Debian Bug report logs - #785383
lynx: Can't connect to (some) https sites

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Kurt Roeckx <kurt@roeckx.be>

To: submit@bugs.debian.org

Subject: lynx: Can't connect to (some) https sites

Date: Fri, 15 May 2015 16:14:59 +0200

Package: lynx
Version: 2.8.9dev1-2
Severity: important

Hi,

Recently I can't connect to some https sites anymore.  At least
any *.debian.org site doesn't work, but various other https
websites do work normally.

If I look at it with wireshark I'm getting a SeverHelloDone
message, so the whole TLS connection isn't set up yet, and it
just closes the connection.

When using: 
$ lynx https://www.debian.org/

I get:
Looking up www.debian.org
Making HTTPS connection to www.debian.org
Retrying connection without TLS.
Looking up www.debian.org
Making HTTPS connection to www.debian.org
Alert!: Unable to make secure connection to remote host.

lynx: Can't access startfile https://www.debian.org/



(The "Retrying connection without TLS" doesn't make much sense.)

I can perfectly connect to the website using gnutls-cli, so I have
no idea what is going on.

The version in wheezy works without problems, but the jessie and
testing don't.


Kurt

Message #10 received at 785383@bugs.debian.org (full text, mbox, reply):

From: Axel Beckert <abe@debian.org>

To: Kurt Roeckx <kurt@roeckx.be>, 785383@bugs.debian.org

Subject: Re: Bug#785383: lynx: Can't connect to (some) https sites

Date: Fri, 15 May 2015 17:29:28 +0200

Control: reassign -1 lynx-cur 2.8.9dev1-2
Control: found -1 2.8.9dev5-2
Control: found -1 2.8.9dev6-1
Control: fixed -1 2.8.9dev6-2
Control: tag -1 + confirmed

Hi Kurt,

Kurt Roeckx wrote:
> Package: lynx

The correct package is btw. lynx-cur. Hence reassigning.

> Version: 2.8.9dev1-2

Am I right that this is Debian Jessie, i.e. Debian Stable?

> When using: 
> $ lynx https://www.debian.org/
> 
> I get:
> Looking up www.debian.org
> Making HTTPS connection to www.debian.org
> Retrying connection without TLS.
> Looking up www.debian.org
> Making HTTPS connection to www.debian.org
> Alert!: Unable to make secure connection to remote host.
> 
> lynx: Can't access startfile https://www.debian.org/
[...]
> The version in wheezy works without problems, but the jessie and
> testing don't.

The version in Unstable doesn't work either, but the version in
Experimental works again.

		Regards, Axel
-- 
 ,''`.  |  Axel Beckert <abe@debian.org>, http://people.debian.org/~abe/
: :' :  |  Debian Developer, ftp.ch.debian.org Admin
`. `'   |  4096R: 2517 B724 C5F6 CA99 5329  6E61 2FF9 CD59 6126 16B5
  `-    |  1024D: F067 EA27 26B9 C3FC 1486  202E C09E 1D89 9593 0EDE

Message #29 received at 785383@bugs.debian.org (full text, mbox, reply):

From: Kurt Roeckx <kurt@roeckx.be>

To: Axel Beckert <abe@debian.org>

Cc: 785383@bugs.debian.org

Subject: Re: Bug#785383: lynx: Can't connect to (some) https sites

Date: Fri, 15 May 2015 17:56:02 +0200

On Fri, May 15, 2015 at 05:29:28PM +0200, Axel Beckert wrote:
> Control: reassign -1 lynx-cur 2.8.9dev1-2
> Control: found -1 2.8.9dev5-2
> Control: found -1 2.8.9dev6-1
> Control: fixed -1 2.8.9dev6-2
> Control: tag -1 + confirmed
> 
> Hi Kurt,
> 
> Kurt Roeckx wrote:
> > Package: lynx
> 
> The correct package is btw. lynx-cur. Hence reassigning.

I actually knew this, but they do both exist.

