Re: [users@httpd] Generate UUIDv4

2021-06-10 Thread Eric Covener 
On Thu, Jun 10, 2021 at 11:36 AM Henson, Robert (GE CoreTech & Cyber,
Non-GE, US)  wrote:
>
> We use apache 2.4.46.  We currently are only able to get UUIDv1 to generate.  
> We are using the mod_auth_openidc 1.8.10 module.  I have tried using 
> different versions of the mod_auth_openidc module, but I am not able to get 
> anything besides UUIDv1 to generate.  I looked at the documentation for 
> 2.4.48, but I have not been able to find anything concerning UUID.  At this 
> point, we are looking at going RedHat apache 2.4.6 to see if the their 
> standard install provides for UUIDv4.  Can UUIDv4 be generated using apache 
> 2.4.46 or apache 2.4.48?

If the UUID you care about is used in mod_auth_openidc it's probably
better to ask the maintainers at
https://github.com/zmartzone/mod_auth_openidc

-
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org

RE: [users@httpd] [External] Re: [users@httpd] Struggling with "decryption failed or bad record mac" error

2021-06-10 Thread Piemonti, Matteo 
Hi,
the only TLS available is TLS 1.2 and only 4 ciphers are configured:

# TLS 1.2 (suites in server-preferred order)
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256

But the problem is randomic even with the same cipher used 
(TLS_DHE_RSA_WITH_AES_256_GCM_SHA384)

The certificate is from an official CA and it is configured on apache with 
Server cert, Intermediate and key. SSLLabs doesn't show any problem on it.


Thank you

Matteo

-Original Message-
From: Ran Mozes  
Sent: giovedì 10 giugno 2021 11:16
To: users@httpd.apache.org
Subject: Re: [users@httpd] [External] Re: [users@httpd] Struggling with 
"decryption failed or bad record mac" error

Hi Matteo,

sounds like various issues could be the root cause. Maybe a negotiation issue 
on the TLS version and/or the Ciphers used? 
Another option, the error "SSL3_GET_RECORD:decryption failed or bad record mac“ 
could also imply that something is wrong with the certificates being used.

HTH,
Ran 

> Am 09.06.2021 um 10:06 schrieb Piemonti, Matteo 
> :
> 
> Hi,
>   has someone any suggestion about this topic?
> 
> 
> Thanks
> Matteo
> 
> -Original Message-
> From: Piemonti, Matteo
> Sent: lunedì 24 maggio 2021 09:56
> To: users@httpd.apache.org
> Subject: RE: [External] Re: [users@httpd] Struggling with "decryption 
> failed or bad record mac" error
> 
> Hi,
>   in my first message you can find many informations...
> The only TLS available is TLS 1.2 and the openssl version is OpenSSL 
> 1.0.2k-fips (the last one of RedHat 7.9), we have this random problem only 
> from a customer that is using .net. In my opinion it should be a client 
> problem but hard to demonstrate.
> Which specific directives do you want to see of httpd-ssl.conf?
> 
> 
> Matteo
> 
> -Original Message-
> From: Daniel Ferradal 
> Sent: domenica 23 maggio 2021 20:49
> To:  
> Subject: [External] Re: [users@httpd] Struggling with "decryption 
> failed or bad record mac" error
> 
> This message is from an EXTERNAL SENDER - be CAUTIOUS, particularly with 
> links and attachments.
> 
> Hello,
> 
> Perhaps you may provide more info. Like the openssl version you are using, 
> your SSL related directives in your server, the openssl version or SSL 
> version of the client, the protocol the client is trying to use.
> 
> Also, is this happening with all clients? just one?
> 
> Can you reproduce it with "openssl s_client -connect" command? or even curl? 
> etc.
> 
> El vie, 21 may 2021 a las 12:25, Piemonti, Matteo
> () escribió:
>> 
>> Hi,
>> 
>>  we’re having a weird error on Apache httpd server that I can’t 
>> understand how to troubleshoot it and not clear to me if it is an our 
>> problem (apache http server) or a problem of the caller.
>> 
>> 
>> 
>> We have actually this configuration:
>> 
>> 
>> 
>> Server version: Apache/2.4.46 (Unix)
>> 
>> Server built:   May 13 2021 05:46:31
>> 
>> Server's Module Magic Number: 20120211:93
>> 
>> Server loaded:  APR 1.6.5, APR-UTIL 1.6.1
>> 
>> Compiled using: APR 1.6.5, APR-UTIL 1.6.1
>> 
>> Architecture:   64-bit
>> 
>> Server MPM: event
>> 
>>  threaded: yes (fixed thread count)
>> 
>>forked: yes (variable process count)
>> 
>> Server compiled with
>> 
>> -D APR_HAS_SENDFILE
>> 
>> -D APR_HAS_MMAP
>> 
>> -D APR_HAVE_IPV6 (IPv4-mapped addresses enabled)
>> 
>> -D APR_USE_SYSVSEM_SERIALIZE
>> 
>> -D APR_USE_PTHREAD_SERIALIZE
>> 
>> -D SINGLE_LISTEN_UNSERIALIZED_ACCEPT
>> 
>> -D APR_HAS_OTHER_CHILD
>> 
>> -D AP_HAVE_RELIABLE_PIPED_LOGS
>> 
>> -D DYNAMIC_MODULE_LIMIT=256
>> 
>> -D HTTPD_ROOT="/data/apache2_frontend"
>> 
>> -D SUEXEC_BIN="/data/apache2_frontend/bin/suexec"
>> 
>> -D DEFAULT_PIDLOG="logs/httpd.pid"
>> 
>> -D DEFAULT_SCOREBOARD="logs/apache_runtime_status"
>> 
>> -D DEFAULT_ERRORLOG="logs/error_log"
>> 
>> -D AP_TYPES_CONFIG_FILE="conf/mime.types"
>> 
>> -D SERVER_CONFIG_FILE="conf/httpd.conf"
>> 
>> 
>> 
>> The problem we have is that during ssl handshake we can see (only with debug 
>> or tcpdump) an “SSL Library Error: error:1408F119:SSL 
>> routines:SSL3_GET_RECORD:decryption failed or bad record mac" into apache 
>> httpd error_log.
>> 
>> No other logs are written into access_log.
>> 
>> How is possible to troubleshoot it and understand where is the 
>> problem (caller? network? receiver?)
>> 
>> 
>> 
>> Some logs from trace:
>> 
>> 
>> 
>> [Wed May 12 17:52:04.134409 2021] [ssl:debug] [pid 10532:tid 
>> 140112100849408] ssl_engine_kernel.c(1741): [client ip:port] AH02275:
>> Certificate Verification, depth 2, CRL checking mode: none (0)
>> [subject: CN=etc etc etc]
>> 
>> [Wed May 12 17:52:04.134553 2021] [ssl:debug] [pid 10532:tid 
>> 140112100849408] ssl_engine_kernel.c(1741): [client ip:port] AH02275:
>> Certificate Verification, depth 1, CRL checking mode: none (0)
>> [subject: CN=etc etc etc]
>> 
>> [Wed May 12 17:52:04.134681 2021] [ssl:debug] [pid 10532:tid 
>

