NAME
    POE::Filter::SSL - The easiest and flexiblest way to SSL in POE!

VERSION
    Version 0.41

DESCRIPTION
    This module allows one to secure connections of *POE::Wheel::ReadWrite*
    with OpenSSL by a *POE::Filter* object, and behaves (beside of SSLing)
    as *POE::Filter::Stream*.

    *POE::Filter::SSL* can be added, switched and removed during runtime,
    for example if you want to initiate SSL (see the *SSL on an established
    connection* example in *SYNOPSIS*) on an already established connection.
    You are able to combine *POE::Filter::SSL* with other filters, for
    example have a HTTPS server together with *POE::Filter::HTTPD* (see the
    *HTTPS-Server* example in *SYNOPSIS*).

    *POE::Filter::SSL* is based on *Net::SSLeay*, but got two XS functions
    which *Net::SSLeay* is missing.

    Features

          Full non-blocking processing

          No use of sockets at all

          Server and client mode

          Optional client certificate verification

          Allows one to accept connections with invalid or missing client
          certificate and return custom error data

          CRL check of client certificates

          Retrieve client certificate details (subject name, issuer name,
          certificate serial)

    Upcoming Features

          Direct cipher encryption without SSL or TLS protocol, for example
          with static AES encryption

SYNOPSIS
    By default *POE::Filter::SSL* acts as a SSL server. To use it in client
    mode you just have to set the *client* option of *new()*.

    TCP-Client
        #!perl

        use warnings;
        use strict;

        use POE qw(Component::Client::TCP Filter::SSL);

        POE::Component::Client::TCP->new(
          RemoteAddress => "yahoo.com",
          RemotePort    => 443,
          Filter        => [ "POE::Filter::SSL", client => 1 ],
          Connected     => sub {
            $_[HEAP]{server}->put("HEAD /\r\n\r\n");
          },
          ServerInput   => sub {
            print "from server: ".$_[ARG0]."\n";
          },
        );

        POE::Kernel->run();
        exit;

    TCP-Server
        #!perl

        use warnings;
        use strict;

        use POE qw(Component::Server::TCP);

        POE::Component::Server::TCP->new(
          Port => 443,
          ClientFilter => [ "POE::Filter::SSL", crt => 'server.crt', key => 'server.key' ],
          ClientConnected => sub {
            print "got a connection from $_[HEAP]{remote_ip}\n";
            $_[HEAP]{client}->put("Smile from the server!\r\n");
          },
          Alias => "tcp",
          ClientInput => sub {
            my ($kernel, $session, $heap) = @_[KERNEL, SESSION, HEAP];
            $_[HEAP]{client}->put("You sent:\r\n".$_[ARG0]);
            $_[KERNEL]->yield("shutdown");
          },
        );

        POE::Kernel->run;
        exit;

    HTTPS-Server
        use POE::Filter::SSL::PreFilter
        use POE::Filter::SSL;
        use POE::Component::Server::HTTP;
        use HTTP::Status;
        my $aliases = POE::Component::Server::HTTP->new(
          Port => 443,
          ContentHandler => {
            '/' => \&handler,
            '/dir/' => sub { return; },
            '/file' => sub { return; }
          },
          Headers => { Server => 'My Server' },
          PreFilter => POE::Filter::SSL->new(
            crt    => 'server.crt',
            key    => 'server.key',
            cacrt  => 'ca.crt'
          )
        );

        sub handler {
          my ($request, $response) = @_;
          $response->code(RC_OK);
          $response->content("Hi, you fetched ". $request->uri);
          return RC_OK;
        }

        POE::Kernel->run();
        POE::Kernel->call($aliases->{httpd}, "shutdown");
        # next line isn't really needed
        POE::Kernel->call($aliases->{tcp}, "shutdown");

  SSL on an established connection
    Advanced Example
      This example is an IMAP-Relay which forwards the connections to a IMAP
      server by username. It allows one the unencrypted transfer on port
      143, with the option of SSL on the established connection (STARTTLS).
      On port 993 it allows one to do direct SSL.

      Tested with Thunderbird version 3.0.5.

