smpatch SSL errors: SSL peer shut down incorrectly
All my machines have been getting this over the past few days. Is there a problem with the server? google suggests this reflects a certificate problem but I haven't changed anything on the machines.
Thanks,
David
Jun 23 14:50:34 galaxy-bne root: [ID 702911 user.error] => com.sun.patchpro.server.ServerPatchServiceProvider@17af46e <=javax.net.ssl.SSLException: SSL peer shut down incorrectly
Jun 23 14:50:34 galaxy-bneat com.sun.net.ssl.internal.ssl.InputRecord.readV3Record(InputRecord.java:398)
Jun 23 14:50:34 galaxy-bneat com.sun.net.ssl.internal.ssl.InputRecord.read(InputRecord.java:348)
Jun 23 14:50:34 galaxy-bneat com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:720)
Jun 23 14:50:34 galaxy-bneat com.sun.net.ssl.internal.ssl.SSLSocketImpl.readDataRecord(SSLSocketImpl.java:67 7)
Jun 23 14:50:34 galaxy-bne root: [ID 702911 user.error] => com.sun.patchpro.server.ServerPatchServiceProvider@17af46e <=javax.net.ssl.SSLException: SSL peer shut down incorrectly
Jun 23 14:50:34 galaxy-bneat com.sun.net.ssl.internal.ssl.InputRecord.readV3Record(InputRecord.java:398)
Jun 23 14:50:34 galaxy-bneat com.sun.net.ssl.internal.ssl.InputRecord.read(InputRecord.java:348)
Jun 23 14:50:34 galaxy-bneat com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:720)
Jun 23 14:50:34 galaxy-bneat com.sun.net.ssl.internal.ssl.SSLSocketImpl.readDataRecord(SSLSocketImpl.java:67 7)
Jun 23 14:50:34 galaxy-bne root: [ID 702911 user.error] => com.sun.patchpro.server.ServerPatchServiceProvider@17af46e <=at com.sun.net.ssl.internal.ssl.AppInputStream.read(AppInputStream.java:75)
Jun 23 14:50:34 galaxy-bneat java.io.BufferedInputStream.fill(BufferedInputStream.java:218)
Jun 23 14:50:34 galaxy-bneat java.io.BufferedInputStream.read1(BufferedInputStream.java:256)
Jun 23 14:50:34 galaxy-bneat java.io.BufferedInputStream.read(BufferedInputStream.java:313)
Jun 23 14:50:34 galaxy-bneat sun.net.www.http.ChunkedInputStream.fastRead(ChunkedInputStream.java:221)
Jun 23 14:50:34 galaxy-bne root: [ID 702911 user.error] => com.sun.patchpro.server.ServerPatchServiceProvider@17af46e <=at com.sun.net.ssl.internal.ssl.AppInputStream.read(AppInputStream.java:75)
Jun 23 14:50:34 galaxy-bneat java.io.BufferedInputStream.fill(BufferedInputStream.java:218)
Jun 23 14:50:34 galaxy-bneat java.io.BufferedInputStream.read1(BufferedInputStream.java:256)
Jun 23 14:50:34 galaxy-bneat java.io.BufferedInputStream.read(BufferedInputStream.java:313)
Jun 23 14:50:34 galaxy-bneat sun.net.www.http.ChunkedInputStream.fastRead(ChunkedInputStream.java:221)
Jun 23 14:50:34 galaxy-bne root: [ID 702911 user.error] => com.sun.patchpro.server.ServerPatchServiceProvider@17af46e <=at sun.net.www.http.ChunkedInputStream.read(ChunkedInputStream.java:662)
Jun 23 14:50:34 galaxy-bneat java.io.FilterInputStream.read(FilterInputStream.java:111)
Jun 23 14:50:34 galaxy-bneat sun.net.www.protocol.http.HttpURLConnection$HttpInputStream.read(HttpURLConnect ion.java:2139)
Jun 23 14:50:34 galaxy-bneat java.io.BufferedInputStream.read1(BufferedInputStream.java:254)
