ruby - 将 mechanize(甚至 Net::HTTP)与 ruby​​ 1.9 一起使用会返回 'OpenSSL::SSL::SSLError' - 如何强制使用 SSLv3？

Question

在过去的 2 天里，我想我已经浏览了每一个可用的(google'able)帖子关于这个与 Net::HTTP 相关的 SSL 错误:OpenSSL::SSL::SSLError: SSL_connect SYSCALL returned=5 errno=0 state=SSLv2/v3 read server hello A

我首先尝试做的是连接到 EtherPad 服务器 (https://test.titanpad.com)，登录并使用 ruby​​gems & 下载 zip 存档 Mechanize ;然而，不幸的是，由于所说的 SSL-Error，我什至没有做到这一点。在尝试从 Mechanize 对象中调试问题后(例如，通过在脚本中手动设置 cert、ca_file、cert_store、verify_mode 等)，我更接近实际问题，试图连接到 https://test.titanpad.com通过简单地使用 Net::HTTP:

(在这个例子中，我首先连接到 https://encrypted.google.com 以确保 SSL 应该 成功；连接到 EtherPad 服务器的尝试从第 6 行开始)

irb(main):001:0> require 'net/https'
=> true
irb(main):002:0> google = Net::HTTP.new('encrypted.google.com', 443)
=> #<Net::HTTP encrypted.google.com:443 open=false>
irb(main):003:0> google.use_ssl = true
=> true
irb(main):004:0> google.ca_file = '/opt/local/share/curl/curl-ca-bundle.crt' if File.exists?('/opt/local/share/curl/curl-ca-bundle.crt')
=> "/opt/local/share/curl/curl-ca-bundle.crt"
irb(main):005:0> google.request_get('/')
=> #<Net::HTTPOK 200 OK readbody=true>

irb(main):006:0> etherpad = Net::HTTP.new('test.titanpad.com', 443)
=> #<Net::HTTP test.titanpad.com:443 open=false>
irb(main):007:0> etherpad.use_ssl = true
=> true
irb(main):008:0> etherpad.ca_file = '/opt/local/share/curl/curl-ca-bundle.crt' if File.exists?('/opt/local/share/curl/curl-ca-bundle.crt')
=> "/opt/local/share/curl/curl-ca-bundle.crt"
irb(main):009:0> etherpad.request_get('/')
OpenSSL::SSL::SSLError: SSL_connect SYSCALL returned=5 errno=0 state=SSLv2/v3 read server hello A
    from /opt/local/lib/ruby1.9/1.9.1/net/http.rb:799:in `connect'
    from /opt/local/lib/ruby1.9/1.9.1/net/http.rb:799:in `block in connect'
    from /opt/local/lib/ruby1.9/1.9.1/timeout.rb:54:in `timeout'
    from /opt/local/lib/ruby1.9/1.9.1/timeout.rb:99:in `timeout'
    from /opt/local/lib/ruby1.9/1.9.1/net/http.rb:799:in `connect'
    from /opt/local/lib/ruby1.9/1.9.1/net/http.rb:755:in `do_start'
    from /opt/local/lib/ruby1.9/1.9.1/net/http.rb:744:in `start'
    from /opt/local/lib/ruby1.9/1.9.1/net/http.rb:1284:in `request'
    from /opt/local/lib/ruby1.9/1.9.1/net/http.rb:1195:in `request_get'
    from (irb):9
    from /opt/local/bin/irb:12:in `<main>'

即使在使用 verify_mode OpenSSL::SSL::VERIFY_NONE 时，OpenSSL 也会退出:

irb(main):010:0> etherpad.verify_mode = OpenSSL::SSL::VERIFY_NONE
=> 0
irb(main):011:0> etherpad.request_get('/')
OpenSSL::SSL::SSLError: SSL_connect SYSCALL returned=5 errno=0 state=SSLv2/v3 read server hello A
    from /opt/local/lib/ruby1.9/1.9.1/net/http.rb:799:in `connect'
    from /opt/local/lib/ruby1.9/1.9.1/net/http.rb:799:in `block in connect'
    from /opt/local/lib/ruby1.9/1.9.1/timeout.rb:54:in `timeout'
    from /opt/local/lib/ruby1.9/1.9.1/timeout.rb:99:in `timeout'
    from /opt/local/lib/ruby1.9/1.9.1/net/http.rb:799:in `connect'
    from /opt/local/lib/ruby1.9/1.9.1/net/http.rb:755:in `do_start'
    from /opt/local/lib/ruby1.9/1.9.1/net/http.rb:744:in `start'
    from /opt/local/lib/ruby1.9/1.9.1/net/http.rb:1284:in `request'
    from /opt/local/lib/ruby1.9/1.9.1/net/http.rb:1195:in `request_get'
    from (irb):11
    from /opt/local/bin/irb:12:in `<main>'

在进一步研究 openssl 本身之后，事实证明在这种情况下真正的麻烦是必须强制使用 SSLv3 才能与 titanpad 后面的 Jetty 6.1.20 服务器 握手。开始工作:

irb(main):001:0> require 'net/https'
=> true
irb(main):002:0> etherpad = Net::HTTP.new('test.titanpad.com', 443)
=> #<Net::HTTP test.titanpad.com:443 open=false>
irb(main):003:0> etherpad.use_ssl = true
=> true
irb(main):004:0> etherpad.ssl_version = "SSLv3"
=> "SSLv3"
irb(main):005:0> etherpad.ca_file = '/opt/local/share/curl/curl-ca-bundle.crt' if File.exists?('/opt/local/share/curl/curl-ca-bundle.crt')
=> "/opt/local/share/curl/curl-ca-bundle.crt"
irb(main):006:0> etherpad.request_get('/')
=> #<Net::HTTPFound 302 Found readbody=true>

虽然这在使用 Net::HTTP 时显然有效，但没有这样的选项来设置 SSL 版本以在 Mechanize 中使用>...因此，如果有人能向我指出如何通过上述 gem o.O 强制执行 SSLv3，我将非常高兴

再次感谢!

系统:Mac OSX 10.6.8 ruby 1.9.3p0(2011-10-30 修订版 33570)[x86_64-darwin10]安装了 mechanize 的 ruby​​gems:domain_name (0.5.2)、mechanize (2.1.1)、net-http-digest_auth (1.2)、net-http-persistent (2.4.1)、nokogiri (1.5.0)、ntlm-http ( 0.1.1), unf (0.0.4), unf_ext (0.0.4), 网络机器人 (0.0.13)

Answer 1

已通过将 ssl_version 功能从 Net::HTTP(通过 net-http-persistent)移植到 Mechanize v. 2.1.2(参见 https://github.com/tenderlove/mechanize/commit/4a228899855e0676ab69c2bf548170c8717465d8)得到修复。