From laurent at elanor.org  Fri Jan  3 14:14:27 2014
From: laurent at elanor.org (Laurent Blume)
Date: Fri, 03 Jan 2014 14:14:27 +0100
Subject: [pca] Issue with wget on RHEL6.5
Message-ID: <52C6B7B3.8040501@elanor.org>

Hello all, and Happy New Year!

To start it properly - I've found a PCA issue. It's been a while since 
I've found one.

I'm running PCA as a proxy on a RHEL6 machine, Apparently, since early 
December and an update to 6.5, it fails connecting to 
getupdates.oracle.com (through a web proxy) with a message saying: 
Unable to establish SSL connection.

After comparing with a Solaris box where it was working, I noticed this 
parameter was present when running on Solaris, not on RHEL:
--secure-protocol=TLSv1

Adding it manually, it connects.

So this bit of the code should be modified to add the parameter in other 
cases than OpenCSW:

   if ((($url =~ /https:\/\/getupdates.oracle.com\//) || ($url =~ 
/https:\/\/support.oracle.com\//)) && ($wget{path} =~ /csw/)) { $cmd .= 
" --secure-protocol=TLSv1" }

So, wget was *not* updated. It's still 1.12, the binary dated Oct 2012.
OpenSSL was updated, so it's probably coming from that.

I'd say, just always add the parameter. It works with /usr/sfw/bin/wget 
(in a recently patched S10 at least) as well as with wget on RHEL >= 5.

Thanks,

Laurent


From martin.paul at univie.ac.at  Tue Jan  7 12:50:15 2014
From: martin.paul at univie.ac.at (Martin Paul)
Date: Tue, 07 Jan 2014 12:50:15 +0100
Subject: [pca] Issue with wget on RHEL6.5
In-Reply-To: <52C6B7B3.8040501@elanor.org>
References: <52C6B7B3.8040501@elanor.org>
Message-ID: <52CBE9F7.7040608@univie.ac.at>

Happy new year to everbody!

> I'm running PCA as a proxy on a RHEL6 machine, Apparently, since early
> December and an update to 6.5, it fails connecting to
> getupdates.oracle.com (through a web proxy) with a message saying:
> Unable to establish SSL connection.

Yeah, you had reported this problem already back in May 2013, and I had 
added the temporary fix for the CSW version of wget back then. The root 
cause was (and is) a problem with Oracle's web server:

   https://www.opencsw.org/mantis/view.php?id=5068

Oracle's web admin team planned to upgrade the web server to support 
clients with recent versions of OpenSSL, but it seems as if this never 
happened. They put a note into Support Document 1199543.1, which is 
still there:

   IMPORTANT:

   https://getupdates.oracle.com web server does not fully support TLS
   1.2. Only OpenSSL versions from branch 1.0.0 will work - Oracle
   Solaris does not deliver higher versions at this time.
   Customers who are trying to access the URL using latest wget/OpenSSL
   (ie. from www.opencsw.org) version with TLS 1.2 support may get
   connection failures.

> I'd say, just always add the parameter. It works with /usr/sfw/bin/wget
> (in a recently patched S10 at least) as well as with wget on RHEL >= 5.

Did exactly that in the current development release of PCA now. It seems 
as if the --secure-protocol option is supported in all relevant versions 
of wget, so this should do no harm.

Thanks for the report!

Martin.


From bl at gfz-potsdam.de  Mon Jan 13 14:42:28 2014
From: bl at gfz-potsdam.de (Thomas Bleek)
Date: Mon, 13 Jan 2014 14:42:28 +0100
Subject: [pca] Issue with wget on RHEL6.5
In-Reply-To: <52CBE9F7.7040608@univie.ac.at>
References: <52C6B7B3.8040501@elanor.org> <52CBE9F7.7040608@univie.ac.at>
Message-ID: <C03BAB08-7725-4827-B43C-4FA7B72F31FE@gfz-potsdam.de>

Hello Martin, hello list,

I just noticed problems with download again. It seems to be a certificate problem (CA). I tried the developer version just downloadad, same problem.
MOS is working.

The debug output below.

Any hints?

Thanks for your wonderful pca!

