“无共享密码"; python和OpenSSL错误 [英] "no shared cipher" error with python and OpenSSL
问题描述
服务器:
#!/usr/bin/env python
import SocketServer
import json
from OpenSSL import SSL
import os
import socket
TERMINATION_STRING = "Done"
CERTIFICATE_PATH = os.getcwd() + '/CA/certs/01.pem'
KEY_PATH = os.getcwd() + '/CA/private/key.pem'
CA_PATH = os.getcwd() + '/CA/cacert.pem'
print CA_PATH
def verify_cb(conn, cert, errnum, depth, ok):
print('Got cert: %s' % cert.get_subject())
return ok
class SSLThreadingTCPServer(SocketServer.ThreadingTCPServer):
def __init__(self, address, handler):
SocketServer.ThreadingTCPServer.__init__(self, address, handler)
ctx = SSL.Context(SSL.SSLv23_METHOD)
ctx.set_verify(SSL.VERIFY_PEER | SSL.VERIFY_FAIL_IF_NO_PEER_CERT, verify_cb)
ctx.use_privatekey_file(KEY_PATH)
ctx.use_certificate_file(CERTIFICATE_PATH)
ctx.load_verify_locations(CA_PATH)
self.socket = SSL.Connection(ctx, socket.socket(self.address_family, self.socket_type))
self.socket.set_accept_state()
self.server_bind()
self.server_activate()
print "Serving:", address[0], "on port:", address[1]
class MemberUpdateHandler(SocketServer.StreamRequestHandler):
def setup(self):
self.connection = self.request
self.rfile = socket._fileobject(self.request, "rb", self.rbufsize)
self.wfile = socket._fileobject(self.request, "wb", self.wbufsize)
print self.client_address, "connected"
def handle(self):
data = ""
while True:
data += self.request.recv(1024).encode('utf-8').strip
if data[-4:] == "Done":
print "Done"
break
dataStrings = data.split(' ')
for item in dataStrings:
print item
if __name__ == "__main__":
ADDRESS = 'localhost'
PORT = 42424
HOST = (ADDRESS, PORT)
s = SSLThreadingTCPServer(HOST, MemberUpdateHandler)
s.serve_forever()
客户:
#!/usr/bin/env python
from OpenSSL import SSL
import socket
import os
HOST = 'localhost'
PORT = 42424
ADDRESS = (HOST, PORT)
CERTIFICATE_FILE = os.getcwd() + '/CA/certs/02.pem'
KEY_PATH = os.getcwd() + '/CA/clientKey.pem'
CA_PATH = os.getcwd() + '/CA/cacert.pem'
def verify_cb(conn, cert, errnum, depth, ok):
print('Got cert: %s' % cert.get_subject())
return ok
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
ctx = SSL.Context(SSL.SSLv23_METHOD)
ctx.set_verify(SSL.VERIFY_PEER, verify_cb)
ctx.use_certificate_file(CERTIFICATE_FILE)
ctx.use_privatekey_file(KEY_PATH)
ctx.load_verify_locations(CA_PATH)
sslSock = SSL.Connection(ctx, sock)
sslSock.connect(ADDRESS)
items = "this is a test Done"
sslSock.sendall(items)
sslSock.close()
服务器端错误:
Error: [('SSL routines', 'SSL3_GET_CLIENT_HELLO', 'no shared cipher')]
客户端错误:
OpenSSL.SSL.Error: [('SSL routines', 'SSL23_GET_SERVER_HELLO', 'sslv3 alert handshake failure')]
我感觉自己缺少一些简单的东西,但是无法将其固定下来.我在各个地方都发现了几个与我完全一样的问题,但没有一个得到回答.我是网络编程的新手,不胜感激.
I have a feeling that I am missing something simple, but have been unable to pin it down. I have found several questions exactly like mine in various places, but none have been answered. I am new to network programming and would greatly appreciate any help.
使用Ubuntu 10.04和python 2.6
Using Ubuntu 10.04 and python 2.6
推荐答案
一个错误是:
data += self.request.recv(1024).encode('utf-8').strip
将我引向
TypeError: cannot concatenate 'str' and 'builtin_function_or_method' objects
应该是:
data += self.request.recv(1024).encode('utf-8').strip()
这个例子对我有用.
Got cert: <X509Name object '/C=IT/ST=XXX/L=YYY/O=ZZZ/OU=NNN/CN=CA'>
Got cert: <X509Name object '/C=IT/ST=XXX/L=YYY/O=ZZZ/OU=NNN/CN=Server'>
使用Stock 10.04 Ubuntu服务器和从apt-get安装的软件包进行了测试.
Tested with Stock 10.04 Ubuntu server and packages installed from apt-get.
python-openssl 0.10-1
openssl 0.9.8k-7ubuntu8
python 2.6.5-0ubuntu1
您应该检查证书/CA,或者使用一些列出了可用密码的简单脚本来测试服务器:
You should check your certificate/CA, or test server with some simple script that list some available ciphers: https://superuser.com/questions/109213/is-there-a-tool-that-can-test-what-ssl-tls-cipher-suites-a-particular-website-of
更新2:
为了排除证书的某些问题,您可以生成一些CA和服务器/客户端证书,例如
In order to exclude some issues with certificates you could generate some CA and server/client certificates like in http://acs.lbl.gov/~boverhof/openssl_certs.html
这篇关于“无共享密码"; python和OpenSSL错误的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!