AnyEvent
view release on metacpan or search on metacpan
TODO: invalid. and localhost. specialcasing inside AEDNS and not AESocket (rfc6761)
TODO: maybe implement env variable to give hosts precedence
TODO: more formats for parse_ipv6 (single ipv6 address without port, ...p80, ...#80)
TODO: inet_aton maybe pack C4? no, add a comment why not
TODO: socket prepare callbacks, can they easily signal failure as well?
TODO: Олег Г <verdrehung@gmail.com>, empty A record response causes
AnyEvent::resolve_sockaddr to eventually call pack_sockaddr with undef -
broken dns server, but maybe improve the response.
7.17 Wed Sep 18 03:04:49 CEST 2019
- work around antique openssl version in RHEL 7 by formatting
dh parameters differently (reported by several people).
- add t/13_weaken.t.
7.16 Fri Jul 19 18:00:21 CEST 2019
- add ffdhe group dh parameters from RFC 7919, and use ffdhe3072
as new default, instead of schmorp1539.
- AnyEvent::Log did not reassess logging status of
AnyEvent::Log::logger's when contexts were changed with
->attach/detach/slaves, causing them to not log even though a
recent attach should have caused them to log.
- added some more logging configuration examples.
- mention RFC 8482 in AnyEvent::DNS.
7.15 Tue Feb 26 03:07:42 CET 2019
- INCOMPATIBLE CHANGE: AnyEvent::Handle's tls_detect documentation gave
separate major and minor versions, while code passed only a single
value. This version follows the documentation and now passes separate
major and minor values.
- work around Net::SSLeay not having been ported to openssl 1.1, but many
distributions compiling it against openssl 1.1, which unfortunately
succeeds and results in a very broken module.
- AnyEvent::DNS::dns_unpack now stores the original DNS packet
in the __ member, to allow decoding of undecodable resouce records
containing compressed domian names.
- AnyEvent::Socket::parse_ipv6 would NOT, as advertised, accept ipv4
addresses. It now does and converts them to ipv4 mapped addresses.
- support CAA records, based on patch by Steve Atkins.
- add freenom and cloudflare nameservers as dns fallback.
- AnyEvent::Strict would not properly ward against io watchers
on files when the handle passed was a file descriptor.
- document "internal" variables used by the dns en-/decoder to allow
enterprising users to extend them in a semi-official way.
7.14 Sat Jun 24 01:44:19 CEST 2017
- fix a crash bug in AnyEvent::Handle with openssl 1.1.0 (patched
by Paul Howarth and apparently tracked down by Mike McCauley).
- AnyEvent::Handle->keepalive was documented (and defined) twice
(found by Matt Merhar).
- AnyEvent::Socket::tcp_bind/tcp_server would immediately unlink a unix
listening socket unless a guard is used. Change this so that no
cleanup will be performed unless a guard is used and document this more
clearly.
- make tcp_bind/tcp_server error messages more regular.
- work around latest perl upstream breakage - this time, perl5porters were
apparently bullied by a bogus CVE (CVE-2016-1238), and since distros
- changed default dns resolver "max_outstanding" value from 1 to 10,
the latter beinfg the intended value all along
(reported by Ilya Chesnokov).
- added new "AnyEvent::Impl::UV" interface module to the UV event lib
(written by Mike Lowell).
7.07 Tue Dec 17 17:45:02 CET 2013
- the documentation for custom tls verify schemes was wrong. make it agree
with the code (reported by Maxime Soulé).
- added cbor read and write types to AnyEvent::Handle (using CBOR::XS).
- work around an API change in openssl that could cause wrong tls connection
aborts, likely on windows only (analyzed by sten).
- calling AnyEvent->now_update with AnyEvent::Impl::Perl caused an
endless loop (reported by Dietrich Rebmann).
- add tlsv1_1 and tlsv1_2 protocols to AnyEvent::TLS
(patch by Maxime Soulé).
- document AnyEvent::Impl::IOAsync::set_loop and
$AnyEvent::Impl::IOAsync::LOOP. Though only documented now, this
functionality has _always_ been available.
- force a toplevel domain name in t/81_hosts.t (analyzed by
David Jack Wange Olrik).
- updated uts46data.pl for unicode 6.1.0.
- made log messages generated by AnyEvent submodules not
include the package name anymore, as it will be logged
by default already.
- upgrade to the trick used by common-sense 3.5 to work
around extra warning torture/breakage under perl 5.15.x.