[users@httpd] Generate UUIDv4

2021-06-10 Thread Henson, Robert (GE CoreTech & Cyber, Non-GE, US) 
We use apache 2.4.46.  We currently are only able to get UUIDv1 to generate.  
We are using the mod_auth_openidc 1.8.10 module.  I have tried using different 
versions of the mod_auth_openidc module, but I am not able to get anything 
besides UUIDv1 to generate.  I looked at the documentation for 2.4.48, but I 
have not been able to find anything concerning UUID.  At this point, we are 
looking at going RedHat apache 2.4.6 to see if the their standard install 
provides for UUIDv4.  Can UUIDv4 be generated using apache 2.4.46 or apache 
2.4.48?



Rob Henson
Aviation Web Consultant Team
Contractor of Sogeti USA
robertdavid.hen...@ge.com

Re: [users@httpd] [External] Re: [users@httpd] Struggling with "decryption failed or bad record mac" error

2021-06-10 Thread Ran Mozes 
Hi Matteo,

sounds like various issues could be the root cause. Maybe a negotiation issue 
on the TLS version and/or the Ciphers used? 
Another option, the error "SSL3_GET_RECORD:decryption failed or bad record mac“ 
could also imply that something is wrong with the certificates being used.

HTH,
Ran 

> Am 09.06.2021 um 10:06 schrieb Piemonti, Matteo 
> :
> 
> Hi,
>   has someone any suggestion about this topic?
> 
> 
> Thanks
> Matteo
> 
> -Original Message-
> From: Piemonti, Matteo 
> Sent: lunedì 24 maggio 2021 09:56
> To: users@httpd.apache.org
> Subject: RE: [External] Re: [users@httpd] Struggling with "decryption failed 
> or bad record mac" error
> 
> Hi,
>   in my first message you can find many informations...
> The only TLS available is TLS 1.2 and the openssl version is OpenSSL 
> 1.0.2k-fips (the last one of RedHat 7.9), we have this random problem only 
> from a customer that is using .net. In my opinion it should be a client 
> problem but hard to demonstrate.
> Which specific directives do you want to see of httpd-ssl.conf?
> 
> 
> Matteo
> 
> -Original Message-
> From: Daniel Ferradal 
> Sent: domenica 23 maggio 2021 20:49
> To:  
> Subject: [External] Re: [users@httpd] Struggling with "decryption failed or 
> bad record mac" error
> 
> This message is from an EXTERNAL SENDER - be CAUTIOUS, particularly with 
> links and attachments.
> 
> Hello,
> 
> Perhaps you may provide more info. Like the openssl version you are using, 
> your SSL related directives in your server, the openssl version or SSL 
> version of the client, the protocol the client is trying to use.
> 
> Also, is this happening with all clients? just one?
> 
> Can you reproduce it with "openssl s_client -connect" command? or even curl? 
> etc.
> 
> El vie, 21 may 2021 a las 12:25, Piemonti, Matteo
> () escribió:
>> 
>> Hi,
>> 
>>  we’re having a weird error on Apache httpd server that I can’t 
>> understand how to troubleshoot it and not clear to me if it is an our 
>> problem (apache http server) or a problem of the caller.