Thomas

pca -d 150162-02
Option download: 1
Option patchdir: /tmp/.
Option user: <user>
Option passwd: <passwd>
Option ignore: 121735
Option debug: 1
Command: /usr/local/bin/pca
ARGV: 150162-02
Version: 20140107-01
CWD: /tmp
Config files: /usr/local/bin/../etc/pca.conf 
Found /usr/sfw/bin/wget (1.12, 11200, https)
Using /usr/sfw/bin/wget
Found /usr/bin/uname
Prerequisites for threads not met, setting threads to 0
Never update
Expanded patch list: 150162-02
xref mtime: Fri Jan 10 03:45:30 2014
xref now  : Mon Jan 13 14:33:47 2014
xref ctime: Mon Jan 13 14:32:49 2014
xref age  : 58
Local file /var/tmp/patchdiag.xref is up to date
osname from uname: SunOS
Reading from /usr/bin/showrev -p  2>/dev/null
patchdiag.xref size: 2348497
Using /var/tmp/patchdiag.xref from Jan/09/14
All operands are fully qualified patch IDs plus revisions
Host: xxxx (SunOS 5.10/Generic_150401-06/i386/i86pc)
List: 150162-02 (1/0)

Patch  IR   CR RSB Age Synopsis
------ -- - -- --- --- -------------------------------------------------------
150162 02 = 02 ---  91 SunOS 5.10_x86: nfssrv patch

Looking for 150162-02 (1/1)
Trying Oracle
Trying https://getupdates.oracle.com/ (1/1)
src: oracle, srcurl: 
Adding to /tmp/pca.811466: header=Authorization: Basic <base64-user-passwd>
/usr/sfw/bin/wget --progress=dot:binary --ca-certificate=/usr/local/bin/pca --secure-protocol=TLSv1 -O /tmp/./150162-02.zip "https://getupdates.oracle.com/all_unsigned/150162-02.zip"
--2014-01-13 14:33:48--  https://getupdates.oracle.com/all_unsigned/150162-02.zip
Resolving getupdates.oracle.com... 141.146.44.51
Connecting to getupdates.oracle.com|141.146.44.51|:443... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Cookie coming from updates.oracle.com attempted to set domain to updates.oracle.com
Location: https://login.oracle.com/pls/orasso/orasso.wwsso_app_admin.ls_login?site2pstoretoken=v1.2~E4066BF0~EB48F0A1deletedsomecharsC1EA8D94D847CE1FB145BF9288CDC12D506FF77D1491F1E2F269FC45B3AC795A6AF30E2CED0BA4EB3C49790A9C660493454F598FD38C81C907A9E7F49E3441A73CB687641FC184BD2DA37F0CA1FC8B09F47CD832DBD083ECC6F85D [following]
--2014-01-13 14:33:49--  https://login.oracle.com/pls/orasso/orasso.wwsso_app_admin.ls_login?site2pstoretoken=v1.2~E4066BF0~EB48F0A1434Adeletedsomechars660493454F598FD38C81C907A9E7F49E3441A73CB687641FC184BD2DA37F0CA1FC8B09F47CD832DBD083ECC6F85D
Resolving login.oracle.com... 209.17.4.8
Connecting to login.oracle.com|209.17.4.8|:443... connected.
ERROR: cannot verify login.oracle.com's certificate, issued by `/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 International Server CA - G3':
  Unable to locally verify the issuer's authority.
To connect to login.oracle.com insecurely, use `--no-check-certificate'.
Removing /tmp/pca.811466
Failed (Unknown Error)
Failed (patch not found)
------------------------------------------------------------------------------
Download Summary: 1 total, 0 successful, 0 skipped, 1 failed


Am 07.01.2014 um 12:50 schrieb Martin Paul <martin.paul at univie.ac.at>:

> Happy new year to everbody!
> 
>> I'm running PCA as a proxy on a RHEL6 machine, Apparently, since early
>> December and an update to 6.5, it fails connecting to
>> getupdates.oracle.com (through a web proxy) with a message saying:
>> Unable to establish SSL connection.
> 
> Yeah, you had reported this problem already back in May 2013, and I had added the temporary fix for the CSW version of wget back then. The root cause was (and is) a problem with Oracle's web server:
> 
>  https://www.opencsw.org/mantis/view.php?id=5068
> 
> Oracle's web admin team planned to upgrade the web server to support clients with recent versions of OpenSSL, but it seems as if this never happened. They put a note into Support Document 1199543.1, which is still there:
> 
>  IMPORTANT:
> 
>  https://getupdates.oracle.com web server does not fully support TLS
>  1.2. Only OpenSSL versions from branch 1.0.0 will work - Oracle
>  Solaris does not deliver higher versions at this time.
>  Customers who are trying to access the URL using latest wget/OpenSSL
>  (ie. from www.opencsw.org) version with TLS 1.2 support may get
>  connection failures.
> 
>> I'd say, just always add the parameter. It works with /usr/sfw/bin/wget
>> (in a recently patched S10 at least) as well as with wget on RHEL >= 5.
> 
> Did exactly that in the current development release of PCA now. It seems as if the --secure-protocol option is supported in all relevant versions of wget, so this should do no harm.
> 
> Thanks for the report!
> 
> Martin.
> 

