PayPal IPN确认失败,出现SSL例程:SSL3_READ_BYTES:sslv3警报握手失败

21

在我们这边没有作任何更改的情况下,可能与POODLE/SSL3有关,我们对PPIPNMessage::validate的PayPal API调用现在失败了。

SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure

IPN的结账和收据都没有问题(我们从未支持SSL3的传入),只是在确认IPN时出现了失败情况(奇怪的是,即使我们失败了,PayPal也不尝试再次发送)。

从相同的服务器命令行运行curl是成功的。

$ curl -iv https://ipnpb.paypal.com/cgi-bin/webscr
* About to connect() to ipnpb.paypal.com port 443 (#0)
*   Trying 173.0.88.8... connected
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Server finished (14):
* SSLv3, TLS handshake, Client key exchange (16):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSL connection using AES256-SHA
* Server certificate:
*    subject: 1.3.6.1.4.1.311.60.2.1.3=US; 1.3.6.1.4.1.311.60.2.1.2=Delaware; businessCategory=Private Organization; serialNumber=3014267; C=US; postalCode=95131-2021; ST=California; L=San Jose; street=2211 N 1st St; O=PayPal, Inc.; OU=PayPal Production; CN=ipnpb.paypa
*    start date: 2013-06-28 00:00:00 GMT
*    expire date: 2015-08-02 23:59:59 GMT
*    subjectAltName: ipnpb.paypal.com matched
*    issuer: C=US; O=VeriSign, Inc.; OU=VeriSign Trust Network; OU=Terms of use at https://www.verisign.com/rpa (c)06; CN=VeriSign Class 3 Extended Validation SSL CA
*    SSL certificate verify ok.
> GET /cgi-bin/webscr HTTP/1.1
> User-Agent: curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3
> Host: ipnpb.paypal.com
> Accept: */*

我注意到ssllabs.com在此端点上显示4个IP中仍有1个支持SSL3。

8个回答

32

是的,我们的IPN现在正在进行验证。我发现隔夜沙箱端点和大部分现场IPN回复端点已经删除了SSLv3。我认为很快它也会被从主要的api-3t.paypal.com端点中移除 - 在此之后,所有对PayPal的SSLv3调用都将失败。 - ianhk
6
谢谢Paypal提前通知。现场网站崩溃,浪费了数小时寻找解决方案。非常不满意。修复方法对我有效。 - depicus
嗯,我正在使用标准的cURL,当我设置curl_setopt($ch, CURLOPT_SSLVERSION, 4);时它仍然无法工作。有什么想法吗? - MrD
PHP文档指出,值为1表示TLSv1.0。它没有定义4的含义- http://php.net/manual/en/function.curl-setopt.php - jrg
2
“4”,“5”和“6”这些值是针对cURL 7.34+的,因此一些旧版本的PHP可能无法使用这些值。我使用了值“1”,在我的半过时的PHP版本上运行得非常好。 :) - Taylor Jasko

15
我有同样的问题...只需更改 ipnlistener.php 上的以下行:
curl_setopt($ch, CURLOPT_SSLVERSION, 3);
to:
curl_setopt($ch, CURLOPT_SSLVERSION, 4);

ipnlistener.php

<?php
/**
* PayPal IPN Listener
*
* A class to listen for and handle Instant Payment Notifications (IPN) from
* the PayPal server.
*
* https://github.com/Quixotix/PHP-PayPal-IPN
*
* @package PHP-PayPal-IPN
* @author Micah Carrick
* @copyright (c) 2012 - Micah Carrick
* @version 2.1.0
*/
class IpnListener {

    /**
* If true, the recommended cURL PHP library is used to send the post back
* to PayPal. If flase then fsockopen() is used. Default true.
*
* @var boolean
*/
    public $use_curl = true;

    /**
* If true, explicitly sets cURL to use SSL version 3. Use this if cURL
* is compiled with GnuTLS SSL.
*
* @var boolean
*/
    public $force_ssl_v3 = true;

