.\" -*- mode: troff; coding: utf-8 -*-
.\" Automatically generated by Pod::Man 5.01 (Pod::Simple 3.43)
.\"
.\" Standard preamble:
.\" ========================================================================
.de Sp \" Vertical space (when we can't use .PP)
.if t .sp .5v
.if n .sp
..
.de Vb \" Begin verbatim text
.ft CW
.nf
.ne \\$1
..
.de Ve \" End verbatim text
.ft R
.fi
..
.\" \*(C` and \*(C' are quotes in nroff, nothing in troff, for use with C<>.
.ie n \{\
. ds C` ""
. ds C' ""
'br\}
.el\{\
. ds C`
. ds C'
'br\}
.\"
.\" Escape single quotes in literal strings from groff's Unicode transform.
.ie \n(.g .ds Aq \(aq
.el .ds Aq '
.\"
.\" If the F register is >0, we'll generate index entries on stderr for
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
.\" entries marked with X<> in POD. Of course, you'll have to process the
.\" output yourself in some meaningful fashion.
.\"
.\" Avoid warning from groff about undefined register 'F'.
.de IX
..
.nr rF 0
.if \n(.g .if rF .nr rF 1
.if (\n(rF:(\n(.g==0)) \{\
. if \nF \{\
. de IX
. tm Index:\\$1\t\\n%\t"\\$2"
..
. if !\nF==2 \{\
. nr % 0
. nr F 2
. \}
. \}
.\}
.rr rF
.\" ========================================================================
.\"
.IX Title "POE::Filter::SSL 3pm"
.TH POE::Filter::SSL 3pm 2024-01-10 "perl v5.38.2" "User Contributed Perl Documentation"
.\" For nroff, turn off justification. Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
.nh
.SH NAME
POE::Filter::SSL \- The easiest and flexiblest way to SSL in POE!
.SH VERSION
.IX Header "VERSION"
Version 0.41
.SH DESCRIPTION
.IX Header "DESCRIPTION"
This module allows one to secure connections of \fIPOE::Wheel::ReadWrite\fR with OpenSSL by a
\&\fIPOE::Filter\fR object, and behaves (beside of SSLing) as \fIPOE::Filter::Stream\fR.
.PP
\&\fIPOE::Filter::SSL\fR can be added, switched and removed during runtime, for example if you
want to initiate SSL (see the \fISSL on an established connection\fR example in \fISYNOPSIS\fR) on an already established connection. You are able to combine
\&\fIPOE::Filter::SSL\fR with other filters, for example have a HTTPS server together
with \fIPOE::Filter::HTTPD\fR (see the \fIHTTPS-Server\fR example in \fISYNOPSIS\fR).
.PP
\&\fIPOE::Filter::SSL\fR is based on \fINet::SSLeay\fR, but got two XS functions which \fINet::SSLeay\fR is missing.
.IP \fBFeatures\fR 4
.IX Item "Features"
.RS 4
.RS 2
Full non-blocking processing
.Sp
No use of sockets at all
.Sp
Server and client mode
.Sp
Optional client certificate verification
.Sp
Allows one to accept connections with invalid or missing client certificate and return custom error data
.Sp
CRL check of client certificates
.Sp
Retrieve client certificate details (subject name, issuer name, certificate serial)
.RE
.RE
.RS 4
.RE
.IP "\fBUpcoming Features\fR" 4
.IX Item "Upcoming Features"
.RS 4
.RS 2
Direct cipher encryption without SSL or TLS protocol, for example with static AES encryption
.RE
.RE
.RS 4
.RE
.SH SYNOPSIS
.IX Header "SYNOPSIS"
By default \fIPOE::Filter::SSL\fR acts as a SSL server. To use it in client mode you just have to set the \fIclient\fR option of \fR\f(BInew()\fR\fI\fR.
