From f35db765d82974d2b935036acbc57e7d1acd13a9 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Tue, 16 Jul 2013 10:54:54 +0100
Subject: lint site_openvpn manifests

Change-Id: I314031d93aa9f4a0f217680870678e39c096d46a
---
 puppet/modules/site_openvpn/manifests/init.pp      | 13 +++---
 .../site_openvpn/manifests/server_config.pp        | 48 +++++++++++-----------
 2 files changed, 31 insertions(+), 30 deletions(-)

(limited to 'puppet/modules/site_openvpn/manifests')

diff --git a/puppet/modules/site_openvpn/manifests/init.pp b/puppet/modules/site_openvpn/manifests/init.pp
index 4f900623..b2bb0d3a 100644
--- a/puppet/modules/site_openvpn/manifests/init.pp
+++ b/puppet/modules/site_openvpn/manifests/init.pp
@@ -5,8 +5,9 @@
 #   (2) unlimited only
 #   (3) limited only
 #
-# The difference is that 'unlimited' gateways only allow client certs that match the 'unlimited_prefix',
-# and 'limited' gateways only allow certs that match the 'limited_prefix'.
+# The difference is that 'unlimited' gateways only allow client certs that match
+# the 'unlimited_prefix', and 'limited' gateways only allow certs that match the
+# 'limited_prefix'.
 #
 # We potentially create four openvpn config files (thus four daemons):
 #
@@ -89,8 +90,8 @@ class site_openvpn {
       management  => '127.0.0.1 1001'
     }
   } else {
-    tidy { "/etc/openvpn/tcp_config.conf": }
-    tidy { "/etc/openvpn/udp_config.conf": }
+    tidy { '/etc/openvpn/tcp_config.conf': }
+    tidy { '/etc/openvpn/udp_config.conf': }
   }
 
   if $openvpn_allow_limited {
@@ -113,8 +114,8 @@ class site_openvpn {
       management  => '127.0.0.1 1003'
     }
   } else {
-    tidy { "/etc/openvpn/limited_tcp_config.conf": }
-    tidy { "/etc/openvpn/limited_udp_config.conf": }
+    tidy { '/etc/openvpn/limited_tcp_config.conf': }
+    tidy { '/etc/openvpn/limited_udp_config.conf': }
   }
 
   file {
diff --git a/puppet/modules/site_openvpn/manifests/server_config.pp b/puppet/modules/site_openvpn/manifests/server_config.pp
index 6106cfbb..a53019a8 100644
--- a/puppet/modules/site_openvpn/manifests/server_config.pp
+++ b/puppet/modules/site_openvpn/manifests/server_config.pp
@@ -70,7 +70,7 @@ define site_openvpn::server_config(
 
   if $tls_remote != undef {
     openvpn::option {
-      "tls-remote $openvpn_configname":
+      'tls-remote $openvpn_configname':
          key     => 'tls-remote',
          value   => $tls_remote,
          server  => $openvpn_configname;
@@ -78,89 +78,89 @@ define site_openvpn::server_config(
   }
 
