Thanks for explaining Don. -GGR
-- Rajiv G Gunja Blog: http://ossrocks.blogspot.com 2009/8/14 Don O'Malley <[email protected]> > Hi Rajiv, > > Someone else on the alias said that they were experiencing failures > downloading patches due to their firewall rules. > > Previously a download via wget would look something like this: > > --10:29:00-- http://sunsolve.sun.com/pdownload.do?target=120068-02&method=h > => `/tmp/120068-02.zip' > Resolving webcache2.uk... 129.156.85.12 > Connecting to webcache2.uk|129.156.85.12|:8080... connected. > Proxy request sent, awaiting response... 302 Moved Temporarily > Location: > http://sunsolve.sun.com/CDW/120068-02.zip;jsessionid=2db6908b949f505b830af062a6a4 > [following] > --10:29:00-- > http://sunsolve.sun.com/CDW/120068-02.zip;jsessionid=2db6908b949f505b830af062a6a4 > => `/tmp/120068-02.zip' > Connecting to webcache2.uk|129.156.85.12|:8080... connected. > Proxy request sent, awaiting response... 200 OK > Length: 47,267 (46K) [application/download] > > 0K .......... .......... .......... .......... ...... 100% 91.67 KB/s > > 10:29:01 (91.67 KB/s) - `/tmp/120068-02.zip' saved [47267/47267] > > > But since the latest changes were deployed and the new download mechanism > was put in place, the wget now looks like this: > > --13:29:01-- http://sunsolve.sun.com/pdownload.do?target=120068-02&method=h > => `/tmp/120068-02.zip' > Resolving webcache2.uk... 129.156.85.12 > Connecting to webcache2.uk|129.156.85.12|:8080... connected. > Proxy request sent, awaiting response... 302 Moved Temporarily > Location: https://getupdates2.sun.com/all_unsigned/120068-02.zip [following] > --13:29:03-- https://getupdates2.sun.com/all_unsigned/120068-02.zip > => `/tmp/120068-02.zip' > Resolving getupdates2.sun.com... 198.232.168.157 > Connecting to getupdates2.sun.com|198.232.168.157|:443... connected. > WARNING: Certificate verification error for getupdates2.sun.com: self signed > certificate in certificate chain > HTTP request sent, awaiting response... 302 Moved Temporarily > Location: > https://a248.e.akamai.net/f/248/21808/15m/sun.download.akamai.com/21808/patches/patchroot/all_unsigned/120068-02.zip?AuthParam=1250253068_b3a69beca93a4bec86808e4aef6d0d7e&TUrl=L0QdUQV8Z4i0fdED3QTP3SJDWA8FMyaJsHfIWf4X29kTWQpKEzIbwqFuyRPZ&TicketId=3q32klqIOhBS&GroupName=SWUP&BHost=sdlc6g.sun.com&FilePath=/patches/patchroot/all_unsigned/120068-02.zip&File=120068-02.zip > [following] > --13:29:08-- > https://a248.e.akamai.net/f/248/21808/15m/sun.download.akamai.com/21808/patches/patchroot/all_unsigned/120068-02.zip?AuthParam=1250253068_b3a69beca93a4bec86808e4aef6d0d7e&TUrl=L0QdUQV8Z4i0fdED3QTP3SJDWA8FMyaJsHfIWf4X29kTWQpKEzIbwqFuyRPZ&TicketId=3q32klqIOhBS&GroupName=SWUP&BHost=sdlc6g.sun.com&FilePath=/patches/patchroot/all_unsigned/120068-02.zip&File=120068-02.zip > => `/tmp/120068-02.zip' > Resolving a248.e.akamai.net... 92.122.126.147, 92.122.126.162, > 92.122.126.177, ... > Connecting to a248.e.akamai.net|92.122.126.147|:443... connected. > WARNING: Certificate verification error for a248.e.akamai.net: unable to get > local issuer certificate > HTTP request sent, awaiting response... 200 OK > Length: 47,267 (46K) [application/zip] > > 0K .......... .......... .......... .......... ...... 100% 287.85 KB/s > > 13:29:08 (287.85 KB/s) - `/tmp/120068-02.zip' saved [47267/47267] > > > The points to note here are the redirects: > - Firstly to https://getupdates2.sun.com > - Then to https://a248.e.akamai.net > > I do not know how your firewall is configured, so I cannot say whether this > is likely to be problematic, but there were other people on the alias that > needed to add rules to their firewall in order for wget to work with the new > service. > > Best, > -Don > > > > Rajiv Gunja wrote: > > Don, > I am unable to download patches via pca/wget. Are you saying that we have > to make changes our proxy/firewall rules to be able to download from > Sunsolve? > > I am behind an enterprise firewall/proxy and cannot ask for rules > change/add without a valid reason. > > Please explain the the solution that you are suggesting. > > Thanks > > -GGR > > -- > Rajiv G Gunja > Blog: