Can we get DEBUG loggin from the OpenSSL library?
維護者通常 1 天內回覆
評估
- 難度
- 5/5
- 預估耗時
- 一週以上
- 新手友好度
- 28/100
- Issue 類型
- 功能
- 描述清晰度
- 基本清楚
- 活躍度
- 停滯
- 領域
- cryptography, security
研究方向
從 crypto/x509/t_x509.c 中引用的 OpenSSL 偵錯輸出開始，並將其與 Ruby 的 OpenSSL::debug 行為進行比較。檢視 verify_callback 和 store_context 範例，接著判斷是否能透過向 Ruby 公開一個 flag，在不使用應用程式層級 callback 的情況下提供等效的憑證詳細資訊。定義並測試所提議的介面及其預期記錄行為後，即視為完成。
由索引模型根據 Issue 內容生成。
描述
Hi,
Problem
As a developer I would like to see (DEBUG) logging from OpenSSL. We have a Ruby application that connects to Amazon Cloudfront to retrieve a file. This runs through a network outside of our control containing NAT gateways, proxies, etc.
This works 99% of the time, but Intermittently we get a self signed certificate error:
OpenSSL::SSL::SSLError (SSL_connect returned=1 errno=0
peeraddr=18.66.171.65:443 state=error: certificate verify failed
(self signed certificate in certificate chain))
But it doesn't show WHICH certificate (or subject, fignerprint, ...) is being seen.
Question / Request
Ideally we would have a ruby OpenSSL flag that instructs OpenSSL to do its (DEBUG) logging so we can get this information. I can see OpenSSL is logging the desired information in:
Is it possible to get the Ruby app to log this information?
I have found OpenSSL::debug=true, but this only seems to trigger debug logging done in this Ruby Gem.
In java we have -Djava.net.debug=ssl, but I realize that is not using OpenSSL underneath.
Alternative
I have found a way to get Ruby to log the self-signed certificate that is being seen in Ruby via https://github.com/mislav/ssl-tools/blob/master/doctor.rb. Something along these lines, where the store_context contains the failed certificat:
http.verify_callback = lambda { |verify_ok, store_context|
if !verify_ok
failed_cert = store_context.current_cert
failed_cert_reason = "%d: %s" % [ store_context.error, store_context.error_string ]
end
verify_ok
}
This is not ideal as it requires code changes in our Ruby apps, which is using httparty as a wrapper. Also we would be replicating logging that is already done by OpenSSL.
The fact that this SSL Docter script exists seems to confirm there is no Ruby OpenSSL::xxx flag to achieve this?
Would it be possible to implement such a flag? Is there an alternative way to achieve the same?
- 主要語言
- C
- 星號
- 276
- 分支
- 204
- 平均合併
- 1 天 7 小時
- 30 天內合併 PR
- 9
環境準備
- 沒有 Dockerfile 或 Docker Compose 檔案
- 沒有 Pull Request 範本
- 閱讀貢獻指南
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
ruby/openssl 的其他 Issue
-
Add OpenSSL::SSL::SSLContext#client_hello_cb= (binding for SSL_CTX_set_client_hello_cb())可能已有人在做 @kou 於 10 天前認領。 未關閉
難度 4/5 3-5 天 新手友好度 53/100
維護者通常 1 天內回覆
-
難度 3/5 1-2 天 新手友好度 55/100
維護者通常 1 天內回覆
-
Expose XOFs like SHAKE128 and SHAKE256可能已有人在做 @rhenium 於 107 天前認領。 未關閉
難度 4/5 3-5 天 新手友好度 48/100
維護者通常 1 天內回覆
-
難度 5/5 一週以上 新手友好度 35/100
維護者通常 1 天內回覆
-
Unchecked *_set_* calls可能已有人在做 @ndossche 於 177 天前認領。 未關閉
難度 4/5 3-5 天 新手友好度 35/100
維護者通常 1 天內回覆
相似的 Issue
-
bug
難度 2/5 1-3 小時 新手友好度 83/100
nextbsd/nextbsd-userland#434 ·
維護者通常 1 天內回覆
-
[YSQL] Local-node initdb reads postgres.bki, but YB clusters bootstrap only from yb_postgres.bki未關閉area/ysql kind/enhancement priority/low status/awaiting-triage
難度 2/5 1-3 小時 新手友好度 72/100
yugabyte/yugabyte-db#35763 ·
維護者通常 1 天內回覆
-
category:port-update
難度 2/5 1-3 小時 新手友好度 66/100
維護者通常 2 天內回覆
-
emerge failure MARK mark-unstable media-kit
難度 2/5 1-3 小時 新手友好度 82/100
macaroni-os/mark-issues#834 ·
-
難度 2/5 1-3 小時 新手友好度 76/100
NVIDIA/open-gpu-kernel-modules#1479 · 2 則留言 ·
維護者通常 1 天內回覆