Merge ~gary-wzl77/snappy-hwe-snaps/+git/easy-openvpn:natdevice into ~snappy-hwe-team/snappy-hwe-snaps/+git/easy-openvpn:master

[Gary.Wang]

Support to specify natdevice via configure hook.

Support to specify natdevice via configure hook.
Note: 1. I don't bump up snap version since we didn't release 2.3.10-2 yet officially.
      2. I'll create another MP with a proper docs structure.

[Simon Fels (morphis)]

One more general comment inline but otherwise LGTM

review: Approve

[System Enablement Bot (system-enablement-ci-bot)]

PASSED: Continuous integration, rev:4cc9c94f1589b96d4c82ca0eb85c0094e063f842
https://jenkins.canonical.com/system-enablement/job/generic-build-snap/1941/
Executed test runs:
    SUCCESS: https://jenkins.canonical.com/system-enablement/job/generic-build-snap-worker/3363
    None: https://jenkins.canonical.com/system-enablement/job/generic-update-snap-mp/1849/console
    SUCCESS: https://jenkins.canonical.com/system-enablement/job/generic-test-snap/3623
    None: https://jenkins.canonical.com/system-enablement/job/generic-cleanup-snap/2818/console

Click here to trigger a rebuild:
https://jenkins.canonical.com/system-enablement/job/generic-build-snap/1941/rebuild

review: Approve (continuous-integration)

[Alfonso Sanchez-Beato (alfonsosanchezbeato)]

One small nit

review: Needs Fixing

[Alfonso Sanchez-Beato (alfonsosanchezbeato)]

LGTM

review: Approve

[System Enablement Bot (system-enablement-ci-bot)]

PASSED: Continuous integration, rev:4e1618e9e80532cacd3b4fd6ead1ea93cc09cda7
https://jenkins.canonical.com/system-enablement/job/generic-build-snap/1942/
Executed test runs:
    SUCCESS: https://jenkins.canonical.com/system-enablement/job/generic-build-snap-worker/3364
    None: https://jenkins.canonical.com/system-enablement/job/generic-update-snap-mp/1850/console
    SUCCESS: https://jenkins.canonical.com/system-enablement/job/generic-test-snap/3624
    None: https://jenkins.canonical.com/system-enablement/job/generic-cleanup-snap/2819/console

Click here to trigger a rebuild:
https://jenkins.canonical.com/system-enablement/job/generic-build-snap/1942/rebuild

review: Approve (continuous-integration)

diff --git a/README.md b/README.md
index 120c043..e5c7630 100644
--- a/README.md
+++ b/README.md
@@ -26,6 +26,18 @@ Commands subject to change as I refine things, but here goes:
 
 ## Configure
 
+Enable IP forwarding firstly. Note: On ubuntu core, IP forwarding is disabled by default.
+
+    $ sudo sysctl -w net.ipv4.ip_forward=1
+
+If internet connection is over ethernet, you can skip natdevice setup since default natdevice value is 'eth0'.
+While a wireless connection is established, you need to set it to 'wlan0' accordingly.
+Note: This fits the scenario where people usually setup a wireless connection on ubuntu core at the first boot.
+
+    $ sudo snap set easy-openvpn natdevice=wlan0
+
+Setup an openvpn server with host machine IP address
+
     $ sudo easy-openvpn.setup -u udp://<public ip>
 
 You'll be prompted to set a passphrase for your CA. This passphrase will be
diff --git a/bin/configure b/bin/configure
index 8ef9823..d1b6d0f 100755
--- a/bin/configure
+++ b/bin/configure
@@ -28,6 +28,11 @@ if ! nopasswd=$(snapctl get nopasswd); then
     exit 1
 fi
 
+if ! natdevice=$(snapctl get natdevice); then
+    echo "Failed to get natdevice option."
+    exit 1
+fi
+
 cat << EOF > $PROFILE
 export OPENVPN=$SNAP_DATA/openvpn
 export EASYRSA=$SNAP/usr/local/easyrsa
@@ -36,6 +41,7 @@ export EASYRSA_VARS_FILE=$SNAP_DATA/openvpn/vars
 export PATH=$SNAP/usr/local/easyrsa:$SNAP/usr/sbin:$SNAP/usr/bin:$SNAP/sbin:$SNAP/bin:$PATH
 export DEBUG=$debug
 export NOPASSWD=$nopasswd
+export OVPN_NATDEVICE=$natdevice
 EOF
 
 # Set default domain common name and call easy-rsa explicitly in batch mode.
diff --git a/bin/help b/bin/help
index 0375715..c2b7cc1 100755
--- a/bin/help
+++ b/bin/help
@@ -18,13 +18,17 @@ source ${SNAP_DATA}/easy-openvpn.profile
 
 DEFAULT_DEBUG=0
 DEFAULT_NOPASSWD=0
+DEFAULT_OVPN_NATDEVICE=eth0
 
 SNAPPY_DEBUG=debug
 SNAPPY_NOPASSWD=nopasswd
+SNAPPY_OVPN_NATDEVICE=natdevice
 
-KEYS=("DEBUG" "NOPASSWD")
+KEYS=("DEBUG" "NOPASSWD" "OVPN_NATDEVICE")
 DESC_DEBUG="Enable debug mode in OpenVPN server if it's set to 1."
 DESC_NOPASSWD="Enable generating private key without a passphrase during server setup if it's set to 1"
+DESC_OVPN_NATDEVICE="Support to specify nat device, typically it could be eth0(default) or wlan0 if you
+                     connect to server over wireless connection"
 
 cat << 'EOF'
 OpenVPN snap with management scripts that simplify PKI
diff --git a/spread/main/add_client/task.yaml b/spread/main/add_client/task.yaml
index 1d0b480..989ef52 100644
--- a/spread/main/add_client/task.yaml
+++ b/spread/main/add_client/task.yaml
@@ -14,11 +14,11 @@ execute: |
 
