merge

Dockerfile

@@ -1,42 +1,59 @@
-FROM osixia-baseimage
-MAINTAINER Bertrand Gouny <bertrand.gouny@osixia.fr>
+FROM osixia/baseimage:0.10.0
+MAINTAINER Bertrand Gouny <bertrand.gouny@osixia.net>
 
 # From Nick Stenning's work
 # https://github.com/nickstenning/docker-slapd
 
 # Default configuration: can be overridden at the docker command line
+ENV DOMAIN_NAME ldap.example.com
+ENV LDAP_DOMAIN example.com
 ENV LDAP_ADMIN_PWD toor
 ENV LDAP_ORGANISATION Example Inc.
-ENV LDAP_DOMAIN example.com
 
-# /!\ To store the data outside the container, mount /var/lib/ldap as a data volume
-# add -v /some/host/directory:/var/lib/ldap to the run command
+ENV WITH_MMC_AGENT false
+ENV MMC_AGENT_LOGIN mmc-docker
+ENV MMC_AGENT_PASSWORD passw0rd
+
+# /!\ To store the data outside the container, 
+# mount /var/lib/ldap and /etc/ldap/slapd.d as a data volume add
+# -v /some/host/directory:/var/lib/ldap and -v /some/other/host/directory:/etc/ldap/slapd.d
+# to the run command
+
+VOLUME ["/var/lib/ldap", "/etc/ldap/slapd.d"]
 
 # Disable SSH
-RUN rm -rf /etc/service/sshd /etc/my_init.d/00_regen_ssh_host_keys.sh
+# RUN rm -rf /etc/service/sshd /etc/my_init.d/00_regen_ssh_host_keys.sh
+
+# Enable dnsmasq
+RUN /sbin/enable-service dnsmasq ca-authority
 
 # Use baseimage-docker's init system.
 CMD ["/sbin/my_init"]
 
+# Add Mandriva MDS repository
+RUN echo "deb http://mds.mandriva.org/pub/mds/debian wheezy main" >> /etc/apt/sources.list
+
 # Resynchronize the package index files from their sources
 RUN apt-get -y update
 
 # Install openldap (slapd) and ldap-utils
-RUN LC_ALL=C DEBIAN_FRONTEND=noninteractive apt-get install -y slapd ldap-utils openssl
+RUN LC_ALL=C DEBIAN_FRONTEND=noninteractive apt-get install -y --force-yes --no-install-recommends slapd ldap-utils  mmc-agent python-mmc-mail
 
-# Expose ldap default port
-EXPOSE 389
+# Expose ldap and mmc-agent default ports
+EXPOSE 389 7080
 
-# Create TSL certificats directory
+# Create TLS certificats directory
 RUN mkdir /etc/ldap/ssl
 
 # Add config directory 
-RUN mkdir /etc/ldap/config
-ADD config /etc/ldap/config
+ADD service/slapd/assets/config /etc/ldap/config
+ADD service/mmc-agent/assets /etc/mmc/agent/assets
 
 # Add slapd deamon
-RUN mkdir /etc/service/slapd
-ADD slapd.sh /etc/service/slapd/run
+ADD service/slapd/slapd.sh /etc/service/slapd/run
+
+# Add mmc-agent deamon
+ADD service/mmc-agent/mmc-agent.sh /etc/service/mmc-agent/run
 
 # Clear out the local repository of retrieved package files
 RUN apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*

LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2014 Osixia
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

Makefile

@@ -0,0 +1,22 @@
+NAME = osixia/openldap
+VERSION = 0.9.2
+
+.PHONY: all build test tag_latest release
+
+all: build
+
+build:
+	docker build -t $(NAME):$(VERSION) --rm .
+
+test:
+	env NAME=$(NAME) VERSION=$(VERSION) ./test.sh debug
+
+tag_latest:
+	docker tag $(NAME):$(VERSION) $(NAME):latest
+
+release: build test tag_latest
+	@if ! docker images $(NAME) | awk '{ print $$2 }' | grep -q -F $(VERSION); then echo "$(NAME) version $(VERSION) is not yet built. Please run 'make build'"; false; fi
+	@if ! head -n 1 CHANGELOG.md | grep -q 'release date'; then echo 'Please note the release date in Changelog.md.' && false; fi
+	docker push $(NAME)
+	@echo "*** Don't forget to run 'twgit release/hotfix finish' :)"
+

