NAME
POE::Filter::SSL - The easiest and flexiblest way to SSL in POE!
VERSION
Version 0.07
DESCRIPTION
This module allows to secure connections of POE::Wheel::ReadWrite with
OpenSSL by a POE::Filter object.
The SSL filter can be added and removed during runtime, for example if
you first do plain text and aftert this SSL (e.g. STARTTLS). You also
can combine POE::Filter::SSL with any other filter, e.g. realise a HTTPS
server together with POE::Filter::HTTPD (see *ADVANCED EXAMPLE* later on
this site).
POE::Filter::SSL is mainly based on Net::SSLeay, but got implemented
some missing calls Net::SSLeay missing. It got an own BIO
implementation, which replaces the socket interface of OpenSSL.
Features
Full non-blocking processing
No use of sockets at all
Server and client mode
Optional client certificate verification
Allows to accept connections with invalid or missing client
certificate and return custom error data
CRL check of client certificates
Retrieve client certificate details (subject name, issuer name,
certificate serial)
Upcoming Features
Direct cipher encryption without SSL or TLS protocol, for example
with static AES encryption
SYNOPSIS
Server and client mainly differs in the *client* option of new().
Client
#!perl
use warnings;
use strict;
use POE qw(Component::Client::TCP Filter::SSL);
POE::Component::Client::TCP->new(
RemoteAddress => "yahoo.com",
RemotePort => 443,
Filter => [
"POE::Filter::SSL", ## HERE WE ARE!
client => 1 ],
Connected => sub {
$_[HEAP]{server}->put("HEAD /\r\n");
},
ServerInput => sub {
my $input = $_[ARG0];
# The following line is needed to do the SSL handshake!
return $_[HEAP]{server}->put() unless $input;
print "from server: $input\n";
},
);
POE::Kernel->run();
exit;
Server
#!perl
use warnings;
use strict;
use POE qw(Component::Server::TCP);
POE::Component::Server::TCP->new(
Port => 443,
ClientFilter => [
"POE::Filter::SSL", ## HERE WE ARE!
crt => 'server.crt',
key => 'server.key' ],
ClientConnected => sub {
print "got a connection from $_[HEAP]{remote_ip}\n";
$_[HEAP]{client}->put("Smile from the server!");
},
ClientInput => sub {
my $client_input = $_[ARG0];
# The following line is needed to do the SSL handshake!
return $_[HEAP]{client}->put() unless $client_input;
$client_input =~ tr[a-zA-Z][n-za-mN-ZA-M];
$_[HEAP]{client}->put($client_input);
},
);
POE::Kernel->run;
exit;
FUNCTIONS
new(options)
Returns a new POE::Filter::SSL object. It accepts the following
options:
debug
Get debug messages, currently mainly used by clientCertNotOnCRL().
client
The filter has to behave as a SSL client, not as a SSL server.
crt
The certificate file (.crt) for the server.
key
The key file (.key) of the certificate for the server.
clientcert
The server requests the client for a client certificat during ssl
handshake.
WARNING: If the client provides an untrusted or no client
certficate, the connection is not failing! You have to ask
clientCertValid() if the certicate is valid!
cacrt
The ca certificate file (ca.crt), which is used to verificated the
client certificates against a CA.
cacrl
Configures a CRL against the client certificate is proofed by
clientCertValid().
cipher
Specify which ciphers are allowed for the asynchronous encrypted
transfer of the data over the ssl connection. For example:
cipher => 'AES256-SHA'
handshakeDone(options)
Returns true if the handshake is done and all data for hanshake has
been written out. It accepts the following options:
ignorebuf
Returns true if OpenSSL has established the connection, regardless
if all data has been written out. Needed if you want to exchange
the Filter of POE::Wheel::ReadWrite before the first data comes
in.
clientCertNotOnCRL($file)
Verifies if the serial of the client certificate is not contained in
the CRL $file. No file caching is done, each call opens the file
again.
clientCertIds()
Returns an array of every certificate found by OpenSSL. Each element
is again a array: First element is the value of
X509_get_subject_name, second is the value of X509_get_issuer_name
and third element is the serial of the certificate in binary form.