- log messages by anyevent are now ucfirst, are usually full
sentences and do no longer include the package name.
- the storable read type would sometimes throw an exception instead
of causing EBADMSG (analyzed by Maxime Soulé).
- work around a bug in openssl 1.0.1 which enforces a minimum rsa
keysize (reported by Paul Howarth).
- documented Rocco fabricating statements about AnyEvent and me.
6.14 Tue Jan 31 20:00:24 CET 2012
- AnyEvent::Impl::Tk was broken due to a mysterious "die" inside,
probably an editing mistake (reported by Darin McBride).
6.13 Thu Jan 12 07:27:01 CET 2012
- AnyEvent::Util::fork_call checked for POSIX availability in the wrong way,
causing it to fail if POSIX wasn't loaded already (analysed by Rock Power).
- add support for FLTK (fltk2), via AnyEvent::Impl::FLTK2.
- many read types in AnyEvent::Handle would malfunction during
transitions to TLS because of a "delete $self->{rbuf}".
(reported by Gerald Galster).
- improve condvar blocking wait performance (probably only noticable
with faster backends), also make it easier for event loops that
do not support blocking waits.
- PERL_ANYEVENT_MODEL now also allows full module names, although
the usefulness of this feature is not yet clear.
- add tests for all supported event loops, conditional on PERL_ANYEVENT_LOOP_TESTS.
- add t/80_ssltext.t.
- no longer use AUTOLOAD for the initial loading (for no very good reason).
- tcp_server now tries to unlink unix domain sockets when it gets destroyed.
- do not run event loop detection multiple times when programs call their cached
copies of AnyEvent::detect.
- parse_hostport now accepts absolute paths als unix domain sockets.
- suppress the idiotic warning inside POE by patching the POE::Kernel
run flags instead of asking the user to jump through contortions.
- add Task::Weaken as dependency (as recommends only at this time).
- replace PF_UNSPEC by 0, for good old minix.
code to cope with both AnyEvent and AE APIs.
5.251 Sat Mar 13 00:58:21 CET 2010
- make test failed if it was run before make install on perl <=
5.8.8, and older versions of perl make our live very difficult,
so write constants.pl during Makefile.PL time.
5.25 Sat Mar 13 00:23:14 CET 2010
- fix a race condition in AnyEvent::Handle that would cause
a "bio_read: unsupported method" error (in _another_
ssl connection) after user code threw an exception.
- added AnyEvent::Handle->destroyed method.
- speed up AnyEvent::Socket::format_address and ::format_ipv6.
- the AnyEvent::Util::fh_nonblocking function worked only
by lucky accident on win32.
- smaller and faster AnyEvent::Util::fh_nonblocking.
- when the (required!) Time::HiRes module is missing, AnyEvent
did not fall back to built-in time properly.
- do not load Fcntl at runtime, saving memory and loading time.
- precompile a number of constants and use them instead of runtime
detection and eval.
AnyEvent::DNS, thus avoiding an exception (reported by Anatoly
K. Sharifulin).
4.2 Sat Jul 12 22:42:11 CEST 2008
- support an "interval" argument for repeating timers.
- fix a bug in the pure perl event loop that caused timers to
be delayed under some circumstances.
- implement optional argument checking via PERL_ANYEVENT_STRICT.
- not importing anything from Event causes it to malfunction
and not use Time::HiRes, work around this bug.
- more bug workarounds against the endlessly broken Tk module,
seems to work now on 32 bit machines, but less so on 64 bit.
- minor optimisations applied to most backends.
4.161 Fri Jul 4 14:24:48 CEST 2008
- fixed the t/handle/02_write.t, it read after write, with the
assumption that all data could be written before read
(reported by Jim Razmus).