   openvpn::option {
-    "ca $openvpn_configname":
+    "ca ${openvpn_configname}":
         key     => 'ca',
         value   => '/etc/openvpn/ca_bundle.pem',
         server  => $openvpn_configname;
-    "cert $openvpn_configname":
+    "cert ${openvpn_configname}":
         key     => 'cert',
         value   => '/etc/x509/certs/leap_openvpn.crt',
         server  => $openvpn_configname;
-    "key $openvpn_configname":
+    "key ${openvpn_configname}":
         key     => 'key',
         value   => '/etc/x509/keys/leap_openvpn.key',
         server  => $openvpn_configname;
-    "dh $openvpn_configname":
+    "dh ${openvpn_configname}":
         key     => 'dh',
         value   => '/etc/openvpn/keys/dh.pem',
         server  => $openvpn_configname;
-    "tls-cipher $openvpn_configname":
+    "tls-cipher ${openvpn_configname}":
         key     => 'tls-cipher',
         value   => 'DHE-RSA-AES128-SHA',
         server  => $openvpn_configname;
-    "auth $openvpn_configname":
+    "auth ${openvpn_configname}":
         key     => 'auth',
         value   => 'SHA1',
         server  => $openvpn_configname;
-    "cipher $openvpn_configname":
+    "cipher ${openvpn_configname}":
         key     => 'cipher',
         value   => 'AES-128-CBC',
         server  => $openvpn_configname;
-    "dev $openvpn_configname":
+    "dev ${openvpn_configname}":
         key    => 'dev',
         value  => 'tun',
         server => $openvpn_configname;
-    "duplicate-cn $openvpn_configname":
+    "duplicate-cn ${openvpn_configname}":
         key    => 'duplicate-cn',
         server => $openvpn_configname;
-    "keepalive $openvpn_configname":
+    "keepalive ${openvpn_configname}":
         key    => 'keepalive',
         value  => '5 20',
         server => $openvpn_configname;
-    "local $openvpn_configname":
+    "local ${openvpn_configname}":
         key    => 'local',
         value  => $local,
         server => $openvpn_configname;
-    "mute $openvpn_configname":
+    "mute ${openvpn_configname}":
         key    => 'mute',
         value  => '5',
         server => $openvpn_configname;
-    "mute-replay-warnings $openvpn_configname":
+    "mute-replay-warnings ${openvpn_configname}":
         key    => 'mute-replay-warnings',
         server => $openvpn_configname;
-    "management $openvpn_configname":
+    "management ${openvpn_configname}":
         key    => 'management',
         value  => $management,
         server => $openvpn_configname;
-    "proto $openvpn_configname":
+    "proto ${openvpn_configname}":
         key    => 'proto',
         value  => $proto,
         server => $openvpn_configname;
-    "push1 $openvpn_configname":
+    "push1 ${openvpn_configname}":
         key    => 'push',
         value  => $push,
         server => $openvpn_configname;
-    "push2 $openvpn_configname":
+    "push2 ${openvpn_configname}":
         key    => 'push',
         value  => '"redirect-gateway def1"',
         server => $openvpn_configname;
-    "script-security $openvpn_configname":
+    "script-security ${openvpn_configname}":
         key    => 'script-security',
         value  => '2',
         server => $openvpn_configname;
-    "server $openvpn_configname":
+    "server ${openvpn_configname}":
         key    => 'server',
         value  => $server,
         server => $openvpn_configname;
-    "status $openvpn_configname":
+    "status ${openvpn_configname}":
         key    => 'status',
         value  => '/var/run/openvpn-status 10',
         server => $openvpn_configname;
-    "status-version $openvpn_configname":
+    "status-version ${openvpn_configname}":
         key    => 'status-version',
         value  => '3',
         server => $openvpn_configname;
-    "topology $openvpn_configname":
+    "topology ${openvpn_configname}":
         key    => 'topology',
         value  => 'subnet',
         server => $openvpn_configname;
@@ -169,7 +169,7 @@ define site_openvpn::server_config(
     #    key    => 'up',
     #    value  => '/etc/openvpn/server-up.sh',
     #    server => $openvpn_configname;
-    "verb $openvpn_configname":
+    "verb ${openvpn_configname}":
         key    => 'verb',
         value  => '3',
         server => $openvpn_configname;
-- 
cgit v1.2.3


From a1d8ec10bd7d7ac4a146222010cf5a6862e45869 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Tue, 23 Jul 2013 12:45:31 -0400
Subject: fix linting error

Change-Id: I975e1bd480d756a85e556b440a0e28e3899c9af8
---
 puppet/modules/site_openvpn/manifests/server_config.pp | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

(limited to 'puppet/modules/site_openvpn/manifests')

diff --git a/puppet/modules/site_openvpn/manifests/server_config.pp b/puppet/modules/site_openvpn/manifests/server_config.pp
index a53019a8..5ba9812f 100644
--- a/puppet/modules/site_openvpn/manifests/server_config.pp
+++ b/puppet/modules/site_openvpn/manifests/server_config.pp
@@ -70,10 +70,10 @@ define site_openvpn::server_config(
 
   if $tls_remote != undef {
     openvpn::option {
-      'tls-remote $openvpn_configname':
-         key     => 'tls-remote',
-         value   => $tls_remote,
-         server  => $openvpn_configname;
+      "tls-remote ${openvpn_configname}":
+        key     => 'tls-remote',
+        value   => $tls_remote,
+        server  => $openvpn_configname;
     }
   }
 
