/ 
POE-Filter-SSL-0.09
River stage one • 2 direct dependents • 2 total dependents
/ POE::Filter::SSL

NAME

POE::Filter::SSL - The easiest and flexiblest way to SSL in POE!

VERSION

Version 0.09

DESCRIPTION

This module allows to secure connections of POE::Wheel::ReadWrite with OpenSSL by a POE::Filter object.

The SSL filter can be added and removed during runtime, for example if you first do plain text and aftert this SSL (e.g. STARTTLS). You also can combine POE::Filter::SSL with any other filter, e.g. realise a HTTPS server together with POE::Filter::HTTPD (see ADVANCED EXAMPLE later on this site).

POE::Filter::SSL is mainly based on Net::SSLeay, but got implemented some missing calls Net::SSLeay missing. It got an own BIO implementation, which replaces the socket interface of OpenSSL.

Features

    Full non-blocking processing

    No use of sockets at all

    Server and client mode

    Optional client certificate verification

    Allows to accept connections with invalid or missing client certificate and return custom error data

    CRL check of client certificates

    Retrieve client certificate details (subject name, issuer name, certificate serial)

Upcoming Features

    Direct cipher encryption without SSL or TLS protocol, for example with static AES encryption

SYNOPSIS

Server and client mainly differs in the client option of new().

Client
#!perl

use warnings;
use strict;

use POE qw(Component::Client::TCP Filter::SSL);

POE::Component::Client::TCP->new(
  RemoteAddress => "yahoo.com",
  RemotePort    => 443,
  Filter => [
    "POE::Filter::SSL",              ## HERE WE ARE!
      client => 1 ],
  Connected     => sub {
    $_[HEAP]{server}->put("HEAD /\r\n");
  },
  ServerInput   => sub {
    my $input = $_[ARG0];
    # The following line is needed to do the SSL handshake!
    return $_[HEAP]{server}->put() unless $input;
    print "from server: $input\n";
  },
);

POE::Kernel->run();
exit;
Server
#!perl

use warnings;
use strict;

use POE qw(Component::Server::TCP);

POE::Component::Server::TCP->new(
  Port => 443,
  ClientFilter => [
    "POE::Filter::SSL",                ## HERE WE ARE!
      crt => 'server.crt',
      key => 'server.key' ],
  ClientConnected => sub {
    print "got a connection from $_[HEAP]{remote_ip}\n";
    $_[HEAP]{client}->put("Smile from the server!");
  },
  ClientInput => sub {
    my $client_input = $_[ARG0];
    # The following line is needed to do the SSL handshake!
    return $_[HEAP]{client}->put() unless $client_input;
    $client_input =~ tr[a-zA-Z][n-za-mN-ZA-M];
    $_[HEAP]{client}->put($client_input);
  },
);

POE::Kernel->run;
exit;

FUNCTIONS

new(options)

Returns a new POE::Filter::SSL object. It accepts the following options:

debug

Get debug messages, currently mainly used by clientCertNotOnCRL().

client

The filter has to behave as a SSL client, not as a SSL server.

crt

The certificate file (.crt) for the server.

key

The key file (.key) of the certificate for the server.

clientcert

The server requests the client for a client certificat during ssl handshake.

WARNING: If the client provides an untrusted or no client certficate, the connection is not failing. You have to ask clientCertValid() if the certicate is valid!

cacrt

The ca certificate file (ca.crt), which is used to verificated the client certificates against a CA.

cacrl

Configures a CRL against the client certificate is proofed by clientCertValid().

cipher

Specify which ciphers are allowed for the synchronous encrypted transfer of the data over the ssl connection. Example:

cipher => 'AES256-SHA'
handshakeDone(options)

Returns true if the handshake is done and all data for hanshake has been written out. It accepts the following options:

ignorebuf

Returns true if OpenSSL has established the connection, regardless if all data has been written out. This is needed if you want to exchange the Filter of POE::Wheel::ReadWrite before the first data comes in (see ADVANCED EXAMPLE later on this site).

clientCertNotOnCRL($file)

Verifies if the serial of the client certificate is not contained in the CRL $file. No file caching is done, each call opens the file again.

WARNING: If your CRL file is missing, can not be opened is empty or has no blocked certificate at all in it, then every call will get blocked!

clientCertIds()

Returns an array of every certificate found by OpenSSL. Each element is again a array. The first element is the value of X509_get_subject_name, second is the value of X509_get_issuer_name and third element is the serial of the certificate in binary form. You have to use split() and ord() to convert it to a readable form. Example:

my ($certid) = ($heap->{sslfilter}->clientCertIds());
$certid = $certid ? $certid->[0]."<br>".$certid->[1]."<br>SERIAL=".hexdump($certid->[2]) : 'No client certificate';
clientCertValid()

Returns true if there is a client certificate that is valid. It also tests against the crl, if you have the cacrl option set on new().

clientCertExists()

Returns true if there is a client certificate, that maybe is untrusted.

