使用 perl 的自签名证书通过 https 访问 xenapi

Question

我正在尝试使用以下 perl 脚本访问 xenapi。 “http”版本似乎可以工作，但“https”版本却不行。 代码：

#!/usr/bin/perl
use 5.20.0;
use RPC::XML::Client;
use Data::Dumper;
use IO::Socket::SSL qw( SSL_VERIFY_NONE );
$ENV{PERL_LWP_SSL_VERIFY_HOSTNAME} = 0;
$ENV{HTTPS_DEBUG} = 1;
$Data::Dumper::Indent   = 1;
$Data::Dumper::Sortkeys = 1;

use Xen::API;

my $user='Gordon';
my $passwd='Freeman';
my $xen = RPC::XML::Client->new("https://xen1.blackmesa.gov",
    ssl_opts =>    {  
        verify_hostname => 0,
        SSL_verify_mode => SSL_VERIFY_NONE
    },);

my $test = $xen->simple_request('session.login_with_password',$user,$passwd);
say '$RPC::XML::ERROR = '.Dumper($RPC::XML::ERROR);
say '$xen = '.Dumper($xen);

这是脚本的输出：

$RPC::XML::ERROR = $VAR1 = 'RPC::XML::Client::simple_request: RPC::XML::Client::send_request: HTTP server error: Can\'t connect to xen1.blackmesa.gov:443 (certificate verify failed)';

$xen = $VAR1 = bless( {
  '__compress' => 'deflate',
  '__compress_re' => qr/deflate/,
  '__compress_requests' => 0,
  '__compress_thresh' => 4096,
  '__message_file_thresh' => 1048576,
  '__message_temp_dir' => '',
  '__parser' => bless( [
    []
  ], 'RPC::XML::Parser::XMLParser' ),
  '__request' => bless( {
    '_content' => '',
    '_headers' => bless( {
      'accept-encoding' => 'deflate',
      'content-type' => 'text/xml'
    }, 'HTTP::Headers' ),
    '_method' => 'POST',
    '_protocol' => 'HTTP/1.1',
    '_uri' => bless( do{\(my $o = 'https://xen1.blackmesa.gov')}, 'URI::https' )
  }, 'HTTP::Request' ),
  '__request_as_string' => undef,
  '__useragent' => bless( {
    'def_headers' => bless( {
      'user-agent' => 'RPC::XML::Client/1.44 libwww-perl/6.52'
    }, 'HTTP::Headers' ),
    'handlers' => {
      'response_header' => bless( [
        { 
          'callback' => sub { "DUMMY" },
          'line' => '/usr/share/perl5/LWP/UserAgent.pm:768',
          'm_media_type' => 'html',
          'owner' => 'LWP::UserAgent::parse_head'
        }
      ], 'HTTP::Config' )
    },
    'local_address' => undef,
    'max_redirect' => 7,
    'max_size' => undef,
    'no_proxy' => [],
    'protocols_allowed' => undef,
    'protocols_forbidden' => undef,
    'proxy' => {},
    'requests_redirectable' => [
      'GET',
      'HEAD'
    ],
    'send_te' => 1,
    'show_progress' => undef,
    'ssl_opts' => {
      'verify_hostname' => '0'
    },
    'timeout' => 180,
    'use_eval' => 1
  }, 'LWP::UserAgent' ),
  'ssl_opts' => {
    'SSL_verify_mode' => 0,
    'verify_hostname' => 0
  }
}, 'RPC::XML::Client' );

任何提示如何使代码工作？ 值得怀疑的是 ssl_opts 实际上是 $xen 转储的 2 倍。

以下 python 脚本似乎可以工作，所以我假设 Xenapi over https 工作正常。

import XenAPI

session = XenAPI.Session('https://xen1.blackmesa.gov:443',ignore_ssl=True)
session.xenapi.login_with_password('Gordon', 'Freeman', "2.3", "test")
hosts = session.xenapi.host.get_all()
for host in hosts:
        vms = session.xenapi.host.get_resident_VMs(host)
        print (vms)

在 python 脚本中没有ignore_ssl=True 我得到以下错误：

ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: EE certificate key too weak (_ssl.c:1123)

这是openssl s_client -showcerts -connect xen1.blackmesa.gov的相关输出

Peer signing digest: SHA512
Peer signature type: RSA
Server Temp Key: ECDH, P-384, 384 bits
---
SSL handshake has read 1134 bytes and written 532 bytes
Verification error: self signed certificate
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES256-SHA384

Answer 1

我已经设法通过以下方式解决了这个问题：

1. 从服务器获取证书并将其保存到文件中：

openssl s_client -showcerts -connect <server>:443 </dev/null 2>/dev/null|openssl x509 -outform PEM >mycertfile.pem

1. 将 HTTPS_CA_FILE 或 PERL_LWP_SSL_CA_FILE 环境变量设置为 mycertfile.pem 位置，这两个变量都在 LWP 文档中进行了描述。

2. 因为在我的例子中服务器使用的是弱密钥，所以我必须在 /etc/ssl/openssl.conf 中将 SECLEVEL 设置为 1： CipherString = DEFAULT@SECLEVEL=1

最终代码如下：

use RPC::XML::Client;
use Xen::API;
$ENV{HTTPS_CA_FILE} = '<location_of_mycertfile.pem>';
my $xen = RPC::XML::Client->new("https://xen1.blackmesa.gov")
my $test = $xen->simple_request('session.login_with_password',"user","passwd");
print $test->{'Status'} if $test;