.IP TCP-Client 2
.IX Item "TCP-Client"
.Vb 1
\& #!perl
\&
\& use warnings;
\& use strict;
\&
\& use POE qw(Component::Client::TCP Filter::SSL);
\&
\& POE::Component::Client::TCP\->new(
\& RemoteAddress => "yahoo.com",
\& RemotePort => 443,
\& Filter => [ "POE::Filter::SSL", client => 1 ],
\& Connected => sub {
\& $_[HEAP]{server}\->put("HEAD /\er\en\er\en");
\& },
\& ServerInput => sub {
\& print "from server: ".$_[ARG0]."\en";
\& },
\& );
\&
\& POE::Kernel\->run();
\& exit;
.Ve
.IP TCP-Server 2
.IX Item "TCP-Server"
.Vb 1
\& #!perl
\&
\& use warnings;
\& use strict;
\&
\& use POE qw(Component::Server::TCP);
\&
\& POE::Component::Server::TCP\->new(
\& Port => 443,
\& ClientFilter => [ "POE::Filter::SSL", crt => \*(Aqserver.crt\*(Aq, key => \*(Aqserver.key\*(Aq ],
\& ClientConnected => sub {
\& print "got a connection from $_[HEAP]{remote_ip}\en";
\& $_[HEAP]{client}\->put("Smile from the server!\er\en");
\& },
\& Alias => "tcp",
\& ClientInput => sub {
\& my ($kernel, $session, $heap) = @_[KERNEL, SESSION, HEAP];
\& $_[HEAP]{client}\->put("You sent:\er\en".$_[ARG0]);
\& $_[KERNEL]\->yield("shutdown");
\& },
\& );
\&
\& POE::Kernel\->run;
\& exit;
.Ve
.IP HTTPS-Server 2
.IX Item "HTTPS-Server"
.Vb 10
\& use POE::Filter::SSL::PreFilter
\& use POE::Filter::SSL;
\& use POE::Component::Server::HTTP;
\& use HTTP::Status;
\& my $aliases = POE::Component::Server::HTTP\->new(
\& Port => 443,
\& ContentHandler => {
\& \*(Aq/\*(Aq => \e&handler,
\& \*(Aq/dir/\*(Aq => sub { return; },
\& \*(Aq/file\*(Aq => sub { return; }
\& },
\& Headers => { Server => \*(AqMy Server\*(Aq },
\& PreFilter => POE::Filter::SSL\->new(
\& crt => \*(Aqserver.crt\*(Aq,
\& key => \*(Aqserver.key\*(Aq,
\& cacrt => \*(Aqca.crt\*(Aq
\& )
\& );
\&
\& sub handler {
\& my ($request, $response) = @_;
\& $response\->code(RC_OK);
\& $response\->content("Hi, you fetched ". $request\->uri);
\& return RC_OK;
\& }
\&
\& POE::Kernel\->run();
\& POE::Kernel\->call($aliases\->{httpd}, "shutdown");
\& # next line isn\*(Aqt really needed
\& POE::Kernel\->call($aliases\->{tcp}, "shutdown");
.Ve
.SS "SSL on an established connection"
.IX Subsection "SSL on an established connection"
.IP "Advanced Example" 2
.IX Item "Advanced Example"
This example is an IMAP-Relay which forwards the connections to a IMAP server
by username. It allows one the unencrypted transfer on port 143, with the option
of SSL on the established connection (STARTTLS). On port 993 it allows one to do
direct SSL.
.Sp
Tested with Thunderbird version 3.0.5.
.Sp
.Vb 1
\& #!perl
\&
\& use warnings;
\& use strict;
\&
\& use POE qw(Component::Server::TCP Component::Client::TCP Filter::SSL Filter::Stream);
\&
\& my $defaultImapServer = "not.existing.de";
\& my $usernameToImapServer = {
\& user1 => \*(Aqmailserver1.domain.de\*(Aq,
\& user2 => \*(Aqmailserver2.domain.de\*(Aq,
\& # ...
