LWP::UserAgent 上的 500 错误第 2 部分答案

【问题标题】：500 Error on LWP::UserAgent part 2LWP::UserAgent 上的 500 错误第 2 部分
【发布时间】：2016-09-22 07:05:15
【问题描述】：

我一直在通过 LWP::UserAgent 研究 HTTPS 500 错误的问题。我已经尝试了500 error with LWP:UserAgent 中的所有内容，但无济于事。

我在同一台服务器上有两个 Perl 库（系统和我自己的）。我自己的图书馆是较新的，但不起作用。

Perl v 5.10.1
IO::Socket::SSL v 2.022
LWP::UserAgent v 6.15
LWP::Protocol::https v 6.06

所有都大于参考帖子中的推荐值。

当我在启用跟踪的情况下运行它时，我得到：

DEBUG: .../IO/Socket/SSL.pm:2688: new ctx 26906416
DEBUG: .../IO/Socket/SSL.pm:605: socket not yet connected
DEBUG: .../IO/Socket/SSL.pm:607: socket connected
DEBUG: .../IO/Socket/SSL.pm:629: ssl handshake not started
DEBUG: .../IO/Socket/SSL.pm:662: using SNI with hostname zscaler.edwardjones.com
DEBUG: .../IO/Socket/SSL.pm:697: request OCSP stapling
DEBUG: .../IO/Socket/SSL.pm:716: set socket to non-blocking to enforce timeout=180
DEBUG: .../IO/Socket/SSL.pm:729: call Net::SSLeay::connect
DEBUG: .../IO/Socket/SSL.pm:732: done Net::SSLeay::connect -> -1
DEBUG: .../IO/Socket/SSL.pm:742: ssl handshake in progress
DEBUG: .../IO/Socket/SSL.pm:752: waiting for fd to become ready: SSL wants a read first
DEBUG: .../IO/Socket/SSL.pm:772: socket ready, retrying connect
DEBUG: .../IO/Socket/SSL.pm:729: call Net::SSLeay::connect
DEBUG: .../IO/Socket/SSL.pm:732: done Net::SSLeay::connect -> -1
DEBUG: .../IO/Socket/SSL.pm:735: local error: SSL connect attempt failed
DEBUG: .../IO/Socket/SSL.pm:738: fatal SSL error: SSL connect attempt failed
DEBUG: ...erl5/Net/HTTPS.pm:69: ignoring less severe local error 'IO::Socket::INET configuration failed', keep 'SSL connect attempt failed'
DEBUG: .../IO/Socket/SSL.pm:2721: free ctx 26906416 open=26906416
DEBUG: .../IO/Socket/SSL.pm:2726: free ctx 26906416 callback
DEBUG: .../IO/Socket/SSL.pm:2733: OK free ctx 26906416

我使用了数据包捕获，发现这使用了安全套接字层 -> SSL 记录层。较旧的系统库使用安全套接字层 -> TLSv1 记录层。失败的数据包大于 254 字节，但我使用的是更新的 Perl 代码。

我已尝试 verify_hostname 0 和 1 没有任何变化。
我试过 SSL_Version => TLSv1 没有任何变化。

代码如下：

#!/usr/bin/perl

use strict;
use warnings;

use lib '/opt/mylib/lib/perl5';

use Data::Dumper;
use LWP::UserAgent;
use HTTP::Request;
use JSON;

use Net::SSLeay;
$Net::SSLeay::trace = 2;
$Net::SSLeay::ssl_version = 10;  #-- force TLSv1

use IO::Socket::SSL;
$IO::Socket::SSL::DEBUG = 3;

use constant {
    TOKEN              => 'xxxx-yyyy-aaaa',
    GET_URI   => 'https://support.myvendor.com',
};

my $useragent = LWP::UserAgent->new( ssl_opts => { verify_hostname => 0 }, cookie_jar => {} );
$useragent->proxy ('https', 'https://my.proxy.com:443');
$useragent->ssl_opts( SSL_version => 'TLSv1');

sendRequest ('MyData');

exit 1;

sub sendRequest {
    my ($data) = @_;
    my $request = HTTP::Request->new('POST', GET_URI);
    $request->header('Content-Type' => 'application/json');
    my $json = encode_json {
        'Token' => TOKEN,
        'Data' => $data
    };
    $request->content($json);
    my $response = $useragent->request($request);
    if (!$response->is_success) {
        print Data::Dumper->Dump([$response], [qw($response)]);
        return;
    }

    eval { $json = decode_json $response->content; 1 } or do {
        print Data::Dumper->Dump([$response], [qw($response)]);
        return;
    };