--
Dr. Thomas Bleek, Netzwerkadministrator
Helmholtz-Zentrum Potsdam
Deutsches GeoForschungsZentrum
Telegrafenberg A20/225
D-14473 Potsdam
Tel.: +49 331 288- 1818/1681 Fax.: 1730 Mobil: +49 172 1543233
E-Mail: bl at gfz-potsdam.de

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.univie.ac.at/pipermail/pca/attachments/20140113/3f63ab54/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4685 bytes
Desc: not available
URL: <https://lists.univie.ac.at/pipermail/pca/attachments/20140113/3f63ab54/attachment.bin>

From martin.paul at univie.ac.at  Mon Jan 13 15:14:54 2014
From: martin.paul at univie.ac.at (Martin Paul)
Date: Mon, 13 Jan 2014 15:14:54 +0100
Subject: [pca] Issue with wget on RHEL6.5
In-Reply-To: <C03BAB08-7725-4827-B43C-4FA7B72F31FE@gfz-potsdam.de>
References: <52C6B7B3.8040501@elanor.org> <52CBE9F7.7040608@univie.ac.at>
	<C03BAB08-7725-4827-B43C-4FA7B72F31FE@gfz-potsdam.de>
Message-ID: <52D3F4DE.7070400@univie.ac.at>

Am 13.01.2014 14:42, schrieb Thomas Bleek:
> I just noticed problems with download again. It seems to be a
> certificate problem (CA). I tried the developer version just
> downloadad, same problem. MOS is working.

Something is wrong with the certificates indeed - I get a similar error:

Connecting to getupdates.oracle.com|141.146.44.51|:443... connected.
ERROR: cannot verify getupdates.oracle.com's certificate, issued by 
`/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at 
https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 International 
Server CA - G3':
   Unable to locally verify the issuer's authority.

When using pca with --wgetopt "--no-check-certificate" I can get past 
the certificate authorization, but the download fails anyway:

Resolving login.oracle.com... 209.17.4.8
Connecting to login.oracle.com|209.17.4.8|:443... connected.
HTTP request sent, awaiting response... 401 Unauthorized
Authorization failed.

No idea on what's wrong. Sigh.

Martin.


From dclarke at adbs.ca  Mon Jan 13 20:01:26 2014
From: dclarke at adbs.ca (Dennis Clarke)
Date: Mon, 13 Jan 2014 14:01:26 -0500
Subject: [pca] WARNING: cannot verify login.oracle.com's certificate
Message-ID: <52D43806.8010104@adbs.ca>

World class annoying little thing is happening :


Looking for 119757-29 (5/83)
Trying Oracle
Trying https://getupdates.oracle.com/ (1/1)
src: oracle, srcurl:
wgetrc: found /root/.wgetrc
Adding to /tmp/pca.225478: header=Authorization: Basic <base64-user-passwd>
/usr/sfw/bin/wget --progress=dot:binary --ca-certificate=/root/bin/pca 
-O /root/pca_data/neptune/archive/119757-29.zip 
"https://getupdates.oracle.com/all_unsigned/119757-29.zip"
--2014-01-13 18:36:52-- 
https://getupdates.oracle.com/all_unsigned/119757-29.zip
Resolving getupdates.oracle.com... 141.146.44.51
Connecting to getupdates.oracle.com|141.146.44.51|:443... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Cookie coming from updates.oracle.com attempted to set domain to 
updates.oracle.com
Location: 
https://login.oracle.com/pls/orasso/orasso.wwsso_app_admin.ls_login?site2pstoretoken=v1.2~E4066BF0~F7D3F0395815C0E25.....AA476 
[following]
--2014-01-13 18:36:52-- 
https://login.oracle.com/pls/orasso/orasso.wwsso_app_admin.ls_login?site2pstoretoken=v1.2~E4066BF0~F7D3F0395815C0E25.....AA476
Resolving login.oracle.com... 209.17.4.8
Connecting to login.oracle.com|209.17.4.8|:443... connected.
WARNING: cannot verify login.oracle.com's certificate, issued by 
`/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at 
https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 International 
Server CA - G3':
   Unable to locally verify the issuer's authority.
HTTP request sent, awaiting response... 401 Unauthorized
Authorization failed.
Removing /tmp/pca.225478
Failed (Error 401: Unauthorized)
Failed (patch not found)


So that kills every patch download right there.

I have tried this :

# cat /root/.wgetrc
progress=dot:mega
check-certificate=off


No change.



Any thoughts or shall I need to mess about with getting a cacert path 
sorted out
as well as a ca-cert tarball out of mozilla sources and all that jazz ?