Jun 23 14:50:34 galaxy-bneat java.io.BufferedInputStream.read(BufferedInputStream.java:313)
Jun 23 14:50:34 galaxy-bne root: [ID 702911 user.error] => com.sun.patchpro.server.ServerPatchServiceProvider@17af46e <=at sun.net.www.http.ChunkedInputStream.read(ChunkedInputStream.java:662)
Jun 23 14:50:34 galaxy-bneat java.io.FilterInputStream.read(FilterInputStream.java:111)
Jun 23 14:50:34 galaxy-bneat sun.net.www.protocol.http.HttpURLConnection$HttpInputStream.read(HttpURLConnect ion.java:2139)
Jun 23 14:50:34 galaxy-bneat java.io.BufferedInputStream.read1(BufferedInputStream.java:254)
Jun 23 14:50:34 galaxy-bneat java.io.BufferedInputStream.read(BufferedInputStream.java:313)
Jun 23 14:50:34 galaxy-bne root: [ID 702911 user.error] => com.sun.patchpro.server.ServerPatchServiceProvider@17af46e <=at com.sun.patchpro.util.Downloader.read(Downloader.java:554)
Jun 23 14:50:34 galaxy-bneat java.io.BufferedInputStream.read1(BufferedInputStream.java:254)
Jun 23 14:50:34 galaxy-bneat java.io.BufferedInputStream.read(BufferedInputStream.java:313)
Jun 23 14:50:34 galaxy-bneat com.sun.patchpro.server.ServerPatchServiceProvider.requestDownload(ServerPatchS erviceProvider.java:2554)
Jun 23 14:50:34 galaxy-bneat com.sun.patchpro.server.ServerPatchServiceProvider.performDownloadPatches(Serve rPatchServiceProvider.java:1592)
Jun 23 14:50:34 galaxy-bne root: [ID 702911 user.error] => com.sun.patchpro.server.ServerPatchServiceProvider@17af46e <=at com.sun.patchpro.util.Downloader.read(Downloader.java:554)
Jun 23 14:50:34 galaxy-bneat java.io.BufferedInputStream.read1(BufferedInputStream.java:254)
Jun 23 14:50:34 galaxy-bneat java.io.BufferedInputStream.read(BufferedInputStream.java:313)
Jun 23 14:50:34 galaxy-bneat com.sun.patchpro.server.ServerPatchServiceProvider.requestDownload(ServerPatchS erviceProvider.java:2554)
Jun 23 14:50:34 galaxy-bneat com.sun.patchpro.server.ServerPatchServiceProvider.performDownloadPatches(Serve rPatchServiceProvider.java:1592)
Jun 23 14:50:34 galaxy-bne root: [ID 702911 user.error] => com.sun.patchpro.server.ServerPatchServiceProvider@17af46e <=at com.sun.patchpro.server.ServerPatchServiceProvider.downloadPatches(ServerPatchS erviceProvider.java:1320)
Jun 23 14:50:34 galaxy-bneat com.sun.patchpro.server.PatchServerProxy.downloadPatches(PatchServerProxy.java: 224)
Jun 23 14:50:34 galaxy-bneat com.sun.patchpro.server.GroupPatchDownloader.downloadPatches(GroupPatchDownload er.java:124)
Jun 23 14:50:34 galaxy-bneat com.sun.patchpro.model.PatchProModel.performPatchDownload(PatchProModel.java:19 44)
Jun 23 14:50:34 galaxy-bneat com.sun.patchpro.model.PatchProStateMachine$10.run(PatchProStateMachine.java:52 6)
Jun 23 14:50:34 galaxy-bne root: [ID 702911 user.error] => com.sun.patchpro.server.ServerPatchServiceProvider@17af46e <=at com.sun.patchpro.server.ServerPatchServiceProvider.downloadPatches(ServerPatchS erviceProvider.java:1320)
Jun 23 14:50:34 galaxy-bneat com.sun.patchpro.server.PatchServerProxy.downloadPatches(PatchServerProxy.java: 224)
Jun 23 14:50:34 galaxy-bneat com.sun.patchpro.server.GroupPatchDownloader.downloadPatches(GroupPatchDownload er.java:124)
