if_ovpn: basic test case
ClosedPublic
Actions

Authored by kp on Apr 26 2022, 3:53 PM.

Details

Reviewers

None

Group Reviewers

network
pfsense

Commits

rG067acae2f3a4: if_ovpn tests: basic test case

Summary

Set up an OpenVPN tunnel between two jails, send traffic through them to
confirm basic function.

Sponsored by: Rubicon Communications, LLC ("Netgate")

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

kp created this revision.Apr 26 2022, 3:53 PM

Herald added subscribers: glebius, melifaro, ae, imp. · View Herald TranscriptApr 26 2022, 3:53 PM

kp requested review of this revision.Apr 26 2022, 3:53 PM

Harbormaster completed remote builds in B45380: Diff 105434.Apr 26 2022, 3:53 PM

kp mentioned this in D34340: ovpn: Introduce OpenVPN DCO support.Apr 26 2022, 3:55 PM

emaste added a subscriber: emaste.Apr 26 2022, 4:04 PM

olivier added a subscriber: olivier.Apr 27 2022, 12:08 AM

olivier added inline comments.

tests/sys/net/if_ovpn/client.crt
10	Shouldn't we use a very long validity period here ?
tests/sys/net/if_ovpn/if_ovpn.sh
35	Do we need a specific minimum version of openvpn, or with specific build option set ?
tests/sys/net/if_ovpn/server.crt
10	Same remark about the short validity date here.

Long-lived keys

Harbormaster completed remote builds in B45389: Diff 105460.Apr 27 2022, 3:05 PM

kp added inline comments.Apr 27 2022, 3:06 PM

tests/sys/net/if_ovpn/if_ovpn.sh
35	We do, in ovpn_init. We can't run anything in a test head, so we have to do those checks in the test body. Much like we do for pf, where we check if the module is loaded.

Improve logging

ensure we print log output from all openvpn instances, prefixed with the jail name.

Harbormaster completed remote builds in B45516: Diff 105815.May 10 2022, 4:31 PM

Can we include the command(s) used to generate the certs somewhere, maybe a comment in the test?

In D35067#797292, @emaste wrote:

Can we include the command(s) used to generate the certs somewhere, maybe a comment in the test?

They're pretty standard certs, generated by openssl, but I did create a CA config file. It's a bit much for a comment. Not to mention that I've already forgotten how I've done it.

I initially started with the certs from openvpn's samples, but switched to these because the openvpn certs expire in two years.

This revision was not accepted when it landed; it landed in state Needs Review.Jun 28 2022, 12:00 PM

Closed by commit rG067acae2f3a4: if_ovpn tests: basic test case (authored by kp). · Explain Why

This revision was automatically updated to reflect the committed changes.

kp added a commit: rG067acae2f3a4: if_ovpn tests: basic test case.