T5735: Stunnel CLI and configuration #3588

HollyGurza · 2024-06-06T09:07:17Z

Add CLI commands
Add config
Add conf_mode
Add systemd config
Add stunnel smoketests

Change Summary

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Code style update (formatting, renaming)
Refactoring (no functional changes)
Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
Other (please describe):

Related Task(s)

https://vyos.dev/T5735

Related PR(s)

Component(s) name

Proposed changes

How to test

Simple test is:
configure server:

conf
del service stunnel
commit
set service stunnel server one connect address google.com
set service stunnel server one connect port 80
set service stunnel server one listen port 9001
set service stunnel server one psk serv id cli1
set service stunnel server one psk serv secret 1234567890ABCDEF1234567890ABCDEF
commit

configure client:

conf
del service stunnel
set service stunnel client cli1 connect address 192.168.122.166
set service stunnel client cli1 connect port 9001
set service stunnel client cli1 listen address 127.0.0.1
set service stunnel client cli1 listen port 80
set service stunnel client cli1 psk cli1 id cli1
set service stunnel client cli1 psk cli1 secret 1234567890ABCDEF1234567890ABCDEF
commit

try to make a request on the client side:

 curl -X GET http://127.0.0.1:80/
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>301 Moved</TITLE></HEAD><BODY>
<H1>301 Moved</H1>
The document has moved
<A HREF="http://www.google.com/">here</A>.
</BODY></HTML>

Socks proxy example:

set service stunnel server one listen port '9001'
set service stunnel server one protocol 'socks'
set service stunnel server one psk serv id 'cli1'
set service stunnel server one psk serv secret '1234567890ABCDEF1234567890ABCDEF'

set service stunnel client one listen port '9000'
set service stunnel client one connect port '9001'
set service stunnel client one psk serv id 'cli1'
set service stunnel client one psk serv secret '1234567890ABCDEF1234567890ABCDEF'
commit

curl --proxy 'socks5h://127.0.0.1:9000' 'https://api.ipify.org/'

Smoketest result

vyos@vyos:~$ python3 /usr/libexec/vyos/tests/smoke/cli/test_service_stunnel.py 
test_01_stunnel_simple_client (__main__.TestServiceStunnel.test_01_stunnel_simple_client) ... 
client [app1]: listen port number is required!

ok
test_02_stunnel_simple_server (__main__.TestServiceStunnel.test_02_stunnel_simple_server) ... 
server [ser1]: listen port number is required!

ok
test_03_multy_services (__main__.TestServiceStunnel.test_03_multy_services) ... ok
test_04_cert_problems (__main__.TestServiceStunnel.test_04_cert_problems) ... 
PKI does not contain any CA certificates!


PKI does not contain any certificates!


server [app1]: TLS server needs a certificate or PSK


PKI does not contain any CA certificates!


PKI does not contain any certificates!

ok
test_05_psk_auth (__main__.TestServiceStunnel.test_05_psk_auth) ... ok
test_06_socks_proxy (__main__.TestServiceStunnel.test_06_socks_proxy) ... 
The 'connect' option cannot be used with the 'socks' protocol in server
mode.

ok
test_07_available_port (__main__.TestServiceStunnel.test_07_available_port) ... 
server [srv1]: Address 127.0.0.1:8001 already in use by other stunnel
service

ok
test_08_two_endpoints (__main__.TestServiceStunnel.test_08_two_endpoints) ... 
client [app1]: connect port number is required!

ok
test_09_pki_still_used (__main__.TestServiceStunnel.test_09_pki_still_used) ... 
PKI object "srv-1" still in use by "service stunnel server ser1 ssl
certificate"

ok
test_99_protocols (__main__.TestServiceStunnel.test_99_protocols) ... 
Additional option is only supported in the 'connect' and 'smtp'
protocols.


Additional option is only supported in the 'connect' and 'smtp'
protocols.


Additional option is only supported in the 'connect' and 'smtp'
protocols.


Additional option is only supported in the 'connect' and 'smtp'
protocols.


Additional option is only supported in the 'connect' and 'smtp'
protocols.


Additional option is only supported in the 'connect' and 'smtp'
protocols.


Protocol 'smtp' does not support options 'domain' and 'host'.