Jun 23 14:50:34 galaxy-bneat com.sun.patchpro.model.PatchProModel.performPatchDownload(PatchProModel.java:19 44)
Jun 23 14:50:34 galaxy-bneat com.sun.patchpro.model.PatchProStateMachine$10.run(PatchProStateMachine.java:52 6)
Jun 23 14:50:34 galaxy-bne root: [ID 702911 user.error] => com.sun.patchpro.server.ServerPatchServiceProvider@17af46e <=nullat com.sun.patchpro.util.State.run(State.java:266)
Jun 23 14:50:34 galaxy-bneat java.lang.Thread.run(Thread.java:595)
Jun 23 14:50:34 galaxy-bne root: [ID 702911 user.error] => com.sun.patchpro.server.ServerPatchServiceProvider@17af46e <=nullat com.sun.patchpro.util.State.run(State.java:266)
Jun 23 14:50:34 galaxy-bneat java.lang.Thread.run(Thread.java:595)
Jun 23 14:50:36 galaxy-bne root: [ID 702911 user.error] => Thread[Thread-19,5,main] <=Problem installing patches: WARNING: The installer cannot find the patch.
Jun 23 14:50:36 galaxy-bne root: [ID 702911 user.error] => Thread[Thread-19,5,main] <=Problem installing patches: WARNING: The installer cannot find the patch.
# 1
I'm not aware of any issues on our side that would cause these errors. My first guesses would be -
* Check your proxy/network routing settings - Has anything changed on the http proxy recently, can you use it to browse https sites through the proxy ( ie. https://www.verisign.com )
* Entitlment - Has your current contract expired and therefore the subscription key you used to register the host with expired?
# 2
I can access the given site with no problem.I don't know if anything has changed on the proxy - I hadn't considered it as the common point - but will try to find out.Entitlment should be ongoing - any way to check if something has gone amiss
# 3
The entitlement should be fine provided the contract has not expired.
Incidently I've just had another report of similar errors from another source so it may be something on our end after all. There were some issues with the current.zip file over the past few days but I initially (and perhaps wrongly) assumed that it would not cause these errors.
Can you give us a listing of your cache directory and everything underneath it?
# ls -laR /var/sadm/spool/cache/
# 4
root galaxy-bne ~ # ls -laR /var/sadm/spool/cache/
/var/sadm/spool/cache/:
total 20840
drwxr-xr-x7 rootsys 1024 Jun 23 14:50 .
drwxr-xr-x5 rootsys 5632 Jun 23 14:50 ..
drwxr-xr-x2 rootroot 512 Jun 23 14:47 Database
drwxr-xr-x2 rootroot 512 Feb 10 12:49 category
drwxr-xr-x2 rootroot 512 Feb 10 12:49 collection
drwxr-xr-x2 rootroot 512 Jun 23 14:47 entitlement
-rw-r--r--1 rootroot3480334 Apr 11 14:47 https%3A%2F%2Fgetupdates.sun.com%2Fsolaris%2F%2Fdetectors.jar
-rw-r--r--1 rootroot3511884 Jun 22 16:41 https%3A%2F%2Fgetupdates1.sun.com%2Fsolaris%2F%2Fdetectors.jar
-rw-r--r--1 rootroot3421441 Feb 10 11:49 https%3A%2F%2Fupdateserver.sun.com%2Fsolaris%2F%2Fdetectors.jar
-rw-r--r--1 rootroot204793 Feb 10 11:50 https%3A%2F%2Fupdateserver.sun.com%2Fsolaris%2F%2Fpatchdb.zip
drwxr-xr-x3 rootsys 512 Feb 10 12:10 updatemanager
/var/sadm/spool/cache/Database:
total 1108
drwxr-xr-x2 rootroot 512 Jun 23 14:47 .
drwxr-xr-x7 rootsys 1024 Jun 23 14:50 ..
