NAME
POE::Filter::SSL - The easiest and flexiblest way to SSL in POE!
VERSION
Version 0.27
DESCRIPTION
This module allows to secure connections of *POE::Wheel::ReadWrite* with
OpenSSL by a *POE::Filter* object, and behaves (beside of SSLing) as
*POE::Filter::Stream*.
*POE::Filter::SSL* can be added, switched and removed during runtime,
for example if you want to initiate SSL (see the *SSL on an established
connection* example in *SYNOPSIS*) on an already established connection.
You are able to combine *POE::Filter::SSL* with other filters, for
example have a HTTPS server together with *POE::Filter::HTTPD* (see the
*HTTPS-Server* example in *SYNOPSIS*).
*POE::Filter::SSL* is based on *Net::SSLeay*, but got two XS functions
which *Net::SSLeay* is missing.
Features
Full non-blocking processing
No use of sockets at all
Server and client mode
Optional client certificate verification
Allows to accept connections with invalid or missing client
certificate and return custom error data
CRL check of client certificates
Retrieve client certificate details (subject name, issuer name,
certificate serial)
Upcoming Features
Direct cipher encryption without SSL or TLS protocol, for example
with static AES encryption
SYNOPSIS
By default *POE::Filter::SSL* acts as a SSL server. To use it in client
mode you just have to set the *client* option of *new()*.
TCP-Client
#!perl
use warnings;
use strict;
use POE qw(Component::Client::TCP Filter::SSL);
POE::Component::Client::TCP->new(
RemoteAddress => "yahoo.com",
RemotePort => 443,
Filter => [ "POE::Filter::SSL", client => 1 ],
Connected => sub {
$_[HEAP]{server}->put("HEAD /\r\n\r\n");
},
ServerInput => sub {
print "from server: ".$_[ARG0]."\n";
},
);
POE::Kernel->run();
exit;
TCP-Server
#!perl
use warnings;
use strict;
use POE qw(Component::Server::TCP);
POE::Component::Server::TCP->new(
Port => 443,
ClientFilter => [ "POE::Filter::SSL", crt => 'server.crt', key => 'server.key' ],
ClientConnected => sub {
print "got a connection from $_[HEAP]{remote_ip}\n";
$_[HEAP]{client}->put("Smile from the server!\r\n");
},
Alias => "tcp",
ClientInput => sub {
my ($kernel, $session, $heap) = @_[KERNEL, SESSION, HEAP];
$_[HEAP]{client}->put("You sent:\r\n".$_[ARG0]);
$_[KERNEL]->yield("shutdown");
},
);
POE::Kernel->run;
exit;
HTTPS-Server
use POE::Filter::SSL;
use POE::Component::Server::HTTP;
use HTTP::Status;
my $aliases = POE::Component::Server::HTTP->new(
Port => 443,
ContentHandler => {
'/' => \&handler,
'/dir/' => sub { return; },
'/file' => sub { return; }
},
Headers => { Server => 'My Server' },
PreFilter => POE::Filter::SSL->new(
crt => 'server.crt',
key => 'server.key',
cacrt => 'ca.crt'
)
);
sub handler {
my ($request, $response) = @_;
$response->code(RC_OK);
$response->content("Hi, you fetched ". $request->uri);
return RC_OK;
}
POE::Kernel->run();
POE::Kernel->call($aliases->{httpd}, "shutdown");
# next line isn't really needed
POE::Kernel->call($aliases->{tcp}, "shutdown");
SSL on an established connection
Advanced Example
This example is a IMAP-Relay which forwards the connections to a IMAP
server by username. It allows the uncrypted transfer on port 143, with
the option of SSL on the established connection (STARTTLS). On port
993 it allows to do direct SSL.
Tested with Thunderbird version 3.0.5.
#!perl
use warnings;
use strict;
use POE qw(Component::Server::TCP Component::Client::TCP Filter::SSL Filter::Stream);
my $defaultImapServer = "not.existing.de";