http://ossrocks.blogspot.com > > > 2009/8/14 Don O'Malley <[email protected]> > >> Hi David, >> >> Just to clarify... >> >> Are you still having issues? >> >> If so, can you confirm the issues are related to your firewall rules (due >> to the redirect to getupdates2.sun.com and subsequent content delivery >> from akamai)? >> >> If you are still having issues not related to this, please let me know... >> >> Best, >> -Don >> >> >> David Stark wrote: >> >> On Fri, Aug 14, 2009 at 10:13:48AM +0100, Jonathan Imber wrote: >> >> >> Hi, >> >> >> Hi. >> >> >> >> Our firewall was blocking access to getupdates2.sun.com, having added this >> into the firewall rules we are now receiving the following error. >> >> >> Location: https://getupdates2.sun.com/all_unsigned/119255-67.zip >> [following] >> >> >> --10:00:38-- https://getupdates2.sun.com/all_unsigned/119255-67.zip >> >> => `/var/tmp/pca/./119255-67.tmp' >> >> >> Resolving getupdates2.sun.com... 198.232.168.157 >> >> >> Connecting to getupdates2.sun.com|198.232.168.157|:443... connected. >> >> >> HTTP request sent, awaiting response... 302 Moved Temporarily >> >> >> Location: >> https://a248.e.akamai.net/f/248/21808/15m/sun.download.akamai.com/21808/patches/patchroot/all_unsigned/119255-67.zip?AuthParam=1250240568_de1a79e0477d9b69eca0cd0b9108b86f&TUrl=L0QdUQV8Z4i0fdED3QTP3SJDWA8FMyaJsHfIWf4X29kTWQpKEzIbwqFuyRPZ&TicketId=3q32kleBPRFU&GroupName=SWUP&BHost=sdlc6h.sun.com&FilePath=/patches/patchroot/all_unsigned/119255-67.zip&File=119255-67.zip >> [following] >> >> >> --10:00:42-- >> https://a248.e.akamai.net/f/248/21808/15m/sun.download.akamai.com/21808/patches/patchroot/all_unsigned/119255-67.zip?AuthParam=1250240568_de1a79e0477d9b69eca0cd0b9108b86f&TUrl=L0QdUQV8Z4i0fdED3QTP3SJDWA8FMyaJsHfIWf4X29kTWQpKEzIbwqFuyRPZ&TicketId=3q32kleBPRFU&GroupName=SWUP&BHost=sdlc6h.sun.com&FilePath=/patches/patchroot/all_unsigned/119255-67.zip&File=119255-67.zip >> >> => `/var/tmp/pca/./119255-67.tmp' >> >> >> Resolving a248.e.akamai.net... 92.122.126.147, 92.122.126.177, >> 92.122.126.136, ... >> >> >> Connecting to a248.e.akamai.net|92.122.126.147|:443... failed: >> Connection timed out. >> >> >> Connecting to a248.e.akamai.net|92.122.126.177|:443... failed: >> Connection timed out. >> >> >> Does anyone know what the a248.e.akamai.net address is? >> >> >> Akamai is the content delivery service Sun is using. You'll have to allow >> *.akamai.net in your firewall rules, because as far as I'm aware there's no >> way to tell exactly which x.y.akamai.net hostname you'll be redirected to. >> (That was the advice we used to hand out to smpatch customers anyway - >> things may have changed, but I doubt it.) >> >> Dave >> >> >> Thanks, >> >> >> Jonathan >> >> >> From: [email protected] >> [mailto:[email protected] <[email protected]>] On >> Behalf Of Jon Whitehouse >> >> >> Sent: 13 August 2009 13:37 >> >> >> To: PCA (Patch Check Advanced) Discussion >> >> >> Subject: Re: [pca] SunSolve updated -- improved patch downloading >> >> >> Don, >> >> >> Would that explain why I am getting this? (from pca -I --debug) >> >> >> Looking for 141414-08 (1/3) >> >> >> Trying http://sunsolve.sun.com/ (1/5) >> >> >> /usr/sfw/bin/wget >> "http://sunsolve.sun.com/pdownload.do?target=141414-08&method=h"; >> <http://sunsolve.sun.com/pdownload.do?target=141414-08&method=h> --execute >> http_proxy=http://xxx:8080 --header="Authorization: Basic >> dW5peC5hZG1pbnNAemltbWVyLmNvbTp0b3l3aW5kb3dz" -O /pca/141414-08.tmp >> >> >> --08:30:53-- >> http://sunsolve.sun.com/pdownload.do?target=141414-08&method=h >> >> => `/pca/141414-08.tmp' >> >> >> Resolving proxy-server... xxx.xxx.xx.xx >> >> >> Connecting to proxy-server|xxx.xxx.xx.xx|:8080... connected. >> >> >> Proxy request sent, awaiting response... 