使用IO :: Socket :: SSL回答浏览器请求

时间：2016-12-28 15:00:18

标签： perl ssl

最后提出的问题，问题的第一个详细描述以及我已经测试过的内容

我正在编写一些代码来向其他人展示一些基本原则。代码永远不会有效，并且意图进行简化。

我的目标（来自其他人的appart）是编写一个使用Web-Certificat加密其网络流量的简单应用程序。

起点是不加密的应用程序：

#!/usr/bin/env perl
use strict;
use warnings;
use IO::Socket::INET;

# auto-flush on socket
$| = 1;

# creating a listening socket
my $socket = new IO::Socket::INET (
    LocalAddr     => '0.0.0.0',     # local server address
    LocalPort     => '7777',        # local server port
    Listen        => 5,             # queue size for connections
    Proto         => 'tcp',         # protocol used
);
die "cannot create socket $!\n" unless $socket;
print "server waiting for client connection on port 7777\n";

while(1)
{
    # waiting for a new client connection
    my $client_socket = $socket->accept() or die "socket accept failed $!";

    # get information about a newly connected client
    my $client_address = $client_socket->peerhost();
    my $client_port    = $client_socket->peerport();
    print "connection from $client_address:$client_port\n";

    # read up to 1024 characters from the connected client
    my $client_data = '';
    sysread( $client_socket, $client_data, 1024);
    print "received data: $client_data\n";

    # write response data to the connected client
    print $client_socket "Hey $client_data!";

    # notify client that response has been sent
    shutdown($client_socket, 1);
}

END {
    $socket->close();
}

可以使用此客户端调用此服务器应用程序：

#!/usr/bin/env perl
use IO::Socket::INET;

# auto-flush on socket
$| = 1;

# create a connecting socket
my $socket = new IO::Socket::INET (
    PeerHost    => '127.0.0.1',
    PeerPort    => '7777',
    Proto       => 'tcp',
);
die "cannot connect to the server $!\n" unless $socket;
print "connected to the server\n";

# data to send to a server
my $req = $ARGV[0] . '';
print $socket $req;

# notify server that request has been sent
shutdown($socket, 1);

# receive a response of up to 1024 characters from server
my $response = '';
sysread( $socket, $response,1024);
print "received response: $response\n";

$socket->close();

客户端和服务器的交互可能如下所示：

inet$ perl server.pl server waiting for client connection on port 7777
connection from 127.0.0.1:40028
received data: Herbert

inet$ perl client.pl "Herbert"
connected to the server
received response: Hey Herbert!

很酷的是：也可以从浏览器调用服务器：

Access TCP-Server with Firefox

所以第一个结论：代码可以工作，并且很好地展示了简单的客户端 - 服务器交互的基本功能。

现在，程序应使用SSL进行通信

编写服务器和客户端，只需在代码中添加几行即可实现SSL功能：

$ diff inet/server.pl ssl/server.pl 
7c7
< use IO::Socket::INET;
---
> use IO::Socket::SSL 'inet4';
13c13
< my $socket = new IO::Socket::INET (
---
> my $socket = IO::Socket::SSL->new (
17a18,19
>     SSL_cert_file => 'cert.pem',    # SSL certificate   
>     SSL_key_file  => 'key.pem',     # SSL certificate key

$ diff inet/client.pl ssl/client.pl 
5c5
< use IO::Socket::INET;
---
> use IO::Socket::SSL 'inet4';
11c11
< my $socket = new IO::Socket::INET (
---
> my $socket = new IO::Socket::SSL (
14a15
>     SSL_ca_file => 'cert.pem',

因此，启用SSL的新代码为：

#!/usr/bin/env perl
use strict;
use warnings;
use IO::Socket::SSL 'inet4';

# auto-flush on socket
$| = 1;

# creating a listening socket
my $socket = IO::Socket::SSL->new (
    LocalAddr     => '0.0.0.0',     # local server address
    LocalPort     => '7777',        # local server port
    Listen        => 5,             # queue size for connections
    Proto         => 'tcp',         # protocol used
    SSL_cert_file => 'cert.pem',    # SSL certificate   
    SSL_key_file  => 'key.pem',     # SSL certificate key
);
die "cannot create socket $!\n" unless $socket;
print "server waiting for client connection on port 7777\n";

while(1)
{
    # waiting for a new client connection
    my $client_socket = $socket->accept() or die "socket accept failed $!";

    # get information about a newly connected client
    my $client_address = $client_socket->peerhost();
    my $client_port    = $client_socket->peerport();
    print "connection from $client_address:$client_port\n";

    # read up to 1024 characters from the connected client
    my $client_data = '';
    sysread( $client_socket, $client_data, 1024);
    print "received data: $client_data\n";

    # write response data to the connected client
    print $client_socket "Hey $client_data!";

    # notify client that response has been sent
    shutdown($client_socket, 1);
}

END {
    $socket->close();
}

和

#!/usr/bin/env perl
use IO::Socket::SSL 'inet4';

# auto-flush on socket
$| = 1;

# create a connecting socket
my $socket = new IO::Socket::SSL (
    PeerHost    => '127.0.0.1',
    PeerPort    => '7777',
    Proto       => 'tcp',
    SSL_ca_file => 'cert.pem',
);
die "cannot connect to the server $!\n" unless $socket;
print "connected to the server\n";

# data to send to a server
my $req = $ARGV[0] . '';
print $socket $req;

# notify server that request has been sent
shutdown($socket, 1);

# receive a response of up to 1024 characters from server
my $response = '';
sysread( $socket, $response,1024);
print "received response: $response\n";

$socket->close();

要运行代码，必须首先创建证书：

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365

现在可以启动服务器和客户端并进行良好的交互：

ssl$ perl server.pl 
Enter PEM pass phrase:
server waiting for client connection on port 7777
connection from 127.0.0.1:40041
received data: Sabine

ssl$ perl client.pl "Sabine"
connected to the server
received response: Hey Sabine!