\& };
\&
\& POE::Component::Server::TCP\->new(
\& Port => 143,
\& ClientFilter => "POE::Filter::Stream",
\& ClientDisconnected => \e&disconnect,
\& ClientConnected => \e&connected,
\& ClientInput => \e&handleInput,
\& InlineStates => {
\& send_stuff => \e&send_stuff,
\& _child => \e&child
\& }
\& );
\&
\& POE::Component::Server::TCP\->new(
\& Port => 993,
\& ClientFilter => [ "POE::Filter::SSL", crt => \*(Aqserver.crt\*(Aq, key => \*(Aqserver.key\*(Aq ],
\& ClientConnected => \e&connected,
\& ClientDisconnected => \e&disconnect,
\& ClientInput => \e&handleInput,
\& InlineStates => {
\& send_stuff => \e&send_stuff,
\& _child => \e&child
\& }
\& );
\&
\& sub disconnect {
\& my ($kernel, $session, $heap) = @_[KERNEL, SESSION, HEAP];
\& logevent(\*(Aqserver got disconnect\*(Aq, $session);
\& $kernel\->post($heap\->{client_id} => "shutdown");
\& }
\&
\& sub connected {
\& my ($kernel, $session, $heap) = @_[KERNEL, SESSION, HEAP];
\& logevent("got a connection from ".$heap\->{remote_ip}, $session);
\& $heap\->{client}\->put("* OK [CAPABILITY IMAP4rev1 UIDPLUS CHILDREN NAMESPACE THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT QUOTA IDLE ACL ACL2=UNION STARTTLS] IMAP Relay v0.1 ready.\er\en");
\& }
\&
\& sub send_stuff {
\& my ($heap, $stuff, $session) = @_[HEAP, ARG0, SESSION];
\& logevent("\-> ".length($stuff)." Bytes", $session);
\& (defined($heap\->{client})) && (ref($heap\->{client}) eq "POE::Wheel::ReadWrite") &&
\& $heap\->{client}\->put($stuff);
\& }
\&
\& sub child {
\& my ($heap, $child_op, $child) = @_[HEAP, ARG0, ARG1];
\& if ($child_op eq "create") {
\& $heap\->{client_id} = $child\->ID;
\& }
\& }
\&
\& sub handleInput {
\& my ($kernel, $session, $heap, $input) = @_[KERNEL, SESSION, HEAP, ARG0];
\& if($heap\->{forwarding}) {
\& return $kernel\->yield("shutdown") unless (defined($heap\->{client_id}));
\& $kernel\->post($heap\->{client_id} => send_stuff => $input);
\& } elsif ($input =~ /^(\ed+)\es+STARTTLS[\er\en]+/i) {
\& $_[HEAP]{client}\->put($1." OK Begin SSL/TLS negotiation now.\er\en");
\& logevent("SSLing now...", $session);
\& $_[HEAP]{client}\->set_filter(POE::Filter::SSL\->new(crt => \*(Aqserver.crt\*(Aq, key => \*(Aqserver.key\*(Aq));
\& } elsif ($input =~ /^(\ed+)\es+CAPABILITY[\er\en]+/i) {
\& $_[HEAP]{client}\->put("* CAPABILITY IMAP4rev1 UIDPLUS CHILDREN NAMESPACE THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT QUOTA IDLE ACL ACL2=UNION STARTTLS\er\en");
\& $_[HEAP]{client}\->put($1." OK CAPABILITY completed\er\en");
\& } elsif ($input =~ /^(\ed+)\es+login\es+\e"(\eS+)\e"\es+\e"(\eS+)\e"[\er\en]+/i) {
\& my $username = $2;
\& my $pass = $3;
\& logevent("login of user ".$username, $session);
\& spawn_client_side($username, $input);
\& $heap\->{forwarding}++;
\& } else {
\& logevent("unknown command before login, disconnecting.", $session);
\& return $kernel\->yield("shutdown");
\& }
\& }
\&
\& sub spawn_client_side {
