NAME POE::Filter::SSL - The easiest and flexiblest way to SSL in POE! VERSION Version 0.15 DESCRIPTION This module allows to secure connections of POE::Wheel::ReadWrite with OpenSSL by a POE::Filter object, and behaves (beside of SSLifying) like POE::Filter::Stream. POE::Filter::SSL can be added, switched and removed during runtime, for example if you want to initiate SSL (e.g. STARTTLS) on an already established connection. You are able to combine POE::Filter::SSL with other filters, for example have an HTTPS server together with POE::Filter::HTTPD (see *ADVANCED EXAMPLE* later on this site). POE::Filter::SSL is based on Net::SSLeay, but got two XS functions which Net::SSLeay is missing. Features Full non-blocking processing No use of sockets at all Server and client mode Optional client certificate verification Allows to accept connections with invalid or missing client certificate and return custom error data CRL check of client certificates Retrieve client certificate details (subject name, issuer name, certificate serial) Upcoming Features Direct cipher encryption without SSL or TLS protocol, for example with static AES encryption SYNOPSIS By default POE::Filter::SSL acts as a SSL server. To use it in client mode you just have to set the *client* option of *new()*. TCP-Client #!perl use warnings; use strict; use POE qw(Component::Client::TCP Filter::SSL); POE::Component::Client::TCP->new( RemoteAddress => "", RemotePort => 443, Filter => [ "POE::Filter::SSL", client => 1 ], Connected => sub { $_[HEAP]{server}->put("HEAD /\r\n"); }, ServerInput => sub { my $input = $_[ARG0]; # The following line is needed to do the SSL handshake! return $_[HEAP]{server}->put() unless $input; print "from server: $input\n"; }, ); POE::Kernel->run(); exit; TCP-Server #!perl use warnings; use strict; use POE qw(Component::Server::TCP); POE::Component::Server::TCP->new( Port => 443, ClientFilter => [ "POE::Filter::SSL", crt => 'server.crt', key => 'server.key' ], ClientConnected => sub { print "got a connection from $_[HEAP]{remote_ip}\n"; $_[HEAP]{client}->put("Smile from the server!"); }, ClientInput => sub { my $client_input = $_[ARG0]; # The following line is needed to do the SSL handshake! return $_[HEAP]{client}->put() unless $client_input; $client_input =~ tr[a-zA-Z][n-za-mN-ZA-M]; $_[HEAP]{client}->put($client_input); }, ); POE::Kernel->run; exit; HTTPS-Server #!perl use warnings; use strict; use POE qw(Component::Server::TCP Filter::SSL Filter::HTTPD); use HTTP::Response; POE::Component::Server::TCP->new( Alias => "web_server", Port => 443, ClientFilter => [ 'POE::Filter::SSL', crt => 'server.crt', key => 'server.key' ], ClientInput => sub { my ($kernel, $heap, $request) = @_[KERNEL, HEAP, ARG0]; return unless (POE::Filter::SSL::doHandshake($heap->{client}, POE::Filter::HTTPD->new())); if ($request->isa("HTTP::Response")) { $heap->{client}->put($request); $kernel->yield("shutdown"); return; } my $request_fields = ''; $request->headers()->scan( sub { my ($header, $value) = @_; $request_fields .= "$header$value"; } ); my $response = HTTP::Response->new(200); $response->push_header('Content-type', 'text/html'); $response->content( "Your Request" . "Details about your request:" . "$request_fields
" . "" ); $heap->{client}->put($response); $kernel->yield("shutdown"); } ); $poe_kernel->run(); FUNCTIONS new(option, option, option...) Returns a new POE::Filter::SSL object. It accepts the following options: debug Get debug messages, currently mainly used by *clientCertNotOnCRL()*. client The filter has to behave as a SSL client, not as a SSL server. crt The certificate file (.crt) for the server. key The key file (.key) of the certificate for the server. clientcert The server requests the client for a client certificat during ssl handshake. WARNING: If the client provides an untrusted or no client certficate, the connection is not failing. You have to ask *clientCertValid()* if the certicate is valid! cacrt The ca certificate file (ca.crt), which is used to verificate the client certificates against the CA. cacrl Configures a CRL (ca.crl) against the client certificate is verified by *clientCertValid()*. cipher Specify which ciphers are allowed for the synchronous encrypted transfer of the data over the ssl connection. Example: cipher => 'AES256-SHA' blockbadclientcert Let OpenSSL deny the connection if there is no or an invalid client certificate. WARNING: If the client is listed in the CRL file, the connection will be established! You have to ask *clientCertValid()* if you have the *crl* option set on *new()*, otherwise to ask *clientCertNotOnCRL()* if the certificate is listed on your CRL file! handshakeDone(options) Returns *true* if the handshake is done and all data for hanshake has been written out. It accepts the following options: ignorebuf Returns *true* if OpenSSL has established the connection, regardless if all data has been written out. This is needed if you want to exchange the Filter of POE::Wheel::ReadWrite before the first data comes in. This option is currently only used by *doHandshake()* to be able to add new filters before first cleartext data to be processed gets in. clientCertNotOnCRL($file) Verifies if the serial of the client certificate is not contained in the CRL $file. No file caching is done, each call opens the file again. WARNING: If your CRL file is missing, can not be opened is empty or has no blocked certificate at all in it, then every call will get blocked! clientCertIds() Returns an array of every certificate found by OpenSSL. Each element is again a array. The first element is the value of *X509_get_subject_name*, second is the value of *X509_get_issuer_name* and third element is the serial of the certificate in binary form. You have to use *split()* and *ord()*, or the *hexdump()* function, to convert it to a readable form. Example: my ($certid) = ($heap->{sslfilter}->clientCertIds()); $certid = $certid ? $certid->[0]."