Additional option is only supported in the 'connect' and 'smtp'
protocols.

ok

----------------------------------------------------------------------
Ran 10 tests in 97.202s

OK

Checklist:

I have read the CONTRIBUTING document
I have linked this PR to one or more Phabricator Task(s)
I have run the components SMOKETESTS if applicable
My commit headlines contain a valid Task id
My change requires a change to the documentation
I have updated the documentation accordingly

github-actions · 2024-06-10T06:22:26Z

👍
No issues in PR Title / Commit Title

sever-sever · 2024-06-13T09:02:42Z

Needs to verify
1.

vyos@r4# set service stunnel 
[edit]
vyos@r4# commit
[ service stunnel ]
VyOS had an issue completing a command.

Report time:      2024-06-13 12:01:01
Image version:    VyOS 1.5-rolling-202406130020
Release train:    current

Built by:         [email protected]
Built on:         Thu 13 Jun 2024 03:16 UTC
Build UUID:       84281102-574f-443d-83f7-af82b6ba3512
Build commit ID:  f2154b4252535e

Architecture:     x86_64
Boot via:         installed image
System type:      KVM guest

Hardware vendor:  QEMU
Hardware model:   Standard PC (Q35 + ICH9, 2009)
Hardware S/N:     
Hardware UUID:    166cfd25-7d3a-4eca-9ef6-0b655c9acf0f

Traceback (most recent call last):
  File "/usr/libexec/vyos/conf_mode/service_stunnel.py", line 198, in <module>
    generate(c)
  File "/usr/libexec/vyos/conf_mode/service_stunnel.py", line 129, in generate
    for c in stunnel['pki']['ca'].values()} if 'ca' in stunnel['pki'] else {}
                                                       ~~~~~~~^^^^^^^
KeyError: 'pki'



[[service stunnel]] failed
Commit failed
[edit]

set service stunnel server my-server connect address 'google.com'
set service stunnel server my-server connect port '80'
set service stunnel server my-server psk PSK id 'foo'
set service stunnel server my-server psk PSK secret '12345'
commit


vyos@r4# commit
[ service stunnel ]
Job for stunnel.service failed because the control process exited with error code.
See "systemctl status stunnel.service" and "journalctl -xeu stunnel.service" for details.

[edit]
vyos@r4#


set service stunnel server one connect address google.com
set service stunnel server one connect port 80
set service stunnel server one listen port 9001
set service stunnel server one psk serv id cli1
set service stunnel server one psk serv secret 12345
commit


vyos@r4# commit
[ service stunnel ]
Job for stunnel.service failed because the control process exited with error code.
See "systemctl status stunnel.service" and "journalctl -xeu stunnel.service" for details.

[edit]
vyos@r4#

set service stunnel server one connect address 'google.com'
set service stunnel server one connect port '80'
set service stunnel server one listen port '9001'
set service stunnel server one protocol 'socks'
set service stunnel server one psk serv id 'cli1'
set service stunnel server one psk serv secret '1234567890ABCDEF1234567890ABCDEF'

vyos@r4# commit
[ service stunnel ]
Job for stunnel.service failed because the control process exited with error code.
See "systemctl status stunnel.service" and "journalctl -xeu stunnel.service" for details.

[edit]
vyos@r4#

sever-sever

See the comment above. There should be several verifications before I can test it again.

interface-definitions/include/stunnel/port.xml.i

src/conf_mode/service_stunnel.py

sever-sever · 2024-06-18T09:51:03Z

It seems not all required options were set

set service stunnel server my-server listen port '22222'
set service stunnel server my-server psk FOO id 'my-cert'
set service stunnel server my-server psk FOO secret '1234567890ABCDEF1234567890ABCDEF'

vyos@r4# commit
[ service stunnel ]
Job for stunnel.service failed because the control process exited with error code.
See "systemctl status stunnel.service" and "journalctl -xeu stunnel.service" for details.