    print Data::Dumper->Dump([$json], [qw($json)]);
    return;
}

我想不通。请帮忙

2016 年 6 月 2 日更新：

如果我设置 SSL_hostname = ""，这就是我得到的：

DEBUG: .../IO/Socket/SSL.pm:2688: new ctx 38074176
DEBUG: .../IO/Socket/SSL.pm:605: socket not yet connected
DEBUG: .../IO/Socket/SSL.pm:607: socket connected
DEBUG: .../IO/Socket/SSL.pm:629: ssl handshake not started
DEBUG: .../IO/Socket/SSL.pm:665: not using SNI because hostname is unknown
DEBUG: .../IO/Socket/SSL.pm:697: request OCSP stapling
DEBUG: .../IO/Socket/SSL.pm:716: set socket to non-blocking to enforce timeout=180
DEBUG: .../IO/Socket/SSL.pm:729: call Net::SSLeay::connect
DEBUG: .../IO/Socket/SSL.pm:732: done Net::SSLeay::connect -> -1
DEBUG: .../IO/Socket/SSL.pm:742: ssl handshake in progress
DEBUG: .../IO/Socket/SSL.pm:752: waiting for fd to become ready: SSL wants a read first
DEBUG: .../IO/Socket/SSL.pm:772: socket ready, retrying connect
DEBUG: .../IO/Socket/SSL.pm:729: call Net::SSLeay::connect
DEBUG: .../IO/Socket/SSL.pm:2589: did not get stapled OCSP response
DEBUG: .../IO/Socket/SSL.pm:2542: ok=1 [2] /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
DEBUG: .../IO/Socket/SSL.pm:2542: ok=1 [1] /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
DEBUG: .../IO/Socket/SSL.pm:2542: ok=1 [0] /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA/C=US/ST=California/L=San Jose/O=Zscaler, Inc./CN=*.zscaler.net
DEBUG: .../IO/Socket/SSL.pm:2543: local error: Cannot determine peer hostname for verification
DEBUG: .../IO/Socket/SSL.pm:732: done Net::SSLeay::connect -> -1
DEBUG: .../IO/Socket/SSL.pm:735: SSL connect attempt failed

DEBUG: .../IO/Socket/SSL.pm:735: ignoring less severe local error 'SSL connect attempt failed error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed', keep 'Cannot determine peer hostname for verification'
DEBUG: .../IO/Socket/SSL.pm:738: fatal SSL error: Cannot determine peer hostname for verification
DEBUG: ...erl5/Net/HTTPS.pm:69: ignoring less severe local error 'IO::Socket::INET configuration failed', keep 'Cannot determine peer hostname for verification'
DEBUG: .../IO/Socket/SSL.pm:2721: free ctx 38074176 open=38074176
DEBUG: .../IO/Socket/SSL.pm:2726: free ctx 38074176 callback
DEBUG: .../IO/Socket/SSL.pm:2733: OK free ctx 38074176

如果我不设置 SSL_hostname，这就是我得到的。请注意，SNI 主机名是我的代理 - 对吗？不应该是终端主机吗？

DEBUG: .../IO/Socket/SSL.pm:2688: new ctx 30971328
DEBUG: .../IO/Socket/SSL.pm:605: socket not yet connected
DEBUG: .../IO/Socket/SSL.pm:607: socket connected
DEBUG: .../IO/Socket/SSL.pm:629: ssl handshake not started
DEBUG: .../IO/Socket/SSL.pm:662: using SNI with hostname my.proxy.com
DEBUG: .../IO/Socket/SSL.pm:697: request OCSP stapling
DEBUG: .../IO/Socket/SSL.pm:716: set socket to non-blocking to enforce timeout=180
DEBUG: .../IO/Socket/SSL.pm:729: call Net::SSLeay::connect
DEBUG: .../IO/Socket/SSL.pm:732: done Net::SSLeay::connect -> -1
DEBUG: .../IO/Socket/SSL.pm:742: ssl handshake in progress
DEBUG: .../IO/Socket/SSL.pm:752: waiting for fd to become ready: SSL wants a read first

经过更多研究，我发现当我设置 SSL_hostname = '' 时，我的 verify_hostname => 1。我尝试使用 verify = 0 并进一步了解。我认为这意味着我能够通过我的代理并与终端服务器通信？但它仍然不像旧图书馆那样工作。