302 Moved Temporarily >> >> >> Location: https://getupdates2.sun.com/all_unsigned/141414-08.zip >> [following] >> >> >> --08:30:54-- https://getupdates2.sun.com/all_unsigned/141414-08.zip >> >> => `/pca/141414-08.tmp' >> >> >> Resolving getupdates2.sun.com... 198.232.168.157 >> >> >> Connecting to getupdates2.sun.com|198.232.168.157|:443... failed: >> Connection refused. >> >> >> Failed >> >> >> When I point my web browser there I get: >> >> >> The proxy was unable to fulfill your request because it could not >> contact the computer at getupdates2.sun.com:80 (Reached maximum of 192 >> servers). >> >> >> The website may be temporarily unavailable. If later attempts to >> access this website are still unsuccessful, you may wish to contact the >> website's administrator. >> >> >> I know it isn't our proxy because I can get out to other sites just >> fine. >> >> >> --- >> >> >> Jon Whitehouse >> >> >> Systems Engineer - IT, Server Support >> >> >> MS 5221 >> >> >> 1800 W. Center Street >> >> >> Warsaw, IN 46580 >> >> >> (574) 371-8684 >> >> >> (574) 377-2829 (cell) >> >> >> [email protected] >> >> From: [email protected] >> [mailto:[email protected] <[email protected]>] On >> Behalf Of Don O'Malley >> >> >> Sent: Thursday, August 13, 2009 7:06 AM >> >> >> To: PCA (Patch Check Advanced) Discussion >> >> >> Subject: Re: [pca] SunSolve updated -- improved patch downloading >> >> >> Hi Craig, >> >> >> Yeah, this is good news. >> >> >> The new system went live on Tuesday. >> >> >> Hopefully this should see an end to the "ERROR 500" problems that pca >> users where sporadically hitting for a long time now. >> >> >> I have been monitoring the new service since it has gone live and it >> really does seem to be highly reliable so far. >> >> >> One key point to note is that there will be a delay of up to 8 hours >> for wget users after they associate a new contract with their SOA (via the >> "Edit Contract" link) on SunSolve. >> >> >> This is detailed in the Technical Instruction document for wget users - >> http://sunsolve.sun.com/search/document.do?assetkey=1-9-240066-1. >> >> >> (It is however expected that the advertised 8 hour delay, should behave >> closer to a one hour delay in practice.) >> >> >> There is one other important point for pca users registered in the >> Members Support Center from this document: >> >> >> "For users registering or updating contracts on the Member Support >> Center, an initial wget access must be attempted to trigger the >> synchronization process." >> >> >> I believe that the new download service will make a massive difference >> to pca users with the huge reliability improvements it brings. >> >> >> Best, >> >> >> -Don >> >> >> Craig Bell wrote: >> >> >> It looks as if Sun is working to address some of our concerns with >> >> >> downloading patches: >> >> >> http://blogs.sun.com/miriamsblog/entry/sunsolve_7_3_is_live >> >> Amongst the touted enhancements in v7.3, they mention improved >> patch >> >> >> downloading: >> >> >> Customer have been experiencing breaks in downloading of >> patches where >> >> >> the back end systems have gone off line and the download was >> stopped. >> >> >> This has now been addressed by using a new download service. >> >> >> There are more details in the blog post. Thx... -cheers, CSB >> >> >> Click >> here<https://www.mailcontrol.com/sr/Nda5GditrZDTndxI!oX7UujCzevbYPVNgyd5ERNeDCDUQRe8y5yEFkwxH4S6j!0Xtzy7YboBKDRPcbrY0G8NdQ==> >> >> <https://www.mailcontrol.com/sr/Nda5GditrZDTndxI%21oX7UujCzevbYPVNgyd5ERNeDCDUQRe8y5yEFkwxH4S6j%210Xtzy7YboBKDRPcbrY0G8NdQ==> >> to report this email as spam to BlackSpider. Reporting this email as spam >> will automatically update the anti-spam rules. >> >> >> To view our disclaimer see http://epolicy.gartmore.com >> >> Gartmore Investment Management Limited (GIM), Gartmore Investment >> Limited (GIL) and Gartmore Fund Managers Limited (GFM) are all registered in >> England and Wales (nos 953703, 1508030 and 1137353). The registered address >> of GIM, GIL and GFM is Gartmore House, 8 Fenchurch Place, London, EC3M 4PB. >> Gartmore Global Partners (GGP) is a general partnership registered in >> Delaware, USA, EIN 56-1903611. The registered office of GGP is One >> International Place, Fort Hill Square, Boston, Massachusetts 02110, USA. >> GIL, GFM and GGP are authorised and regulated by the Financial Services >> Authority under the references 119236 (GIL), 122610 (GFM) and 172616 (GGP). >> See www.fsa.gov.uk/register for more details. GGP is also a SEC registered >> investment advisor. >> >> >> >
