NAME

POE::Filter::SSL - The easiest and flexiblest way to SSL in POE!

VERSION

Version 0.19

DESCRIPTION

This module allows to secure connections of POE::Wheel::ReadWrite with OpenSSL by a POE::Filter object, and behaves (beside of the SSL stuff) as POE::Filter::Stream.

POE::Filter::SSL can be added and removed during runtime, for example if you want to initiate SSL via STARTTLS on an already established tcp connection. You can combine POE::Filter::SSL with other filters, for example have a HTTPS server together with POE::Filter::HTTPD.

POE::Filter::SSL is based on Net::SSLeay.

Features

Full non-blocking processing

No use of sockets at all

Server and client mode

Optional client certificate verification

Allows to accept connections with invalid or missing client certificate and return custom error data

CRL check of client certificates

Retrieve client certificate details (subject name, issuer name, certificate serial)

Upcoming Features

Direct cipher encryption without SSL or TLS protocol, for example with static AES encryption

SYNOPSIS

By default POE::Filter::SSL acts as a SSL server. To use it in client mode you just have to set the client option of new().

TCP-Client

#!perl

use warnings;
use strict;

use POE qw(Component::Client::TCP Filter::SSL);

POE::Component::Client::TCP->new(
  RemoteAddress => "yahoo.com",
  RemotePort    => 443,
  Filter        => [ "POE::Filter::SSL", client => 1 ],
  Connected     => sub {
    $_[HEAP]{server}->put("GET / HTTP/1.0\r\nHost: yahoo.com\r\n\r\n");
  },
  ServerInput   => sub {
    my $input = $_[ARG0];
    # The following line is needed to do the SSL handshake!
    return $_[HEAP]{server}->put() unless $input;
    print "from server: $input\n";
  },
);

POE::Kernel->run();
exit;

TCP-Server

#!perl

use warnings;
use strict;

use POE qw(Component::Server::TCP);

POE::Component::Server::TCP->new(
  Port => 443,
  ClientFilter => [ "POE::Filter::SSL", crt => 'server.crt', key => 'server.key' ],
  ClientConnected => sub {
    print "got a connection from $_[HEAP]{remote_ip}\n";
    $_[HEAP]{client}->put("Smile from the server!");
  },
  ClientInput => sub {
    my $client_input = $_[ARG0];
    # The following line is needed to do the SSL handshake!
    return $_[HEAP]{client}->put() unless $client_input;
    $client_input =~ tr[a-zA-Z][n-za-mN-ZA-M];
    $_[HEAP]{client}->put($client_input);
  },
);

POE::Kernel->run;
exit;

HTTPS-Server

#!perl
use warnings;
use strict;
use POE qw(Component::Server::TCP Filter::SSL Filter::HTTPD);
use HTTP::Response;
POE::Component::Server::TCP->new(
  Alias        => "web_server",
  Port         => 443,
  ClientFilter => [ 'POE::Filter::SSL', crt => 'server.crt', key => 'server.key' ],
  ClientInput => sub {
    my ($kernel, $heap, $request) = @_[KERNEL, HEAP, ARG0];
    return unless (POE::Filter::SSL::doHandshake($heap->{client}, POE::Filter::HTTPD->new()));
    if ($request->isa("HTTP::Response")) {
      $heap->{client}->put($request);
      $kernel->yield("shutdown");
      return;
    }
    my $request_fields = '';
    $request->headers()->scan(
      sub {
        my ($header, $value) = @_;
        $request_fields .= "<tr><td>$header</td><td>$value</td></tr>";
      }
    );
    my $response = HTTP::Response->new(200);
    $response->push_header('Content-type', 'text/html');
    $response->content(
      "<html><head><title>Your Request</title></head>"
        . "<body>Details about your request:"
        . "<table border='1'>$request_fields</table>"
        . "</body></html>"
    );
    $heap->{client}->put($response);
    $kernel->yield("shutdown");
  }
);
$poe_kernel->run();

SSL on an established connection

Advanced Example

This example is a IMAP-Relay which forwards the connections to a IMAP server by username. It allows the uncrypted transfer on port 143, with the option of SSL on the established connection (STARTTLS). On port 993 it allows to do direct SSL.

Tested with Thunderbird version 3.0.5.

