mirror of
https://github.com/angristan/openvpn-install.git
synced 2026-08-11 09:08:13 +02:00
Add configurable VPN access policies (#1505)
## Summary - add independent install options for internet routing, client-to-client access, and explicit server-side networks - enforce the selected policy across firewalld, nftables, and iptables, including DCO traffic - use destination-scoped NAT for home LAN access and preserve client routes and DNS in split-tunnel mode - document the new defaults and add focused Docker policy coverage Defaults remain internet access enabled, client-to-client access disabled, and server-side network access disabled. Related: #1496 #443 #385 #624 #547 #1436 #1103 #1126 #575 #1434 #1213 #147
This commit is contained in:
Stanislas
@@ -19,7 +19,8 @@ RUN mkdir -p /dev/net
|
||||
|
||||
# Copy test scripts
|
||||
COPY test/client-entrypoint.sh /entrypoint.sh
|
||||
RUN chmod +x /entrypoint.sh
|
||||
COPY test/policy-peer-entrypoint.sh /policy-peer-entrypoint.sh
|
||||
RUN chmod +x /entrypoint.sh /policy-peer-entrypoint.sh
|
||||
|
||||
WORKDIR /etc/openvpn
|
||||
|
||||
|
||||
@@ -68,7 +68,8 @@ RUN chmod +x /opt/openvpn-install.sh
|
||||
# Copy test scripts
|
||||
COPY test/server-entrypoint.sh /entrypoint.sh
|
||||
COPY test/validate-output.sh /opt/test/validate-output.sh
|
||||
RUN chmod +x /entrypoint.sh /opt/test/validate-output.sh
|
||||
COPY test/local-network-detection.sh /opt/test/local-network-detection.sh
|
||||
RUN chmod +x /entrypoint.sh /opt/test/validate-output.sh /opt/test/local-network-detection.sh
|
||||
|
||||
# Create systemd service for the test script
|
||||
# PassEnvironment passes Docker env vars (-e) from PID 1 to the service
|
||||
@@ -80,7 +81,7 @@ RUN printf '%s\n' \
|
||||
'[Service]' \
|
||||
'Type=oneshot' \
|
||||
'Environment=HOME=/root' \
|
||||
'PassEnvironment=AUTH_MODE TLS_SIG TLS_KEY_FILE TLS_VERSION_MIN TLS13_CIPHERSUITES CLIENT_IPV6 VPN_SUBNET_IPV6 WAIT_TIMEOUT_SIGNAL WAIT_TIMEOUT_CONNECT WAIT_TIMEOUT_REVOKE' \
|
||||
'PassEnvironment=AUTH_MODE TLS_SIG TLS_KEY_FILE TLS_VERSION_MIN TLS13_CIPHERSUITES CLIENT_IPV6 VPN_SUBNET_IPV6 ROUTE_INTERNET CLIENT_TO_CLIENT LOCAL_NETWORKS POLICY_E2E WAIT_TIMEOUT_SIGNAL WAIT_TIMEOUT_CONNECT WAIT_TIMEOUT_REVOKE' \
|
||||
'WorkingDirectory=/root' \
|
||||
'ExecStart=/entrypoint.sh' \
|
||||
'RemainAfterExit=yes' \
|
||||
|
||||
+102
-9
@@ -131,10 +131,13 @@ wait_for_revoked_reconnect_rejected() {
|
||||
|
||||
test_dns_resolution() {
|
||||
local label="$1"
|
||||
local test_name="github.com"
|
||||
local success=false
|
||||
# This verifies recursive DNS connectivity. Use an unsigned zone so the test
|
||||
# does not depend on DNSSEC key retrieval over GitHub runner networks.
|
||||
echo "$label: Testing DNS resolution via Unbound ($VPN_GATEWAY)..."
|
||||
for i in $(seq 1 10); do
|
||||
DIG_OUTPUT=$(dig @"$VPN_GATEWAY" example.com +short +time=5 2>&1)
|
||||
DIG_OUTPUT=$(dig @"$VPN_GATEWAY" "$test_name" +short +time=5 2>&1)
|
||||
if [ -n "$DIG_OUTPUT" ] && ! echo "$DIG_OUTPUT" | grep -qi "timed out\|SERVFAIL\|connection refused"; then
|
||||
success=true
|
||||
break
|
||||
@@ -147,7 +150,7 @@ test_dns_resolution() {
|
||||
echo "PASS: DNS resolution through Unbound works"
|
||||
else
|
||||
echo "FAIL: DNS resolution through Unbound failed after 10 attempts"
|
||||
dig @"$VPN_GATEWAY" example.com +time=5 || true
|
||||
dig @"$VPN_GATEWAY" "$test_name" +time=5 || true
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
@@ -220,13 +223,42 @@ if [ "${CLIENT_IPV6:-n}" = "y" ]; then
|
||||
fi
|
||||
fi
|
||||
|
||||
# Test 2: Ping VPN gateway (IPv4)
|
||||
echo "Test 2: Pinging VPN gateway (IPv4) ($VPN_GATEWAY)..."
|
||||
# Test 2: Verify pushed routes match the access policy.
|
||||
echo "Test 2: Checking access policy routes..."