README.md

@@ -1,4 +1,33 @@
-## docker-openldap
+# docker-openldap
 
 Fork of Nick Stenning docker-slapd :
 https://github.com/nickstenning/docker-slapd
+
+Add support of tls.
+
+### How to use tls
+
+Add `-v some/host/dir:/etc/ldap/ssl` and `--dns=127.0.0.1` to the run command.
+
+`some/host/dir` must contain a least 3 files :
+- `ca.crt` certificate authority certificate
+- `ldap.crt` ldap server certificate
+- `ldap.key` ldap server certificate private key
+
+and optionaly `dhparam.pem` this file is genereted automaticaly if not present.
+
+`--dns=127.0.0.1` allow to use the certificate cn correctly.
+
+
+### Example
+
+    docker run --dns=127.0.0.1 \
+               -v /data/ldap/db:/var/lib/ldap \
+               -v /data/ldap/config:/etc/ldap/slapd.d \
+               -v /data/ldap/ssl/:/etc/ldap/ssl \
+               -v /data/ldap/log/:/var/log \
+               -e LDAP_DOMAIN=example.com \
+               -e LDAP_ORGANISATION="Example Corp." \
+               -e LDAP_ROOTPASS=toor \
+               -p 389:389 -d osixia/openldap
+

service/mmc-agent/assets/append_to_mail.ini

@@ -0,0 +1,3 @@
+[userdefault] 
+mailbox = /home/vmail/%uid%/ 
+mailuserquota = 204800

service/mmc-agent/assets/convert_to_ldif

@@ -0,0 +1,6 @@
+include /etc/ldap/schema/core.schema
+include /etc/ldap/schema/cosine.schema
+include /etc/ldap/schema/nis.schema
+include /etc/ldap/schema/inetorgperson.schema
+include /usr/share/doc/mmc/contrib/base/mmc.schema
+include /usr/share/doc/mmc/contrib/mail/mail.schema

service/mmc-agent/mmc-agent.sh

@@ -0,0 +1,94 @@
+#!/bin/sh
+
+# -e Exit immediately if a command exits with a non-zero status
+set -e
+
+WITH_MMC_AGENT=${WITH_MMC_AGENT}
+
+# Run mmc-agent
+if [ "$WITH_MMC_AGENT" = true ]; then
+
+  # Openldap is configured
+  if [ -e /etc/ldap/slapd.d/docker_bootstrapped ]; then
+
+    # mmc-agent is not already configured
+    if [ ! -e /etc/mmc/agent/docker_bootstrapped ]; then
+      status "configuring mmc-agent for first run"
+
+       status () {
+        echo "---> ${@}" >&2
+      }
+
+      getBaseDn () {
+        IFS="."
+        export IFS
+
+        domain=$1
+        init=1
+
+        for s in $domain; do
+          dc="dc=$s"
+          if [ "$init" -eq 1 ]; then
+            baseDn=$dc
+            init=0
+        else
+            baseDn="$baseDn,$dc" 
+          fi
+        done
+      }
+
+      DOMAIN_NAME=${DOMAIN_NAME}
+      WITH_MMC_AGENT=${WITH_MMC_AGENT}
+      LDAP_DOMAIN=${LDAP_DOMAIN}
+      LDAP_ADMIN_PWD=${LDAP_ADMIN_PWD}
+      MMC_AGENT_LOGIN=${MMC_AGENT_LOGIN}
+      MMC_AGENT_PASSWORD=${MMC_AGENT_PASSWORD}
+
+      # mmc-agent config
+      sed -i -e "s/127.0.0.1/0.0.0.0/" /etc/mmc/agent/config.ini #listen on docker default network
+      sed -i -e "s/login = mmc/login = $MMC_AGENT_LOGIN/" /etc/mmc/agent/config.ini
+      sed -i -e "s/password = s3cr3t/password = $MMC_AGENT_PASSWORD/" /etc/mmc/agent/config.ini
+
+      # generate ssl certificate
+      rm /etc/mmc/agent/keys/cacert.pem /etc/mmc/agent/keys/localcert.pem
+      /sbin/ssl-create-cert mmc /etc/mmc/agent/keys/cacert.pem /etc/mmc/agent/keys/localcert.pem
+
+      # Get base dn from ldap domain
+      getBaseDn ${LDAP_DOMAIN}
+
+      sed -i -e "s/dc=mandriva, dc=com/$baseDn/" /etc/mmc/plugins/base.ini
+      sed -i -e "s/password = secret/password = $LDAP_ADMIN_PWD/" /etc/mmc/plugins/base.ini
+
+      mkdir /home/archives
+
+      # Mail plugin
+
+      sed -i -e 's/vDomainSupport = 0/vDomainSupport = 1/g' /etc/mmc/plugins/mail.ini
+      sed -i -e 's/vAliasesSupport = 0/vAliasesSupport = 1/g' /etc/mmc/plugins/mail.ini
+      cat /etc/mmc/agent/assets/append_to_mail.ini >> /etc/mmc/plugins/mail.ini
+
+      touch /etc/mmc/agent/docker_bootstrapped
+    else
+      status "found already-configured mmc-agent"
+    fi
+
+    # Run mmc-agent
+    exec /usr/sbin/mmc-agent -d
+
+  # wait openldap config done
+  else
+    sleep 3s
+  fi
+
+# Do nothing but needed for runit
+else 
+  sleep 1d
+fi
+
+
+
+
+
+
+
+