SERIAL=".$heap->{sslfilter}->hexdump($certid->[2]) : 'No client certificate'; clientCertValid() Returns *true* if there is a client certificate that is valid. It also tests against the CRL, if you have the *cacrl* option set on *new()*. doHandshake($readWrite, $filter, $filter, ...) Allows to add filters after the ssl handshake. It has to be called in the input handler, and needs the passing of the POE::Wheel::ReadWhile object. If it returns false, you have to return from the input handler. See the *HTTP-Server* example in *SYNOPSIS* or the *ADVANCED EXAMPLE* later on this site how use it. clientCertExists() Returns *true* if there is a client certificate, that might be untrusted. WARNING: If the client provides an untrusted client certficate a client certicate that is listed in CRL, this function returns *true*. You have to ask *clientCertValid()* if the certicate is valid! hexdump($string) Returns string data in hex format. Example: perl -e 'use POE::Filter::SSL; print POE::Filter::SSL->hexdump("test")."\n";' 74:65:73:74 Internal functions and POE::Filter handler VERIFY() X509_get_serialNumber() clone() doSSL() get() get_one() get_one_start() get_pending() writeToSSLBIO() writeToSSL() put() verify_serial_against_crl_file() ADVANCED EXAMPLE The following example implements a HTTPS server with client certificate verification, which shows details about the verified client certificate. It uses *doHandshake* to add Filter::HTTPD to process the cleartext data. #!perl use strict; use warnings; use Socket; use POE qw( Wheel::SocketFactory Wheel::ReadWrite Driver::SysRW Filter::SSL Filter::Stackable Filter::HTTPD ); POE::Session->create( inline_states => { _start => sub { my $heap = $_[HEAP]; $heap->{listener} = POE::Wheel::SocketFactory->new( BindAddress => '', BindPort => 443, Reuse => 'yes', SuccessEvent => 'socket_birth', FailureEvent => '_stop', ); }, _stop => sub { delete $_[HEAP]->{listener}; }, socket_birth => sub { my ($socket) = $_[ARG0]; POE::Session->create( inline_states => { _start => sub { my ($heap, $kernel, $connected_socket, $address, $port) = @_[HEAP, KERNEL, ARG0, ARG1, ARG2]; $heap->{socket_wheel} = POE::Wheel::ReadWrite->new( Handle => $connected_socket, Driver => POE::Driver::SysRW->new(), Filter => POE::Filter::SSL->new( ### HERE WE ARE!!! crt => 'server.crt', key => 'server.key', cactr => 'ca.crt', cipher => 'AES256-SHA', #cacrl => 'ca.crl', # Uncomment this, if you have a CRL file. debug => 1, clientcert => 1 ), InputEvent => 'socket_input', ErrorEvent => '_stop', ); $heap->{sslfilter} = $heap->{socket_wheel}->get_input_filter(); }, socket_input => sub { my ($kernel, $heap, $buf) = @_[KERNEL, HEAP, ARG0]; # The following line is needed to do the SSL handshake and add the Filter::HTTPD! return unless (POE::Filter::SSL::doHandshake($heap->{socket_wheel}, POE::Filter::HTTPD->new()); my ($certid) = ($heap->{sslfilter}->clientCertIds()); $certid = $certid ? $certid->[0]."
SERIAL=".$heap->{sslfilter}->hexdump($certid->[2]) : 'No client certificate'; my $content = ''; if ($heap->{sslfilter}->clientCertValid()) { $content .= "Hello valid client Certifcate:"; } else { $content .= "None or invalid client certificate:"; } $content .= "
"; $content .= "Your URL was: ".$buf->uri."
" if (ref($buf) eq "HTTP::Request"); $content .= localtime(time()); my $response = HTTP::Response->new(200); $response->push_header('Content-type', 'text/html'); $response->content($content); $heap->{socket_wheel}->put($response); $kernel->delay(_stop => 1); }, _stop => sub { delete $_[HEAP]->{socket_wheel}; } }, args => [$socket], ); } } ); $poe_kernel->run(); AUTHOR Markus Mueller, "" BUGS Please report any bugs or feature requests to "bug-poe-filter-ssl at", or through the web interface at . I will be notified, and then you'll automatically be notified of progress on your bug as I make changes. SUPPORT You can find documentation for this module with the perldoc command. perldoc POE::Filter::SSL You can also look for information at: * RT: CPAN's request tracker * AnnoCPAN: Annotated CPAN documentation * CPAN Ratings * Search CPAN Commercial support Commercial support can be gained at COPYRIGHT & LICENSE Copyright 2010 Markus Mueller, all rights reserved. This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.