-rw-r--r--1 rootroot267702 Apr 11 14:41 https%3A%2F%2Fgetupdates.sun.com%2Fsolaris%2F%2FDatabase%2Fcurrent.zip
-rw-r--r--1 rootroot273394 Jun 23 14:47 https%3A%2F%2Fgetupdates1.sun.com%2Fsolaris%2F%2FDatabase%2Fcurrent.zip
/var/sadm/spool/cache/category:
total 8
drwxr-xr-x2 rootroot 512 Feb 10 12:49 .
drwxr-xr-x7 rootsys 1024 Jun 23 14:50 ..
-rw-r--r--1 rootroot1398 Feb 10 12:49 https%3A%2F%2Fgetupdates.sun.com%2Fsolaris%2F%2Fcategory%2Fdefault
/var/sadm/spool/cache/collection:
total 6
drwxr-xr-x2 rootroot 512 Feb 10 12:49 .
drwxr-xr-x7 rootsys 1024 Jun 23 14:50 ..
-rw-r--r--1 rootroot 626 Feb 10 12:49 https%3A%2F%2Fgetupdates.sun.com%2Fsolaris%2F%2Fcollection%2Fdefault
/var/sadm/spool/cache/entitlement:
total 8
drwxr-xr-x2 rootroot 512 Jun 23 14:47 .
drwxr-xr-x7 rootsys 1024 Jun 23 14:50 ..
-rw-r--r--1 rootroot 28 Apr 11 14:47 https%3A%2F%2Fgetupdates.sun.com%2Fsolaris%2F%2Fentitlement_client
-rw-r--r--1 rootroot 121 Jun 23 14:47 https%3A%2F%2Fgetupdates1.sun.com%2Fsolaris%2F%2Fentitlement_client
/var/sadm/spool/cache/updatemanager:
total 6
drwxr-xr-x3 rootsys 512 Feb 10 12:10 .
drwxr-xr-x7 rootsys 1024 Jun 23 14:50 ..
drwxr-xr-x2 rootsys 512 Apr 12 00:51 analysis.results
/var/sadm/spool/cache/updatemanager/analysis.results:
total 8
drwxr-xr-x2 rootsys 512 Apr 12 00:51 .
drwxr-xr-x3 rootsys 512 Feb 10 12:10 ..
-rw-r--r--1 rootroot1330 Feb 23 00:57 https%3A%2F%2Fgetupdates.sun.com%2Fsolaris%2F%0A%2Fcurrent
-rw-r--r--1 rootroot0 Jun 23 00:49 https%3A%2F%2Fgetupdates1.sun.com%2Fsolaris%2F%0A%2Fcurrent
# 5
Is that other error the IndexOutOfBoundsException -1 ?I've had that too.
# 6
I'd actually expect no errors to be returned but also no patches to be listed as available (ie smpatch analyze returns no patches required).
Can you try deleting your cache and running an smpatch analyze?
# rm -rf /var/sadm/spool/cache/*
# smpatch analyze -C patchpro.log.level=3 -C patchpro.debug=true
Note that it may take a little longer than usual to run the smpatch analyze.
# 7
root galaxy-bne ~ # smpatch analyze -C patchpro.log.level=3 -C patchpro.debug=true
Effective proxy host : <proxy>
Effective proxy port : "8080"
Effective proxy user : ""
Effective proxy host : <proxy>
Effective proxy port : "8080"
Effective proxy user : ""
Effective proxy host : <proxy>
Effective proxy port : "8080"
Effective proxy user : ""
Effective proxy host : <proxy>
Effective proxy port : "8080"
Effective proxy user : ""
118668-06 J2SE 5.0_x86: update 7 patch
120100-06 APOC 1.2_x86: Sun Java(tm) Desktop System Configuration Shared Libraries
119118-19 Evolution 1.4.6_x86 patch
122213-05 GNOME 2.6.0_x86: GNOME Image Editor Patch
<proxy> is real proxy name of course - elided.