4.160 Thu Jul 3 04:02:21 CEST 2008
- re-registering signal watchers after unregistering one did
t/10_loadall.t
t/io_common
t/11_io_perl.t
t/12_io_ioaio.t
t/13_weaken.t
t/handle/01_readline.t
t/handle/02_write.t
t/handle/03_http_req.t
t/handle/04_listen.t
t/80_ssltest.t
t/81_hosts.t
eg/bench
eg/runbench
eg/bench2
eg/runbench2
eg/connect
eg/listen
eg/handle
eg/ae0.pl
lib/AnyEvent/Handle.pm view on Meta::CPAN
});
=cut
register_read_type tls_detect => sub {
my ($self, $cb) = @_;
sub {
# this regex matches a full or partial tls record
if (
# ssl3+: type(22=handshake) major(=3) minor(any) length_hi
$self->{rbuf} =~ /^(?:\z| \x16 (\z| [\x03\x04] (?:\z| . (?:\z| [\x00-\x40] ))))/xs
# ssl2 comapatible: len_hi len_lo type(1) major minor dummy(forlength)
or $self->{rbuf} =~ /^(?:\z| [\x80-\xff] (?:\z| . (?:\z| \x01 (\z| [\x03\x04] (?:\z| . (?:\z| . ))))))/xs
) {
return if 3 != length $1; # partial match, can't decide yet
# full match, valid TLS record
my ($major, $minor) = unpack "CC", $1;
$cb->($self, "accept", $major, $minor);
} else {
# mismatch == guaranteed not TLS
$cb->($self, undef);
lib/AnyEvent/Handle.pm view on Meta::CPAN
&_freetls;
} else {
&_freetls;
$self->_error (Errno::EPROTO, 1, $err);
}
}
# poll the write BIO and send the data if applicable
# also decode read data if possible
# this is basiclaly our TLS state machine
# more efficient implementations are possible with openssl,
# but not with the buggy and incomplete Net::SSLeay.
sub _dotls {
my ($self) = @_;
my $tmp;
while (length $self->{_tls_wbuf}) {
if (($tmp = Net::SSLeay::write ($self->{tls}, $self->{_tls_wbuf})) <= 0) {
$tmp = Net::SSLeay::get_error ($self->{tls}, $tmp);
lib/AnyEvent/Handle.pm view on Meta::CPAN
$ctx = $TLS_CACHE{$key} ||= new AnyEvent::TLS %$ctx;
} else {
$ctx = new AnyEvent::TLS %$ctx;
}
}
$self->{tls_ctx} = $ctx || TLS_CTX ();
$self->{tls} = $tls = $self->{tls_ctx}->_get_session ($tls, $self, $self->{peername});
# basically, this is deep magic (because SSL_read should have the same issues)
# but the openssl maintainers basically said: "trust us, it just works".
# (unfortunately, we have to hardcode constants because the abysmally misdesigned
# and mismaintained ssleay-module didn't offer them for a decade or so).
# http://www.mail-archive.com/openssl-dev@openssl.org/msg22420.html
#
# in short: this is a mess.
#
# note that we do not try to keep the length constant between writes as we are required to do.
# we assume that most (but not all) of this insanity only applies to non-blocking cases,
# and we drive openssl fully in blocking mode here. Or maybe we don't - openssl seems to
# have identity issues in that area.
# Net::SSLeay::set_mode ($ssl,
# (eval { local $SIG{__DIE__}; Net::SSLeay::MODE_ENABLE_PARTIAL_WRITE () } || 1)
# | (eval { local $SIG{__DIE__}; Net::SSLeay::MODE_ACCEPT_MOVING_WRITE_BUFFER () } || 2));
Net::SSLeay::set_mode ($tls, 1|2);
$self->{_rbio} = Net::SSLeay::BIO_new (Net::SSLeay::BIO_s_mem ());
$self->{_wbio} = Net::SSLeay::BIO_new (Net::SSLeay::BIO_s_mem ());
Net::SSLeay::BIO_write ($self->{_rbio}, $self->{rbuf});
$self->{rbuf} = "";
lib/AnyEvent/Handle.pm view on Meta::CPAN
sub stoptls {
my ($self) = @_;
if ($self->{tls} && $self->{fh}) {
Net::SSLeay::shutdown ($self->{tls});
&_dotls;
# # we don't give a shit. no, we do, but we can't. no...#d#
# # we, we... have to use openssl :/#d#
# &_freetls;#d#
}
}
sub _freetls {
my ($self) = @_;
return unless $self->{tls};
$self->{tls_ctx}->_put_session (delete $self->{tls})
lib/AnyEvent/Handle.pm view on Meta::CPAN
clearing the C<on_eof> callback and in the C<on_error> callback, the data
will be in C<$_[0]{rbuf}>:
$handle->on_read (sub { });
$handle->on_eof (undef);
$handle->on_error (sub {
my $data = delete $_[0]{rbuf};
});
Note that this example removes the C<rbuf> member from the handle object,
which is not normally allowed by the API. It is expressly permitted in
this case only, as the handle object needs to be destroyed afterwards.
The reason to use C<on_error> is that TCP connections, due to latencies
and packets loss, might get closed quite violently with an error, when in
fact all data has been received.