|
||||
if [ "${ROUTE_INTERNET:-y}" = "y" ]; then
|
||||
if ip route show | grep -q '^0.0.0.0/1 .* tun0' && ip route show | grep -q '^128.0.0.0/1 .* tun0'; then
|
||||
echo "PASS: Internet routes use the VPN"
|
||||
else
|
||||
echo "FAIL: VPN internet routes are missing"
|
||||
ip route show
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
if ip route show | grep -qE '^(0\.0\.0\.0/1|128\.0\.0\.0/1) .* tun0'; then
|
||||
echo "FAIL: Internet route uses the VPN in split-tunnel mode"
|
||||
ip route show
|
||||
exit 1
|
||||
fi
|
||||
echo "PASS: Internet routes remain outside the VPN"
|
||||
fi
|
||||
|
||||
if [ -n "${LOCAL_NETWORKS:-}" ]; then
|
||||
while IFS= read -r local_network; do
|
||||
if [[ $local_network == *.* ]] && ! ip route show "$local_network" | grep -q 'tun0'; then
|
||||
echo "FAIL: Local network route is missing for $local_network"
|
||||
ip route show
|
||||
exit 1
|
||||
fi
|
||||
done < <(tr ',' '\n' <<<"$LOCAL_NETWORKS")
|
||||
fi
|
||||
|
||||
# Test 3: Ping VPN gateway (IPv4)
|
||||
echo "Test 3: Pinging VPN gateway (IPv4) ($VPN_GATEWAY)..."
|
||||
wait_for_gateway_ping "VPN gateway (IPv4)"
|
||||
|
||||
# Test 2b: Ping VPN gateway (IPv6, if enabled)
|
||||
# Test 3b: Ping VPN gateway (IPv6, if enabled)
|
||||
if [ "${CLIENT_IPV6:-n}" = "y" ]; then
|
||||
echo "Test 2b: Pinging VPN gateway (IPv6) ($VPN_GATEWAY_IPV6)..."
|
||||
echo "Test 3b: Pinging VPN gateway (IPv6) ($VPN_GATEWAY_IPV6)..."
|
||||
if ping6 -c 5 "$VPN_GATEWAY_IPV6"; then
|
||||
echo "PASS: Can ping VPN gateway (IPv6)"
|
||||
else
|
||||
@@ -235,8 +267,67 @@ if [ "${CLIENT_IPV6:-n}" = "y" ]; then
|
||||
fi
|
||||
fi
|
||||
|
||||
# Test 3: DNS resolution through Unbound
|
||||
test_dns_resolution "Test 3"
|
||||
# Packet-level access policy tests use a second VPN client and a LAN-only host.
|
||||
if [ -n "${POLICY_E2E:-}" ]; then
|
||||
echo "Test 4: Checking packet-level access policy..."
|
||||
wait_for_file /shared/policy-peer-ip "policy peer VPN address"
|
||||
POLICY_PEER_IP=$(cat /shared/policy-peer-ip)
|
||||
POLICY_LAN_IP="${POLICY_LAN_IP:-10.55.0.20}"
|
||||
|
||||
if [ "$POLICY_E2E" = "allow" ]; then
|
||||
if ping -c 3 -W 2 "$POLICY_PEER_IP" >/dev/null; then
|
||||
echo "PASS: Client-to-client packets are allowed"
|
||||
else
|
||||
echo "FAIL: Cannot reach allowed VPN peer $POLICY_PEER_IP"
|
||||
exit 1
|
||||
fi
|
||||
if ping -c 3 -W 2 "$POLICY_LAN_IP" >/dev/null; then
|
||||
echo "PASS: LAN packets and destination-scoped NAT work"
|
||||
else
|
||||
echo "FAIL: Cannot reach allowed LAN host $POLICY_LAN_IP"
|
||||
exit 1
|
||||
fi
|
||||
elif [ "$POLICY_E2E" = "deny" ]; then
|
||||
if ping -c 1 -W 2 "$POLICY_PEER_IP" >/dev/null; then
|
||||
echo "FAIL: Isolated VPN peer $POLICY_PEER_IP is reachable"
|
||||
exit 1
|
||||
fi
|
||||
echo "PASS: Client-to-client packets are blocked"
|
||||
if ping -c 1 -W 2 "$POLICY_LAN_IP" >/dev/null; then
|
||||
echo "FAIL: Unexposed LAN host $POLICY_LAN_IP is reachable"
|
||||
exit 1
|
||||
fi
|
||||
echo "PASS: Unexposed LAN packets are blocked"
|
||||
else
|
||||
echo "FAIL: Unknown POLICY_E2E value: $POLICY_E2E"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ "${ROUTE_INTERNET:-y}" = "y" ]; then
|
||||
PUBLIC_DNS_OUTPUT=""
|
||||
for _ in $(seq 1 5); do
|
||||
PUBLIC_DNS_OUTPUT=$(dig @1.1.1.1 example.com +short +tcp +time=5 +tries=1 2>&1) || true
|
||||
if grep -qE '^[0-9]+(\.[0-9]+){3}$' <<<"$PUBLIC_DNS_OUTPUT"; then
|
||||
break
|
||||
fi
|
||||
PUBLIC_DNS_OUTPUT=""
|
||||
sleep 2
|
||||
done
|
||||
if [ -n "$PUBLIC_DNS_OUTPUT" ]; then
|
||||
echo "PASS: Direct internet packets traverse VPN forwarding and NAT"
|
||||
else
|
||||
echo "FAIL: Direct public DNS query through the VPN failed"
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
# Test 5: DNS resolution through Unbound in full-tunnel mode.
|
||||
if [ "${ROUTE_INTERNET:-y}" = "y" ]; then
|
||||
test_dns_resolution "Test 5"
|
||||
else
|
||||
echo "Test 5: SKIP: VPN DNS is disabled in split-tunnel mode"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "=== Initial connectivity tests PASSED ==="
|
||||
@@ -269,7 +360,9 @@ sleep 5
|
||||
echo "Test: Pinging VPN gateway after renewal ($VPN_GATEWAY)..."
