if __name__ == "__main__": ghostunnel = None try: # create certs root = RootCert('root') root.create_signed_cert('server') root.create_signed_cert('client') # start ghostunnel server = UnixServer() ghostunnel = run_ghostunnel([ 'server', '--listen={0}:13001'.format(LOCALHOST), '--target=unix:{0}'.format(server.get_socket_path()), '--keystore=server.p12', '--status={0}:{1}'.format(LOCALHOST, STATUS_PORT), '--cacert=root.crt', '--allow-ou=client' ]) # connect with client, confirm that the tunnel is up pair = SocketPair(TlsClient('client', 'root', 13001), server) pair.validate_can_send_from_server("hello world", "1: server -> client") pair.validate_can_send_from_client("hello world", "1: client -> server") pair.validate_closing_server_closes_client( "1: server closed -> client closed") print_ok("OK") finally: terminate(ghostunnel)
# create certs root = RootCert('root') root.create_signed_cert('server') root.create_signed_cert('new_server') root.create_signed_cert('client') # start ghostunnel ghostunnel = run_ghostunnel([ 'server', '--listen={0}:13001'.format(LOCALHOST), '--target={0}:13002'.format(LOCALHOST), '--keystore=server.p12', '--cacert=root.crt', '--allow-ou=client', '--status={0}:{1}'.format(LOCALHOST, STATUS_PORT) ]) # create connections with client pair1 = SocketPair(TlsClient('client', 'root', 13001), TcpServer(13002)) pair1.validate_can_send_from_client("toto", "pair1 works") pair1.validate_tunnel_ou("server", "pair1 -> ou=server") # Replace keystore and trigger reload os.rename('new_server.p12', 'server.p12') ghostunnel.send_signal(signal.SIGUSR1) TlsClient(None, 'root', STATUS_PORT).connect(20, 'new_server') print_ok("reload done") # create connections with client pair2 = SocketPair(TlsClient('client', 'root', 13001), TcpServer(13002)) pair2.validate_can_send_from_client("toto", "pair2 works") pair2.validate_tunnel_ou("new_server", "pair2 -> ou=new_server")
if __name__ == "__main__": ghostunnel = None try: # create certs root = RootCert('root') root.create_signed_cert('server') root.create_signed_cert('client') # start ghostunnel client = UnixClient() ghostunnel = run_ghostunnel([ 'client', '--listen=unix:{0}'.format(client.get_socket_path()), '--target={0}:13002'.format(LOCALHOST), '--keystore=client.p12', '--status={0}:{1}'.format(LOCALHOST, STATUS_PORT), '--cacert=root.crt' ]) # connect to server, confirm that the tunnel is up pair = SocketPair(client, TlsServer('server', 'root', 13002)) pair.validate_can_send_from_client("hello world", "1: client -> server") pair.validate_can_send_from_server("hello world", "1: server -> client") pair.validate_closing_client_closes_server( "1: client closed -> server closed") print_ok("OK") finally: terminate(ghostunnel)
root = RootCert('root') root.create_signed_cert('client') for n in range(1, n_clients): root.create_signed_cert("server{0}".format(n)) # start ghostunnel ghostunnel = run_ghostunnel([ 'client', '--listen={0}:13001'.format(LOCALHOST), '--target={0}:13002'.format(LOCALHOST), '--keystore=client.p12', '--status={0}:{1}'.format(LOCALHOST, STATUS_PORT), '--cacert=root.crt' ]) # servers should be able to communicate all at the same time. procs = [] for n in range(1, n_clients): pair = SocketPair(TcpClient(13001), TlsServer("server{0}".format(n), 'root', 13002)) proc = Process(target=send_data, args=( n, pair, )) proc.start() procs.append(proc) for proc in procs: proc.join() print_ok("OK") finally: terminate(ghostunnel)
root.create_signed_cert('server') root.create_signed_cert('client') # start ghostunnel ghostunnel = run_ghostunnel([ 'server', '--listen={0}:13001'.format(LOCALHOST), '--target={0}:13002'.format(LOCALHOST), '--keystore=server.p12', '--cacert=root.crt', '--allow-ou=client', '--status={0}:{1}'.format(LOCALHOST, STATUS_PORT) ]) # wait for startup TlsClient(None, 'root', STATUS_PORT).connect(20, 'server') # create connections with client pair1 = SocketPair(TlsClient('client', 'root', 13001), TcpServer(13002)) pair1.validate_can_send_from_client("toto", "pair1 works") # shut down ghostunnel with connection open, make sure it doesn't hang print_ok('attempting to terminate ghostunnel via SIGTERM signals') for n in range(0, 90): try: try: ghostunnel.terminate() ghostunnel.wait(timeout=1) except BaseException: pass os.kill(ghostunnel.pid, 0) print_ok("ghostunnel is still alive") except BaseException: stopped = True
