Beam Line Controls - User contributions [en]

SciStream at APS

2025-04-14T18:21:23Z

Fcastro:

= SciStream Tunnel Setup Guide =

This guide provides step-by-step instructions on how to tunnel a connection through SciStream using <code>s2uc</code> running from a container. This setup involves two endpoints, each running on separate hosts, to establish a secure tunnel(TLS) for forwarding packets.

Scistream's API TLS certificates are on the test servers at <code>/local/scistream</code>. Use the folder corresponding to the server -- i.e. on server1, always use /server1; on server2, use /server2.

== How data flows through the tunnel ==

The tunnel consists of parts that work together:

'''Server side (Inbound Request):''' Destination that receives data. TCP server listens for connections.
'''Client side (Outbound Request):''' Source that sends data. TCP client that actively creates new connections

** Your client application connects to the local port (5100) on the client machine
** The SciStream outbound request forwards this connection through the secure tunnel
** The SciStream inbound request receives the forwarded connection
** Data is delivered to your server application listening on the receiver port (5300)

== Request Configuration ==

=== Inbound Request ("Server side": 192.168.150.1) ===
'''Purpose:''' Sets up the receiving end of the tunnel. This establishes a listener that waits for incoming connections from the outbound request and it forwards this connection to the <remote_ip>:<receiver_ports>.

<pre>podman run --rm --net=host -v ./server1:/scistream --entrypoint=s2uc castroflaviojr/scistream:1.2.1 inbound-request --remote_ip 192.168.150.1 --s2cs 192.168.150.1:5000 --receiver_ports 5300 --num_conn 1 --server_cert=/scistream/server.crt
</pre>

* '''Parameters:'''
** <code>--remote_ip</code>: The address the user application is listening on.
** <code>--s2cs</code>: The IP and port for the local s2cs scistream control server.
** <code>--receiver_ports</code>: The port the user application is listening on (i.e. the user application is bound to {remote_ip:receiver_port}).
** <code>--num_conn</code>: Number of connections to establish.
** <code>--server_cert</code>: Path to the server certificate for TLS.

'''Note the UID:'''

After running the command, note the UID and listener port provided in the output. Example:

<pre>
uid; s2cs; access_token; role
bd9f1a7e-04d7-11f0-b44c-946dae415862 192.168.150.1:5000 INVALID_TOKEN PROD
sending client request message
started client request
waiting for hello message
sending for hello message
Hello message sent successfully
Listeners: ['192.168.150.1:5100']
</pre>

=== Outbound Request ("Client side": 192.168.150.2) ===

<pre>podman run --rm --net=host -v ./server2:/scistream --entrypoint=s2uc castroflaviojr/scistream:1.2.1 outbound-request --remote_ip 192.168.150.1 --s2cs 192.168.150.2:5000 --receiver_ports 5100 --num_conn 1 --server_cert=/scistream/server.crt bd9f1a7e-04d7-11f0-b44c-946dae415862 192.168.150.1:5100
</pre>

* '''Parameters:'''
** <code>--remote_ip</code>: The eventual destination IP address we want data to be forwarded to.
** <code>--s2cs</code>: The IP and port for the local s2cs scistream control server.
** <code>--receiver_ports</code>: Local port which the client application will connect to.
** <code>--num_conn</code>: Number of connections to establish.
** <code>--server_cert</code>: Path to the server certificate for TLS.
** <code>UID</code>: Use the UID noted from the inbound request.
** <code>IP:PORT</code>: Use the IP and port noted from the inbound request.

Example output:

<pre>
uid; s2cs; access_token; role
bd9f1a7e-04d7-11f0-b44c-946dae415862 192.168.150.2:5000 INVALID_TOKEN CONS
started client request
waiting for hello message
Hello message sent successfully
Listeners: ['192.168.150.2:5100']
</pre>

== Verification ==

* '''Check Listening Ports:'''

On both hosts, verify that the <code>stunnel</code> processes are listening on the expected ports using:

<pre>ss -tlpn
</pre>

* '''Test the Tunnel:'''

Use <code>iperf3</code> to test the tunnel:

* '''Client Side (Host 192.168.150.2):'''

<pre>iperf3 -c 192.168.150.2 -p 5100
</pre>

* '''Server Side (Host 192.168.150.1):'''

<pre>iperf3 -s -p 5300
</pre>

== Closing the Connection ==

To close a connection request, use the <code>release</code> option with <code>s2uc</code>:

<pre>s2uc release <uid>
</pre>

SciStream at APS

2025-04-14T18:20:06Z

Fcastro: /* How data flows through the tunnel */

= SciStream Tunnel Setup Guide =

This guide provides step-by-step instructions on how to tunnel a connection through SciStream using <code>s2uc</code> running from a container. This setup involves two endpoints, each running on separate hosts, to establish a secure tunnel(TLS) for forwarding packets.

