What determines availability of Slim::Networking::Async::Socket::HTTPS ?

[meep]

 eval { 
   require Slim::Networking::Async::Socket::HTTPS;
  };
  if ($@) {

   #SSL is not available

  }else{
  
   #SSL is available

  }

I've read a note somewhere indicating that support for requests over HTTPS may or may not be available depending on the LMS install.

I've tried the above code in 7.9.x and found that it's available on a windows system but not available on an Ubuntu system,

What's the determining factor dictating SSL availability for async requests? (assume it's availability of IO::Socket::SSL?). What's the core reason why this may or may not be included in a particular LMS version/platform? Is there anything an end-user can do to enable it?

Many thanks

Peter

[bpa]

Not sure if it is of help but for BBC plugin I have a requirement for HTTP 1.1 persistent TCP connection -which is not implemented in LMS async HTTP so I use AnyEvent::HTTP included in the lib dir of a plugin. AnyEvent works with LMS scheduler loop so it is proper async I/O . AFAICT AnyEvent::HTTP also implements https. AnyEvent::HTTP works with LMS 7.8

[mherger]

> What's the determining factor dictating SSL availability for async
> requests? (assume it's availability of IO::Socket::SSL?). What's the
> core reason why this may or may not be included in a particular LMS
> version/platform? Is there anything an end-user can do to enable it?

IO::Socket::SSL can't be included for every platform, as it depends on
OpenSSL. And it must be compiled against the exact same version as is
installed. Therefore it's almost only possible to have it installed
using the system's package manager.

--

Michael

[meep]

OK, thanks both

@Michael - do you have any insights into a rough % of LMS installs it might be enabled on (I've added some tracking to my DB so will be building this data over time from testers in any case). It would be useful to give end users some indication of platforms which would have enhanced security.

@bpa - thanks for the pointers. I actually had a development version that used AnyEvent but had issues around SSLeay requirements, if I recall correctly (probably the same issue that Michael outlines, if I think back on it).

[mherger]

> @Michael - do you have any insights into a rough % of LMS installs it
> might be enabled on (I've added some tracking to my DB so will be
> building this data over time from testers in any case). It would be
> useful to give end users some indication of platforms which would have
> enhanced security.

No numbers, no. Only some guess work.

Nowadays most LMS installations run on Linux systems of some kind.
"Unfortunately" a large chunk thereof are NAS systems which don't always
come with all libraries required. Windows and Mac should be fine.
Overall I'd guess that the vast majority of users can handle SSL.

--

Michael

[Mnyb]

I recently installed on a linux mint 18 , all off it was not installed per default ( especially not the perl modules ) but was easilly aviable trough the packet manager . A piont and click exercise , (not like my old obscure server).

Could not lms in case it is avaible trough a packet manager have this as dependencies thus installing it on many linux systems ?
even the plugin needs could be considered ? you and the third party devs could agreee on some common ssl needs ?

[rederikus]

> @Michael - do you have any insights into a rough % of LMS installs it
> might be enabled on (I've added some tracking to my DB so will be
> building this data over time from testers in any case). It would be
> useful to give end users some indication of platforms which would have
> enhanced security.

No numbers, no. Only some guess work.

Nowadays most LMS installations run on Linux systems of some kind.
"Unfortunately" a large chunk thereof are NAS systems which don't always
come with all libraries required. Windows and Mac should be fine.
Overall I'd guess that the vast majority of users can handle SSL.

--

Michael

Any chance of a stand alone package for the Raspberry Pi? It would be really nice to have https on the Pi if that were possible.

[mherger]

> Any chance of a stand alone package for the Raspberry Pi? It would be
> really nice to have https on the Pi if that were possible.

sudo apt-get install libio-socket-ssl-perl

That should do.

--

Michael

[rederikus]

> Any chance of a stand alone package for the Raspberry Pi? It would be
> really nice to have https on the Pi if that were possible.

sudo apt-get install libio-socket-ssl-perl

That should do.

--

Michael

Thank you Michael.

Edit: I installed it and it worked perfectly first time. A ta sante, Michel.

[meep]

a tester of the Alexa plugin also reported success as follows, though I haven't yet tested this....

I'm using Ubuntu here and to get the https working I ran the following command in Ubuntu:

sudo apt-get install libnet-ssleay-perl libio-socket-ssl-perl

Then I rebooted LMS and now my Alexa traffic is being sent via https.