|
||||
wait_for_gateway_ping "VPN gateway after renewal"
|
||||
|
||||
test_dns_resolution "Test: Post-renewal DNS"
|
||||
if [ "${ROUTE_INTERNET:-y}" = "y" ]; then
|
||||
test_dns_resolution "Test: Post-renewal DNS"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "=== Post-renewal connectivity tests PASSED ==="
|
||||
|
||||
Executable
+92
@@ -0,0 +1,92 @@
|
||||
#!/bin/bash
|
||||
# shellcheck disable=SC1091,SC2034
|
||||
# SC1091: The installer path is provided by the test environment.
|
||||
# SC2034: VPN subnet globals are consumed by sourced installer functions.
|
||||
set -euo pipefail
|
||||
|
||||
INSTALLER=${1:-/opt/openvpn-install.sh}
|
||||
TEMP_DIR=$(mktemp -d)
|
||||
trap 'rm -rf "$TEMP_DIR"' EXIT
|
||||
|
||||
cat >"$TEMP_DIR/ip" <<'EOF'
|
||||
#!/bin/bash
|
||||
case "$*" in
|
||||
"-4 -o route show type unicast")
|
||||
cat <<'ROUTES'
|
||||
default via 167.172.176.1 dev public0
|
||||
10.8.0.0/24 dev tun-test proto kernel scope link
|
||||
10.19.0.0/16 dev public0 proto kernel scope link src 10.19.0.5
|
||||
10.135.0.0/16 dev eth1 proto kernel scope link src 10.135.0.2
|
||||
10.135.0.0/16 dev eth1 proto kernel scope link src 10.135.0.2
|
||||
10.200.0.0/16 via 10.135.0.1 dev eth1
|
||||
100.64.0.0/10 dev tailscale0 proto kernel scope link
|
||||
169.254.0.0/16 dev eth1 proto kernel scope link
|
||||
172.20.0.0/16 dev docker0 proto kernel scope link
|
||||
192.168.50.0/24 dev lan0 proto kernel scope link
|
||||
203.0.113.0/24 dev public0 proto kernel scope link
|
||||
ROUTES
|
||||
;;
|
||||
"-6 -o route show type unicast")
|
||||
cat <<'ROUTES'
|
||||
default via fe80::1 dev public0
|
||||
fc00:1::/64 via fd12:3456::1 dev lan0
|
||||
fd12:3456::/64 dev lan0 proto kernel metric 256
|
||||
fe80::/64 dev public0 proto kernel metric 256
|
||||
2001:db8::/64 dev public0 proto kernel metric 256
|
||||
ROUTES
|
||||
;;
|
||||
"-4 -o address show dev public0 scope global")
|
||||
cat <<'ADDRESSES'
|
||||
2: public0 inet 203.0.113.10/24 brd 203.0.113.255 scope global public0
|
||||
2: public0 inet 10.19.0.5/16 brd 10.19.255.255 scope global public0
|
||||
ADDRESSES
|
||||
;;
|
||||
"-4 -o address show dev eth1 scope global")
|
||||
echo "3: eth1 inet 10.135.0.2/16 brd 10.135.255.255 scope global eth1"
|
||||
;;
|
||||
esac
|
||||
EOF
|
||||
chmod +x "$TEMP_DIR/ip"
|
||||
|
||||
export FORCE_COLOR=0 LOG_FILE="" NON_INTERACTIVE_INSTALL=n OUTPUT_FORMAT=table
|
||||
# shellcheck source=../openvpn-install.sh
|
||||
source "$INSTALLER"
|
||||
PATH="$TEMP_DIR:$PATH"
|
||||
|
||||
VPN_SUBNET_IPV4=10.8.0.0
|
||||
VPN_SUBNET_IPV6=fd42:42:42:42::
|
||||
|
||||
assert_equal() {
|
||||
local expected="$1" actual="$2" description="$3"
|
||||
if [[ $actual != "$expected" ]]; then
|
||||
echo "FAIL: $description" >&2
|
||||
echo "Expected: $expected" >&2
|
||||
echo "Actual: $actual" >&2
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
assert_equal \
|
||||
"10.135.0.0/16,172.20.0.0/16,192.168.50.0/24,fd12:3456::/64" \
|
||||
"$(detect_private_local_networks y y)" \
|
||||
"detects unique, directly connected RFC1918 and ULA networks"
|
||||
assert_equal \
|
||||
"10.135.0.0/16,172.20.0.0/16,192.168.50.0/24" \
|
||||
"$(detect_private_local_networks y n)" \
|
||||
"honors IPv4-only client configuration"
|
||||
assert_equal \
|
||||
"fd12:3456::/64" \
|
||||
"$(detect_private_local_networks n y)" \
|
||||
"honors IPv6-only client configuration"
|
||||
assert_equal "" "$(detect_private_local_networks n n)" "returns an empty list when both families are disabled"
|
||||
|
||||
if is_private_ipv4_network 10.0.0.0/7; then
|
||||
echo "FAIL: IPv4 network broader than RFC1918 space was accepted" >&2
|
||||
exit 1
|
||||
fi
|
||||
if is_private_ipv6_network fc00::/6; then
|
||||
echo "FAIL: IPv6 network broader than ULA space was accepted" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "PASS: Local network candidate detection"
|
||||
Executable
+35
@@ -0,0 +1,35 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