[edit]
vyos@r4#

Log:

Jun 18 12:49:32 r4 stunnel[6964]: [!] Service [my-server]: Each service must define two endpoints
Jun 18 12:49:32 r4 stunnel[6964]: [!] Configuration failed
Jun 18 12:49:32 r4 stunnel[6964]: [ ] Deallocating temporary section defaults
Jun 18 12:49:32 r4 stunnel[6964]: [ ] Deallocating section [my-server]
Jun 18 12:49:32 r4 systemd[1]: stunnel.service: Control process exited, code=exited, status=1/FAILURE
Jun 18 12:49:32 r4 systemd[1]: stunnel.service: Failed with result 'exit-code'.
Jun 18 12:49:32 r4 systemd[1]: Failed to start stunnel.service - SSL tunneling service.

interface-definitions/include/stunnel/ssl.xml.i

src/conf_mode/service_stunnel.py

Add CLI commands Add config Add conf_mode Add systemd config Add stunnel smoketests Add log level config

HollyGurza requested a review from a team as a code owner June 6, 2024 09:07

HollyGurza requested review from dmbaturin, sarthurdev, zdc, jestabro, sever-sever and c-po June 6, 2024 09:07

github-actions bot assigned HollyGurza Jun 6, 2024

github-actions bot added the current label Jun 6, 2024

HollyGurza force-pushed the T5735 branch 2 times, most recently from cc8f076 to 91a3d3a Compare June 10, 2024 06:22

sever-sever requested changes Jun 13, 2024

View reviewed changes

interface-definitions/include/stunnel/port.xml.i Outdated Show resolved Hide resolved

HollyGurza changed the title ~~T5735: Stunnel CLI and configuration~~ [Draft]T5735: Stunnel CLI and configuration Jun 13, 2024

HollyGurza marked this pull request as draft June 13, 2024 14:51

HollyGurza changed the title ~~[Draft]T5735: Stunnel CLI and configuration~~ T5735: Stunnel CLI and configuration Jun 13, 2024

HollyGurza force-pushed the T5735 branch 2 times, most recently from 7cee2e9 to 560271e Compare June 17, 2024 11:01

HollyGurza marked this pull request as ready for review June 17, 2024 11:03

HollyGurza requested a review from sever-sever June 17, 2024 11:03

sever-sever requested changes Jun 18, 2024

View reviewed changes

src/conf_mode/service_stunnel.py Show resolved Hide resolved

HollyGurza force-pushed the T5735 branch from 560271e to d5203b9 Compare June 19, 2024 08:34

HollyGurza requested a review from sever-sever June 19, 2024 08:39

HollyGurza force-pushed the T5735 branch 3 times, most recently from ca497fe to 9742f9d Compare June 19, 2024 12:29

sever-sever approved these changes Jun 19, 2024

View reviewed changes

c-po requested changes Jun 19, 2024

View reviewed changes

interface-definitions/include/stunnel/ssl.xml.i Outdated Show resolved Hide resolved

HollyGurza force-pushed the T5735 branch from 9742f9d to bc4c36b Compare June 20, 2024 08:34

HollyGurza requested a review from c-po June 20, 2024 08:35

c-po requested changes Jun 24, 2024

View reviewed changes

src/conf_mode/service_stunnel.py Outdated Show resolved Hide resolved

T5735: Stunnel CLI and configuration

f613161

Add CLI commands Add config Add conf_mode Add systemd config Add stunnel smoketests Add log level config

HollyGurza force-pushed the T5735 branch from bc4c36b to f613161 Compare June 24, 2024 14:16

c-po approved these changes Jun 24, 2024

View reviewed changes

c-po merged commit 6fbe91e into vyos:current Jun 24, 2024
12 of 13 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

T5735: Stunnel CLI and configuration #3588

T5735: Stunnel CLI and configuration #3588

HollyGurza commented Jun 6, 2024 •

edited

Loading

github-actions bot commented Jun 10, 2024 •

edited

Loading

sever-sever commented Jun 13, 2024 •

edited

Loading

sever-sever left a comment

sever-sever commented Jun 18, 2024

T5735: Stunnel CLI and configuration #3588

T5735: Stunnel CLI and configuration #3588

Conversation

HollyGurza commented Jun 6, 2024 • edited Loading

Change Summary

Types of changes

Related Task(s)

Related PR(s)

Component(s) name

Proposed changes

How to test

Smoketest result

Checklist:

github-actions bot commented Jun 10, 2024 • edited Loading

sever-sever commented Jun 13, 2024 • edited Loading

sever-sever left a comment

Choose a reason for hiding this comment

sever-sever commented Jun 18, 2024

HollyGurza commented Jun 6, 2024 •

edited

Loading

github-actions bot commented Jun 10, 2024 •

edited

Loading

sever-sever commented Jun 13, 2024 •

edited

Loading