#!perl

use warnings;
use strict;

use POE qw(Component::Server::TCP Component::Client::TCP Filter::SSL Filter::Stream);

my $defaultImapServer = "not.existing.de";
my $usernameToImapServer = {
   user1 => 'mailserver1.domain.de',
   user2 => 'mailserver2.domain.de',
   # ...
};

POE::Component::Server::TCP->new(
   Port => 143,
   ClientFilter => "POE::Filter::Stream",
   ClientDisconnected => \&disconnect,
   ClientConnected => \&connected,
   ClientInput => \&handleInput,
   InlineStates => {
      send_stuff => \&send_stuff,
      _child => \&child
   }
);

POE::Component::Server::TCP->new(
   Port => 993,
   ClientFilter => [ "POE::Filter::SSL", crt => 'server.crt', key => 'server.key' ],
   ClientConnected => \&connected,
   ClientDisconnected => \&disconnect,
   ClientInput => \&handleInput,
   InlineStates => {
      send_stuff => \&send_stuff,
      _child => \&child
   }
);

sub disconnect {
   my ($kernel, $session, $heap) = @_[KERNEL, SESSION, HEAP];
   logevent('server got disconnect', $session);
   $kernel->post($heap->{client_id} => "shutdown");
}

sub connected {
   my ($kernel, $session, $heap) = @_[KERNEL, SESSION, HEAP];
   logevent("got a connection from ".$heap->{remote_ip}, $session);
   $heap->{client}->put("* OK [CAPABILITY IMAP4rev1 UIDPLUS CHILDREN NAMESPACE THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT QUOTA IDLE ACL ACL2=UNION STARTTLS] IMAP Relay v0.1 ready.\r\n");
}

sub send_stuff {
   my ($heap, $stuff, $session) = @_[HEAP, ARG0, SESSION];
   logevent("-> ".length($stuff)." Bytes", $session);
   (defined($heap->{client})) && (ref($heap->{client}) eq "POE::Wheel::ReadWrite") &&
   $heap->{client}->put($stuff);
}

sub child {
   my ($heap, $child_op, $child) = @_[HEAP, ARG0, ARG1];
   if ($child_op eq "create") {
      $heap->{client_id} = $child->ID;
   }
}

sub handleInput {
   my ($kernel, $session, $heap, $input) = @_[KERNEL, SESSION, HEAP, ARG0];
   return if ((ref($heap->{client}->get_output_filter()) eq "POE::Filter::SSL") && (!POE::Filter::SSL::doHandshake($heap->{client})));
   if($heap->{forwarding}) {
      return $kernel->yield("shutdown") unless (defined($heap->{client_id}));
      $kernel->post($heap->{client_id} => send_stuff => $input);
   } elsif ($input =~ /^(\d+)\s+STARTTLS[\r\n]+/i) {
      $_[HEAP]{client}->put($1." OK Begin SSL/TLS negotiation now.\r\n");
      logevent("SSLing now...", $session);
      $_[HEAP]{client}->set_filter(POE::Filter::SSL->new(crt => 'server.crt', key => 'server.key'));
   } elsif ($input =~ /^(\d+)\s+CAPABILITY[\r\n]+/i) {
      $_[HEAP]{client}->put("* CAPABILITY IMAP4rev1 UIDPLUS CHILDREN NAMESPACE THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT QUOTA IDLE ACL ACL2=UNION STARTTLS\r\n");
      $_[HEAP]{client}->put($1." OK CAPABILITY completed\r\n");
   } elsif ($input =~ /^(\d+)\s+login\s+\"(\S+)\"\s+\"(\S+)\"[\r\n]+/i) {
      my $username = $2;
      my $pass = $3;
      logevent("login of user ".$username, $session);
      spawn_client_side($username, $input);
      $heap->{forwarding}++;
   } else {
      logevent("unknown command before login, disconnecting.", $session);
      return $kernel->yield("shutdown");
   }
}

sub spawn_client_side {
  my $username = shift;
  POE::Component::Client::TCP->new(
    RemoteAddress => $usernameToImapServer->{$username} || $defaultImapServer,
    RemotePort    => 143,
    Filter => "POE::Filter::Stream",
    Started       => sub {
      $_[HEAP]->{server_id} = $_[SENDER]->ID;
      $_[HEAP]->{buf} = $_[ARG0];
      $_[HEAP]->{skip} = 0;
    },
    Connected => sub {
      my ($heap, $session) = @_[HEAP, SESSION];
      logevent('client connected', $session);
      $heap->{server}->put($heap->{buf});
      delete $heap->{buf};
    },
    ServerInput => sub {
      my ($kernel, $heap, $session, $input) = @_[KERNEL, HEAP, SESSION, ARG0];
      #logevent('client got input', $session, $input);
      $kernel->post($heap->{server_id} => send_stuff => $input) if ($heap->{skip}++);
    },
    Disconnected => sub {
      my ($kernel, $heap, $session) = @_[KERNEL, HEAP, SESSION];
      logevent('client disconnected', $session);
      $kernel->post($heap->{server_id} => 'shutdown');
    },
    InlineStates => {
      send_stuff => sub {
        my ($heap, $stuff, $session) = @_[HEAP, ARG0, SESSION];
        logevent("<- ".length($stuff)." Bytes", $session);
        (defined($heap->{server})) && (ref($heap->{server}) eq "POE::Wheel::ReadWrite") && 
        $heap->{server}->put($stuff);
      },
    },
    Args => [ shift ]
  );
}

sub logevent {
  my ($state, $session, $arg) = @_;
  my $id = $session->ID();
  print "session $id $state ";
  print ": $arg" if (defined $arg);
  print "\n";
}

POE::Kernel->run;

Client certificate verification

Advanced Example

The following example implements a HTTPS server with client certificate verification, which shows details about the verified client certificate. It uses doHandshake() to add POE::Filter::HTTPD to process the cleartext data.