        #!perl

        use warnings;
        use strict;

        use POE qw(Component::Server::TCP Component::Client::TCP Filter::SSL Filter::Stream);

        my $defaultImapServer = "not.existing.de";
        my $usernameToImapServer = {
          user1 => 'mailserver1.domain.de',
          user2 => 'mailserver2.domain.de',
          # ...
        };

        POE::Component::Server::TCP->new(
          Port => 143,
          ClientFilter => "POE::Filter::Stream",
          ClientDisconnected => \&disconnect,
          ClientConnected => \&connected,
          ClientInput => \&handleInput,
          InlineStates => {
            send_stuff => \&send_stuff,
            _child => \&child
          }
        );

        POE::Component::Server::TCP->new(
          Port => 993,
          ClientFilter => [ "POE::Filter::SSL", crt => 'server.crt', key => 'server.key' ],
          ClientConnected => \&connected,
          ClientDisconnected => \&disconnect,
          ClientInput => \&handleInput,
          InlineStates => {
            send_stuff => \&send_stuff,
            _child => \&child
          }
        );

        sub disconnect {
          my ($kernel, $session, $heap) = @_[KERNEL, SESSION, HEAP];
          logevent('server got disconnect', $session);
          $kernel->post($heap->{client_id} => "shutdown");
        }

        sub connected {
          my ($kernel, $session, $heap) = @_[KERNEL, SESSION, HEAP];
          logevent("got a connection from ".$heap->{remote_ip}, $session);
          $heap->{client}->put("* OK [CAPABILITY IMAP4rev1 UIDPLUS CHILDREN NAMESPACE THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT QUOTA IDLE ACL ACL2=UNION STARTTLS] IMAP Relay v0.1 ready.\r\n");
        }

        sub send_stuff {
          my ($heap, $stuff, $session) = @_[HEAP, ARG0, SESSION];
          logevent("-> ".length($stuff)." Bytes", $session);
          (defined($heap->{client})) && (ref($heap->{client}) eq "POE::Wheel::ReadWrite") &&
          $heap->{client}->put($stuff);
        }

        sub child {
          my ($heap, $child_op, $child) = @_[HEAP, ARG0, ARG1];
          if ($child_op eq "create") {
            $heap->{client_id} = $child->ID;
          }
        }

        sub handleInput {
          my ($kernel, $session, $heap, $input) = @_[KERNEL, SESSION, HEAP, ARG0];
          if($heap->{forwarding}) {
            return $kernel->yield("shutdown") unless (defined($heap->{client_id}));
            $kernel->post($heap->{client_id} => send_stuff => $input);
          } elsif ($input =~ /^(\d+)\s+STARTTLS[\r\n]+/i) {
            $_[HEAP]{client}->put($1." OK Begin SSL/TLS negotiation now.\r\n");
            logevent("SSLing now...", $session);
            $_[HEAP]{client}->set_filter(POE::Filter::SSL->new(crt => 'server.crt', key => 'server.key'));
          } elsif ($input =~ /^(\d+)\s+CAPABILITY[\r\n]+/i) {
            $_[HEAP]{client}->put("* CAPABILITY IMAP4rev1 UIDPLUS CHILDREN NAMESPACE THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT QUOTA IDLE ACL ACL2=UNION STARTTLS\r\n");
            $_[HEAP]{client}->put($1." OK CAPABILITY completed\r\n");
          } elsif ($input =~ /^(\d+)\s+login\s+\"(\S+)\"\s+\"(\S+)\"[\r\n]+/i) {
            my $username = $2;
            my $pass = $3;
            logevent("login of user ".$username, $session);
            spawn_client_side($username, $input);
            $heap->{forwarding}++;
          } else {
            logevent("unknown command before login, disconnecting.", $session);
            return $kernel->yield("shutdown");
          }
        }

        sub spawn_client_side {
          my $username = shift;
          POE::Component::Client::TCP->new(
            RemoteAddress => $usernameToImapServer->{$username} || $defaultImapServer,
            RemotePort    => 143,
            Filter => "POE::Filter::Stream",
            Started       => sub {
              $_[HEAP]->{server_id} = $_[SENDER]->ID;
              $_[HEAP]->{buf} = $_[ARG0];
              $_[HEAP]->{skip} = 0;
            },
            Connected => sub {
              my ($heap, $session) = @_[HEAP, SESSION];
              logevent('client connected', $session);
              $heap->{server}->put($heap->{buf});
              delete $heap->{buf};
            },
            ServerInput => sub {
              my ($kernel, $heap, $session, $input) = @_[KERNEL, HEAP, SESSION, ARG0];
              #logevent('client got input', $session, $input);
              $kernel->post($heap->{server_id} => send_stuff => $input) if ($heap->{skip}++);
            },
            Disconnected => sub {
              my ($kernel, $heap, $session) = @_[KERNEL, HEAP, SESSION];
              logevent('client disconnected', $session);
              $kernel->post($heap->{server_id} => 'shutdown');
            },
            InlineStates => {
              send_stuff => sub {
                my ($heap, $stuff, $session) = @_[HEAP, ARG0, SESSION];
                logevent("<- ".length($stuff)." Bytes", $session);
                (defined($heap->{server})) && (ref($heap->{server}) eq "POE::Wheel::ReadWrite") &&
                $heap->{server}->put($stuff);
              },
            },
            Args => [ shift ]
          );
        }

        sub logevent {
          my ($state, $session, $arg) = @_;
          my $id = $session->ID();
          print "session $id $state ";
          print ": $arg" if (defined $arg);
          print "\n";
        }