WAIT_TIMEOUT="${WAIT_TIMEOUT:-120}"
|
||||
elapsed=0
|
||||
|
||||
while [ ! -f /shared/policy-peer.ovpn ]; do
|
||||
if [ "$elapsed" -ge "$WAIT_TIMEOUT" ]; then
|
||||
echo "FAIL: Timed out waiting for peer client configuration"
|
||||
exit 1
|
||||
fi
|
||||
echo "Waiting for peer client configuration... (${elapsed}/${WAIT_TIMEOUT}s)"
|
||||
sleep 2
|
||||
elapsed=$((elapsed + 2))
|
||||
done
|
||||
|
||||
openvpn --config /shared/policy-peer.ovpn --daemon --log /var/log/openvpn-policy-peer.log
|
||||
|
||||
elapsed=0
|
||||
until ip -4 addr show tun0 2>/dev/null | grep -q 'inet '; do
|
||||
if [ "$elapsed" -ge "$WAIT_TIMEOUT" ]; then
|
||||
echo "FAIL: Timed out waiting for peer VPN connection"
|
||||
cat /var/log/openvpn-policy-peer.log 2>/dev/null || true
|
||||
exit 1
|
||||
fi
|
||||
echo "Waiting for peer VPN connection... (${elapsed}/${WAIT_TIMEOUT}s)"
|
||||
sleep 2
|
||||
elapsed=$((elapsed + 2))
|
||||
done
|
||||
|
||||
PEER_IP=$(ip -4 -o addr show tun0 | awk '{print $4}' | cut -d/ -f1)
|
||||
printf '%s\n' "$PEER_IP" >/shared/policy-peer-ip
|
||||
echo "Policy peer connected with VPN address $PEER_IP"
|
||||
|
||||
exec tail -f /var/log/openvpn-policy-peer.log
|
||||
+251
-109
@@ -3,6 +3,8 @@ set -e
|
||||
|
||||
echo "=== OpenVPN Server Container ==="
|
||||
|
||||
/opt/test/local-network-detection.sh /opt/openvpn-install.sh
|
||||
|
||||
# Create TUN device if it doesn't exist
|
||||
if [ ! -c /dev/net/tun ]; then
|
||||
mkdir -p /dev/net
|
||||
@@ -57,10 +59,28 @@ if grep -q $'\033' "$NO_COLOR_OUTPUT"; then
|
||||
fi
|
||||
echo "PASS: --no-color help output has no ANSI escape sequences"
|
||||
|
||||
INVALID_NETWORK_OUTPUT="/tmp/invalid-local-network.log"
|
||||
if /opt/openvpn-install.sh install --local-network 192.168.1.1/24 >"$INVALID_NETWORK_OUTPUT" 2>&1; then
|
||||
echo "FAIL: Host-address CIDR was accepted as a local network"
|
||||
exit 1
|
||||
elif grep -q "Invalid local network" "$INVALID_NETWORK_OUTPUT"; then
|
||||
echo "PASS: Invalid local network CIDR is rejected"
|
||||
else
|
||||
echo "FAIL: Expected local network validation error"
|
||||
cat "$INVALID_NETWORK_OUTPUT"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Calculate VPN gateway from subnet (first usable IP)
|
||||
VPN_GATEWAY="${VPN_SUBNET_IPV4%.*}.1"
|
||||
export VPN_GATEWAY
|
||||
|
||||
# Access policy configuration
|
||||
ROUTE_INTERNET="${ROUTE_INTERNET:-y}"
|
||||
CLIENT_TO_CLIENT="${CLIENT_TO_CLIENT:-n}"
|
||||
LOCAL_NETWORKS="${LOCAL_NETWORKS:-}"
|
||||
POLICY_E2E="${POLICY_E2E:-}"
|
||||
|
||||
# IPv6 configuration (optional)
|
||||
# CLIENT_IPV6: y/n to enable IPv6 for VPN clients
|
||||
# VPN_SUBNET_IPV6: IPv6 subnet (ULA prefix, e.g., fd42:42:42:42::)
|
||||
@@ -95,6 +115,18 @@ INSTALL_CMD+=(--subnet-ipv4 "$VPN_SUBNET_IPV4")
|
||||
INSTALL_CMD+=(--mtu 1400)
|
||||
INSTALL_CMD+=(--client testclient)
|
||||
|
||||
if [ "$ROUTE_INTERNET" = "n" ]; then
|
||||
INSTALL_CMD+=(--no-route-internet)
|
||||
fi
|
||||
if [ "$CLIENT_TO_CLIENT" = "y" ]; then
|
||||
INSTALL_CMD+=(--client-to-client)
|
||||
fi
|
||||
if [ -n "$LOCAL_NETWORKS" ]; then
|
||||
while IFS= read -r local_network; do
|
||||
INSTALL_CMD+=(--local-network "$local_network")
|
||||
done < <(tr ',' '\n' <<<"$LOCAL_NETWORKS")
|
||||
fi
|
||||
|
||||
# Add IPv6 client support if enabled
|
||||
if [ "$CLIENT_IPV6" = "y" ]; then
|
||||
INSTALL_CMD+=(--client-ipv6)
|
||||
@@ -197,6 +229,65 @@ fi
|
||||
|
||||
echo "All required files present"
|
||||
|
||||
# =====================================================
|
||||
# Verify access policy configuration
|
||||
# =====================================================
|
||||
echo ""
|
||||
echo "=== Verifying Access Policy Configuration ==="
|
||||
|
||||
if [ "$ROUTE_INTERNET" = "y" ]; then
|
||||
if grep -q '^push "redirect-gateway def1 bypass-dhcp"' /etc/openvpn/server/server.conf; then
|
||||
echo "PASS: Internet default route is pushed"
|
||||
else
|
||||
echo "FAIL: Internet default route is missing"
