Skip to content

Commit e47f86b

Browse files
kylemannakylemanna
authored
Merge pull request #615 from kylemanna/dev
Cleanup some tests and documentation
2 parents 1c55356 + 192ce97 commit e47f86b

File tree

9 files changed

+108
-76
lines changed

9 files changed

+108
-76
lines changed

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ If you prefer to use `docker-compose` please refer to the [documentation](docs/d
6969

7070
* Create an environment variable with the name DEBUG and value of 1 to enable debug output (using "docker -e").
7171

72-
docker run -v $OVPN_DATA:/etc/openvpn -p 1194:1194/udp --privileged -e DEBUG=1 kylemanna/openvpn
72+
docker run -v $OVPN_DATA:/etc/openvpn -p 1194:1194/udp --cap-add=NET_ADMIN -e DEBUG=1 kylemanna/openvpn
7373

7474
* Test using a client that has openvpn installed correctly
7575

‎bin/ovpn_run‎

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -39,11 +39,11 @@ function addArg {
3939
# this allows rules/routing to be altered by supplying this function
4040
# in an included file, such as ovpn_env.sh
4141
function setupIptablesAndRouting {
42-
iptables -t nat -C POSTROUTING -s $OVPN_SERVER -o $OVPN_NATDEVICE -j MASQUERADE || {
42+
iptables -t nat -C POSTROUTING -s $OVPN_SERVER -o $OVPN_NATDEVICE -j MASQUERADE 2>/dev/null || {
4343
iptables -t nat -A POSTROUTING -s $OVPN_SERVER -o $OVPN_NATDEVICE -j MASQUERADE
4444
}
4545
for i in "${OVPN_ROUTES[@]}"; do
46-
iptables -t nat -C POSTROUTING -s "$i" -o $OVPN_NATDEVICE -j MASQUERADE || {
46+
iptables -t nat -C POSTROUTING -s "$i" -o $OVPN_NATDEVICE -j MASQUERADE 2>/dev/null || {
4747
iptables -t nat -A POSTROUTING -s "$i" -o $OVPN_NATDEVICE -j MASQUERADE
4848
}
4949
done
@@ -87,13 +87,18 @@ fi
8787

8888
ip -6 route show default 2>/dev/null
8989
if [ $? = 0 ]; then
90-
echo "Enabling IPv6 Forwarding"
91-
# If this fails, ensure the docker container is run with --privileged
92-
# Could be side stepped with `ip netns` madness to drop privileged flag
90+
echo "Checking IPv6 Forwarding"
91+
if [ "$(</proc/sys/net/ipv6/conf/all/disable_ipv6)" != "0" ]; then
92+
echo "Sysctl error for disable_ipv6, please run docker with '--sysctl net.ipv6.conf.all.disable_ipv6=0'"
93+
fi
94+
95+
if [ "$(</proc/sys/net/ipv6/conf/default/forwarding)" != "1" ]; then
96+
echo "Sysctl error for default forwarding, please run docker with '--sysctl net.ipv6.conf.default.forwarding=1'"
97+
fi
9398

94-
sysctl -w net.ipv6.conf.all.disable_ipv6=0 || echo "Failed to enable IPv6 support"
95-
sysctl -w net.ipv6.conf.default.forwarding=1 || echo "Failed to enable IPv6 Forwarding default"
96-
sysctl -w net.ipv6.conf.all.forwarding=1 || echo "Failed to enable IPv6 Forwarding"
99+
if [ "$(</proc/sys/net/ipv6/conf/all/forwarding)" != "1" ]; then
100+
echo "Sysctl error for all forwarding, please run docker with '--sysctl net.ipv6.conf.all.forwarding=1'"
101+
fi
97102
fi
98103

99104
echo "Running 'openvpn ${ARGS[@]} ${USER_ARGS[@]}'"

‎docs/advanced.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,4 +17,4 @@ The [`ovpn_genconfig`](/bin/ovpn_genconfig) script is intended for simple config
1717

