if_ovpn: basic test case

[kp]

Summary

Set up an OpenVPN tunnel between two jails, send traffic through them to
confirm basic function.

Sponsored by: Rubicon Communications, LLC ("Netgate")

[olivier]

tests/sys/net/if_ovpn/client.crt

10

Shouldn't we use a very long validity period here ?

tests/sys/net/if_ovpn/if_ovpn.sh

35

Do we need a specific minimum version of openvpn, or with specific build option set ?

tests/sys/net/if_ovpn/server.crt

10

Same remark about the short validity date here.

[kp]

Long-lived keys

[kp]

tests/sys/net/if_ovpn/if_ovpn.sh

35

We do, in ovpn_init.

We can't run anything in a test head, so we have to do those checks in the test body. Much like we do for pf, where we check if the module is loaded.

[kp]

Improve logging

ensure we print log output from all openvpn instances, prefixed with the jail name.

[emaste]

Can we include the command(s) used to generate the certs somewhere, maybe a comment in the test?

[kp]

In D35067#797292, @emaste wrote:

Can we include the command(s) used to generate the certs somewhere, maybe a comment in the test?

They're pretty standard certs, generated by openssl, but I did create a CA config file. It's a bit much for a comment. Not to mention that I've already forgotten how I've done it.

I initially started with the certs from openvpn's samples, but switched to these because the openvpn certs expire in two years.