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
if grep -q 'redirect-gateway\|block-ipv6' /etc/openvpn/server/server.conf; then
|
||||
echo "FAIL: Internet or leak-blocking routes exist in split-tunnel mode"
|
||||
exit 1
|
||||
fi
|
||||
echo "PASS: Client internet routes remain outside the VPN"
|
||||
fi
|
||||
|
||||
if [ "$CLIENT_TO_CLIENT" = "y" ]; then
|
||||
grep -q '^client-to-client$' /etc/openvpn/server/server.conf || {
|
||||
echo "FAIL: client-to-client directive is missing"
|
||||
exit 1
|
||||
}
|
||||
else
|
||||
if grep -q '^client-to-client$' /etc/openvpn/server/server.conf; then
|
||||
echo "FAIL: client-to-client is enabled by default"
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ -n "$LOCAL_NETWORKS" ]; then
|
||||
while IFS= read -r local_network; do
|
||||
if [[ $local_network == *.* ]]; then
|
||||
local_address="${local_network%/*}"
|
||||
grep -q "^push \"route $local_address " /etc/openvpn/server/server.conf || {
|
||||
echo "FAIL: Local IPv4 route for $local_network is missing"
|
||||
exit 1
|
||||
}
|
||||
else
|
||||
grep -q "^push \"route-ipv6 $local_network\"" /etc/openvpn/server/server.conf || {
|
||||
echo "FAIL: Local IPv6 route for $local_network is missing"
|
||||
exit 1
|
||||
}
|
||||
fi
|
||||
done < <(tr ',' '\n' <<<"$LOCAL_NETWORKS")
|
||||
fi
|
||||
|
||||
for setting in "ROUTE_INTERNET=$ROUTE_INTERNET" "CLIENT_TO_CLIENT=$CLIENT_TO_CLIENT" "LOCAL_NETWORKS=$LOCAL_NETWORKS"; do
|
||||
grep -Fxq "$setting" /etc/openvpn/server/openvpn-install.conf || {
|
||||
echo "FAIL: Policy manifest is missing $setting"
|
||||
exit 1
|
||||
}
|
||||
done
|
||||
|
||||
echo "PASS: Access policy configuration is correct"
|
||||
|
||||
# =====================================================
|
||||
# Verify management interface configuration
|
||||
# =====================================================
|
||||
@@ -253,6 +344,17 @@ else
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ -n "$POLICY_E2E" ]; then
|
||||
echo "Creating second VPN client for packet-level policy tests..."
|
||||
bash /opt/openvpn-install.sh client add policy-peer --cert-days 3650
|
||||
if [ ! -f /root/policy-peer.ovpn ]; then
|
||||
echo "FAIL: Policy peer client configuration was not generated"
|
||||
exit 1
|
||||
fi
|
||||
cp /root/policy-peer.ovpn /shared/policy-peer.ovpn
|
||||
sed -i 's/^remote .*/remote openvpn-server 1194/' /shared/policy-peer.ovpn
|
||||
fi
|
||||
|
||||
# Copy client config to shared volume for initial connectivity tests
|
||||
cp /root/testclient.ovpn /shared/client.ovpn
|
||||
sed -i 's/^remote .*/remote openvpn-server 1194/' /shared/client.ovpn
|
||||
@@ -264,6 +366,9 @@ echo "Client config copied to /shared/client.ovpn"
|
||||
echo "VPN_GATEWAY=$VPN_GATEWAY"
|
||||
echo "CLIENT_IPV6=$CLIENT_IPV6"
|
||||
echo "AUTH_MODE=$AUTH_MODE"
|
||||
echo "ROUTE_INTERNET=$ROUTE_INTERNET"
|
||||
echo "CLIENT_TO_CLIENT=$CLIENT_TO_CLIENT"
|
||||
echo "LOCAL_NETWORKS=$LOCAL_NETWORKS"
|
||||
if [ "$CLIENT_IPV6" = "y" ]; then
|
||||
echo "VPN_SUBNET_IPV6=$VPN_SUBNET_IPV6"
|
||||
echo "VPN_GATEWAY_IPV6=$VPN_GATEWAY_IPV6"
|
||||
@@ -599,87 +704,117 @@ echo "Post-renewal client tests passed"
|
||||
# =====================================================
|
||||
# Verify Unbound DNS resolver (started by systemd via install script)
|
||||
# =====================================================
|
||||
echo "=== Verifying Unbound DNS Resolver ==="
|
||||
if [ "$ROUTE_INTERNET" = "y" ]; then
|
||||
echo "=== Verifying Unbound DNS Resolver ==="
|
||||
|
||||
if [ -f /etc/unbound/unbound.conf ]; then
|
||||
# Verify Unbound is running (started by systemctl in install script)
|
||||
echo "Checking Unbound service status..."
|
||||
for _ in $(seq 1 30); do
|
||||
if pgrep -x unbound >/dev/null; then
|
||||
echo "PASS: Unbound is running"
|
||||
break
|
||||
if [ -f /etc/unbound/unbound.conf ]; then
|
||||
# Verify Unbound is running (started by systemctl in install script)
|
||||
echo "Checking Unbound service status..."