> > Version: 2.8.9dev1-2
> 
> Am I right that this is Debian Jessie, i.e. Debian Stable?

Yes, I tried various version and this is the oldest I tried that
had the issue.  But it's really testing using the version from
jessie.


Kurt

Message #34 received at 785383@bugs.debian.org (full text, mbox, reply):

From: Axel Beckert <abe@debian.org>

To: Kurt Roeckx <kurt@roeckx.be>

Cc: 785383@bugs.debian.org

Subject: Re: Bug#785383: lynx: Can't connect to (some) https sites

Date: Fri, 15 May 2015 18:07:39 +0200

Control: tag -1 + sid stretch

Hi Kurt,

Kurt Roeckx wrote:
> > Kurt Roeckx wrote:
> > > Package: lynx
> > 
> > The correct package is btw. lynx-cur. Hence reassigning.
> 
> I actually knew this, but they do both exist.

Yeah, lynx is currently just a transitional package. (But this is
bound to change.)

> > > Version: 2.8.9dev1-2
> > 
> > Am I right that this is Debian Jessie, i.e. Debian Stable?
> 
> Yes, I tried various version and this is the oldest I tried that
> had the issue.  But it's really testing using the version from
> jessie.

Thanks for that information. So this issue is likely not an issue in
Lynx per se. Because the version in Jessie works fine on Jessie as I
can confirm. Looks to me if it's a combination of the version of
lynx(-cur) and the GnuTLS library.

I guess Andreas can tell more than me on this. In the end -- you and
Andreas maintain the two most important SSL implementations in Debian,
not me. ;-)

		Regards, Axel
-- 
 ,''`.  |  Axel Beckert <abe@debian.org>, http://people.debian.org/~abe/
: :' :  |  Debian Developer, ftp.ch.debian.org Admin
`. `'   |  4096R: 2517 B724 C5F6 CA99 5329  6E61 2FF9 CD59 6126 16B5
  `-    |  1024D: F067 EA27 26B9 C3FC 1486  202E C09E 1D89 9593 0EDE

Message #41 received at 785383@bugs.debian.org (full text, mbox, reply):

From: Andreas Metzler <ametzler@bebt.de>

To: 785383@bugs.debian.org

Cc: Kurt Roeckx <kurt@roeckx.be>

Subject: Re: [pkg-lynx-maint] Bug#785383: lynx: Can't connect to (some) https sites

Date: Fri, 15 May 2015 19:16:37 +0200

On 2015-05-15 Axel Beckert <abe@debian.org> wrote:
[...]
> Thanks for that information. So this issue is likely not an issue in
> Lynx per se. Because the version in Jessie works fine on Jessie as I
> can confirm. Looks to me if it's a combination of the version of
> lynx(-cur) and the GnuTLS library.

Hello,

GnuTLS has become more picky when evaluating priority strings and
lynx is using an incorrect one.

We will need to update lynx in stable, too, since the changed GnuTLS
behavior is an effect of a deliberate change to fix
<http://www.gnutls.org/security.html#GNUTLS-SA-2015-2> which is
labeled as "Minor issue; Can be fixed along with a future DSA" on
<https://security-tracker.debian.org/tracker/TEMP-0000000-8E8BA8>.

cu Andreas
-- 
`What a good friend you are to him, Dr. Maturin. His other friends are
so grateful to you.'
`I sew his ears on from time to time, sure'

Message #46 received at 785383@bugs.debian.org (full text, mbox, reply):

From: Axel Beckert <abe@debian.org>

To: 785383@bugs.debian.org

Subject: Re: Bug#785383: lynx: Can't connect to (some) https sites

Date: Fri, 15 May 2015 19:55:35 +0200

Control: tag -1 - sid stretch

Hi Andreas,

Andreas Metzler wrote:
> On 2015-05-15 Axel Beckert <abe@debian.org> wrote:
> > […] So this issue is likely not an issue in Lynx per se. Because
> > the version in Jessie works fine on Jessie as I can confirm. Looks
> > to me if it's a combination of the version of lynx(-cur) and the
> > GnuTLS library.
[…]
> We will need to update lynx in stable, too,

Ok, removing the tags sid and stretch again.