-- 
cgit v1.2.3


From a6c19295e276da865f6c66963ed761d3ebc7dc99 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Fri, 13 Sep 2013 14:17:54 +0200
Subject: remove x509::ca for leap_ca in site_openvpn::keys and
 site_stunnel::stunnel (#3817)

---
 puppet/modules/site_openvpn/manifests/keys.pp | 6 ------
 1 file changed, 6 deletions(-)

(limited to 'puppet/modules/site_openvpn/manifests')

diff --git a/puppet/modules/site_openvpn/manifests/keys.pp b/puppet/modules/site_openvpn/manifests/keys.pp
index f3c5b423..864bbd9b 100644
--- a/puppet/modules/site_openvpn/manifests/keys.pp
+++ b/puppet/modules/site_openvpn/manifests/keys.pp
@@ -12,12 +12,6 @@ class site_openvpn::keys {
       notify  => Service[openvpn];
   }
 
-  x509::ca {
-    'leap_ca':
-      content => $site_openvpn::x509_config['ca_cert'],
-      notify  => Service[openvpn];
-  }
-
   file { '/etc/openvpn/keys/dh.pem':
     content => $site_openvpn::x509_config['dh'],
     mode    => '0644',
-- 
cgit v1.2.3


From bdfef97e49f17c74158084e10e7d0121cc70dd42 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Tue, 17 Sep 2013 19:11:39 +0200
Subject: openvpn should use /usr/local/share/ca-certificates/leap_ca.crt
 (Feature #3831)

---
 puppet/modules/site_openvpn/manifests/server_config.pp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'puppet/modules/site_openvpn/manifests')

diff --git a/puppet/modules/site_openvpn/manifests/server_config.pp b/puppet/modules/site_openvpn/manifests/server_config.pp
index 5ba9812f..befeaef7 100644
--- a/puppet/modules/site_openvpn/manifests/server_config.pp
+++ b/puppet/modules/site_openvpn/manifests/server_config.pp
@@ -80,15 +80,15 @@ define site_openvpn::server_config(
   openvpn::option {
     "ca ${openvpn_configname}":
         key     => 'ca',
-        value   => '/etc/openvpn/ca_bundle.pem',
+        value   => "${x509::variables::local_CAs}/${site_config::params::ca_bundle_name}.crt",
         server  => $openvpn_configname;
     "cert ${openvpn_configname}":
         key     => 'cert',
-        value   => '/etc/x509/certs/leap_openvpn.crt',
+        value   => "${x509::variables::certs}/${site_config::params::cert_name}.crt",
         server  => $openvpn_configname;
     "key ${openvpn_configname}":
         key     => 'key',
-        value   => '/etc/x509/keys/leap_openvpn.key',
+        value   => "${x509::variables::keys}/${site_config::params::cert_name}.key",
         server  => $openvpn_configname;
     "dh ${openvpn_configname}":
         key     => 'dh',
-- 
cgit v1.2.3


From 3388336b57cc59617b6dc8380beeeacfdb2fb5b3 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Wed, 18 Sep 2013 12:05:10 -0400
Subject: Setup a class dependency for every tag 'leap_service' to make sure
 that shorewall is setup before the service is setup. This is necessary due to
 the strict initial firewall that stops various service setup operations from
 happening, but is relaxed once shorewall is setup properly (#3782)

Change-Id: Ia9640c4118aa0053cdb99e7bc11860fed5527501
---
 puppet/modules/site_openvpn/manifests/init.pp | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'puppet/modules/site_openvpn/manifests')

diff --git a/puppet/modules/site_openvpn/manifests/init.pp b/puppet/modules/site_openvpn/manifests/init.pp
index b2bb0d3a..fe5ef87f 100644
--- a/puppet/modules/site_openvpn/manifests/init.pp
+++ b/puppet/modules/site_openvpn/manifests/init.pp
@@ -20,6 +20,8 @@
 class site_openvpn {
   tag 'leap_service'
 
+  Class['site_config::default'] -> Class['site_openvpn']
+  
   $openvpn_config   = hiera('openvpn')
   $x509_config      = hiera('x509')
   $openvpn_ports    = $openvpn_config['ports']
-- 
cgit v1.2.3


