Update the whole project

I've decided to maintain the project myself now, so I've forked it and
create a drone pipeline to push image to my registry

.travis.yml

@@ -1,33 +0,0 @@
-# Disallowing packages: openvpn
-# If you require these packages, please review the package approval process at: https://github.com/travis-ci/apt-package-whitelist#package-approval-process
-#addons:
-#    apt:
-#        sources:
-#            - ubuntu-toolchain-r-test
-#        packages:
-#            - openvpn
-
-services:
-    - docker
-
-before_install:
-    - docker --version
-
-install:
-    - git clone https://github.com/docker-library/official-images.git official-images
-
-# Assist with ci test debugging:
-#   - DEBUG=1
-before_script:
-    - image="kylemanna/openvpn"
-    - docker build -t "$image" .
-    - docker inspect "$image"
-    - docker run --rm "$image" openvpn --version || true # why does it return 1?
-    - docker run --rm "$image" openssl version
-
-script:
-    - official-images/test/run.sh "$image"
-    - test/run.sh "$image"
-
-after_script:
-    - docker images

.woodpecker.yaml

@@ -0,0 +1,34 @@
+---
+when:
+  event:
+    - push
+  branch:
+    - main
+
+matrix:
+  TARGET:
+    - openvpn_xor
+    - openvpn
+
+steps:
+  build-${TARGET}:
+    name: Build ${TARGET}
+    image: git.badhouseplants.net/badhouseplants/badhouseplants-builder:latest
+    secrets:
+      - gitea_token
+    privileged: true
+    depends_on: []
+    backend_options:
+      kubernetes:
+        resources:
+          requests:
+            memory: 500Mi
+            cpu: 200m
+          limits:
+            memory: 500Mi
+            cpu: 200m
+        securityContext:
+          privileged: true
+    commands:
+      - source ./env/${TARGET}.env
+      - ./scripts/$SCRIPT

CONTRIBUTING.md

@@ -25,11 +25,11 @@ In an effort to not repeat bugs (and break less popular features), unit tests ar
 The style of the repo follows that of the Linux kernel, in particular:
 
 * Pull requests should be rebased to small atomic commits so that the merged history is more coherent
-* The subject of the commit should be in the form "<subsystem>: <subject>"
+* The subject of the commit should be in the form "`<subsystem>: <subject>`"
 * More details in the body
 * Match surrounding coding style (line wrapping, spaces, etc)
 
-More details in the [SubmittingPatches](https://www.kernel.org/doc/Documentation/SubmittingPatches) document included with the Linux kernel.  In particular the following sections:
+More details in the [SubmittingPatches](https://www.kernel.org/doc/html/latest/process/submitting-patches.html) document included with the Linux kernel.  In particular the following sections:
 
 * `2) Describe your changes`
 * `3) Separate your changes`

Dockerfile

@@ -1,31 +0,0 @@
-# Original credit: https://github.com/jpetazzo/dockvpn
-
-# Smallest base image
-FROM alpine:3.5
-
-MAINTAINER Kyle Manna <kyle@kylemanna.com>
-
-RUN echo "http://dl-4.alpinelinux.org/alpine/edge/community/" >> /etc/apk/repositories && \
-    echo "http://dl-4.alpinelinux.org/alpine/edge/testing/" >> /etc/apk/repositories && \
-    apk add --update openvpn iptables bash easy-rsa openvpn-auth-pam google-authenticator pamtester && \
-    ln -s /usr/share/easy-rsa/easyrsa /usr/local/bin && \
-    rm -rf /tmp/* /var/tmp/* /var/cache/apk/* /var/cache/distfiles/*
-
-# Needed by scripts
-ENV OPENVPN /etc/openvpn
-ENV EASYRSA /usr/share/easy-rsa
-ENV EASYRSA_PKI $OPENVPN/pki
-ENV EASYRSA_VARS_FILE $OPENVPN/vars
-
-VOLUME ["/etc/openvpn"]
-
-# Internally uses port 1194/udp, remap using `docker run -p 443:1194/tcp`
-EXPOSE 1194/udp
-
-CMD ["ovpn_run"]
-
-ADD ./bin /usr/local/bin
-RUN chmod a+x /usr/local/bin/*
-
-# Add support for OTP authentication using a PAM module
-ADD ./otp/openvpn /etc/pam.d/

README.md

@@ -1,46 +1,62 @@
 # OpenVPN for Docker
 
-[![Build Status](https://travis-ci.org/kylemanna/docker-openvpn.svg)](https://travis-ci.org/kylemanna/docker-openvpn)
-[![Docker Stars](https://img.shields.io/docker/stars/kylemanna/openvpn.svg)](https://hub.docker.com/r/kylemanna/openvpn/)
-[![Docker Pulls](https://img.shields.io/docker/pulls/kylemanna/openvpn.svg)](https://hub.docker.com/r/kylemanna/openvpn/)
-[![ImageLayers](https://images.microbadger.com/badges/image/kylemanna/openvpn.svg)](https://microbadger.com/#/images/kylemanna/openvpn)
-
-
-OpenVPN server in a Docker container complete with an EasyRSA PKI CA.
-
-Extensively tested on [Digital Ocean $5/mo node](http://bit.ly/1C7cKr3) and has
-a corresponding [Digital Ocean Community Tutorial](http://bit.ly/1AGUZkq).
+OpenVPN server in a Docker container complete with an EasyRSA PKI CA, with support for the [Tunnelblick obfuscation patch](https://tunnelblick.net/cOpenvpn_xorpatch.html). Based on [kylemanna's docker-openvpn image](https://github.com/kylemanna/docker-openvpn).
 
 #### Upstream Links
 
-* Docker Registry @ [kylemanna/openvpn](https://hub.docker.com/r/kylemanna/openvpn/)
-* GitHub @ [kylemanna/docker-openvpn](https://github.com/kylemanna/docker-openvpn)
+* Docker Registry @ [lawtancool/docker-openvpn-xor](https://hub.docker.com/r/lawtancool/docker-openvpn-xor)
+* GitHub @ [lawtancool/docker-openvpn-xor](https://github.com/lawtancool/docker-openvpn-xor)
+
+#### Clients with support for the Tunnelblick obfuscation patch
+* Windows: https://github.com/lawtancool/openvpn-windows-xor
+* Android: https://github.com/lawtancool/ics-openvpn-xor
+* macOS: https://tunnelblick.net/
 
 ## Quick Start
 
-* Pick a name for the `$OVPN_DATA` data volume container, it will be created automatically.
+* Pick a name for the `$OVPN_DATA` data volume container. It's recommended to
+  use the `ovpn-data-` prefix to operate seamlessly with the reference systemd
+  service.  Users are encourage to replace `example` with a descriptive name of
+  their choosing.
 
-        OVPN_DATA="ovpn-data"
+      OVPN_DATA="ovpn-data-example"
 
-* Initialize the `$OVPN_DATA` container that will hold the configuration files and certificates
+* Initialize the `$OVPN_DATA` container that will hold the configuration files
+  and certificates.  The container will prompt for a passphrase to protect the
+  private key used by the newly generated certificate authority.
 
       docker volume create --name $OVPN_DATA
-        docker run -v $OVPN_DATA:/etc/openvpn --rm kylemanna/openvpn ovpn_genconfig -u udp://VPN.SERVERNAME.COM
-        docker run -v $OVPN_DATA:/etc/openvpn --rm -it kylemanna/openvpn ovpn_initpki
+      docker run -v $OVPN_DATA:/etc/openvpn --log-driver=none --rm lawtancool/docker-openvpn-xor ovpn_genconfig -u udp://VPN.SERVERNAME.COM
+      docker run -v $OVPN_DATA:/etc/openvpn --log-driver=none --rm -it lawtancool/docker-openvpn-xor ovpn_initpki
 
 * Start OpenVPN server process
 
-        docker run -v $OVPN_DATA:/etc/openvpn -d -p 1194:1194/udp --cap-add=NET_ADMIN kylemanna/openvpn
+      docker run -v $OVPN_DATA:/etc/openvpn -d -p 1194:1194/udp --cap-add=NET_ADMIN lawtancool/docker-openvpn-xor
 
 * Generate a client certificate without a passphrase
 
-        docker run -v $OVPN_DATA:/etc/openvpn --rm -it kylemanna/openvpn easyrsa build-client-full CLIENTNAME nopass
+      docker run -v $OVPN_DATA:/etc/openvpn --log-driver=none --rm -it lawtancool/docker-openvpn-xor ovpn_genclientcert CLIENTNAME nopass
 
 * Retrieve the client configuration with embedded certificates
 
-        docker run -v $OVPN_DATA:/etc/openvpn --rm kylemanna/openvpn ovpn_getclient CLIENTNAME > CLIENTNAME.ovpn
+      docker run -v $OVPN_DATA:/etc/openvpn --log-driver=none --rm lawtancool/docker-openvpn-xor ovpn_getclient CLIENTNAME > CLIENTNAME.ovpn
 
-## Docker Compose
+## Next Steps
+
+### More Reading
+
+Miscellaneous write-ups for advanced configurations are available in the
+[docs](docs) folder.
+
+### Systemd Init Scripts
+
+A `systemd` init script is available to manage the OpenVPN container.  It will
+start the container on system boot, restart the container if it exits
+unexpectedly, and pull updates from Docker Hub to keep itself up to date.
+
+Please refer to the [systemd documentation](docs/systemd.md) to learn more.
+
+### Docker Compose
 
 If you prefer to use `docker-compose` please refer to the [documentation](docs/docker-compose.md).
 
@@ -48,7 +64,7 @@ If you prefer to use `docker-compose` please refer to the [documentation](docs/d
 
 * Create an environment variable with the name DEBUG and value of 1 to enable debug output (using "docker -e").
 
-        docker run -v $OVPN_DATA:/etc/openvpn -p 1194:1194/udp --privileged -e DEBUG=1 kylemanna/openvpn
+        docker run -v $OVPN_DATA:/etc/openvpn -p 1194:1194/udp --privileged -e DEBUG=1 lawtancool/docker-openvpn-xor
 
 * Test using a client that has openvpn installed correctly
 
@@ -66,7 +82,7 @@ If you prefer to use `docker-compose` please refer to the [documentation](docs/d
 
 ## How Does It Work?
 
-Initialize the volume container using the `kylemanna/openvpn` image with the
+Initialize the volume container using the `lawtancool/docker-openvpn-xor` image with the
 included scripts to automatically generate:
 
 - Diffie-Hellman parameters
@@ -82,11 +98,11 @@ declares that directory as a volume. It means that you can start another
 container with the `-v` argument, and access the configuration.
 The volume also holds the PKI keys and certs so that it could be backed up.
 