Scistream's API TLS certificates are on the test servers at <code>/local/scistream</code>. Use the folder corresponding to the server -- i.e. on server1, always use /server1; on server2, use /server2.

== How data flows through the tunnel ==

The tunnel consists of parts that work together:

'''Server side (Inbound Request):''' Destination that receives data. TCP server listens for connections.
'''Client side (Outbound Request):''' Source that sends data. TCP client that actively creates new connections

* Your client application connects to the local port (5100) on the client machine
** The SciStream outbound request forwards this connection through the secure tunnel
** The SciStream inbound request receives the forwarded connection
** Data is delivered to your server application listening on the receiver port (5300)

== Request Configuration ==

=== Inbound Request ("Server side": 192.168.150.1) ===
'''Purpose:''' Sets up the receiving end of the tunnel. This establishes a listener that waits for incoming connections from the outbound request and it forwards this connection to the <remote_ip>:<receiver_ports>.

<pre>podman run --rm --net=host -v ./server1:/scistream --entrypoint=s2uc castroflaviojr/scistream:1.2.1 inbound-request --remote_ip 192.168.150.1 --s2cs 192.168.150.1:5000 --receiver_ports 5300 --num_conn 1 --server_cert=/scistream/server.crt
</pre>

* '''Parameters:'''
** <code>--remote_ip</code>: The address the user application is listening on.
** <code>--s2cs</code>: The IP and port for the local s2cs scistream control server.
** <code>--receiver_ports</code>: The port the user application is listening on (i.e. the user application is bound to {remote_ip:receiver_port}).
** <code>--num_conn</code>: Number of connections to establish.
** <code>--server_cert</code>: Path to the server certificate for TLS.

'''Note the UID:'''

After running the command, note the UID and listener port provided in the output. Example:

<pre>
uid; s2cs; access_token; role
bd9f1a7e-04d7-11f0-b44c-946dae415862 192.168.150.1:5000 INVALID_TOKEN PROD
sending client request message
started client request
waiting for hello message
sending for hello message
Hello message sent successfully
Listeners: ['192.168.150.1:5100']
</pre>

=== Outbound Request ("Client side": 192.168.150.2) ===

<pre>podman run --rm --net=host -v ./server2:/scistream --entrypoint=s2uc castroflaviojr/scistream:1.2.1 outbound-request --remote_ip 192.168.150.1 --s2cs 192.168.150.2:5000 --receiver_ports 5100 --num_conn 1 --server_cert=/scistream/server.crt bd9f1a7e-04d7-11f0-b44c-946dae415862 192.168.150.1:5100
</pre>

* '''Parameters:'''
** <code>--remote_ip</code>: The eventual destination IP address we want data to be forwarded to.
** <code>--s2cs</code>: The IP and port for the local s2cs scistream control server.
** <code>--receiver_ports</code>: Local port which the client application will connect to.
** <code>--num_conn</code>: Number of connections to establish.
** <code>--server_cert</code>: Path to the server certificate for TLS.
** <code>UID</code>: Use the UID noted from the inbound request.
** <code>IP:PORT</code>: Use the IP and port noted from the inbound request.

Example output:

<pre>
uid; s2cs; access_token; role
bd9f1a7e-04d7-11f0-b44c-946dae415862 192.168.150.2:5000 INVALID_TOKEN CONS
started client request
waiting for hello message
Hello message sent successfully
Listeners: ['192.168.150.2:5100']
</pre>

== Verification ==

* '''Check Listening Ports:'''

On both hosts, verify that the <code>stunnel</code> processes are listening on the expected ports using:

<pre>ss -tlpn
</pre>

* '''Test the Tunnel:'''

Use <code>iperf3</code> to test the tunnel:

* '''Client Side (Host 192.168.150.2):'''

<pre>iperf3 -c 192.168.150.2 -p 5100
</pre>

* '''Server Side (Host 192.168.150.1):'''

<pre>iperf3 -s -p 5300
</pre>

== Closing the Connection ==

To close a connection request, use the <code>release</code> option with <code>s2uc</code>:

<pre>s2uc release <uid>
</pre>

SciStream at APS

2025-04-14T18:19:31Z

Fcastro:

= SciStream Tunnel Setup Guide =

This guide provides step-by-step instructions on how to tunnel a connection through SciStream using <code>s2uc</code> running from a container. This setup involves two endpoints, each running on separate hosts, to establish a secure tunnel(TLS) for forwarding packets.

