perl - 使用 perl 的自签名证书通过 https 访问 xenapi
问题描述
我正在尝试使用以下 perl 脚本访问 xenapi。“http”版本似乎可以工作,但“https”版本却不行。编码:
#!/usr/bin/perl
use 5.20.0;
use RPC::XML::Client;
use Data::Dumper;
use IO::Socket::SSL qw( SSL_VERIFY_NONE );
$ENV{PERL_LWP_SSL_VERIFY_HOSTNAME} = 0;
$ENV{HTTPS_DEBUG} = 1;
$Data::Dumper::Indent = 1;
$Data::Dumper::Sortkeys = 1;
use Xen::API;
my $user='Gordon';
my $passwd='Freeman';
my $xen = RPC::XML::Client->new("https://xen1.blackmesa.gov",
ssl_opts => {
verify_hostname => 0,
SSL_verify_mode => SSL_VERIFY_NONE
},);
my $test = $xen->simple_request('session.login_with_password',$user,$passwd);
say '$RPC::XML::ERROR = '.Dumper($RPC::XML::ERROR);
say '$xen = '.Dumper($xen);
这是脚本的输出:
$RPC::XML::ERROR = $VAR1 = 'RPC::XML::Client::simple_request: RPC::XML::Client::send_request: HTTP server error: Can\'t connect to xen1.blackmesa.gov:443 (certificate verify failed)';
$xen = $VAR1 = bless( {
'__compress' => 'deflate',
'__compress_re' => qr/deflate/,
'__compress_requests' => 0,
'__compress_thresh' => 4096,
'__message_file_thresh' => 1048576,
'__message_temp_dir' => '',
'__parser' => bless( [
[]
], 'RPC::XML::Parser::XMLParser' ),
'__request' => bless( {
'_content' => '',
'_headers' => bless( {
'accept-encoding' => 'deflate',
'content-type' => 'text/xml'
}, 'HTTP::Headers' ),
'_method' => 'POST',
'_protocol' => 'HTTP/1.1',
'_uri' => bless( do{\(my $o = 'https://xen1.blackmesa.gov')}, 'URI::https' )
}, 'HTTP::Request' ),
'__request_as_string' => undef,
'__useragent' => bless( {
'def_headers' => bless( {
'user-agent' => 'RPC::XML::Client/1.44 libwww-perl/6.52'
}, 'HTTP::Headers' ),
'handlers' => {
'response_header' => bless( [
{
'callback' => sub { "DUMMY" },
'line' => '/usr/share/perl5/LWP/UserAgent.pm:768',
'm_media_type' => 'html',
'owner' => 'LWP::UserAgent::parse_head'
}
], 'HTTP::Config' )
},
'local_address' => undef,
'max_redirect' => 7,
'max_size' => undef,
'no_proxy' => [],
'protocols_allowed' => undef,
'protocols_forbidden' => undef,
'proxy' => {},
'requests_redirectable' => [
'GET',
'HEAD'
],
'send_te' => 1,
'show_progress' => undef,
'ssl_opts' => {
'verify_hostname' => '0'
},
'timeout' => 180,
'use_eval' => 1
}, 'LWP::UserAgent' ),
'ssl_opts' => {
'SSL_verify_mode' => 0,
'verify_hostname' => 0
}
}, 'RPC::XML::Client' );
任何提示如何使代码工作?值得怀疑的是 ssl_opts 实际上是 .dump 的 2 倍$xen
。
以下 python 脚本似乎工作,所以我假设 Xenapi over https 工作。
import XenAPI
session = XenAPI.Session('https://xen1.blackmesa.gov:443',ignore_ssl=True)
session.xenapi.login_with_password('Gordon', 'Freeman', "2.3", "test")
hosts = session.xenapi.host.get_all()
for host in hosts:
vms = session.xenapi.host.get_resident_VMs(host)
print (vms)
如果没有ignore_ssl=True
在 python 脚本中,我会收到以下错误:
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: EE certificate key too weak (_ssl.c:1123)
这是相关的输出openssl s_client -showcerts -connect xen1.blackmesa.gov
Peer signing digest: SHA512
Peer signature type: RSA
Server Temp Key: ECDH, P-384, 384 bits
---
SSL handshake has read 1134 bytes and written 532 bytes
Verification error: self signed certificate
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES256-SHA384
解决方案
我设法通过以下方式解决了这个问题:
- 从服务器获取证书并将其保存到文件中:
openssl s_client -showcerts -connect <server>:443 </dev/null 2>/dev/null|openssl x509 -outform PEM >mycertfile.pem
设置
HTTPS_CA_FILE
或PERL_LWP_SSL_CA_FILE
环境变量到 mycertfile.pem 位置,这两个变量都在 LWP 文档中进行了描述。因为在我的情况下,服务器使用的是弱密钥,所以我必须将
SECLEVEL
1设置为/etc/ssl/openssl.conf
:CipherString = DEFAULT@SECLEVEL=1
最终代码如下所示:
use RPC::XML::Client;
use Xen::API;
$ENV{HTTPS_CA_FILE} = '<location_of_mycertfile.pem>';
my $xen = RPC::XML::Client->new("https://xen1.blackmesa.gov")
my $test = $xen->simple_request('session.login_with_password',"user","passwd");
print $test->{'Status'} if $test;