1818
* Start the server with:
1919

20-
docker run -v $PWD:/etc/openvpn -d -p 1194:1194/udp --privileged kylemanna/openvpn
20+
docker run -v $PWD:/etc/openvpn -d -p 1194:1194/udp --cap-add=NET_ADMIN kylemanna/openvpn

‎docs/tcp.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ specified protocol, adjust the mapping appropriately:
2121
## Running a Second Fallback TCP Container
2222
Instead of choosing between UDP and TCP, you can use both. A single instance of OpenVPN can only listen for a single protocol on a single port, but this image makes it easy to run two instances simultaneously. After building, configuring, and starting a standard container listening for UDP traffic on 1194, you can start a second container listening for tcp traffic on port 443:
2323

24-
docker run -v $OVPN_DATA:/etc/openvpn --rm -p 443:1194/tcp --privileged kylemanna/openvpn ovpn_run --proto tcp
24+
docker run -v $OVPN_DATA:/etc/openvpn --rm -p 443:1194/tcp --cap-add=NET_ADMIN kylemanna/openvpn ovpn_run --proto tcp
2525

2626
`ovpn_run` will load all the values from the default config file, and `--proto tcp` will override the protocol setting.
2727

‎test/client/wait-for-connect.sh‎

Lines changed: 29 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -5,34 +5,46 @@ set -e
55

66
OPENVPN_CONFIG=${1:-/client/config.ovpn}
77

8-
# Run in background, rely on bash for job management
8+
# For some reason privileged mode creates the char device and cap-add=NET_ADMIN doesn't
9+
mkdir -p /dev/net
10+
if [ ! -c /dev/net/tun ]; then
11+
mknod /dev/net/tun c 10 200
12+
fi
13+
14+
# Run in background using bash job management, setup trap to clean-up
15+
trap "{ jobs -p | xargs -r kill; wait; }" EXIT
916
openvpn --config "$OPENVPN_CONFIG" --management 127.0.0.1 9999 &
1017

1118
# Spin waiting for interface to exist signifying connection
1219
timeout=10
1320
for i in $(seq $timeout); do
21+
# Allow to start-up
22+
sleep 0.5
23+
24+
# Use bash magic to open tcp socket on fd 3 and break when successful
25+
exec 3<>/dev/tcp/127.0.0.1/9999 && break
26+
done
1427

15-
# Break when connected
16-
#echo state | busybox nc 127.0.0.1 9999 | grep -q "CONNECTED,SUCCESS" && break;
28+
if [ $i -ge $timeout ]; then
29+
echo "Error connecting to OpenVPN mgmt interface, i=$i, exiting."
30+
exit 2
31+
fi
1732

18-
# Bash magic for tcp sockets
19-
if exec 3<>/dev/tcp/127.0.0.1/9999; then
20-
# Consume all header input
21-
while read -t 0.1 <&3; do true; done
22-
echo "state" >&3
23-
read -t 1 <&3
24-
echo -n $REPLY | grep -q "CONNECTED,SUCCESS" && break || true
25-
exec 3>&-
26-
fi
33+
# Consume all header input and echo, look for errors here
34+
while read -t 0.1 <&3; do echo $REPLY; done
2735

28-
# Else sleep
36+
# Request state over mgmt interface
37+
timeout=10
38+
for i in $(seq $timeout); do
39+
echo "state" >&3
40+
state=$(head -n1 <&3)
41+
echo -n "$state" | grep -q 'CONNECTED,SUCCESS' && break
2942
sleep 1
3043
done
3144

3245
if [ $i -ge $timeout ]; then
33-
echo "Error starting OpenVPN, i=$i, exiting."
34-
exit 2;
46+
echo "Error connecting to OpenVPN, i=$i, exiting."
47+
exit 3
3548
fi
3649