try: # create certs root = RootCert('root') root.create_signed_cert('server') root.create_signed_cert('client') # start ghostunnel ghostunnel = run_ghostunnel(['server', '--listen={0}:13001'.format(LOCALHOST), '--target={0}:13002'.format(LOCALHOST), '--keystore=server.p12', '--status={0}:{1}'.format(LOCALHOST, STATUS_PORT), '--cacert=root.crt', '--allow-ou=client']) # client should fail to connect since nothing is listening on 13003 try: pair = SocketPair( TlsClient('client', 'root', 13001), TcpServer(13003)) raise Exception('client should have failed to connect') except socket.timeout: print_ok("timeout when nothing is listening on 13003") # client should connect pair = SocketPair(TlsClient('client', 'root', 13001), TcpServer(13002)) pair.cleanup() print_ok("OK") finally: terminate(ghostunnel)
STATUS_PORT)], stdout=subprocess.PIPE, stderr=subprocess.PIPE) def urlopen(path): return urllib.request.urlopen(path, cafile='root.crt') # block until ghostunnel is up TcpClient(STATUS_PORT).connect(20) # send some requests to status endpoints metrics = json.loads(str(urlopen( 'https://{0}:{1}/_metrics'.format(LOCALHOST, STATUS_PORT)).read(), 'utf-8')) # send some data through proxy pair1 = SocketPair( TlsClient('client', 'root', 13001), TcpServer(13002)) pair1.validate_can_send_from_client('toto', 'works') pair1.validate_can_send_from_server('toto', 'works') pair1.cleanup() terminate(ghostunnel) # make sure no logs printed out, err = ghostunnel.communicate() print('stdout (len={0}):'.format(len(out))) print(out) print('stderr (len={0}):'.format(len(err))) print(err) if len(err) > 0:
stderr=subprocess.PIPE) def urlopen(path): return urllib.request.urlopen(path, cafile='root.crt') # block until ghostunnel is up TcpClient(STATUS_PORT).connect(20) # send some requests to status endpoints metrics = json.loads( str( urlopen('https://{0}:{1}/_metrics'.format( LOCALHOST, STATUS_PORT)).read(), 'utf-8')) # send some data through proxy pair1 = SocketPair(TlsClient('client', 'root', 13001), TcpServer(13002)) pair1.validate_can_send_from_client('toto', 'works') pair1.validate_can_send_from_server('toto', 'works') pair1.cleanup() terminate(ghostunnel) # make sure no logs printed out, err = ghostunnel.communicate() print('stdout (len={0}):'.format(len(out))) print(out) print('stderr (len={0}):'.format(len(err))) print(err) if 'opening pipe' in err.decode('utf-8'):
other_root = RootCert('other_root') other_root.create_signed_cert('other_client1') # start ghostunnel ghostunnel = run_ghostunnel(['server', '--listen={0}:13001'.format(LOCALHOST), '--target={0}:13002'.format(LOCALHOST), '--keystore=server.p12', '--status={0}:{1}'.format(LOCALHOST, STATUS_PORT), '--cacert=root.crt', '--allow-ou=client1']) # connect with client1, confirm that the tunnel is up pair = SocketPair( TlsClient('client1', 'root', 13001), TcpServer(13002)) pair.validate_can_send_from_client( "hello world", "1: client -> server") pair.validate_can_send_from_server( "hello world", "1: server -> client") pair.validate_closing_client_closes_server( "1: client closed -> server closed") # connect with client2, confirm that the tunnel isn't up try: pair = SocketPair( TlsClient('client2', 'root', 13001), TcpServer(13002)) raise Exception('failed to reject client2') except ssl.SSLError: print_ok("client2 correctly rejected")