-To generate a client certificate, `kylemanna/openvpn` uses EasyRSA via the
+To generate a client certificate, `lawtancool/docker-openvpn-xor` uses EasyRSA via the
 `easyrsa` command in the container's path.  The `EASYRSA_*` environmental
 variables place the PKI CA under `/etc/openvpn/pki`.
 
-Conveniently, `kylemanna/openvpn` comes with a script called `ovpn_getclient`,
+Conveniently, `lawtancool/docker-openvpn-xor` comes with a script called `ovpn_getclient`,
 which dumps an inline OpenVPN client configuration file.  This single file can
 then be given to a client for access to the VPN.
 
@@ -152,7 +168,7 @@ OpenVPN with latest OpenSSL on Ubuntu 12.04 LTS).
 ### It Doesn't Stomp All Over the Server's Filesystem
 
 Everything for the Docker container is contained in two images: the ephemeral
-run time image (kylemanna/openvpn) and the `$OVPN_DATA` data volume. To remove
+run time image (lawtancool/docker-openvpn-xor) and the `$OVPN_DATA` data volume. To remove
 it, remove the corresponding containers, `$OVPN_DATA` data volume and Docker
 image and it's completely removed.  This also makes it easier to run multiple
 servers since each lives in the bubble of the container (of course multiple IPs
@@ -174,12 +190,6 @@ of a guarantee in the future.
   volume for re-use across containers
 * Addition of tls-auth for HMAC security
 
-## Originally Tested On
-
-* Docker hosts:
-  * server a [Digital Ocean](https://www.digitalocean.com/?refcode=d19f7fe88c94) Droplet with 512 MB RAM running Ubuntu 14.04
-* Clients
-  * Android App OpenVPN Connect 1.1.14 (built 56)
-     * OpenVPN core 3.0 android armv7a thumb2 32-bit
-  * OS X Mavericks with Tunnelblick 3.4beta26 (build 3828) using openvpn-2.3.4
-  * ArchLinux OpenVPN pkg 2.3.4-1
+## Differences from kylemanna/openvpn
+* Based on Ubuntu instead of Alpine
+* Compiles OpenVPN 2.5.0 from source, applying the [Tunnelblick obfuscation patches](https://github.com/Tunnelblick/Tunnelblick/tree/master/third_party/sources/openvpn/openvpn-2.5.0/patches)

alpine/google-authenticator/APKBUILD

@@ -1,52 +0,0 @@
-# Contributor: Fabio Napoleoni <f.napoleoni@gmail.com>
-# Maintainer:
-pkgname=google-authenticator
-pkgver=20160207
-pkgrel=1
-pkgdesc="Google Authenticator PAM module"
-url="https://github.com/google/google-authenticator"
-arch="all"
-license="ASL 2.0"
-depends=
-depends_dev=
-makedepends="$depends_dev autoconf automake libtool linux-pam-dev m4 openssl-dev"
-install=
-subpackages="$pkgname-doc"
-source="https://github.com/google/google-authenticator/archive/c0404dcdbda9ab9e4f0b8451ecdd44eee8db2425.zip"
-
-_builddir="$srcdir"/$pkgname-c0404dcdbda9ab9e4f0b8451ecdd44eee8db2425/libpam
-
-prepare() {
-	local i
-	cd "$_builddir"
-	for i in $source; do
-		case $i in
-			*.patch) msg $i; patch -p1 -i "$srcdir"/$i || return 1;;
-		esac
-	done
-}
-
-build() {
-	cd "$_builddir"
-		./bootstrap.sh || return 1
-		./configure \
-			--build=$CBUILD \
-			--host=$CHOST \
-			--prefix=/usr \
-			--libdir=/lib \
-			--sysconfdir=/etc \
-			--mandir=/usr/share/man \
-			--infodir=/usr/share/info \
-			|| return 1
-
-		make || return 1
-}
-
-package() {
-	cd "$_builddir"
-	make DESTDIR="$pkgdir" install || return 1
-}
-
-md5sums="33d3cbd0488bcb4f50b34b5670deffae  c0404dcdbda9ab9e4f0b8451ecdd44eee8db2425.zip"
-sha256sums="e32abe693e54195bdb6aca52783e6e1c239e67296876ac59211a59e4608338b8  c0404dcdbda9ab9e4f0b8451ecdd44eee8db2425.zip"
-sha512sums="b44a626e6cc5d8e27685f5d39b5d33f49fc7070331db7b458d3ee40723972821bb8ed5458f27a287dc664d162acf1f8f9a36ca3b1bf767f2bbf27d4f538e9872  c0404dcdbda9ab9e4f0b8451ecdd44eee8db2425.zip"

bin/ovpn_genclientcert

@@ -0,0 +1,18 @@
+#!/bin/bash
+
+#
+# Generate a client certificate with EasyRSA
+#
+
+if [ "$DEBUG" == "1" ]; then
+  set -x
+fi
+
+CLIENTNAME=$1
+PASSWORD=$2
+
+set -e
+
+source "$OPENVPN/ovpn_env.sh"
+
+/usr/share/easy-rsa/easyrsa build-client-full $CLIENTNAME $PASSWORD

bin/ovpn_genconfig

@@ -7,7 +7,6 @@
 TMP_PUSH_CONFIGFILE=$(mktemp -t vpn_push.XXXXXXX)
 TMP_ROUTE_CONFIGFILE=$(mktemp -t vpn_route.XXXXXXX)
 TMP_EXTRA_CONFIGFILE=$(mktemp -t vpn_extra.XXXXXXX)
-TMP_EXTRA_CLIENT_CONFIGFILE=$(mktemp -t vpn_extra_client.XXXXXXX)
 
 #Traceback on Error and Exit come from https://docwhat.org/tracebacks-in-bash/
 set -eu
@@ -46,7 +45,6 @@ on_exit() {
   rm -f $TMP_PUSH_CONFIGFILE
   rm -f $TMP_ROUTE_CONFIGFILE
   rm -f $TMP_EXTRA_CONFIGFILE
-  rm -f $TMP_EXTRA_CLIENT_CONFIGFILE
   local _ec="$?"
   if [[ $_ec != 0 && "${_showed_traceback}" != t ]]; then
     traceback 1
@@ -95,10 +93,12 @@ usage() {
     echo "optional arguments:"
     echo " -2    Enable two factor authentication using Google Authenticator."
     echo " -a    Authenticate  packets with HMAC using the given message digest algorithm (auth)."
+    echo " -b    Disable 'push block-outside-dns'"
     echo " -c    Enable client-to-client option"
     echo " -C    A list of allowable TLS ciphers delimited by a colon (cipher)."
-    echo " -d    Disable NAT routing and default route"
+    echo " -d    Disable default route"
     echo " -D    Do not push dns servers"
+    echo " -k    Set keepalive. Default: '10 60'"
     echo " -m    Set client MTU"
     echo " -N    Configure NAT to access external server network"
     echo " -t    Use TAP device (instead of TUN device)"
@@ -119,7 +119,7 @@ process_push_config() {
   local ovpn_push_config=''
   ovpn_push_config="$1"
   echo "Processing PUSH Config: '${ovpn_push_config}'"
-  [[ -n "$ovpn_push_config" ]] && echo "push $ovpn_push_config" >> "$TMP_PUSH_CONFIGFILE"
+  [[ -n "$ovpn_push_config" ]] && echo "push \"$ovpn_push_config\"" >> "$TMP_PUSH_CONFIGFILE"
 }
 
 process_extra_config() {
@@ -127,14 +127,6 @@ process_extra_config() {
   ovpn_extra_config="$1"
   echo "Processing Extra Config: '${ovpn_extra_config}'"
   [[ -n "$ovpn_extra_config" ]] && echo "$ovpn_extra_config" >> "$TMP_EXTRA_CONFIGFILE"
-
-}
-
-process_extra_client_config() {
-  local ovpn_extra_config=''
-  ovpn_extra_config="$1"
-  echo "Processing Extra Client Config: '${ovpn_extra_config}'"
-  [[ -n "$ovpn_extra_config" ]] && echo "$ovpn_extra_config" >> "$TMP_EXTRA_CLIENT_CONFIGFILE"
 }
 
 if [ "${DEBUG:-}" == "1" ]; then
@@ -150,35 +142,52 @@ if [ -z "${EASYRSA_PKI:-}" ]; then
     export EASYRSA_PKI="$OPENVPN/pki"
 fi
 
-OVPN_ENV=${OPENVPN}/ovpn_env.sh
-OVPN_SERVER=192.168.255.0/24
+OVPN_AUTH=''
+OVPN_CIPHER=''
+OVPN_CLIENT_TO_CLIENT=''
+OVPN_CN=''
+OVPN_COMP_LZO=0
 OVPN_DEFROUTE=1
-OVPN_NAT=0
-OVPN_DNS=1
 OVPN_DEVICE="tun"
 OVPN_DEVICEN=0
-OVPN_DNS_SERVERS=("8.8.8.8" "8.8.4.4")
-TMP_DNS_SERVERS=()
+OVPN_DISABLE_PUSH_BLOCK_DNS=0
+OVPN_DNS=1
+OVPN_DNS_SERVERS=()
+OVPN_ENV=${OPENVPN}/ovpn_env.sh
+OVPN_EXTRA_CLIENT_CONFIG=()
+OVPN_EXTRA_SERVER_CONFIG=()
+OVPN_FRAGMENT=''
+OVPN_KEEPALIVE="10 60"
+OVPN_MTU=''
+OVPN_NAT=0
+OVPN_PORT=''
+OVPN_PROTO=''
+OVPN_PUSH=()
+OVPN_ROUTES=()
+OVPN_SERVER=192.168.255.0/24
+OVPN_SERVER_URL=''
 OVPN_TLS_CIPHER=''
-OVPN_CIPHER=''
-OVPN_AUTH=''
-OVPN_EXTRA_CONFIG=''
-CUSTOM_ROUTE_CONFIG=''
 
-# Import defaults if present
+# Import existing configuration if present
 [ -r "$OVPN_ENV" ] && source "$OVPN_ENV"
 
