Skip to content

[pull] master from angristan:master #114

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pull merged 2 commits into from
Mar 14, 2026
Merged

[pull] master from angristan:master #114

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ea440ad
chore(deps): update dependency openvpn/easy-rsa to v3.2.6 (#1480)
renovate[bot] Mar 14, 2026
63448d5
fix: test client connectivity both before and after cert renewal (#1481)
angristan Mar 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions openvpn-install.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,8 @@
# Configuration constants
readonly DEFAULT_CERT_VALIDITY_DURATION_DAYS=3650 # 10 years
readonly DEFAULT_CRL_VALIDITY_DURATION_DAYS=5475 # 15 years
readonly EASYRSA_VERSION="3.2.5"
readonly EASYRSA_SHA256="662ee3b453155aeb1dff7096ec052cd83176c460cfa82ac130ef8568ec4df490"
readonly EASYRSA_VERSION="3.2.6"
readonly EASYRSA_SHA256="c2572990ce91112eef8d1b8e4a3b58790da95b68501785c621f69121dfbd22d7"

# =============================================================================
# Logging Configuration
Expand Down
89 changes: 68 additions & 21 deletions test/client-entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,29 @@ fi

echo "TUN device ready"

test_dns_resolution() {
local label="$1"
local success=false
echo "$label: Testing DNS resolution via Unbound ($VPN_GATEWAY)..."
for i in $(seq 1 10); do
DIG_OUTPUT=$(dig @"$VPN_GATEWAY" example.com +short +time=5 2>&1)
if [ -n "$DIG_OUTPUT" ] && ! echo "$DIG_OUTPUT" | grep -qi "timed out\|SERVFAIL\|connection refused"; then
success=true
break
fi
echo "DNS attempt $i failed:"
echo "$DIG_OUTPUT"
sleep 2
done
if [ "$success" = true ]; then
echo "PASS: DNS resolution through Unbound works"
else
echo "FAIL: DNS resolution through Unbound failed after 10 attempts"
dig @"$VPN_GATEWAY" example.com +time=5 || true
exit 1
fi
}

# Wait for client config to be available
echo "Waiting for client config..."
while [ ! -f /shared/client.ovpn ]; do
Expand Down Expand Up @@ -110,34 +133,58 @@ if [ "${CLIENT_IPV6:-n}" = "y" ]; then
fi

# Test 3: DNS resolution through Unbound
echo "Test 3: Testing DNS resolution via Unbound ($VPN_GATEWAY)..."
DNS_SUCCESS=false
DNS_MAX_RETRIES=10
for i in $(seq 1 $DNS_MAX_RETRIES); do
DIG_OUTPUT=$(dig @"$VPN_GATEWAY" example.com +short +time=5 2>&1)
if [ -n "$DIG_OUTPUT" ] && ! echo "$DIG_OUTPUT" | grep -qi "timed out\|SERVFAIL\|connection refused"; then
DNS_SUCCESS=true
break
fi
echo "DNS attempt $i failed:"
echo "$DIG_OUTPUT"
sleep 2
done
if [ "$DNS_SUCCESS" = true ]; then
echo "PASS: DNS resolution through Unbound works"
echo "Resolved example.com to: $(dig @"$VPN_GATEWAY" example.com +short +time=5)"
else
echo "FAIL: DNS resolution through Unbound failed after $DNS_MAX_RETRIES attempts"
dig @"$VPN_GATEWAY" example.com +time=5 || true
exit 1
fi
test_dns_resolution "Test 3"

echo ""
echo "=== Initial connectivity tests PASSED ==="

