Proof-of-Concept for proxy TLS support

The code is quite messy, but particularly the argument parsing and
volume-mounting. Also, it doesn't support args with spaces, or
non-absolute file-paths.

test/670_proxy_tls_test.sh

@@ -0,0 +1,18 @@
+#! /bin/bash
+
+. ./config.sh
+
+start_suite "Boot the proxy with TLS-enabled Docker support"
+
+PWD=$($SSH $HOST1 pwd)
+
+weave_on $HOST1 launch
+weave_on $HOST1 launch-proxy \
+  --tls \
+  --tlscacert $PWD/tls/$HOST1.ca.pem \
+  --tlscert   $PWD/tls/$HOST1.server.pem \
+  --tlskey    $PWD/tls/server-key.pem
+
+assert_raises "proxy docker_on $HOST1 --tls --tlscacert ./tls/$HOST1.ca.pem ps"
+
+end_suite

test/setup.sh

@@ -15,3 +15,10 @@ for HOST in $HOSTS; do
     run_on $HOST chmod a+x $DOCKER_NS ./weave
     run_on $HOST sudo service docker restart
 done
+
+echo Setting up Docker TLS on hosts
+(cd ./tls && make)
+chmod 0600 tls/*
+for HOST in $HOSTS; do
+    rsync -az -e "$SSH" ./tls/ $HOST:~/tls/
+done

test/tls/Makefile

@@ -0,0 +1,36 @@
+SERVERS = 192.168.48.11 192.168.48.12
+SERVER_CAS  = $(SERVERS:=.ca.pem)
+SERVER_CSRS = $(SERVERS:=.server.csr)
+SERVER_PEMS = $(SERVERS:=.server.pem)
+CLIENT_PEMS = $(SERVERS:=.client.pem)
+
+.DEFAULT: all
+.PHONY: all clean $(SERVERS)
+
+SHELL=/bin/bash
+
+all: ca-key.pem server-key.pem client-key.pem $(SERVER_CAS) $(SERVER_CSRS) $(SERVER_PEMS) client.csr $(CLIENT_PEMS)
+
+ca-key.pem server-key.pem client-key.pem:
+	openssl genrsa -out $@ 1024
+
+$(SERVER_CAS): ca-key.pem
+	openssl req -subj "/CN=$(@:.ca.pem=)" -new -x509 -days 3650 -key ca-key.pem -sha256 -out $@
+
+$(SERVER_CSRS): server-key.pem
+	openssl req -subj "/CN=$(@:.server.csr=)" -new -key server-key.pem -out $@
+
+$(SERVER_PEMS): %.server.pem: %.server.csr ca-key.pem %.ca.pem
+	openssl x509 -req -days 3650 -in $(@:.pem=.csr) \
+		-CA $(@:.server.pem=.ca.pem) -CAkey ca-key.pem -CAcreateserial -out $@
+
+client.csr: client-key.pem
+	openssl req -subj '/CN=client' -new -key client-key.pem -out $@
+
+$(CLIENT_PEMS): %.client.pem: client.csr ca-key.pem %.ca.pem
+	openssl x509 -req -days 3650 -in client.csr \
+		-CA $(@:.client.pem=.ca.pem) -CAkey ca-key.pem -CAcreateserial \
+		-extfile <(echo "extendedKeyUsage = clientAuth") -out $@
+
+clean:
+	rm -f *.pem *.csr *.srl