    /**
* If true, cURL will use the CURLOPT_FOLLOWLOCATION to follow any
* "Location: ..." headers in the response.
*
* @var boolean
*/
    public $follow_location = false;

    /**
* If true, an SSL secure connection (port 443) is used for the post back
* as recommended by PayPal. If false, a standard HTTP (port 80) connection
* is used. Default true.
*
* @var boolean
*/
    public $use_ssl = true;

    /**
* If true, the paypal sandbox URI www.sandbox.paypal.com is used for the
* post back. If false, the live URI www.paypal.com is used. Default false.
*
* @var boolean
*/
    public $use_sandbox = false;

    /**
* The amount of time, in seconds, to wait for the PayPal server to respond
* before timing out. Default 30 seconds.
*
* @var int
*/
    public $timeout = 30;

    private $post_data = array();
    private $post_uri = '';
    private $response_status = '';
    private $response = '';

    const PAYPAL_HOST = 'www.paypal.com';
    const SANDBOX_HOST = 'www.sandbox.paypal.com';

    /**
* Post Back Using cURL
*
* Sends the post back to PayPal using the cURL library. Called by
* the processIpn() method if the use_curl property is true. Throws an
* exception if the post fails. Populates the response, response_status,
* and post_uri properties on success.
*
* @param string The post data as a URL encoded string
*/
    protected function curlPost($encoded_data) {

        if ($this->use_ssl) {
            $uri = 'https://'.$this->getPaypalHost().'/cgi-bin/webscr';
            $this->post_uri = $uri;
        } else {
            $uri = 'http://'.$this->getPaypalHost().'/cgi-bin/webscr';
            $this->post_uri = $uri;
        }

        $ch = curl_init();

                curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
                curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
                curl_setopt($ch, CURLOPT_CAINFO,
                 dirname(__FILE__)."/cert/api_cert_chain.crt");
        curl_setopt($ch, CURLOPT_URL, $uri);
        curl_setopt($ch, CURLOPT_POST, true);
        curl_setopt($ch, CURLOPT_POSTFIELDS, $encoded_data);
        curl_setopt($ch, CURLOPT_FOLLOWLOCATION, $this->follow_location);
        curl_setopt($ch, CURLOPT_TIMEOUT, $this->timeout);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_HEADER, true);
        curl_setopt($ch, CURLOPT_SSLVERSION, 4);

        if ($this->force_ssl_v3) {
            curl_setopt($ch, CURLOPT_SSLVERSION, 4); //Modified from 3 to 4
        }

        $this->response = curl_exec($ch);
        $this->response_status = strval(curl_getinfo($ch, CURLINFO_HTTP_CODE));

        if ($this->response === false || $this->response_status == '0') {
            $errno = curl_errno($ch);
            $errstr = curl_error($ch);
            throw new Exception("cURL error: [$errno] $errstr");
        }
    }

    /**
* Post Back Using fsockopen()
*
* Sends the post back to PayPal using the fsockopen() function. Called by
* the processIpn() method if the use_curl property is false. Throws an
* exception if the post fails. Populates the response, response_status,
* and post_uri properties on success.
*
* @param string The post data as a URL encoded string
*/
    protected function fsockPost($encoded_data) {

        if ($this->use_ssl) {
            $uri = 'ssl://'.$this->getPaypalHost();
            $port = '443';
            $this->post_uri = $uri.'/cgi-bin/webscr';
        } else {
            $uri = $this->getPaypalHost(); // no "http://" in call to fsockopen()
            $port = '80';
            $this->post_uri = 'http://'.$uri.'/cgi-bin/webscr';
        }

        $fp = fsockopen($uri, $port, $errno, $errstr, $this->timeout);

        if (!$fp) {
            // fsockopen error
            throw new Exception("fsockopen error: [$errno] $errstr");
        }