        POE::Kernel->run;

  Client certificate verification
    Advanced Example
      The following example implements a HTTPS server with client
      certificate verification, which shows details about the verified
      client certificate.

        #!perl

        use strict;
        use warnings;
        use Socket;
        use POE qw(
          Wheel::SocketFactory
          Wheel::ReadWrite
          Driver::SysRW
          Filter::SSL
          Filter::Stackable
          Filter::HTTPD
        );

        POE::Session->create(
          inline_states => {
            _start       => sub {
              my $heap = $_[HEAP];
              $heap->{listener} = POE::Wheel::SocketFactory->new(
                BindAddress  => '0.0.0.0',
                BindPort     => 443,
                Reuse        => 'yes',
                SuccessEvent => 'socket_birth',
                FailureEvent => '_stop',
              );
            },
            _stop => sub {
              delete $_[HEAP]->{listener};
            },
            socket_birth => sub {
              my ($socket) = $_[ARG0];
              POE::Session->create(
                inline_states => {
                  _start       => sub {
                    my ($heap, $kernel, $connected_socket, $address, $port) = @_[HEAP, KERNEL, ARG0, ARG1, ARG2];
                    $heap->{sslfilter} = POE::Filter::SSL->new(
                       crt    => 'server.crt',
                       key    => 'server.key',
                       cacrt  => 'ca.crt',
                       cipher => 'DHE-RSA-AES256-GCM-SHA384:AES256-SHA',
                       #cacrl  => 'ca.crl', # Uncomment this, if you have a CRL file.
                       debug  => 1,
                       clientcert => 1
                    );
                    $heap->{socket_wheel} = POE::Wheel::ReadWrite->new(
                      Handle     => $connected_socket,
                      Driver     => POE::Driver::SysRW->new(),
                      Filter     => POE::Filter::Stackable->new(Filters => [
                        $heap->{sslfilter},
                        POE::Filter::HTTPD->new()
                      ]),
                      InputEvent => 'socket_input',
                      ErrorEvent => '_stop',
                    );
                  },
                  socket_input => sub {
                    my ($kernel, $heap, $buf) = @_[KERNEL, HEAP, ARG0];
                    my (@certid) = ($heap->{sslfilter}->clientCertIds());
                    my $content = '';
                    if ($heap->{sslfilter}->clientCertValid()) {
                      $content .= "Hello <font color=green>valid</font> client Certifcate:";
                    } else {
                      $content .= "None or <font color=red>invalid</font> client certificate:";
                    }
                    $content .= "<hr>";
                    foreach my $certid (@certid) {
                      $certid = $certid ? $certid->[0]."<br>".$certid->[1]."<br>SERIAL=".$heap->{sslfilter}->hexdump($certid->[2]) : 'No client certificate';
                      $content .= $certid."<hr>";
                    }
                    $content .= "Your URL was: ".$buf->uri."<hr>"
                      if (ref($buf) eq "HTTP::Request");
                    $content .= localtime(time());
                    my $response = HTTP::Response->new(200);
                    $response->push_header('Content-type', 'text/html');
                    $response->content($content);
                    $heap->{socket_wheel}->put($response);
                    $kernel->delay(_stop => 1);
                  },
                  _stop => sub {
                    delete $_[HEAP]->{socket_wheel};
                  }
                },
                args => [$socket],
              );
            }
          }
        );

        $poe_kernel->run();

FUNCTIONS
    new(option = value, option => value, option...)>
        Returns a new *POE::Filter::SSL* object. It accepts the following
        options:

        client
          By default *POE::Filter::SSL* acts as a SSL server. To use it in
          client mode, you have to set this option.

        crt{mem}
          The certificate file (.crt) for the server, a client certificate
          in client mode.

          You are able to pass the already inmemory crt file as scalar via
          *crtmem*.

        key{mem}
          The key file (.key) of the certificate (see *crt* above).