It is usually better to use acknowledgements when transferring data,
to make sure the other side hasn't just died and you got the data
intact. This is also one reason why so many internet protocols have an
explicit QUIT command.
lib/AnyEvent/Impl/FLTK.pm view on Meta::CPAN
my ($class, %arg) = @_;
# only one watcher/fd :(
my $cb = $arg{cb};
my ($fh, $ev) = AnyEvent::_dupfh $arg{poll}, $arg{fh},
FLTK::READ,
FLTK::WRITE | (AnyEvent::WIN32 ? FLTK::EXCEPT : 0);
# fltk hardcodes poll constants and aliases EXCEPT with POLLERR,
# which is grossly wrong, but likely it doesn't use poll on windows.
FLTK::add_fd $fh, $ev, sub { &$cb }
}
# use signal and child emulation - fltk has no facilities for that
# fltk idle watchers are like EV::check watchers, and fltk check watchers
# are like EV::prepare watchers. both are called when the loop is busy,
# so we have to use idle watcher emulation.
sub _poll {
lib/AnyEvent/Impl/POE.pm view on Meta::CPAN
POE has other weird messages, and sometimes weird behaviour, for example,
it doesn't support overloaded code references as callbacks for no apparent
reason.
=item One POE session per Event
AnyEvent has to create one POE::Session per event watcher, which is
immensely slow and makes watchers very large. The reason for this is
lacking lifetime management (mostly undocumented, too). Without one
session/watcher it is not possible to easily keep the kernel from running
endlessly.
This is not just a problem with the way AnyEvent has to interact with
POE, but is a principal issue with POEs lifetime management (namely
that stopping the kernel stops sessions, but AnyEvent has no control
over who and when the kernel starts or stops w.r.t. AnyEvent watcher
creation/destruction).
From benchmark data it is not clear that session creation is that costly,
though - the real inefficiencies with POE seem to come from other sources,
such as event handling.
lib/AnyEvent/Impl/POE.pm view on Meta::CPAN
It gets worse, though - the notion of "task" or "resource", although used
throughout the documentation, is not defined in a usable way. For example,
waiting for a timeout is considered to be a task, waiting for a signal is
not (a session that only waits for a signal is considered finished and
gets removed). The user is left guessing when waiting for an event counts
as task and when not (in fact, the issue with signals is mentioned in
passing in a section about child watchers and directly contradicts earlier
parts in that document).
One could go on endlessly - ten years, no usable documentation.
It is likely that differences between documentation, or the one or two
things I had to guess, cause unanticipated problems with this adaptor.
=item Fragile and inconsistent API
The POE API is extremely inconsistent - sometimes you have to pass a
session argument, sometimes it gets ignored, sometimes a session-specific
method must not use a session argument.
lib/AnyEvent/TLS.pm view on Meta::CPAN
use AnyEvent::Handle;
use AnyEvent::Socket;
# simple https-client
my $handle = new AnyEvent::Handle
connect => [$host, $port],
tls => "connect",
tls_ctx => { verify => 1, verify_peername => "https" },
...
# simple ssl-server
tcp_server undef, $port, sub {
my ($fh) = @_;
my $handle = new AnyEvent::Handle
fh => $fh,
tls => "accept",
tls_ctx => { cert_file => "my-server-keycert.pem" },
...
# directly
lib/AnyEvent/TLS.pm view on Meta::CPAN
# (http://www.skip-vpn.org/spec/numbers.html).
# (or http://web.archive.org/web/20011212141438/http://www.skip-vpn.org/spec/numbers.html#params)
# See there for how they were generated.
# Note that g might not be a generator,
# but this is not a problem since p is a safe prime.
skip512 => "MEYCQQD1Kv884bEpQBgRjXyEpwpy1obEAxnIByl6ypUM2Zafq9AKUJsCRtMIPWak|XUGfnHy9iUsiGSa6q6Jew1XpKgVfAgEC",
skip1024 => "MIGHAoGBAPSI/VhOSdvNILSd5JEHNmszbDgNRR0PfIizHHxbLY7288kjwEPwpVsY|jY67VYy4XTjTNP18F1dDox0YbN4zISy1Kv884bEpQBgRjXyEpwpy1obEAxnIByl6|ypUM2Zafq9AKUJsCRtMIPWakXUGfnHy9iUsiGSa6q6Jew1XpL3jHAgEC",
skip2048 => "MIIBCAKCAQEA9kJXtwh/CBdyorrWqULzBej5UxE5T7bxbrlLOCDaAadWoxTpj0BV|89AHxstDqZSt90xkhkn4DIO9ZekX1KHTUPj1WV/cdlJPPT2N286Z4VeSWc39uK50|T8X8dryDxUcwYc58yWb/Ffm7/ZFexwGq01uejaClcjrUGvC/RgBYK+X0iP1YTknb|zSC0neSRBzZrM2w4DUUdD3yIsxx8Wy2O9vPJI8B...