\& my $username = shift;
\& POE::Component::Client::TCP\->new(
\& RemoteAddress => $usernameToImapServer\->{$username} || $defaultImapServer,
\& RemotePort => 143,
\& Filter => "POE::Filter::Stream",
\& Started => sub {
\& $_[HEAP]\->{server_id} = $_[SENDER]\->ID;
\& $_[HEAP]\->{buf} = $_[ARG0];
\& $_[HEAP]\->{skip} = 0;
\& },
\& Connected => sub {
\& my ($heap, $session) = @_[HEAP, SESSION];
\& logevent(\*(Aqclient connected\*(Aq, $session);
\& $heap\->{server}\->put($heap\->{buf});
\& delete $heap\->{buf};
\& },
\& ServerInput => sub {
\& my ($kernel, $heap, $session, $input) = @_[KERNEL, HEAP, SESSION, ARG0];
\& #logevent(\*(Aqclient got input\*(Aq, $session, $input);
\& $kernel\->post($heap\->{server_id} => send_stuff => $input) if ($heap\->{skip}++);
\& },
\& Disconnected => sub {
\& my ($kernel, $heap, $session) = @_[KERNEL, HEAP, SESSION];
\& logevent(\*(Aqclient disconnected\*(Aq, $session);
\& $kernel\->post($heap\->{server_id} => \*(Aqshutdown\*(Aq);
\& },
\& InlineStates => {
\& send_stuff => sub {
\& my ($heap, $stuff, $session) = @_[HEAP, ARG0, SESSION];
\& logevent("<\- ".length($stuff)." Bytes", $session);
\& (defined($heap\->{server})) && (ref($heap\->{server}) eq "POE::Wheel::ReadWrite") &&
\& $heap\->{server}\->put($stuff);
\& },
\& },
\& Args => [ shift ]
\& );
\& }
\&
\& sub logevent {
\& my ($state, $session, $arg) = @_;
\& my $id = $session\->ID();
\& print "session $id $state ";
\& print ": $arg" if (defined $arg);
\& print "\en";
\& }
\&
\& POE::Kernel\->run;
.Ve
.SS "Client certificate verification"
.IX Subsection "Client certificate verification"
.IP "Advanced Example" 2
.IX Item "Advanced Example"
The following example implements a HTTPS server with client certificate verification, which shows details about the verified client certificate.
.Sp
.Vb 1
\& #!perl
\&
\& use strict;
\& use warnings;
\& use Socket;
\& use POE qw(
\& Wheel::SocketFactory
\& Wheel::ReadWrite
\& Driver::SysRW
\& Filter::SSL
\& Filter::Stackable
\& Filter::HTTPD
\& );
\&
\& POE::Session\->create(
\& inline_states => {
\& _start => sub {
\& my $heap = $_[HEAP];
\& $heap\->{listener} = POE::Wheel::SocketFactory\->new(
\& BindAddress => \*(Aq0.0.0.0\*(Aq,
\& BindPort => 443,
\& Reuse => \*(Aqyes\*(Aq,
\& SuccessEvent => \*(Aqsocket_birth\*(Aq,
\& FailureEvent => \*(Aq_stop\*(Aq,
\& );
\& },
\& _stop => sub {
\& delete $_[HEAP]\->{listener};
\& },
\& socket_birth => sub {
\& my ($socket) = $_[ARG0];
\& POE::Session\->create(
\& inline_states => {
\& _start => sub {
\& my ($heap, $kernel, $connected_socket, $address, $port) = @_[HEAP, KERNEL, ARG0, ARG1, ARG2];
\& $heap\->{sslfilter} = POE::Filter::SSL\->new(
\& crt => \*(Aqserver.crt\*(Aq,
\& key => \*(Aqserver.key\*(Aq,
\& cacrt => \*(Aqca.crt\*(Aq,
\& cipher => \*(AqDHE\-RSA\-AES256\-GCM\-SHA384:AES256\-SHA\*(Aq,
\& #cacrl => \*(Aqca.crl\*(Aq, # Uncomment this, if you have a CRL file.