|
||||
for _ in $(seq 1 30); do
|
||||
if pgrep -x unbound >/dev/null; then
|
||||
echo "PASS: Unbound is running"
|
||||
break
|
||||
fi
|
||||
sleep 1
|
||||
done
|
||||
if ! pgrep -x unbound >/dev/null; then
|
||||
echo "FAIL: Unbound is not running"
|
||||
systemctl status unbound 2>&1 || true
|
||||
journalctl -u unbound --no-pager -n 50 2>&1 || true
|
||||
exit 1
|
||||
fi
|
||||
sleep 1
|
||||
done
|
||||
if ! pgrep -x unbound >/dev/null; then
|
||||
echo "FAIL: Unbound is not running"
|
||||
systemctl status unbound 2>&1 || true
|
||||
journalctl -u unbound --no-pager -n 50 2>&1 || true
|
||||
else
|
||||
echo "FAIL: /etc/unbound/unbound.conf not found"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "=== Verifying Unbound Installation ==="
|
||||
|
||||
# Verify Unbound config exists in conf.d directory
|
||||
UNBOUND_OPENVPN_CONF="/etc/unbound/unbound.conf.d/openvpn.conf"
|
||||
if [ -f "$UNBOUND_OPENVPN_CONF" ]; then
|
||||
echo "PASS: Found Unbound config at $UNBOUND_OPENVPN_CONF"
|
||||
else
|
||||
echo "FAIL: OpenVPN Unbound config not found at $UNBOUND_OPENVPN_CONF"
|
||||
echo "Contents of /etc/unbound/:"
|
||||
ls -la /etc/unbound/
|
||||
ls -la /etc/unbound/unbound.conf.d/ 2>/dev/null || true
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Verify Unbound listens on VPN gateway
|
||||
if grep -q "interface: $VPN_GATEWAY" "$UNBOUND_OPENVPN_CONF"; then
|
||||
echo "PASS: Unbound configured to listen on $VPN_GATEWAY"
|
||||
else
|
||||
echo "FAIL: Unbound not configured for $VPN_GATEWAY"
|
||||
cat "$UNBOUND_OPENVPN_CONF"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Verify OpenVPN pushes correct DNS
|
||||
if grep -q "push \"dhcp-option DNS $VPN_GATEWAY\"" /etc/openvpn/server/server.conf; then
|
||||
echo "PASS: OpenVPN configured to push Unbound DNS"
|
||||
else
|
||||
echo "FAIL: OpenVPN not configured to push Unbound DNS"
|
||||
grep "dhcp-option DNS" /etc/openvpn/server/server.conf || echo "No DNS push found"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "=== Unbound Installation Verified ==="
|
||||
echo ""
|
||||
else
|
||||
echo "FAIL: /etc/unbound/unbound.conf not found"
|
||||
exit 1
|
||||
if grep -q '^push "dhcp-option DNS ' /etc/openvpn/server/server.conf; then
|
||||
echo "FAIL: DNS is pushed while internet routing is disabled"
|
||||
exit 1
|
||||
fi
|
||||
echo "PASS: VPN DNS setup is skipped in split-tunnel mode"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "=== Verifying Unbound Installation ==="
|
||||
|
||||
# Verify Unbound config exists in conf.d directory
|
||||
UNBOUND_OPENVPN_CONF="/etc/unbound/unbound.conf.d/openvpn.conf"
|
||||
if [ -f "$UNBOUND_OPENVPN_CONF" ]; then
|
||||
echo "PASS: Found Unbound config at $UNBOUND_OPENVPN_CONF"
|
||||
else
|
||||
echo "FAIL: OpenVPN Unbound config not found at $UNBOUND_OPENVPN_CONF"
|
||||
echo "Contents of /etc/unbound/:"
|
||||
ls -la /etc/unbound/
|
||||
ls -la /etc/unbound/unbound.conf.d/ 2>/dev/null || true
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Verify Unbound listens on VPN gateway
|
||||
if grep -q "interface: $VPN_GATEWAY" "$UNBOUND_OPENVPN_CONF"; then
|
||||
echo "PASS: Unbound configured to listen on $VPN_GATEWAY"
|
||||
else
|
||||
echo "FAIL: Unbound not configured for $VPN_GATEWAY"
|
||||
cat "$UNBOUND_OPENVPN_CONF"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Verify OpenVPN pushes correct DNS
|
||||
if grep -q "push \"dhcp-option DNS $VPN_GATEWAY\"" /etc/openvpn/server/server.conf; then
|
||||
echo "PASS: OpenVPN configured to push Unbound DNS"
|
||||
else
|
||||
echo "FAIL: OpenVPN not configured to push Unbound DNS"
|
||||
grep "dhcp-option DNS" /etc/openvpn/server/server.conf || echo "No DNS push found"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "=== Unbound Installation Verified ==="
|
||||
echo ""
|
||||
|
||||
# Verify OpenVPN server (started by systemd via install script)
|
||||
echo "Verifying OpenVPN server..."
|
||||
|
||||
# Verify firewall rules exist
|
||||
echo "Verifying firewall rules..."
|
||||
if systemctl is-active --quiet firewalld; then
|
||||
# firewalld is active - verify masquerade is enabled
|
||||
echo "firewalld detected, checking masquerade..."
|
||||
for _ in $(seq 1 10); do
|
||||
if firewall-cmd --query-masquerade 2>/dev/null; then
|
||||
echo "PASS: firewalld masquerade is enabled"
|
||||
break
|
||||
fi
|
||||
sleep 1
|
||||
done
|
||||
if ! firewall-cmd --query-masquerade 2>/dev/null; then
|
||||
echo "FAIL: firewalld masquerade is not enabled"
|
||||
echo "Current firewalld config:"
|
||||
firewall-cmd --list-all 2>&1 || true
|
||||
echo "firewalld detected, checking scoped policy rules..."