37-
# The show is over.
38-
kill %1
50+
exec 3>&-

‎test/tests/basic/run.sh‎

Lines changed: 11 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -22,27 +22,22 @@ docker run -v $OVPN_DATA:/etc/openvpn --rm $IMG ovpn_getclient $CLIENT | tee $CL
2222
docker run -v $OVPN_DATA:/etc/openvpn --rm $IMG ovpn_listclients | grep $CLIENT
2323

2424
#
25-
# Fire up the server
25+
# Fire up the server and setup a trap to always clean it up
2626
#
27-
docker run --name "ovpn-test" -v $OVPN_DATA:/etc/openvpn --rm -p 1194:1194/udp --privileged $IMG &
27+
trap "{ jobs -p | xargs -r kill; wait; }" EXIT
28+
docker run --name "ovpn-test" -v $OVPN_DATA:/etc/openvpn --rm -e DEBUG --cap-add=NET_ADMIN $IMG &
2829

29-
#for i in $(seq 10); do
30-
# SERV_IP=$(docker inspect --format '{{ .NetworkSettings.IPAddress }}')
31-
# test -n "$SERV_IP" && break
32-
#done
33-
#sed -ie s:SERV_IP:$SERV_IP:g config.ovpn
30+
for i in $(seq 10); do
31+
SERV_IP_INTERNAL=$(docker inspect --format '{{ .NetworkSettings.IPAddress }}' "ovpn-test" 2>/dev/null || true)
32+
test -n "$SERV_IP_INTERNAL" && break
33+
sleep 0.1
34+
done
35+
sed -i -e s:$SERV_IP:$SERV_IP_INTERNAL:g ${CLIENT_DIR}/config.ovpn
3436

3537
#
36-
# Fire up a client in a container since openvpn is disallowed by Travis-CI, don't NAT
37-
# the host as it confuses itself:
38-
# "Incoming packet rejected from [AF_INET]172.17.42.1:1194[2], expected peer address: [AF_INET]10.240.118.86:1194"
38+
# Fire up a client in a container since openvpn is disallowed by Travis-CI
3939
#
40-
docker run --rm --net=host --privileged --volume $CLIENT_DIR:/client $IMG /client/wait-for-connect.sh
41-
42-
#
43-
# Client either connected or timed out, kill server
44-
#
45-
kill %1
40+
docker run --rm --cap-add=NET_ADMIN -e DEBUG --volume $CLIENT_DIR:/client $IMG /client/wait-for-connect.sh
4641

4742
#
4843
# Celebrate

‎test/tests/dual-proto/run.sh‎

Lines changed: 21 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -35,22 +35,31 @@ docker run -v $OVPN_DATA:/etc/openvpn --rm $IMG ovpn_listclients | grep $CLIENT_
3535
# Fire up the server
3636
#
3737

38-
# run in shell bg to get logs
39-
docker run --name "ovpn-test-udp" -v $OVPN_DATA:/etc/openvpn --rm -p 1194:1194/udp --privileged $IMG &
40-
docker run --name "ovpn-test-tcp" -v $OVPN_DATA:/etc/openvpn --rm -p 443:1194/tcp --privileged $IMG ovpn_run --proto tcp &
38+
# Run in shell bg to get logs, setup trap to clean-up
39+
trap "{ jobs -p | xargs -r kill; wait; docker volume rm ${OVPN_DATA}; }" EXIT
40+
docker run --name "ovpn-test-udp" -v $OVPN_DATA:/etc/openvpn --rm --cap-add=NET_ADMIN -e DEBUG $IMG &
41+
docker run --name "ovpn-test-tcp" -v $OVPN_DATA:/etc/openvpn --rm --cap-add=NET_ADMIN -e DEBUG $IMG ovpn_run --proto tcp --port 443 &
4142