\& debug => 1,
\& clientcert => 1
\& );
\& $heap\->{socket_wheel} = POE::Wheel::ReadWrite\->new(
\& Handle => $connected_socket,
\& Driver => POE::Driver::SysRW\->new(),
\& Filter => POE::Filter::Stackable\->new(Filters => [
\& $heap\->{sslfilter},
\& POE::Filter::HTTPD\->new()
\& ]),
\& InputEvent => \*(Aqsocket_input\*(Aq,
\& ErrorEvent => \*(Aq_stop\*(Aq,
\& );
\& },
\& socket_input => sub {
\& my ($kernel, $heap, $buf) = @_[KERNEL, HEAP, ARG0];
\& my (@certid) = ($heap\->{sslfilter}\->clientCertIds());
\& my $content = \*(Aq\*(Aq;
\& if ($heap\->{sslfilter}\->clientCertValid()) {
\& $content .= "Hello valid client Certifcate:";
\& } else {
\& $content .= "None or invalid client certificate:";
\& }
\& $content .= "
";
\& foreach my $certid (@certid) {
\& $certid = $certid ? $certid\->[0]."
".$certid\->[1]."
SERIAL=".$heap\->{sslfilter}\->hexdump($certid\->[2]) : \*(AqNo client certificate\*(Aq;
\& $content .= $certid."
";
\& }
\& $content .= "Your URL was: ".$buf\->uri."
"
\& if (ref($buf) eq "HTTP::Request");
\& $content .= localtime(time());
\& my $response = HTTP::Response\->new(200);
\& $response\->push_header(\*(AqContent\-type\*(Aq, \*(Aqtext/html\*(Aq);
\& $response\->content($content);
\& $heap\->{socket_wheel}\->put($response);
\& $kernel\->delay(_stop => 1);
\& },
\& _stop => sub {
\& delete $_[HEAP]\->{socket_wheel};
\& }
\& },
\& args => [$socket],
\& );
\& }
\& }
\& );
\&
\& $poe_kernel\->run();
.Ve
.SH FUNCTIONS
.IX Header "FUNCTIONS"
.IP "\fBnew(option =\fR value, option => value, option...)>" 4
.IX Item "new(option = value, option => value, option...)>"
Returns a new \fIPOE::Filter::SSL\fR object. It accepts the following options:
.RS 4
.IP client 2
.IX Item "client"
By default \fIPOE::Filter::SSL\fR acts as a SSL server. To use it in client mode, you have to set this option.
.IP crt{mem} 2
.IX Item "crt{mem}"
The certificate file (.crt) for the server, a client certificate in client mode.
.Sp
You are able to pass the already inmemory crt file as scalar via \fIcrtmem\fR.
.IP key{mem} 2
.IX Item "key{mem}"
The key file (.key) of the certificate (see \fIcrt\fR above).
.Sp
You are able to pass the already inmemory key file as scalar via \fIkeymem\fR.
.IP cacrt{mem} 2
.IX Item "cacrt{mem}"
The ca certificate file (ca.crt), which is used to verificate the client certificates against a CA. You can store multiple ca in one file, all of them gets imported.
.Sp
You are able to pass the already inmemory cacrt file as scalar via \fIcacrtmem\fR or as an array ref of scalars, if you have multiple ca.
.IP caverifydepth 2
.IX Item "caverifydepth"
By default the ca verify depth is 5, you can override this via this option.
.IP chain 2
.IX Item "chain"
Chain certificate, you need it for example for startssl.org which needs a intermedia certificates. Here you can configure it. You can generate this the following way:
.Sp
cat client.crt intermediate.crt ca.crt > chain.pem
.Sp
In this case, you normalyly have no \fIkey\fR and \fIcrt\fR option. Currently it is not possible to pass this inmemory, only by file.
.IP cacrl 2
.IX Item "cacrl"
Configures a CRL (ca.crl) against the client certificate is verified by \fR\f(BIclientCertValid()\fR\fI\fR.
.IP dhcert{mem} 2
.IX Item "dhcert{mem}"
If you want to enable perfect forward secrecy, here you can enable Diffie-Hellman. You just have to create a dhparam file and there here the path to the path/to/FILENAME.pem where your Diffie-Hellman (pem format) stays.
