Beefy Boxes and Bandwidth Generously Provided by pair Networks
No such thing as a small change

Encrypting XML-RPC

by Malach (Scribe)
on Mar 07, 2001 at 07:43 UTC ( [id://62658]=perlquestion: print w/replies, xml ) Need Help??

Malach has asked for the wisdom of the Perl Monks concerning the following question:

OK, so I've got this nice wee application thingy that I'm writing.

Different parts of it (potentially on different machines) exchange data using xml-rpc (using the Frontier::RPC2 modules). On a private network, this is all well and good. Working fine, easy to do.

That's not the problem.

The problem is that I want to be able to have this working remotely... meaning that the data will be transmitted across the internet... which, I'd rather didn't happen in plain (XML) text, for the world to see.

Now, I can use something like stunnel (I've been told), but for the sake of tidiness, I'd like to not use external applications. Doing this all in perl would be a *lot* nicer.

So, the question. Can I encrypt XML-RPC data, and still use the stock Frontier::RPC2 modules? Or, will I have to do commit some strange acts of deviancy (that are probably outside my skillset) upon the modules to make this happen?

Any and all suggestions, ideas, or constructive LARTs appreciated.


Replies are listed 'Best First'.
Re: Encrypting XML-RPC
by merlyn (Sage) on Mar 07, 2001 at 08:07 UTC

      OK, I'm guessing that I'm missing something here....

      The Frontier::RPC2 module (more specifically, Frontier::Daemon) includes a simple webserver (using HTTP::Daemon) which, as far as I can tell doesn't support SSL.

      For those not familiar with the Frontier::RPC2 modulles, the same command that converts the data into XML, also sends it out.. likewise, at the other end, the same process that takes the data in, also gets it out of XML, so it can be used.

      So, based on this, I don't see how Merlyns suggestion works..... (I'm guessing that it doesn't, but as I have far more respect for merlyns knowledge than my own, I'd not be surprised to be proven wrong here....)

      My guess, having thought further on this, (and based on the assumption that merlyns suggestion is somehow, not workable) is that to get what I want, I'll have to make alterations/additions to the Frontier::??? modules, so they support some sort of encryption of the XML data objects.

      Of course, a more detailed explanation of merlyns answer would suit me down to the ground, if anyone feels like using small enough words...... *grin*


        OK, I am going to try unpack-ing merlyn's word. Just understand that I have not used XML::RPC yet, nor Crypt::SSLeay so I haven't tested anything. I hope you do and report back ;--)

        On the client side Frontier::Client relies on LWP::UserAgent to post the XML RPC. Crypt-SSLeay allows you to switch the regular POST to an encrypted one:

        # straight from the synopsys use LWP::UserAgent; my $ua = new LWP::UserAgent; my $req = new HTTP::Request('GET', ''); my $res = $ua->request($req); print $res->code."\n";

        So on the client side things should be OK, as merlyn saidyou should just have to install Crypt::SSLeay and then use an https://... as the url parameter for Frontier::Client->new.

        Now on the server side things seem a little more complex. Once again I am not really familiar with the problem but here is my take: I am afraid you might have to modify some modules.

        A Frontier::Daemon is an HTTP::Daemon, which does not seem to support HTTPS, but which in turn is a IO::Socket::INET, and there I found the IO::Socket::SSL module which covers most of the IO::Socket API, hopefully enough, I haven't tested it, to be used by HTTP::Daemon.

        So I would think the easiest method for you would be first to wait for the opinion of monks more versed than me in the dark arts of SSL and networking in general than me, then to contact the author of HTTP::Daemon (Gisle AAs) and check whether any one as implemented HTTPS using his module, and if not to go for it, using IO::Socket::SSL, then send a patch to Gisle and probably to Ken McLeod as I expect some changes to Frontier::Daemon too. You will also earn the respect and gratitude from developers around the world! Good luck.

Re: Encrypting XML-RPC
by vladdrak (Monk) on Mar 07, 2001 at 11:07 UTC
    If you end up not wanting to use XML RPCs , there are some excellent SOAP modules you can use with CryptSSL. We just finished a project and almost went this route, but ended up writing a C listener app w/OpenSSL..

Log In?

What's my password?
Create A New User
Domain Nodelet?
Node Status?
node history
Node Type: perlquestion [id://62658]
Approved by root
and the web crawler heard nothing...

How do I use this?Last hourOther CB clients
Other Users?
Others perusing the Monastery: (3)
As of 2024-07-13 07:40 GMT
Find Nodes?
    Voting Booth?

    No recent polls found

    erzuuli‥ 🛈The London Perl and Raku Workshop takes place on 26th Oct 2024. If your company depends on Perl, please consider sponsoring and/or attending.