san="IP:127.0.0.1,IP:::1,DNS:foobar") other_root = RootCert('other_root') other_root.create_signed_cert('other_server') # start ghostunnel ghostunnel = run_ghostunnel([ 'client', '--listen={0}:13001'.format(LOCALHOST), '--target=localhost:13002', '--keystore=client.p12', '--cacert=root.crt', '--timed-reload=1s', '--override-server-name=foobar', '--status={0}:{1}'.format(LOCALHOST, STATUS_PORT) ]) # connect to server1, confirm that the tunnel is up pair = SocketPair(TcpClient(13001), TlsServer('server2', 'root', 13002)) pair.validate_can_send_from_client("hello world", "1: client -> server") pair.validate_can_send_from_server("hello world", "1: server -> client") pair.validate_closing_client_closes_server( "1: client closed -> server closed") # connect to other_server, confirm that the tunnel isn't up try: pair = SocketPair(TcpClient(13001), TlsServer('other_server', 'other_root', 13002)) raise Exception('failed to reject other_server') except ssl.SSLError: print_ok("other_server correctly rejected")
root2 = RootCert('new_root') root2.create_signed_cert('server2') # start ghostunnel ghostunnel = run_ghostunnel(['client', '--listen={0}:13001'.format(LOCALHOST), '--target={0}:13002'.format(LOCALHOST), '--keystore=client1.p12', '--timed-reload=1s', '--cacert=root1.crt', '--status={0}:{1}'.format(LOCALHOST, STATUS_PORT)]) # ensure ghostunnel connects with server1 pair1 = SocketPair(TcpClient(13001), TlsServer( 'server1', 'root1', 13002)) pair1.validate_can_send_from_client("toto", "pair1 works") pair1.validate_client_cert("client1", "pair1: ou=client1 -> ...") # check certificate on status port TlsClient(None, 'root1', STATUS_PORT).connect(20, 'client1') print_ok("got client1 on /_status") # replace keystore and check ghostunnel connects with new_client1 print_ok("replacing certificates") os.rename('new_client1.p12', 'client1.p12') # reload should happen automatically TlsClient(None, 'root1', STATUS_PORT).connect(20, 'new_client1') print_ok("reload done") pair2 = SocketPair(TcpClient(13001), TlsServer(
root.create_signed_cert('client') httpd = http.server.HTTPServer( (LOCALHOST, 13080), FakeConnectProxyHandler) server = threading.Thread(target=httpd.handle_request) server.start() # start ghostunnel ghostunnel = run_ghostunnel(['client', '--listen={0}:13001'.format(LOCALHOST), '--target={0}:13002'.format(LOCALHOST), '--keystore=client.p12', '--cacert=root.crt', '--connect-proxy=http://{0}:13080'.format(LOCALHOST), '--connect-timeout=30s', '--status={0}:{1}'.format(LOCALHOST, STATUS_PORT)]) # connect to server, confirm that the tunnel is up pair = SocketPair(TcpClient(13001), TlsServer('server', 'root', 13002)) pair.validate_can_send_from_client( 'hello world', '1: client -> server') pair.validate_can_send_from_server( 'hello world', '1: server -> client') pair.validate_closing_client_closes_server('closing client') pair.cleanup() print_ok("OK") finally: terminate(ghostunnel)
root.create_signed_cert('server') root.create_signed_cert('new_server') root.create_signed_cert('client') # start ghostunnel ghostunnel = run_ghostunnel(['server', '--listen={0}:13001'.format(LOCALHOST), '--target={0}:13002'.format(LOCALHOST), '--keystore=server.p12', '--cacert=root.crt', '--allow-ou=client', '--status={0}:{1}'.format(LOCALHOST, STATUS_PORT)]) # create connections with client pair1 = SocketPair( TlsClient('client', 'root', 13001), TcpServer(13002)) pair1.validate_can_send_from_client("toto", "pair1 works") pair1.validate_tunnel_ou("server", "pair1 -> ou=server") # Replace keystore and trigger reload os.rename('new_server.p12', 'server.p12') ghostunnel.send_signal(signal.SIGUSR1) TlsClient(None, 'root', STATUS_PORT).connect(20, 'new_server') print_ok("reload done") # create connections with client pair2 = SocketPair( TlsClient('client', 'root', 13001), TcpServer(13002)) pair2.validate_can_send_from_client("toto", "pair2 works") pair2.validate_tunnel_ou("new_server", "pair2 -> ou=new_server")
