def send_data(i):
p = SocketPair(TlsClient("client{0}".format(i), 'root', 13001),
TcpServer(13002))
counter = 0
while counter < 100:
r = random.random()
if r < 0.4:
time.sleep(r)
continue
counter += 1
if r < 0.7:
p.validate_can_send_from_client(
"blah blah blah",
"{0}:{1} client -> server".format(i, counter))
else:
p.validate_can_send_from_server(
"blah blah blah",
"{0}:{1} server -> client".format(i, counter))
r = random.random()
if r < 0.5:
p.validate_closing_client_closes_server(
"{0} client close -> server close".format(i))
else:
p.validate_closing_server_closes_client(
"{0} server close -> client close".format(i))
# start ghostunnel
ghostunnel = run_ghostunnel([
'client', '--listen={0}:13001'.format(LOCALHOST),
'--target=localhost:13002', '--cacert=root.crt',
'--disable-authentication',
'--status={0}:{1}'.format(LOCALHOST, STATUS_PORT)
])
# connect to server1, confirm that the tunnel is up
pair = SocketPair(
TcpClient(13001),
TlsServer('server1', 'root', 13002, cert_reqs=ssl.CERT_NONE))
pair.validate_can_send_from_client("hello world",
"1: client -> server")
pair.validate_can_send_from_server("hello world",
"1: server -> client")
pair.validate_closing_client_closes_server(
"1: client closed -> server closed")
# connect to other_server, confirm that the tunnel isn't up
try:
pair = SocketPair(
TcpClient(13001),
TlsServer('other_server',
'other_root',
13002,
cert_reqs=ssl.CERT_NONE))
raise Exception('failed to reject other_server')
except ssl.SSLError:
print_ok("other_server with unknown CA correctly rejected")
ghostunnel = None
try:
# create certs
root = RootCert('root')
root.create_signed_cert('server')
root.create_signed_cert('client')
# start ghostunnel
server = UnixServer()
ghostunnel = run_ghostunnel(['server',
'--listen={0}:13001'.format(LOCALHOST),
'--target=unix:{0}'.format(server.get_socket_path()),
'--keystore=server.p12',
'--status={0}:{1}'.format(LOCALHOST,
STATUS_PORT),
'--cacert=root.crt',
'--allow-ou=client'])
# connect with client, confirm that the tunnel is up
pair = SocketPair(TlsClient('client', 'root', 13001), server)
pair.validate_can_send_from_server(
"hello world", "1: server -> client")
pair.validate_can_send_from_client(
"hello world", "1: client -> server")
pair.validate_closing_server_closes_client(
"1: server closed -> client closed")
print_ok("OK")
finally:
terminate(ghostunnel)
def urlopen(path):
return urllib.request.urlopen(path, cafile='root.crt')
# block until ghostunnel is up
TcpClient(STATUS_PORT).connect(20)
# send some requests to status endpoints
metrics = json.loads(str(urlopen(
'https://{0}:{1}/_metrics'.format(LOCALHOST, STATUS_PORT)).read(), 'utf-8'))
# send some data through proxy
pair1 = SocketPair(
TlsClient('client', 'root', 13001), TcpServer(13002))
pair1.validate_can_send_from_client('toto', 'works')
pair1.validate_can_send_from_server('toto', 'works')
pair1.cleanup()
terminate(ghostunnel)
# make sure no logs printed
out, err = ghostunnel.communicate()
print('stdout (len={0}):'.format(len(out)))
print(out)
print('stderr (len={0}):'.format(len(err)))
print(err)
if len(err) > 0:
raise Exception('ghostunnel logged to stderr with --quiet=all')
return urllib.request.urlopen(path, cafile='root.crt')
# block until ghostunnel is up
TcpClient(STATUS_PORT).connect(20)