So that worked, but I just ran "smpatch analyze" on another machine that was failing and it worked now too - with no deletion of the cache. I'm running "smpatch update" on both machines now.
Thanks.
# 8
This problem is back but intermittent:
root galaxy-bne /var/sadm/spool # smpatch update
122035-03 has been validated.
118966-23 has been validated.
118778-05 has been validated.
119547-06 has been validated.
Jun 30 14:03:22 galaxy-bne root: => com.sun.patchpro.server.ServerPatchServiceProvider@12ddfe4 <=javax.net.ssl.SSLException: SSL peer shut down incorrectly
Then after that another patch came through ok.
# 9
It is strange that it seems to be an intermittent issue.Just to rule out an issue with thee network connectivity could you run a ping for 10 mins to https://getupdates1.sun.com just to see if any packets are dropped?
# 10
No problem with ping but the other error occurs intermittently.
Now I have a second problem. I downloaded over a dozen updates for one of my x86 boxes over the past couple of days. Today I went to my other x86 box to do the same and "smaptch analyze" reports "No patches required" ?
<sigh>
# 11
Previous when clearing the cache was discussed did you clear the cache on the proxy as well as the clients with issues?
# 12
The "proxy" is just my web-proxy and I don't have any access to it to clear caches etc.
# 13
Dear David,
My mistake I was thinking there was a Sun Update Connection proxy involved in this equation.
There is a bug being investigated at present with our Engineers for errors in subscription, this may be affecting the way your smpatch is behaving.
This is being given a high priority and we hope to have something for our customers soon.
# 14
I think I know the problem on the second machine. Today one machine saw a long list of new updates available, the problem machine only one: 119549 which is a security patch.
I'm guessing the registration for the problem machine has disappeared somehow and so only security patches are being made available to it.
I tried re-registering yesterday but registration fails with a "exception in web service communication" error. I found a log file in /tmp which contains in part:
INFO: >>>> About to output
5/07/2006 09:13:17 com.sun.cns.basicreg.common.ProxyManager isProxyEnabled
INFO: proxy is enabled
5/07/2006 09:13:17 com.sun.cns.basicreg.common.ProxyManager isSecureProxyEnabled
INFO: secure proxy is enabled
5/07/2006 09:13:17 com.sun.cns.basicreg.adapter.eCRAdapter <init>
INFO: Using eCRAdapter endpoint := https://cns-services.sun.com/UserInformationService/UserInformationService
5/07/2006 09:13:51 com.sun.cns.basicreg.common.ProxyManager isSecureProxyEnabled
INFO: secure proxy is enabled
5/07/2006 09:13:51 com.sun.cns.basicreg.adapter.Adapter connectToSun
INFO: secure proxy tested OK !
5/07/2006 09:13:51 com.sun.cns.basicreg.adapter.eCRAdapter authenticateUser
SEVERE: Exception in web service communication
5/07/2006 09:13:51 com.sun.cns.basicreg.adapter.eCRAdapter authenticateUser
SEVERE: java.lang.NullPointerException
5/07/2006 09:13:51 com.sun.cns.basicreg.adapter.eCRAdapter authenticateUser
SEVERE:
com.sun.cns.basicreg.adapter.eCRAdapter.authenticateUser(eCRAdapter.java:82)
com.sun.cns.basicreg.adapter.eCRAdapter.authenticateUser(eCRAdapter.java:69)
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.ja va:25)
java.lang.reflect.Method.invoke(Method.java:585)
com.sun.cns.basicreg.wizard.cli.CmdLineWizard.authenticateUser(CmdLineWizard.ja va:1059)
com.sun.cns.basicreg.wizard.cli.CmdLineWizard.outCall(CmdLineWizard.java:980)
com.sun.cns.basicreg.wizard.cli.CmdLineWizard.output(CmdLineWizard.java:764)
com.sun.cns.basicreg.wizard.swing.WizardPanel$StoreTask.<init>(WizardPane l.java:1024)
com.sun.cns.basicreg.wizard.swing.WizardPanel$1.construct(WizardPanel.java:843)
com.sun.cns.basicreg.wizard.swing.SwingWorker$2.run(SwingWorker.java:127)
java.lang.Thread.run(Thread.java:595)
Thanks.
