Page MenuHomeVyOS Platform
Create Task
Maniphest T4597

Check bind port before assign service HTTPS API and openconnect
Closed, ResolvedPublicBUG
Actions

Description

Check listen port before commit service https api and vpn openconnect

Configure API:

set service https api gql
set service https api keys id KID key 'foo'
set service https api socket

Check ports:

vyos@r14# sudo netstat -tulpn | grep 443
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      15283/nginx: master 
tcp6       0      0 :::443                  :::*                    LISTEN      15283/nginx: master 
[edit]
vyos@r14#

Configure openconnect:

set vpn openconnect authentication local-users username foo password 'bar'
set vpn openconnect authentication mode local 'password'
set vpn openconnect network-settings client-ip-settings subnet '100.64.0.0/24'
set vpn openconnect ssl ca-certificate 'ca-ocserv'
set vpn openconnect ssl certificate 'srv-ocserv'
commit

Check ports and status:

vyos@r14# sudo netstat -tulpn | grep 443
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      15283/nginx: master 
tcp6       0      0 :::443                  :::*                    LISTEN      15283/nginx: master 
[edit]
vyos@r14# sudo systemctl status ocserv.service
● ocserv.service - OpenConnect SSL VPN server
     Loaded: loaded (/lib/systemd/system/ocserv.service; disabled; vendor preset: enabled)
    Drop-In: /etc/systemd/system/ocserv.service.d
             └─override.conf
     Active: failed (Result: exit-code) since Fri 2022-08-05 14:36:51 EEST; 9s ago
       Docs: man:ocserv(8)
    Process: 15405 ExecStart=/usr/sbin/ocserv --foreground --pid-file /run/ocserv/ocserv.pid --config /run/ocserv/ocserv.conf (code=exited, status=1/FAILURE)
   Main PID: 15405 (code=exited, status=1/FAILURE)
        CPU: 6ms

Aug 05 14:36:51 r14 ocserv[15405]: main: CN=vyos.io,O=VyOS,L=Dnipro,ST=Denwer,C=US certificate key usage prevents key encipherment; unable to support the RSA ciphersuites; if that is not intentiona>
Aug 05 14:36:51 r14 ocserv[15405]: error connecting to sec-mod socket '/run/ocserv/ocserv.socket.e4a4a64e': No such file or directory
Aug 05 14:36:51 r14 ocserv[15405]: note: setting 'file' as supplemental config option
Aug 05 14:36:51 r14 ocserv[15405]: listening (TCP) on 0.0.0.0:443...
Aug 05 14:36:51 r14 ocserv[15405]: bind() failed: Address already in use
Aug 05 14:36:51 r14 ocserv[15405]: listening (TCP) on [::]:443...
Aug 05 14:36:51 r14 ocserv[15405]: bind() failed: Address already in use
Aug 05 14:36:51 r14 ocserv[15405]: Could not listen to any TCP or UNIX ports
Aug 05 14:36:51 r14 systemd[1]: ocserv.service: Main process exited, code=exited, status=1/FAILURE
Aug 05 14:36:51 r14 systemd[1]: ocserv.service: Failed with result 'exit-code'.
lines 1-20/20 (END)

Requires this check https://github.com/vyos/vyos-1x/blob/2a10ffa4b5074be27458159fa94d6227d0e5c7f7/python/vyos/util.py#L939

Details

Difficulty level
Easy (less than an hour)
Version
VyOS 1.4-rolling-202208020217
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Bug (incorrect behavior)

Related Objects

Event Timeline

Viacheslav created this task.Aug 5 2022, 11:40 AM
Viacheslav changed the task status from Open to In progress.Aug 5 2022, 2:26 PM
Viacheslav claimed this task.
Viacheslav added a comment.EditedAug 5 2022, 3:47 PM

PR checks if openconnect port is listened by another service https://github.com/vyos/vyos-1x/pull/1460

Viacheslav added a subscriber: jestabro.Aug 5 2022, 3:48 PM
pasik added a subscriber: pasik.Aug 7 2022, 5:45 PM
jestabro claimed this task.Aug 11 2022, 2:19 PM
Viacheslav mentioned this in T4596: "show openconnect-server sessions" command does not work in the openconnect module.Aug 20 2022, 6:34 AM
Viacheslav added a comment.EditedAug 20 2022, 10:45 AM

There is a bug with such implementation check for openconnect
It is not possible to create the second user in another commit (as port already bonded)

vyos@r14# run show conf com | match vpn
set vpn openconnect authentication local-users username foo password 'bar'
set vpn openconnect authentication mode local 'password'
set vpn openconnect listen-ports tcp '8443'
set vpn openconnect listen-ports udp '8443'
set vpn openconnect network-settings client-ip-settings subnet '100.64.0.0/24'
set vpn openconnect network-settings name-server '100.64.0.1'
set vpn openconnect ssl ca-certificate 'ca-ocserv'
set vpn openconnect ssl certificate 'srv-ocserv'
[edit]
vyos@r14# commit
No configuration changes to commit
[edit]
vyos@r14# sudo netstat -tulpn | grep 8443
tcp        0      0 0.0.0.0:8443            0.0.0.0:*               LISTEN      23880/ocserv-main   
tcp6       0      0 :::8443                 :::*                    LISTEN      23880/ocserv-main   
udp        0      0 0.0.0.0:8443            0.0.0.0:*                           23880/ocserv-main   
udp6       0      0 :::8443                 :::*                                23880/ocserv-main   
[edit]
vyos@r14# set vpn openconnect authentication local-users username foo2 password 'bar2'
[edit]
vyos@r14# commit
[ vpn openconnect ]
"tcp" port "8443" is used by another service

[[vpn openconnect]] failed
Commit failed
[edit]
vyos@r14#

So we should revert the previous commit or find out if the port is free and the port is not listening by ocserv itself

Viacheslav added a comment.Aug 20 2022, 2:03 PM

Fix PR https://github.com/vyos/vyos-1x/pull/1481

Viacheslav added a comment.Aug 23 2022, 9:36 AM

Check NGINX address/port before applying/committing service https
PR https://github.com/vyos/vyos-1x/pull/1488

jestabro reassigned this task from jestabro to Viacheslav.Aug 23 2022, 1:31 PM
Viacheslav changed the task status from In progress to Needs testing.Aug 25 2022, 6:33 AM
Viacheslav mentioned this in T4644: Check bind port before assign vpn sstp.Aug 25 2022, 9:32 AM
Viacheslav closed this task as Resolved.Sep 6 2022, 8:44 AM
Viacheslav moved this task from Need Triage to Finished on the VyOS 1.4 Sagitta board.