#!perl

use strict;
use warnings;
use Socket;
use POE qw(
  Wheel::SocketFactory
  Wheel::ReadWrite
  Driver::SysRW
  Filter::SSL
  Filter::Stackable
  Filter::HTTPD
);

POE::Session->create(
  inline_states => {
    _start       => sub {
      my $heap = $_[HEAP];
      $heap->{listener} = POE::Wheel::SocketFactory->new(
        BindAddress  => '0.0.0.0',
        BindPort     => 443,
        Reuse        => 'yes',
        SuccessEvent => 'socket_birth',
        FailureEvent => '_stop',
      );
    },
    _stop => sub {
      delete $_[HEAP]->{listener};
    },
    socket_birth => sub {
      my ($socket) = $_[ARG0];
      POE::Session->create(
        inline_states => {
          _start       => sub {
            my ($heap, $kernel, $connected_socket, $address, $port) = @_[HEAP, KERNEL, ARG0, ARG1, ARG2];
            $heap->{socket_wheel} = POE::Wheel::ReadWrite->new(
              Handle     => $connected_socket,
              Driver     => POE::Driver::SysRW->new(),
              Filter     => POE::Filter::SSL->new(           ### HERE WE ARE!!!
                crt    => 'server.crt',
                key    => 'server.key',
                cacrt  => 'ca.crt',
                cipher => 'AES256-SHA',
                #cacrl  => 'ca.crl', # Uncomment this, if you have a CRL file.
                debug  => 1,
                clientcert => 1
              ),
              InputEvent => 'socket_input',
              ErrorEvent => '_stop',
            );
            $heap->{sslfilter} = $heap->{socket_wheel}->get_input_filter();
          },
          socket_input => sub {
            my ($kernel, $heap, $buf) = @_[KERNEL, HEAP, ARG0];
            # The following line is needed to do the SSL handshake and add the Filter::HTTPD!
            return unless POE::Filter::SSL::doHandshake($heap->{socket_wheel}, POE::Filter::HTTPD->new());
            my ($certid) = ($heap->{sslfilter}->clientCertIds());
            $certid = $certid ? $certid->[0]."<br>".$certid->[1]."<br>SERIAL=".$heap->{sslfilter}->hexdump($certid->[2]) : 'No client certificate';
            my $content = '';
            if ($heap->{sslfilter}->clientCertValid()) {
              $content .= "Hello <font color=green>valid</font> client Certifcate:";
            } else {
              $content .= "None or <font color=red>invalid</font> client certificate:";
            }
            $content .= "<hr>".$certid."<hr>";
            $content .= "Your URL was: ".$buf->uri."<hr>"
              if (ref($buf) eq "HTTP::Request");
            $content .= localtime(time());
            my $response = HTTP::Response->new(200);
            $response->push_header('Content-type', 'text/html');
            $response->content($content);
            $heap->{socket_wheel}->put($response);
            $kernel->delay(_stop => 1);
          },
          _stop => sub {
            delete $_[HEAP]->{socket_wheel};
          }
        },
        args => [$socket],
      );
    }
  }
);

$poe_kernel->run();

FUNCTIONS

new(option, option, option...)

Returns a new POE::Filter::SSL object. It accepts the following options:

debug

Shows debug messages of clientCertNotOnCRL().

client

By default POE::Filter::SSL acts as a SSL server. To use it in client mode, you have to set this option.

crt

The certificate file (.crt) for the server, only needed in server mode.

key

The key file (.key) of the certificate for the server, only needed in server mode.

clientcert

The server requests the client for a client certificat during ssl handshake, only useful in server mode.

WARNING: If the client provides an untrusted or no client certficate, the connection is not failing. You have to ask clientCertValid() if the certicate is valid!

cacrt

The ca certificate file (ca.crt), which is used to verificate the client certificates against a CA.

cacrl

Configures a CRL (ca.crl) against the client certificate is verified by clientCertValid().

cipher

Specify which ciphers are allowed for the synchronous encrypted transfer of the data over the ssl connection.

Example:

cipher => 'AES256-SHA'

blockbadclientcert

Let OpenSSL deny the connection if there is no or an invalid client certificate.