From 1ce6cb5a30c5ee73d6474ac9c1bbd4c7819d9a73 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Thu, 19 Sep 2013 12:19:00 +0200
Subject: only deploy x509 stuff for nodes if it existes in hiera (Feature
 #3875)

---
 puppet/modules/site_openvpn/manifests/init.pp | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

(limited to 'puppet/modules/site_openvpn/manifests')

diff --git a/puppet/modules/site_openvpn/manifests/init.pp b/puppet/modules/site_openvpn/manifests/init.pp
index fe5ef87f..41f4c6d4 100644
--- a/puppet/modules/site_openvpn/manifests/init.pp
+++ b/puppet/modules/site_openvpn/manifests/init.pp
@@ -20,8 +20,12 @@
 class site_openvpn {
   tag 'leap_service'
 
+  include site_config::x509::cert_key
+  include site_config::x509::ca_bundle
+
+
   Class['site_config::default'] -> Class['site_openvpn']
-  
+
   $openvpn_config   = hiera('openvpn')
   $x509_config      = hiera('x509')
   $openvpn_ports    = $openvpn_config['ports']
-- 
cgit v1.2.3


From c68399c019d09a4c8ba44f47936b4b3842802177 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Thu, 19 Sep 2013 12:29:15 +0200
Subject: tidy openvpn x509 definitions (#3831)

---
 puppet/modules/site_openvpn/manifests/dh_key.pp | 10 ++++++
 puppet/modules/site_openvpn/manifests/init.pp   |  5 ++-
 puppet/modules/site_openvpn/manifests/keys.pp   | 45 -------------------------
 3 files changed, 12 insertions(+), 48 deletions(-)
 create mode 100644 puppet/modules/site_openvpn/manifests/dh_key.pp
 delete mode 100644 puppet/modules/site_openvpn/manifests/keys.pp

(limited to 'puppet/modules/site_openvpn/manifests')

diff --git a/puppet/modules/site_openvpn/manifests/dh_key.pp b/puppet/modules/site_openvpn/manifests/dh_key.pp
new file mode 100644
index 00000000..13cc0f5b
--- /dev/null
+++ b/puppet/modules/site_openvpn/manifests/dh_key.pp
@@ -0,0 +1,10 @@
+class site_openvpn::dh_key {
+
+  $x509_config      = hiera('x509')
+
+  file { '/etc/openvpn/keys/dh.pem':
+    content => $x509_config['dh'],
+    mode    => '0644',
+  }
+
+}
diff --git a/puppet/modules/site_openvpn/manifests/init.pp b/puppet/modules/site_openvpn/manifests/init.pp
index 41f4c6d4..29b3f13f 100644
--- a/puppet/modules/site_openvpn/manifests/init.pp
+++ b/puppet/modules/site_openvpn/manifests/init.pp
@@ -27,7 +27,6 @@ class site_openvpn {
   Class['site_config::default'] -> Class['site_openvpn']
 
   $openvpn_config   = hiera('openvpn')
-  $x509_config      = hiera('x509')
   $openvpn_ports    = $openvpn_config['ports']
 
   if $::ec2_instance_id {
@@ -62,8 +61,8 @@ class site_openvpn {
     $openvpn_limited_udp_cidr             = '21'
   }
 
-  # deploy ca + server keys
-  include site_openvpn::keys
+  # deploy dh keys
+  include site_openvpn::dh_key
 
