From 97b23327ec2da81c279c4f3995327956409e4b17 Mon Sep 17 00:00:00 2001
From: Silvio Rhatto <rhatto@riseup.net>
Date: Fri, 1 Nov 2013 14:33:19 -0200
Subject: Initial ecdhforce support

---
 files/init.d/mumble-server.Debian | 18 +++++++++-------
 manifests/ecdhforce.pp            | 43 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 54 insertions(+), 7 deletions(-)
 create mode 100644 manifests/ecdhforce.pp

diff --git a/files/init.d/mumble-server.Debian b/files/init.d/mumble-server.Debian
index e7771e3..61b6808 100755
--- a/files/init.d/mumble-server.Debian
+++ b/files/init.d/mumble-server.Debian
@@ -28,6 +28,10 @@ MURMUR_DAEMON_START=0
 MURMUR_USE_CAPABILITIES=0
 MURMUR_LIMIT_NOFILE=0
 
+# ECDHE Perfect Forward Secrecy on the Murmur server via an LD_PRELOAD
+# https://github.com/ultramancool/ecdhforce
+STARTSTOP="LD_PRELOAD=/var/lib/mumble-server/ecdhforce/ecdhforce.so start-stop-daemon"
+
 # Include murmur defaults if available
 if [ -f /etc/default/$NAME ] ; then
 	. /etc/default/$NAME
@@ -49,13 +53,13 @@ case "$1" in
   	[ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME"
 	[ -d $PIDDIR ] || install -o $USER -d $PIDDIR
 	if [ "$MURMUR_USE_CAPABILITIES" != "1" ] ; then
-	  start-stop-daemon --start --quiet \
+	  $STARTSTOP --start --quiet \
 		--pidfile $PIDFILE \
 		--chuid $USER:$GROUP \
 		--exec $DAEMON \
 		-- $DAEMON_OPTS
 	else
-	  start-stop-daemon --start --quiet \
+	  $STARTSTOP --start --quiet \
 		--pidfile $PIDFILE \
 		--exec $DAEMON \
 		-- $DAEMON_OPTS
@@ -67,7 +71,7 @@ case "$1" in
 	;;
   stop)
   	[ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"
-	start-stop-daemon --stop --quiet \
+	$STARTSTOP --stop --quiet \
 		--retry=TERM/30/KILL/5 \
 		--pidfile $PIDFILE \
 		--user $USER \
@@ -80,7 +84,7 @@ case "$1" in
 	esac
 	;;
   force-reload)
-	start-stop-daemon --stop --test --quiet \
+	$STARTSTOP --stop --test --quiet \
 		--pidfile $PIDFILE \
 		--user $USER \
 		--exec $DAEMON \
@@ -88,7 +92,7 @@ case "$1" in
 	;;
   restart)
  	[ "$VERBOSE" != no ] && log_daemon_msg "Restarting $DESC" "$NAME"
-	start-stop-daemon --stop --quiet \
+	$STARTSTOP --stop --quiet \
 		--retry=TERM/30/KILL/5 \
 		--pidfile $PIDFILE \
 		--user $USER \
@@ -98,13 +102,13 @@ case "$1" in
 		  	[ -d $PIDDIR ] || install -o $USER -d $PIDDIR
 			rm -f $PIDFILE
 			if [ "$MURMUR_USE_CAPABILITIES" != "1" ] ; then
-			  start-stop-daemon --start --quiet \
+			  $STARTSTOP --start --quiet \
 				--pidfile $PIDFILE \
 				--chuid $USER:$GROUP \
 				--exec $DAEMON \
 				-- $DAEMON_OPTS
 			else
-			  start-stop-daemon --start --quiet \
+			  $STARTSTOP --start --quiet \
 				--pidfile $PIDFILE \
 				--exec $DAEMON \
 				-- $DAEMON_OPTS
diff --git a/manifests/ecdhforce.pp b/manifests/ecdhforce.pp
new file mode 100644
index 0000000..bdbd4c9
--- /dev/null
+++ b/manifests/ecdhforce.pp
@@ -0,0 +1,43 @@
+class mumble::ecdhforce {
+  vcsrepo { "/var/lib/mumble-server/ecdhforce":
+    ensure   => present,
+    provider => git,
+    source   => 'https://github.com/ultramancool/ecdhforce.git',
+    revision => '7b0d6564c21a1bc619307258b773da547842ebca',
+    owner    => root,
+    group    => mumble-server,
+    require  => Package[ 'mumble-server' ],
+  }
+
+  package { [ 'gcc', 'libssl-dev' ]:
+    ensure => present,
+  }
+
+  exec { 'ecdhforce-compile':
+    cwd     => '/var/lib/mumble-server/ecdhforce',
+    command => 'gcc -Wall -fPIC -DPIC -c ecdhforce.c',
+    require => [ Vcsrepo['/var/lib/mumble-server/ecdhforce'], Package['gcc'], Package['libssl-dev'] ],
+    creates => '/var/lib/mumble-server/ecdhforce/ecdhforce.o',
+    user    => root,
+    group   => root,
+  }
+
+  exec { 'ecdhforce-link':
+    cwd     => '/var/lib/mumble-server/ecdhforce',
+    command => 'ld -shared -o ecdhforce.so ecdhforce.o -ldl',
+    require => Exec['ecdhforce-compile'],
+    creates => '/var/lib/mumble-server/ecdhforce/ecdhforce.so',
+    user    => root,
+    group   => root,
+  }
+
+  file { '/etc/init.d/mumble-server':
+    ensure  => present,
+    owner   => root,
+    group   => root,
+    mode    => 0755,
+    source  => "puppet:///modules/mumble/init.d/mumble-server.${::operatingsystem}",
+    require => Exec['ecdhforce-link'],
+    notify  => Service['mumble-server'],
+  }
+}
-- 
cgit v1.2.3