          You are able to pass the already inmemory key file as scalar via
          *keymem*.

        cacrt{mem}
          The ca certificate file (ca.crt), which is used to verificate the
          client certificates against a CA. You can store multiple ca in one
          file, all of them gets imported.

          You are able to pass the already inmemory cacrt file as scalar via
          *cacrtmem* or as an array ref of scalars, if you have multiple ca.

        caverifydepth
          By default the ca verify depth is 5, you can override this via
          this option.

        chain
          Chain certificate, you need it for example for startssl.org which
          needs a intermedia certificates. Here you can configure it. You
          can generate this the following way:

          cat client.crt intermediate.crt ca.crt > chain.pem

          In this case, you normalyly have no *key* and *crt* option.
          Currently it is not possible to pass this inmemory, only by file.

        cacrl
          Configures a CRL (ca.crl) against the client certificate is
          verified by *clientCertValid()*.

        dhcert{mem}
          If you want to enable perfect forward secrecy, here you can enable
          Diffie-Hellman. You just have to create a dhparam file and there
          here the path to the path/to/FILENAME.pem where your
          Diffie-Hellman (pem format) stays.

          openssl dhparam -check -text -5 2048 -out path/to/FILENAME.pem

          You are able to pass the already inmemory dhparam file as
          scalar(string) via *dhcertmem*.

        clientcert
          Only in server mode: Request during ssl handshake from the client
          a client certificat.

          WARNING: If the client provides an untrusted or no client
          certificate, the connection is not failing. You have to ask
          *clientCertValid()* if the certificate is valid!

        sni
          Allows one to set the SNI hostname indication in first packet of
          handshake. See
          https://de.wikipedia.org/wiki/Server_Name_Indication

        tls
          Force in the handshake the use of tls, disables support for the
          obsolete SSL handshake.

        tls1_2
          Force in the handshake the use of tls in version 1.2, disables
          support for the obsolete SSL handshake.

        nohonor
          By default, as server, *POE::Filter:SSL* sets the option
          *SSL_OP_CIPHER_SERVER_PREFERENCE*. For more information you may
          google the pendant of apache *SSLHonorCipherOrder*.

          To flip back to the old behaviour, not setting this option, you
          can set nohonor.

        cipher
          Specify which ciphers are allowed for the synchronous encrypted
          transfer of the data over the ssl connection.

          Example:

            cipher => 'DHE-RSA-AES256-GCM-SHA384:AES256-SHA'

        blockbadclientcert
          Let OpenSSL deny the connection if there is no client certificate.

          WARNING: If the client is listed in the CRL file or an invalid
          client certifiate has been sent, the connection will be
          established! You have to ask *clientCertValid()* if you have the
          *crl* option set on *new()*, otherwise to ask
          *clientCertNotOnCRL()* if the certificate is listed on your CRL
          file!

        ignoreVerifyErrors
          WARNING: Before using this option, you should be realy sure that
          you know what you are doing!

          Specify to ignore specific errors on verifying the certificate
          chain: This is for example useful to be able to fetch the time
          from via secure and trusted TLS connection. In this case, your
          time is wrong, so must ignore time errors, which are 9:
          X509_V_ERR_CERT_NOT_YET_VALID (certificate is not yet valid) and
          10: X509_V_ERR_CERT_HAS_EXPIRED (certificate has expired).

          The list of errors you can ignore can be found on the
          documentation:

          <https://wiki.openssl.org/index.php/Manual:Verify(1)>

          Example:

            ignoreVerifyErrors => [ 9, 10, ]

    handshakeDone(options)
        Returns *true* if the handshake is done and all data for handshake
        has been written out. It accepts the following options:

        ignorebuf
          Returns *true* if OpenSSL has established the connection,
          regardless if all data has been written out. This is needed if you
          want to exchange the Filter of *POE::Wheel::ReadWrite* before the
          first data comes in. This option have been only used by
          *doHandshake()* to be able to add new filters before first
          cleartext data to be processed gets in.

    clientCertNotOnCRL($file)
        Verifies if the serial of the client certificate is not contained in
        the CRL $file. No file caching is done, each call opens the file
        again.

        WARNING: If your CRL file is missing, can not be opened is empty or
        has no blocked certificate at all in it, then every call will get
        blocked!

    clientCertIds()
        Returns an array of every certificate found by OpenSSL. Each element
        is again a array. The first element is the value of
        *X509_get_subject_name*, second is the value of
        *X509_get_issuer_name* and third element is the serial of the
        certificate in binary form. You have to use *split()* and *ord()*,
        or the *hexdump()* function, to convert it to a readable form.