WARNING: If the client is listed in the CRL file, the connection will be established! You have to ask clientCertValid() if you have the crl option set on new(), otherwise to ask clientCertNotOnCRL() if the certificate is listed on your CRL file!

handshakeDone(option)

Returns true if the handshake is done and all data for hanshake has been written out. It accepts the following option:

ignorebuf: Returns true if OpenSSL has established the connection, regardless if all data has been written out. This is needed if you want to exchange the Filter of POE::Wheel::ReadWrite before the first data comes in. This option is currently only used by doHandshake() to be able to add new filters before first cleartext data to be processed gets in.

clientCertNotOnCRL($file)

Verifies if the serial of the client certificate is not contained in the CRL $file. No file caching is done, each call opens the file again.

WARNING: If your CRL file is missing, can not be opened is empty or has no blocked certificate at all in it, then every call will get blocked!

clientCertIds()

Returns an array of every certificate found by OpenSSL. Each element is again a array. The first element is the value of X509_get_subject_name, second is the value of X509_get_issuer_name and third element is the serial of the certificate in binary form. You have to use split() and ord(), or the hexdump() function, to convert it to a readable form.

Example:

my ($certid) = ($heap->{sslfilter}->clientCertIds());
$certid = $certid ? $certid->[0]."<br>".$certid->[1]."<br>SERIAL=".$heap->{sslfilter}->hexdump($certid->[2]) : 'No client certificate';

clientCertValid()

Returns true if there is a client certificate that is valid. It also tests against the CRL, if you have the cacrl option set on new().

doHandshake($readWrite, $filter, $filter, ...)

Allows to add filters after the ssl handshake. It has to be called in the input handler, and needs the passing of the POE::Wheel::ReadWhile object. If it returns false, you have to return from the input handler.

See the HTTPS-Server, SSL on an established connection and Client certificate verification examples in SYNOPSIS

clientCertExists()

Returns true if there is a client certificate, that might be untrusted.

WARNING: If the client provides an untrusted client certficate a client certicate that is listed in CRL, this function returns true. You have to ask clientCertValid() if the certicate is valid!

hexdump($string)

Returns string data in hex format.

Example:

perl -e 'use POE::Filter::SSL; print POE::Filter::SSL->hexdump("test")."\n";'
74:65:73:74

Internal functions and POE::Filter handler

VERIFY()
X509_get_serialNumber()
clone()
doSSL()
get()
get_one()
get_one_start()
get_pending()
writeToSSLBIO()
writeToSSL()
put()
verify_serial_against_crl_file()

AUTHOR

Markus Mueller, <privi at cpan.org>

BUGS

Please report any bugs or feature requests to bug-poe-filter-ssl at rt.cpan.org, or through the web interface at http://rt.cpan.org/NoAuth/ReportBug.html?Queue=POE-Filter-SSL. I will be notified, and then you'll automatically be notified of progress on your bug as I make changes.

SUPPORT

You can find documentation for this module with the perldoc command.

perldoc POE::Filter::SSL

You can also look for information at:

RT: CPAN's request tracker

http://rt.cpan.org/NoAuth/Bugs.html?Dist=POE-Filter-SSL
AnnoCPAN: Annotated CPAN documentation

http://annocpan.org/dist/POE-Filter-SSL
CPAN Ratings

http://cpanratings.perl.org/d/POE-Filter-SSL
Search CPAN

http://search.cpan.org/dist/POE-Filter-SSL

Commercial support

Commercial support can be gained at <sslsupport at priv.de>

COPYRIGHT & LICENSE

This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

1 POD Error

The following errors were encountered while parsing the POD:

Around line 477:: Expected text after =item, not a bullet

To install POE::Filter::SSL, copy and paste the appropriate command in to your terminal.

cpanm

cpanm POE::Filter::SSL

CPAN shell

perl -MCPAN -e shell
install POE::Filter::SSL

For more information on module installation, please visit the detailed CPAN module installation guide.

	Global
`s`	Focus search bar
`?`	Bring up this help dialog

	GitHub
`g` `p`	Go to pull requests
`g` `i`	go to github issues (only if github is preferred repository)

	POD
`g` `a`	Go to author
`g` `c`	Go to changes
`g` `i`	Go to issues
`g` `d`	Go to dist
`g` `r`	Go to repository/SCM
`g` `s`	Go to source
`g` `b`	Go to file browse

	Search terms
module: (e.g. module:Plugin)
distribution: (e.g. distribution:Dancer auth)
author: (e.g. author:SONGMU Redis)
version: (e.g. version:1.00)

NAME

VERSION

DESCRIPTION

SYNOPSIS

SSL on an established connection

Client certificate verification

FUNCTIONS

Internal functions and POE::Filter handler

AUTHOR

BUGS

SUPPORT

Commercial support

COPYRIGHT & LICENSE

Module Install Instructions