   if $openvpn_allow_unlimited and $openvpn_allow_limited {
     $unlimited_gateway_address = $openvpn_gateway_address
diff --git a/puppet/modules/site_openvpn/manifests/keys.pp b/puppet/modules/site_openvpn/manifests/keys.pp
deleted file mode 100644
index 864bbd9b..00000000
--- a/puppet/modules/site_openvpn/manifests/keys.pp
+++ /dev/null
@@ -1,45 +0,0 @@
-class site_openvpn::keys {
-
-  x509::key {
-    'leap_openvpn':
-      content => $site_openvpn::x509_config['key'],
-      notify  => Service[openvpn];
-  }
-
-  x509::cert {
-    'leap_openvpn':
-      content => $site_openvpn::x509_config['cert'],
-      notify  => Service[openvpn];
-  }
-
-  file { '/etc/openvpn/keys/dh.pem':
-    content => $site_openvpn::x509_config['dh'],
-    mode    => '0644',
-  }
-
-  #
-  # CA bundle -- we want to have the possibility of allowing multiple CAs.
-  # For now, the reason is to transition to using client CA. In the future,
-  # we will want to be able to smoothly phase out one CA and phase in another.
-  # I tried "--capath" for this, but it did not work.
-  #
-
-  concat {
-    '/etc/openvpn/ca_bundle.pem':
-      owner  => root,
-      group  => root,
-      mode   => 644,
-      warn   => true,
-      notify => Service['openvpn'];
-  }
-
-  concat::fragment {
-    'client_ca_cert':
-      content => $site_openvpn::x509_config['client_ca_cert'],
-      target  => '/etc/openvpn/ca_bundle.pem';
-    'ca_cert':
-      content => $site_openvpn::x509_config['ca_cert'],
-      target  => '/etc/openvpn/ca_bundle.pem';
-  }
-
-}
-- 
cgit v1.2.3


From d7aca479f254ce4cbe58ee2a2197ea5c6d02de53 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Thu, 19 Sep 2013 12:44:30 +0200
Subject: Depend services on deployment of default key, cert and ca (Feature
 #3838)

---
 puppet/modules/site_openvpn/manifests/init.pp | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

(limited to 'puppet/modules/site_openvpn/manifests')

diff --git a/puppet/modules/site_openvpn/manifests/init.pp b/puppet/modules/site_openvpn/manifests/init.pp
index 29b3f13f..6ab0d430 100644
--- a/puppet/modules/site_openvpn/manifests/init.pp
+++ b/puppet/modules/site_openvpn/manifests/init.pp
@@ -137,7 +137,11 @@ class site_openvpn {
     command     => '/etc/init.d/openvpn restart',
     refreshonly => true,
     subscribe   => File['/etc/openvpn'],
-    require     => [ Package['openvpn'], File['/etc/openvpn'] ];
+    require     => [
+      Package['openvpn'],
+      File['/etc/openvpn'],
+      Class['Site_config::X509::Cert_key'],
+      Class['Site_config::X509::Ca_bundle'] ];
   }
 
   cron { 'add_gateway_ips.sh':
-- 
cgit v1.2.3


From ffa4504f81c0abecc62b068951ec147741028128 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Tue, 24 Sep 2013 09:09:30 +0200
Subject: seperate cert and key deployment (#3918)

---
 puppet/modules/site_openvpn/manifests/init.pp | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

(limited to 'puppet/modules/site_openvpn/manifests')

diff --git a/puppet/modules/site_openvpn/manifests/init.pp b/puppet/modules/site_openvpn/manifests/init.pp
index 6ab0d430..bf72c8d6 100644
--- a/puppet/modules/site_openvpn/manifests/init.pp
+++ b/puppet/modules/site_openvpn/manifests/init.pp
@@ -20,7 +20,8 @@
 class site_openvpn {
   tag 'leap_service'
 
-  include site_config::x509::cert_key
+  include site_config::x509::cert
+  include site_config::x509::key
   include site_config::x509::ca_bundle
 
 
@@ -140,7 +141,8 @@ class site_openvpn {
     require     => [
       Package['openvpn'],
       File['/etc/openvpn'],
-      Class['Site_config::X509::Cert_key'],
+      Class['Site_config::X509::Key'],
+      Class['Site_config::X509::Cert'],
       Class['Site_config::X509::Ca_bundle'] ];
   }
 
-- 
cgit v1.2.3


From 20a8032ae0580356c3399976f44c13825f87093a Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Wed, 25 Sep 2013 14:29:15 +0200
Subject: openvpn is restarted before package is installed (Bug #3904)

---
 puppet/modules/site_openvpn/manifests/init.pp | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to 'puppet/modules/site_openvpn/manifests')

diff --git a/puppet/modules/site_openvpn/manifests/init.pp b/puppet/modules/site_openvpn/manifests/init.pp
index bf72c8d6..61fefd0a 100644
--- a/puppet/modules/site_openvpn/manifests/init.pp
+++ b/puppet/modules/site_openvpn/manifests/init.pp
@@ -167,7 +167,9 @@ class site_openvpn {
       ensure     => running,
       hasrestart => true,
       hasstatus  => true,
-      require    => Exec['concat_/etc/default/openvpn'];
+      require    => [
+        Package['openvpn'],
+        Exec['concat_/etc/default/openvpn'] ];
   }
 
   file {
-- 
cgit v1.2.3


From 3b532da3871a5a655af4b0741348d9140b0ebf6a Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Wed, 2 Oct 2013 10:37:05 -0400
Subject: only add vpn_(un)?limited_udp_resolver and
 vpn_(un)?limited_tcp_resolver lines to unbound.conf if the openvpn package is
 installed (#3868)