 # Parse arguments
-while getopts ":a:e:E:C:T:r:s:du:cp:n:DNmf:tz2" opt; do
+while getopts ":a:e:E:C:T:r:s:du:bcp:n:k:DNm:f:tz2" opt; do
     case $opt in
         a)
             OVPN_AUTH="$OPTARG"
             ;;
         e)
-            process_extra_config "$OPTARG"
+            mapfile -t TMP_EXTRA_SERVER_CONFIG <<< "$OPTARG"
+            for i in "${TMP_EXTRA_SERVER_CONFIG[@]}"; do
+              OVPN_EXTRA_SERVER_CONFIG+=("$i")
+            done
             ;;
         E)
-            process_extra_client_config "$OPTARG"
+            mapfile -t TMP_EXTRA_CLIENT_CONFIG <<< "$OPTARG"
+            for i in "${TMP_EXTRA_CLIENT_CONFIG[@]}"; do
+              OVPN_EXTRA_CLIENT_CONFIG+=("$i")
+            done
             ;;
         C)
             OVPN_CIPHER="$OPTARG"
@@ -187,26 +196,38 @@ while getopts ":a:e:E:C:T:r:s:du:cp:n:DNmf:tz2" opt; do
             OVPN_TLS_CIPHER="$OPTARG"
             ;;
         r)
-            CUSTOM_ROUTE_CONFIG=1
-            process_route_config "$OPTARG"
+            mapfile -t TMP_ROUTES <<< "$OPTARG"
+            for i in "${TMP_ROUTES[@]}"; do
+              OVPN_ROUTES+=("$i")
+            done
             ;;
         s)
-            OVPN_SERVER=$OPTARG
+            OVPN_SERVER="$OPTARG"
             ;;
         d)
             OVPN_DEFROUTE=0
+            OVPN_DISABLE_PUSH_BLOCK_DNS=1
             ;;
         u)
-            OVPN_SERVER_URL=$OPTARG
+            OVPN_SERVER_URL="$OPTARG"
+            ;;
+        b)
+            OVPN_DISABLE_PUSH_BLOCK_DNS=1
             ;;
         c)
             OVPN_CLIENT_TO_CLIENT=1
             ;;
         p)
-            process_push_config "$OPTARG"
+            mapfile -t TMP_PUSH <<< "$OPTARG"
+            for i in "${TMP_PUSH[@]}"; do
+              OVPN_PUSH+=("$i")
+            done
             ;;
         n)
-            TMP_DNS_SERVERS+=("$OPTARG")
+            mapfile -t TMP_DNS_SERVERS <<< "$OPTARG"
+            for i in "${TMP_DNS_SERVERS[@]}"; do
+              OVPN_DNS_SERVERS+=("$i")
+            done
             ;;
         D)
             OVPN_DNS=0
@@ -214,8 +235,11 @@ while getopts ":a:e:E:C:T:r:s:du:cp:n:DNmf:tz2" opt; do
         N)
             OVPN_NAT=1
             ;;
+        k)
+            OVPN_KEEPALIVE="$OPTARG"
+            ;;
         m)
-            OVPN_MTU=$OPTARG
+            OVPN_MTU="$OPTARG"
             ;;
         t)
             OVPN_DEVICE="tap"
@@ -227,7 +251,7 @@ while getopts ":a:e:E:C:T:r:s:du:cp:n:DNmf:tz2" opt; do
             OVPN_OTP_AUTH=1
             ;;
         f)
-            OVPN_FRAGMENT=$OPTARG
+            OVPN_FRAGMENT="$OPTARG"
             ;;
         \?)
             set +x
@@ -247,9 +271,6 @@ done
 # Create ccd directory for static routes
 [ ! -d "${OPENVPN:-}/ccd" ] && mkdir -p ${OPENVPN:-}/ccd
 
-# if dns servers were not defined with -n, use google nameservers
-[ ${#TMP_DNS_SERVERS[@]} -gt 0 ] && OVPN_DNS_SERVERS=("${TMP_DNS_SERVERS[@]}")
-
 # Server name is in the form "udp://vpn.example.com:1194"
 if [[ "${OVPN_SERVER_URL:-}" =~ ^((udp|tcp|udp6|tcp6)://)?([0-9a-zA-Z\.\-]+)(:([0-9]+))?$ ]]; then
     OVPN_PROTO=${BASH_REMATCH[2]};
@@ -262,24 +283,13 @@ else
     exit 1
 fi
 
-# Apply defaults
+# Apply defaults. If dns servers were not defined with -n, use google nameservers
+set +u
+[ -z "$OVPN_DNS_SERVERS" ] && OVPN_DNS_SERVERS=("8.8.8.8" "8.8.4.4")
 [ -z "$OVPN_PROTO" ] && OVPN_PROTO=udp
 [ -z "$OVPN_PORT" ] && OVPN_PORT=1194
-[ -z "$CUSTOM_ROUTE_CONFIG" ] && process_route_config "192.168.254.0/24"
-
-# Save extra client config from temp file only if temp file is not empty
-if [ -s "$TMP_EXTRA_CLIENT_CONFIGFILE" ]; then
-  OVPN_ADDITIONAL_CLIENT_CONFIG=$(cat $TMP_EXTRA_CLIENT_CONFIGFILE)
-fi
-
-export OVPN_SERVER OVPN_ROUTES OVPN_DEFROUTE
-export OVPN_SERVER_URL OVPN_ENV OVPN_PROTO OVPN_CN OVPN_PORT
-export OVPN_CLIENT_TO_CLIENT OVPN_PUSH OVPN_NAT OVPN_DNS OVPN_MTU OVPN_DEVICE
-export OVPN_TLS_CIPHER OVPN_CIPHER OVPN_AUTH
-export OVPN_COMP_LZO
-export OVPN_OTP_AUTH
-export OVPN_FRAGMENT
-export OVPN_ADDITIONAL_CLIENT_CONFIG
+set -u
+[ "${#OVPN_ROUTES[@]}" == "0" ] && [ "$OVPN_DEFROUTE" == "1" ] && OVPN_ROUTES+=("192.168.254.0/24")
 
 # Preserve config
 if [ -f "$OVPN_ENV" ]; then
@@ -288,17 +298,10 @@ if [ -f "$OVPN_ENV" ]; then
     mv "$OVPN_ENV" "$bak_env"
 fi
 
-# Like `export | grep OVPN_ > "$OVPN_ENV"` but handles multiline variables
-set +u
-while read var ; do
-  eval value=\$$var
-  if [ -n "$value" ]; then
-    echo "declare -x $var=\"$value\"" >> "$OVPN_ENV"
-  else
+# Save the current OVPN_ vars to the ovpn_env.sh file
+(set | grep '^OVPN_') | while read -r var; do
   echo "declare -x $var"  >> "$OVPN_ENV"
-  fi
-done < <(export | egrep -o '(OVPN_[^=]+)')
-set -u
+done
 
 conf=${OPENVPN:-}/openvpn.conf
 if [ -f "$conf" ]; then
@@ -307,6 +310,13 @@ if [ -f "$conf" ]; then
     mv "$conf" "$bak"
 fi
 
+# Echo extra client configurations
+if [ ${#OVPN_EXTRA_CLIENT_CONFIG[@]} -gt 0 ]; then
+  for i in "${OVPN_EXTRA_CLIENT_CONFIG[@]}"; do
+    echo "Processing Extra Client Config: $i"
+  done
+fi
+
 cat > "$conf" <<EOF
 server $(getroute $OVPN_SERVER)
 verb 3
@@ -314,9 +324,9 @@ key $EASYRSA_PKI/private/${OVPN_CN}.key
 ca $EASYRSA_PKI/ca.crt
 cert $EASYRSA_PKI/issued/${OVPN_CN}.crt
 dh $EASYRSA_PKI/dh.pem
-tls-auth $EASYRSA_PKI/ta.key
-key-direction 0
-keepalive 10 60
+tls-crypt $EASYRSA_PKI/ta.key
+#key-direction 0
+keepalive $OVPN_KEEPALIVE
 persist-key
 persist-tun
 
@@ -330,39 +340,62 @@ user nobody
 group nogroup
 EOF
 
-#This was in the heredoc, we use the new function instead
+if [ "${OVPN_DISABLE_PUSH_BLOCK_DNS}" == "1" ]; then
+  echo "Disable default push of 'block-outside-dns'"
+else
   process_push_config "block-outside-dns"
+fi
 
 [ -n "$OVPN_TLS_CIPHER" ] && echo "tls-cipher $OVPN_TLS_CIPHER" >> "$conf"
 [ -n "$OVPN_CIPHER" ] && echo "cipher $OVPN_CIPHER" >> "$conf"
 [ -n "$OVPN_AUTH" ] && echo "auth $OVPN_AUTH" >> "$conf"
 
 [ -n "${OVPN_CLIENT_TO_CLIENT:-}" ] && echo "client-to-client" >> "$conf"
-[ -n "${OVPN_COMP_LZO:-}" ] && echo "comp-lzo" >> "$conf"
+[ "$OVPN_COMP_LZO" == "1" ] && echo "comp-lzo" >> "$conf"
+[ "$OVPN_COMP_LZO" == "0" ] && echo "comp-lzo no" >> "$conf"
 
 [ -n "${OVPN_FRAGMENT:-}" ] && echo "fragment $OVPN_FRAGMENT" >> "$conf"
 
+# Append route commands
+if [ ${#OVPN_ROUTES[@]} -gt 0 ]; then
+  for i in "${OVPN_ROUTES[@]}"; do
+    process_route_config "$i"
+  done
+  echo -e "\n### Route Configurations Below" >> "$conf"
+  cat $TMP_ROUTE_CONFIGFILE >> "$conf"
+fi
+
+# Append push commands
 [ "$OVPN_DNS" == "1" ] && for i in "${OVPN_DNS_SERVERS[@]}"; do
   process_push_config "dhcp-option DNS $i"
 done
 
-# Append route commands
-echo -e "\n### Route Configurations Below" >> "$conf"
-cat $TMP_ROUTE_CONFIGFILE >> "$conf"
+if [ "$OVPN_COMP_LZO" == "0" ]; then
+    process_push_config "comp-lzo no"
+fi
+
+[ ${#OVPN_PUSH[@]} -gt 0 ] && for i in "${OVPN_PUSH[@]}"; do
+  process_push_config "$i"
+done
 
-# Append push commands
 echo -e "\n### Push Configurations Below" >> "$conf"
 cat $TMP_PUSH_CONFIGFILE >> "$conf"
 
-# Optional OTP authentication support
+# Append optional OTP authentication support
 if [ -n "${OVPN_OTP_AUTH:-}" ]; then
     echo -e "\n\n# Enable OTP+PAM for user authentication" >> "$conf"
     echo "plugin /usr/lib/openvpn/plugins/openvpn-plugin-auth-pam.so openvpn" >> "$conf"
     echo "reneg-sec 0" >> "$conf"
 fi
 
