perl - 使用 IO::Socket::SSL 响应浏览器请求

Question

问题制定到最后，先详细描述问题和我已经测试过的内容

我正在编写一些代码来向其他人展示一些基本原则。代码永远不会高效，并且旨在简化。

我的目标(与其他人不同)是编写一个简单的应用程序，它使用 Web 证书来加密其网络流量。

起点是一个不加密的应用程序:

#!/usr/bin/env perl
use strict;
use warnings;
use IO::Socket::INET;

# auto-flush on socket
$| = 1;

# creating a listening socket
my $socket = new IO::Socket::INET (
    LocalAddr     => '0.0.0.0',     # local server address
    LocalPort     => '7777',        # local server port
    Listen        => 5,             # queue size for connections
    Proto         => 'tcp',         # protocol used
);
die "cannot create socket $!\n" unless $socket;
print "server waiting for client connection on port 7777\n";

while(1)
{
    # waiting for a new client connection
    my $client_socket = $socket->accept() or die "socket accept failed $!";

    # get information about a newly connected client
    my $client_address = $client_socket->peerhost();
    my $client_port    = $client_socket->peerport();
    print "connection from $client_address:$client_port\n";

    # read up to 1024 characters from the connected client
    my $client_data = '';
    sysread( $client_socket, $client_data, 1024);
    print "received data: $client_data\n";

    # write response data to the connected client
    print $client_socket "Hey $client_data!";

    # notify client that response has been sent
    shutdown($client_socket, 1);
}

END {
    $socket->close();
}

可以使用此客户端调用此服务器应用程序:

#!/usr/bin/env perl
use IO::Socket::INET;

# auto-flush on socket
$| = 1;

# create a connecting socket
my $socket = new IO::Socket::INET (
    PeerHost    => '127.0.0.1',
    PeerPort    => '7777',
    Proto       => 'tcp',
);
die "cannot connect to the server $!\n" unless $socket;
print "connected to the server\n";

# data to send to a server
my $req = $ARGV[0] . '';
print $socket $req;

# notify server that request has been sent
shutdown($socket, 1);

# receive a response of up to 1024 characters from server
my $response = '';
sysread( $socket, $response,1024);
print "received response: $response\n";

$socket->close();

客户端和服务器的交互可能如下所示:

inet$ perl server.pl
server waiting for client connection on port 7777
connection from 127.0.0.1:40028
received data: Herbert

inet$ perl client.pl "Herbert"
connected to the server
received response: Hey Herbert!

很酷的是:服务器也可以从浏览器调用:

第一个结论是:该代码有效并且很好地展示了简单客户端-服务器交互的基本功能。

现在程序应该使用 SSL 进行通信

Server和Client是这样写的，只需在代码中添加几行就可以实现SSL-Ability:

$ diff inet/server.pl ssl/server.pl 
7c7
< use IO::Socket::INET;
---
> use IO::Socket::SSL 'inet4';
13c13
< my $socket = new IO::Socket::INET (
---
> my $socket = IO::Socket::SSL->new (
17a18,19
>     SSL_cert_file => 'cert.pem',    # SSL certificate   
>     SSL_key_file  => 'key.pem',     # SSL certificate key

$ diff inet/client.pl ssl/client.pl 
5c5
< use IO::Socket::INET;
---
> use IO::Socket::SSL 'inet4';
11c11
< my $socket = new IO::Socket::INET (
---
> my $socket = new IO::Socket::SSL (
14a15
>     SSL_ca_file => 'cert.pem',

所以新的启用 SSL 的代码是:

#!/usr/bin/env perl
use strict;
use warnings;
use IO::Socket::SSL 'inet4';

# auto-flush on socket
$| = 1;

# creating a listening socket
my $socket = IO::Socket::SSL->new (
    LocalAddr     => '0.0.0.0',     # local server address
    LocalPort     => '7777',        # local server port
    Listen        => 5,             # queue size for connections
    Proto         => 'tcp',         # protocol used
    SSL_cert_file => 'cert.pem',    # SSL certificate   
    SSL_key_file  => 'key.pem',     # SSL certificate key
);
die "cannot create socket $!\n" unless $socket;
print "server waiting for client connection on port 7777\n";

while(1)
{
    # waiting for a new client connection
    my $client_socket = $socket->accept() or die "socket accept failed $!";

    # get information about a newly connected client
    my $client_address = $client_socket->peerhost();
    my $client_port    = $client_socket->peerport();
    print "connection from $client_address:$client_port\n";

    # read up to 1024 characters from the connected client
    my $client_data = '';
    sysread( $client_socket, $client_data, 1024);
    print "received data: $client_data\n";

    # write response data to the connected client
    print $client_socket "Hey $client_data!";

    # notify client that response has been sent
    shutdown($client_socket, 1);
}

END {
    $socket->close();
}

和

#!/usr/bin/env perl
use IO::Socket::SSL 'inet4';

# auto-flush on socket
$| = 1;

# create a connecting socket
my $socket = new IO::Socket::SSL (
    PeerHost    => '127.0.0.1',
    PeerPort    => '7777',
    Proto       => 'tcp',
    SSL_ca_file => 'cert.pem',
);
die "cannot connect to the server $!\n" unless $socket;
print "connected to the server\n";

# data to send to a server
my $req = $ARGV[0] . '';
print $socket $req;

# notify server that request has been sent
shutdown($socket, 1);

# receive a response of up to 1024 characters from server
my $response = '';
sysread( $socket, $response,1024);
print "received response: $response\n";

$socket->close();

要运行代码，必须先创建一个证书:

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365

现在 Server 和 Client 可以启动并很好地交互了:

ssl$ perl server.pl 
Enter PEM pass phrase:
server waiting for client connection on port 7777
connection from 127.0.0.1:40041
received data: Sabine

ssl$ perl client.pl "Sabine"
connected to the server
received response: Hey Sabine!