|
||||
if ! firewall-cmd --get-policies | grep -qw openvpn-egress; then
|
||||
echo "FAIL: firewalld OpenVPN policy is missing"
|
||||
exit 1
|
||||
fi
|
||||
if ! firewall-cmd --zone=openvpn-install --query-source="$VPN_SUBNET_IPV4/24"; then
|
||||
echo "FAIL: firewalld OpenVPN source zone is missing"
|
||||
exit 1
|
||||
fi
|
||||
if [ "$(firewall-cmd --permanent --policy=openvpn-egress --get-target)" != "DROP" ]; then
|
||||
echo "FAIL: firewalld OpenVPN policy does not default to DROP"
|
||||
exit 1
|
||||
fi
|
||||
FIREWALLD_POLICY_RULES=$(firewall-cmd --policy=openvpn-egress --list-rich-rules)
|
||||
if [ "$ROUTE_INTERNET" = "y" ]; then
|
||||
if grep -q 'family="ipv4" masquerade' <<<"$FIREWALLD_POLICY_RULES"; then
|
||||
echo "PASS: firewalld has policy-scoped internet NAT"
|
||||
else
|
||||
echo "FAIL: firewalld policy-scoped internet NAT is missing"
|
||||
printf '%s\n' "$FIREWALLD_POLICY_RULES"
|
||||
exit 1
|
||||
fi
|
||||
if grep -q 'destination address="10.0.0.0/8" reject' <<<"$FIREWALLD_POLICY_RULES"; then
|
||||
echo "PASS: firewalld private-network isolation is configured"
|
||||
else
|
||||
echo "FAIL: firewalld private-network isolation is missing"
|
||||
printf '%s\n' "$FIREWALLD_POLICY_RULES"
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
if [ "$CLIENT_TO_CLIENT" = "y" ] && ! firewall-cmd --zone=openvpn-install --query-forward; then
|
||||
echo "FAIL: firewalld client-to-client forwarding is missing"
|
||||
exit 1
|
||||
fi
|
||||
if firewall-cmd --query-masquerade 2>/dev/null; then
|
||||
echo "FAIL: firewalld zone-wide masquerade should not be enabled"
|
||||
exit 1
|
||||
fi
|
||||
# Verify port is open
|
||||
if firewall-cmd --list-ports | grep -q "1194/udp"; then
|
||||
echo "PASS: OpenVPN port is open in firewalld"
|
||||
else
|
||||
@@ -687,15 +822,6 @@ if systemctl is-active --quiet firewalld; then
|
||||
firewall-cmd --list-ports
|
||||
exit 1
|
||||
fi
|
||||
# Verify VPN subnet rich rule exists (source-based rules work reliably across firewalld backends)
|
||||
if firewall-cmd --list-rich-rules | grep -q "source address=\"$VPN_SUBNET_IPV4/24\""; then
|
||||
echo "PASS: VPN subnet rich rule is configured"
|
||||
else
|
||||
echo "FAIL: VPN subnet rich rule not found in firewalld"
|
||||
echo "Current rich rules:"
|
||||
firewall-cmd --list-rich-rules
|
||||
exit 1
|
||||
fi
|
||||
elif systemctl is-active --quiet nftables; then
|
||||
# nftables mode - verify OpenVPN tables exist
|
||||
echo "nftables detected, checking OpenVPN tables..."
|
||||
@@ -712,20 +838,25 @@ elif systemctl is-active --quiet nftables; then
|
||||
nft list ruleset 2>&1 || true
|
||||
exit 1
|
||||
fi
|
||||
# Verify NAT table exists
|
||||
if nft list table ip openvpn-nat >/dev/null 2>&1; then
|
||||
echo "PASS: nftables 'ip openvpn-nat' table exists"
|
||||
else
|
||||
echo "FAIL: nftables 'ip openvpn-nat' table not found"
|
||||
nft list ruleset 2>&1 || true
|
||||
exit 1
|
||||
if [ "$ROUTE_INTERNET" = "y" ] || [ -n "$LOCAL_NETWORKS" ]; then
|
||||
if nft list table ip openvpn-nat >/dev/null 2>&1 && nft list table ip openvpn-nat | grep -q "masquerade"; then
|
||||
echo "PASS: nftables scoped NAT is configured"
|
||||
else
|
||||
echo "FAIL: nftables scoped NAT is missing"
|
||||
nft list ruleset 2>&1 || true
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
# Verify masquerade rule exists
|
||||
if nft list table ip openvpn-nat | grep -q "masquerade"; then
|
||||
echo "PASS: nftables masquerade rule exists"
|
||||
else
|
||||
echo "FAIL: nftables masquerade rule not found"
|
||||
nft list table ip openvpn-nat 2>&1 || true
|
||||
if [ "$ROUTE_INTERNET" = "y" ]; then
|
||||
if nft list table inet openvpn | grep -q "ip daddr 10.0.0.0/8 drop"; then
|
||||
echo "PASS: nftables private-network isolation is configured"
|
||||
else
|
||||
echo "FAIL: nftables private-network isolation is missing"
|
||||
nft list table inet openvpn
|
||||
exit 1
|
||||
fi
|
||||
elif ! nft list table inet openvpn | grep -q "ip saddr $VPN_SUBNET_IPV4/24 drop"; then
|
||||
echo "FAIL: nftables split-tunnel default drop is missing"
|
||||
exit 1
|
||||
fi
|
||||
# Verify include in nftables.conf
|
||||
@@ -737,20 +868,32 @@ elif systemctl is-active --quiet nftables; then
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
# iptables mode - verify NAT rules
|
||||
echo "iptables mode, checking NAT rules..."