     # check if foo exists in the client list
     client_name=$(sudo easy-openvpn.clients | awk -F',' '{if(NR>1)print $1}')
-    [ "${client_name}" = foo ] || exit 1
+    test "${client_name}" = "foo"
 
     # test client config
     sudo easy-openvpn.show-client foo > tmp.ovpn
     ! cmp --silent foo.ovpn tmp.ovpn
 
     # test duplicated client 
-    sudo easy-openvpn.add-client foo > foo.ovpn && exit 1 || exit 0
+    ! sudo easy-openvpn.add-client foo > foo.ovpn
diff --git a/spread/main/change_natdevice/task.yaml b/spread/main/change_natdevice/task.yaml
new file mode 100644
index 0000000..6bbdf50
--- /dev/null
+++ b/spread/main/change_natdevice/task.yaml
@@ -0,0 +1,42 @@
+summary: Test change natdevice to 'wlan0'.
+
+execute: |
+    . $TESTSLIB/utilities.sh
+    # so enable to setup server in non-interactive mode 
+    sudo snap set easy-openvpn nopasswd=1
+
+    # change natdevice to 'eth0'.
+    # It should be set to 'wlan0' while connecting to a wireless network
+    sudo snap set easy-openvpn natdevice='eth0'
+
+    # setup openvpn server
+    sudo easy-openvpn.setup -u "udp://${SERVER_IP}"
+
+    # launch openvpn server
+    sudo service ${SERVICE_UNIT} start
+
+    # wait openvpn server to launch
+    wait_for_systemd_service ${SERVICE_UNIT}
+    sudo journalctl -n 10 --no-pager -u ${SERVICE_UNIT} | MATCH 'Initialization Sequence Completed'
+
+    # add a client
+    sudo easy-openvpn.add-client foo > foo.ovpn
+
+    # change foo.ovpn owner to avoid dac_override denied in snappy world.
+    sudo chown root.root foo.ovpn
+
+    # run openvpn client as daemon to connect server
+    sudo easy-openvpn.connect-server foo.ovpn --daemon
+
+    # check currrent client connection status
+    sleep 90
+    sudo nohup easy-openvpn.status &>status_log &
+
+    sleep 1
+    client_info=$(sed '/^Common/,/^ROUTING/{//!b};d;//d' status_log)
+    name=$(echo "${client_info}" | awk -F',' '{print $1}')
+    rx=$(echo "${client_info}" | awk -F',' '{print $3}')
+    tx=$(echo "${client_info}" | awk -F',' '{print $4}')
+    test "${name}" = "foo"
+    test "${rx}" -gt "0"
+    test "${tx}" -gt "0"
diff --git a/spread/main/hooks/task.yaml b/spread/main/hooks/task.yaml
index 53c3fe1..f849977 100644
--- a/spread/main/hooks/task.yaml
+++ b/spread/main/hooks/task.yaml
@@ -11,3 +11,7 @@ execute: |
     # set 'nopasswd' to 1 and check the value in help command
     sudo snap set easy-openvpn nopasswd=1
     sudo easy-openvpn.help | MATCH "'nopasswd' current value set to: '1'.*"
+
+    # set 'natdevice' to 'wlan0' and check the value in help command
+    sudo snap set easy-openvpn natdevice=wlan0
+    sudo easy-openvpn.help | MATCH "'natdevice' current value set to: 'wlan0'.*"
diff --git a/spread/main/monitor_status/task.yaml b/spread/main/monitor_status/task.yaml
index d73a647..0574a89 100644
--- a/spread/main/monitor_status/task.yaml
+++ b/spread/main/monitor_status/task.yaml
@@ -32,12 +32,10 @@ execute: |
     sudo nohup easy-openvpn.status &>status_log &
 
     sleep 1
-    cat status_log
     client_info=$(sed '/^Common/,/^ROUTING/{//!b};d;//d' status_log)
-    echo $client_info
     name=$(echo "${client_info}" | awk -F',' '{print $1}')
     rx=$(echo "${client_info}" | awk -F',' '{print $3}')
     tx=$(echo "${client_info}" | awk -F',' '{print $4}')
-    [ "${name}" = "foo" ] || exit 1
-    [ "${rx}" -gt "0" ] || exit 1
-    [ "${tx}" -gt "0" ] || exit 1
+    test "${name}" = "foo"
+    test "${rx}" -gt "0"
+    test "${tx}" -gt "0"
diff --git a/spread/main/setup_server/task.yaml b/spread/main/setup_server/task.yaml
index 77bf55b..0b1b0c4 100644
--- a/spread/main/setup_server/task.yaml
+++ b/spread/main/setup_server/task.yaml
@@ -14,5 +14,5 @@ execute: |
 
     # to check if ca keypairs are generated successfully
     SNAP_DATA="/var/snap/easy-openvpn/current"
-    [ -f "${SNAP_DATA}/openvpn/pki/private/${SERVER_IP}.key" ] || exit 1
-    [ -f "${SNAP_DATA}/openvpn/pki/private/ca.key" ] || exit 1
+    test -f "${SNAP_DATA}/openvpn/pki/private/${SERVER_IP}.key"
+    test -f "${SNAP_DATA}/openvpn/pki/private/ca.key"