Here are my envionment variables if that helps :

# env | sort
CC=cc
COLUMNS=132
CXX=CC
EDITOR=/usr/xpg4/bin/vi
HOME=/root
HZ=
LANG=en_US.UTF-8
LC_ALL=en_US.UTF-8
LC_COLLATE=en_US.UTF-8
LC_CTYPE=en_US.UTF-8
LC_MESSAGES=en_US.UTF-8
LC_MONETARY=en_US.UTF-8
LC_NUMERIC=en_US.UTF-8
LC_TIME=en_US.UTF-8
LINES=43
LOGNAME=root
MACHINE=neptune
MAIL=/usr/mail/root
PATH=/usr/xpg6/bin:/usr/xpg4/bin:/usr/ccs/bin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/dt/bin:/usr/openwin/bin:/usr/X11/bin:/opt/schily/bin:/usr/platform/SUNW,Sun-Fire-V210/sbin
PCA_FROMFILES=/root/pca_data/neptune/system_data
PCA_PASSWD=XXXXXXXXXX
PCA_PATCHDIR=/root/pca_data/neptune/archive
PCA_USER=XXXXXXXXXX
PCA_WGET=/usr/sfw/bin/wget
PCA_XREFDIR=/root/pca_data/xref
SHELL=/usr/xpg4/bin/sh
TERM=xterm
TZ=GMT0
VISUAL=/usr/xpg4/bin/vi


Dennis



From martin.paul at univie.ac.at  Tue Jan 14 08:39:19 2014
From: martin.paul at univie.ac.at (Martin Paul)
Date: Tue, 14 Jan 2014 08:39:19 +0100
Subject: [pca] WARNING: cannot verify login.oracle.com's certificate
In-Reply-To: <52D43806.8010104@adbs.ca>
References: <52D43806.8010104@adbs.ca>
Message-ID: <52D4E9A7.3010801@univie.ac.at>

Hi Dennis and all,

as reported, patch downloads stopped to work yesterday. The first 
problem was that there seems to be a new certificate used for HTTPS on 
login.oracle.com, signed by different CA certificates than before.

While this problem could be worked around, patch downloads still failed 
as login.oracle.com answered all authentication requests with "401 
Unauthorized". This second problem seems to have gone away (or fixed by 
Oracle) over night.

I fixed the problem with the HTTPS certs by including the necessary CA 
certs in the current development release of PCA:

   http://www.par.univie.ac.at/solaris/pca/develop/pca

Please try that and see if the downloads work again and let me know 
about it. I will then release a new stable release of PCA.

Martin.


From bl at gfz-potsdam.de  Tue Jan 14 11:13:13 2014
From: bl at gfz-potsdam.de (Thomas Bleek)
Date: Tue, 14 Jan 2014 11:13:13 +0100
Subject: [pca] WARNING: cannot verify login.oracle.com's certificate
In-Reply-To: <52D4E9A7.3010801@univie.ac.at>
References: <52D43806.8010104@adbs.ca> <52D4E9A7.3010801@univie.ac.at>
Message-ID: <0D47F61C-F01D-401F-AA99-C30B65B6BD43@gfz-potsdam.de>

Hi Martin,

the new developer version has solved my problem.

Thanks a lot again,
Thomas

Am 14.01.2014 um 08:39 schrieb Martin Paul <martin.paul at univie.ac.at>:

> Hi Dennis and all,
> 
> as reported, patch downloads stopped to work yesterday. The first problem was that there seems to be a new certificate used for HTTPS on login.oracle.com, signed by different CA certificates than before.
> 
> While this problem could be worked around, patch downloads still failed as login.oracle.com answered all authentication requests with "401 Unauthorized". This second problem seems to have gone away (or fixed by Oracle) over night.
> 
> I fixed the problem with the HTTPS certs by including the necessary CA certs in the current development release of PCA:
> 
>  http://www.par.univie.ac.at/solaris/pca/develop/pca
> 
> Please try that and see if the downloads work again and let me know about it. I will then release a new stable release of PCA.
> 
> Martin.
> 

--
Dr. Thomas Bleek, Netzwerkadministrator
Helmholtz-Zentrum Potsdam
Deutsches GeoForschungsZentrum
Telegrafenberg A20/225
D-14473 Potsdam
Tel.: +49 331 288- 1818/1681 Fax.: 1730 Mobil: +49 172 1543233
E-Mail: bl at gfz-potsdam.de

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.univie.ac.at/pipermail/pca/attachments/20140114/88291a65/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4685 bytes
Desc: not available
URL: <https://lists.univie.ac.at/pipermail/pca/attachments/20140114/88291a65/attachment.bin>

From dclarke at blastwave.org  Tue Jan 14 14:56:56 2014
From: dclarke at blastwave.org (Dennis Clarke)
Date: Tue, 14 Jan 2014 08:56:56 -0500
Subject: [pca] WARNING: cannot verify login.oracle.com's certificate
In-Reply-To: <0D47F61C-F01D-401F-AA99-C30B65B6BD43@gfz-potsdam.de>
References: <52D43806.8010104@adbs.ca> <52D4E9A7.3010801@univie.ac.at>
	<0D47F61C-F01D-401F-AA99-C30B65B6BD43@gfz-potsdam.de>
Message-ID: <72d0b0657ac5.52d4fbd8@blastwave.org>



On 01/14/14, Thomas Bleek  wrote:
> 
> 
> 
> Hi Martin,
> 
> the new developer version has solved my problem.
> 

I will give that a try this morning. Thank you for letting me know it works for you.

