| POE::Filter::SSL(3pm) | User Contributed Perl Documentation | POE::Filter::SSL(3pm) |
POE::Filter::SSL - The easiest and flexiblest way to SSL in POE!
Version 0.41
This module allows one to secure connections of POE::Wheel::ReadWrite with OpenSSL by a POE::Filter object, and behaves (beside of SSLing) as POE::Filter::Stream.
POE::Filter::SSL can be added, switched and removed during runtime, for example if you want to initiate SSL (see the SSL on an established connection example in SYNOPSIS) on an already established connection. You are able to combine POE::Filter::SSL with other filters, for example have a HTTPS server together with POE::Filter::HTTPD (see the HTTPS-Server example in SYNOPSIS).
POE::Filter::SSL is based on Net::SSLeay, but got two XS functions which Net::SSLeay is missing.
No use of sockets at all
Server and client mode
Optional client certificate verification
Allows one to accept connections with invalid or missing client certificate and return custom error data
CRL check of client certificates
Retrieve client certificate details (subject name, issuer name, certificate serial)
By default POE::Filter::SSL acts as a SSL server. To use it in client mode you just have to set the client option of new().
#!perl
use warnings;
use strict;
use POE qw(Component::Client::TCP Filter::SSL);
POE::Component::Client::TCP->new(
RemoteAddress => "yahoo.com",
RemotePort => 443,
Filter => [ "POE::Filter::SSL", client => 1 ],
Connected => sub {
$_[HEAP]{server}->put("HEAD /\r\n\r\n");
},
ServerInput => sub {
print "from server: ".$_[ARG0]."\n";
},
);
POE::Kernel->run();
exit;
#!perl
use warnings;
use strict;
use POE qw(Component::Server::TCP);
POE::Component::Server::TCP->new(
Port => 443,
ClientFilter => [ "POE::Filter::SSL", crt => 'server.crt', key => 'server.key' ],
ClientConnected => sub {
print "got a connection from $_[HEAP]{remote_ip}\n";
$_[HEAP]{client}->put("Smile from the server!\r\n");
},
Alias => "tcp",
ClientInput => sub {
my ($kernel, $session, $heap) = @_[KERNEL, SESSION, HEAP];
$_[HEAP]{client}->put("You sent:\r\n".$_[ARG0]);
$_[KERNEL]->yield("shutdown");
},
);
POE::Kernel->run;
exit;
use POE::Filter::SSL::PreFilter
use POE::Filter::SSL;
use POE::Component::Server::HTTP;
use HTTP::Status;
my $aliases = POE::Component::Server::HTTP->new(
Port => 443,
ContentHandler => {
'/' => \&handler,
'/dir/' => sub { return; },
'/file' => sub { return; }
},
Headers => { Server => 'My Server' },
PreFilter => POE::Filter::SSL->new(
crt => 'server.crt',
key => 'server.key',
cacrt => 'ca.crt'
)
);
sub handler {
my ($request, $response) = @_;
$response->code(RC_OK);
$response->content("Hi, you fetched ". $request->uri);
return RC_OK;
}
POE::Kernel->run();
POE::Kernel->call($aliases->{httpd}, "shutdown");
# next line isn't really needed
POE::Kernel->call($aliases->{tcp}, "shutdown");
Tested with Thunderbird version 3.0.5.