		Regards, Axel
-- 
 ,''`.  |  Axel Beckert <abe@debian.org>, http://people.debian.org/~abe/
: :' :  |  Debian Developer, ftp.ch.debian.org Admin
`. `'   |  4096R: 2517 B724 C5F6 CA99 5329  6E61 2FF9 CD59 6126 16B5
  `-    |  1024D: F067 EA27 26B9 C3FC 1486  202E C09E 1D89 9593 0EDE

Message #53 received at 785383@bugs.debian.org (full text, mbox, reply):

From: Kurt Roeckx <kurt@roeckx.be>

To: Andreas Metzler <ametzler@bebt.de>

Cc: 785383@bugs.debian.org

Subject: Re: [pkg-lynx-maint] Bug#785383: lynx: Can't connect to (some) https sites

Date: Fri, 15 May 2015 22:14:12 +0200

On Fri, May 15, 2015 at 07:16:37PM +0200, Andreas Metzler wrote:
> On 2015-05-15 Axel Beckert <abe@debian.org> wrote:
> [...]
> > Thanks for that information. So this issue is likely not an issue in
> > Lynx per se. Because the version in Jessie works fine on Jessie as I
> > can confirm. Looks to me if it's a combination of the version of
> > lynx(-cur) and the GnuTLS library.
> 
> Hello,
> 
> GnuTLS has become more picky when evaluating priority strings and
> lynx is using an incorrect one.

Can you explain a little more what's wrong with the priority
string?  (I have no idea what the current value is.)

So I've been looking at the packets it send, and it seems that
when using lynx it's not sending a signature algorithm extention
in the ClientHello at all, which for the server means it's the
default and should have used sha1, rsa.

Using gnutls-cli it sends a whole bunch of extensions it doesn't
send with lynx including the signature alorithms.

With lynx it's also sending an other cipher list, which doesn't
include any GCM based cipher suite.  It should probably use some
default string instead.

But I don't understand why gnutls would close the connection in
that case and it seems you can get it into an inconsistent state.


Kurt

Message #58 received at 785383@bugs.debian.org (full text, mbox, reply):

From: Andreas Metzler <ametzler@bebt.de>

To: Kurt Roeckx <kurt@roeckx.be>, 785383@bugs.debian.org

Subject: Re: [pkg-lynx-maint] Bug#785383: Bug#785383: lynx: Can't connect to (some) https sites

Date: Sat, 16 May 2015 07:50:39 +0200

On 2015-05-15 Kurt Roeckx <kurt@roeckx.be> wrote:
> On Fri, May 15, 2015 at 07:16:37PM +0200, Andreas Metzler wrote:
[...] 
>> GnuTLS has become more picky when evaluating priority strings and
>> lynx is using an incorrect one.

> Can you explain a little more what's wrong with the priority
> string?  (I have no idea what the current value is.)

Hello,

the whole issue first showed up as bug report against gnutls
<https://bugs.debian.org/784430> (I have kept it there for the time
being to avoid duplicates), so I can sum up the the key points
nicely:

The actual string is
NONE:+VERS-SSL3.0:+VERS-TLS1.2:+VERS-TLS1.1:+VERS-TLS1.0:+AES-256-GCM:+AES-128-GCM:+AES-256-CBC:+AES-128-CBC:+CAMELLIA-256-CBC:+CAMELLIA-128-CBC:+3DES-CBC:+COMP-NULL:+DHE-RSA:+RSA:+DHE-DSS:+SHA1:+MD5
(lynx -trace to the rescue ;-)

As it starts up with NONE it implicitely disables SIGN-* (Signature
algorithms), CURVE-* (Elliptic curves) and CTYPE-* (Certificate type).
The absence of SIGN-* breaks any TLS1.2 connections. (Do not ask me
why, Nikos Mavrogiannopoulos said so [1], experimenting with
gnutls-bin --priority=NORMAL:-SIGN-ALL and
--priority=NORMAL:-VERS-TLS1.2:-SIGN-ALL shows he is right.)