+# Append extra server configurations
+if [ ${#OVPN_EXTRA_SERVER_CONFIG[@]} -gt 0 ]; then
+  for i in "${OVPN_EXTRA_SERVER_CONFIG[@]}"; do
+    process_extra_config "$i"
+  done
   echo -e "\n### Extra Configurations Below" >> "$conf"
   cat $TMP_EXTRA_CONFIGFILE >> "$conf"
+fi
 
 set +e
 

bin/ovpn_getclient

@@ -35,7 +35,6 @@ get_client_config() {
 client
 nobind
 dev $OVPN_DEVICE
-key-direction 1
 remote-cert-tls server
 
 remote $OVPN_CN $OVPN_PORT $OVPN_PROTO"
@@ -45,8 +44,9 @@ remote $OVPN_CN $OVPN_PORT $OVPN_PROTO"
     if [ "$OVPN_PROTO" == "tcp6" ]; then
         echo "remote $OVPN_CN $OVPN_PORT tcp"
     fi
-    echo "$OVPN_ADDITIONAL_CLIENT_CONFIG
-"
+    for i in "${OVPN_EXTRA_CLIENT_CONFIG[@]}"; do
+      echo "$i"
+    done
     if [ "$mode" == "combined" ]; then
         echo "
 <key>
@@ -58,17 +58,18 @@ $(openssl x509 -in $EASYRSA_PKI/issued/${cn}.crt)
 <ca>
 $(cat $EASYRSA_PKI/ca.crt)
 </ca>
-<tls-auth>
+#key-direction 1
+<tls-crypt>
 $(cat $EASYRSA_PKI/ta.key)
-</tls-auth>
-key-direction 1
+</tls-crypt>
 "
     elif [ "$mode" == "separated" ]; then
         echo "
 key ${cn}.key
 ca ca.crt
 cert ${cn}.crt
-tls-auth ta.key 1
+tls-crypt ta.key
+#tls-auth ta.key 1
 "
     fi
 
@@ -97,7 +98,7 @@ tls-auth ta.key 1
         echo "auth-nocache"
     fi
 
-    if [ -n "$OVPN_COMP_LZO" ]; then
+    if [ "$OVPN_COMP_LZO" == "1" ]; then
         echo "comp-lzo"
     fi
 
@@ -124,9 +125,9 @@ case "$parm" in
         get_client_config "combined" > "$dir/${cn}-combined.ovpn"
         ;;
     *)
-        echo "This script can produce the client configuration in to formats:" >&2
+        echo "This script can produce the client configuration in two formats:" >&2
         echo "    1. combined (default): All needed configuration and cryptographic material is in one file (Use \"combined-save\" to write the configuration file in the same path as the separated parameter does)." >&2
         echo "    2. separated: Separated files." >&2
-        echo "Please specific one of those options as second parameter." >&2
+        echo "Please specify one of those options as second parameter." >&2
         ;;
 esac

bin/ovpn_initpki

@@ -15,15 +15,9 @@ source "$OPENVPN/ovpn_env.sh"
 # Specify "nopass" as arg[2] to make the CA insecure (not recommended!)
 nopass=$1
 
-# Provides a sufficient warning before erasing pre-existing files
-easyrsa init-pki
-
-# CA always has a password for protection in event server is compromised. The
-# password is only needed to sign client/server certificates.  No password is
-# needed for normal OpenVPN operation.
-easyrsa build-ca $nopass
-
-easyrsa gen-dh
+/usr/share/easy-rsa/easyrsa init-pki
+/usr/share/easy-rsa/easyrsa build-ca $nopass
+/usr/share/easy-rsa/easyrsa gen-dh
 openvpn --genkey --secret $EASYRSA_PKI/ta.key
 
 # Was nice to autoset, but probably a bad idea in practice, users should
@@ -37,4 +31,7 @@ openvpn --genkey --secret $EASYRSA_PKI/ta.key
 #fi
 
 # For a server key with a password, manually init; this is autopilot
-easyrsa build-server-full "$OVPN_CN" nopass
+/usr/share/easy-rsa/easyrsa build-server-full "$OVPN_CN" nopass
+
+# Generate the CRL for client/server certificates revocation.
+/usr/share/easy-rsa/easyrsa gen-crl

bin/ovpn_listclients

@@ -15,6 +15,8 @@ cd "$EASYRSA_PKI"
 
 if [ -e crl.pem ]; then
     cat ca.crt crl.pem > cacheck.pem
+else
+    cat ca.crt > cacheck.pem
 fi
 
 echo "name,begin,end,status"
@@ -26,20 +28,27 @@ for name in issued/*.crt; do
     name=${name%.crt}
     name=${name#issued/}
     if [ "$name" != "$OVPN_CN" ]; then
-    if [ -e crl.pem ]; then
-        if openssl verify -crl_check -CAfile cacheck.pem $path &> /dev/null; then
+        # check for revocation or expiration
+        command="openssl verify -crl_check -CAfile cacheck.pem $path"
+        result=$($command)
+        if [ $(echo "$result" | wc -l) == 1 ] && [ "$(echo "$result" | grep ": OK")" ]; then
             status="VALID"
         else
+            result=$(echo "$result" | tail -n 1 | grep error | cut -d" " -f2)
+            case $result in
+                10)
+                    status="EXPIRED"
+                    ;;
+                23)
                     status="REVOKED"
+                    ;;
+                *)
+                    status="INVALID"
+            esac
         fi
-    else
-        status="VALID"
-    fi
-
         echo "$name,$begin,$end,$status"
     fi
 done
 
-if [ -e crl.pem ]; then
+# Clean
 rm cacheck.pem
-fi

bin/ovpn_revokeclient

@@ -0,0 +1,62 @@
+#!/bin/bash
+
+#
+# Revoke a client certificate
+#
+
+if [ "$DEBUG" == "1" ]; then
+    set -x
+fi
+
+set -e
+
+if [ -z "$OPENVPN" ]; then
+    export OPENVPN="$PWD"
+fi
+if ! source "$OPENVPN/ovpn_env.sh"; then
+    echo "Could not source $OPENVPN/ovpn_env.sh."
+    exit 1
+fi
+if [ -z "$EASYRSA_PKI" ]; then
+    export EASYRSA_PKI="$OPENVPN/pki"
+fi
+
+cn="$1"
+parm="$2"
+
+if [ ! -f "$EASYRSA_PKI/private/${cn}.key" ]; then
+    echo "Unable to find \"${cn}\", please try again or generate the key first" >&2
+    exit 1
+fi
+
+revoke_client_certificate(){
+    # Download EasyRSA because Ubuntu doesn't have it as a CLI command
+    /usr/share/easy-rsa/easyrsa revoke "$1"
+    echo "Generating the Certificate Revocation List :"
+    /usr/share/easy-rsa/easyrsa gen-crl
+    cp -f "$EASYRSA_PKI/crl.pem" "$OPENVPN/crl.pem"
+    chmod 644 "$OPENVPN/crl.pem"
+}
+
+remove_files(){
+    rm -v "$EASYRSA_PKI/issued/${1}.crt"
+    rm -v "$EASYRSA_PKI/private/${1}.key"
+    rm -v "$EASYRSA_PKI/reqs/${1}.req"
+}
+
+case "$parm" in
+    "remove")
+        revoke_client_certificate "$cn"
+        remove_files "$cn"
+        ;;
+    "" | "keep")
+        revoke_client_certificate "$cn"
+        ;;
+    *)
+        echo "When revoking a client certificate, this script let you choose if you want to remove the corresponding crt, key and req files." >&2
+        echo "Pease note that the removal of those files is required if you want to generate a new client certificate using the revoked certificate's CN." >&2
+        echo "    1. keep (default): Keep the files." >&2
+        echo "    2. remove: Remove the files." >&2
+        echo "Please specify one of those options as second parameter." >&2
+        ;;
+esac

bin/ovpn_run

@@ -74,13 +74,14 @@ if [ "$OVPN_DEFROUTE" != "0" ] || [ "$OVPN_NAT" == "1" ] ; then
 	setupIptablesAndRouting
 fi
 
-# Use a hacky hardlink as the CRL Needs to be readable by the user/group
+# Use a copy of crl.pem as the CRL Needs to be readable by the user/group
 # OpenVPN is running as.  Only pass arguments to OpenVPN if it's found.
-if [ -r "$EASYRSA_PKI/crl.pem" ]; then
-    if [ ! -r "$OPENVPN/crl.pem" ]; then
-        ln "$EASYRSA_PKI/crl.pem" "$OPENVPN/crl.pem"
+if [ "$EASYRSA_PKI/crl.pem" -nt "$OPENVPN/crl.pem" ]; then
+    cp -f "$EASYRSA_PKI/crl.pem" "$OPENVPN/crl.pem"
     chmod 644 "$OPENVPN/crl.pem"
 fi
+
+if [ -r "$OPENVPN/crl.pem" ]; then
     addArg "--crl-verify" "$OPENVPN/crl.pem"
 fi
 
@@ -90,6 +91,7 @@ if [ $? = 0 ]; then
     # If this fails, ensure the docker container is run with --privileged
     # Could be side stepped with `ip netns` madness to drop privileged flag
 
