From 937c61b74bbd99f9955cbee426fb35e96050eea6 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Mon, 27 Oct 2014 09:23:23 -0400
Subject: Change stunnel default sslversion to be TLSv1, instead of the default
 SSLv3 (#6261)

Change-Id: I7ab5a6455e434f8359169d31febed8b92f84bbcc
---
 puppet/modules/site_stunnel/manifests/client.pp | 1 +
 1 file changed, 1 insertion(+)

(limited to 'puppet/modules/site_stunnel/manifests')

diff --git a/puppet/modules/site_stunnel/manifests/client.pp b/puppet/modules/site_stunnel/manifests/client.pp
index 12d664b4..76815174 100644
--- a/puppet/modules/site_stunnel/manifests/client.pp
+++ b/puppet/modules/site_stunnel/manifests/client.pp
@@ -35,6 +35,7 @@ define site_stunnel::client (
     pid        => "/var/run/stunnel4/${pid}.pid",
     rndfile    => $rndfile,
     debuglevel => $debuglevel,
+    sslversion => 'TLSv1',
     subscribe  => [
       Class['Site_config::X509::Key'],
       Class['Site_config::X509::Cert'],
-- 
cgit v1.2.3


From 38d7c80fae4efc1d365ec9f982cb025dc67a4386 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Sun, 2 Nov 2014 20:53:34 -0500
Subject: add missing TLSv1 sslversion parameter to site_stunnel::serviers

Change-Id: I48dc8135943393bd11c7181853985f4a5799011e
---
 puppet/modules/site_stunnel/manifests/servers.pp | 1 +
 1 file changed, 1 insertion(+)

(limited to 'puppet/modules/site_stunnel/manifests')

diff --git a/puppet/modules/site_stunnel/manifests/servers.pp b/puppet/modules/site_stunnel/manifests/servers.pp
index b1da5c59..8d537644 100644
--- a/puppet/modules/site_stunnel/manifests/servers.pp
+++ b/puppet/modules/site_stunnel/manifests/servers.pp
@@ -35,6 +35,7 @@ define site_stunnel::servers (
     pid        => "/var/run/stunnel4/${pid}.pid",
     rndfile    => '/var/lib/stunnel4/.rnd',
     debuglevel => $debuglevel,
+    sslversion => 'TLSv1',
     require    => [
       Class['Site_config::X509::Key'],
       Class['Site_config::X509::Cert'],
-- 
cgit v1.2.3


From 896dd69710fa24a0235fc70081a71f35adbf9af1 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Thu, 20 Nov 2014 15:22:09 -0500
Subject: Make sure that stunnel restarts when cert/key change (#6181)

Change-Id: I5085247a87018e18e73833119ac73225afbfea1e
---
 puppet/modules/site_stunnel/manifests/client.pp           |  6 +-----
 puppet/modules/site_stunnel/manifests/init.pp             |  2 ++
 puppet/modules/site_stunnel/manifests/override_service.pp | 13 +++++++++++++
 puppet/modules/site_stunnel/manifests/servers.pp          |  6 +-----
 4 files changed, 17 insertions(+), 10 deletions(-)
 create mode 100644 puppet/modules/site_stunnel/manifests/override_service.pp

(limited to 'puppet/modules/site_stunnel/manifests')

diff --git a/puppet/modules/site_stunnel/manifests/client.pp b/puppet/modules/site_stunnel/manifests/client.pp
index 76815174..3b10ecb8 100644
--- a/puppet/modules/site_stunnel/manifests/client.pp
+++ b/puppet/modules/site_stunnel/manifests/client.pp
@@ -35,11 +35,7 @@ define site_stunnel::client (
     pid        => "/var/run/stunnel4/${pid}.pid",
     rndfile    => $rndfile,
     debuglevel => $debuglevel,
-    sslversion => 'TLSv1',
-    subscribe  => [
-      Class['Site_config::X509::Key'],
-      Class['Site_config::X509::Cert'],
-      Class['Site_config::X509::Ca'] ];
+    sslversion => 'TLSv1';
   }
 
   site_shorewall::stunnel::client { $name:
diff --git a/puppet/modules/site_stunnel/manifests/init.pp b/puppet/modules/site_stunnel/manifests/init.pp
index b292f1cd..2e0cf5b8 100644
--- a/puppet/modules/site_stunnel/manifests/init.pp
+++ b/puppet/modules/site_stunnel/manifests/init.pp
@@ -28,5 +28,7 @@ class site_stunnel {
   $clients = $stunnel['clients']
   $client_sections = keys($clients)
   site_stunnel::clients { $client_sections: }
+
+  include site_stunnel::override_service
 }
 
diff --git a/puppet/modules/site_stunnel/manifests/override_service.pp b/puppet/modules/site_stunnel/manifests/override_service.pp
new file mode 100644
index 00000000..96187048
--- /dev/null
+++ b/puppet/modules/site_stunnel/manifests/override_service.pp
@@ -0,0 +1,13 @@
+class site_stunnel::override_service inherits stunnel::debian {
+
+  include site_config::x509::cert
+  include site_config::x509::key
+  include site_config::x509::ca
+
+  Service[stunnel] {
+    subscribe => [
+                  Class['Site_config::X509::Key'],
+                  Class['Site_config::X509::Cert'],
+                  Class['Site_config::X509::Ca'] ]
+  }
+}
diff --git a/puppet/modules/site_stunnel/manifests/servers.pp b/puppet/modules/site_stunnel/manifests/servers.pp
index 8d537644..b6fac319 100644
--- a/puppet/modules/site_stunnel/manifests/servers.pp
+++ b/puppet/modules/site_stunnel/manifests/servers.pp
@@ -35,11 +35,7 @@ define site_stunnel::servers (
     pid        => "/var/run/stunnel4/${pid}.pid",
     rndfile    => '/var/lib/stunnel4/.rnd',
     debuglevel => $debuglevel,
-    sslversion => 'TLSv1',
-    require    => [
-      Class['Site_config::X509::Key'],
-      Class['Site_config::X509::Cert'],
-      Class['Site_config::X509::Ca'] ];
+    sslversion => 'TLSv1';
   }
 
   # allow incoming connections on $accept_port
-- 
cgit v1.2.3