42-
#
43-
# Fire up a clients in a containers since openvpn is disallowed by Travis-CI, don't NAT
44-
# the host as it confuses itself:
45-
# "Incoming packet rejected from [AF_INET]172.17.42.1:1194[2], expected peer address: [AF_INET]10.240.118.86:1194"
46-
#
47-
docker run --rm --net=host --privileged --volume $CLIENT_DIR:/client $IMG /client/wait-for-connect.sh
48-
docker run --rm --net=host --privileged --volume $CLIENT_DIR:/client $IMG /client/wait-for-connect.sh "/client/config-tcp.ovpn"
43+
# Update configs
44+
for i in $(seq 10); do
45+
SERV_IP_INTERNAL=$(docker inspect --format '{{ .NetworkSettings.IPAddress }}' "ovpn-test-udp" 2>/dev/null || true)
46+
test -n "$SERV_IP_INTERNAL" && break
47+
sleep 0.1
48+
done
49+
sed -i -e s:$SERV_IP:$SERV_IP_INTERNAL:g $CLIENT_DIR/config.ovpn
50+
51+
for i in $(seq 10); do
52+
SERV_IP_INTERNAL=$(docker inspect --format '{{ .NetworkSettings.IPAddress }}' "ovpn-test-tcp" 2>/dev/null || true)
53+
test -n "$SERV_IP_INTERNAL" && break
54+
sleep 0.1
55+
done
56+
sed -i -e s:$SERV_IP:$SERV_IP_INTERNAL:g $CLIENT_DIR/config-tcp.ovpn
4957

5058
#
51-
# Client either connected or timed out, kill server
59+
# Fire up a clients in a containers since openvpn is disallowed by Travis-CI
5260
#
53-
kill %1 %2
61+
docker run --rm --cap-add=NET_ADMIN -v $CLIENT_DIR:/client -e DEBUG $IMG /client/wait-for-connect.sh
62+
docker run --rm --cap-add=NET_ADMIN -v $CLIENT_DIR:/client -e DEBUG $IMG /client/wait-for-connect.sh "/client/config-tcp.ovpn"
5463

5564
#
5665
# Celebrate

‎test/tests/otp/run.sh‎

Lines changed: 10 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -49,25 +49,19 @@ grep 'reneg-sec 0' $CLIENT_DIR/config.ovpn || abort 'reneg-sec not set to 0 in c
4949
#
5050
# Fire up the server
5151
#
52-
docker run --name "ovpn-test" -v $OVPN_DATA:/etc/openvpn --rm -p 1194:1194/udp --privileged $IMG &
52+
trap "{ jobs -p | xargs -r kill; wait; }" EXIT
53+
docker run --name "ovpn-test" -v $OVPN_DATA:/etc/openvpn --rm --cap-add=NET_ADMIN $IMG &
5354

54-
#for i in $(seq 10); do
55-
# SERV_IP=$(docker inspect --format '{{ .NetworkSettings.IPAddress }}')
56-
# test -n "$SERV_IP" && break
57-
#done
58-
#sed -ie s:SERV_IP:$SERV_IP:g $CLIENT_DIR/config.ovpn
55+
for i in $(seq 10); do
56+
SERV_IP_INTERNAL=$(docker inspect --format '{{ .NetworkSettings.IPAddress }}' "ovpn-test" 2>/dev/null || true)
57+
test -n "$SERV_IP_INTERNAL" && break
58+
sleep 0.1
59+
done
60+
sed -i -e s:$SERV_IP:$SERV_IP_INTERNAL:g $CLIENT_DIR/config.ovpn
5961

6062
#
61-
# Fire up a client in a container since openvpn is disallowed by Travis-CI, don't NAT
62-
# the host as it confuses itself:
63-
# "Incoming packet rejected from [AF_INET]172.17.42.1:1194[2], expected peer address: [AF_INET]10.240.118.86:1194"
64-
#
65-
docker run --rm --net=host --privileged --volume $CLIENT_DIR:/client $IMG /client/wait-for-connect.sh
66-
67-
#
68-
# Client either connected or timed out, kill server
69-
#
70-
kill %1
63+
# Fire up a client in a container since openvpn is disallowed by Travis-CI
64+
docker run --rm --cap-add=NET_ADMIN --volume $CLIENT_DIR:/client -e DEBUG $IMG /client/wait-for-connect.sh
7165