+    sysctl -w net.ipv6.conf.all.disable_ipv6=0 || echo "Failed to enable IPv6 support"
     sysctl -w net.ipv6.conf.default.forwarding=1 || echo "Failed to enable IPv6 Forwarding default"
     sysctl -w net.ipv6.conf.all.forwarding=1 || echo "Failed to enable IPv6 Forwarding"
 fi

bin/start_openvpn

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+if [ -z "$( ls -A '/opt/data/openvpn' )" ] || [ "${EASY_RSA_REGEN}" == "true" ]; then
+    rm -rf /opt/data/openvpn/*
+    # -- It should prepare certs with easy-rsa
+    /usr/share/easy-rsa/easyrsa init-pki
+    # -- Currently only no password
+    /usr/share/easy-rsa/easyrsa build-ca nopass
+    /usr/share/easy-rsa/easyrsa gen-dh
+    `unset EASYRSA_REQ_CN && /usr/share/easy-rsa/easyrsa build-server-full server nopass`
+    # -- Generate the CRL for client/server certificates revocation.
+    /usr/share/easy-rsa/easyrsa gen-crl
+    openvpn --genkey tls-crypt-v2-server "pki/private/${EASYRSA_REQ_CN}.pem"
+    openvpn --genkey secret > "ta.key"
+
+else
+   echo "Easy RSA config is already prepared, skipping"
+fi
+
+cp /opt/data/openvpn/ta.key /etc/openvpn/server
+openvpn --config /opt/config/server.conf

containerfiles/Containerfile

@@ -0,0 +1,64 @@
+FROM ghcr.io/allanger/dumb-downloader as dudo
+ARG OPENVPN_VERSION
+RUN apt update && apt install gnupg tar -y
+RUN mkdir /output
+# ------------------------------------------------------
+# -- Downlaod OpenVPN
+# ------------------------------------------------------
+RUN dudo -l "https://keys.openpgp.org/vks/v1/by-fingerprint/F554A3687412CFFEBDEFE0A312F5F7B42F2B01E7" -d security-openvpn-net.asc -p DUMMY
+RUN gpg --import security-openvpn-net.asc
+RUN dudo -l "https://swupdate.openvpn.org/community/releases/openvpn-{{ version }}.tar.gz.asc" -d /tmp/openvpn.asc -p ${OPENVPN_VERSION}
+# ------------------------------------------------------
+# -- todo: I should fix it later
+# ------------------------------------------------------
+# RUN gpg  --no-tty --verify /tmp/openvpn.asc
+RUN dudo -l "https://swupdate.openvpn.org/community/releases/openvpn-{{ version }}.tar.gz " -d /tmp/openvpn.tar.gz -p ${OPENVPN_VERSION}
+RUN tar -xf /tmp/openvpn.tar.gz  -C /tmp && rm -f /tmp/openvpn.tar.gz
+RUN mv /tmp/openvpn-${OPENVPN_VERSION} /output/openvpn
+
+FROM ubuntu:24.04 as builder
+# ------------------------------------------------------
+# -- TODO: Define it only once
+# ------------------------------------------------------
+ARG OPENVPN_VERSION
+COPY --from=dudo /output /src
+RUN apt-get update &&\
+      apt-get install -y wget tar unzip build-essential \
+      libssl-dev iproute2 liblz4-dev liblzo2-dev \
+      libpam0g-dev libpkcs11-helper1-dev libsystemd-dev \
+      easy-rsa iptables pkg-config libcap-ng-dev
+WORKDIR /src/openvpn
+RUN ./configure --disable-systemd --enable-async-push --enable-iproute2
+RUN make && make install
+RUN mkdir /output
+RUN cp $(which openvpn) /output
+RUN cp /src/openvpn/sample/sample-config-files/server.conf /output
+
+# ------------------------------------------------------
+# -- Final container
+# ------------------------------------------------------
+FROM ubuntu:24.04
+LABEL maintainer="allanger <allanger@badhouseplants.net>"
+VOLUME /opt/data/openvpn
+WORKDIR /opt/data/openvpn
+
+ENV EASYRSA_BATCH=yes
+ENV EASYRSA_REQ_CN=openvpn-server
+
+COPY --from=builder /output/openvpn /src/openvpn
+COPY --from=builder /output/server.conf /opt/config/server.conf
+
+# -------------------------------------------------------
+# -- Prepare system deps
+# -- It's also installing the openvpn package but 
+# -- it's required for getting dependencies, later
+# -- it's rewritten by the binary that from the builder
+# -------------------------------------------------------
+RUN apt update &&\
+      apt upgrade -y && \
+      apt install openvpn easy-rsa -y && \
+      mv /src/openvpn $(which openvpn)
+
+CMD ["ovpn_run"]
+
+COPY --chmod='755' ./bin /usr/local/bin

containerfiles/Containerfile-XOR

@@ -0,0 +1,78 @@
+FROM ghcr.io/allanger/dumb-downloader as dudo
+ARG OPENVPN_VERSION
+ARG TUNNELBLICK_VERSION
+RUN apt update && apt install gnupg tar -y
+RUN mkdir /output
+# ------------------------------------------------------
+# -- Downlaod OpenVPN
+# ------------------------------------------------------
+RUN dudo -l "https://keys.openpgp.org/vks/v1/by-fingerprint/F554A3687412CFFEBDEFE0A312F5F7B42F2B01E7" -d security-openvpn-net.asc -p DUMMY
+RUN gpg --import security-openvpn-net.asc
+RUN dudo -l "https://swupdate.openvpn.org/community/releases/openvpn-{{ version }}.tar.gz.asc" -d /tmp/openvpn.asc -p $OPENVPN_VERSION
+# ------------------------------------------------------
+# -- I should fix it later
+# ------------------------------------------------------
+# RUN gpg  --no-tty --verify /tmp/openvpn.asc
+RUN dudo -l "https://swupdate.openvpn.org/community/releases/openvpn-{{ version }}.tar.gz " -d /tmp/openvpn.tar.gz -p $OPENVPN_VERSION
+RUN tar -xf /tmp/openvpn.tar.gz  -C /tmp && rm -f /tmp/openvpn.tar.gz
+RUN mv /tmp/openvpn-$OPENVPN_VERSION /output/openvpn
+# ------------------------------------------------------
+# -- Download Tunnelblick
+# ------------------------------------------------------
+RUN dudo -l "https://github.com/Tunnelblick/Tunnelblick/archive/refs/tags/v{{ version }}.tar.gz" -d /tmp/tunnelblick.tar.gz -p $TUNNELBLICK_VERSION
+RUN tar -xf /tmp/tunnelblick.tar.gz  -C /tmp && rm -f /tmp/tunnelblick.tar.gz
+RUN mv /tmp/Tunnelblick-$TUNNELBLICK_VERSION /output/tunnelblick
+
+FROM ubuntu as builder
+# ------------------------------------------------------
+# -- TODO: Define it only once
+# ------------------------------------------------------
+ARG OPENVPN_VERSION
+ARG TUNNELBLICK_VERSION
+COPY --from=dudo /output /src
+RUN apt-get update &&\
+      apt-get install -y wget tar unzip build-essential \
+      libssl-dev iproute2 liblz4-dev liblzo2-dev \
+      libpam0g-dev libpkcs11-helper1-dev libsystemd-dev \
+      easy-rsa iptables pkg-config libcap-ng-dev
+RUN cp /src/tunnelblick/third_party/sources/openvpn/openvpn-$OPENVPN_VERSION/patches/*.diff /src/openvpn
+WORKDIR /src/openvpn
+RUN for patch in $(find -type f | grep diff); do\
+        patch -p1 < $patch;\
+    done
+RUN ./configure --disable-systemd --enable-async-push --enable-iproute2
+RUN make && make install
+RUN mkdir /output
+RUN cp $(which openvpn) /output/
+
+# ------------------------------------------------------
+# -- Final container
+# ------------------------------------------------------
+FROM ubuntu:24.04
+LABEL maintainer="allanger <allanger@zohomail.com>"
+COPY --from=builder /output /src
+# -------------------------------------------------------
+# -- Prepare system deps
+# -------------------------------------------------------
+RUN apt update && apt install openvpn easy-rsa iptables -y && \
+  mv /src/openvpn $(which openvpn)
+
+# Needed by scripts
+ENV OPENVPN /etc/openvpn
+
+# Prevents refused client connection because of an expired CRL
+ENV EASYRSA_CRL_DAYS 3650
+
+VOLUME ["/etc/openvpn"]
+
+# Internally uses port 1194, remap if needed using `docker run -p 443:1194/tcp`
+EXPOSE 1194
+
+CMD ["ovpn_run"]
+
+COPY --chmod='755' ./bin /usr/local/bin
+# -----------------------------------------------------------
+# -- Add support for OTP authentication using a PAM module
+# -- I have no idea how it works yet
+# -----------------------------------------------------------
+WORKDIR /etc/openvpn

docs/clients.md

@@ -11,10 +11,12 @@ Note that some client software might be picky about which configuration format i
 
 ## Client List
 
-See an overview of the configured clients, including revocation status:
+See an overview of the configured clients, including revocation and expiration status:
 
     docker run --rm -it -v $OVPN_DATA:/etc/openvpn kylemanna/openvpn ovpn_listclients
 
+ The output is generated using `openssl verify`. Error codes from the verification process different from `X509_V_ERR_CERT_HAS_EXPIRED` or `X509_V_ERR_CERT_REVOKED` will show the status `INVALID`.
+
 ## Batch Mode
 
 If you have more than a few clients, you will want to generate and update your client configuration in batch. For this task the script [`ovpn_getclient_all`](/bin/ovpn_getclient_all) was written, which writes out the configuration for each client to a separate directory called `clients/$cn`.
@@ -34,9 +36,12 @@ After doing so, you will find the following files in each of the `$cn` directori
 
 ## Revoking Client Certificates
 
-Revoke `client1`'s certificate and generate the certificate revocation list (CRL):
+Revoke `client1`'s certificate and generate the certificate revocation list (CRL) using [`ovpn_revokeclient`](/bin/ovpn_revokeclient) script :
 
-    docker run --rm -it -v $OVPN_DATA:/etc/openvpn kylemanna/openvpn easyrsa revoke client1
-    docker run --rm -it -v $OVPN_DATA:/etc/openvpn kylemanna/openvpn easyrsa gen-crl
+    docker run --rm -it -v $OVPN_DATA:/etc/openvpn kylemanna/openvpn ovpn_revokeclient client1
 
 The OpenVPN server will read this change every time a client connects (no need to restart server) and deny clients access using revoked certificates.
+
+You can optionally pass `remove` as second parameter to ovpn_revokeclient to remove the corresponding crt, key and req files :
+
+    docker run --rm -it -v $OVPN_DATA:/etc/openvpn kylemanna/openvpn ovpn_revokeclient client1 remove

docs/debug.md

@@ -4,8 +4,8 @@ Random things I do to debug the containers.
 
 ## Login Shells
 
-* Create a shell in the running docker container (aka namespace) with [nsenter](https://github.com/jpetazzo/nsenter)
-* If you don't have nsenter/docker-enter, you can mount the data container and modify it with
+* Create a shell in the running docker container with `docker exec`.
+* To modify the data, you can also mount the data container and modify it with
 
         docker run --rm -it -v $OVPN_DATA:/etc/openvpn kylemanna/openvpn bash -l
 

docs/docker-compose.md

@@ -59,10 +59,19 @@ docker-compose run --rm openvpn easyrsa build-client-full $CLIENTNAME nopass
 docker-compose run --rm openvpn ovpn_getclient $CLIENTNAME > $CLIENTNAME.ovpn
 ```
 
+* Revoke a client certificate
+
+```bash
+# Keep the corresponding crt, key and req files.
+docker-compose run --rm openvpn ovpn_revokeclient $CLIENTNAME
+# Remove the corresponding crt, key and req files.
+docker-compose run --rm openvpn ovpn_revokeclient $CLIENTNAME remove
+```
+
 ## Debugging Tips
 
 * Create an environment variable with the name DEBUG and value of 1 to enable debug output (using "docker -e").
 