#!perl
use warnings;
use strict;
use POE qw(Component::Server::TCP Component::Client::TCP Filter::SSL Filter::Stream);
my $defaultImapServer = "not.existing.de";
my $usernameToImapServer = {
user1 => 'mailserver1.domain.de',
user2 => 'mailserver2.domain.de',
# ...
};
POE::Component::Server::TCP->new(
Port => 143,
ClientFilter => "POE::Filter::Stream",
ClientDisconnected => \&disconnect,
ClientConnected => \&connected,
ClientInput => \&handleInput,
InlineStates => {
send_stuff => \&send_stuff,
_child => \&child
}
);
POE::Component::Server::TCP->new(
Port => 993,
ClientFilter => [ "POE::Filter::SSL", crt => 'server.crt', key => 'server.key' ],
ClientConnected => \&connected,
ClientDisconnected => \&disconnect,
ClientInput => \&handleInput,
InlineStates => {
send_stuff => \&send_stuff,
_child => \&child
}
);
sub disconnect {
my ($kernel, $session, $heap) = @_[KERNEL, SESSION, HEAP];
logevent('server got disconnect', $session);
$kernel->post($heap->{client_id} => "shutdown");
}
sub connected {
my ($kernel, $session, $heap) = @_[KERNEL, SESSION, HEAP];
logevent("got a connection from ".$heap->{remote_ip}, $session);
$heap->{client}->put("* OK [CAPABILITY IMAP4rev1 UIDPLUS CHILDREN NAMESPACE THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT QUOTA IDLE ACL ACL2=UNION STARTTLS] IMAP Relay v0.1 ready.\r\n");
}
sub send_stuff {
my ($heap, $stuff, $session) = @_[HEAP, ARG0, SESSION];
logevent("-> ".length($stuff)." Bytes", $session);
(defined($heap->{client})) && (ref($heap->{client}) eq "POE::Wheel::ReadWrite") &&
$heap->{client}->put($stuff);
}
sub child {
my ($heap, $child_op, $child) = @_[HEAP, ARG0, ARG1];
if ($child_op eq "create") {
$heap->{client_id} = $child->ID;
}
}
sub handleInput {
my ($kernel, $session, $heap, $input) = @_[KERNEL, SESSION, HEAP, ARG0];
if($heap->{forwarding}) {
return $kernel->yield("shutdown") unless (defined($heap->{client_id}));
$kernel->post($heap->{client_id} => send_stuff => $input);
} elsif ($input =~ /^(\d+)\s+STARTTLS[\r\n]+/i) {
$_[HEAP]{client}->put($1." OK Begin SSL/TLS negotiation now.\r\n");
logevent("SSLing now...", $session);
$_[HEAP]{client}->set_filter(POE::Filter::SSL->new(crt => 'server.crt', key => 'server.key'));
} elsif ($input =~ /^(\d+)\s+CAPABILITY[\r\n]+/i) {
$_[HEAP]{client}->put("* CAPABILITY IMAP4rev1 UIDPLUS CHILDREN NAMESPACE THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT QUOTA IDLE ACL ACL2=UNION STARTTLS\r\n");
$_[HEAP]{client}->put($1." OK CAPABILITY completed\r\n");
} elsif ($input =~ /^(\d+)\s+login\s+\"(\S+)\"\s+\"(\S+)\"[\r\n]+/i) {
my $username = $2;
my $pass = $3;
logevent("login of user ".$username, $session);
spawn_client_side($username, $input);
$heap->{forwarding}++;
} else {
logevent("unknown command before login, disconnecting.", $session);
return $kernel->yield("shutdown");
}
}
sub spawn_client_side {
my $username = shift;
POE::Component::Client::TCP->new(
RemoteAddress => $usernameToImapServer->{$username} || $defaultImapServer,
RemotePort => 143,
Filter => "POE::Filter::Stream",
Started => sub {
$_[HEAP]->{server_id} = $_[SENDER]->ID;
$_[HEAP]->{buf} = $_[ARG0];
$_[HEAP]->{skip} = 0;
},
Connected => sub {
my ($heap, $session) = @_[HEAP, SESSION];
logevent('client connected', $session);