WARNING: If the client provides an untrusted client certficate a client certicate that is listed in CRL, this function maybe return true. You have to ask clientCertValid() if the certicate is valid!

hexdump($string)

Returns string data in hex format.

Example:

perl -e 'use POE::Filter::SSL; print POE::Filter::SSL::hexdump("test")."\n";'
74:65:73:74

Internal functions and POE::Filter handler

BIO_get_handler()
BIO_read()
BIO_write()
VERIFY()
X509_get_serialNumber()
clone()
doSSL()
get()
get_one()
get_one_start()
get_pending()
hello()
put()
verify_serial_against_crl_file()

ADVANCED EXAMPLE

The following example implements a HTTPS server with client certificate validation, which shows details about the verified client certificate. If you uncomment the POE::Filter::HTTPD block, it also shows the URI property of the parsed HTTP::Response object from POE::Filter::HTTPD.

#!perl

use strict;
use warnings;
use Socket;
use POE qw(
  Wheel::SocketFactory
  Wheel::ReadWrite
  Driver::SysRW
  Filter::SSL
  Filter::Stackable
  Filter::HTTPD
);

POE::Session->create(
  inline_states => {
    _start       => sub {
      my $heap = $_[HEAP];
        $heap->{listener} = POE::Wheel::SocketFactory->new(
          BindAddress  => '0.0.0.0',
          BindPort     => 443,
          Reuse        => 'yes',
          SuccessEvent => 'socket_birth',
          FailureEvent => '_stop',
        );
      },
      _stop => sub {
        delete $_[HEAP]->{listener};
      },
      socket_birth => sub {
        my ($socket) = $_[ARG0];
        POE::Session->create(
          inline_states => {
            _start       => sub {
              my ($heap, $kernel, $connected_socket, $address, $port) = @_[HEAP, KERNEL, ARG0, ARG1, ARG2];
              $heap->{socket_wheel} = POE::Wheel::ReadWrite->new(
                Handle     => $connected_socket,
                Driver     => POE::Driver::SysRW->new(),
                Filter     => POE::Filter::SSL->new(           ### HERE WE ARE!!!
                crt    => 'server.crt',
                key    => 'server.key',
                cactr  => 'ca.crt',
                cipher => 'AES256-SHA',
                cacrl  => 'ca.crl',
                debug  => 1,
                clientcert => 1
              ),
              InputEvent => 'socket_input',
              ErrorEvent => '_stop',
            );
            $heap->{sslfilter} = $heap->{socket_wheel}->get_input_filter();
          },
          socket_input => sub {
            my ($kernel, $heap, $buf) = @_[KERNEL, HEAP, ARG0];
            ### Uncomment the follwing lines if you want to use POE::Filter::HTTPD after the SSL handshake
            #if (ref($heap->{socket_wheel}->get_input_filter()) eq "POE::Filter::SSL") {
            #   if ($heap->{sslfilter}->handshakeDone(ignorebuf => 1)) {
            #      $heap->{socket_wheel}->set_input_filter(POE::Filter::Stackable->new(
            #         Filters => [
            #            $heap->{sslfilter},
            #            POE::Filter::HTTPD->new()
            #         ])
            #      );
            #   }
            #}
            # This following line is needed to do the SSL handshake!
            return $heap->{socket_wheel}->put()
              unless $heap->{sslfilter}->handshakeDone();
            my ($certid) = ($heap->{sslfilter}->clientCertIds());
            $certid = $certid ? $certid->[0]."<br>".$certid->[1]."<br>SERIAL=".ord($certid->[2]) : 'No client certificate';
            my $content = "HTTP/1.0 OK\r\nContent-type: text/html\r\n\r\n";
            if ($heap->{sslfilter}->clientCertValid()) {
              $content .= "Hello <font color=green>valid</font> client Certifcate:";
            } else {
              $content .= "None or <font color=red>invalid</font> client certificate:";
            }
            $content .= "<hr>".$certid."<hr>";
            $content .= "Your URL was: ".$buf->uri."<hr>" # This line will only appear if you uncomment the lines above!
              if (ref($buf) eq "HTTP::Request");
            $content .= localtime(time());
            $heap->{socket_wheel}->put($content);
            $kernel->delay(_stop => 1);
          },
          _stop => sub {
            delete $_[HEAP]->{socket_wheel};
          }
        },
        args => [$socket],
      );
    }
  }
);
$poe_kernel->run();

AUTHOR

Markus Mueller, <privi at cpan.org>

BUGS

Please report any bugs or feature requests to bug-poe-filter-sslsupport at rt.cpan.org, or through the web interface at http://rt.cpan.org/NoAuth/ReportBug.html?Queue=POE-Filter-SSL. I will be notified, and then you'll automatically be notified of progress on your bug as I make changes.

SUPPORT

You can find documentation for this module with the perldoc command.

perldoc POE::Filter::SSL

You can also look for information at:

Commercial support

Commercial support can be gained at <sslsupport at priv.de>

COPYRIGHT & LICENSE

Copyright 2010 Markus Mueller, all rights reserved.

This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.