 ```bash
-docker-compose run -e DEBUG=1 openvpn
+docker-compose run -e DEBUG=1 -p 1194:1194/udp openvpn
 ```

docs/faqs.md

@@ -2,9 +2,9 @@
 
 ## How do I edit `openvpn.conf`?
 
-Use a Docker image with a text editor pre-installed (i.e. Ubuntu) and connect the volume container:
+Use a Docker image with an editor and connect the volume container:
 
-    docker run -v $OVPN_DATA:/etc/openvpn --rm -it ubuntu vi /etc/openvpn/openvpn.conf
+    docker run -v $OVPN_DATA:/etc/openvpn --rm -it kylemanna/openvpn vi /etc/openvpn/openvpn.conf
 
 
 ## Why not keep everything in one image?

docs/paranoid.md

@@ -1,6 +1,6 @@
 # Advanced security
 
-## Keep the CA root key save
+## Keep the CA root key safe
 As mentioned in the [backup section](/docs/backup.md), there are good reasons to not generate the CA and/or leave it on the server. This document describes how you can generate the CA and all your certificates on a secure machine and then copy only the needed files (which never includes the CA root key obviously ;) ) to the server(s) and clients.
 
 Execute the following commands. Note that you might want to change the volume `$PWD` or use a data docker container for this.
@@ -13,7 +13,7 @@ The [`ovpn_copy_server_files`](/bin/ovpn_copy_server_files) script puts all the
 
 ## Crypto Hardening
 
-If you want to select the cyphers used by OpenVPN the following parameters of the `ovpn_genconfig` might interest you:
+If you want to select the ciphers used by OpenVPN the following parameters of the `ovpn_genconfig` might interest you:
 
     -T    Encrypt packets with the given cipher algorithm instead of the default one (tls-cipher).
     -C    A list of allowable TLS ciphers delimited by a colon (cipher).

docs/systemd.md

@@ -15,11 +15,17 @@ are harmless for those not using IPv6.
 To use and enable automatic start by systemd:
 
 1. Create a Docker volume container named `ovpn-data-NAME` where `NAME` is the
-   user's choice to describe the use of the container.  In the example
-   configuration given in the [README](/README.md) `NAME=data`.
-2. Initialize the data container according to the [docker-openvpn
-   README](/README.md), but don't start the container. Stop the Docker
-   container if started.
+   user's choice to describe the use of the container.  In this example
+   configuration, `NAME=example`.
+   
+        OVPN_DATA="ovpn-data-example"
+        docker volume create --name $OVPN_DATA
+   
+2. Initialize the data container, but don't start the container :
+   
+       docker run -v $OVPN_DATA:/etc/openvpn --rm kylemanna/openvpn ovpn_genconfig -u udp://VPN.SERVERNAME.COM
+       docker run -v $OVPN_DATA:/etc/openvpn --rm -it kylemanna/openvpn ovpn_initpki
+   
 3. Download the [docker-openvpn@.service](https://raw.githubusercontent.com/kylemanna/docker-openvpn/master/init/docker-openvpn%40.service)
    file to `/etc/systemd/system`:
 
@@ -27,11 +33,11 @@ To use and enable automatic start by systemd:
 
 4. Enable and start the service with:
 
-        systemctl enable --now docker-openvpn@NAME.service
+        systemctl enable --now docker-openvpn@example.service
 
 5. Verify service start-up with:
 
-        systemctl status docker-openvpn@NAME.service
-        journalctl --unit docker-openvpn@NAME.service
+        systemctl status docker-openvpn@example.service
+        journalctl --unit docker-openvpn@example.service
 
 For more information, see the [systemd manual pages](https://www.freedesktop.org/software/systemd/man/index.html).

docs/tcp.md

@@ -29,3 +29,17 @@ This allows you to use UDP most of the time, but fall back to TCP on the rare oc
 
 Note that you will need to configure client connections manually. At this time it is not possible to generate a client config that will automatically fall back to the TCP connection.
 
+## Forward HTTP/HTTPS connection to another TCP port
+You might run into cases where you want your OpenVPN server listening on TCP port 443 to allow connection behind a restricted network, but you already have a webserver on your host running on that port. OpenVPN has a built-in option named `port-share` that allow you to proxy incoming traffic that isn't OpenVPN protocol to another host and port.
+
+First, change the listening port of your existing webserver (for instance from 443 to 4433).
+
+Then initialize the data container by specifying the TCP protocol, port 443 and the port-share option:
+
+    docker run -v $OVPN_DATA:/etc/openvpn --rm kylemanna/openvpn ovpn_genconfig \
+    -u tcp://VPN.SERVERNAME.COM:443 \
+    -e 'port-share VPN.SERVERNAME.COM 4433'
+    
+Then proceed to initialize the pki, create your users and start the container as usual.
+    
+This will proxy all non OpenVPN traffic incoming on TCP port 443 to TCP port 4433 on the same host. This is currently only designed to work with HTTP or HTTPS protocol.

env/openvpn.env

@@ -0,0 +1,3 @@
+export OPENVPN_VERSION=2.6.11
+export CONTAINERFILE=./containerfiles/Containerfile
+export SCRIPT=build_upstream.sh

env/openvpn_xor.env

@@ -0,0 +1,3 @@
+export TUNNELBLICK_VERSION=6.0beta03
+export CONTAINERFILE=./containerfiles/Containerfile-XOR
+export SCRIPT=build_xor.sh

init/docker-openvpn@.service

@@ -33,8 +33,8 @@
 [Unit]
 Description=OpenVPN Docker Container
 Documentation=https://github.com/kylemanna/docker-openvpn
-After=network.target docker.socket
-Requires=docker.socket
+After=network.target docker.service
+Requires=docker.service
 
 [Service]
 RestartSec=10
@@ -64,7 +64,7 @@ ExecStartPre=-/usr/bin/docker pull $IMG
 ExecStartPre=/bin/sh -c 'test -z "$IP6_PREFIX" && exit 0; sysctl net.ipv6.conf.all.forwarding=1'
 
 # Main process
-ExecStart=/usr/bin/docker run --rm --privileged -v ${DATA_VOL}:/etc/openvpn --name ${NAME} -p ${PORT} ${IMG} ovpn_run $ARGS
+ExecStart=/usr/bin/docker run --rm --cap-add=NET_ADMIN -v ${DATA_VOL}:/etc/openvpn --name ${NAME} -p ${PORT} ${IMG} ovpn_run $ARGS
 
 # IPv6: Add static route for IPv6 after it starts up
 ExecStartPost=/bin/sh -c 'test -z "${IP6_PREFIX}" && exit 0; sleep 1; ip route replace ${IP6_PREFIX} via $(docker inspect -f "{{ .NetworkSettings.GlobalIPv6Address }}" $NAME ) dev docker0'

init/upstart.init

@@ -4,5 +4,5 @@ start on filesystem and started docker
 stop on runlevel [!2345]
 respawn
 script
-  exec docker run -v ovpn-data:/etc/openvpn --rm -p 1194:1194/udp --cap-add=NET_ADMIN kylemanna/openvpn
+  exec docker run -v ovpn-data-example:/etc/openvpn --rm -p 1194:1194/udp --cap-add=NET_ADMIN kylemanna/openvpn
 end script

otp/openvpn

@@ -1,7 +0,0 @@
-# Uses google authenticator library as PAM module using a single folder for all users tokens
-# User root is required to stick with an hardcoded user when trying to determine user id and allow unexisting system users
-# See https://github.com/google/google-authenticator/tree/master/libpam#secretpathtosecretfile--usersome-user
-auth required pam_google_authenticator.so secret=/etc/openvpn/otp/${USER}.google_authenticator user=root
-
-# Accept any user since we're dealing with virtual users there's no need to have a system account (pam_unix.so)
-account sufficient pam_permit.so

scripts/build_upstream.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env sh
+export CUSTOM_TAG="v$OPENVPN_VERSION"
+export BUILD_ARGS="--build-arg OPENVPN_VERSION=$OPENVPN_VERSION"
+build-container

scripts/build_xor.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env sh
+git clone https://github.com/Tunnelblick/Tunnelblick.git /tmp/tunnelblick
+export OPENVPN_VERSION=$(ls /tmp/tunnelblick/third_party/sources/openvpn | sed 's/openvpn-//g' | sort  -k1,1nr -k2,2n -k3,3n | head -n 1)
+export CUSTOM_TAG="v$OPENVPN_VERSION-XOR-$TUNNELBLICK_VERSION"
+export BUILD_ARGS="--build-arg OPENVPN_VERSION=$OPENVPN_VERSION --build-arg TUNNELBLICK_VERSION=$TUNNELBLICK_VERSION"