$heap->{server}->put($heap->{buf});
delete $heap->{buf};
},
ServerInput => sub {
my ($kernel, $heap, $session, $input) = @_[KERNEL, HEAP, SESSION, ARG0];
#logevent('client got input', $session, $input);
$kernel->post($heap->{server_id} => send_stuff => $input) if ($heap->{skip}++);
},
Disconnected => sub {
my ($kernel, $heap, $session) = @_[KERNEL, HEAP, SESSION];
logevent('client disconnected', $session);
$kernel->post($heap->{server_id} => 'shutdown');
},
InlineStates => {
send_stuff => sub {
my ($heap, $stuff, $session) = @_[HEAP, ARG0, SESSION];
logevent("<- ".length($stuff)." Bytes", $session);
(defined($heap->{server})) && (ref($heap->{server}) eq "POE::Wheel::ReadWrite") &&
$heap->{server}->put($stuff);
},
},
Args => [ shift ]
);
}
sub logevent {
my ($state, $session, $arg) = @_;
my $id = $session->ID();
print "session $id $state ";
print ": $arg" if (defined $arg);
print "\n";
}
POE::Kernel->run;
#!perl
use strict;
use warnings;
use Socket;
use POE qw(
Wheel::SocketFactory
Wheel::ReadWrite
Driver::SysRW
Filter::SSL
Filter::Stackable
Filter::HTTPD
);
POE::Session->create(
inline_states => {
_start => sub {
my $heap = $_[HEAP];
$heap->{listener} = POE::Wheel::SocketFactory->new(
BindAddress => '0.0.0.0',
BindPort => 443,
Reuse => 'yes',
SuccessEvent => 'socket_birth',
FailureEvent => '_stop',
);
},
_stop => sub {
delete $_[HEAP]->{listener};
},
socket_birth => sub {
my ($socket) = $_[ARG0];
POE::Session->create(
inline_states => {
_start => sub {
my ($heap, $kernel, $connected_socket, $address, $port) = @_[HEAP, KERNEL, ARG0, ARG1, ARG2];
$heap->{sslfilter} = POE::Filter::SSL->new(
crt => 'server.crt',
key => 'server.key',
cacrt => 'ca.crt',
cipher => 'DHE-RSA-AES256-GCM-SHA384:AES256-SHA',
#cacrl => 'ca.crl', # Uncomment this, if you have a CRL file.
debug => 1,
clientcert => 1
);
$heap->{socket_wheel} = POE::Wheel::ReadWrite->new(
Handle => $connected_socket,
Driver => POE::Driver::SysRW->new(),
Filter => POE::Filter::Stackable->new(Filters => [
$heap->{sslfilter},
POE::Filter::HTTPD->new()
]),
InputEvent => 'socket_input',
ErrorEvent => '_stop',
);
},
socket_input => sub {
my ($kernel, $heap, $buf) = @_[KERNEL, HEAP, ARG0];
my (@certid) = ($heap->{sslfilter}->clientCertIds());
my $content = '';
if ($heap->{sslfilter}->clientCertValid()) {
$content .= "Hello <font color=green>valid</font> client Certifcate:";
} else {
$content .= "None or <font color=red>invalid</font> client certificate:";
}
$content .= "<hr>";
foreach my $certid (@certid) {
$certid = $certid ? $certid->[0]."<br>".$certid->[1]."<br>SERIAL=".$heap->{sslfilter}->hexdump($certid->[2]) : 'No client certificate';
$content .= $certid."<hr>";
}
$content .= "Your URL was: ".$buf->uri."<hr>"
if (ref($buf) eq "HTTP::Request");
$content .= localtime(time());
my $response = HTTP::Response->new(200);
$response->push_header('Content-type', 'text/html');
$response->content($content);
$heap->{socket_wheel}->put($response);
$kernel->delay(_stop => 1);
},
_stop => sub {
delete $_[HEAP]->{socket_wheel};
}
},
args => [$socket],
);
}
}
);
$poe_kernel->run();
You are able to pass the already inmemory crt file as scalar via crtmem.
You are able to pass the already inmemory key file as scalar via keymem.