my $usernameToImapServer = {
user1 => 'mailserver1.domain.de',
user2 => 'mailserver2.domain.de',
# ...
};
POE::Component::Server::TCP->new(
Port => 143,
ClientFilter => "POE::Filter::Stream",
ClientDisconnected => \&disconnect,
ClientConnected => \&connected,
ClientInput => \&handleInput,
InlineStates => {
send_stuff => \&send_stuff,
_child => \&child
}
);
POE::Component::Server::TCP->new(
Port => 993,
ClientFilter => [ "POE::Filter::SSL", crt => 'server.crt', key => 'server.key' ],
ClientConnected => \&connected,
ClientDisconnected => \&disconnect,
ClientInput => \&handleInput,
InlineStates => {
send_stuff => \&send_stuff,
_child => \&child
}
);
sub disconnect {
my ($kernel, $session, $heap) = @_[KERNEL, SESSION, HEAP];
logevent('server got disconnect', $session);
$kernel->post($heap->{client_id} => "shutdown");
}
sub connected {
my ($kernel, $session, $heap) = @_[KERNEL, SESSION, HEAP];
logevent("got a connection from ".$heap->{remote_ip}, $session);
$heap->{client}->put("* OK [CAPABILITY IMAP4rev1 UIDPLUS CHILDREN NAMESPACE THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT QUOTA IDLE ACL ACL2=UNION STARTTLS] IMAP Relay v0.1 ready.\r\n");
}
sub send_stuff {
my ($heap, $stuff, $session) = @_[HEAP, ARG0, SESSION];
logevent("-> ".length($stuff)." Bytes", $session);
(defined($heap->{client})) && (ref($heap->{client}) eq "POE::Wheel::ReadWrite") &&
$heap->{client}->put($stuff);
}
sub child {
my ($heap, $child_op, $child) = @_[HEAP, ARG0, ARG1];
if ($child_op eq "create") {
$heap->{client_id} = $child->ID;
}
}
sub handleInput {
my ($kernel, $session, $heap, $input) = @_[KERNEL, SESSION, HEAP, ARG0];
if($heap->{forwarding}) {
return $kernel->yield("shutdown") unless (defined($heap->{client_id}));
$kernel->post($heap->{client_id} => send_stuff => $input);
} elsif ($input =~ /^(\d+)\s+STARTTLS[\r\n]+/i) {
$_[HEAP]{client}->put($1." OK Begin SSL/TLS negotiation now.\r\n");
logevent("SSLing now...", $session);
$_[HEAP]{client}->set_filter(POE::Filter::SSL->new(crt => 'server.crt', key => 'server.key'));
} elsif ($input =~ /^(\d+)\s+CAPABILITY[\r\n]+/i) {
$_[HEAP]{client}->put("* CAPABILITY IMAP4rev1 UIDPLUS CHILDREN NAMESPACE THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT QUOTA IDLE ACL ACL2=UNION STARTTLS\r\n");
$_[HEAP]{client}->put($1." OK CAPABILITY completed\r\n");
} elsif ($input =~ /^(\d+)\s+login\s+\"(\S+)\"\s+\"(\S+)\"[\r\n]+/i) {
my $username = $2;
my $pass = $3;
logevent("login of user ".$username, $session);
spawn_client_side($username, $input);
$heap->{forwarding}++;
} else {
logevent("unknown command before login, disconnecting.", $session);
return $kernel->yield("shutdown");
}
}
sub spawn_client_side {
my $username = shift;
POE::Component::Client::TCP->new(
RemoteAddress => $usernameToImapServer->{$username} || $defaultImapServer,
RemotePort => 143,
Filter => "POE::Filter::Stream",
Started => sub {
$_[HEAP]->{server_id} = $_[SENDER]->ID;
$_[HEAP]->{buf} = $_[ARG0];
$_[HEAP]->{skip} = 0;
},
Connected => sub {
my ($heap, $session) = @_[HEAP, SESSION];
logevent('client connected', $session);
$heap->{server}->put($heap->{buf});
delete $heap->{buf};
},
ServerInput => sub {
my ($kernel, $heap, $session, $input) = @_[KERNEL, HEAP, SESSION, ARG0];
#logevent('client got input', $session, $input);
$kernel->post($heap->{server_id} => send_stuff => $input) if ($heap->{skip}++);
},
Disconnected => sub {
my ($kernel, $heap, $session) = @_[KERNEL, HEAP, SESSION];
logevent('client disconnected', $session);
$kernel->post($heap->{server_id} => 'shutdown');
},
InlineStates => {
send_stuff => sub {
my ($heap, $stuff, $session) = @_[HEAP, ARG0, SESSION];
logevent("<- ".length($stuff)." Bytes", $session);
(defined($heap->{server})) && (ref($heap->{server}) eq "POE::Wheel::ReadWrite") &&
$heap->{server}->put($stuff);
},
},
Args => [ shift ]
);
}
sub logevent {
my ($state, $session, $arg) = @_;
my $id = $session->ID();
print "session $id $state ";
print ": $arg" if (defined $arg);
print "\n";
}
POE::Kernel->run;
Client certificate verification
Advanced Example
The following example implements a HTTPS server with client
certificate verification, which shows details about the verified
client certificate.
