Hello, I see the error is: Dec 15 13:50:26 fooserver1 /usr/sbin/kamailio[12125]: ERROR: db_postgres [km_pg_con.c:82]: db_postgres_new_connection(): SSL SYSCALL error: Resource temporarily unavailable#012FATAL: no pg_hba.conf entry for host "129.240.1.1", user "foo_test_user", database " foo_test", SSL off#012 TLS module is initializing the libssl instance, because it needs to set the shared memory manager for handling tls connections. It was working fine so far. Can you get more from the above log message related to postgres? TLS module initializes ok. Cheers, Daniel On 15/12/14 14:03, Øyvind Kolbu wrote: > Hi, > > I'm trying to add tls to our services, but seem hindered by > "something". When enabling the tls > module it seems to turn off the SSL setting in postgresql, and since > we require SSL on our postgres servers > Kamailio can't connect and it fails to start. > > If I disable WITH_TLS it will start. If I comment out the sqlops > modparam it will also start. > > Kamailio on RHEL6, from ~4.1.6 git rev > 2f690887b45dbc49a8038b1fa041d47cd9ae39ea. > > # kamailio -V > version: kamailio 4.1.6 (x86_64/linux) > flags: STATS: Off, USE_TCP, USE_TLS, TLS_HOOKS, USE_RAW_SOCKS, > DISABLE_NAGLE, USE_MCAST, DNS_IP_HACK, SHM_MEM, SHM_MMAP, PKG_MALLOC, > DBG_QM_MALLOC, USE_FUTEX, FAST_LOCK-ADAPTIVE_WAIT, USE_DNS_CACHE, > USE_DNS_FAILOVER, USE_NAPTR, USE_DST_BLACKLIST, HAVE_RESOLV_RES > ADAPTIVE_WAIT_LOOPS=1024, MAX_RECV_BUFFER_SIZE 262144, MAX_LISTEN 16, > MAX_URI_SIZE 1024, BUF_SIZE 65535, DEFAULT PKG_SIZE 4MB > poll method support: poll, epoll_lt, epoll_et, sigio_rt, select. > id: unknown > compiled on 16:48:10 Sep 26 2014 with gcc 4.4.7 > > Very simpel config file: > > debug=3 > log_stderror=no > log_facility=LOG_LOCAL0 > > fork=yes > children=2 > > #!define TLSFILE "/kamailio/tls-fooserver1.cfg" > > port=5060 > > #!define WITH_TLS > #!ifdef WITH_TLS > enable_tls=yes > #!endif > > include_file "/kamailio/databases.cfg" > > loadmodule "tm.so" # Transaction (stateful) module > loadmodule "tmx.so" # Extensions from Kamailio TM module > loadmodule "sl.so" # Stateless replier module > loadmodule "rr.so" # Record-Route and Route module > loadmodule "pv.so" # Module holding Pseudo-Variables > loadmodule "sqlops.so" # SQL operations > > loadmodule "db_postgres.so" # POSTGRES-backend for database API > module > > #!ifdef WITH_TLS > loadmodule "tls.so" > #!endif > > modparam("sqlops","sqlcon",SQLOPS_DATA) > > #!ifdef WITH_TLS > modparam("tls", "config", TLSFILE) > #!endif > > route{ > exit; > } > > SQLOPS_DATA is just a normal "data=>postgres://user:pass@server/db". > > TLSFILE contains: > [server:default] > method = TLSv1 > verify_certificate = no > require_certificate = no > private_key = /ssl/key > certificate = /ssl/cert > ca_list = /ssl/terena_chain2.pem > > [client:default] > verify_certificate = no > require_certificate = no > > From messages on startup: > > Dec 15 13:50:19 fooserver1 kamailio[12115]: INFO: tls > [tls_init.c:385]: init_tls_compression(): tls: init_tls: disabling > compression... > Dec 15 13:50:19 fooserver1 kamailio[12115]: INFO: <core> > [tcp_main.c:4836]: init_tcp(): init_tcp: using epoll_lt as the io > watch method (auto detected) > Dec 15 13:50:19 fooserver1 kamailio[12118]: WARNING: <core> > [daemonize.c:352]: daemonize(): pid file contains old pid, replacing > pid > Dec 15 13:50:19 fooserver1 /usr/sbin/kamailio[12118]: INFO: rr > [../outbound/api.h:54]: ob_load_api(): Failed to import bind_ob > Dec 15 13:50:19 fooserver1 /usr/sbin/kamailio[12118]: INFO: rr > [rr_mod.c:159]: mod_init(): outbound module not available > Dec 15 13:50:19 fooserver1 /usr/sbin/kamailio[12118]: INFO: tls > [tls_mod.c:346]: mod_init(): With ECDH-Support! > Dec 15 13:50:19 fooserver1 /usr/sbin/kamailio[12118]: INFO: tls > [tls_mod.c:349]: mod_init(): With Diffie Hellman > Dec 15 13:50:19 fooserver1 /usr/sbin/kamailio[12118]: INFO: tls > [tls_init.c:549]: init_tls_h(): tls: _init_tls_h: compiled with > openssl version "OpenSSL 1.0.1e-fips 11 Feb 2013" (0x1000105f), > kerberos support: on, compression: on > Dec 15 13:50:19 fooserver1 /usr/sbin/kamailio[12118]: INFO: tls > [tls_init.c:557]: init_tls_h(): tls: init_tls_h: installed openssl > library version "OpenSSL 1.0.1e-fips 11 Feb 2013" (0x1000105f), > kerberos support: on, zlib compression: on#012 compiler: gcc -fPIC -DO > PENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN > -DHAVE_DLFCN_H -DKRB5_MIT -m64 -DL_ENDIAN -DTERMIO -Wall -O2 -g -pipe > -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector > --param=ssp-buffer-size=4 -m64 -mtune=generic -Wa,--noexecstack > -DPURIFY -DOPEN > SSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 > -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM > -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM > Dec 15 13:50:19 fooserver1 /usr/sbin/kamailio[12118]: WARNING: tls > [tls_init.c:611]: init_tls_h(): tls: openssl bug #1491 (crash/mem > leaks on low memory) workaround enabled (on low memory tls operations > will fail preemptively) with free memory thresholds 5242880 and > 2621440 bytes > Dec 15 13:50:19 fooserver1 /usr/sbin/kamailio[12118]: INFO: <core> > [cfg/cfg_ctx.c:613]: cfg_set_now(): INFO: cfg_set_now(): > tls.low_mem_threshold1 has been changed to 5242880 > Dec 15 13:50:19 fooserver1 /usr/sbin/kamailio[12118]: INFO: <core> > [cfg/cfg_ctx.c:613]: cfg_set_now(): INFO: cfg_set_now(): > tls.low_mem_threshold2 has been changed to 2621440 > Dec 15 13:50:19 fooserver1 /usr/sbin/kamailio[12118]: INFO: <core> > [udp_server.c:176]: probe_max_receive_buffer(): INFO: udp_init: > SO_RCVBUF is initially 124928 > Dec 15 13:50:19 fooserver1 /usr/sbin/kamailio[12118]: INFO: <core> > [udp_server.c:227]: probe_max_receive_buffer(): INFO: udp_init: > SO_RCVBUF is finally 249856 > Dec 15 13:50:19 fooserver1 /usr/sbin/kamailio[12118]: INFO: <core> > [udp_server.c:176]: probe_max_receive_buffer(): INFO: udp_init: > SO_RCVBUF is initially 124928 > Dec 15 13:50:19 fooserver1 /usr/sbin/kamailio[12118]: INFO: <core> > [udp_server.c:227]: probe_max_receive_buffer(): INFO: udp_init: > SO_RCVBUF is finally 249856 > Dec 15 13:50:19 fooserver1 /usr/sbin/kamailio[12118]: INFO: tls > [tls_domain.c:275]: fill_missing(): TLSs<default>: tls_method=9 > Dec 15 13:50:19 fooserver1 /usr/sbin/kamailio[12118]: INFO: tls > [tls_domain.c:287]: fill_missing(): TLSs<default>: > certificate='/path/ssl/fooserver1.uio.no.crt' > Dec 15 13:50:19 fooserver1 /usr/sbin/kamailio[12118]: INFO: tls > [tls_domain.c:294]: fill_missing(): TLSs<default>: > ca_list='/voip/packages/mgmt/ssl/terena_chain2.pem' > Dec 15 13:50:19 fooserver1 /usr/sbin/kamailio[12118]: INFO: tls > [tls_domain.c:301]: fill_missing(): TLSs<default>: crl='(null)' > Dec 15 13:50:19 fooserver1 /usr/sbin/kamailio[12118]: INFO: tls > [tls_domain.c:305]: fill_missing(): TLSs<default>: > require_certificate=0 > Dec 15 13:50:19 fooserver1 /usr/sbin/kamailio[12118]: INFO: tls > [tls_domain.c:312]: fill_missing(): TLSs<default>: cipher_list='(null)' > Dec 15 13:50:19 fooserver1 /usr/sbin/kamailio[12118]: INFO: tls > [tls_domain.c:319]: fill_missing(): TLSs<default>: > private_key='/path/ssl/fooserver1.uio.no.key' > Dec 15 13:50:19 fooserver1 /usr/sbin/kamailio[12118]: INFO: tls > [tls_domain.c:323]: fill_missing(): TLSs<default>: verify_certificate=0 > Dec 15 13:50:19 fooserver1 /usr/sbin/kamailio[12118]: INFO: tls > [tls_domain.c:326]: fill_missing(): TLSs<default>: verify_depth=9 > Dec 15 13:50:23 fooserver1 /usr/sbin/kamailio[12118]: INFO: tls > [tls_domain.c:670]: set_verification(): TLSs<default>: No client > certificate required and no checks performed > Dec 15 13:50:23 fooserver1 /usr/sbin/kamailio[12118]: INFO: tls > [tls_domain.c:275]: fill_missing(): TLSc<default>: tls_method=9 > Dec 15 13:50:23 fooserver1 /usr/sbin/kamailio[12118]: INFO: tls > [tls_domain.c:287]: fill_missing(): TLSc<default>: certificate='(null)' > Dec 15 13:50:23 fooserver1 /usr/sbin/kamailio[12118]: INFO: tls > [tls_domain.c:294]: fill_missing(): TLSc<default>: ca_list='(null)' > Dec 15 13:50:23 fooserver1 /usr/sbin/kamailio[12118]: INFO: tls > [tls_domain.c:301]: fill_missing(): TLSc<default>: crl='(null)' > Dec 15 13:50:23 fooserver1 /usr/sbin/kamailio[12118]: INFO: tls > [tls_domain.c:305]: fill_missing(): TLSc<default>: > require_certificate=0 > Dec 15 13:50:23 fooserver1 /usr/sbin/kamailio[12118]: INFO: tls > [tls_domain.c:312]: fill_missing(): TLSc<default>: cipher_list='(null)' > Dec 15 13:50:23 fooserver1 /usr/sbin/kamailio[12118]: INFO: tls > [tls_domain.c:319]: fill_missing(): TLSc<default>: private_key='(null)' > Dec 15 13:50:23 fooserver1 /usr/sbin/kamailio[12118]: INFO: tls > [tls_domain.c:323]: fill_missing(): TLSc<default>: verify_certificate=0 > Dec 15 13:50:23 fooserver1 /usr/sbin/kamailio[12118]: INFO: tls > [tls_domain.c:326]: fill_missing(): TLSc<default>: verify_depth=9 > Dec 15 13:50:23 fooserver1 /usr/sbin/kamailio[12118]: INFO: tls > [tls_domain.c:673]: set_verification(): TLSc<default>: Server MAY > present invalid certificate > Dec 15 13:50:26 fooserver1 /usr/sbin/kamailio[12125]: ERROR: > db_postgres [km_pg_con.c:82]: db_postgres_new_connection(): SSL > SYSCALL error: Resource temporarily unavailable#012FATAL: no > pg_hba.conf entry for host "129.240.1.1", user "foo_test_user", > database " > foo_test", SSL off#012 > Dec 15 13:50:26 fooserver1 /usr/sbin/kamailio[12125]: ERROR: > db_postgres [km_pg_con.c:95]: db_postgres_new_connection(): cleaning > up 0x7fce98be0c78=pkg_free() > Dec 15 13:50:26 fooserver1 /usr/sbin/kamailio[12125]: ERROR: <core> > [db.c:322]: db_do_init2(): could not add connection to the pool > Dec 15 13:50:26 fooserver1 /usr/sbin/kamailio[12125]: ERROR: sqlops > [sql_api.c:166]: sql_connect(): failed to connect to the database > [data] > Dec 15 13:50:26 fooserver1 /usr/sbin/kamailio[12125]: ERROR: <core> > [sr_module.c:927]: init_mod_child(): init_mod_child(): Error while > initializing module sqlops (/usr/lib64/kamailio/modules/sqlops.so) > Dec 15 13:50:26 fooserver1 /usr/sbin/kamailio[12125]: ERROR: <core> > [pt.c:490]: fork_tcp_process(): ERROR: fork_tcp_process(): init_child > failed for process 7, pid 12125, "tcp receiver (generic) child=0" > Dec 15 13:50:26 fooserver1 /usr/sbin/kamailio[12125]: ERROR: <core> > [tcp_main.c:4962]: tcp_init_children(): ERROR: tcp_main: fork failed: > Success > Dec 15 13:50:26 fooserver1 /usr/sbin/kamailio[12118]: ALERT: <core> > [main.c:774]: handle_sigs(): child process 12125 exited normally, > status=255 > Dec 15 13:50:26 fooserver1 /usr/sbin/kamailio[12118]: INFO: <core> > [main.c:792]: handle_sigs(): INFO: terminating due to SIGCHLD > Dec 15 13:50:26 fooserver1 /usr/sbin/kamailio[12126]: INFO: <core> > [main.c:843]: sig_usr(): INFO: signal 15 received > Dec 15 13:50:26 fooserver1 /usr/sbin/kamailio[12124]: INFO: <core> > [main.c:843]: sig_usr(): INFO: signal 15 received > Dec 15 13:50:26 fooserver1 /usr/sbin/kamailio[12123]: INFO: <core> > [main.c:843]: sig_usr(): INFO: signal 15 received > Dec 15 13:50:26 fooserver1 /usr/sbin/kamailio[12122]: INFO: <core> > [main.c:843]: sig_usr(): INFO: signal 15 received > Dec 15 13:50:26 fooserver1 /usr/sbin/kamailio[12121]: INFO: <core> > [main.c:843]: sig_usr(): INFO: signal 15 received > Dec 15 13:50:26 fooserver1 /usr/sbin/kamailio[12120]: INFO: <core> > [main.c:843]: sig_usr(): INFO: signal 15 received > Dec 15 13:50:26 fooserver1 /usr/sbin/kamailio[12127]: INFO: <core> > [main.c:843]: sig_usr(): INFO: signal 15 received > > Any ideas? > > Best regards, > Øyvind > > _______________________________________________ > SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list > sr-users(a)lists.sip-router.org > http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users

The question would be more specific to the error message printed from postgres client library: FATAL: no pg_hba.conf entry for host "129.240.1.1", user "foo_test_user", database " foo_test", SSL off

Is it something that is documented somewhere or maybe some web search can indicate the reasons why it happens? Can you try loading tls module before db_postgres?

TLS module initializes libssl when it is loaded. db_postgress creates connections at mod init, so it is later and inside same process (no fork at that moment). Based on the new details, I understand that some connections succeed, some not, and even sometimes all connection succeed (when having lot of log messages that add delay). What is the operating system you have? Is selinux enabled? You can try to play with fork_delay and modinit_delay core parameters: - http://www.kamailio.org/wiki/cookbooks/4.2.x/core#fork_delay

Those parameters are not about number of children, but how fast to do some operations. I had troubles with selinux, because it has some obscure limits on how fast new connections can be opened. TLS is using quite some memory, I wonder if selinux have a limit on how fast one process keeps allocating... Have you tried with children=1?

there is an extra space, " foo_test" vs "foo_test". That might turn out to be the entire issue.

Searching on google about libpq and tls I found the notes about SSL Initialization at: - http://www.postgresql.org/docs/9.3/static/libpq-ssl.html Scroll down the page. Can you try adding: PQinitSSL(0); inside function: struct pg_con* db_postgres_new_connection(struct db_id* id) in file: modules/db_postgres/km_pg_con.c Before line with: ptr->con = PQsetdbLogin(id->host, ports, ... If works, we have to make that optional via modparam or try auto-detect if ssl is initialized (finding tls is loaded, but some other modules can do it, even when tls is not initialized, so mod param could be a safe way).