From c88472a94c15adef4275242934f2a3eec9778dd4 Mon Sep 17 00:00:00 2001
From: drebs <drebs@leap.se>
Date: Wed, 26 Nov 2014 20:20:52 -0200
Subject: Enforce TLSv1 in soledad server (#6437).

---
 server/pkg/soledad | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'server/pkg')

diff --git a/server/pkg/soledad b/server/pkg/soledad
index 841233d1..62b7c5f8 100644
--- a/server/pkg/soledad
+++ b/server/pkg/soledad
@@ -19,6 +19,7 @@ CERT_PATH=/etc/leap/soledad-server.pem
 PRIVKEY_PATH=/etc/leap/soledad-server.key
 TWISTD_PATH=/usr/bin/twistd
 HOME=/var/lib/soledad/
+SSL_METHOD=TLSv1_METHOD
 
 [ -r /etc/default/soledad ] && . /etc/default/soledad
 
@@ -35,7 +36,7 @@ case "$1" in
             --logfile=$LOGFILE \
             web \
             --wsgi=$OBJ \
-            --port=ssl:$HTTPS_PORT:privateKey=$PRIVKEY_PATH:certKey=$CERT_PATH
+            --port=ssl:${HTTPS_PORT}:privateKey=${PRIVKEY_PATH}:certKey=${CERT_PATH}:sslmethod=${SSL_METHOD}
         echo "."
     ;;
 
-- 
cgit v1.2.3


From 6b6b4af8edc807726341b848165c91ff02e9148b Mon Sep 17 00:00:00 2001
From: drebs <drebs@leap.se>
Date: Wed, 26 Nov 2014 20:23:33 -0200
Subject: Run daemon as user soledad (#6436).

---
 server/pkg/soledad | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

(limited to 'server/pkg')

diff --git a/server/pkg/soledad b/server/pkg/soledad
index 62b7c5f8..7f48e2c8 100644
--- a/server/pkg/soledad
+++ b/server/pkg/soledad
@@ -20,6 +20,8 @@ PRIVKEY_PATH=/etc/leap/soledad-server.key
 TWISTD_PATH=/usr/bin/twistd
 HOME=/var/lib/soledad/
 SSL_METHOD=TLSv1_METHOD
+USER=soledad
+GROUP=soledad
 
 [ -r /etc/default/soledad ] && . /etc/default/soledad
 
@@ -31,7 +33,9 @@ test -r /etc/leap/ || exit 0
 case "$1" in
     start)
         echo -n "Starting soledad: twistd"
-          start-stop-daemon --start --quiet --exec $TWISTD_PATH -- \
+          start-stop-daemon --start --quiet \
+            --user=$USER --group=$GROUP \
+            --exec $TWISTD_PATH -- \
             --pidfile=$PIDFILE \
             --logfile=$LOGFILE \
             web \
-- 
cgit v1.2.3


From 4f7a1e1063199cb91535ab9cd3ca428bca2ced96 Mon Sep 17 00:00:00 2001
From: drebs <drebs@leap.se>
Date: Fri, 28 Nov 2014 09:39:41 -0200
Subject: Enclose server initscript variables in curly brackets.

---
 server/pkg/soledad | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

(limited to 'server/pkg')

diff --git a/server/pkg/soledad b/server/pkg/soledad
index 7f48e2c8..bf24dac2 100644
--- a/server/pkg/soledad
+++ b/server/pkg/soledad
@@ -30,16 +30,16 @@ test -r /etc/leap/ || exit 0
 . /lib/lsb/init-functions
 
 
-case "$1" in
+case "${1}" in
     start)
         echo -n "Starting soledad: twistd"
           start-stop-daemon --start --quiet \
-            --user=$USER --group=$GROUP \
-            --exec $TWISTD_PATH -- \
-            --pidfile=$PIDFILE \
-            --logfile=$LOGFILE \
+            --user=${USER} --group=${GROUP} \
+            --exec ${TWISTD_PATH} -- \
+            --pidfile=${PIDFILE} \
+            --logfile=${LOGFILE} \
             web \
-            --wsgi=$OBJ \
+            --wsgi=${OBJ} \
             --port=ssl:${HTTPS_PORT}:privateKey=${PRIVKEY_PATH}:certKey=${CERT_PATH}:sslmethod=${SSL_METHOD}
         echo "."
     ;;
@@ -47,21 +47,21 @@ case "$1" in
     stop)
         echo -n "Stopping soledad: twistd"
         start-stop-daemon --stop --quiet  \
-            --pidfile $PIDFILE
+            --pidfile ${PIDFILE}
         echo "."
     ;;
 
     restart)
-        $0 stop
-        $0 start
+        ${0} stop
+        ${0} start
     ;;
 
     force-reload)
-        $0 restart
+        ${0} restart
     ;;
 
     status)
-        status_of_proc -p $PIDFILE $TWISTD_PATH soledad && exit 0 || exit $?
+        status_of_proc -p ${PIDFILE} ${TWISTD_PATH} soledad && exit 0 || exit ${?}
     ;;
 
     *)
-- 
cgit v1.2.3


From 6fc80e14d568d83df7899e516d1422b2e011d2cb Mon Sep 17 00:00:00 2001
From: Kali Kaneko <kali@leap.se>
Date: Wed, 3 Dec 2014 00:22:18 +0100
Subject: Use SSL negotiation.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Although the API can be misleading, PROTOCOL_SSLv23 selects the highest
protocol version that both the client and server support. Despite the
name, this option can select “TLS” protocols as well as “SSL”.

In this way, we can use TLSv1.2 (PROTOCOL_TLSv1 will *only* give us TLS
v1.0)

In the client side, we try to disable SSLv2 and SSLv3 options
explicitely.

The python version in wheezy does not offer PROTOCOL_TLSv1_2 nor
OP_NO_SSLv2 or OP_NO_SSLv3 (It's new in 2.7.9)
---
 server/pkg/soledad | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'server/pkg')

diff --git a/server/pkg/soledad b/server/pkg/soledad
index bf24dac2..ccb3e9b0 100644
--- a/server/pkg/soledad
+++ b/server/pkg/soledad
@@ -19,7 +19,7 @@ CERT_PATH=/etc/leap/soledad-server.pem
 PRIVKEY_PATH=/etc/leap/soledad-server.key
 TWISTD_PATH=/usr/bin/twistd
 HOME=/var/lib/soledad/
-SSL_METHOD=TLSv1_METHOD
+SSL_METHOD=SSLv23_METHOD
 USER=soledad
 GROUP=soledad
 
-- 
cgit v1.2.3