Dennis


From dclarke at adbs.ca  Tue Jan 14 14:59:54 2014
From: dclarke at adbs.ca (Dennis Clarke)
Date: Tue, 14 Jan 2014 08:59:54 -0500
Subject: [pca] WARNING: cannot verify login.oracle.com's certificate
In-Reply-To: <52D4E9A7.3010801@univie.ac.at>
References: <52D43806.8010104@adbs.ca> <52D4E9A7.3010801@univie.ac.at>
Message-ID: <52D542DA.3060801@adbs.ca>

On 14/01/14 02:39 AM, Martin Paul wrote:
> Hi Dennis and all,
>
> as reported, patch downloads stopped to work yesterday. The first 
> problem was that there seems to be a new certificate used for HTTPS on 
> login.oracle.com, signed by different CA certificates than before.

So Oracle is broken again.  OKay.   Not surprised.

Once again I find it only slightly amazing that when I try to get some
patches, for the first time in three months, an Oracle service is
broken.

Sort of like walking into a casino and then to the nearest roulette
wheel and dropping 100 dollars on number 14, and winning.  In fact the
probability of that event is much higher than Oracle being broken on the
very day I look for patches for the first time since late September.

Not sure how to wrap my brain around that.

PCA is awesome and I must toss money in the bucket.  In fact, I am
really trying and to do just that for you Martin.  This morning I try to
toss $120 CDN at you and my stupid paypal account says "we can't do that
right now" for totally obscure reasons.  Yet another service not working
this morning.  I will go stare at my coffee cup for a while perhaps and
I will let you know if the new PCA version works for me.

Dennis



From Richard.Skelton at infineon.com  Tue Jan 14 15:38:00 2014
From: Richard.Skelton at infineon.com (Richard Skelton)
Date: Tue, 14 Jan 2014 14:38:00 +0000
Subject: [pca] WARNING: cannot verify login.oracle.com's certificate
In-Reply-To: <52D4E9A7.3010801@univie.ac.at>
References: <52D43806.8010104@adbs.ca> <52D4E9A7.3010801@univie.ac.at>
Message-ID: <52D54BC8.4070105@infineon.com>

Hi Martin,
The new development version is working for us :-)

On 01/14/14 07:39, Martin Paul wrote:
> Hi Dennis and all,
>
> as reported, patch downloads stopped to work yesterday. The first 
> problem was that there seems to be a new certificate used for HTTPS on 
> login.oracle.com, signed by different CA certificates than before.
>
> While this problem could be worked around, patch downloads still 
> failed as login.oracle.com answered all authentication requests with 
> "401 Unauthorized". This second problem seems to have gone away (or 
> fixed by Oracle) over night.
>
> I fixed the problem with the HTTPS certs by including the necessary CA 
> certs in the current development release of PCA:
>
>   http://www.par.univie.ac.at/solaris/pca/develop/pca
>
> Please try that and see if the downloads work again and let me know 
> about it. I will then release a new stable release of PCA.
>
> Martin.
>

-- 



Cheers

Richard Skelton
Richard.Skelton at infineon.com
Infineon Technologies UK Ltd
Infineon House
Great Western Court
Hunts Ground Road
Stoke Gifford
Bristol
BS34 8HP
Tel +44(0)117 952 8808
Fax: +44(0)117 952 8777
Mobile: +44(0)743 6272 137



From dclarke at adbs.ca  Tue Jan 14 15:42:53 2014
From: dclarke at adbs.ca (Dennis Clarke)
Date: Tue, 14 Jan 2014 09:42:53 -0500
Subject: [pca] WARNING: cannot verify login.oracle.com's certificate
In-Reply-To: <52D54BC8.4070105@infineon.com>
References: <52D43806.8010104@adbs.ca> <52D4E9A7.3010801@univie.ac.at>
	<52D54BC8.4070105@infineon.com>
Message-ID: <52D54CED.4080501@adbs.ca>

On 14/01/14 09:38 AM, Richard Skelton wrote:
> Hi Martin,
> The new development version is working for us :-)

seems perfect here also :

Download Summary: 94 total, 94 successful, 0 skipped, 0 failed




From jaearick at colby.edu  Tue Jan 14 16:35:25 2014
From: jaearick at colby.edu (Jeff Earickson)
Date: Tue, 14 Jan 2014 10:35:25 -0500
Subject: [pca] WARNING: cannot verify login.oracle.com's certificate
In-Reply-To: <52D4E9A7.3010801@univie.ac.at>
References: <52D43806.8010104@adbs.ca> <52D4E9A7.3010801@univie.ac.at>
Message-ID: <CADU1O-2Gq-pdx_9+OLov5sE2gHHAtviQgO0vAbYFdpkYgECVHQ@mail.gmail.com>

Martin,

I downloaded the development version and tried it.  A whole bunch of new
patches appeared.  I also discovered that my firewall was blocking a (new
to me) Oracle subnet for downloads: 209.17.0.0/18.

