bugGNU Wget - Bugs: bug #46061, wget...

 
 

bug #46061: wget https://contributors.debian.org fails with "No data received."

Submitter:  Noël Köthe <nok>
Submitted:  Sun 27 Sep 2015 04:13:54 PM UTC
   
 
Category:  Protocol Issue Severity:  3 - Normal
Priority:  5 - Normal Status:  Fixed
Privacy:  Public Assigned to:  None
Originator Name:  Open/Closed:  Closed
Release:  1.16.3 Operating System:  GNU/Linux
Reproducibility:  Every Time Fixed Release:  None
Planned Release:  None Regression:  None
Work Required:  None Patch Included:  No
* Mandatory Fields

Add a New Comment Rich Markup
   

Mon 28 Sep 2015 12:17:17 PM UTC, comment #4: 

Sorry, my patch didn't make it to the bug tracker nor to the mailing list nor to you !? Interesting, I saw it pop up on the Debian bug tracker (and I got an automatic reply from there).
I attach it here for comparison with your patch.


(file #35003)

Tim Ruehsen <rockdaboot>
Group administrator
Mon 28 Sep 2015 11:11:30 AM UTC, comment #3: 

Good analysis Tim!  I have attacheda patch that solves the problem for me

(file #35002)

Giuseppe Scrivano <gscrivano>
Group administrator
Sun 27 Sep 2015 08:03:54 PM UTC, comment #2: 

Wget is not reacting on GNUTLS_E_REHANDSHAKE. Should be straight forward...

Tim Ruehsen <rockdaboot>
Group administrator
Sun 27 Sep 2015 06:44:39 PM UTC, comment #1: 

wget in debian is using gnutls. Compiling wget using --with-ssl=openssl doesn't exhibit this bug. gnutls-cli contributors.debian.org works, though.

Ángel <angel_>
Sun 27 Sep 2015 04:13:54 PM UTC, original submission:  

Hello,

a forwarded bug from https://bugs.debian.org/797057

"We currently added "SSLVerifyClient optional" to the server configuration to support authentication with client certificates, but client certificates are not required to connect. The relevant apache configuration is here:

  https://wiki.debian.org/DebianSingleSignOn#Documentation_for_web_application_owners-1

curl can access the site."

$ LC_ALL=C wget -d https://contributors.debian.org
DEBUG output created by Wget 1.16.3 on linux-gnu.

URI encoding = 'ANSI_X3.4-1968'
converted 'https://contributors.debian.org' (ANSI_X3.4-1968) -> 'https://contributors.debian.org' (UTF-8)
--2015-09-27 18:08:27--  https://contributors.debian.org/
Certificates loaded: 180
Resolving contributors.debian.org (contributors.debian.org)... 2607:f8f0:610:4000:216:36ff:fe40:3861, 206.12.19.123
Caching contributors.debian.org => 2607:f8f0:610:4000:216:36ff:fe40:3861 206.12.19.123
Connecting to contributors.debian.org (contributors.debian.org)|2607:f8f0:610:4000:216:36ff:fe40:3861|:443... connected.
Created socket 4.
Releasing 0x000055f91c3876f0 (new refcount 1).

---request begin---
GET / HTTP/1.1
User-Agent: Wget/1.16.3 (linux-gnu)
Accept: /
Accept-Encoding: identity
Host: contributors.debian.org
Connection: Keep-Alive

---request end---
HTTP request sent, awaiting response... No data received.
Retrying.

--2015-09-27 18:08:29--  (try: 2)  https://contributors.debian.org/
Found contributors.debian.org in host_name_addresses_map (0x55f91c3876f0)
Connecting to contributors.debian.org (contributors.debian.org)|2607:f8f0:610:4000:216:36ff:fe40:3861|:443... connected.
Created socket 4.
Releasing 0x000055f91c3876f0 (new refcount 1).

---request begin---
GET / HTTP/1.1
User-Agent: Wget/1.16.3 (linux-gnu)
Accept: /
Accept-Encoding: identity
Host: contributors.debian.org
Connection: Keep-Alive

---request end---
HTTP request sent, awaiting response... No data received.
Retrying.