# send some requests to status endpoints
metrics = json.loads(
str(
urlopen('https://{0}:{1}/_metrics'.format(
LOCALHOST, STATUS_PORT)).read(), 'utf-8'))
# send some data through proxy
pair1 = SocketPair(TlsClient('client', 'root', 13001),
TcpServer(13002))
pair1.validate_can_send_from_client('toto', 'works')
pair1.validate_can_send_from_server('toto', 'works')
pair1.cleanup()
terminate(ghostunnel)
# make sure no logs printed
out, err = ghostunnel.communicate()
print('stdout (len={0}):'.format(len(out)))
print(out)
print('stderr (len={0}):'.format(len(err)))
print(err)
if 'opening pipe' in err.decode('utf-8'):
raise Exception(
'ghostunnel logged connection log to stderr with --quiet=all')
'client1',
san='URI:spiffe://client1,IP:127.0.0.1,IP:::1,DNS:localhost')
root.create_signed_cert(
'client2',
san='URI:spiffe://client2,IP:127.0.0.1,IP:::1,DNS:localhost')
# start ghostunnel
ghostunnel = run_ghostunnel([
'server', '--listen={0}:13001'.format(LOCALHOST),
'--target={0}:13002'.format(LOCALHOST), '--keystore=server.p12',
'--cacert=root.crt', '--allow-uri=spiffe://client1',
'--status={0}:{1}'.format(LOCALHOST, STATUS_PORT)
])
# create connections with client
pair1 = SocketPair(TlsClient('client1', 'root', 13001),
TcpServer(13002))
pair1.validate_can_send_from_client("toto", "pair1 works")
pair1.validate_can_send_from_server("toto", "pair1 works")
try:
pair2 = SocketPair(TlsClient('client2', 'root', 13001),
TcpServer(13002))
raise Exception('failed to reject client2')
except ssl.SSLError:
print_ok("client2 correctly rejected")
print_ok("OK")
finally:
terminate(ghostunnel)
root.create_signed_cert('client')
httpd = http.server.HTTPServer(
(LOCALHOST, 13080), FakeConnectProxyHandler)
server = threading.Thread(target=httpd.handle_request)
server.start()
# start ghostunnel
ghostunnel = run_ghostunnel(['client',
'--listen={0}:13001'.format(LOCALHOST),
'--target={0}:13002'.format(LOCALHOST),
'--keystore=client.p12',
'--cacert=root.crt',
'--connect-proxy=http://{0}:13080'.format(LOCALHOST),
'--connect-timeout=30s',
'--status={0}:{1}'.format(LOCALHOST,
STATUS_PORT)])
# connect to server, confirm that the tunnel is up
pair = SocketPair(TcpClient(13001), TlsServer('server', 'root', 13002))
pair.validate_can_send_from_client(
'hello world', '1: client -> server')
pair.validate_can_send_from_server(
'hello world', '1: server -> client')
pair.validate_closing_client_closes_server('closing client')
pair.cleanup()
print_ok("OK")
finally:
terminate(ghostunnel)
root.create_signed_cert(
'client2',
san='URI:spiffe://client2,IP:127.0.0.1,IP:::1,DNS:localhost')
# start ghostunnel
ghostunnel = run_ghostunnel(['server',
'--listen={0}:13001'.format(LOCALHOST),
'--target={0}:13002'.format(LOCALHOST),
'--keystore=server.p12',
'--cacert=root.crt',
'--allow-uri=spiffe://client1',
'--status={0}:{1}'.format(LOCALHOST,
STATUS_PORT)])
# create connections with client
pair1 = SocketPair(
TlsClient('client1', 'root', 13001), TcpServer(13002))
pair1.validate_can_send_from_client("toto", "pair1 works")
pair1.validate_can_send_from_server("toto", "pair1 works")
try:
pair2 = SocketPair(
TlsClient('client2', 'root', 13001), TcpServer(13002))
raise Exception('failed to reject client2')
except ssl.SSLError:
print_ok("client2 correctly rejected")
print_ok("OK")
finally:
terminate(ghostunnel)