[...]
> With lynx it's also sending an other cipher list, which doesn't
> include any GCM based cipher suite.  It should probably use some
> default string instead.
[...]

That is exactly what lynx-cur/experimental does. I read Thomas
Dickey's (lynx upstream) comment "simpler settings sounds like an
improvement..." as agreement. ;-)
http://lists.nongnu.org/archive/html/lynx-dev/2015-05/msg00014.html

cu Andreas

[1] http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/8152
-- 
`What a good friend you are to him, Dr. Maturin. His other friends are
so grateful to you.'
`I sew his ears on from time to time, sure'

Message #63 received at 785383-close@bugs.debian.org (full text, mbox, reply):

From: Andreas Metzler <ametzler@debian.org>

To: 785383-close@bugs.debian.org

Subject: Bug#785383: fixed in lynx-cur 2.8.9dev6-3

Date: Sat, 16 May 2015 16:28:48 +0000

Source: lynx-cur
Source-Version: 2.8.9dev6-3

We believe that the bug you reported is fixed in the latest version of
lynx-cur, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 785383@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Andreas Metzler <ametzler@debian.org> (supplier of updated lynx-cur package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 16 May 2015 11:16:43 +0200
Source: lynx-cur
Binary: lynx-cur lynx
Architecture: source i386 all
Version: 2.8.9dev6-3
Distribution: unstable
Urgency: medium
Maintainer: Debian Lynx Packaging Team <pkg-lynx-maint@lists.alioth.debian.org>
Changed-By: Andreas Metzler <ametzler@debian.org>
Description:
 lynx       - Text-mode WWW Browser (transitional package)
 lynx-cur   - classic non-graphical (text-mode) web browser
Closes: 785383
Changes:
 lynx-cur (2.8.9dev6-3) unstable; urgency=medium
 .
   * Upload to unstable. The change in the previous upload (to experimental)
     Closes: #785383.
Checksums-Sha1:
 4beb7ca636b1d92168b8010775b61815f263ce20 2229 lynx-cur_2.8.9dev6-3.dsc
 3d652696564e26cd43c2caed5920185298ea753e 26308 lynx-cur_2.8.9dev6-3.debian.tar.xz
 34c63e216811a039daed4596afb299c229f9c880 1689184 lynx-cur_2.8.9dev6-3_i386.deb
 431515b8bfaac1a2909e2d54cdd675fcb4ce3916 235992 lynx_2.8.9dev6-3_all.deb
Checksums-Sha256:
 76b1e073dbc673d1dcf0f76545eeaa0abab5765e35296ba2f5a8cfa1af13bec3 2229 lynx-cur_2.8.9dev6-3.dsc
 4a561e12771c9f47a2e40f573f4624a6a734643a586af21aa4ae38db75d001f2 26308 lynx-cur_2.8.9dev6-3.debian.tar.xz
 c04418cb41c10f2944ad67ac235dd4c9765d093b922930ae80c9178e26a925bf 1689184 lynx-cur_2.8.9dev6-3_i386.deb
 9ba3c8689fd0209b0bf3e0a813b68ea96f443d7943a21cfb9751924b4db45060 235992 lynx_2.8.9dev6-3_all.deb
Files:
 1fbd80d3ec7c5d7e0d5752aa69f7b64e 2229 web extra lynx-cur_2.8.9dev6-3.dsc
 26562d5dc8611e8e7fb02c76dd397c17 26308 web extra lynx-cur_2.8.9dev6-3.debian.tar.xz
 e6b27c8fc606514dee69329aae3404ca 1689184 web extra lynx-cur_2.8.9dev6-3_i386.deb
 09bc4e192ae4678ee2a59d57e45295ef 235992 oldlibs extra lynx_2.8.9dev6-3_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJVVwwRAAoJEKVPAYVDghSEkegQAI97/by0dTDt5ZIBeUMS4DNM
eWb46Uha72tVZLSJWuio/maWFjnpJ1tGrwRxsWVA8MwclPrdb0Cd/4JLhkBeu2R8
SwK8+/XZ7gJ4ZHJ+JZjdxbrOfvay7P54Rp3XhKk3pJ+b5Unth08y1xEMLVWNxO1Y
IPM+1WWfaIzRSZA16muq5s0QvDH8oHRQy2y3KdfLUfcq7ylsJEg/a+bJZ+5+HcM+
kfza9LWWdmq3JkC+O/ettSMIO+PqUyZhVm8x9hcwiLfanKe40ujMn5wTE6hUR43V
aYg/K6f4czol3R7BWH7Hc0OYnfM2/flOC+ZBDKlicF8zUOkpDi4GqcOhUF21pSQu
G1/xnqqNd9Zj5QupQN/vKWa4Fxzzruhg6XZUkQ74BnmAmXO47zkDq75m/pY9wk2C
9iC/kHm9D/CNEPTuwKCNMIquX2QVb8L1kBmlZo70GfVx44VQTn6fjz+9ei3XQzu1
Bml+2OiviBTeL1vPqCABzzLwC6Bcfua5od9fHAbLITl4HxselXPl60LGaI7+jzoQ
px3XnsicYa5SARlSG1yL0j8nSKVp+8LhiB7XlTH92iI++o3ET8KsNRXth0sn7GVw
1aTNdm2SXdwF69zV5Tq3l2Ys5QyE7CsH1/FuYN7U36ZDFv9UIrLZUep+FwxoRhmE
oRzLThiDOfBxxDdln7r9
=KWW5
-----END PGP SIGNATURE-----