Change-Id: I65852660a606ccea7569b2207bd535bd8aa3867c
---
 puppet/modules/site_openvpn/manifests/resolver.pp | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

(limited to 'puppet/modules/site_openvpn/manifests')

diff --git a/puppet/modules/site_openvpn/manifests/resolver.pp b/puppet/modules/site_openvpn/manifests/resolver.pp
index c1bce858..c74fb509 100644
--- a/puppet/modules/site_openvpn/manifests/resolver.pp
+++ b/puppet/modules/site_openvpn/manifests/resolver.pp
@@ -60,25 +60,25 @@ class site_openvpn::resolver {
       path    => '/etc/unbound/unbound.conf',
       line    => 'server: include: /etc/unbound/conf.d/vpn_unlimited_tcp_resolver',
       notify  => Service['unbound'],
-      require => Package['unbound'];
+      require => [ Package['openvpn'], Package['unbound'] ];
     'add_unlimited_udp_resolver':
       ensure  => $ensure_unlimited,
       path    => '/etc/unbound/unbound.conf',
       line    => 'server: include: /etc/unbound/conf.d/vpn_unlimited_udp_resolver',
       notify  => Service['unbound'],
-      require => Package['unbound'];
+      require => [ Package['openvpn'], Package['unbound'] ];
     'add_limited_tcp_resolver':
       ensure  => $ensure_limited,
       path    => '/etc/unbound/unbound.conf',
       line    => 'server: include: /etc/unbound/conf.d/vpn_limited_tcp_resolver',
       notify  => Service['unbound'],
-      require => Package['unbound'];
-    'add_limited_udp_resolver':
+      require => [ Package['openvpn'], Package['unbound'] ];
+      'add_limited_udp_resolver':
       ensure  => $ensure_limited,
       path    => '/etc/unbound/unbound.conf',
       line    => 'server: include: /etc/unbound/conf.d/vpn_limited_udp_resolver',
       notify  => Service['unbound'],
-      require => Package['unbound']
+      require => [ Package['openvpn'], Package['unbound'] ];
   }
 
 }
-- 
cgit v1.2.3


From 071bd544ed79a07bb2532b7e79318e76062ba49e Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Sat, 12 Oct 2013 01:02:38 +0200
Subject: puppet - openvpn gateway address is hard coded as a /24 network (Bug
 #1863)

---
 puppet/modules/site_openvpn/manifests/init.pp | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'puppet/modules/site_openvpn/manifests')

diff --git a/puppet/modules/site_openvpn/manifests/init.pp b/puppet/modules/site_openvpn/manifests/init.pp
index 61fefd0a..42146741 100644
--- a/puppet/modules/site_openvpn/manifests/init.pp
+++ b/puppet/modules/site_openvpn/manifests/init.pp
@@ -62,6 +62,12 @@ class site_openvpn {
     $openvpn_limited_udp_cidr             = '21'
   }
 
+  # find out the netmask in cidr format of the primary IF
+  # thx to https://blog.kumina.nl/tag/puppet-tips-and-tricks/
+  # we can do this using an inline_template:
+  $factname_primary_netmask = "netmask_cidr_${::site_config::params::interface}"
+  $primary_netmask = inline_template('<%= scope.lookupvar(factname_primary_netmask) %>')
+
   # deploy dh keys
   include site_openvpn::dh_key
 
-- 
cgit v1.2.3


From 222fd1568d7af9ea953a4d6179578da5994ea1fd Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Thu, 20 Mar 2014 13:10:44 -0700
Subject: allow ability to customize openvpn security stuff: tls-cipher, auth,
 and cipher config options.