# Signal server that initial tests passed
touch /shared/initial-tests-passed

# =====================================================
# Post-renewal connectivity tests
# =====================================================
echo ""
echo "=== Waiting for post-renewal config ==="
while [ ! -f /shared/renewal-config-ready ]; do
sleep 2
echo "Waiting for renewal config..."
done

echo "Renewal config ready, reconnecting..."
pkill openvpn || true
sleep 2

openvpn --config /shared/client.ovpn --daemon --log /var/log/openvpn-renewal.log

echo "Waiting for VPN connection after renewal..."
while ! ip addr show tun0 2>/dev/null | grep -q "inet "; do
sleep 2
echo "Waiting for tun0..."
if [ -f /var/log/openvpn-renewal.log ]; then
tail -3 /var/log/openvpn-renewal.log
fi
done

echo "=== VPN Connected after renewal! ==="
ip addr show tun0

echo "Waiting for routing to stabilize..."
sleep 5

echo "Test: Pinging VPN gateway after renewal ($VPN_GATEWAY)..."
while ! ping -c 3 -W 2 "$VPN_GATEWAY" >/dev/null 2>&1; do
echo "Ping failed, retrying..."
sleep 3
done
echo "PASS: Can ping VPN gateway after renewal"

test_dns_resolution "Test: Post-renewal DNS"

echo ""
echo "=== Post-renewal connectivity tests PASSED ==="
touch /shared/renewal-tests-passed

# =====================================================
# Certificate Revocation E2E Tests
# =====================================================
Expand Down
44 changes: 25 additions & 19 deletions test/server-entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -211,7 +211,7 @@ else
exit 1
fi

# Copy client config to shared volume for the client container
# Copy client config to shared volume for initial connectivity tests
cp /root/testclient.ovpn /shared/client.ovpn
sed -i 's/^remote .*/remote openvpn-server 1194/' /shared/client.ovpn
echo "Client config copied to /shared/client.ovpn"
Expand Down Expand Up @@ -356,6 +356,17 @@ fi

echo "=== TLS 1.3 Configuration Verified ==="

# =====================================================
# Wait for initial client tests to complete
# =====================================================
echo ""
echo "=== Waiting for initial client connectivity tests ==="
while [ ! -f /shared/initial-tests-passed ]; do
sleep 2
echo "Waiting for initial tests..."
done
echo "Initial client tests passed, proceeding with renewal tests"

# =====================================================
# Test certificate renewal functionality
# =====================================================
Expand Down Expand Up @@ -429,11 +440,6 @@ if [ "$AUTH_MODE" = "pki" ]; then
fi
fi

# Update shared client config with renewed certificate
cp /root/testclient.ovpn /shared/client.ovpn
sed -i 's/^remote .*/remote openvpn-server 1194/' /shared/client.ovpn
echo "Updated client config with renewed certificate"

echo "=== Client Certificate Renewal Tests PASSED ==="

# =====================================================
Expand Down Expand Up @@ -538,10 +544,21 @@ done
# Allow routing to stabilize after renewal restart
sleep 3

# Update shared client config after server renewal (fingerprint changed)
cp /root/testclient.ovpn /shared/client.ovpn
sed -i 's/^remote .*/remote openvpn-server 1194/' /shared/client.ovpn
echo "Updated client config with new server fingerprint"
touch /shared/renewal-config-ready
echo "Updated client config with renewed certificates"

# =====================================================
# Wait for post-renewal client connectivity tests
# =====================================================
echo ""
echo "=== Waiting for post-renewal client connectivity tests ==="
while [ ! -f /shared/renewal-tests-passed ]; do
sleep 2
echo "Waiting for renewal tests..."
done
echo "Post-renewal client tests passed"

# =====================================================
# Verify Unbound DNS resolver (started by systemd via install script)
Expand Down Expand Up @@ -749,17 +766,6 @@ fi
echo "Allowing routing to stabilize..."
sleep 3

# =====================================================
# Wait for initial client tests to complete
# =====================================================
echo ""
echo "=== Waiting for initial client connectivity tests ==="
while [ ! -f /shared/initial-tests-passed ]; do
sleep 2
echo "Waiting for initial tests..."
done
echo "Initial client tests passed, proceeding with revocation tests"

# =====================================================
# Test certificate revocation functionality
# =====================================================
Expand Down
Loading