skip4096 => "MIICCAKCAgEA+hRyUsFN4VpJ1O8JLcCo/VWr19k3BCgJ4uk+d+KhehjdRqNDNyOQ|l/MOyQNQfWXPeGKmOmIig6Ev/nm6Nf9Z2B1h3R4hExf+zTiHnvVPeRBhjdQi81rt|Xeoh6TNrSBIKIHfUJWBh3va0TxxjQIs6IZOLeVNRLMqzeylWqMf49HsIXqbcokUS|Vt1BkvLdW48j8PPv5DsKRN3tloTxqDJGo9tKvj1...
# generated on a linux desktop with openssl using /dev/urandom - entropy_avail was >= 3600 each time
# the 8192 bit key took 25 hours to generate :/
schmorp1024 => "MIGHAoGBAN+GjqAhNxLesSuGfDzYe6HdexXtHuxe85umshfPHfnmLSkGWl/FE27+|v+50mwY5XaNnCmo1VvGju4iTKxWoZTGgslUSc8KX197XWAXIpab8ESyg442if9Kr|vSOuu0fopwvvTOgHK8mkEWI4joU5G4/MQy+pnC5NIEVBP4HtGiTrAgEC",
schmorp1539 => "MIHHAoHBByJzpVGUsXysX8w/+uuXRUCL9exhAixoHkaJU5lf4noJUtp9F0yr/5rb|hF8M9mSZJ+RlPyB+Zt37GPp1WQDO1+/2yZJX9kHE3+h5JCRoR8PKc2G+ts9jhM7r|CnTQ0z0b6s12Pusf+UhQPwLust4JAYE/LPuTK8yFiVx5L2a+aZhGMVlYN/12SEtY|jRl3lGXdZj9g8E2PzTQbA9CGy5dGIvz/ENTz...
schmorp2048 => "MIIBCAKCAQEAhR5Fn9h3Tgnc+q4o3CMkZtre3lLUyDT+1bf3aiVOt22JdDQndZLc|FeKz8AqliB3UIgNExc6oDtuG4znKPgklfOnHv/a9tl1AYQbV+QFM/E0jYl6oG8tF|Epgxezt1GCivvtu64ql0s213wr64QffNMt3hva8lNqK1PXfqp13PzzLzAVsfghrv|fMAX7/bYm1T5fAJdcah6FeZkKof+mqbs8HtR...
schmorp4096 => "MIICCAKCAgEA5WwA5lQg09YRYqc/JILCd2AfBmYBkF19wmCEJB8G3JhTxv8EGvYk|xyP2ecKVUvHTG8Xw/qpW8nRqzPIyV8QRf6YFYSf33Qnx2xYhcnqOumU3nfC0SNOL|/w2q1BA9BbHtW4574P+6hOQx9ftRtbtZ2HPKBMRcAKGjpYZiKopv0+UAM4NpEC2p|bfajp7pyVLeb/Aqm/oWP3L63wPlY1SDp+XRz...
schmorp8192 => "MIIECAKCBAEA/SAEbRSSLenVxoInHiltm/ztSwehGOhOiUKfzDcKlRBZHlCC9jBl|S/aeklM6Ucg8E6J2bnfoh6CAdnE/glQOn6CifhZr8X/rnlL9/eP+r9m+aiAw4l0D|MBd8BondbEqwTZthMmLtx0SslnevsFAZ1Cj8WgmUNaSPOukvJ1N7aQ98U+E99Pw3|VG8ANBydXqLqW2sogS8FtZoMbVywcQuaGmC7...
# finite field dhe parameters, some taken from firefox, some directly from RFC 7919
ffdhe2048 => "MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz+8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjc...
ffdhe3072 => "MIIBiAKCAYEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz+8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjc...
lib/AnyEvent/TLS.pm view on Meta::CPAN
while C<any> (the default) uses a parser capable of all three
protocols.