|
||||
for _ in $(seq 1 10); do
|
||||
if iptables -t nat -L POSTROUTING -n | grep -q "$VPN_SUBNET_IPV4"; then
|
||||
echo "PASS: NAT POSTROUTING rule for $VPN_SUBNET_IPV4/24 exists"
|
||||
break
|
||||
echo "iptables mode, checking policy rules..."
|
||||
if [ "$ROUTE_INTERNET" = "y" ] || [ -n "$LOCAL_NETWORKS" ]; then
|
||||
for _ in $(seq 1 10); do
|
||||
iptables -t nat -L POSTROUTING -n | grep -q "$VPN_SUBNET_IPV4" && break
|
||||
sleep 1
|
||||
done
|
||||
if ! iptables -t nat -L POSTROUTING -n | grep -q "$VPN_SUBNET_IPV4"; then
|
||||
echo "FAIL: Expected scoped NAT rule was not found"
|
||||
iptables -t nat -L POSTROUTING -n -v
|
||||
exit 1
|
||||
fi
|
||||
sleep 1
|
||||
done
|
||||
if ! iptables -t nat -L POSTROUTING -n | grep -q "$VPN_SUBNET_IPV4"; then
|
||||
echo "FAIL: NAT POSTROUTING rule for $VPN_SUBNET_IPV4/24 not found"
|
||||
echo "Current NAT rules:"
|
||||
iptables -t nat -L POSTROUTING -n -v
|
||||
systemctl status iptables-openvpn 2>&1 || true
|
||||
fi
|
||||
if [ "$ROUTE_INTERNET" = "y" ]; then
|
||||
if iptables -S OPENVPN_INSTALL_FORWARD | grep -q -- "-d 10.0.0.0/8 -j REJECT"; then
|
||||
echo "PASS: iptables private-network isolation is configured"
|
||||
else
|
||||
echo "FAIL: iptables private-network isolation is missing"
|
||||
iptables -S OPENVPN_INSTALL_FORWARD
|
||||
exit 1
|
||||
fi
|
||||
elif ! iptables -S OPENVPN_INSTALL_FORWARD | grep -q -- "-A OPENVPN_INSTALL_FORWARD -j REJECT"; then
|
||||
echo "FAIL: iptables split-tunnel default reject is missing"
|
||||
exit 1
|
||||
fi
|
||||
if [ "$CLIENT_TO_CLIENT" = "y" ] && ! iptables -S OPENVPN_INSTALL_FORWARD | grep -q -- "-d $VPN_SUBNET_IPV4/24 -j ACCEPT"; then
|
||||
echo "FAIL: iptables client-to-client allow rule is missing"
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
@@ -930,10 +1073,8 @@ echo "=== Certificate Revocation Tests PASSED ==="
|
||||
echo ""
|
||||
echo "=== Testing List Client Certificates ==="
|
||||
|
||||
# At this point we have 3 client certificates:
|
||||
# - testclient (Valid) - the renewed certificate
|
||||
# - testclient (Revoked) - the old certificate revoked during renewal
|
||||
# - revoketest (Revoked) - the revoked certificate
|
||||
# At this point PKI mode has three lifecycle-test certificates, plus the
|
||||
# optional policy peer used by packet-level access tests.
|
||||
LIST_OUTPUT="/tmp/list-clients-output.log"
|
||||
(bash /opt/openvpn-install.sh client list) 2>&1 | tee "$LIST_OUTPUT" || true
|
||||
|
||||
@@ -956,8 +1097,9 @@ fi
|
||||
|
||||
# Verify certificate count (varies by auth mode)
|
||||
if [ "$AUTH_MODE" = "pki" ]; then
|
||||
# PKI mode: 3 certs (testclient valid, testclient revoked from renewal, revoketest revoked)
|
||||
if grep -q "Found 3 client certificate(s)" "$LIST_OUTPUT"; then
|
||||
EXPECTED_CLIENT_COUNT=3
|
||||
[ -n "$POLICY_E2E" ] && EXPECTED_CLIENT_COUNT=4
|
||||
if grep -q "Found $EXPECTED_CLIENT_COUNT client certificate(s)" "$LIST_OUTPUT"; then
|
||||
echo "PASS: List shows correct certificate count"
|
||||
else
|
||||
echo "FAIL: List does not show correct certificate count"
|
||||
@@ -993,10 +1135,10 @@ fi
|
||||
# Verify client count in JSON (varies by auth mode)
|
||||
JSON_CLIENT_COUNT=$(jq '.clients | length' "$LIST_JSON_OUTPUT")
|
||||
if [ "$AUTH_MODE" = "pki" ]; then
|
||||
if [ "$JSON_CLIENT_COUNT" -eq 3 ]; then
|
||||
if [ "$JSON_CLIENT_COUNT" -eq "$EXPECTED_CLIENT_COUNT" ]; then
|
||||
echo "PASS: Client list JSON has correct count ($JSON_CLIENT_COUNT)"
|
||||
else
|
||||
echo "FAIL: Client list JSON has wrong count: $JSON_CLIENT_COUNT (expected 3)"
|
||||
echo "FAIL: Client list JSON has wrong count: $JSON_CLIENT_COUNT (expected $EXPECTED_CLIENT_COUNT)"
|
||||
cat "$LIST_JSON_OUTPUT"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
Reference in New Issue
Block a user