Debian Bug report logs - #587330
[lynx-cur] lynx-cur doesn’t handle IPv6 addresses correctly in the finger protocol (and possibly others).

version graph

Package: lynx-cur; Maintainer for lynx-cur is Atsuhito KOHDA <kohda@debian.org>; Source for lynx-cur is src:lynx-cur.

Reported by: elliot@purdy.demon.co.uk

Date: Sun, 27 Jun 2010 14:45:02 UTC

Severity: normal

Tags: fixed-upstream

Found in version lynx-cur/2.8.8dev.4-1

Fixed in version lynx-cur/2.8.8dev.6-1

Done: Atsuhito KOHDA <kohda@debian.org>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, Atsuhito KOHDA <kohda@debian.org>:
Bug#587330; Package lynx-cur. (Sun, 27 Jun 2010 14:45:04 GMT) Full text and rfc822 format available.

Acknowledgement sent to elliot@purdy.demon.co.uk:
New Bug report received and forwarded. Copy sent to Atsuhito KOHDA <kohda@debian.org>. (Sun, 27 Jun 2010 14:45:04 GMT) Full text and rfc822 format available.

Message #5 received at submit@bugs.debian.org (full text, mbox):

From: Elliot Thomas <elliot@purdy.demon.co.uk>
To: <submit@bugs.debian.org>
Subject: [lynx-cur] lynx-cur doesn’t handle IPv6 addresses correctly in the finger protocol (and possibly others).
Date: Sun, 27 Jun 2010 15:35:11 +0100
Package: lynx-cur
Version: 2.8.8dev.4-1
Severity: normal

When an IPv6 address is given to lynx in the finger protocol, lynx
will misinterpret the address.
Example:
lynx finger://[::1]

outputs:
Alert!: Invalid port number - will only use port 79!

While:
lynx finger://ip6-localhost

will give the desired output.

It seems as if lynx interprets the :1 in [::1] as a port number, and
refuses to even attempt to complete the operation. Looking at the
source, it looks like lynx will do this with all other protocols it
supports, such as news:// and gopher://, although these are quite
difficult to test. (No IPv6 gopher servers yet, no clue about news).

However, as the HTTP Parser handles the []'s separately (see line 232
to 237 of WWW/Library/implementation/HTParse.c), it doesn't share this
problem, and interprets the address correctly.

Architecture: amd64
Kernel:       Linux 2.6.32-5-amd64

Debian Release: squeeze/sid





Information forwarded to debian-bugs-dist@lists.debian.org, Atsuhito KOHDA <kohda@debian.org>:
Bug#587330; Package lynx-cur. (Sun, 27 Jun 2010 14:57:04 GMT) Full text and rfc822 format available.

Acknowledgement sent to Thomas Dickey <dickey@his.com>:
Extra info received and forwarded to list. Copy sent to Atsuhito KOHDA <kohda@debian.org>. (Sun, 27 Jun 2010 14:57:05 GMT) Full text and rfc822 format available.

Message #10 received at 587330@bugs.debian.org (full text, mbox):

From: Thomas Dickey <dickey@his.com>
To: elliot@purdy.demon.co.uk, 587330@bugs.debian.org
Cc: Atsuhito KOHDA <kohda@debian.org>
Subject: Re: Bug#587330: [lynx-cur] lynx-cur doesn’t handle IPv6 addresses correctly in the finger protocol (and possibly others).
Date: Sun, 27 Jun 2010 10:49:09 -0400 (EDT)
On Sun, 27 Jun 2010, Elliot Thomas wrote:

>
> Package: lynx-cur
> Version: 2.8.8dev.4-1
> Severity: normal
>
> When an IPv6 address is given to lynx in the finger protocol, lynx
> will misinterpret the address.
> Example:
> lynx finger://[::1]
>
> outputs:
> Alert!: Invalid port number - will only use port 79!

thanks (I can reproduce this).

-- 
Thomas E. Dickey
http://invisible-island.net
ftp://invisible-island.net




Information forwarded to debian-bugs-dist@lists.debian.org, Atsuhito KOHDA <kohda@debian.org>:
Bug#587330; Package lynx-cur. (Sun, 27 Jun 2010 17:45:08 GMT) Full text and rfc822 format available.

Acknowledgement sent to elliot@purdy.demon.co.uk:
Extra info received and forwarded to list. Copy sent to Atsuhito KOHDA <kohda@debian.org>. (Sun, 27 Jun 2010 17:45:08 GMT) Full text and rfc822 format available.