root1.create_signed_cert('client1') root1.create_signed_cert('new_client1') root2 = RootCert('new_root') root2.create_signed_cert('server2') # start ghostunnel ghostunnel = run_ghostunnel([ 'client', '--listen={0}:13001'.format(LOCALHOST), '--target={0}:13002'.format(LOCALHOST), '--keystore=client1.p12', '--timed-reload=1s', '--cacert=root1.crt', '--status={0}:{1}'.format(LOCALHOST, STATUS_PORT) ]) # ensure ghostunnel connects with server1 pair1 = SocketPair(TcpClient(13001), TlsServer('server1', 'root1', 13002)) pair1.validate_can_send_from_client("toto", "pair1 works") pair1.validate_client_cert("client1", "pair1: ou=client1 -> ...") # check certificate on status port TlsClient(None, 'root1', STATUS_PORT).connect(20, 'client1') print_ok("got client1 on /_status") # replace keystore and check ghostunnel connects with new_client1 print_ok("replacing certificates") os.rename('new_client1.p12', 'client1.p12') # reload should happen automatically TlsClient(None, 'root1', STATUS_PORT).connect(20, 'new_client1') print_ok("reload done") pair2 = SocketPair(TcpClient(13001),
ghostunnel = None try: # create certs root = RootCert('root') root.create_signed_cert('server') root.create_signed_cert('client') # start ghostunnel server = UnixServer() ghostunnel = run_ghostunnel(['server', '--listen={0}:13001'.format(LOCALHOST), '--target=unix:{0}'.format(server.get_socket_path()), '--keystore=server.p12', '--status={0}:{1}'.format(LOCALHOST, STATUS_PORT), '--cacert=root.crt', '--allow-ou=client']) # connect with client, confirm that the tunnel is up pair = SocketPair(TlsClient('client', 'root', 13001), server) pair.validate_can_send_from_server( "hello world", "1: server -> client") pair.validate_can_send_from_client( "hello world", "1: client -> server") pair.validate_closing_server_closes_client( "1: server closed -> client closed") print_ok("OK") finally: terminate(ghostunnel)
root.create_signed_cert('server') root.create_signed_cert('client') # start ghostunnel ghostunnel = run_ghostunnel([ 'client', '--listen={0}:13001'.format(LOCALHOST), '--target={0}:13002'.format(LOCALHOST), '--keystore=client.p12', '--cacert=root.crt', '--status={0}:{1}'.format(LOCALHOST, STATUS_PORT) ]) # wait for startup TlsClient(None, 'root', STATUS_PORT).connect(20, 'client') # create connections with client pair1 = SocketPair(TcpClient(13001), TlsServer('server', 'root', 13002)) pair1.validate_can_send_from_client("toto", "pair1 works") # shut down ghostunnel with connection open, make sure it doesn't hang print_ok('attempting to terminate ghostunnel via SIGTERM signals') for n in range(0, 90): try: try: ghostunnel.terminate() ghostunnel.wait(timeout=1) except BaseException: pass os.kill(ghostunnel.pid, 0) print_ok("ghostunnel is still alive") except BaseException: stopped = True
# start ghostunnel ghostunnel = run_ghostunnel(['server', '--listen={0}:13001'.format(LOCALHOST), '--target={0}:13002'.format(LOCALHOST), '--keystore=server.p12', '--cacert=root.crt', '--allow-ou=client', '--status={0}:{1}'.format(LOCALHOST, STATUS_PORT)]) # wait for startup TlsClient(None, 'root', STATUS_PORT).connect(20, 'server') # create connections with client pair1 = SocketPair( TlsClient('client', 'root', 13001), TcpServer(13002)) pair1.validate_can_send_from_client("toto", "pair1 works") # shut down ghostunnel with connection open, make sure it doesn't hang print_ok('attempting to terminate ghostunnel via SIGTERM signals') for n in range(0, 90): try: try: ghostunnel.terminate() ghostunnel.wait(timeout=1) except BaseException: pass os.kill(ghostunnel.pid, 0) print_ok("ghostunnel is still alive") except BaseException: stopped = True
ghostunnel = None try: # create certs root = RootCert('root') root.create_signed_cert('server') root.create_signed_cert('client') # start ghostunnel ghostunnel = run_ghostunnel(['client', '--listen={0}:13001'.format(LOCALHOST), '--target={0}:13002'.format(LOCALHOST), '--keystore=client.p12', '--status={0}:{1}'.format(LOCALHOST, STATUS_PORT), '--cacert=root.crt']) # client should fail to connect since nothing is listening on 13003 try: pair = SocketPair(TcpClient(13001), TlsServer( 'server', 'root', 13003)) raise Exception('client should have failed to connect') except socket.timeout: print_ok("timeout when nothing is listening on 13003") # client should connect pair = SocketPair(TcpClient(13001), TlsServer('server', 'root', 13002)) pair.cleanup() print_ok("OK") finally: terminate(ghostunnel)