Eu estou tentando descobrir onde Ruby espera encontrar sua lista de CA OpenSSL. Meu ambiente é:
- Mac OS 10.7.5
- openssl do homebrew
- rbenv de homebrew
- Ruby 1.9.3, instalado usando rbenv e configure_opts = "- com-openssl-dir =` brew --prefix openssl`
Confirmação de que meu Ruby está usando o Homebrew OpenSSL (Nota: ABCDEFGHIJKLMNABCDEFGHIJKLMN1 é uma versão redigida do diretório do usuário em todos os exemplos abaixo):
$ otool -L /Users/me/.rbenv/versions/1.9.3-p194/lib/ruby/1.9.1/x86_64-darwin11.4.2/openssl.bundle /Users/me/.rbenv/versions/1.9.3-p194/lib/ruby/1.9.1/x86_64-darwin11.4.2/openssl.bundle: /usr/local/opt/openssl/lib/libssl.1.0.0.dylib (compatibility version 1.0.0, current version 1.0.0) /usr/local/opt/openssl/lib/libcrypto.1.0.0.dylib (compatibility version 1.0.0, current version 1.0.0) /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 159.1.0) /usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0) Para testar, escrevi o seguinte script:
#!/usr/bin/env ruby require 'net/https' https = Net::HTTP.new('encrypted.google.com', 443) https.use_ssl = true https.verify_mode = OpenSSL::SSL::VERIFY_PEER https.request_get('/') puts 'success!' Se eu especificar manualmente o caminho para o meu ssl_cert_file, ele funciona:
$ SSL_CERT_FILE=/Users/me/.rbenv/versions/1.9.3-p194/lib/ruby/site_ruby/1.9.1/rubygems/ssl_certs/ca-bundle.pem ./test_ssl.rb success! Se não, quebra:
$ ./test_ssl.rb /Users/me/.rbenv/versions/1.9.3-p194/lib/ruby/1.9.1/net/http.rb:799:in `connect': SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed (OpenSSL::SSL::SSLError) from /Users/me/.rbenv/versions/1.9.3-p194/lib/ruby/1.9.1/net/http.rb:799:in `block in connect' from /Users/me/.rbenv/versions/1.9.3-p194/lib/ruby/1.9.1/timeout.rb:54:in `timeout' from /Users/me/.rbenv/versions/1.9.3-p194/lib/ruby/1.9.1/timeout.rb:99:in `timeout' from /Users/me/.rbenv/versions/1.9.3-p194/lib/ruby/1.9.1/net/http.rb:799:in `connect' from /Users/me/.rbenv/versions/1.9.3-p194/lib/ruby/1.9.1/net/http.rb:755:in `do_start' from /Users/me/.rbenv/versions/1.9.3-p194/lib/ruby/1.9.1/net/http.rb:744:in `start' from /Users/me/.rbenv/versions/1.9.3-p194/lib/ruby/1.9.1/net/http.rb:1284:in `request' from /Users/me/.rbenv/versions/1.9.3-p194/lib/ruby/1.9.1/net/http.rb:1195:in `request_get' from ./test_ssl.rb:6:in `<main>' Como de lado, já estou ciente de que poderia verificar manualmente vários caminhos para o arquivo CA do meu script. No entanto, o script é um teste de operações semelhantes líquidas / http dentro do Ruby Gem "Faraday" no meu sistema. Eu não quero cortar a jóia do Faraday para contornar esse problema.