        $header = "POST /cgi-bin/webscr HTTP/1.1\r\n";
        $header .= "Host: ".$this->getPaypalHost()."\r\n";
        $header .= "Content-Type: application/x-www-form-urlencoded\r\n";
        $header .= "Content-Length: ".strlen($encoded_data)."\r\n";
        $header .= "Connection: Close\r\n\r\n";

        fputs($fp, $header.$encoded_data."\r\n\r\n");

        while(!feof($fp)) {
            if (empty($this->response)) {
                // extract HTTP status from first line
                $this->response .= $status = fgets($fp, 1024);
                $this->response_status = trim(substr($status, 9, 4));
            } else {
                $this->response .= fgets($fp, 1024);
            }
        }

        fclose($fp);
    }

    private function getPaypalHost() {
        if ($this->use_sandbox) return self::SANDBOX_HOST;
        else return self::PAYPAL_HOST;
    }

    /**
* Get POST URI
*
* Returns the URI that was used to send the post back to PayPal. This can
* be useful for troubleshooting connection problems. The default URI
* would be "ssl://www.sandbox.paypal.com:443/cgi-bin/webscr"
*
* @return string
*/
    public function getPostUri() {
        return $this->post_uri;
    }

    /**
* Get Response
*
* Returns the entire response from PayPal as a string including all the
* HTTP headers.
*
* @return string
*/
    public function getResponse() {
        return $this->response;
    }

    /**
* Get Response Status
*
* Returns the HTTP response status code from PayPal. This should be "200"
* if the post back was successful.
*
* @return string
*/
    public function getResponseStatus() {
        return $this->response_status;
    }

    /**
* Get Text Report
*
* Returns a report of the IPN transaction in plain text format. This is
* useful in emails to order processors and system administrators. Override
* this method in your own class to customize the report.
*
* @return string
*/
    public function getTextReport() {

        $r = '';

        // date and POST url
        for ($i=0; $i<80; $i++) { $r .= '-'; }
        $r .= "\n[".date('m/d/Y g:i A').'] - '.$this->getPostUri();
        if ($this->use_curl) $r .= " (curl)\n";
        else $r .= " (fsockopen)\n";

        // HTTP Response
        for ($i=0; $i<80; $i++) { $r .= '-'; }
        $r .= "\n{$this->getResponse()}\n";

        // POST vars
        for ($i=0; $i<80; $i++) { $r .= '-'; }
        $r .= "\n";

        foreach ($this->post_data as $key => $value) {
            $r .= str_pad($key, 25)."$value\n";
        }
        $r .= "\n\n";

        return $r;
    }

    /**
* Process IPN
*
* Handles the IPN post back to PayPal and parsing the response. Call this
* method from your IPN listener script. Returns true if the response came
* back as "VERIFIED", false if the response came back "INVALID", and
* throws an exception if there is an error.
*
* @param array
*
* @return boolean
*/
    public function processIpn($post_data=null) {

        $encoded_data = 'cmd=_notify-validate';

        if ($post_data === null) {
            // use raw POST data
            if (!empty($_POST)) {
                $this->post_data = $_POST;
                $encoded_data .= '&'.file_get_contents('php://input');
            } else {
                throw new Exception("No POST data found.");
            }
        } else {
            // use provided data array
            $this->post_data = $post_data;

            foreach ($this->post_data as $key => $value) {
                $encoded_data .= "&$key=".urlencode($value);
            }
        }

        if ($this->use_curl) $this->curlPost($encoded_data);
        else $this->fsockPost($encoded_data);

        if (strpos($this->response_status, '200') === false) {
            throw new Exception("Invalid response status: ".$this->response_status);
        }

        if (strpos($this->response, "VERIFIED") !== false) {
            return true;
        } elseif (strpos($this->response, "INVALID") !== false) {
            return false;
        } else {
            throw new Exception("Unexpected response from PayPal.");
        }
    }

    /**
* Require Post Method
*
* Throws an exception and sets a HTTP 405 response header if the request
* method was not POST.
*/
    public function requirePostMethod() {
        // require POST requests
        if ($_SERVER['REQUEST_METHOD'] && $_SERVER['REQUEST_METHOD'] != 'POST') {
            header('Allow: POST', true, 405);
            throw new Exception("Invalid HTTP request method.");
        }
    }
}
?>