The default is to use C<"any"> but disable SSLv2. This has the effect of
sending a SSLv2 hello, indicating the support for SSLv3 and TLSv1, but not
actually negotiating an (insecure) SSLv2 connection.
Specifying a specific version is almost always wrong to use for a server
speaking to a wide variety of clients (e.g. web browsers), and often wrong
for a client. If you only want to allow a specific protocol version, use
the C<sslv2>, C<sslv3>, C<tlsv1>, C<tlsv1_1> or C<tlsv1_2> arguments instead.
For new services it is usually a good idea to enforce a C<TLSv1> method
from the beginning.
C<TLSv1_1> and C<TLSv1_2> require L<Net::SSLeay> >= 1.55 and OpenSSL
>= 1.0.1. Check the L<Net::SSLeay> and OpenSSL documentations for more
details.
=item sslv2 => $enabled
Enable or disable SSLv2 (normally I<disabled>).
=item sslv3 => $enabled
Enable or disable SSLv3 (normally I<enabled>).
=item tlsv1 => $enabled
Enable or disable TLSv1 (normally I<enabled>).
=item tlsv1_1 => $enabled
Enable or disable TLSv1_1 (normally I<enabled>).
lib/AnyEvent/TLS.pm view on Meta::CPAN
You have to enable verify mode (C<< verify => 1 >>) for this parameter to
have any effect.
=item ca_path => $path
If this parameter is specified and non-empty, it will be
the path to a directory with hashed CA certificate files in
PEM format. When the ca certificate is being verified, the
certificate will be hashed and looked up in that directory (see
L<http://www.openssl.org/docs/ssl/SSL_CTX_load_verify_locations.html> for
details)
The certificates specified via C<ca_file> take precedence over the ones
found in C<ca_path>.
You have to enable verify mode (C<< verify => 1 >>) for this parameter to
have any effect.
=item ca_cert => $string
lib/AnyEvent/TLS.pm view on Meta::CPAN
AnyEvent::TLS object is created and will be reused.
All the DH parameters supplied with AnyEvent::TLS should be safe with
C<dh_single_use> switched off, but YMMV.
=item cipher_list => $string
The list of ciphers to use, as a string (example:
C<AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH>). The format
of this string and its default value is documented at
L<http://www.openssl.org/docs/apps/ciphers.html#CIPHER_STRINGS>.
=item session_ticket => $enable
Enables or disables RC5077 support (Session Resumption without Server-Side
State). The default is disabled for clients, as many (buggy) TLS/SSL
servers choke on it, but enabled for servers.
When enabled and supported by the server, a session ticket will be
provided to the client, which allows fast resuming of connections.
lib/AnyEvent/TLS.pm view on Meta::CPAN
=cut
#=item trust => $trust
#
#Sets the expected (root) certificate use on this context, i.e. what
#certificates to trust. The default is C<compat>, and the following strings
#are supported:
#
# compat any certifictae will do
# ssl_client only trust client certificates
# ssl_server only trust server certificates
# email only trust e-mail certificates
# object_sign only trust signing (CA) certificates
# ocsp_sign only trust ocsp signing certs
# ocsp_request only trust ocsp request certs
# purpose?
#TODO
# verify_depth?
# reuse_ctx
lib/AnyEvent/TLS.pm view on Meta::CPAN
#=cut
=back
=cut
sub init ();
#our %X509_TRUST = (
# compat => 1,
# ssl_client => 2,
# ssl_server => 3,
# email => 4,
# object_sign => 5,
# ocsp_sign => 6,
# ocsp_request => 7,
#);
BEGIN {
eval 'sub _check_tls_gt_1 (){'
. (($Net::SSLeay::VERSION >= 1.55 && Net::SSLeay::OPENSSL_VERSION_NUMBER() >= 0x1000100f) * 1)
. '}';
