Re: [Bug-wget] What are the tests testing?

[Josef Moellers]

On 12.06.2017 11:55, Josef Moellers wrote:
> On 12.06.2017 11:48, Tim Rühsen wrote:
>> On 06/12/2017 10:42 AM, Josef Moellers wrote:
>>> On 12.06.2017 10:00, Tim Rühsen wrote:
>>>> Hi Josef,
>>>>
>>>>
>>>> On 06/12/2017 09:23 AM, Josef Moellers wrote:
>>>>> Hello Tim,
>>>>>
>>>>> Thanks for the reply.
>>>>>
>>>>> On 10.06.2017 13:36, Tim Rühsen wrote:
>>>>>> On Freitag, 9. Juni 2017 17:02:15 CEST Josef Moellers wrote:
>>>>>>> Hi,
>>>>>>
>>>>>> Hi Josef,
>>>>>>
>>>>>>> I'm currently trying to build test suites for openQA.
>>>>>>> One of the candidates is wget and, luckily, it already provides quite an
>>>>>>> extensive test suite.
>>>>>>> I have successfully built an RPM which has all that is needed for the 
>>>>>>> tests.
>>>>>>> One test, Test-ftp-iri-fallback.px, fails on SLES12-SP2 and I can't see
>>>>>>> why. 
>>>>>>
>>>>>> Look at tests/Test-ftp-iri-fallback.log, if you can't interpret the 
>>>>>> content 
>>>>>> send it here.
>>>>>
>>>>> I cannot find any such file, no *.log" anywhere in the vicinity of the
>>>>> tests.
>>>>
>>>> Ok, the .log files just contain the output of each single test when
>>>> tested with 'make check'. If you use run-px, copy & pasting from the
>>>> console is the right thing to do.
>>>>
>>>>> Ah ... maybe I should have addede that I'm working on a slightly older
>>>>> version of wget: 1.14, which we ship with SLES12.
>>>>
>>>> So I compiled 1.14 (git tag v1.14) and used run-px to run the test suite
>>>> - but still can't reproduce the problem (Debian unstable here, `locale`
>>>> shows all set to 'en_US.UTF-8').
>>>>
>>>>>
>>>>> 227 Entering Passive Mode (127,0,0,1,155,189)
>>>>> --> RETR français.txt^M
>>>>>
>>>>> 150 Opening ASCII mode data connection.
>>>>> Length: 12 (unauthoritative)
>>>>>
>>>>>      0K                                                       100% 
>>>>> 2.95M=0s
>>>>>
>>>>> 226 File retrieval complete. Data connection has been closed.
>>>>> 2017-06-09 16:42:53 (2.95 MB/s) - â<80><98>français.txtâ<80><99> saved 
>>>>> [12]
>>>>>
>>>>> Test failed: file français.txt not downloaded
>>>>
>>>> My out put looks identical except the these last lines:
>>>>
>>>> 227 Entering Passive Mode (127,0,0,1,175,123)
>>>> --> RETR français.txt
>>>>
>>>> 150 Opening ASCII mode data connection.
>>>> Length: 12 (unauthoritative)
>>>>
>>>>      0K                                                       100% 2.05M=0s
>>>>
>>>> 226 File retrieval complete. Data connection has been closed.
>>>> 2017-06-12 09:39:27 (2.05 MB/s) - ‘fran\347ais.txt’ saved [12]
>>>>
>>>> Test successful.
>>>>
>>>>
>>>> I just can guess:
>>>> - something with your locale (what does the 'locale' command output ?)
>>>
>>> LANG=POSIX
>>> LC_CTYPE=en_US.UTF-8
>>> LC_NUMERIC="POSIX"
>>> LC_TIME="POSIX"
>>> LC_COLLATE="POSIX"
>>> LC_MONETARY="POSIX"
>>> LC_MESSAGES="POSIX"
>>> LC_PAPER="POSIX"
>>> LC_NAME="POSIX"
>>> LC_ADDRESS="POSIX"
>>> LC_TELEPHONE="POSIX"
>>> LC_MEASUREMENT="POSIX"
>>> LC_IDENTIFICATION="POSIX"
>>> LC_ALL=
>>>
>>> Changing everything to en_US.UTF-8 doesn't help:
>>> I added "export LC...=en_US.UTF-8" lines prior to running the test.
>>
>> I used your settings, but still the tests succeed.
>>
>>> I must admit, I never really understood this "locale" thingy, it bites
>>> my whenever I come close.
>>
>> Just take your time and read up about charset conversion, it doesn't
>> take too long :-)
>>
>>>> - something with iconv() function
>>>>
>>>> Does the same test fail if you use Wget 1.19.1 ?
>>>
>>> I can't get it to build on SLES12 as it does not have libidn2(-devel)!
>>>
>>> I'll keep on trying, but until then ...
>>
>> There is no debug output by default with wget 1.14 (I didn't think of
>> it, sorry)... please add '-d' to the command line in
>> Test-ftp-iri-fallback.px, and send that output. Something must go wrong
>> there...
> 
> It's attached as "out"
> 
>>
>> And then go back to v1.18 and try to build/test that (or eventually to
>> v1.17.1). That should compile with libidn instead libidn2.
> 
> I'll first try to build 1.14 without any ouf our local patches. As you
> say: it works on your system (maybe I should also try on a local Ubuntu
> machine), so it's strange that it doesn't work on my VM. Maybe there's
> something in one of the patches ...

FYI It's the attached patch which is supposed to fix CVE-2016-4971!

Without this patch, the test succeeds, with this patch, the test fails.

Josef

wget-CVE-2016-4971.patch
Description: Text Data

signature.asc
Description: OpenPGP digital signature