+build-container

test/config.sh

@@ -9,9 +9,11 @@ imageTests+=(
 	[openvpn]='
 	paranoid
         conf_options
+        client
         basic
         dual-proto
         otp
 	iptables
+	revocation
 	'
 )

test/tests/client/container.sh

@@ -0,0 +1,84 @@
+#!/bin/bash
+
+SERV_IP=$(ip -4 -o addr show scope global  | awk '{print $4}' | sed -e 's:/.*::' | head -n1)
+SERVER_CONF="/etc/openvpn/openvpn.conf"
+TEST1_OVPN="/etc/openvpn/test1.ovpn"
+
+# Function to fail
+abort() { cat <<< "$@" 1>&2; exit 1; }
+
+# Check a config (haystack) for a given line (needle) exit with error if not
+# found.
+test_config() {
+
+    local needle="${2}"
+    local file="${1}"
+
+    busybox grep -q "${needle}" "${file}"
+    if [ $? -ne 0 ]; then
+        abort "==> Config match not found: ${needle}"
+    fi
+}
+
+# Check a config (haystack) for absence of given line (needle) exit with error
+# if found.
+test_not_config() {
+
+    local needle="${2}"
+    local file="${1}"
+
+    busybox grep -vq "${needle}" "${file}"
+    if [ $? -ne 0 ]; then
+        abort "==> Config match found: ${needle}"
+    fi
+}
+
+
+#
+# Generate openvpn.config file
+#
+
+ovpn_genconfig \
+    -u udp://$SERV_IP \
+    -m 1337 \
+
+
+EASYRSA_BATCH=1 EASYRSA_REQ_CN="Travis-CI Test CA" ovpn_initpki nopass
+
+easyrsa build-client-full test1 nopass 2>/dev/null
+
+ovpn_getclient test1 > "${TEST1_OVPN}"
+
+
+#
+# Simple test cases
+#
+
+# 1. client MTU
+test_config "${TEST1_OVPN}" "^tun-mtu\s\+1337"
+
+
+#
+# Test udp client with tcp fallback
+#
+ovpn_genconfig -u udp://$SERV_IP -E "remote $SERV_IP 443 tcp" -E "remote vpn.example.com 443 tcp"
+# nopass is insecure
+EASYRSA_BATCH=1 EASYRSA_REQ_CN="Travis-CI Test CA" ovpn_initpki nopass
+easyrsa build-client-full client-fallback nopass
+ovpn_getclient client-fallback > "${TEST1_OVPN}"
+
+test_config "${TEST1_OVPN}" "^remote\s\+$SERV_IP\s\+443\s\+tcp"
+test_config "${TEST1_OVPN}" "^remote\s\+vpn.example.com\s\+443\s\+tcp"
+
+
+#
+# Test non-defroute config
+#
+ovpn_genconfig -d -u udp://$SERV_IP -r "172.33.33.0/24" -r "172.34.34.0/24"
+# nopass is insecure
+EASYRSA_BATCH=1 EASYRSA_REQ_CN="Travis-CI Test CA" ovpn_initpki nopass
+easyrsa build-client-full non-defroute nopass
+ovpn_getclient non-defroute > "${TEST1_OVPN}"
+
+# The '!' inverts the match to test that the string isn't present
+test_not_config "${TEST1_OVPN}" "^redirect-gateway\s\+def1"

test/tests/client/run.sh

@@ -0,0 +1 @@
+../run-bash-in-container.sh

test/tests/conf_options/container.sh

@@ -1,8 +1,37 @@
 #!/bin/bash
 
+SERV_IP=$(ip -4 -o addr show scope global  | awk '{print $4}' | sed -e 's:/.*::' | head -n1)
+SERVER_CONF="/etc/openvpn/openvpn.conf"
+TEST1_OVPN="/etc/openvpn/test1.ovpn"
+
 # Function to fail
 abort() { cat <<< "$@" 1>&2; exit 1; }
 
+# Check a config (haystack) for a given line (needle) exit with error if not found.
+test_config() {
+
+    local needle="${2}"
+    local file="${1}"
+
+    busybox grep -q "${needle}" "${file}"
+    if [ $? -ne 0 ]; then
+        abort "==> Config match not found: ${needle}"
+    fi
+}
+
+# Check a config (haystack) for absence of given line (needle) exit with error
+# if found.
+test_not_config() {
+
+    local needle="${2}"
+    local file="${1}"
+
+    busybox grep -vq "${needle}" "${file}"
+    if [ $? -ne 0 ]; then
+        abort "==> Config match found: ${needle}"
+    fi
+}
+
 
 #
 # Generate openvpn.config file
@@ -12,183 +41,76 @@ management localhost 7505
 max-clients 10
 EOF
 
-SERV_IP=$(ip -4 -o addr show scope global  | awk '{print $4}' | sed -e 's:/.*::' | head -n1)
-ovpn_genconfig -u udp://$SERV_IP -f 1400 -e "$MULTILINE_EXTRA_SERVER_CONF" -e 'duplicate-cn' -e 'topology subnet' -p 'route 172.22.22.0 255.255.255.0'
+ovpn_genconfig \
+    -u udp://$SERV_IP \
+    -f 1400 \
+    -k '60 300' \
+    -e "$MULTILINE_EXTRA_SERVER_CONF" \
+    -e 'duplicate-cn' \
+    -e 'topology subnet' \
+    -p 'route 172.22.22.0 255.255.255.0' \
+
+# Run ovpn_genconfig a second time with no arguments to test its repeatability.
+ovpn_genconfig
 
 #
-# grep for config lines from openvpn.conf
-# add more tests for more configs as required
+# Simple test cases
 #
 
 # 1. verb config
-CONFIG_REQUIRED_VERB="verb 3"
-CONFIG_MATCH_VERB=$(busybox grep verb /etc/openvpn/openvpn.conf)
+test_config "${SERVER_CONF}" "^verb\s\+3"
 
 # 2. fragment config
-CONFIG_REQUIRED_FRAGMENT="fragment 1400"
-CONFIG_MATCH_FRAGMENT=$(busybox grep fragment /etc/openvpn/openvpn.conf)
+test_config "${SERVER_CONF}" "^fragment\s\+1400"
 
 ## Tests for extra configs
 # 3. management config
-CONFIG_REQUIRED_MANAGEMENT="^management localhost 7505"
-CONFIG_MATCH_MANAGEMENT=$(busybox grep management /etc/openvpn/openvpn.conf)
+test_config "${SERVER_CONF}" "^management\s\+localhost\s\+7505"
 
 # 4. max-clients config
-CONFIG_REQUIRED_MAX_CLIENTS="^max-clients 10"
-CONFIG_MATCH_MAX_CLIENTS=$(busybox grep max-clients /etc/openvpn/openvpn.conf)
+test_config "${SERVER_CONF}" "^max-clients\s\+10"
 
 # 5. duplicate-cn config
-CONFIG_REQUIRED_DUPCN="^duplicate-cn"
-CONFIG_MATCH_DUPCN=$(busybox grep duplicate-cn /etc/openvpn/openvpn.conf)
+test_config "${SERVER_CONF}" "^duplicate-cn"
 
 # 6. topology config
-CONFIG_REQUIRED_TOPOLOGY="^topology subnet"
-CONFIG_MATCH_TOPOLOGY=$(busybox grep 'topology subnet' /etc/openvpn/openvpn.conf)
+test_config "${SERVER_CONF}" "^topology\s\+subnet"
 
 ## Tests for push config
 # 7. push route
-CONFIG_REQUIRED_PUSH_ROUTE="^push route 172.22.22.0 255.255.255.0"
-CONFIG_MATCH_PUSH_ROUTE=$(busybox grep 'push route 172.22.22.0 255.255.255.0' /etc/openvpn/openvpn.conf)
+test_config "${SERVER_CONF}" '^push\s\+"route\s\+172.22.22.0\s\+255.255.255.0"'
 
 ## Test for default
 # 8. Should see default route if none provided
-CONFIG_REQUIRED_DEFAULT_ROUTE="^route 192.168.254.0 255.255.255.0"
-CONFIG_MATCH_DEFAULT_ROUTE=$(busybox grep 'route 192.168.254.0 255.255.255.0' /etc/openvpn/openvpn.conf)
+test_config "${SERVER_CONF}" "^route\s\+192.168.254.0\s\+255.255.255.0"
 
 # 9. Should see a push of 'block-outside-dns' by default
-CONFIG_REQUIRED_DEFAULT_ROUTE="^push block-outside-dns"
-CONFIG_MATCH_DEFAULT_ROUTE=$(busybox grep 'push block-outside-dns' /etc/openvpn/openvpn.conf)
+test_config "${SERVER_CONF}" '^push\s\+"block-outside-dns"'
 
 # 10. Should see a push of 'dhcp-option DNS' by default
-CONFIG_REQUIRED_DEFAULT_DNS_1="^push dhcp-option DNS 8.8.8.8"
-CONFIG_MATCH_DEFAULT_DNS_1=$(busybox grep 'push dhcp-option DNS 8.8.8.8' /etc/openvpn/openvpn.conf)
-CONFIG_REQUIRED_DEFAULT_DNS_2="^push dhcp-option DNS 8.8.4.4"
-CONFIG_MATCH_DEFAULT_DNS_2=$(busybox grep 'push dhcp-option DNS 8.8.4.4' /etc/openvpn/openvpn.conf)
+test_config "${SERVER_CONF}" '^push\s\+"dhcp-option\s\+DNS\s\+8.8.8.8"'
+test_config "${SERVER_CONF}" '^push\s\+"dhcp-option\s\+DNS\s\+8.8.4.4"'
+
+## Test for keepalive
+# 11. keepalive config
+test_config "${SERVER_CONF}" '^keepalive\s\+60\s\+300'
 
 
 #
-# Tests
+# More elaborate route tests
 #
 
-if [[ $CONFIG_MATCH_VERB =~ $CONFIG_REQUIRED_VERB ]]
-then
-  echo "==> Config match found: $CONFIG_REQUIRED_VERB == $CONFIG_MATCH_VERB"
-else
-  abort "==> Config match not found: $CONFIG_REQUIRED_VERB != $CONFIG_MATCH_VERB"
-fi
-
-if [[ $CONFIG_MATCH_FRAGMENT =~ $CONFIG_REQUIRED_FRAGMENT ]]
-then
-  echo "==> Config match found: $CONFIG_REQUIRED_FRAGMENT == $CONFIG_MATCH_FRAGMENT"
-else
-  abort "==> Config match not found: $CONFIG_REQUIRED_FRAGMENT != $CONFIG_MATCH_FRAGMENT"
-fi
-
-if [[ $CONFIG_MATCH_MANAGEMENT =~ $CONFIG_REQUIRED_MANAGEMENT ]]
-then
-  echo "==> Config match found: $CONFIG_REQUIRED_MANAGEMENT == $CONFIG_MATCH_MANAGEMENT"
-else
-  abort "==> Config match not found: $CONFIG_REQUIRED_MANAGEMENT != $CONFIG_MATCH_MANAGEMENT"
-fi
-
-