我们正在使用同一个库,但它在我的网站上无法工作。我甚至现在都没有收到IPN请求。有什么想法吗? - MrD
1
强制cURL使用4很容易,也是解决问题的正确方法!运行得非常好! - Ivan Dokov

13

为响应“POODLE”漏洞,PayPal已禁用SSLv3协议。在此处阅读有关此事的信息:PayPal Response

如果您正在使用ipnlistener.php,请将SSL协议强制设置为TLS 1.2:

curl_setopt($ch, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_2); 

(更新:2017年需要 TLS V1.2)

注意:PayPal正在升级其用于保护所有对其系统发起的外部连接所使用的协议。在2018年与PayPal通信将必须使用传输层安全性协议版本1.2(TLS 1.2)和超文本传输协议版本1.1(HTTP/1.1)。请参阅他们的Security Roadmap(安全路线图)


2

SSLv3在www.paypal.com上已不再可用:

# sslscan www.paypal.com|grep Accepted
Accepted  TLSv1  256 bits  AES256-SHA
Accepted  TLSv1  128 bits  AES128-SHA
Accepted  TLSv1  168 bits  DES-CBC3-SHA
Accepted  TLSv1  128 bits  RC4-SHA
Accepted  TLSv1  128 bits  RC4-MD5

你应该将CURLOPT_SSLVERSION更改为TLSv1:
curl_setopt($ch, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1);

这个"CURL_SSLVERSION_TLSv1"常量在较旧的PHP版本中不可用,因此另一种方法是简单地删除CURLOPT_SSLVERSION的强制执行。


1
对我来说,其他答案提到的这些方法都没用,但是我找到了解决方法,和其他方法类似,但是花了一段时间才找到我正在使用的sdk放置其curl配置文件的位置,因为没有ipn监听器文件,而且"PPHttpConfig"会给我一个致命错误。
所以我发现他们现在正在使用的是这个监听器文件:

PayPal-PHP-SDK/paypal/rest-api-sdk-php/lib/PayPal/Core/PayPalHttpConfig.php

我发现里面有:

CURLOPT_SSLVERSION => 1

我将其改为:

CURLOPT_SSLVERSION => 4

这样就解决了我的问题。


感谢@Kit Ramos的发现,以下是截至2016年4月的所有可能值:CURL_SSLVERSION_DEFAULT(0) CURL_SSLVERSION_TLSv1(1) CURL_SSLVERSION_SSLv2(2) CURL_SSLVERSION_SSLv3(3) CURL_SSLVERSION_TLSv1_0(4) CURL_SSLVERSION_TLSv1_1(5) CURL_SSLVERSION_TLSv1_2(6) - Ruslan Abuzant

0

我在使用PayPal检查IPN时遇到了同样的错误。以下是问题的解决方案:

我曾经使用PHP 5.3,但是PHP 5.3不再支持SSL版本3。我升级到了PHP 5.4,并添加了下面这行代码。这对我起作用了。

curl_setopt($ch, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $req);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
#curl_setopt($ch, CURLOPT_SSLVERSION, 4);
curl_setopt($ch, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1); 
curl_setopt($ch, CURLOPT_SSL_CIPHER_LIST, 'TLSv1');

0

我完全同意。 浪费了很多时间才弄明白。 在我的IPN监听器中,我不得不删除“force ssl v3”。 从那时起,我的IPN又开始工作了。

只需执行 curl -v https://paypal.com

它会显示: SSL连接使用TLS_RSA_WITH_AES_256_CBC_SHA


-2

在调用函数PPHttpPost()时,在您的PayPal类中使用此设置。

curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); 
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false); 
curl_setopt($ch, CURLOPT_SSLVERSION, 6); //6 is for TLSV1.2

1
这在生产环境中绝对不是推荐的设置。这些设置应该为TRUE,以确保没有第三方在中间伪造您正在连接的主机。 - Ruslan Abuzant

网页内容由stack overflow 提供, 点击上面的
可以查看英文原文,
原文链接