^C
$  openssl s_client -connect contributors.debian.org:443
CONNECTED(00000003)
depth=3 C = SE, O = AddTrust AB, OU = AddTrust External TTP Network, CN = AddTrust External CA Root
verify return:1
depth=2 C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority
verify return:1
depth=1 C = FR, ST = Paris, L = Paris, O = Gandi, CN = Gandi Standard SSL CA 2
verify return:1
depth=0 OU = Domain Control Validated, OU = Gandi Standard SSL, CN = contributors.debian.org
verify return:1
---
Certificate chain

  1. s:/OU=Domain Control Validated/OU=Gandi Standard SSL/CN=contributors.debian.org

   i:/C=FR/ST=Paris/L=Paris/O=Gandi/CN=Gandi Standard SSL CA 2
 1 s:/C=FR/ST=Paris/L=Paris/O=Gandi/CN=Gandi Standard SSL CA 2
   i:/C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust RSA Certification Authority
 2 s:/C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust RSA Certification Authority
   i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIFlDCCBHygAwIBAgIQMfAlgnw3Yfda6FqlD6XUlzANBgkqhkiG9w0BAQsFADBf
MQswCQYDVQQGEwJGUjEOMAwGA1UECBMFUGFyaXMxDjAMBgNVBAcTBVBhcmlzMQ4w
DAYDVQQKEwVHYW5kaTEgMB4GA1UEAxMXR2FuZGkgU3RhbmRhcmQgU1NMIENBIDIw
HhcNMTQxMjE3MDAwMDAwWhcNMTUxMjMxMjM1OTU5WjBiMSEwHwYDVQQLExhEb21h
aW4gQ29udHJvbCBWYWxpZGF0ZWQxGzAZBgNVBAsTEkdhbmRpIFN0YW5kYXJkIFNT
TDEgMB4GA1UEAxMXY29udHJpYnV0b3JzLmRlYmlhbi5vcmcwggGiMA0GCSqGSIb3
DQEBAQUAA4IBjwAwggGKAoIBgQDTUXqPGAz+wN+C/uGBpsJoGF16/fFufYMSBJp1
z6w8cgYP6KLeDLO+ApWEyvAUJXCrzGx6MwGZDBttMQb4w4/4hqAYApywbSUydPqZ
nx0W7//kI/EejBG/2NIN8cy4xVB7D4m8S3RZaF1SSEDvcofE1niSXbIjQGtSu6Ko
ZNPfiu4iV1ROLx45jmbMYphEUc9xxD3SnDYXDKcBLd0y37AeP7D878dqa+rZ4H+r
tAo9iaazyQECHNUeIE8Y5ASngspxArtfURyQswR36p5uARwjPtgUtYbrA35KMiUg
HgFSViocuMtHKW53QJUqTvHr6KtLSiL7J9ySx12DGBa97Lj0iV5zyyq4uRP0h1qy
rOiGnxiGeKf+9sRm+kZKO2/1tjNc9m9BDPJ9tH+cD1bkW+ZRVze/HPHsnzFVH84m
jYKImSvh9Ptpt282W1XPoHGPgg+WX4Q5b3cmLzQsivitjevXp9eaH0j4QAMa8Noa
GF72ZctDZcXXQjuXnDSI9k8g60kCAwEAAaOCAccwggHDMB8GA1UdIwQYMBaAFLOQ
p9jJr07NYTyffK1df0H9aTDqMB0GA1UdDgQWBBSu8itYsZ8cGTjya4lZxPGr4wli
dTAOBgNVHQ8BAf8EBAMCBaAwDAYDVR0TAQH/BAIwADAdBgNVHSUEFjAUBggrBgEF
BQcDAQYIKwYBBQUHAwIwSwYDVR0gBEQwQjA2BgsrBgEEAbIxAQICGjAnMCUGCCsG
AQUFBwIBFhlodHRwczovL2Nwcy51c2VydHJ1c3QuY29tMAgGBmeBDAECATBBBgNV
HR8EOjA4MDagNKAyhjBodHRwOi8vY3JsLnVzZXJ0cnVzdC5jb20vR2FuZGlTdGFu
ZGFyZFNTTENBMi5jcmwwcwYIKwYBBQUHAQEEZzBlMDwGCCsGAQUFBzAChjBodHRw
Oi8vY3J0LnVzZXJ0cnVzdC5jb20vR2FuZGlTdGFuZGFyZFNTTENBMi5jcnQwJQYI
KwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wPwYDVR0RBDgwNoIX
Y29udHJpYnV0b3JzLmRlYmlhbi5vcmeCG3d3dy5jb250cmlidXRvcnMuZGViaWFu
Lm9yZzANBgkqhkiG9w0BAQsFAAOCAQEAXU77+xxyEFoKFyfb50Qg5j311zMLIfXW
T/Rn8Ffjiz7PQS+UwidXS3RY/D3Sx+zQhhzf0cWc00Ida9z5fYPNscWefpq5DJ0L