#!perl
use strict;
use warnings;
use Socket;
use POE qw(
Wheel::SocketFactory
Wheel::ReadWrite
Driver::SysRW
Filter::SSL
Filter::Stackable
Filter::HTTPD
);
POE::Session->create(
inline_states => {
_start => sub {
my $heap = $_[HEAP];
$heap->{listener} = POE::Wheel::SocketFactory->new(
BindAddress => '0.0.0.0',
BindPort => 443,
Reuse => 'yes',
SuccessEvent => 'socket_birth',
FailureEvent => '_stop',
);
},
_stop => sub {
delete $_[HEAP]->{listener};
},
socket_birth => sub {
my ($socket) = $_[ARG0];
POE::Session->create(
inline_states => {
_start => sub {
my ($heap, $kernel, $connected_socket, $address, $port) = @_[HEAP, KERNEL, ARG0, ARG1, ARG2];
$heap->{sslfilter} = POE::Filter::SSL->new(
crt => 'server.crt',
key => 'server.key',
cacrt => 'ca.crt',
cipher => 'DHE-RSA-AES256-GCM-SHA384:AES256-SHA',
#cacrl => 'ca.crl', # Uncomment this, if you have a CRL file.
debug => 1,
clientcert => 1
);
$heap->{socket_wheel} = POE::Wheel::ReadWrite->new(
Handle => $connected_socket,
Driver => POE::Driver::SysRW->new(),
Filter => POE::Filter::Stackable->new(Filters => [
$heap->{sslfilter},
POE::Filter::HTTPD->new()
]),
InputEvent => 'socket_input',
ErrorEvent => '_stop',
);
},
socket_input => sub {
my ($kernel, $heap, $buf) = @_[KERNEL, HEAP, ARG0];
my (@certid) = ($heap->{sslfilter}->clientCertIds());
my $content = '';
if ($heap->{sslfilter}->clientCertValid()) {
$content .= "Hello <font color=green>valid</font> client Certifcate:";
} else {
$content .= "None or <font color=red>invalid</font> client certificate:";
}
$content .= "<hr>";
foreach my $certid (@certid) {
$certid = $certid ? $certid->[0]."<br>".$certid->[1]."<br>SERIAL=".$heap->{sslfilter}->hexdump($certid->[2]) : 'No client certificate';
$content .= $certid."<hr>";
}
$content .= "Your URL was: ".$buf->uri."<hr>"
if (ref($buf) eq "HTTP::Request");
$content .= localtime(time());
my $response = HTTP::Response->new(200);
$response->push_header('Content-type', 'text/html');
$response->content($content);
$heap->{socket_wheel}->put($response);
$kernel->delay(_stop => 1);
},
_stop => sub {
delete $_[HEAP]->{socket_wheel};
}
},
args => [$socket],
);
}
}
);
$poe_kernel->run();
FUNCTIONS
new(option = value, option => value, option...)>
Returns a new *POE::Filter::SSL* object. It accepts the following
options:
debug
Shows debug messages of *clientCertNotOnCRL()*.
client
By default *POE::Filter::SSL* acts as a SSL server. To use it in
client mode, you have to set this option.
crt
The certificate file (.crt) for the server, only needed in server
mode.
chain
Chain certificates, for example startssl.org needs a intermedia
certificates. He you can configure it.
dhcert
If you want to enable perfect forward secrecy, here you can enable
Diffie-Hellman. You just have to create a dhpara file via *openssl
dhparam -check -text -5 1024 -out path/to/FILENAME.pem*, and there
here the path to the path/to/FILENAME.pem where your
Diffie-Hellman (pem format) stays.
key
The key file (.key) of the certificate for the server, only needed
in server mode.
clientcert
The server requests the client for a client certificat during ssl
handshake, only useful in server mode.
WARNING: If the client provides an untrusted or no client
certficate, the connection is not failing. You have to ask
*clientCertValid()* if the certicate is valid!
cacrt
The ca certificate file (ca.crt), which is used to verificate the
client certificates against a CA.
cacrl
Configures a CRL (ca.crl) against the client certificate is
verified by *clientCertValid()*.
cipher
Specify which ciphers are allowed for the synchronous encrypted
transfer of the data over the ssl connection.
