If you’re using Debian and you want to get rid of Hearbleed bug then it’s not sufficient to upgrade openssl package.
The really important package is libssl1.0.0:
apt-get install libssl1.0.0
It will restart all services which depends on this package.
19. February 2012
Tomcat 7 and curl – SSL23_GET_SERVER_HELLO:tlsv1 alert internal error
There is very annoying bug in Open SSL 1.0 which affects curl. When you try to access Tomcat 7 with https with curl you’ll get fancy error:
curl: (35) error:14077438:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert internal error
-k parameter is not working at all
You’re not able to invoke any request against Tomcat 7 with https in default configuration.
The solution is to restrict available ciphers in Tomcat’s https connector:
ciphers="SSL_RSA_WITH_RC4_128_SHA"
Restart Tomcat and curl will work.
28. August 2011
Software Feature Paradox
By adding more features you'll achieve less. By adding less features you'll achieve more.
Why is this paradox so common in the Sea of Software development?
It’s easier to add more than to add less.
It’s easier to rush than run for a long distance.
It’s easier to promise castle in the air than build it.
It’s easier to blame old code in the system than find understanding.
Is it harder to write test before a code than fix a bug within a bug within a bug?
😉
31. January 2011
Amazon S3 – Authenticating REST – bug in documentation
Document Amazon S3 – Authenticating REST says that you should generate authentication signature using following code:
"Authorization: AWS " + AWSAccessKeyId + ":" + base64(hmac-sha1(VERB + "\n" + CONTENT-MD5 + "\n" + CONTENT-TYPE + "\n" + DATE + "\n" + CanonicalizedAmzHeaders + "\n" + CanonicalizedResource))
In documentation you can find following instructions:
The string to be signed is formed by appending the REST verb, content-md5 value, content-type value, date value, canonicalized x-amz headers, and the resource; all separated by newlines.
I followed instructions, but server always responded in the same stubborn fashion:
Code: SignatureDoesNotMatch
Message: The request signature we calculated does not match the signature you provided. Check your key and signing method.
The problem was that my request didn’t contain any AmzHeader and therefore CanonicalizedAmzHeaders was empty string followed by new line. That’s wrong.
If CanonizalizedAmzHeaders is empty string then there MUST NOT be new line!
Correct string for signing in case when AmzHeader is empty:
"Authorization: AWS " + AWSAccessKeyId + ":" + base64(hmac-sha1(VERB + "\n" + CONTENT-MD5 + "\n" + CONTENT-TYPE + "\n" + DATE + "\n" + CanonicalizedResource))