---
 puppet/modules/site_openvpn/manifests/init.pp      | 33 +++++++++++++---------
 .../site_openvpn/manifests/server_config.pp        |  8 +++---
 2 files changed, 23 insertions(+), 18 deletions(-)

(limited to 'puppet/modules/site_openvpn/manifests')

diff --git a/puppet/modules/site_openvpn/manifests/init.pp b/puppet/modules/site_openvpn/manifests/init.pp
index 42146741..abcac41c 100644
--- a/puppet/modules/site_openvpn/manifests/init.pp
+++ b/puppet/modules/site_openvpn/manifests/init.pp
@@ -27,22 +27,23 @@ class site_openvpn {
 
   Class['site_config::default'] -> Class['site_openvpn']
 
-  $openvpn_config   = hiera('openvpn')
-  $openvpn_ports    = $openvpn_config['ports']
+  $openvpn          = hiera('openvpn')
+  $openvpn_ports    = $openvpn['ports']
+  $openvpn_config   = $openvpn['configuration']
 
   if $::ec2_instance_id {
     $openvpn_gateway_address = $::ipaddress
   } else {
-    $openvpn_gateway_address         = $openvpn_config['gateway_address']
-    if $openvpn_config['second_gateway_address'] {
-      $openvpn_second_gateway_address = $openvpn_config['second_gateway_address']
+    $openvpn_gateway_address         = $openvpn['gateway_address']
+    if $openvpn['second_gateway_address'] {
+      $openvpn_second_gateway_address = $openvpn['second_gateway_address']
     } else {
       $openvpn_second_gateway_address = undef
     }
   }
 
-  $openvpn_allow_unlimited              = $openvpn_config['allow_unlimited']
-  $openvpn_unlimited_prefix             = $openvpn_config['unlimited_prefix']
+  $openvpn_allow_unlimited              = $openvpn['allow_unlimited']
+  $openvpn_unlimited_prefix             = $openvpn['unlimited_prefix']
   $openvpn_unlimited_tcp_network_prefix = '10.41.0'
   $openvpn_unlimited_tcp_netmask        = '255.255.248.0'
   $openvpn_unlimited_tcp_cidr           = '21'
@@ -51,9 +52,9 @@ class site_openvpn {
   $openvpn_unlimited_udp_cidr           = '21'
 
   if !$::ec2_instance_id {
-    $openvpn_allow_limited                = $openvpn_config['allow_limited']
-    $openvpn_limited_prefix               = $openvpn_config['limited_prefix']
-    $openvpn_rate_limit                   = $openvpn_config['rate_limit']
+    $openvpn_allow_limited                = $openvpn['allow_limited']
+    $openvpn_limited_prefix               = $openvpn['limited_prefix']
+    $openvpn_rate_limit                   = $openvpn['rate_limit']
     $openvpn_limited_tcp_network_prefix   = '10.43.0'
     $openvpn_limited_tcp_netmask          = '255.255.248.0'
     $openvpn_limited_tcp_cidr             = '21'
@@ -90,7 +91,8 @@ class site_openvpn {
       tls_remote  => "\"${openvpn_unlimited_prefix}\"",
       server      => "${openvpn_unlimited_tcp_network_prefix}.0 ${openvpn_unlimited_tcp_netmask}",
       push        => "\"dhcp-option DNS ${openvpn_unlimited_tcp_network_prefix}.1\"",
-      management  => '127.0.0.1 1000'
+      management  => '127.0.0.1 1000',
+      config      => $openvpn_config
     }
     site_openvpn::server_config { 'udp_config':
       port        => '1194',
@@ -99,7 +101,8 @@ class site_openvpn {
       tls_remote  => "\"${openvpn_unlimited_prefix}\"",
       server      => "${openvpn_unlimited_udp_network_prefix}.0 ${openvpn_unlimited_udp_netmask}",
       push        => "\"dhcp-option DNS ${openvpn_unlimited_udp_network_prefix}.1\"",
-      management  => '127.0.0.1 1001'
+      management  => '127.0.0.1 1001',
+      config      => $openvpn_config
     }
   } else {
     tidy { '/etc/openvpn/tcp_config.conf': }
@@ -114,7 +117,8 @@ class site_openvpn {
       tls_remote  => "\"${openvpn_limited_prefix}\"",
       server      => "${openvpn_limited_tcp_network_prefix}.0 ${openvpn_limited_tcp_netmask}",
       push        => "\"dhcp-option DNS ${openvpn_limited_tcp_network_prefix}.1\"",
-      management  => '127.0.0.1 1002'
+      management  => '127.0.0.1 1002',
+      config      => $openvpn_config
     }
     site_openvpn::server_config { 'limited_udp_config':
       port        => '1194',
@@ -123,7 +127,8 @@ class site_openvpn {
       tls_remote  => "\"${openvpn_limited_prefix}\"",
       server      => "${openvpn_limited_udp_network_prefix}.0 ${openvpn_limited_udp_netmask}",
       push        => "\"dhcp-option DNS ${openvpn_limited_udp_network_prefix}.1\"",
-      management  => '127.0.0.1 1003'
+      management  => '127.0.0.1 1003',
+      config      => $openvpn_config
     }
   } else {
     tidy { '/etc/openvpn/limited_tcp_config.conf': }
diff --git a/puppet/modules/site_openvpn/manifests/server_config.pp b/puppet/modules/site_openvpn/manifests/server_config.pp
index befeaef7..6246a836 100644
--- a/puppet/modules/site_openvpn/manifests/server_config.pp
+++ b/puppet/modules/site_openvpn/manifests/server_config.pp
@@ -54,7 +54,7 @@
 