DEBUG: .../IO/Socket/SSL.pm:2688: new ctx 44513104
DEBUG: .../IO/Socket/SSL.pm:605: socket not yet connected
DEBUG: .../IO/Socket/SSL.pm:607: socket connected
DEBUG: .../IO/Socket/SSL.pm:629: ssl handshake not started
DEBUG: .../IO/Socket/SSL.pm:665: not using SNI because hostname is unknown
DEBUG: .../IO/Socket/SSL.pm:716: set socket to non-blocking to enforce timeout=180
DEBUG: .../IO/Socket/SSL.pm:729: call Net::SSLeay::connect
DEBUG: .../IO/Socket/SSL.pm:732: done Net::SSLeay::connect -> -1
DEBUG: .../IO/Socket/SSL.pm:742: ssl handshake in progress
DEBUG: .../IO/Socket/SSL.pm:752: waiting for fd to become ready: SSL wants a read first
DEBUG: .../IO/Socket/SSL.pm:772: socket ready, retrying connect
DEBUG: .../IO/Socket/SSL.pm:729: call Net::SSLeay::connect
DEBUG: .../IO/Socket/SSL.pm:732: done Net::SSLeay::connect -> -1
DEBUG: .../IO/Socket/SSL.pm:742: ssl handshake in progress
DEBUG: .../IO/Socket/SSL.pm:752: waiting for fd to become ready: SSL wants a read first
DEBUG: .../IO/Socket/SSL.pm:772: socket ready, retrying connect
DEBUG: .../IO/Socket/SSL.pm:729: call Net::SSLeay::connect
DEBUG: .../IO/Socket/SSL.pm:732: done Net::SSLeay::connect -> 1
DEBUG: .../IO/Socket/SSL.pm:787: ssl handshake done
DEBUG: .../IO/Socket/SSL.pm:2721: free ctx 44513104 open=44513104
DEBUG: .../IO/Socket/SSL.pm:2733: OK free ctx 44513104
$response = bless( {
                     '_content' => 'Server closed connection without sending any data back at /opt/ejvfortiprov/lib/perl5/Net/HTTP/Methods.pm line 399.
',
                     '_rc' => 500,

【问题讨论】：

当前的调试信息除了 SSL 握手失败之外没有提供太多细节。您能否提供好连接和坏连接的数据包捕获（cloudshark.org 上的完整捕获，而不仅仅是来自 tcpdump 的一些文本）以及用于比较的系统的调试输出和规范？相关的还可能是系统使用的 Net::SSLeay 和 openssl 版本，即两个系统上的 $Net::SSLeay::VERSION 和 Net::SSLeay::OPENSSL_VERSION_NUMBER()。
失败 ~~~~ Perl v 5.10.1 IO::Socket::SSL v 2.022 LWP::UserAgent v 6.15 LWP::Protocol v 6.15 LWP::Protocol::https v 6.06 $Net ::HTTPS::SSL_SOCKET_CLASS = IO::Socket::SSL IO::Socket::SSL = v 2.022 $Net::SSLeay::VERSION = v 1.72 Net::SSLeay::OPENSSL_VERSION_NUMBER() = 268439647 工作~~~ ~~~~~ Perl v 5.10.1 IO::Socket::SSL v 1.31 LWP::UserAgent v 5.833 LWP::Protocol v 5.829 LWP::Protocol::https（不在 https.pm 中）$Net::HTTPS ::SSL_SOCKET_CLASS = IO::Socket::SSL IO::Socket::SSL = v 1.31 $Net::SSLeay::VERSION = v 1.35 Net::SSLeay::OPENSSL_VERSION_NUMBER() = 268435459
调试：.../IO/Socket/SSL.pm:1471：新 ctx 37998400 调试：.../IO/Socket/SSL.pm:332：套接字尚未连接调试：。 ../IO/Socket/SSL.pm:334：套接字已连接调试：.../IO/Socket/SSL.pm:347：ssl 握手未开始调试：.../IO/Socket/SSL.pm:390 : Net::SSLeay::connect -> 1 DEBUG: .../IO/Socket/SSL.pm:445: ssl 握手完成 DEBUG: .../IO/Socket/SSL.pm:1507: free ctx 37998400 open =37998400 调试：.../IO/Socket/SSL.pm:1515：OK 免费 ctx 37998400
最后评论中的调试来自有效的代码。
我无法上传到 cloudshark.org。如果有办法附上屏幕截图，我可以向您展示每个的安全套接字层输出。

标签： perl lwp-useragent

【解决方案1】：

没有解决办法，但也许是一种变通方法：尝试 curl 而不是 libwww，例如 WWW::Curl 或 LWP::Curl（看起来与 LWP::UserAgent 具有相同的界面）

【讨论】：