Message #74 received at 784430-close@bugs.debian.org (full text, mbox, reply):

From: Andreas Metzler <ametzler@debian.org>

To: 784430-close@bugs.debian.org

Subject: Bug#784430: fixed in lynx-cur 2.8.9dev1-2+deb8u1

Date: Sat, 20 Jun 2015 11:02:11 +0000

Source: lynx-cur
Source-Version: 2.8.9dev1-2+deb8u1

We believe that the bug you reported is fixed in the latest version of
lynx-cur, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 784430@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Andreas Metzler <ametzler@debian.org> (supplier of updated lynx-cur package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Fri, 05 Jun 2015 13:30:14 +0200
Source: lynx-cur
Binary: lynx-cur lynx-cur-wrapper lynx
Architecture: source all i386
Version: 2.8.9dev1-2+deb8u1
Distribution: jessie
Urgency: medium
Maintainer: Atsuhito KOHDA <kohda@debian.org>
Changed-By: Andreas Metzler <ametzler@debian.org>
Description:
 lynx       - Text-mode WWW Browser (transitional package)
 lynx-cur   - Text-mode WWW Browser with NLS support (development version)
 lynx-cur-wrapper - Wrapper for lynx-cur (transitional package)
Closes: 784430
Changes:
 lynx-cur (2.8.9dev1-2+deb8u1) jessie; urgency=medium
 .
   * gnutls_set_default_priority.diff: Use gnutls_set_default_priority()
     instead of a custom priority string. The fix for the GnuTLS issue
     GNUTLS-SA-2015-2 combined with a buggy GnuTLS priority string in lynx
     breaks lynx SSL support. Preemptively apply the fix to lynx before the
     GnuTLS issue is fixed in stable. Closes: #784430
Checksums-Sha1:
 ee84f6fb33a7985eac2b78d0dff8a2a5d5532fb1 1984 lynx-cur_2.8.9dev1-2+deb8u1.dsc
 2c971825b84b1d229d0930ce6d196173d4804520 34082 lynx-cur_2.8.9dev1-2+deb8u1.diff.gz
 128e231750e12dfe5c1aac9d0e4bceac6e24d5b8 231156 lynx-cur-wrapper_2.8.9dev1-2+deb8u1_all.deb
 5c3a4d9dbf36c929de82a33ccfc22701367eba7a 231570 lynx_2.8.9dev1-2+deb8u1_all.deb