 define site_openvpn::server_config(
   $port, $proto, $local, $server, $push,
-  $management, $tls_remote = undef) {
+  $management, $config, $tls_remote = undef) {
 
   $openvpn_configname = $name
 
@@ -96,15 +96,15 @@ define site_openvpn::server_config(
         server  => $openvpn_configname;
     "tls-cipher ${openvpn_configname}":
         key     => 'tls-cipher',
-        value   => 'DHE-RSA-AES128-SHA',
+        value   => $config['tls-cipher'],
         server  => $openvpn_configname;
     "auth ${openvpn_configname}":
         key     => 'auth',
-        value   => 'SHA1',
+        value   => $config['auth'],
         server  => $openvpn_configname;
     "cipher ${openvpn_configname}":
         key     => 'cipher',
-        value   => 'AES-128-CBC',
+        value   => $config['cipher'],
         server  => $openvpn_configname;
     "dev ${openvpn_configname}":
         key    => 'dev',
-- 
cgit v1.2.3


From 1ebece7b07ee721eb888873e47fa512a6a42f807 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Tue, 25 Mar 2014 08:31:20 +0100
Subject:  ignore openvpn TLS initialization errors (Feature #5374)

---
 puppet/modules/site_openvpn/manifests/init.pp | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'puppet/modules/site_openvpn/manifests')

diff --git a/puppet/modules/site_openvpn/manifests/init.pp b/puppet/modules/site_openvpn/manifests/init.pp
index 42146741..4c2a3967 100644
--- a/puppet/modules/site_openvpn/manifests/init.pp
+++ b/puppet/modules/site_openvpn/manifests/init.pp
@@ -213,4 +213,7 @@ class site_openvpn {
       target  => '/etc/default/openvpn',
       order   => 10;
   }
+
+  include site_check_mk::agent::openvpn
+
 }
-- 
cgit v1.2.3


From 4a0feb8fa663c1c73c47f3298c1f303dffd942cc Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Sat, 5 Apr 2014 12:39:01 -0700
Subject: openvpn: allow for configurable keepalive (aka ping & ping-restart)
 closes https://leap.se/code/issues/4127

---
 puppet/modules/site_openvpn/manifests/server_config.pp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'puppet/modules/site_openvpn/manifests')

diff --git a/puppet/modules/site_openvpn/manifests/server_config.pp b/puppet/modules/site_openvpn/manifests/server_config.pp
index 6246a836..b1f4997c 100644
--- a/puppet/modules/site_openvpn/manifests/server_config.pp
+++ b/puppet/modules/site_openvpn/manifests/server_config.pp
@@ -115,7 +115,7 @@ define site_openvpn::server_config(
         server => $openvpn_configname;
     "keepalive ${openvpn_configname}":
         key    => 'keepalive',
-        value  => '5 20',
+        value  => $config['keepalive'],
         server => $openvpn_configname;
     "local ${openvpn_configname}":
         key    => 'local',
-- 
cgit v1.2.3