Message #15 received at 587330@bugs.debian.org (full text, mbox):

From: Elliot Thomas <elliot@purdy.demon.co.uk>
To: <587330@bugs.debian.org>
Subject: [lynx-cur] More experimentation...
Date: Sun, 27 Jun 2010 18:25:17 +0100
I did some further testing. It looks like lynx will work with IPv6
gopher. (Finding a server was pretty hard... Its called bucktooth if
anyone is interested.)

It looks like this might be a bug merely in HTFinger.c

It seems that in the case of finger:// addresses, anything lynx deems to
be the port is tested, and even IF the port passes the test (must
equal 79), it is still omitted. (because, it could only be one value,
according to lynx).

This means, if you were to type:
$ lynx finger://[:79]

It would indeed pass the test , but then you would get:
Looking up [
Unable to locate remote host [.
Alert!: Could not access finger host.

Showing us that everything past and including the colon are removed.
This also works with arbitrary numbers and/or letters appended to the
end. fir example:
$ lynx finger://[:79]09842093840298402834

You would again get:
Looking up [
Unable to locate remote host [.
Alert!: Could not access finger host.

It does, however, accept IPv6-style addresses without colons, but I'm
pretty sure these don't exist.

Hope this helps, Elliot.




Information forwarded to debian-bugs-dist@lists.debian.org, Atsuhito KOHDA <kohda@debian.org>:
Bug#587330; Package lynx-cur. (Tue, 05 Oct 2010 00:45:04 GMT) Full text and rfc822 format available.

Acknowledgement sent to dickey@his.com:
Extra info received and forwarded to list. Copy sent to Atsuhito KOHDA <kohda@debian.org>. (Tue, 05 Oct 2010 00:45:04 GMT) Full text and rfc822 format available.

Message #20 received at 587330@bugs.debian.org (full text, mbox):

From: Thomas Dickey <dickey@his.com>
To: 587330@bugs.debian.org
Cc: 587330-submitter@bugs.debian.org
Subject: re: #587330 [lynx-cur] lynx-cur doesn't handle IPv6 addresses correctly in the finger protocol (and possibly others).
Date: Mon, 04 Oct 2010 20:40:20 -0400
[Message part 1 (text/plain, inline)]
This is addressed in 2.8.8dev.6

-- 
Thomas E. Dickey <dickey@invisible-island.net>
http://invisible-island.net
ftp://invisible-island.net
[signature.asc (application/pgp-signature, inline)]

Added tag(s) fixed-upstream. Request was from Thomas Dickey <dickey@his.com> to control@bugs.debian.org. (Tue, 05 Oct 2010 00:45:08 GMT) Full text and rfc822 format available.

Message sent on to elliot@purdy.demon.co.uk:
Bug#587330. (Tue, 05 Oct 2010 00:45:12 GMT) Full text and rfc822 format available.

Reply sent to Atsuhito KOHDA <kohda@debian.org>:
You have taken responsibility. (Sat, 06 Nov 2010 12:21:08 GMT) Full text and rfc822 format available.

Notification sent to elliot@purdy.demon.co.uk:
Bug acknowledged by developer. (Sat, 06 Nov 2010 12:21:08 GMT) Full text and rfc822 format available.

Message #30 received at 587330-close@bugs.debian.org (full text, mbox):

From: Atsuhito KOHDA <kohda@debian.org>
To: 587330-close@bugs.debian.org
Subject: Bug#587330: fixed in lynx-cur 2.8.8dev.6-1
Date: Sat, 06 Nov 2010 12:17:39 +0000
Source: lynx-cur
Source-Version: 2.8.8dev.6-1

We believe that the bug you reported is fixed in the latest version of
lynx-cur, which is due to be installed in the Debian FTP archive:

lynx-cur-wrapper_2.8.8dev.6-1_all.deb
  to main/l/lynx-cur/lynx-cur-wrapper_2.8.8dev.6-1_all.deb
lynx-cur_2.8.8dev.6-1.diff.gz
  to main/l/lynx-cur/lynx-cur_2.8.8dev.6-1.diff.gz
lynx-cur_2.8.8dev.6-1.dsc
  to main/l/lynx-cur/lynx-cur_2.8.8dev.6-1.dsc
lynx-cur_2.8.8dev.6-1_i386.deb
  to main/l/lynx-cur/lynx-cur_2.8.8dev.6-1_i386.deb
lynx-cur_2.8.8dev.6.orig.tar.gz
  to main/l/lynx-cur/lynx-cur_2.8.8dev.6.orig.tar.gz
lynx_2.8.8dev.6-1_all.deb
  to main/l/lynx-cur/lynx_2.8.8dev.6-1_all.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 587330@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Atsuhito KOHDA <kohda@debian.org> (supplier of updated lynx-cur package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Fri, 05 Nov 2010 16:05:27 +0900
Source: lynx-cur
Binary: lynx-cur lynx-cur-wrapper lynx
Architecture: source all i386
Version: 2.8.8dev.6-1
Distribution: unstable
Urgency: low
Maintainer: Atsuhito KOHDA <kohda@debian.org>
Changed-By: Atsuhito KOHDA <kohda@debian.org>
Description: 
 lynx       - Text-mode WWW Browser (transitional package)
 lynx-cur   - Text-mode WWW Browser with NLS support (development version)
 lynx-cur-wrapper - Wrapper for lynx-cur
Closes: 586762 587330 592883
Changes: 
 lynx-cur (2.8.8dev.6-1) unstable; urgency=low
 .
   * New Upstream Release.
    - amend change for Debian #514897 to exclude XML documents
      (Closes: #592883)
    - use HTParsePort() in a few places, e.g., HTFinger.c, to allow for IPv6
      addresses with colons (Closes: #587330)
    - add option -unique-urls (Closes: #586762)
   * Updated patch-1 for a new upstream source.
Checksums-Sha1: 
 0a500c3754e403bf9660e86f0264acc2b8715a69 1181 lynx-cur_2.8.8dev.6-1.dsc
 6ddfd4583d98f9a5ca024702ec4c4b58f004de63 3446351 lynx-cur_2.8.8dev.6.orig.tar.gz
 b288517c01ef225ceabeca41f7e516201203fe33 32087 lynx-cur_2.8.8dev.6-1.diff.gz
 c90aab2ae0a7d061453fe917d77cc881a8b62e62 220376 lynx-cur-wrapper_2.8.8dev.6-1_all.deb
 923194aebbfd4452d5f0abfbf059447dbbc6cb38 217846 lynx_2.8.8dev.6-1_all.deb
 9ee1e4ffae57cdbc8c591f72136224e8e79490b1 2113146 lynx-cur_2.8.8dev.6-1_i386.deb
Checksums-Sha256: 
 1e8c1d324793d7cf2b6c083c1a684ad5074f4f73878da73f1dd8d9d6fd51813f 1181 lynx-cur_2.8.8dev.6-1.dsc
 a7020e09f0dd8c0104a06fa2a6a8dc24a5b0f2bb2605af9bb4ccc16bc6920153 3446351 lynx-cur_2.8.8dev.6.orig.tar.gz
 0b7e8602b5adaf20d79c68314fb6449ba4810dba33d8d89cbc1e8197d8aaa31a 32087 lynx-cur_2.8.8dev.6-1.diff.gz
 f0be9f1efb8583c687c6797fc4ff200bf7f0d024507700e4c68686474c0c43a4 220376 lynx-cur-wrapper_2.8.8dev.6-1_all.deb
 cbf447fdac0fc89efbcac903e9656544d0814da893973b0976f520f21e1ccbd9 217846 lynx_2.8.8dev.6-1_all.deb
 f1ed381d5d866bb39fd945be7909c05f35d68d59847ccd459294a6bc80a4c872 2113146 lynx-cur_2.8.8dev.6-1_i386.deb
Files: 
 63c058f75006878861deaa0ff792bded 1181 web extra lynx-cur_2.8.8dev.6-1.dsc
 8cf75c5c7f0bb9950fe9e3a87263e439 3446351 web extra lynx-cur_2.8.8dev.6.orig.tar.gz
 06a3faba8437cfb3015a32ae5c27ece4 32087 web extra lynx-cur_2.8.8dev.6-1.diff.gz
 5aba32fca26b1fdab488b83bb87988d4 220376 web extra lynx-cur-wrapper_2.8.8dev.6-1_all.deb
 7460f7dfe63a6a0aeae8f3aca135bb1d 217846 web extra lynx_2.8.8dev.6-1_all.deb
 25460d9eee5604de0a2f23ab7f0b9495 2113146 web extra lynx-cur_2.8.8dev.6-1_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAkzVQaAACgkQ1IXdL1v6kOwRuQCffQPyeFhqqjpy8KU5Srx+6xCY
N64An3OQMZT7E3Jsks6PL8jxPUoY+yut
=Gu+m
-----END PGP SIGNATURE-----





Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Mon, 07 Feb 2011 07:53:12 GMT) Full text and rfc822 format available.

Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Sat Apr 19 12:17:29 2014; Machine Name: beach.debian.org

Debian Bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.