Então eu usei dtruss para procurar por comandos de estatísticas e ver se algum deles é tentado CA File Lookups:
$ sudo dtruss -f -t stat64 ./test_ssl.rb PID/THRD SYSCALL(args) = return 96741/0x6b4be4: stat64("/usr/lib/dtrace/libdtrace_dyld.dylib ", 0x7FFF6A9BE810, 0x7FFF6A9BF700) = 0 0 96741/0x6b4be4: stat64("/usr/lib/libSystem.B.dylib ", 0x7FFF6A9BE650, 0x7FFF6A9BF4D0) = 0 0 96741/0x6b4be4: stat64("/usr/lib/system/libcache.dylib ", 0x7FFF6A9BE350, 0x7FFF6A9BF1D0) = 0 0 96741/0x6b4be4: stat64("/usr/lib/system/libcommonCrypto.dylib ", 0x7FFF6A9BE350, 0x7FFF6A9BF1D0) = 0 0 96741/0x6b4be4: stat64("/usr/lib/system/libcompiler_rt.dylib ", 0x7FFF6A9BE350, 0x7FFF6A9BF1D0) = 0 0 96741/0x6b4be4: stat64("/usr/lib/system/libcopyfile.dylib ", 0x7FFF6A9BE350, 0x7FFF6A9BF1D0) = 0 0 96741/0x6b4be4: stat64("/usr/lib/system/libdispatch.dylib ", 0x7FFF6A9BE350, 0x7FFF6A9BF1D0) = 0 0 96741/0x6b4be4: stat64("/usr/lib/system/libdnsinfo.dylib ", 0x7FFF6A9BE350, 0x7FFF6A9BF1D0) = 0 0 96741/0x6b4be4: stat64("/usr/lib/system/libdyld.dylib ", 0x7FFF6A9BE350, 0x7FFF6A9BF1D0) = 0 0 96741/0x6b4be4: stat64("/usr/lib/system/libkeymgr.dylib ", 0x7FFF6A9BE350, 0x7FFF6A9BF1D0) = 0 0 96741/0x6b4be4: stat64("/usr/lib/system/liblaunch.dylib ", 0x7FFF6A9BE350, 0x7FFF6A9BF1D0) = 0 0 96741/0x6b4be4: stat64("/usr/lib/system/libmacho.dylib ", 0x7FFF6A9BE350, 0x7FFF6A9BF1D0) = 0 0 96741/0x6b4be4: stat64("/usr/lib/system/libmathCommon.A.dylib ", 0x7FFF6A9BE350, 0x7FFF6A9BF1D0) = 0 0 96741/0x6b4be4: stat64("/usr/lib/system/libquarantine.dylib ", 0x7FFF6A9BE350, 0x7FFF6A9BF1D0) = 0 0 96741/0x6b4be4: stat64("/usr/lib/system/libremovefile.dylib ", 0x7FFF6A9BE350, 0x7FFF6A9BF1D0) = 0 0 96741/0x6b4be4: stat64("/usr/lib/system/libsystem_blocks.dylib ", 0x7FFF6A9BE350, 0x7FFF6A9BF1D0) = 0 0 96741/0x6b4be4: stat64("/usr/lib/system/libsystem_c.dylib ", 0x7FFF6A9BE350, 0x7FFF6A9BF1D0) = 0 0 96741/0x6b4be4: stat64("/usr/lib/system/libsystem_dnssd.dylib ", 0x7FFF6A9BE350, 0x7FFF6A9BF1D0) = 0 0 96741/0x6b4be4: stat64("/usr/lib/system/libsystem_info.dylib ", 0x7FFF6A9BE350, 0x7FFF6A9BF1D0) = 0 0 96741/0x6b4be4: stat64("/usr/lib/system/libsystem_kernel.dylib ", 0x7FFF6A9BE350, 0x7FFF6A9BF1D0) = 0 0 96741/0x6b4be4: stat64("/usr/lib/system/libsystem_network.dylib ", 0x7FFF6A9BE350, 0x7FFF6A9BF1D0) = 0 0 96741/0x6b4be4: stat64("/usr/lib/system/libsystem_notify.dylib ", 0x7FFF6A9BE350, 0x7FFF6A9BF1D0) = 0 0 96741/0x6b4be4: stat64("/usr/lib/system/libsystem_sandbox.dylib ", 0x7FFF6A9BE350, 0x7FFF6A9BF1D0) = 0 0 96741/0x6b4be4: stat64("/usr/lib/system/libunc.dylib ", 0x7FFF6A9BE350, 0x7FFF6A9BF1D0) = 0 0 96741/0x6b4be4: stat64("/usr/lib/system/libunwind.dylib ", 0x7FFF6A9BE350, 0x7FFF6A9BF1D0) = 0 0 96741/0x6b4be4: stat64("/usr/lib/system/libxpc.dylib ", 0x7FFF6A9BE350, 0x7FFF6A9BF1D0) = 0 0 96741/0x6b4be4: stat64("/AppleInternal ", 0x7FFF6A9BEFF8, 0x0) = -1 Err#2 96741/0x6b4be4: stat64("/usr/lib/libstdc++.6.dylib ", 0x7FFF6A9BE640, 0x7FFF6A9BF4C0) = 0 0 96741/0x6b4be4: stat64("/usr/lib/libc++abi.dylib ", 0x7FFF6A9BE550, 0x7FFF6A9BF3D0) = 0 0 Nenhuma das estatísticas do arquivo parece uma pesquisa de arquivo CA! Estou usando dtruss corretamente? Existe alguma outra maneira para eu descobrir onde o arquivo de certificados do CA deve ser colocado?