Scistream's API TLS certificates are on the test servers at <code>/local/scistream</code>. Use the folder corresponding to the server -- i.e. on server1, always use /server1; on server2, use /server2.

== How data flows through the tunnel ==
The tunnel consists of parts that work together:

'''Server side (Inbound Request):''' Destination that receives data. TCP server listens for connections.
'''Client side (Outbound Request):''' Source that sends data. TCP client that actively creates new connections

* Your client application connects to the local port (5100) on the client machine
** The SciStream outbound request forwards this connection through the secure tunnel
** The SciStream inbound request receives the forwarded connection
** Data is delivered to your server application listening on the receiver port (5300)

== Request Configuration ==

=== Inbound Request ("Server side": 192.168.150.1) ===
'''Purpose:''' Sets up the receiving end of the tunnel. This establishes a listener that waits for incoming connections from the outbound request and it forwards this connection to the <remote_ip>:<receiver_ports>.

<pre>podman run --rm --net=host -v ./server1:/scistream --entrypoint=s2uc castroflaviojr/scistream:1.2.1 inbound-request --remote_ip 192.168.150.1 --s2cs 192.168.150.1:5000 --receiver_ports 5300 --num_conn 1 --server_cert=/scistream/server.crt
</pre>

* '''Parameters:'''
** <code>--remote_ip</code>: The address the user application is listening on.
** <code>--s2cs</code>: The IP and port for the local s2cs scistream control server.
** <code>--receiver_ports</code>: The port the user application is listening on (i.e. the user application is bound to {remote_ip:receiver_port}).
** <code>--num_conn</code>: Number of connections to establish.
** <code>--server_cert</code>: Path to the server certificate for TLS.

'''Note the UID:'''

After running the command, note the UID and listener port provided in the output. Example:

<pre>
uid; s2cs; access_token; role
bd9f1a7e-04d7-11f0-b44c-946dae415862 192.168.150.1:5000 INVALID_TOKEN PROD
sending client request message
started client request
waiting for hello message
sending for hello message
Hello message sent successfully
Listeners: ['192.168.150.1:5100']
</pre>

=== Outbound Request ("Client side": 192.168.150.2) ===

<pre>podman run --rm --net=host -v ./server2:/scistream --entrypoint=s2uc castroflaviojr/scistream:1.2.1 outbound-request --remote_ip 192.168.150.1 --s2cs 192.168.150.2:5000 --receiver_ports 5100 --num_conn 1 --server_cert=/scistream/server.crt bd9f1a7e-04d7-11f0-b44c-946dae415862 192.168.150.1:5100
</pre>

* '''Parameters:'''
** <code>--remote_ip</code>: The eventual destination IP address we want data to be forwarded to.
** <code>--s2cs</code>: The IP and port for the local s2cs scistream control server.
** <code>--receiver_ports</code>: Local port which the client application will connect to.
** <code>--num_conn</code>: Number of connections to establish.
** <code>--server_cert</code>: Path to the server certificate for TLS.
** <code>UID</code>: Use the UID noted from the inbound request.
** <code>IP:PORT</code>: Use the IP and port noted from the inbound request.

Example output:

<pre>
uid; s2cs; access_token; role
bd9f1a7e-04d7-11f0-b44c-946dae415862 192.168.150.2:5000 INVALID_TOKEN CONS
started client request
waiting for hello message
Hello message sent successfully
Listeners: ['192.168.150.2:5100']
</pre>

== Verification ==

* '''Check Listening Ports:'''

On both hosts, verify that the <code>stunnel</code> processes are listening on the expected ports using:

<pre>ss -tlpn
</pre>

* '''Test the Tunnel:'''

Use <code>iperf3</code> to test the tunnel:

* '''Client Side (Host 192.168.150.2):'''

<pre>iperf3 -c 192.168.150.2 -p 5100
</pre>

* '''Server Side (Host 192.168.150.1):'''

<pre>iperf3 -s -p 5300
</pre>

== Closing the Connection ==

To close a connection request, use the <code>release</code> option with <code>s2uc</code>:

<pre>s2uc release <uid>
</pre>