 f2cb8f58d073c44f0633e11f6de84ddd41343000 1640934 lynx-cur_2.8.9dev1-2+deb8u1_i386.deb
Checksums-Sha256:
 7f4b47263fdb3744dac8e7c9190d68350732a0b4f016463e55472959740f97c7 1984 lynx-cur_2.8.9dev1-2+deb8u1.dsc
 9ca24bfc438f5df595b798442880f60c173c67636e718408d4cc4545676aa4b6 34082 lynx-cur_2.8.9dev1-2+deb8u1.diff.gz
 dd666d07176881f45b4955dbcdb652196bda182a59b5f3e021055cc8af6ff716 231156 lynx-cur-wrapper_2.8.9dev1-2+deb8u1_all.deb
 04092926478145fd1726498205c9229a12c905d2f52021af6cadb6a28c61bdaf 231570 lynx_2.8.9dev1-2+deb8u1_all.deb
 6d0fcc6d3dcb0af978d76d94b81b07b40c83dfb2c1e482de0cd31133aebf1c1c 1640934 lynx-cur_2.8.9dev1-2+deb8u1_i386.deb
Files:
 c50933616be2807a98c0d0b17890c446 1984 web extra lynx-cur_2.8.9dev1-2+deb8u1.dsc
 3231c2c47eb4bcb49abfb79a12118ff8 34082 web extra lynx-cur_2.8.9dev1-2+deb8u1.diff.gz
 868585652eec604fced3d6b70fd859fb 231156 oldlibs extra lynx-cur-wrapper_2.8.9dev1-2+deb8u1_all.deb
 14eb1c632fcdadb53178de952b5fcfcf 231570 oldlibs extra lynx_2.8.9dev1-2+deb8u1_all.deb
 3e65350c91ee21535172d199b8ecf53b 1640934 web extra lynx-cur_2.8.9dev1-2+deb8u1_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJVhESAAAoJEKVPAYVDghSE2TEP/3WyEtYLU1EfPtDrkvhSoKrd
TNlvZ00mHsageVD4mCbg2xc1bZtkZPVkJvCNB0KwoZTs049sQfCGwbUZA0lpgi/a
N1VSsuuevu03vg/tjISRzGZEabsPLQdgMvR/uuR/WzHvsJdjc3eS24nFSvCm4J7g
stPUEYnRj2pL99z0TASOjzB1pyI1oVgqs4Y/+y1dHCwhMGmUwTrMGT/E3NNB7h14
yrOIh4fgDlwnHPJPJjQgA/3EWUXp3qXkzFUHuzeaQvDnX1d1Mgq1qZAByzLoYCkb
JML6YfX4+ijE5xMtMlZXSMf4ly9f8v8zjdcdl+ilI3xGXwTVfktOXKj2bnmmuHei
kC4m9nlmbEpSI/56l5nFFxTvWPB55JwPON8Qv+FTcPtyFasIPxnZT/0rBnPn3rb1
/WwUekTtHQBXtlUmTr1rqJ122IdvC4clQGxNZhQJKyqM53514aiXkJF1ClFYORG+
JOqgId4lNqEh95YapRhpzN3T58APdh8nWNibvpr2TNVn2rHvwMNDN2irdeKSSNhi
/NnKEPKguisHl9zyEaUwdWLW9bTHVKh17sBUIzaR2aMkDnOAtf2nd1kxutE0rAF2
0mZN5ya5TTrNz/ojs4Rm8H33NdskGgl/gMj8S5aQJWjCXOqhFxeu75Zu2r7dq4wZ
4hodITlosUttdNPALV44
=Wu/9
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.