P4PfH8RS5kN94pQNoYLjsL9T8GYzpJdmYgs2uOswMYHZNy71Or5miNZQ+tE3xJZi
KlfjLC63nFILEkmVXF0PnTfuIHrw47edbLYewxR759hXHS3zA8rqgGnAkVCh8IzN
vqYgfhbio1fFDxSnsInPl48Z9ewHbBR5VEBrEjXVxwneodYZRwB7S1SCyccczwV2
3qfolqlrmg135rx7iCH5TpKhTnknQwJeWxUMQmqDKPoIIypnY0VyXw==
-----END CERTIFICATE-----
subject=/OU=Domain Control Validated/OU=Gandi Standard SSL/CN=contributors.debian.org
issuer=/C=FR/ST=Paris/L=Paris/O=Gandi/CN=Gandi Standard SSL CA 2
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 5177 bytes and written 441 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 3072 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: C294DC945A410D580AADFB9254CC0D33B6CB1220CCE2522E86559AF90F93B1A8
    Session-ID-ctx:
    Master-Key: BE0C2D1DCCB7F7FBCB6CC7A960456BC10F98CDD7C0AD9B154567D5C768DAA4D9137FC1F17F71D1186BA1825AB0DC19BB
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - 1a f3 8c 98 3a a9 fc 8c-be 32 c1 42 e9 b3 2c 61   ....:....2.B..,a
    0010 - 0b 0d f1 14 dc d5 3f 5d-4c 78 4e a3 d3 1f 5c 8e   ......?]LxN...\.
    0020 - bf f4 5e 25 61 0b 4d 4f-49 fb a1 5d 19 31 70 30   ..^%a.MOI..].1p0
    0030 - 98 37 1b fc 25 e2 88 51-0f c5 a8 3b 3d b5 6c e9   .7..%..Q...;=.l.
    0040 - 9c 0b 7d 18 d1 5d e0 9a-02 65 9d 79 42 41 3d b5   ..}..]...e.yBA=.
    0050 - b6 57 1d b5 7d 0f 2c 00-21 c0 5c da 52 92 15 16   .W..}.,.!.\.R...
    0060 - 46 f2 2b 54 6b 2c 99 08-e2 a3 cc fa 62 d8 28 8e   F.+Tk,......b.(.
    0070 - 7d 3f 2e 50 3e 63 91 6c-5a 99 39 04 2c 26 09 4d   }?.P>c.lZ.9.,&.M
    0080 - aa ae 9b 33 76 34 ea 39-e9 f5 f7 b2 4e 3f f0 b5   ...3v4.9....N?..
    0090 - 2c 75 96 b9 4c 68 47 56-e5 76 ea 50 13 1e 4f 5b   ,u..LhGV.v.P..O[
    00a0 - be cf 1f 8b 9a 4c c2 45-9c 72 a9 fa 70 81 44 9d   .....L.E.r..p.D.
    00b0 - 9c 04 b0 94 fb 72 e3 ea-a9 73 15 b6 ba fb 8c 98   .....r...s......

    Start Time: 1443370323
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---

Noël Köthe <nok>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by gscrivano (Updated the item)
  • -email is unavailable- added by rockdaboot (Posted a comment)
  • -email is unavailable- added by angel_ (Posted a comment)
  • -email is unavailable- added by nok (Submitted the item)
  • -email is unavailable- added by nok
  •  

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-09-28 rockdaboot StatusNone Fixed
        Open/ClosedOpen Closed
    2015-09-28 rockdaboot Attached File- Added 0001-Handle-TLS-rehandshakes-in-GnuTLS-code.patch, #35003
    2015-09-28 gscrivano Attached File- Added 0001-gnutls-honor-error-GNUTLS_E_REHANDSHAKE.patch, #35002
    2015-09-27 nok Carbon-Copy- Added -email is unavailable-

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code