For me, this change was a silent failure.  I was not seeing patches, yet
thought that everything was ok.  Yuck.  I am down to two Sun machines and
will be happy to get rid of them this Summer.

-----------------------------------
Jeff A. Earickson, Ph.D
Senior Server System Administrator
Colby College,
4214 Mayflower Hill,
Waterville ME, 04901-8842
207-859-4214 (fax 207-859-4186)
Eastern Time Zone, USA
-----------------------------------


On Tue, Jan 14, 2014 at 2:39 AM, Martin Paul <martin.paul at univie.ac.at>wrote:

> Hi Dennis and all,
>
> as reported, patch downloads stopped to work yesterday. The first problem
> was that there seems to be a new certificate used for HTTPS on
> login.oracle.com, signed by different CA certificates than before.
>
> While this problem could be worked around, patch downloads still failed as
> login.oracle.com answered all authentication requests with "401
> Unauthorized". This second problem seems to have gone away (or fixed by
> Oracle) over night.
>
> I fixed the problem with the HTTPS certs by including the necessary CA
> certs in the current development release of PCA:
>
>   http://www.par.univie.ac.at/solaris/pca/develop/pca
>
> Please try that and see if the downloads work again and let me know about
> it. I will then release a new stable release of PCA.
>
> Martin.
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.univie.ac.at/pipermail/pca/attachments/20140114/21cf2f42/attachment.html>

From martin.paul at univie.ac.at  Wed Jan 15 10:47:20 2014
From: martin.paul at univie.ac.at (Martin Paul)
Date: Wed, 15 Jan 2014 10:47:20 +0100
Subject: [pca] New release: 20140115-01
Message-ID: <52D65928.6000302@univie.ac.at>

A new release of PCA has just been published. Here's a list of new 
features and changes:

  * Add new CA certs for login.oracle.com
  * Use --secure-protocol=TLSv1 with wget on all connections to Oracle 
server
  * Fix bug in HTML output
  * Whitelist: add 148104, 148105
  * Whitelist: add 150525, 150526

Update:
   pca --update now

Download:
   http://www.par.univie.ac.at/solaris/pca/installation.html

MD5: 96415657cb8f53e4577cf02afb9ef707


From martin.paul at univie.ac.at  Wed Jan 15 10:48:29 2014
From: martin.paul at univie.ac.at (Martin Paul)
Date: Wed, 15 Jan 2014 10:48:29 +0100
Subject: [pca] WARNING: cannot verify login.oracle.com's certificate
In-Reply-To: <52D54CED.4080501@adbs.ca>
References: <52D43806.8010104@adbs.ca>
	<52D4E9A7.3010801@univie.ac.at>	<52D54BC8.4070105@infineon.com>
	<52D54CED.4080501@adbs.ca>
Message-ID: <52D6596D.9060805@univie.ac.at>

Thanks to everybody who tested the development version.

A new stable release is out now. Problem solved.

Martin.


From martin.paul at univie.ac.at  Wed Jan 15 10:52:28 2014
From: martin.paul at univie.ac.at (Martin Paul)
Date: Wed, 15 Jan 2014 10:52:28 +0100
Subject: [pca] WARNING: cannot verify login.oracle.com's certificate
In-Reply-To: <CADU1O-2Gq-pdx_9+OLov5sE2gHHAtviQgO0vAbYFdpkYgECVHQ@mail.gmail.com>
References: <52D43806.8010104@adbs.ca> <52D4E9A7.3010801@univie.ac.at>
	<CADU1O-2Gq-pdx_9+OLov5sE2gHHAtviQgO0vAbYFdpkYgECVHQ@mail.gmail.com>
Message-ID: <52D65A5C.1010402@univie.ac.at>

Am 14.01.2014 16:35, schrieb Jeff Earickson:
> I downloaded the development version and tried it.  A whole bunch of new
> patches appeared.  I also discovered that my firewall was blocking a (new
> to me) Oracle subnet for downloads: 209.17.0.0/18.
>
> For me, this change was a silent failure.  I was not seeing patches, yet
> thought that everything was ok.

I think that's a different issue: Oracle nowadays publishes Solaris 
patches only once per month, and this just happened yesterday. So that's 
what might have confused you.

