From 6482a4ccb3d72773cc6d00d5fa7933fa83c4cafe Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Tue, 5 Sep 2017 18:24:31 -0700
Subject: Bug: fix vpn network problem caused by vagrant fact

Boolean facts must be escaped with str2bool. This commit includes
new tests to catch VPN problems like this in the future.
---
 puppet/modules/site_config/manifests/params.pp             |  3 +--
 puppet/modules/site_config/manifests/setup.pp              |  2 +-
 puppet/modules/site_openvpn/manifests/init.pp              |  2 +-
 .../modules/site_openvpn/templates/add_gateway_ips.sh.erb  | 14 ++++++++++++--
 4 files changed, 15 insertions(+), 6 deletions(-)

(limited to 'puppet')

diff --git a/puppet/modules/site_config/manifests/params.pp b/puppet/modules/site_config/manifests/params.pp
index 4627515a..2c9687a3 100644
--- a/puppet/modules/site_config/manifests/params.pp
+++ b/puppet/modules/site_config/manifests/params.pp
@@ -6,8 +6,7 @@ class site_config::params {
   $ec2_local_ipv4_interface = getvar("interface_${::ec2_local_ipv4}")
   $environment              = hiera('environment', undef)
 
-
-  if $::vagrant {
+  if str2bool("$::vagrant") {
     # Depending on the backend hypervisor networking is setup differently.
     if $::interfaces =~ /eth1/ {
       # Virtualbox: Private networking creates a second interface eth1
diff --git a/puppet/modules/site_config/manifests/setup.pp b/puppet/modules/site_config/manifests/setup.pp
index a96f87a6..bd3097fa 100644
--- a/puppet/modules/site_config/manifests/setup.pp
+++ b/puppet/modules/site_config/manifests/setup.pp
@@ -37,7 +37,7 @@ class site_config::setup {
   # we need to include shorewall::interface{eth0} in setup.pp so
   # packages can be installed during main puppetrun, even before shorewall
   # is configured completly
-  if $::vagrant {
+  if str2bool("$::vagrant") {
     include site_config::vagrant
   }
 
diff --git a/puppet/modules/site_openvpn/manifests/init.pp b/puppet/modules/site_openvpn/manifests/init.pp
index f1ecefb9..ee7d6840 100644
--- a/puppet/modules/site_openvpn/manifests/init.pp
+++ b/puppet/modules/site_openvpn/manifests/init.pp
@@ -68,7 +68,7 @@ class site_openvpn {
   # find out the netmask in cidr format of the primary IF
   # thx to https://blog.kumina.nl/tag/puppet-tips-and-tricks/
   # we can do this using an inline_template:
-  $factname_primary_netmask = "netmask_cidr_${::site_config::params::interface}"
+  $factname_primary_netmask = "netmask_${::site_config::params::interface}"
   $primary_netmask = inline_template('<%= scope.lookupvar(@factname_primary_netmask) %>')
 
   # deploy dh keys
diff --git a/puppet/modules/site_openvpn/templates/add_gateway_ips.sh.erb b/puppet/modules/site_openvpn/templates/add_gateway_ips.sh.erb
index e76b756b..f2d2bc70 100644
--- a/puppet/modules/site_openvpn/templates/add_gateway_ips.sh.erb
+++ b/puppet/modules/site_openvpn/templates/add_gateway_ips.sh.erb
@@ -1,11 +1,21 @@
 #!/bin/sh
 
-ip addr show dev <%= scope.lookupvar('site_config::params::interface') %> | grep -q <%= @openvpn_gateway_address %>/<%= @primary_netmask %> ||
+ip addr show dev <%= scope.lookupvar('site_config::params::interface') %> | grep -q "inet <%= @openvpn_gateway_address %>/" ||
   ip addr add <%= @openvpn_gateway_address %>/<%= @primary_netmask %> dev <%= scope.lookupvar('site_config::params::interface') %>
 
+EXITCODE=$?
+if [ $EXITCODE != 0 ]; then
+  exit $EXITCODE
+fi
+
 <% if @openvpn_second_gateway_address %>
-ip addr show dev <%= scope.lookupvar('site_config::params::interface') %> | grep -q <%= @openvpn_second_gateway_address %>/<%= @primary_netmask %> ||
+ip addr show dev <%= scope.lookupvar('site_config::params::interface') %> | grep -q "<%= @openvpn_second_gateway_address %>/" ||
   ip addr add <%= @openvpn_second_gateway_address %>/<%= @primary_netmask %> dev <%= scope.lookupvar('site_config::params::interface') %>
+
+EXITCODE=$?
+if [ $EXITCODE != 0 ]; then
+  exit $EXITCODE
+fi
 <% end %>
 
 /bin/echo 1 > /proc/sys/net/ipv4/ip_forward
-- 
cgit v1.2.3