https(SSL) handshake failure解决过程

liangjz · 发表于 2008-2-29 22:41:33

初到阿里巴巴时遇到的一个技术问题，呵呵放到另外的地方太冷落了，不忍心啊。特转移到这里

碰到loadrunner https脚本回放失败，通过多次尝试，无意中找到答案，觉得过程有点意思，特与各位交流。 •1.1.    录制https脚本采用http协议，url: https://crm.cn.alibaba-inc.com/, 默认选项。生成的脚本如后：
web_url("crm.cn.alibaba-inc.com",
         "URL=https://crm.cn.alibaba-inc.com/",
         "Resource=0",
         "RecContentType=text/html",
         "Referer=",
         "Snapshot=t1.inf",
         "Mode=HTML",
         LAST);
•1.2.    回放失败打开extend log，把advance trace均打开，log如后：
Action.c(6): web_url("crm.cn.alibaba-inc.com" started    [MsgId: MMSG-26355]
Action.c(6): t=407ms: Connecting to host 60.190.232.107:443       [MsgId: MMSG-26000]
Action.c(6): t=426ms: Connected socket from 10.0.68.48:3764 to 60.190.232.107:443 in 13 ms  [MsgId: MMSG-26000]
Action.c(6): SSL3 alert read:fatal failure
   [MsgId: MMSG-26000]
Action.c(6): SSL_connect:error in SSLv2/v3 read server hello A
   [MsgId: MMSG-26000]
Action.c(6): Error -27778: SSL protocol error when attempting to connect with host "crm.cn.alibaba-inc.com"  [MsgId: MERR-27778]
Action.c(6): t=443ms: Closed connection to crm.cn.alibaba-inc.com:443 after completing 0 requests [MsgId: MMSG-26000]
Action.c(6): t=445ms: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure       [MsgId: MMSG-26000]
Action.c(6): web_url("crm.cn.alibaba-inc.com" highest severity level was "ERROR", 0 body bytes, 0 header bytes    [MsgId: MMSG-26388]
•1.3.    解决过程第一层想法：

Ø support.mercury.com，以关键词 ssl,https均未有相近结果。但肯定loadrunner支持SSL。
Ø 去51testing.com找到有类似问题，但未有解决方案。
Ø 查 function reference，并没有看到与ssl特别密切的函数，仅有web_set_sockets_option沾边。查online book，有些关于ssl 的说明。
第二层想法:  找了一些ssl 握手过程的资料（如rfc）。了解到client/server握手过程中，内容动态变化。经过ethereal抓包，确信loadrunner每次回放均采用旧值，导致handshake failure 。初步计划下载openssl的握手源代码，包装成dll并集成到loadrunner。
考虑到代价高昂，再google  ssl+loadrunner 。随手看到 http://www.wilsonmar.com/1loadrun.htm：If an Web SSL script works in the Controller but not vuGen, try changing the controller's Runtime Settings Preferences to "WININET replay instead of Sockets".  不类似，但一尝试，问题解决！
•1.4.    解决方法在vugen 内， run-time settings->preferences->勾上WININET replay instead of Sockets。
•1.5.    原理
vugen  user's  guide 提到 Advanced Web run-time options

WinInet Replay (instead of Sockets): Instructs VuGen to use the WinInet

replay engine. VuGen has two HTTP replay engines: Sockets-based (default)

or WinInet based. The WinInet is the engine used by Internet Explorer and

it supports all of the features incorporated into the IE browser. The

limitations of the WinInet replay engine are that it is not scalable, nor does

it support UNIX. In addition, when working with threads, the WinInet

engine does not accurately emulate the modem speed and number of

connections.

VuGen's proprietary sockets-based replay is a lighter engine that is scalable

for load testing. It is also accurate when working with threads. The

limitation of the sockets-based engine is that it does not support SOCKS

proxy. If you are recording in that type of environment, use the WinInet

replay engine.

从上可知，winInet replay 支持集成如IE的所有特征。回放时，底层的winInet函数完成SSL握手过程。同时每种mode均有优劣。

另外，找到一些说明：

Any Web script can be replayed in LoadRunner in two modes:

1. WinInet Mode - Using the WinInet.dll provided by Internet Explorer.
2. Socket mode - Using the Sockets Replay engine developed by Mercury.

•1.6.    启示
Ø 有必要再review 一次loadrunner的文档。Loadrunner还是一个"黑匣子"，有很多的技术细节不为人知！
Ø 关注每一个选项，尤其平常少用的。也许就是一个不起眼的选项，节省无数的时间