# 15
The "Exception in web service communication" error is a known issue. You may be able to register if it is possible to bypass your HTTP Proxy temporarily. The issue is caused by a bug (6226610) in Java which has been fixed the the upcoming release (Java 1.5 Update 8). This is due to be released next month.
# 16
Bypassing the web proxy is not possible.
But I don't understand how this can be a Java bug as I have registered this system in the past. There is no indication from the CR you listed that this has ever worked, hence, unless something has changed on the server side of registration I don't see why it work in the past but not now.
Anyway I will try running with the latest Java 6 build.
Thanks.
# 17
Using the latest Java 6 build I was able to register successfully. However after re-registration updatemanager still only shows the one security patch available.
BTW the SSL errors still occur intermittently on all systems.
ForumModerator could you drop me an email at dholmes@ieee.org so I can then contact you from my company account. Thanks.
# 18
Perhaps have a look at registration packages or SSL certs etc.
Patches require for Installing
for SPARC...
121118-06 Sun Update Connection Client System Edition 1.0.4
121081-05 Connected Customer Agents 1.1.0
121563-02 Sun Update Connection Registration, version 1.0.3
122231-01 Sun Connection agents, transport certificate update
121453-02 Sun Update Connection Client Foundation
119254-24 Install & Patch Utilities Patch
119574-02 SU Patch
120335-04 Sun Update Connection Client Localizations (Optional)
then if the system is a Sun Update Connection Proxy as well;
119788-02 Sun Update Connection Proxy System Edition 1.0
and for x86....
121119-06 Sun Update Connection Client System Edition 1.0.4
121082-05 Connected Customer Agents 1.1.0
121564-02 Sun Update Connection Registration, version 1.0.3
122232-01 Sun Connection agents, transport certificate update
121454-02 Sun Update Connection Client Foundation
119255-24 Install & Patch Utilities Patch
119575-02 SU Patch
120336-04 Sun Update Connection Client Localization
then if the system is a Sun Update Connection Proxy as well;
119789-02 Sun Update Connection Proxy, System Edition 1.0
# 19
For x86 system all those patches are applied.
# 20
This intermittent "SSL peer shut down incorrectly" problem is not something we have come across before and is likely to need some in depth investigation. Can you log a support call by calling the CCC, or online via the OSC?
That way we will be able to communicate with you by phone or email and investigate this more effectively. Investigation will probably centre around gathering snoop output, finding out about your HTTP proxy, establishing exactly how intermittent the problem is, etc.
# 21
ForumModerator I was going to send email to you via the address you have mentioned elsewhere but now I can't find it.Please email me at David.Holmes@sun.com - thanks.Message was edited by: davidholmes
# 22
Didn't realise you were a Sun employee. In that case you can create a case by using the webform at this internal site: http://webhome.central/sunupdate/support/emp/webform.jspThis will get to us via email and we will be able to contact you back.
# 23
Does anyone know if this issue was resolved and how to fix it? Following the announced closure of the ftp service for patches, I've started to use smpatch for a pair of legacy Sparc Solaris 8 machines, and they are exhibiting the same intermittent problem. I left them running "smpatch update", and they both took a long time and eventually finished, but the log shows that some patches failed to download, with errors similar to those reported in this thread in the download phase, followed by "the installer cannot find the patch" errors during the install phase. Only a handful of patches were affected and the errors did not stop subsequent patches in the sequence.
NOTE Unlike the original poster, I don't have a sun service plan, so this problem applies to downloads of free updates
# 24
Hi.We are still working the case created by davidholmes, but it seems that the errors are dependant on the HTTP proxy used. We had davidholmes change his proxy, and the errors have disappeared.