        Example:

          my ($certid) = ($heap->{sslfilter}->clientCertIds());
          $certid = $certid ? $certid->[0]."<br>".$certid->[1]."<br>SERIAL=".$heap->{sslfilter}->hexdump($certid->[2]) : 'No client certificate';

    getCipher()
        Returns the used cryptographic algorithm and length.

        Example:

          $sslfilter->getCipher()

    clientCertValid()
        Returns *true* if there is a client certificate that is valid. It
        also tests against the CRL, if you have the *cacrl* option set on
        *new()*.

    doHandshake($readWrite, $filter, $filter, ...) !!!REMOVED!!!
        WARNING: POE::Filter:SSL now is able to do the ssh handshake now
        without any helpers. Because of this, this function has been
        removed!

        Allows one to add filters after the ssl handshake. It has to be
        called in the input handler, and needs the passing of the
        *POE::Wheel::ReadWhile* object. If it returns false, you have to
        return from the input handler.

        See the *HTTPS-Server*, *SSL on an established connection* and
        *Client certificate verification* examples in *SYNOPSIS*

    clientCertExists()
        Returns *true* if there is a client certificate, that might be
        untrusted.

        WARNING: If the client provides an untrusted client certificate a
        client certificate that is listed in CRL, this function returns
        *true*. You have to ask *clientCertValid()* if the certificate is
        valid!

    errorhandler
        By default, every ssl error is escalated via carp. You may change
        this behaviour via this option to:

        "ignore"
          Do not report any error.

        *CODE*
          Setting errorhandler to a reference of a function allows one to be
          called it callback function with the following options:

          ARG1: POE:SSL::Filter instance

          ARG2: Ref on a Hash with the following keys:

            ret        The return code of Net::SSLeay::connect (client) or Net::SSLeay::accept (server)
            ssl        The SSL context (SSL_CTX)
            msg        The error message as text, as normally reported via carp
            get_error  The error code of get_error the ssl context
            error      The error code of get_error without context

        "carp" (or undef)
          Do Carp/carp on error.

        "confess"
          Do Carp/confess (stacktrace) on error.

        "carponetime"
          Report carp for one occurrence only one time - over all!

    debug
        Shows debug messages of *clientCertNotOnCRL()*.

    hexdump($string)
        Returns string data in hex format.

        Example:

          perl -e 'use POE::Filter::SSL; print POE::Filter::SSL->hexdump("test")."\n";'
          74:65:73:74

  Internal functions and POE::Filter handler
    VERIFY()
    POE_FILTER_X509_get_serialNumber()
    POE_FILTER_SSL_CTX_set_tmp_dh()
    POE_FILTER_SSL_CTX_set_tmp_rsa()
    POE_FILTER_SSL_set_tmp_dh()
    clone()
    doSSL()
    get()
    get_one()
    get_one_start()
    get_pending()
    writeToSSLBIO()
    writeToSSL()
    put()
    verify_serial_against_crl_file()
    DOSENDBACK()
    checkForDoSendback()
    CTX_add_client_CA()
    PEMdataToEVP_PKEY
    PEMdataToX509
    dataToBio

AUTHOR
    Markus Schraeder, "<privi at cpan.org>"

BUGS
    Please report any bugs or feature requests to "bug-poe-filter-ssl at
    rt.cpan.org", or through the web interface at
    <http://rt.cpan.org/NoAuth/ReportBug.html?Queue=POE-Filter-SSL>. I will
    be notified, and then you'll automatically be notified of progress on
    your bug as I make changes.

SUPPORT
    You can find documentation for this module with the perldoc command.

        perldoc POE::Filter::SSL

    You can also look for information at:

    *   RT: CPAN's request tracker

        <http://rt.cpan.org/NoAuth/Bugs.html?Dist=POE-Filter-SSL>

    *   AnnoCPAN: Annotated CPAN documentation

        <http://annocpan.org/dist/POE-Filter-SSL>

    *   CPAN Ratings

        <http://cpanratings.perl.org/d/POE-Filter-SSL>

    *   Search CPAN

        <http://search.cpan.org/dist/POE-Filter-SSL>

Commercial support
    Commercial support can be gained at <sslsupport at cryptomagic.eu>.

    Used in our products, you can find on <https://www.cryptomagic.eu/>

COPYRIGHT & LICENSE
    Copyright 2010-2017 Markus Schraeder, CryptoMagic GmbH, all rights
    reserved.

    This program is free software; you can redistribute it and/or modify it
    under the same terms as Perl itself.