[proxy] Add tls support

Caveats:
* TLS files must be present on the target server (and readable)
* TLS file paths cannot contain spaces
* TLS file paths must be absolute (i.e. cannot be relative)
* Bash argument parsing is terrible

test/670_proxy_tls_test.sh

@@ -0,0 +1,18 @@
+#! /bin/bash
+
+. ./config.sh
+
+start_suite "Boot the proxy with TLS-enabled Docker support"
+
+PWD=$($SSH $HOST1 pwd)
+
+weave_on $HOST1 launch
+weave_on $HOST1 launch-proxy \
+  --tlsverify \
+  --tlscacert $PWD/tls/ca.pem \
+  --tlscert   $PWD/tls/$HOST1.pem \
+  --tlskey    $PWD/tls/$HOST1-key.pem
+
+assert_raises "DOCKER_CERT_PATH=./tls proxy docker_on $HOST1 --tlsverify ps"
+
+end_suite

test/setup.sh

@@ -4,7 +4,9 @@ set -e
 
 . ./config.sh
 
-echo Copying weave images and script to hosts
+(cd ./tls && go get ./... && go run generate_certs.go $HOSTS)
+
+echo Copying weave images, scripts, and certificates to hosts
 for HOST in $HOSTS; do
     docker_on $HOST load -i ../weave.tar
     docker_on $HOST load -i ../weavedns.tar
@@ -13,5 +15,6 @@ for HOST in $HOSTS; do
     cat ../bin/docker-ns | run_on $HOST sh -c "cat > $DOCKER_NS"
     cat ../weave | run_on $HOST sh -c "cat > ./weave"
     run_on $HOST chmod a+x $DOCKER_NS ./weave
+    rsync -az -e "$SSH" ./tls/ $HOST:~/tls
     run_on $HOST sudo service docker restart
 done

test/tls/generate_certs.go

@@ -0,0 +1,81 @@
+package main
+
+import (
+	"fmt"
+	"log"
+	"os"
+
+	"github.com/docker/machine/utils"
+)
+
+const (
+	org            = "vagrant"
+	bits           = 2048
+	caKeyPath      = "ca-key.pem"
+	caCertPath     = "ca.pem"
+	clientKeyPath  = "key.pem"
+	clientCertPath = "cert.pem"
+	serverKeyPath  = "server-key.pem"
+	serverCertPath = "server.pem"
+)
+
+func main() {
+	if _, err := os.Stat(caCertPath); os.IsNotExist(err) {
+		log.Printf("Creating CA: %s", caCertPath)
+
+		// check if the key path exists; if so, error
+		if _, err := os.Stat(caKeyPath); err == nil {
+			log.Fatalf("The CA key already exists.  Please remove it or specify a different key/cert.")
+		}
+
+		if err := utils.GenerateCACertificate(caCertPath, caKeyPath, org, bits); err != nil {
+			log.Printf("Error generating CA certificate: %s", err)
+		}
+	}
+
+	if _, err := os.Stat(clientCertPath); os.IsNotExist(err) {
+		log.Printf("Creating client certificate: %s", clientCertPath)
+
+		// check if the key path exists; if so, error
+		if _, err := os.Stat(clientKeyPath); err == nil {
+			log.Fatalf("The client key already exists.  Please remove it or specify a different key/cert.")
+		}
+
+		err = utils.GenerateCert(
+			[]string{""},
+			clientCertPath,
+			clientKeyPath,
+			caCertPath,
+			caKeyPath,
+			org,
+			bits,
+		)
+		if err != nil {
+			log.Fatalf("Error generating client certificate: %s", err)
+		}
+	}
+
+	if len(os.Args) <= 1 {
+		return
+	}
+	for _, ip := range os.Args[1:] {
+		serverKeyPath := fmt.Sprintf("%s-key.pem", ip)
+		serverCertPath := fmt.Sprintf("%s.pem", ip)
+
+		if _, err := os.Stat(serverCertPath); os.IsNotExist(err) {
+			log.Printf("Creating server certificate: %s", serverCertPath)
+			err = utils.GenerateCert(
+				[]string{ip},
+				serverCertPath,
+				serverKeyPath,
+				caCertPath,
+				caKeyPath,
+				org,
+				bits,
+			)
+			if err != nil {
+				log.Fatalf("error generating server cert: %s", err)
+			}
+		}
+	}
+}