>> 
>> 
>> 
>> We have actually this configuration:
>> 
>> 
>> 
>> Server version: Apache/2.4.46 (Unix)
>> 
>> Server built:   May 13 2021 05:46:31
>> 
>> Server's Module Magic Number: 20120211:93
>> 
>> Server loaded:  APR 1.6.5, APR-UTIL 1.6.1
>> 
>> Compiled using: APR 1.6.5, APR-UTIL 1.6.1
>> 
>> Architecture:   64-bit
>> 
>> Server MPM: event
>> 
>>  threaded: yes (fixed thread count)
>> 
>>forked: yes (variable process count)
>> 
>> Server compiled with
>> 
>> -D APR_HAS_SENDFILE
>> 
>> -D APR_HAS_MMAP
>> 
>> -D APR_HAVE_IPV6 (IPv4-mapped addresses enabled)
>> 
>> -D APR_USE_SYSVSEM_SERIALIZE
>> 
>> -D APR_USE_PTHREAD_SERIALIZE
>> 
>> -D SINGLE_LISTEN_UNSERIALIZED_ACCEPT
>> 
>> -D APR_HAS_OTHER_CHILD
>> 
>> -D AP_HAVE_RELIABLE_PIPED_LOGS
>> 
>> -D DYNAMIC_MODULE_LIMIT=256
>> 
>> -D HTTPD_ROOT="/data/apache2_frontend"
>> 
>> -D SUEXEC_BIN="/data/apache2_frontend/bin/suexec"
>> 
>> -D DEFAULT_PIDLOG="logs/httpd.pid"
>> 
>> -D DEFAULT_SCOREBOARD="logs/apache_runtime_status"
>> 
>> -D DEFAULT_ERRORLOG="logs/error_log"
>> 
>> -D AP_TYPES_CONFIG_FILE="conf/mime.types"
>> 
>> -D SERVER_CONFIG_FILE="conf/httpd.conf"
>> 
>> 
>> 
>> The problem we have is that during ssl handshake we can see (only with debug 
>> or tcpdump) an “SSL Library Error: error:1408F119:SSL 
>> routines:SSL3_GET_RECORD:decryption failed or bad record mac" into apache 
>> httpd error_log.
>> 
>> No other logs are written into access_log.
>> 
>> How is possible to troubleshoot it and understand where is the problem 
>> (caller? network? receiver?)
>> 
>> 
>> 
>> Some logs from trace:
>> 
>> 
>> 
>> [Wed May 12 17:52:04.134409 2021] [ssl:debug] [pid 10532:tid 
>> 140112100849408] ssl_engine_kernel.c(1741): [client ip:port] AH02275:
>> Certificate Verification, depth 2, CRL checking mode: none (0)
>> [subject: CN=etc etc etc]
>> 
>> [Wed May 12 17:52:04.134553 2021] [ssl:debug] [pid 10532:tid 
>> 140112100849408] ssl_engine_kernel.c(1741): [client ip:port] AH02275:
>> Certificate Verification, depth 1, CRL checking mode: none (0)
>> [subject: CN=etc etc etc]
>> 
>> [Wed May 12 17:52:04.134681 2021] [ssl:debug] [pid 10532:tid 
>> 140112100849408] ssl_engine_kernel.c(1741): [client ip:port] AH02275:
>> Certificate Verification, depth 0, CRL checking mode: none (0)
>> [subject: CN=etc etc etc]
>> 
>> [Wed May 12 17:52:04.134705 2021] [ssl:trace3] [pid 10532:tid 
>> 140112100849408] ssl_engine_kernel.c(2192): [client ip:port] OpenSSL:
>> Loop: SSLv3 read client certificate A
>> 
>> [Wed May 12 17:52:04.138368 2021] [ssl:trace3] [pid 10532:tid 
>> 140112100849408] ssl_engine_kernel.c(2192): [client ip:port] OpenSSL:
>> Loop: SSLv3 read client key exchange A
>> 
>> [Wed May 12 17:52:04.138492 2021] [ssl:trace3] [pid 10532:tid 
>> 140112100849408] ssl_engine_kernel.c(2192): [client ip:port] OpenSSL:
>> Loop: SSLv3 read certificate verify A
>> 
>> [Wed May 12 17:52:04.138513 2021] [ssl:trace