但是无法正常工作的是来自 Firefox 或 Chrome 等浏览器的连接，即使我使用以下方法转换了证书:

openssl pkcs12 -export -in cert.pem -inkey key.pem -out webcert.p12

我还通过导入菜单将新创建的证书导入浏览器。

连接刚被拒绝。浏览器无法连接，服务器在 $socket->accept() 没有任何有用消息时失败。
更新:导出变量 $SSL_ERROR 中有一条消息:

SSL accept attempt failed error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request

我用工具做了一些测试 analyze ssl

p5-ssl-tools-master$ perl analyze-ssl.pl --show-chain --all-ciphers -v3 127.0.0.1:7777
+ checking host=127.0.0.1(127.0.0.1) port=7777
* version SSLv23 no verification, ciphers= -> TLSv1_2,ECDHE-RSA-AES128-GCM-SHA256
* version SSLv23 no verification, ciphers=HIGH:ALL -> TLSv1_2,ECDHE-RSA-AES128-GCM-SHA256
* version TLSv1_2 no verification, ciphers= -> TLSv1_2,ECDHE-RSA-AES128-GCM-SHA256
* version TLSv1_2 no verification, ciphers=HIGH:ALL -> TLSv1_2,ECDHE-RSA-AES128-GCM-SHA256
* version TLSv1_1 no verification, ciphers= -> TLSv1_1,ECDHE-RSA-AES256-SHA
* version TLSv1_1 no verification, ciphers=HIGH:ALL -> TLSv1_1,ECDHE-RSA-AES256-SHA
* version TLSv1 no verification, ciphers= -> TLSv1,ECDHE-RSA-AES256-SHA
* version TLSv1 no verification, ciphers=HIGH:ALL -> TLSv1,ECDHE-RSA-AES256-SHA
* version SSLv3, no verification, ciphers= -> FAIL! SSL connect attempt failed because of handshake problems error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure
+ 127.0.0.1 failed permanently 'tcp connect: Verbindungsaufbau abgelehnt', no more IP to try
tcp connect: Verbindungsaufbau abgelehnt

服务器似乎接受了某些请求但最终失败了，可能与浏览器的方式相同？

ssl$ perl server.pl 
Enter PEM pass phrase:
server waiting for client connection on port 7777
connection from 127.0.0.1:40042
received data: 
connection from 127.0.0.1:40043
received data: 
connection from 127.0.0.1:40044
received data: 
connection from 127.0.0.1:40045
received data: 
connection from 127.0.0.1:40046
received data: 
connection from 127.0.0.1:40047
received data: 
connection from 127.0.0.1:40048
received data: 
connection from 127.0.0.1:40049
received data: 
socket accept failed  at server.pl line 27.

我的问题

为什么用浏览器请求不工作？该代码通常应支持浏览器请求，因为它可以在没有 SSL 的情况下工作。它似乎是浏览器特定的 SSL 设置，因为 SSL-Perl-Client 没有问题。还是将证书导入浏览器未按预期工作？任何人都可以在这件事上给我提示或解决方案吗？

更新:当我查看 $SSL_ERROR 中的错误消息“SSL23”和客户端测试中的错误消息“SSL3”时SSL 版本似乎存在兼容性问题？我需要明确指定我想要的版本吗？ (另一方面，“SSL23”的客户端测试似乎成功运行...)

非常感谢。

更新:输出 $IO::Socket::SSL::DEBUG = 3;

ssl$ perl server.pl 
Enter PEM pass phrase:
DEBUG: .../IO/Socket/SSL.pm:2554: new ctx 42708208
server waiting for client connection on port 7777
DEBUG: .../IO/Socket/SSL.pm:799: no socket yet
DEBUG: .../IO/Socket/SSL.pm:801: accept created normal socket IO::Socket::SSL=GLOB(0x28ac158)
DEBUG: .../IO/Socket/SSL.pm:829: starting sslifying
DEBUG: .../IO/Socket/SSL.pm:873: Net::SSLeay::accept -> -1
DEBUG: .../IO/Socket/SSL.pm:1779: SSL accept attempt failed

DEBUG: .../IO/Socket/SSL.pm:1784: SSL accept attempt failed error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request
socket accept failed: SSL accept attempt failed error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request at server.pl line 28.
DEBUG: .../IO/Socket/SSL.pm:2587: free ctx 42708208 open=42708208
DEBUG: .../IO/Socket/SSL.pm:2599: OK free ctx 42708208

Answer 1

... SSL accept attempt failed error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request

我的猜测是您仍然使用 http:// URL 访问服务器，即使您需要使用 https:// URL。这意味着浏览器向服务器发送 HTTP 请求，而不是先进行 TLS 握手，并在握手成功后才发送 HTTP 请求。

除此之外，您还指望浏览器理解旧的且长期弃用的 HTTP 0.9 协议(protocol)，该协议(protocol)仅包含没有任何 HTTP header 的响应主体。并非所有浏览器都理解这一点。