You are able to pass the already inmemory cacrt file as scalar via cacrtmem or as an array ref of scalars, if you have multiple ca.
cat client.crt intermediate.crt ca.crt > chain.pem
In this case, you normalyly have no key and crt option. Currently it is not possible to pass this inmemory, only by file.
openssl dhparam -check -text -5 2048 -out path/to/FILENAME.pem
You are able to pass the already inmemory dhparam file as scalar(string) via dhcertmem.
WARNING: If the client provides an untrusted or no client certificate, the connection is not failing. You have to ask clientCertValid() if the certificate is valid!
To flip back to the old behaviour, not setting this option, you can set nohonor.
Example:
cipher => 'DHE-RSA-AES256-GCM-SHA384:AES256-SHA'
WARNING: If the client is listed in the CRL file or an invalid client certifiate has been sent, the connection will be established! You have to ask clientCertValid() if you have the crl option set on new(), otherwise to ask clientCertNotOnCRL() if the certificate is listed on your CRL file!
Specify to ignore specific errors on verifying the certificate chain: This is for example useful to be able to fetch the time from via secure and trusted TLS connection. In this case, your time is wrong, so must ignore time errors, which are 9: X509_V_ERR_CERT_NOT_YET_VALID (certificate is not yet valid) and 10: X509_V_ERR_CERT_HAS_EXPIRED (certificate has expired).
The list of errors you can ignore can be found on the documentation:
<https://wiki.openssl.org/index.php/Manual:Verify(1)>
Example:
ignoreVerifyErrors => [ 9, 10, ]
WARNING: If your CRL file is missing, can not be opened is empty or has no blocked certificate at all in it, then every call will get blocked!
Example:
my ($certid) = ($heap->{sslfilter}->clientCertIds());
$certid = $certid ? $certid->[0]."<br>".$certid->[1]."<br>SERIAL=".$heap->{sslfilter}->hexdump($certid->[2]) : 'No client certificate';
Example:
$sslfilter->getCipher()
Allows one to add filters after the ssl handshake. It has to be called in the input handler, and needs the passing of the POE::Wheel::ReadWhile object. If it returns false, you have to return from the input handler.
See the HTTPS-Server, SSL on an established connection and Client certificate verification examples in SYNOPSIS
WARNING: If the client provides an untrusted client certificate a client certificate that is listed in CRL, this function returns true. You have to ask clientCertValid() if the certificate is valid!
ARG1: POE:SSL::Filter instance
ARG2: Ref on a Hash with the following keys:
ret The return code of Net::SSLeay::connect (client) or Net::SSLeay::accept (server)
ssl The SSL context (SSL_CTX)
msg The error message as text, as normally reported via carp
get_error The error code of get_error the ssl context
error The error code of get_error without context
Example:
perl -e 'use POE::Filter::SSL; print POE::Filter::SSL->hexdump("test")."\n";'
74:65:73:74
Markus Schraeder, "<privi at cpan.org>"
Please report any bugs or feature requests to "bug-poe-filter-ssl at rt.cpan.org", or through the web interface at <http://rt.cpan.org/NoAuth/ReportBug.html?Queue=POE-Filter-SSL>. I will be notified, and then you'll automatically be notified of progress on your bug as I make changes.
You can find documentation for this module with the perldoc command.
perldoc POE::Filter::SSL
You can also look for information at:
<http://rt.cpan.org/NoAuth/Bugs.html?Dist=POE-Filter-SSL>
<http://annocpan.org/dist/POE-Filter-SSL>
<http://cpanratings.perl.org/d/POE-Filter-SSL>
<http://search.cpan.org/dist/POE-Filter-SSL>
Commercial support can be gained at <sslsupport at cryptomagic.eu>.
Used in our products, you can find on <https://www.cryptomagic.eu/>
Copyright 2010-2017 Markus Schraeder, CryptoMagic GmbH, all rights reserved.
This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.
| 2020-11-09 | perl v5.32.0 |