但是什么不起作用是来自Firefox或Chrome等浏览器的连接，即使我使用以下方式转换证书：

openssl pkcs12 -export -in cert.pem -inkey key.pem -out webcert.p12

我还通过导入菜单将新创建的证书导入浏览器。

连接被拒绝了。浏览器无法连接，服务器在$socket->accept() 失败，没有任何有用的消息 更新：导出的变量$SSL_ERROR中有一条消息：

SSL accept attempt failed error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request

我使用工具analyze ssl

进行了一些测试 
p5-ssl-tools-master$ perl analyze-ssl.pl --show-chain --all-ciphers -v3 127.0.0.1:7777
+ checking host=127.0.0.1(127.0.0.1) port=7777
* version SSLv23 no verification, ciphers= -> TLSv1_2,ECDHE-RSA-AES128-GCM-SHA256
* version SSLv23 no verification, ciphers=HIGH:ALL -> TLSv1_2,ECDHE-RSA-AES128-GCM-SHA256
* version TLSv1_2 no verification, ciphers= -> TLSv1_2,ECDHE-RSA-AES128-GCM-SHA256
* version TLSv1_2 no verification, ciphers=HIGH:ALL -> TLSv1_2,ECDHE-RSA-AES128-GCM-SHA256
* version TLSv1_1 no verification, ciphers= -> TLSv1_1,ECDHE-RSA-AES256-SHA
* version TLSv1_1 no verification, ciphers=HIGH:ALL -> TLSv1_1,ECDHE-RSA-AES256-SHA
* version TLSv1 no verification, ciphers= -> TLSv1,ECDHE-RSA-AES256-SHA
* version TLSv1 no verification, ciphers=HIGH:ALL -> TLSv1,ECDHE-RSA-AES256-SHA
* version SSLv3, no verification, ciphers= -> FAIL! SSL connect attempt failed because of handshake problems error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure
+ 127.0.0.1 failed permanently 'tcp connect: Verbindungsaufbau abgelehnt', no more IP to try
tcp connect: Verbindungsaufbau abgelehnt

服务器似乎接受某些请求并在最后失败，可能与浏览器的方式相同？

ssl$ perl server.pl 
Enter PEM pass phrase:
server waiting for client connection on port 7777
connection from 127.0.0.1:40042
received data: 
connection from 127.0.0.1:40043
received data: 
connection from 127.0.0.1:40044
received data: 
connection from 127.0.0.1:40045
received data: 
connection from 127.0.0.1:40046
received data: 
connection from 127.0.0.1:40047
received data: 
connection from 127.0.0.1:40048
received data: 
connection from 127.0.0.1:40049
received data: 
socket accept failed  at server.pl line 27.

我的问题

为什么浏览器的请求不起作用？ 代码应该支持一般的浏览器请求，因为它在没有SSL的情况下工作。 它似乎是一个特定于浏览器的SSL设置，因为SSL-Perl-Client没有问题。 或者是将证书导入浏览器是否按预期工作？ 在这件事上，有人能给我一个提示或解决方案吗？

更新：当我查看SSL23中的错误消息“$SSL_ERROR”和客户端测试“SSL3”中的错误消息时，SSL版本似乎存在兼容性问题？我是否需要明确指定我想要的版本？ （另一方面，“SSL23”的客户端测试似乎成功运行...）

非常感谢。

更新：以$IO::Socket::SSL::DEBUG = 3;

输出 
ssl$ perl server.pl 
Enter PEM pass phrase:
DEBUG: .../IO/Socket/SSL.pm:2554: new ctx 42708208
server waiting for client connection on port 7777
DEBUG: .../IO/Socket/SSL.pm:799: no socket yet
DEBUG: .../IO/Socket/SSL.pm:801: accept created normal socket IO::Socket::SSL=GLOB(0x28ac158)
DEBUG: .../IO/Socket/SSL.pm:829: starting sslifying
DEBUG: .../IO/Socket/SSL.pm:873: Net::SSLeay::accept -> -1
DEBUG: .../IO/Socket/SSL.pm:1779: SSL accept attempt failed

DEBUG: .../IO/Socket/SSL.pm:1784: SSL accept attempt failed error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request
socket accept failed: SSL accept attempt failed error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request at server.pl line 28.
DEBUG: .../IO/Socket/SSL.pm:2587: free ctx 42708208 open=42708208
DEBUG: .../IO/Socket/SSL.pm:2599: OK free ctx 42708208

1 个答案:

答案 0 :(得分：2)

  

... SSL接受尝试失败错误：1407609C：SSL例程：SSL23_GET_CLIENT_HELLO：http请求

我的猜测是，即使您需要使用http://网址，仍然会使用https://网址来访问服务器。这意味着浏览器向服务器发送HTTP请求，而不是先进行TLS握手，只在成功握手后发送HTTP请求。

除此之外，您依靠浏览器了解旧的和长期弃用的HTTP 0.9协议，该协议仅由没有任何HTTP头的响应主体组成。并非所有浏览器都能理解这一点。

相关问题
最新问题