7266
#
7367
# Celebrate

‎test/tests/revocation/run.sh‎

Lines changed: 21 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -23,11 +23,13 @@ function finish {
2323
# Stop the server and clean up
2424
docker rm -f $NAME
2525
docker volume rm $OVPN_DATA
26+
jobs -p | xargs -r kill
27+
wait
2628
}
2729
trap finish EXIT
2830

2931
# Put the server in the background
30-
docker run -d -v $OVPN_DATA:/etc/openvpn --cap-add=NET_ADMIN -p 1194:1194/udp --name $NAME $IMG
32+
docker run -d -v $OVPN_DATA:/etc/openvpn --cap-add=NET_ADMIN --name $NAME $IMG
3133

3234
#
3335
# Test that easy_rsa generate CRLs with 'next publish' set to 3650 days.
@@ -49,10 +51,18 @@ docker exec -it $NAME easyrsa build-client-full $CLIENT1 nopass
4951
docker exec -it $NAME ovpn_getclient $CLIENT1 > $CLIENT_DIR/config.ovpn
5052
docker exec -it $NAME bash -c "echo 'yes' | ovpn_revokeclient $CLIENT1"
5153

54+
# Determine IP address of container running daemon and update config
55+
for i in $(seq 10); do
56+
SERV_IP_INTERNAL=$(docker inspect --format '{{ .NetworkSettings.IPAddress }}' "$NAME" 2>/dev/null || true)
57+
test -n "$SERV_IP_INTERNAL" && break
58+
sleep 0.1
59+
done
60+
sed -i -e s:$SERV_IP:$SERV_IP_INTERNAL:g $CLIENT_DIR/config.ovpn
61+
5262
#
5363
# Test that openvpn client can't connect using $CLIENT1 config.
5464
#
55-
if docker run --rm -v $CLIENT_DIR:/client --cap-add=NET_ADMIN --privileged --net=host $IMG /client/wait-for-connect.sh; then
65+
if docker run --rm -v $CLIENT_DIR:/client --cap-add=NET_ADMIN -e DEBUG $IMG /client/wait-for-connect.sh; then
5666
echo "Client was able to connect after revocation test #1." >&2
5767
exit 2
5868
fi
@@ -64,7 +74,14 @@ docker exec -it $NAME easyrsa build-client-full $CLIENT2 nopass
6474
docker exec -it $NAME ovpn_getclient $CLIENT2 > $CLIENT_DIR/config.ovpn
6575
docker exec -it $NAME bash -c "echo 'yes' | ovpn_revokeclient $CLIENT2"
6676

67-
if docker run --rm -v $CLIENT_DIR:/client --cap-add=NET_ADMIN --privileged --net=host $IMG /client/wait-for-connect.sh; then
77+
# Determine IP address of container running daemon and update config
78+
for i in $(seq 10); do
79+
SERV_IP_INTERNAL=$(docker inspect --format '{{ .NetworkSettings.IPAddress }}' "$NAME" 2>/dev/null || true)
80+
test -n "$SERV_IP_INTERNAL" && break
81+
sleep 0.1
82+
done
83+
84+
if docker run --rm -v $CLIENT_DIR:/client --cap-add=NET_ADMIN -e DEBUG $IMG /client/wait-for-connect.sh; then
6885
echo "Client was able to connect after revocation test #2." >&2
6986
exit 2
7087
fi
@@ -77,7 +94,7 @@ docker stop $NAME && docker start $NAME
7794
#
7895
# Test for failed connection using $CLIENT2 config again.
7996
#
80-
if docker run --rm -v $CLIENT_DIR:/client --cap-add=NET_ADMIN --privileged --net=host $IMG /client/wait-for-connect.sh; then
97+
if docker run --rm -v $CLIENT_DIR:/client --cap-add=NET_ADMIN -e DEBUG $IMG /client/wait-for-connect.sh; then
8198
echo "Client was able to connect after revocation test #3." >&2
8299
exit 2
83100
fi

0 commit comments

Comments
 (0)