The problem with PCA was only affecting patch downloads.

Martin.


From dclarke at adbs.ca  Tue Jan 28 17:30:07 2014
From: dclarke at adbs.ca (Dennis Clarke)
Date: Tue, 28 Jan 2014 11:30:07 -0500
Subject: [pca] 18117543 patch 144872-02 is missing a hard requirement
Message-ID: <52E7DB0F.1000806@adbs.ca>

last night at 17 secs after midnight this 144872-03 was slid out the door.

Seems odd to me that Solaris 10 patches are released on specific schedule
except for odd little creatures like this.

Anyways, makes me wonder what bugid 18117543 is.

------------------------------ README.144872-03

Keywords: ifconfig dhcpagent
Synopsis: SunOS 5.10: ifconfig patch
Date: Jan/27/2014


Install Requirements: Reboot after installing this patch to activate the 
changes delivered.  An alternative may be specified in the
Special Install Instructions.
                       Use Single User Mode (run level S) when 
installing this patch on an active boot environment.  An alternative m
ay be specified in the Special Install Instructions.

Solaris Release: 10

SunOS Release: 5.10

Unbundled Product:

Unbundled Release:

Xref: This patch available for x86 as patch 144873

Topic: SunOS 5.10: ifconfig patch

Relevant Architectures: sparc

BugId's fixed with this patch: 17563148 18117543 6208507

Changes incorporated in this version: 18117543

Patches accumulated and obsoleted by this patch: 145019-01

Patches which conflict with this patch:

Patches required with this patch: 118833-36 120011-14 139555-08 
141444-09 147002-01 (or greater)

Obsoleted by:

Files included with this patch:

/lib/svc/method/net-physical
/sbin/ifconfig

Problem Description:

18117543 patch 144872-02 is missing a hard requirement

(from 144872-02)

17563148 Failed to plumb IPv4 interface(s): ibd3

(from 144872-01)

         This revision accumulates generic Sustaining patch 145019-01
         into Solaris S10U9 update.

(from 145019-01)

6208507 net-physical's start method's use of "ifconfig dhcp status" 
starts dhcpagent

Patch Installation Instructions:
--------------------------------

Please refer to the man pages for instructions on using 'patchadd'
and 'patchrm' commands provided with Solaris.

The following example installs a patch to a standalone machine:

        example# patchadd /var/spool/patch/123456-07

The following example removes a patch from a standalone system:

        example# patchrm 123456-07

For additional examples please see the appropriate man pages. Any
other special or non-generic installation instructions should be
described below as special instructions.

Special Install Instructions:
-----------------------------

None.

README -- Last modified date:  Monday, January 27, 2014




From martin.paul at univie.ac.at  Wed Jan 29 09:55:53 2014
From: martin.paul at univie.ac.at (Martin Paul)
Date: Wed, 29 Jan 2014 09:55:53 +0100
Subject: [pca] 18117543 patch 144872-02 is missing a hard requirement
In-Reply-To: <52E7DB0F.1000806@adbs.ca>
References: <52E7DB0F.1000806@adbs.ca>
Message-ID: <52E8C219.5060504@univie.ac.at>

Am 28.01.2014 17:30, schrieb Dennis Clarke:
> last night at 17 secs after midnight this 144872-03 was slid out the door.
>
> Seems odd to me that Solaris 10 patches are released on specific schedule
> except for odd little creatures like this.
>
> Anyways, makes me wonder what bugid 18117543 is.

Oracle support doesn't let me see what BugID 18117543 is about. The main 
difference seems to be that 144872-03 now requires 147002-01 (SunOS 
5.10: libxnet.so patch). My assumption would be that ifconfig requires a 
change or a new function in libxnet.so.1 provided by that patch.

Martin.


From Richard.Skelton at infineon.com  Wed Jan 29 09:56:16 2014
From: Richard.Skelton at infineon.com (Richard Skelton)
Date: Wed, 29 Jan 2014 08:56:16 +0000
Subject: [pca] New patch fails to install because the patchfile is not a
	patchfile
Message-ID: <52E8C230.8010909@infineon.com>

Hi,
I have noticed that some patches fail to install:-

Patch  IR   CR RSB Age Synopsis
------ -- - -- --- --- -------------------------------------------------------
144873 02<  03 R--   2 SunOS 5.10_x86: ifconfig patch

Looking for 144873-03 (1/1)
Tryinghttp://pcaproxy/cgi-bin/pca-proxy.cgi
Failed (unknown file type)
Failed (patch not found)

Installing 144873-03 (1/1)
Failed - missing patch file (07:02:03/00:00:00/00:00:03, 1/1, 0/0/1)
------------------------------------------------------------------------------
Download Summary: 1 total, 0 successful, 0 skipped, 1 failed
Install Summary : 1 total, 0 successful, 0 skipped, 1 failed


When I look at the file on the proxy server I see it's not a patch file 
but some html which contains:-

         An unexpected error has occurred.  This may be
    a temporary network failure. Please try again later. If it doesn't
    work on a retry then please contact MyOracleSupport (MOS) for
     further assistance.

