From a73e53019cced05a6dce12414d868e6dedc865ca Mon Sep 17 00:00:00 2001 From: Harold Drost Date: Thu, 25 Apr 2019 18:22:47 +0100 Subject: [PATCH] Detect current network and netmask (#13250) * Detect current network and netmask Previously the network was guessed (assumed it was a /24 by replacing the last octet with a 0) and then later the netmask was hardcoded to 255.255.240.0 as a result the requested route is almost always incorrect. As most people supply their own or use the vpn tunnel as a default gateway it's probably rare to cause any issues. Signed-off-by: Harold Drost * Removing unnecessary debug messages. Signed-off-by: Harold Drost * Actually fixing the thing it was all about... :$ My testing worked because helm believed the `openvpn.conf` unchanged and therefore didn't replace the manually edited file which had the change in this commit. Tested using brand new deployment now works correctly and without routing errors. Signed-off-by: Harold Drost --- stable/openvpn/Chart.yaml | 2 +- stable/openvpn/templates/config-openvpn.yaml | 42 ++++++++++++++++++-- 2 files changed, 39 insertions(+), 5 deletions(-) diff --git a/stable/openvpn/Chart.yaml b/stable/openvpn/Chart.yaml index e48e72cd77..ad7272f285 100755 --- a/stable/openvpn/Chart.yaml +++ b/stable/openvpn/Chart.yaml @@ -3,7 +3,7 @@ description: A Helm chart to install an openvpn server inside a kubernetes clust generation is also part of the deployment, and this chart will generate client keys as needed. name: openvpn -version: 3.12.2 +version: 3.12.3 appVersion: 1.1.0 maintainers: - name: jfelten diff --git a/stable/openvpn/templates/config-openvpn.yaml b/stable/openvpn/templates/config-openvpn.yaml index 4276077865..9891ef9442 100644 --- a/stable/openvpn/templates/config-openvpn.yaml +++ b/stable/openvpn/templates/config-openvpn.yaml @@ -53,6 +53,34 @@ data: configure.sh: |- #!/bin/sh + + cidr2mask() { + # Number of args to shift, 255..255, first non-255 byte, zeroes + set -- $(( 5 - ($1 / 8) )) 255 255 255 255 $(( (255 << (8 - ($1 % 8))) & 255 )) 0 0 0 + [ $1 -gt 1 ] && shift "$1" || shift + echo ${1-0}.${2-0}.${3-0}.${4-0} + } + + cidr2net() { + local i ip mask netOctets octets + ip="${1%/*}" + mask="${1#*/}" + octets=$(echo "$ip" | tr '.' '\n') + + for octet in $octets; do + i=$((i+1)) + if [ $i -le $(( mask / 8)) ]; then + netOctets="$netOctets.$octet" + elif [ $i -eq $(( mask / 8 +1 )) ]; then + netOctets="$netOctets.$((((octet / ((256 / ((2**((mask % 8)))))))) * ((256 / ((2**((mask % 8))))))))" + else + netOctets="$netOctets.0" + fi + done + + echo ${netOctets#.} + } + /etc/openvpn/setup/setup-certs.sh iptables -t nat -A POSTROUTING -s {{ .Values.openvpn.OVPN_NETWORK }}/{{ .Values.openvpn.OVPN_SUBNET }} -o eth0 -j MASQUERADE mkdir -p /dev/net @@ -65,9 +93,14 @@ data: cat "${OVPN_CONFIG}" echo ==================================== fi - IP=$(ip route get 8.8.8.8 | awk '/8.8.8.8/ {print $NF}') - BASEIP=`echo $IP | cut -d"." -f1-3` - NETWORK=`echo $BASEIP".0"` + + intAndIP="$(ip route get 8.8.8.8 | awk '/8.8.8.8/ {print $5 "-" $7}')" + int="${intAndIP%-*}" + ip="${intAndIP#*-}" + cidr="$(ip addr show dev "$int" | awk -vip="$ip" '($2 ~ ip) {print $2}')" + + NETWORK="$(cidr2net $cidr)" + NETMASK="$(cidr2mask ${cidr#*/})" DNS=$(cat /etc/resolv.conf | grep -v '^#' | grep nameserver | awk '{print $2}') SEARCH=$(cat /etc/resolv.conf | grep -v '^#' | grep search | awk '{$1=""; print $0}') FORMATTED_SEARCH="" @@ -78,6 +111,7 @@ data: sed 's|OVPN_K8S_SEARCH|'"${FORMATTED_SEARCH}"'|' -i /etc/openvpn/openvpn.conf sed 's|OVPN_K8S_DNS|'"${DNS}"'|' -i /etc/openvpn/openvpn.conf sed 's|NETWORK|'"${NETWORK}"'|' -i /etc/openvpn/openvpn.conf + sed 's|NETMASK|'"${NETMASK}"'|' -i /etc/openvpn/openvpn.conf openvpn --config /etc/openvpn/openvpn.conf openvpn.conf: |- @@ -101,7 +135,7 @@ data: user nobody group nogroup - push "route NETWORK 255.255.240.0" + push "route NETWORK NETMASK" {{ if (.Values.openvpn.OVPN_K8S_POD_NETWORK) (.Values.openvpn.OVPN_K8S_POD_SUBNET) }} push "route {{ .Values.openvpn.OVPN_K8S_POD_NETWORK }} {{ .Values.openvpn.OVPN_K8S_POD_SUBNET }}" {{ end }}