You have to use split and use "ord" to convert it to a readable
form. Example:
my ($certid) = ($heap->{sslfilter}->clientCertIds());
$certid = $certid ? $certid->[0]."
".$certid->[1]."
SERIAL=".hexdump($certid->[2]) : 'No client certificate';
clientCertValid()
Returns true if there is a client certificate that is valid. It also
tests against the crl, if you have set the *cacrl* option on new().
clientCertExists()
Returns true if there is a client certificate, that maybe is
untrusted.
WARNING: If the client provides an untrusted client certficate or
which is listed in CRL, this function maybe return true! You have to
ask clientCertValid() if the certicate is valid!
hexdump($string)
Returns string data in hex format.
For example:
perl -e 'use POE::Filter::SSL; print POE::Filter::SSL::hexdump("test")."\n";'
74:65:73:74
Internal functions and POE::Filter handler
BIO_get_handler()
BIO_read()
BIO_write()
VERIFY()
X509_get_serialNumber()
clone()
doSSL()
get()
get_one()
get_one_start()
get_pending()
hello()
put()
verify_serial_against_crl_file()
ADVANCED EXAMPLE
The following example implements a HTTPS server with client certificate
validation, which shows many details about the verified client
certificate. If you uncomment the POE::Filter::HTTPD block, it also
shows the URI property of the parsed HTTP::Response object from
POE::Filter::HTTPD.
#!perl
use strict;
use warnings;
use Socket;
use POE qw(
Wheel::SocketFactory
Wheel::ReadWrite
Driver::SysRW
Filter::SSL
Filter::Stackable
Filter::HTTPD
);
POE::Session->create(
inline_states => {
_start => sub {
my $heap = $_[HEAP];
$heap->{listener} = POE::Wheel::SocketFactory->new(
BindAddress => '0.0.0.0',
BindPort => 443,
Reuse => 'yes',
SuccessEvent => 'socket_birth',
FailureEvent => '_stop',
);
},
_stop => sub {
delete $_[HEAP]->{listener};
},
socket_birth => sub {
my ($socket) = $_[ARG0];
POE::Session->create(
inline_states => {
_start => sub {
my ($heap, $kernel, $connected_socket, $address, $port) = @_[HEAP, KERNEL, ARG0, ARG1, ARG2];
$heap->{socket_wheel} = POE::Wheel::ReadWrite->new(
Handle => $connected_socket,
Driver => POE::Driver::SysRW->new(),
Filter => POE::Filter::SSL->new( ### HERE WE ARE!!!
crt => 'server.crt',
key => 'server.key',
cactr => 'ca.crt',
cipher => 'AES256-SHA',
cacrl => 'ca.crl',
debug => 1,
clientcert => 1
),
InputEvent => 'socket_input',
ErrorEvent => '_stop',
);
$heap->{sslfilter} = $heap->{socket_wheel}->get_input_filter();
},
socket_input => sub {
my ($kernel, $heap, $buf) = @_[KERNEL, HEAP, ARG0];
### Uncomment the follwing lines if you want to use POE::Filter::HTTPD after the SSL handshake
#if (ref($heap->{socket_wheel}->get_input_filter()) eq "POE::Filter::SSL") {
# if ($heap->{sslfilter}->handshakeDone(ignorebuf => 1)) {
# $heap->{socket_wheel}->set_input_filter(POE::Filter::Stackable->new(
# Filters => [
# $heap->{sslfilter},
# POE::Filter::HTTPD->new()
# ])
# );
# }
#}
# This following line is needed to do the SSL handshake!
return $heap->{socket_wheel}->put()
unless $heap->{sslfilter}->handshakeDone();
my ($certid) = ($heap->{sslfilter}->clientCertIds());
$certid = $certid ? $certid->[0]."
".$certid->[1]."
SERIAL=".ord($certid->[2]) : 'No client certificate';
my $content = "HTTP/1.0 OK\r\nContent-type: text/html\r\n\r\n";
if ($heap->{sslfilter}->clientCertValid()) {
$content .= "Hello valid client Certifcate:";
} else {
$content .= "None or invalid client certificate:";
}
$content .= "