.Sp
openssl dhparam \-check \-text \-5 2048 \-out path/to/FILENAME.pem
.Sp
You are able to pass the already inmemory dhparam file as scalar(string) via \fIdhcertmem\fR.
.IP clientcert 2
.IX Item "clientcert"
Only in server mode: Request during ssl handshake from the client a client certificate.
.Sp
\&\fBWARNING:\fR If the client provides an untrusted or no client certificate, the connection is \fBnot\fR failing. You have to ask \fR\f(BIclientCertValid()\fR\fI\fR if the certificate is valid!
.IP sni 2
.IX Item "sni"
Allows one to set the SNI hostname indication in first packet of handshake. See https://de.wikipedia.org/wiki/Server_Name_Indication
.IP tls 2
.IX Item "tls"
Force in the handshake the use of tls, disables support for the obsolete SSL handshake.
.IP tls1_2 2
.IX Item "tls1_2"
Force in the handshake the use of tls in version 1.2, disables support for the obsolete SSL handshake.
.IP nohonor 2
.IX Item "nohonor"
By default, as server, \fIPOE::Filter:SSL\fR sets the option \fISSL_OP_CIPHER_SERVER_PREFERENCE\fR. For more information you may google the pendant of apache \fISSLHonorCipherOrder\fR.
.Sp
To flip back to the old behaviour, not setting this option, you can set nohonor.
.IP cipher 2
.IX Item "cipher"
Specify which ciphers are allowed for the synchronous encrypted transfer of the data over the ssl connection.
.Sp
Example:
.Sp
.Vb 1
\& cipher => \*(AqDHE\-RSA\-AES256\-GCM\-SHA384:AES256\-SHA\*(Aq
.Ve
.IP blockbadclientcert 2
.IX Item "blockbadclientcert"
Let OpenSSL deny the connection if there is no client certificate.
.Sp
\&\fBWARNING:\fR If the client is listed in the CRL file or an invalid client certifiate has been sent, the connection will be established! You have to ask \fR\f(BIclientCertValid()\fR\fI\fR if you have the \fIcrl\fR option set on \fI\fR\f(BInew()\fR\fI\fR, otherwise to ask \fI\fR\f(BIclientCertNotOnCRL()\fR\fI\fR if the certificate is listed on your CRL file!
.IP ignoreVerifyErrors 2
.IX Item "ignoreVerifyErrors"
\&\fBWARNING:\fR Before using this option, you should be realy sure that you know what you are doing!
.Sp
Specify to ignore specific errors on verifying the certificate chain: This is for example useful to be able to fetch the time from via secure and trusted TLS connection. In this case, your time is wrong, so must ignore time errors, which are 9: X509_V_ERR_CERT_NOT_YET_VALID (certificate is not yet valid) and 10: X509_V_ERR_CERT_HAS_EXPIRED (certificate has expired).
.Sp
The list of errors you can ignore can be found on the documentation:
.Sp
.Sp
Example:
.Sp
.Vb 1
\& ignoreVerifyErrors => [ 9, 10, ]
.Ve
.RE
.RS 4
.RE
.IP handshakeDone(options) 4
.IX Item "handshakeDone(options)"
Returns \fItrue\fR if the handshake is done and all data for handshake has been written out. It accepts the following options:
.RS 4
.IP ignorebuf 2
.IX Item "ignorebuf"
Returns \fItrue\fR if OpenSSL has established the connection, regardless if all data has been written out. This is needed if you want to exchange the Filter of \fIPOE::Wheel::ReadWrite\fR before the first data comes in. This option have been only used by \fR\f(BIdoHandshake()\fR\fI\fR to be able to add new filters before first cleartext data to be processed gets in.
.RE
.RS 4
.RE
.IP clientCertNotOnCRL($file) 4
.IX Item "clientCertNotOnCRL($file)"
Verifies if the serial of the client certificate is not contained in the CRL \f(CW$file\fR. No file caching is done, each call opens the file again.