# as of this writing, Net::SSLeay (1.85-2) has not been ported to OpenSSL 1.1,
# but many distributions and users compile it against openssl 1.1, leading to
# many symbols not being defined because they are now enums instead of macros
# and have different prefixes.
# The only one we use is SSL_ST_OK, or TLS_ST_OK, which should be available
# as Net::SSLeay::ST_OK. If it is not callable, we define it to be 1, which
# hopefully will not change.
eval 'Net::SSLeay::ST_OK (); 1'
or *Net::SSLeay::ST_OK = sub () { 1 };
}
our %SSL_METHODS = (
any => \&Net::SSLeay::CTX_new,
sslv23 => \&Net::SSLeay::CTX_new, # deliberately undocumented
sslv2 => \&Net::SSLeay::CTX_v2_new,
sslv3 => \&Net::SSLeay::CTX_v3_new,
tlsv1 => \&Net::SSLeay::CTX_tlsv1_new,
);
# Add TLSv1_1 and TLSv1_2 if Net::SSLeay and openssl allow them
if (_check_tls_gt_1) {
$SSL_METHODS{tlsv1_1} = \&Net::SSLeay::CTX_tlsv1_1_new;
$SSL_METHODS{tlsv1_2} = \&Net::SSLeay::CTX_tlsv1_2_new;
} else {
for my $method (qw(tlsv1_1 tlsv1_2)) {
$SSL_METHODS{$method} = sub { croak "AnyEvent::TLS method '$method' requires openssl v1.0.1 and Net::SSLeay 1.55 or higher" };
}
}
sub new {
my ($class, %arg) = @_;
init unless $REF_IDX;
my $method = lc $arg{method} || "any";
my $ctx = ($SSL_METHODS{$method}
|| croak "'$method' is not a valid AnyEvent::TLS method (must be one of @{[ sort keys %SSL_METHODS ]})")->();
my $self = bless { ctx => $ctx }, $class; # to make sure it's destroyed if we croak
my $op = Net::SSLeay::OP_ALL ();
$op |= Net::SSLeay::OP_NO_SSLv2 () unless $arg{sslv2};
$op |= Net::SSLeay::OP_NO_SSLv3 () if exists $arg{sslv3} && !$arg{sslv3};
$op |= Net::SSLeay::OP_NO_TLSv1 () if exists $arg{tlsv1} && !$arg{tlsv1};
$op |= Net::SSLeay::OP_NO_TLSv1_1 () if exists $arg{tlsv1_1} && !$arg{tlsv1_1} && _check_tls_gt_1;
$op |= Net::SSLeay::OP_NO_TLSv1_2 () if exists $arg{tlsv1_2} && !$arg{tlsv1_2} && _check_tls_gt_1;
$op |= Net::SSLeay::OP_SINGLE_DH_USE () if !exists $arg{dh_single_use} || $arg{dh_single_use};
Net::SSLeay::CTX_set_options ($ctx, $op);
Net::SSLeay::CTX_set_cipher_list ($ctx, $arg{cipher_list})
or croak "'$arg{cipher_list}' was not accepted as a valid cipher list by AnyEvent::TLS"
if exists $arg{cipher_list};
lib/AnyEvent/TLS.pm view on Meta::CPAN
Net::SSLeay::CTX_use_PrivateKey_file
($ctx, $arg{key_file}, Net::SSLeay::FILETYPE_PEM ())
or croak "$arg{key_file}: failed to load local private key (key_file or key)";
Net::SSLeay::CTX_use_certificate_chain_file ($ctx, $arg{cert_file})
or croak "$arg{cert_file}: failed to use local certificate chain (cert_file or cert)";
}
if ($arg{check_crl}) {
Net::SSLeay::OPENSSL_VERSION_NUMBER () >= 0x00090702f
or croak "check_crl requires openssl v0.9.7b or higher";
Net::SSLeay::X509_STORE_set_flags (
Net::SSLeay::CTX_get_cert_store ($ctx),
Net::SSLeay::X509_V_FLAG_CRL_CHECK ());
}
Net::SSLeay::CTX_set_read_ahead ($ctx, 1);
$arg{prepare}->($self)
if $arg{prepare};
$self
}
=item $tls = new_from_ssleay AnyEvent::TLS $ctx
This constructor takes an existing L<Net::SSLeay> SSL_CTX object
(which is just an integer) and converts it into an C<AnyEvent::TLS>
object. This only works because AnyEvent::TLS is currently implemented
using Net::SSLeay. As this is such a horrible perl module and OpenSSL has
such an annoying license, this might change in the future, in which case
this method might vanish.
=cut
sub new_from_ssleay {
my ($class, $ctx) = @_;
bless { ctx => $ctx }, $class
}
=item $ctx = $tls->ctx
Returns the actual L<Net::SSLeay::CTX> object (just an integer).