Example:
cipher => 'DHE-RSA-AES256-GCM-SHA384:AES256-SHA'
blockbadclientcert
Let OpenSSL deny the connection if there is no or an invalid
client certificate.
WARNING: If the client is listed in the CRL file, the connection
will be established! You have to ask *clientCertValid()* if you
have the *crl* option set on *new()*, otherwise to ask
*clientCertNotOnCRL()* if the certificate is listed on your CRL
file!
handshakeDone(options)
Returns *true* if the handshake is done and all data for hanshake
has been written out. It accepts the following options:
ignorebuf
Returns *true* if OpenSSL has established the connection,
regardless if all data has been written out. This is needed if you
want to exchange the Filter of *POE::Wheel::ReadWrite* before the
first data comes in. This option have been only used by
*doHandshake()* to be able to add new filters before first
cleartext data to be processed gets in.
clientCertNotOnCRL($file)
Verifies if the serial of the client certificate is not contained in
the CRL $file. No file caching is done, each call opens the file
again.
WARNING: If your CRL file is missing, can not be opened is empty or
has no blocked certificate at all in it, then every call will get
blocked!
clientCertIds()
Returns an array of every certificate found by OpenSSL. Each element
is again a array. The first element is the value of
*X509_get_subject_name*, second is the value of
*X509_get_issuer_name* and third element is the serial of the
certificate in binary form. You have to use *split()* and *ord()*,
or the *hexdump()* function, to convert it to a readable form.
Example:
my ($certid) = ($heap->{sslfilter}->clientCertIds());
$certid = $certid ? $certid->[0]."<br>".$certid->[1]."<br>SERIAL=".$heap->{sslfilter}->hexdump($certid->[2]) : 'No client certificate';
getCipher()
Returns the used cryptographic algorithm and length.
Example:
$sslfilter->getCipher()
clientCertValid()
Returns *true* if there is a client certificate that is valid. It
also tests against the CRL, if you have the *cacrl* option set on
*new()*.
doHandshake($readWrite, $filter, $filter, ...) !!!REMOVED!!!
WARNING: POE::Filter:SSL now is able to do the ssh handshake now
without any helpers. Because of this, this function has been
removed!
Allows to add filters after the ssl handshake. It has to be called
in the input handler, and needs the passing of the
*POE::Wheel::ReadWhile* object. If it returns false, you have to
return from the input handler.
See the *HTTPS-Server*, *SSL on an established connection* and
*Client certificate verification* examples in *SYNOPSIS*
clientCertExists()
Returns *true* if there is a client certificate, that might be
untrusted.
WARNING: If the client provides an untrusted client certficate a
client certicate that is listed in CRL, this function returns
*true*. You have to ask *clientCertValid()* if the certicate is
valid!
hexdump($string)
Returns string data in hex format.
Example:
perl -e 'use POE::Filter::SSL; print POE::Filter::SSL->hexdump("test")."\n";'
74:65:73:74
Internal functions and POE::Filter handler
VERIFY()
X509_get_serialNumber()
clone()
doSSL()
get()
get_one()
get_one_start()
get_pending()
writeToSSLBIO()
writeToSSL()
put()
verify_serial_against_crl_file()
DOSENDBACK()
checkForDoSendback()
AUTHOR
Markus Schraeder, "<privi at cpan.org>"
BUGS
Please report any bugs or feature requests to "bug-poe-filter-ssl at
rt.cpan.org", or through the web interface at
<http://rt.cpan.org/NoAuth/ReportBug.html?Queue=POE-Filter-SSL>. I will
be notified, and then you'll automatically be notified of progress on
your bug as I make changes.
SUPPORT
You can find documentation for this module with the perldoc command.
perldoc POE::Filter::SSL
You can also look for information at:
* RT: CPAN's request tracker
<http://rt.cpan.org/NoAuth/Bugs.html?Dist=POE-Filter-SSL>
* AnnoCPAN: Annotated CPAN documentation
<http://annocpan.org/dist/POE-Filter-SSL>
* CPAN Ratings
<http://cpanratings.perl.org/d/POE-Filter-SSL>
* Search CPAN
<http://search.cpan.org/dist/POE-Filter-SSL>
Commercial support
Commercial support can be gained at <sslsupport at priv.de>
COPYRIGHT & LICENSE
Copyright 2010-2013 Markus Schraeder, all rights reserved.
This program is free software; you can redistribute it and/or modify it
under the same terms as Perl itself.