.Sp
\&\fBWARNING:\fR If your CRL file is missing, can not be opened is empty or has no blocked certificate at all in it, then every call will get blocked!
.IP \fBclientCertIds()\fR 4
.IX Item "clientCertIds()"
Returns an array of every certificate found by OpenSSL. Each element
is again a array. The first element is the value of \fIX509_get_subject_name\fR,
second is the value of \fIX509_get_issuer_name\fR and third element is the
serial of the certificate in binary form. You have to use \fR\f(BIsplit()\fR\fI\fR and
\&\fI\fR\f(BIord()\fR\fI\fR, or the \fI\fR\f(BIhexdump()\fR\fI\fR function, to convert it to a readable form.
.Sp
Example:
.Sp
.Vb 2
\& my ($certid) = ($heap\->{sslfilter}\->clientCertIds());
\& $certid = $certid ? $certid\->[0]."
".$certid\->[1]."
SERIAL=".$heap\->{sslfilter}\->hexdump($certid\->[2]) : \*(AqNo client certificate\*(Aq;
.Ve
.IP \fBgetCipher()\fR 4
.IX Item "getCipher()"
Returns the used cryptographic algorithm and length.
.Sp
Example:
.Sp
.Vb 1
\& $sslfilter\->getCipher()
.Ve
.IP \fBclientCertValid()\fR 4
.IX Item "clientCertValid()"
Returns \fItrue\fR if there is a client certificate that is valid. It
also tests against the CRL, if you have the \fIcacrl\fR option set on \fR\f(BInew()\fR\fI\fR.
.ie n .IP "doHandshake($readWrite, $filter, $filter, ...) !!!REMOVED!!!" 4
.el .IP "doHandshake($readWrite, \f(CW$filter\fR, \f(CW$filter\fR, ...) !!!REMOVED!!!" 4
.IX Item "doHandshake($readWrite, $filter, $filter, ...) !!!REMOVED!!!"
\&\fBWARNING:\fR POE::Filter:SSL now is able to do the ssh handshake now without any helpers. Because of this, this function has been removed!
.Sp
Allows one to add filters after the ssl handshake. It has to be called in the input handler, and needs the passing of the \fIPOE::Wheel::ReadWhile\fR object. If it returns false, you have to return from the input handler.
.Sp
See the \fIHTTPS-Server\fR, \fISSL on an established connection\fR and \fIClient certificate verification\fR examples in \fISYNOPSIS\fR
.IP \fBclientCertExists()\fR 4
.IX Item "clientCertExists()"
Returns \fItrue\fR if there is a client certificate, that might be untrusted.
.Sp
\&\fBWARNING:\fR If the client provides an untrusted client certificate a client certificate that is listed in CRL, this function returns \fItrue\fR. You have to ask \fR\f(BIclientCertValid()\fR\fI\fR if the certificate is valid!
.IP errorhandler 4
.IX Item "errorhandler"
By default, every ssl error is escalated via carp. You may change this behaviour via this option to:
.RS 4
.IP """ignore""" 2
.IX Item """ignore"""
Do not report any error.
.IP \fICODE\fR 2
.IX Item "CODE"
Setting errorhandler to a reference of a function allows one to be called it callback function with the following options:
.Sp
ARG1: POE:SSL::Filter instance
.Sp
ARG2: Ref on a Hash with the following keys:
.Sp
.Vb 5
\& ret The return code of Net::SSLeay::connect (client) or Net::SSLeay::accept (server)
\& ssl The SSL context (SSL_CTX)
\& msg The error message as text, as normally reported via carp
\& get_error The error code of get_error the ssl context
\& error The error code of get_error without context
.Ve
.IP """carp"" (or undef)" 2
.IX Item """carp"" (or undef)"
Do Carp/carp on error.
.IP """confess""" 2
.IX Item """confess"""
Do Carp/confess (stacktrace) on error.
.IP """carponetime""" 2
.IX Item """carponetime"""
Report carp for one occurrence only one time \- over all!
