Skip to content

Commit 63448d5

Browse files
angristanangristan
authored
fix: test client connectivity both before and after cert renewal (angristan#1481)
- Fix fingerprint CI test that started consistently failing after the EasyRSA 3.2.6 update - The client config was copied to `/shared/` before server cert renewal changed the fingerprint, causing a TLS handshake failure race condition - Instead of just fixing the race, add proper two-phase connectivity testing: client connects before renewal, server renews certs, client reconnects with the updated config
1 parent ea440ad commit 63448d5

2 files changed

Lines changed: 93 additions & 40 deletions

File tree

‎test/client-entrypoint.sh‎

Lines changed: 68 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,29 @@ fi
1212

1313
echo "TUN device ready"
1414

15+
test_dns_resolution() {
16+
local label="$1"
17+
local success=false
18+
echo "$label: Testing DNS resolution via Unbound ($VPN_GATEWAY)..."
19+
for i in $(seq 1 10); do
20+
DIG_OUTPUT=$(dig @"$VPN_GATEWAY" example.com +short +time=5 2>&1)
21+
if [ -n "$DIG_OUTPUT" ] && ! echo "$DIG_OUTPUT" | grep -qi "timed out\|SERVFAIL\|connection refused"; then
22+
success=true
23+
break
24+
fi
25+
echo "DNS attempt $i failed:"
26+
echo "$DIG_OUTPUT"
27+
sleep 2
28+
done
29+
if [ "$success" = true ]; then
30+
echo "PASS: DNS resolution through Unbound works"
31+
else
32+
echo "FAIL: DNS resolution through Unbound failed after 10 attempts"
33+
dig @"$VPN_GATEWAY" example.com +time=5 || true
34+
exit 1
35+
fi
36+
}
37+
1538
# Wait for client config to be available
1639
echo "Waiting for client config..."
1740
while [ ! -f /shared/client.ovpn ]; do
@@ -110,34 +133,58 @@ if [ "${CLIENT_IPV6:-n}" = "y" ]; then
110133
fi
111134

112135
# Test 3: DNS resolution through Unbound
113-
echo "Test 3: Testing DNS resolution via Unbound ($VPN_GATEWAY)..."
114-
DNS_SUCCESS=false
115-
DNS_MAX_RETRIES=10
116-
for i in $(seq 1 $DNS_MAX_RETRIES); do
117-
DIG_OUTPUT=$(dig @"$VPN_GATEWAY" example.com +short +time=5 2>&1)
118-
if [ -n "$DIG_OUTPUT" ] && ! echo "$DIG_OUTPUT" | grep -qi "timed out\|SERVFAIL\|connection refused"; then
119-
DNS_SUCCESS=true
120-
break
121-
fi
122-
echo "DNS attempt $i failed:"
123-
echo "$DIG_OUTPUT"
124-
sleep 2
125-
done
126-
if [ "$DNS_SUCCESS" = true ]; then
127-
echo "PASS: DNS resolution through Unbound works"
128-
echo "Resolved example.com to: $(dig @"$VPN_GATEWAY" example.com +short +time=5)"
129-
else
130-
echo "FAIL: DNS resolution through Unbound failed after $DNS_MAX_RETRIES attempts"
131-
dig @"$VPN_GATEWAY" example.com +time=5 || true
132-
exit 1
133-
fi
136+
test_dns_resolution "Test 3"
134137

135138
echo ""
136139
echo "=== Initial connectivity tests PASSED ==="
137140

138141
# Signal server that initial tests passed
139142
touch /shared/initial-tests-passed
140143

