From 2d0fd75ed81ee19e7dc1f1236a8cfd918ceb40af Mon Sep 17 00:00:00 2001
From: Bertrand Gouny <bgouny@hi-media.com>
Date: Mon, 5 May 2014 11:24:54 +0200
Subject: [PATCH]  TLS

---
 Dockerfile           |  4 +---
 config/auto/tls.ldif | 11 +++++-----
 config/logging.ldif  |  2 +-
 slapd.sh             | 52 ++++++++++++++++++++++++++++----------------
 4 files changed, 41 insertions(+), 28 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index bbd9723..d62e624 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -22,14 +22,12 @@ CMD ["/sbin/my_init"]
 RUN apt-get -y update
 
 # Install openldap (slapd) and ldap-utils
-RUN LC_ALL=C DEBIAN_FRONTEND=noninteractive apt-get install -y slapd ldap-utils
+RUN LC_ALL=C DEBIAN_FRONTEND=noninteractive apt-get install -y slapd ldap-utils openssl
 
 # Expose ldap default port
 EXPOSE 389
 
 # Create TSL certificats directory
-# /!\ If used the deamon must be lauch with a hostname matching the certificat common mame
-# add -h my.hostname.com to the run command
 RUN mkdir /etc/ldap/ssl
 
 # Add config directory 
diff --git a/config/auto/tls.ldif b/config/auto/tls.ldif
index 90178dd..55fb4ef 100644
--- a/config/auto/tls.ldif
+++ b/config/auto/tls.ldif
@@ -1,16 +1,17 @@
 dn: cn=config
-add: olcTLSCACertificateFile
+changetype: modify
+replace: olcTLSCACertificateFile
 olcTLSCACertificateFile: /etc/ldap/ssl/ca.crt
 -
-add: olcTLSCertificateFile
+replace: olcTLSCertificateFile
 olcTLSCertificateFile: /etc/ldap/ssl/ldap.crt
 -
-add: olcTLSCertificateKeyFile
+replace: olcTLSCertificateKeyFile
 olcTLSCertificateKeyFile: /etc/ldap/ssl/ldap.key
 -
-add: olcTLSDHParamFile
+replace: olcTLSDHParamFile
 olcTLSDHParamFile: /etc/ldap/ssl/dhparam.pem
 -
-add: olcTLSVerifyClient
+replace: olcTLSVerifyClient
 olcTLSVerifyClient: never
 
diff --git a/config/logging.ldif b/config/logging.ldif
index bab9364..5494c10 100644
--- a/config/logging.ldif
+++ b/config/logging.ldif
@@ -1,4 +1,4 @@
 dn: cn=config
 changetype: modify
-add: olcLogLevel
+replace: olcLogLevel
 olcLogLevel: stats
diff --git a/slapd.sh b/slapd.sh
index 07781f1..4c2fce3 100755
--- a/slapd.sh
+++ b/slapd.sh
@@ -11,6 +11,7 @@ set -x
 : LDAP_DOMAIN=${LDAP_DOMAIN}
 : LDAP_ORGANISATION=${LDAP_ORGANISATION}
 
+############ Base config ############
 if [ ! -e /var/lib/ldap/docker_bootstrapped ]; then
   status "configuring slapd for first run"
 
@@ -31,25 +32,6 @@ slapd slapd/dump_database select when needed
 EOF
 
   dpkg-reconfigure -f noninteractive slapd
-  chown -R openldap:openldap /etc/ldap
-
-  # Lauch slapd deamon
-  slapd -h "ldap:///" -u openldap -g openldap
-
-  if [ -e /etc/ldap/ssl/ldap.crt ] && [ -e /etc/ldap/ssl/ldap.key ] && [ -e /etc/ldap/ssl/ca.crt ]; then
-    status "certificates found"
-
-    chmod 600 /etc/ldap/ssl/ldap.key
-
-    # create DHParamFile if not found
-    [ -f /etc/ldap/ssl/dhparam.pem ] || openssl dhparam -out /etc/ldap/ssl/dhparam.pem 2048
-
-    ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ldap/config/auto/tls.ldif 
-
-  fi
-
-  # kill slapd deamon
-  pkill -f slapd
 
   touch /var/lib/ldap/docker_bootstrapped
 
@@ -57,6 +39,38 @@ else
   status "found already-configured slapd"
 fi
 
+############ Dynamic config ############
+slapd -h "ldap:/// ldapi:///" -u openldap -g openldap
+chown -R openldap:openldap /etc/ldap
+
+# TLS
+if [ -e /etc/ldap/ssl/ldap.crt ] && [ -e /etc/ldap/ssl/ldap.key ] && [ -e /etc/ldap/ssl/ca.crt ]; then
+  status "certificates found"
+
+  chmod 600 /etc/ldap/ssl/ldap.key
+
+  # create DHParamFile if not found
+  [ -f /etc/ldap/ssl/dhparam.pem ] || openssl dhparam -out /etc/ldap/ssl/dhparam.pem 2048
+
+  ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ldap/config/auto/tls_add.ldif 
+
+  # add fake dnsmasq route to certificate cn
+  cn=$(openssl x509 -in /etc/ldap/ssl/ldap.crt -subject -noout | sed -n 's/.*CN=\(.*\).\^*/\1/p')
+  echo "127.0.0.1	" $cn >> /etc/dhosts
+
+fi
+
+# Replication
+# todo
+
+# Other config files
+for f in $(find /etc/ldap/config -maxdepth 1 -name \*.ldif -type f); do
+  status "Processing file ${f}"
+  ldapmodify -Y EXTERNAL -H ldapi:/// -f $f
+done
+
+pkill slapd
+
 status "starting slapd on default port 389"
 set -x
 exec /usr/sbin/slapd -h "ldap:///" -u openldap -g openldap -d -1