.RE
.RS 4
.RE
.IP debug 4
.IX Item "debug"
Shows debug messages of \fR\f(BIclientCertNotOnCRL()\fR\fI\fR.
.IP hexdump($string) 4
.IX Item "hexdump($string)"
Returns string data in hex format.
.Sp
Example:
.Sp
.Vb 2
\& perl \-e \*(Aquse POE::Filter::SSL; print POE::Filter::SSL\->hexdump("test")."\en";\*(Aq
\& 74:65:73:74
.Ve
.SS "Internal functions and POE::Filter handler"
.IX Subsection "Internal functions and POE::Filter handler"
.IP \fBVERIFY()\fR 2
.IX Item "VERIFY()"
.PD 0
.IP \fBPOE_FILTER_X509_get_serialNumber()\fR 2
.IX Item "POE_FILTER_X509_get_serialNumber()"
.IP \fBPOE_FILTER_SSL_CTX_set_tmp_dh()\fR 2
.IX Item "POE_FILTER_SSL_CTX_set_tmp_dh()"
.IP \fBPOE_FILTER_SSL_CTX_set_tmp_rsa()\fR 2
.IX Item "POE_FILTER_SSL_CTX_set_tmp_rsa()"
.IP \fBPOE_FILTER_SSL_set_tmp_dh()\fR 2
.IX Item "POE_FILTER_SSL_set_tmp_dh()"
.IP \fBclone()\fR 2
.IX Item "clone()"
.IP \fBdoSSL()\fR 2
.IX Item "doSSL()"
.IP \fBget()\fR 2
.IX Item "get()"
.IP \fBget_one()\fR 2
.IX Item "get_one()"
.IP \fBget_one_start()\fR 2
.IX Item "get_one_start()"
.IP \fBget_pending()\fR 2
.IX Item "get_pending()"
.IP \fBwriteToSSLBIO()\fR 2
.IX Item "writeToSSLBIO()"
.IP \fBwriteToSSL()\fR 2
.IX Item "writeToSSL()"
.IP \fBput()\fR 2
.IX Item "put()"
.IP \fBverify_serial_against_crl_file()\fR 2
.IX Item "verify_serial_against_crl_file()"
.IP \fBDOSENDBACK()\fR 2
.IX Item "DOSENDBACK()"
.IP \fBcheckForDoSendback()\fR 2
.IX Item "checkForDoSendback()"
.IP \fBCTX_add_client_CA()\fR 2
.IX Item "CTX_add_client_CA()"
.IP PEMdataToEVP_PKEY 2
.IX Item "PEMdataToEVP_PKEY"
.IP PEMdataToX509 2
.IX Item "PEMdataToX509"
.IP dataToBio 2
.IX Item "dataToBio"
.PD
.SH AUTHOR
.IX Header "AUTHOR"
Markus Schraeder, \f(CW\*(C`\*(C'\fR
.SH BUGS
.IX Header "BUGS"
Please report any bugs or feature requests to \f(CW\*(C`bug\-poe\-filter\-ssl at rt.cpan.org\*(C'\fR, or through
the web interface at . I will be notified, and then you'll
automatically be notified of progress on your bug as I make changes.
.SH SUPPORT
.IX Header "SUPPORT"
You can find documentation for this module with the perldoc command.
.PP
.Vb 1
\& perldoc POE::Filter::SSL
.Ve
.PP
You can also look for information at:
.IP \(bu 4
RT: CPAN's request tracker
.Sp
.IP \(bu 4
AnnoCPAN: Annotated CPAN documentation
.Sp
.IP \(bu 4
CPAN Ratings
.Sp
.IP \(bu 4
Search CPAN
.Sp
.SH "Commercial support"
.IX Header "Commercial support"
Commercial support can be gained at .
.PP
Used in our products, you can find on
.SH "COPYRIGHT & LICENSE"
.IX Header "COPYRIGHT & LICENSE"
Copyright 2010\-2017 Markus Schraeder, CryptoMagic GmbH, all rights reserved.
.PP
This program is free software; you can redistribute it and/or modify it
under the same terms as Perl itself.