144+
# =====================================================
145+
# Post-renewal connectivity tests
146+
# =====================================================
147+
echo ""
148+
echo "=== Waiting for post-renewal config ==="
149+
while [ ! -f /shared/renewal-config-ready ]; do
150+
sleep 2
151+
echo "Waiting for renewal config..."
152+
done
153+
154+
echo "Renewal config ready, reconnecting..."
155+
pkill openvpn || true
156+
sleep 2
157+
158+
openvpn --config /shared/client.ovpn --daemon --log /var/log/openvpn-renewal.log
159+
160+
echo "Waiting for VPN connection after renewal..."
161+
while ! ip addr show tun0 2>/dev/null | grep -q "inet "; do
162+
sleep 2
163+
echo "Waiting for tun0..."
164+
if [ -f /var/log/openvpn-renewal.log ]; then
165+
tail -3 /var/log/openvpn-renewal.log
166+
fi
167+
done
168+
169+
echo "=== VPN Connected after renewal! ==="
170+
ip addr show tun0
171+
172+
echo "Waiting for routing to stabilize..."
173+
sleep 5
174+
175+
echo "Test: Pinging VPN gateway after renewal ($VPN_GATEWAY)..."
176+
while ! ping -c 3 -W 2 "$VPN_GATEWAY" >/dev/null 2>&1; do
177+
echo "Ping failed, retrying..."
178+
sleep 3
179+
done
180+
echo "PASS: Can ping VPN gateway after renewal"
181+
182+
test_dns_resolution "Test: Post-renewal DNS"
183+
184+
echo ""
185+
echo "=== Post-renewal connectivity tests PASSED ==="
186+
touch /shared/renewal-tests-passed
187+
141188
# =====================================================
142189
# Certificate Revocation E2E Tests
143190
# =====================================================

‎test/server-entrypoint.sh‎

Lines changed: 25 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -211,7 +211,7 @@ else
211211
exit 1
212212
fi
213213

214-
# Copy client config to shared volume for the client container
214+
# Copy client config to shared volume for initial connectivity tests
215215
cp /root/testclient.ovpn /shared/client.ovpn
216216
sed -i 's/^remote .*/remote openvpn-server 1194/' /shared/client.ovpn
217217
echo "Client config copied to /shared/client.ovpn"
@@ -356,6 +356,17 @@ fi
356356

357357
echo "=== TLS 1.3 Configuration Verified ==="
358358

359+
# =====================================================
360+
# Wait for initial client tests to complete
361+
# =====================================================
362+
echo ""
363+
echo "=== Waiting for initial client connectivity tests ==="
364+
while [ ! -f /shared/initial-tests-passed ]; do
365+
sleep 2
366+
echo "Waiting for initial tests..."
367+
done
368+
echo "Initial client tests passed, proceeding with renewal tests"
369+
359370
# =====================================================
360371
# Test certificate renewal functionality
361372
# =====================================================
@@ -429,11 +440,6 @@ if [ "$AUTH_MODE" = "pki" ]; then
429440
fi
430441
fi
431442

432-
# Update shared client config with renewed certificate
433-
cp /root/testclient.ovpn /shared/client.ovpn
434-
sed -i 's/^remote .*/remote openvpn-server 1194/' /shared/client.ovpn
435-
echo "Updated client config with renewed certificate"
436-
437443
echo "=== Client Certificate Renewal Tests PASSED ==="
438444

439445
# =====================================================
@@ -538,10 +544,21 @@ done
538544
# Allow routing to stabilize after renewal restart
539545
sleep 3
540546

541-
# Update shared client config after server renewal (fingerprint changed)
542547
cp /root/testclient.ovpn /shared/client.ovpn
543548
sed -i 's/^remote .*/remote openvpn-server 1194/' /shared/client.ovpn
544-
echo "Updated client config with new server fingerprint"
549+
touch /shared/renewal-config-ready
550+
echo "Updated client config with renewed certificates"
551+
552+
# =====================================================
553+
# Wait for post-renewal client connectivity tests
554+
# =====================================================
555+
echo ""
556+
echo "=== Waiting for post-renewal client connectivity tests ==="
557+
while [ ! -f /shared/renewal-tests-passed ]; do
558+
sleep 2
559+
echo "Waiting for renewal tests..."
560+
done
561+
echo "Post-renewal client tests passed"
545562

546563
# =====================================================
547564
# Verify Unbound DNS resolver (started by systemd via install script)
@@ -749,17 +766,6 @@ fi
749766
echo "Allowing routing to stabilize..."
750767
sleep 3
751768

752-
# =====================================================
753-
# Wait for initial client tests to complete
754-
# =====================================================
755-
echo ""
756-
echo "=== Waiting for initial client connectivity tests ==="
757-
while [ ! -f /shared/initial-tests-passed ]; do
758-
sleep 2
759-
echo "Waiting for initial tests..."
760-
done
761-
echo "Initial client tests passed, proceeding with revocation tests"
762-
763769
# =====================================================
764770
# Test certificate revocation functionality
765771
# =====================================================

0 commit comments

Comments
 (0)