I have to remove 144873-03.zip and hope it downloaded next time
-bash-3.2# file 144873-03.zip
144873-03.zip:  ascii text
-bash-3.2# rm 144873-03.zip

Can PCA not check the downloaded file is a zip file?

-- 



Cheers

Richard Skelton
Richard.Skelton at infineon.com
Infineon Technologies UK Ltd
Infineon House
Great Western Court
Hunts Ground Road
Stoke Gifford
Bristol
BS34 8HP
Tel +44(0)117 952 8808
Fax: +44(0)117 952 8777
Mobile: +44(0)743 6272 137



From martin.paul at univie.ac.at  Wed Jan 29 10:50:16 2014
From: martin.paul at univie.ac.at (Martin Paul)
Date: Wed, 29 Jan 2014 10:50:16 +0100
Subject: [pca] New patch fails to install because the patchfile is not a
 patchfile
In-Reply-To: <52E8C230.8010909@infineon.com>
References: <52E8C230.8010909@infineon.com>
Message-ID: <52E8CED8.9040504@univie.ac.at>

Hi,

> Can PCA not check the downloaded file is a zip file?

Thanks for the report - I've added an appropriate check to the 
development version of PCA.

Actually PCA alreadys does extensive checking of all possible replies 
from the Oracle server, but that's a moving target. In that case it's 
especially weird: PCA asks the server explicitely for a ZIP file, and 
the server returns an HTML file instead of an appropriate HTTP error code.

Martin.


From opn.src.rocks at gmail.com  Wed Jan 29 15:35:45 2014
From: opn.src.rocks at gmail.com (Rajiv Gunja)
Date: Wed, 29 Jan 2014 09:35:45 -0500
Subject: [pca] 18117543 patch 144872-02 is missing a hard requirement
In-Reply-To: <52E8C219.5060504@univie.ac.at>
References: <52E7DB0F.1000806@adbs.ca>
	<52E8C219.5060504@univie.ac.at>
Message-ID: <CAO33OyjCQBQZndBYBP1T+VO+Q=Dw7BLLVCFTHevmA_cbu9A8uQ@mail.gmail.com>

Love the way the story began.... 17 seconds after midnight... On a cold
frigid night...

Thanks for the information Martin.

-Rajiv
On Jan 29, 2014 3:59 AM, "Martin Paul" <martin.paul at univie.ac.at> wrote:

> Am 28.01.2014 17:30, schrieb Dennis Clarke:
>
>> last night at 17 secs after midnight this 144872-03 was slid out the door.
>>
>> Seems odd to me that Solaris 10 patches are released on specific schedule
>> except for odd little creatures like this.
>>
>> Anyways, makes me wonder what bugid 18117543 is.
>>
>
> Oracle support doesn't let me see what BugID 18117543 is about. The main
> difference seems to be that 144872-03 now requires 147002-01 (SunOS 5.10:
> libxnet.so patch). My assumption would be that ifconfig requires a change
> or a new function in libxnet.so.1 provided by that patch.
>
> Martin.
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.univie.ac.at/pipermail/pca/attachments/20140129/22eda49d/attachment.html>

From dclarke at adbs.ca  Wed Jan 29 17:41:36 2014
From: dclarke at adbs.ca (Dennis Clarke)
Date: Wed, 29 Jan 2014 11:41:36 -0500
Subject: [pca] 18117543 patch 144872-02 is missing a hard requirement
In-Reply-To: <52E8C219.5060504@univie.ac.at>
References: <52E7DB0F.1000806@adbs.ca> <52E8C219.5060504@univie.ac.at>
Message-ID: <52E92F40.4030405@adbs.ca>

On 29/01/14 03:55 AM, Martin Paul wrote:
> Am 28.01.2014 17:30, schrieb Dennis Clarke:
>> last night at 17 secs after midnight this 144872-03 was slid out the 
>> door.
>>
>> Seems odd to me that Solaris 10 patches are released on specific 
>> schedule
>> except for odd little creatures like this.
>>
>> Anyways, makes me wonder what bugid 18117543 is.
>
> Oracle support doesn't let me see what BugID 18117543 is about. The 
> main difference seems to be that 144872-03 now requires 147002-01 
> (SunOS 5.10: libxnet.so patch). My assumption would be that ifconfig 
> requires a change or a new function in libxnet.so.1 provided by that 
> patch.
>
> Martin.
>
>

ah . .so that would be the new backdoor for the NSA I guess.

dc