=cut
lib/AnyEvent/TLS.pm view on Meta::CPAN
$preverify_ok &&= $self->_verify_hostname ($cn, $cert)
unless $depth;
$preverify_ok = $self->{verify_cb}->($self, $ref, $cn, $depth, $preverify_ok, $x509_store_ctx, $cert)
if $self->{verify_cb};
$preverify_ok
}
#=item $ssl = $tls->_get_session ($mode[, $ref])
#
#Creates a new Net::SSLeay::SSL session object, puts it into C<$mode>
#(C<accept> or C<connect>) and optionally associates it with the given
#C<$ref>. If C<$mode> is already a C<Net::SSLeay::SSL> object, then just
#associate data with it.
#
#=cut
#our %REF_MAP;
our $TLS_SNI_WARNED;
lib/AnyEvent/TLS.pm view on Meta::CPAN
Net::SSLeay::free ($session);
}
#sub _ref($) {
# $REF_MAP{Net::SSLeay::get_ex_data ($_[0], $REF_IDX)}
#}
sub DESTROY {
my ($self) = @_;
# better be safe than sorry with net-ssleay
Net::SSLeay::CTX_set_default_passwd_cb ($self->{ctx});
Net::SSLeay::CTX_free ($self->{ctx});
}
=item AnyEvent::TLS::init
AnyEvent::TLS does on-demand initialisation, and normally there is no need to call an initialise
function.
lib/AnyEvent/TLS.pm view on Meta::CPAN
=cut
sub init() {
return if $REF_IDX;
AE::log 5 => "Net::SSLeay versions older than 1.33 might malfunction."
if $Net::SSLeay::VERSION < 1.33;
Net::SSLeay::load_error_strings ();
Net::SSLeay::SSLeay_add_ssl_algorithms ();
Net::SSLeay::randomize ();
$REF_IDX = Net::SSLeay::get_ex_new_index (0, 0, 0, 0, 0)
until $REF_IDX; # Net::SSLeay uses id #0 for its own stuff without allocating it
}
=item $certname = AnyEvent::TLS::certname $x509
Utility function that returns a user-readable string identifying the X509
certificate object.
lib/AnyEvent/Util.pm view on Meta::CPAN
If there are any errors, then the C<$cb> will be called without any
arguments. In that case, either C<$@> contains the exception (and C<$!> is
irrelevant), or C<$!> contains an error number. In all other cases, C<$@>
will be C<undef>ined.
The code block must not ever call an event-polling function or use
event-based programming that might cause any callbacks registered in the
parent to run.
Win32 spoilers: Due to the endlessly sucky and broken native windows
perls (there is no way to cleanly exit a child process on that platform
that doesn't also kill the parent), you have to make sure that your main
program doesn't exit as long as any C<fork_calls> are still in progress,
otherwise the program won't exit. Also, on most windows platforms some
memory will leak for every invocation. We are open for improvements that
don't require XS hackery.
Note that forking can be expensive in large programs (RSS 200MB+). On
windows, it is abysmally slow, do not expect more than 5..20 forks/s on
that sucky platform (note this uses perl's pseudo-threads, so avoid those
lib/AnyEvent/Util.pm view on Meta::CPAN
close $r;
--$forks;
_fork_schedule;
my $result = eval { Storable::thaw ($buf) };
$result = [$@] unless $result;
$@ = shift @$result;
$cb->(@$result);
# work around the endlessly broken windows perls
kill 9, $pid if AnyEvent::WIN32;
# clean up the pid
waitpid $pid, 0;
}
};
} elsif (defined $pid) {
# child
close $r;
lib/AnyEvent/Util.pm view on Meta::CPAN
Example: run C<rm -rf />, redirecting standard input, output and error to
F</dev/null>.
my $cv = run_cmd [qw(rm -rf /)],
"<", "/dev/null",
">", "/dev/null",
"2>", "/dev/null";
$cv->recv and die "d'oh! something survived!"
Example: run F<openssl> and create a self-signed certificate and key,
storing them in C<$cert> and C<$key>. When finished, check the exit status
in the callback and print key and certificate.
my $cv = run_cmd [qw(openssl req
-new -nodes -x509 -days 3650
-newkey rsa:2048 -keyout /dev/fd/3
-batch -subj /CN=AnyEvent
)],
"<", "/dev/null",
">" , \my $cert,
"3>", \my $key,
"2>", "/dev/null";
$cv->cb (sub {
shift->recv and die "openssl failed";
print "$key\n$cert\n";
});
=cut
sub run_cmd {
my $cmd = shift;
require POSIX unless $POSIX::VERSION;
( run in 1.581 second using v1.01-cache-2.11-cpan-acf6aa7dc9e )