-if [[ $CONFIG_MATCH_MAX_CLIENTS =~ $CONFIG_REQUIRED_MAX_CLIENTS ]]
-then
-  echo "==> Config match found: $CONFIG_REQUIRED_MAX_CLIENTS == $CONFIG_MATCH_MAX_CLIENTS"
-else
-  abort "==> Config match not found: $CONFIG_REQUIRED_MAX_CLIENTS != $CONFIG_MATCH_MAX_CLIENTS"
-fi
-
-if [[ $CONFIG_MATCH_DUPCN =~ $CONFIG_REQUIRED_DUPCN ]]
-then
-  echo "==> Config match found: $CONFIG_REQUIRED_DUPCN == $CONFIG_MATCH_DUPCN"
-else
-  abort "==> Config match not found: $CONFIG_REQUIRED_DUPCN != $CONFIG_MATCH_DUPCN"
-fi
-
-if [[ $CONFIG_MATCH_TOPOLOGY =~ $CONFIG_REQUIRED_TOPOLOGY ]]
-then
-  echo "==> Config match found: $CONFIG_REQUIRED_TOPOLOGY == $CONFIG_MATCH_TOPOLOGY"
-else
-  abort "==> Config match not found: $CONFIG_REQUIRED_TOPOLOGY != $CONFIG_MATCH_TOPOLOGY"
-fi
-
-if [[ $CONFIG_MATCH_PUSH_ROUTE =~ $CONFIG_REQUIRED_PUSH_ROUTE ]]
-then
-  echo "==> Config match found: $CONFIG_REQUIRED_PUSH_ROUTE == $CONFIG_MATCH_PUSH_ROUTE"
-else
-  abort "==> Config match not found: $CONFIG_REQUIRED_PUSH_ROUTE != $CONFIG_MATCH_PUSH_ROUTE"
-fi
-
-if [[ $CONFIG_MATCH_DEFAULT_ROUTE =~ $CONFIG_REQUIRED_DEFAULT_ROUTE ]]
-then
-  echo "==> Config match found: $CONFIG_REQUIRED_DEFAULT_ROUTE == $CONFIG_MATCH_DEFAULT_ROUTE"
-else
-  abort "==> Config match not found: $CONFIG_REQUIRED_DEFAULT_ROUTE != $CONFIG_MATCH_DEFAULT_ROUTE"
-fi
-
-if [[ $CONFIG_MATCH_DEFAULT_DNS_1 =~ $CONFIG_REQUIRED_DEFAULT_DNS_1 ]]
-then
-  echo "==> Config match found: $CONFIG_REQUIRED_DEFAULT_DNS_1 == $CONFIG_MATCH_DEFAULT_DNS_1"
-else
-  abort "==> Config match not found: $CONFIG_REQUIRED_DEFAULT_DNS_1 != $CONFIG_MATCH_DEFAULT_DNS_1"
-fi
-
-if [[ $CONFIG_MATCH_DEFAULT_DNS_2 =~ $CONFIG_REQUIRED_DEFAULT_DNS_2 ]]
-then
-  echo "==> Config match found: $CONFIG_REQUIRED_DEFAULT_DNS_2 == $CONFIG_MATCH_DEFAULT_DNS_2"
-else
-  abort "==> Config match not found: $CONFIG_REQUIRED_DEFAULT_DNS_2 != $CONFIG_MATCH_DEFAULT_DNS_2"
-fi
-
-SERV_IP=$(ip -4 -o addr show scope global  | awk '{print $4}' | sed -e 's:/.*::' | head -n1)
 ovpn_genconfig -u udp://$SERV_IP -r "172.33.33.0/24" -r "172.34.34.0/24"
 
-CONFIG_REQUIRED_ROUTE_1="^route 172.33.33.0 255.255.255.0"
-CONFIG_MATCH_ROUTE_1=$(busybox grep 'route 172.33.33.0 255.255.255.0' /etc/openvpn/openvpn.conf)
+test_config "${SERVER_CONF}" "^route\s\+172.33.33.0\s\+255.255.255.0"
+test_config "${SERVER_CONF}" "^route\s\+172.34.34.0\s\+255.255.255.0"
 
-CONFIG_REQUIRED_ROUTE_2="^route 172.34.34.0 255.255.255.0"
-CONFIG_MATCH_ROUTE_2=$(busybox grep 'route 172.34.34.0 255.255.255.0' /etc/openvpn/openvpn.conf)
 
-if [[ $CONFIG_MATCH_ROUTE_1 =~ $CONFIG_REQUIRED_ROUTE_1 ]]
-then
-  echo "==> Config match found: $CONFIG_REQUIRED_ROUTE_1 == $CONFIG_MATCH_ROUTE_1"
-else
-  abort "==> Config match not found: $CONFIG_REQUIRED_ROUTE_1 != $CONFIG_MATCH_ROUTE_1"
-fi
+#
+# Block outside DNS test
+#
 
-if [[ $CONFIG_MATCH_ROUTE_2 =~ $CONFIG_REQUIRED_ROUTE_2 ]]
-then
-  echo "==> Config match found: $CONFIG_REQUIRED_ROUTE_2 == $CONFIG_MATCH_ROUTE_2"
-else
-  abort "==> Config match not found: $CONFIG_REQUIRED_ROUTE_2 != $CONFIG_MATCH_ROUTE_2"
-fi
+ovpn_genconfig -u udp://$SERV_IP -b
 
-# Test generated client config
-
-# gen udp client with tcp fallback
-ovpn_genconfig -u udp://$SERV_IP -E "remote $SERV_IP 443 tcp" -E "remote vpn.example.com 443 tcp"
-# nopass is insecure
-EASYRSA_BATCH=1 EASYRSA_REQ_CN="Travis-CI Test CA" ovpn_initpki nopass
-easyrsa build-client-full client-fallback nopass
-ovpn_getclient client-fallback | tee /etc/openvpn/config-fallback.ovpn
-
-CONFIG_REQUIRED_TCP_REMOTE="^remote $SERV_IP 443 tcp"
-CONFIG_MATCH_TCP_REMOTE=$(busybox grep "remote $SERV_IP 443 tcp" /etc/openvpn/config-fallback.ovpn)
-
-CONFIG_REQUIRED_TCP_REMOTE_2="^remote vpn.example.com 443 tcp"
-CONFIG_MATCH_TCP_REMOTE_2=$(busybox grep "remote vpn.example.com 443 tcp" /etc/openvpn/config-fallback.ovpn)
-
-if [[ $CONFIG_MATCH_TCP_REMOTE =~ $CONFIG_REQUIRED_TCP_REMOTE ]]
-then
-  echo "==> Config match found: $CONFIG_REQUIRED_TCP_REMOTE == $CONFIG_MATCH_TCP_REMOTE"
-else
-  abort "==> Config match not found: $CONFIG_REQUIRED_TCP_REMOTE != $CONFIG_MATCH_TCP_REMOTE"
-fi
-
-if [[ $CONFIG_MATCH_TCP_REMOTE_2 =~ $CONFIG_REQUIRED_TCP_REMOTE_2 ]]
-then
-  echo "==> Config match found: $CONFIG_REQUIRED_TCP_REMOTE_2 == $CONFIG_MATCH_TCP_REMOTE_2"
-else
-  abort "==> Config match not found: $CONFIG_REQUIRED_TCP_REMOTE_2 != $CONFIG_MATCH_TCP_REMOTE_2"
-fi
+test_not_config "${SERVER_CONF}" '^push "block-outside-dns"'
+cat ${SERVER_CONF} >&1

test/tests/revocation/run.sh

@@ -0,0 +1,101 @@
+#!/bin/bash
+set -e
+
+[ -n "${DEBUG+x}" ] && set -x
+
+OVPN_DATA="basic-data"
+CLIENT1="travis-client1"
+CLIENT2="travis-client2"
+IMG="kylemanna/openvpn"
+NAME="ovpn-test"
+CLIENT_DIR="$(readlink -f "$(dirname "$BASH_SOURCE")/../../client")"
+SERV_IP="$(ip -4 -o addr show scope global  | awk '{print $4}' | sed -e 's:/.*::' | head -n1)"
+
+#
+# Initialize openvpn configuration and pki.
+#
+docker volume create --name $OVPN_DATA
+docker run --rm -v $OVPN_DATA:/etc/openvpn $IMG ovpn_genconfig -u udp://$SERV_IP
+docker run --rm -v $OVPN_DATA:/etc/openvpn -it -e "EASYRSA_BATCH=1" -e "EASYRSA_REQ_CN=Travis-CI Test CA" $IMG ovpn_initpki nopass
+
+#
+# Fire up the server.
+#
+sudo iptables -N DOCKER || echo 'Firewall already configured'
+sudo iptables -I FORWARD 1 -j DOCKER
+docker run -d -v $OVPN_DATA:/etc/openvpn --cap-add=NET_ADMIN --privileged -p 1194:1194/udp --name $NAME $IMG
+
+
+#
+# Test that easy_rsa generate CRLs with 'next publish' set to 3650 days.
+#
+crl_next_update="$(docker exec $NAME openssl crl -nextupdate -noout -in /etc/openvpn/crl.pem | cut -d'=' -f2 | tr -d 'GMT')"
+crl_next_update="$(date -u -d "$crl_next_update" "+%s")"
+now="$(docker exec $NAME date "+%s")"
+crl_remain="$(( $crl_next_update - $now ))"
+crl_remain="$(( $crl_remain / 86400 ))"
+if (( $crl_remain < 3649 )); then
+    echo "easy_rsa CRL next publish set to less than 3650 days." >&2
+    exit 2
+fi
+
+#
+# Generate a first client certificate and configuration using $CLIENT1 as CN then revoke it.
+#
+docker exec -it $NAME easyrsa build-client-full $CLIENT1 nopass
+docker exec -it $NAME ovpn_getclient $CLIENT1 > $CLIENT_DIR/config.ovpn
+docker exec -it $NAME bash -c "echo 'yes' | ovpn_revokeclient $CLIENT1 remove"
+
+#
+# Test that openvpn client can't connect using $CLIENT1 config.
+#
+if docker run --rm -v $CLIENT_DIR:/client --cap-add=NET_ADMIN --privileged --net=host $IMG /client/wait-for-connect.sh; then
+    echo "Client was able to connect after revocation test #1." >&2
+    exit 2
+fi
+
+#
+# Generate and revoke a second client certificate using $CLIENT2 as CN, then test for failed client connection.
+#
+docker exec -it $NAME easyrsa build-client-full $CLIENT2 nopass
+docker exec -it $NAME ovpn_getclient $CLIENT2 > $CLIENT_DIR/config.ovpn
+docker exec -it $NAME bash -c "echo 'yes' | ovpn_revokeclient $CLIENT2 remove"
+
+if docker run --rm -v $CLIENT_DIR:/client --cap-add=NET_ADMIN --privileged --net=host $IMG /client/wait-for-connect.sh; then
+    echo "Client was able to connect after revocation test #2." >&2
+    exit 2
+fi
+
+#
+# Restart the server
+#
+docker stop $NAME && docker start $NAME
+
+#
+# Test for failed connection using $CLIENT2 config again.
+#
+if docker run --rm -v $CLIENT_DIR:/client --cap-add=NET_ADMIN --privileged --net=host $IMG /client/wait-for-connect.sh; then
+    echo "Client was able to connect after revocation test #3." >&2
+    exit 2
+fi
+
+#
+# Stop the server and clean up
+#
+docker kill $NAME && docker rm $NAME
+docker volume rm $OVPN_DATA
+sudo iptables -D FORWARD 1
+
+#
+# Celebrate
+#
+cat <<EOF
+ ___________
+< it worked >
+ -----------
+        \   ^__^
+         \  (oo)\_______
+            (__)\       )\/\\
+                ||----w |
+                ||     ||
+EOF