service/slapd/assets/config/modify/auto/tls.ldif

@@ -1,5 +1,8 @@
 dn: cn=config
 changetype: modify
+add: olcTLSCipherSuite
+olcTLSCipherSuite: SECURE256:-VERS-SSL3.0
+-
 replace: olcTLSCACertificateFile
 olcTLSCACertificateFile: /etc/ldap/ssl/ca.crt
 -

service/slapd/slapd.sh

@@ -0,0 +1,129 @@
+#!/bin/sh
+
+set -eu
+
+status () {
+  echo "---> ${@}" >&2
+}
+
+
+set -x
+: LDAP_ADMIN_PWD=${LDAP_ADMIN_PWD}
+: LDAP_DOMAIN=${LDAP_DOMAIN}
+: LDAP_ORGANISATION=${LDAP_ORGANISATION}
+: DOMAIN_NAME=${DOMAIN_NAME}
+
+
+############ Base config ############
+if [ ! -e /var/lib/ldap/docker_bootstrapped ]; then
+  status "configuring slapd database"
+
+  cat <<EOF | debconf-set-selections
+slapd slapd/internal/generated_adminpw password ${LDAP_ADMIN_PWD}
+slapd slapd/internal/adminpw password ${LDAP_ADMIN_PWD}
+slapd slapd/password2 password ${LDAP_ADMIN_PWD}
+slapd slapd/password1 password ${LDAP_ADMIN_PWD}
+slapd slapd/dump_database_destdir string /var/backups/slapd-VERSION
+slapd slapd/domain string ${LDAP_DOMAIN}
+slapd shared/organization string ${LDAP_ORGANISATION}
+slapd slapd/backend string HDB
+slapd slapd/purge_database boolean true
+slapd slapd/move_old_database boolean true
+slapd slapd/allow_ldap_v2 boolean false
+slapd slapd/no_configuration boolean false
+slapd slapd/dump_database select when needed
+EOF
+
+  dpkg-reconfigure -f noninteractive slapd
+
+  # Enable access only from docker default network and localhost
+  echo "slapd: 172.17.0.0/255.255.0.0 127.0.0.1 : ALLOW" >> /etc/hosts.allow
+  echo "slapd: ALL : DENY" >> /etc/hosts.allow
+
+  touch /var/lib/ldap/docker_bootstrapped
+
+else
+  status "slapd database found"
+fi
+
+
+############ Custom config ############
+if [ ! -e /etc/ldap/slapd.d/docker_bootstrapped ]; then
+  status "Custom config"
+
+  slapd -h "ldapi:///" -u openldap -g openldap 
+  chown -R openldap:openldap /etc/ldap 
+
+  if [ "$WITH_MMC_AGENT" = true ]; then
+
+    # Convert needed mmc ldap schema to ldif
+    mkdir -p /etc/ldap/schema/converted
+    slaptest -f /etc/mmc/agent/assets/convert_to_ldif -F /etc/ldap/schema/converted
+
+    sed -i -e 's/^dn:.*$/dn: cn=mmc,cn=schema,cn=config/; s/^cn:.*$/cn: mmc/; /^structuralObjectClass:.*$/d; /^entryUUID:.*$/d; /^creatorsName:.*$/d; /^createTimestamp:.*$/d; /^entryCSN:.*$/d; /^modifiersName:.*$/d; /^modifyTimestamp:.*$/d' /etc/ldap/schema/converted/cn\=config/cn\=schema/cn=\{4\}mmc.ldif
+  
+    sed -i -e 's/^dn:.*$/dn: cn=mail,cn=schema,cn=config/; s/^cn:.*$/cn: mail/; /^structuralObjectClass:.*$/d; /^entryUUID:.*$/d; /^creatorsName:.*$/d; /^createTimestamp:.*$/d; /^entryCSN:.*$/d; /^modifiersName:.*$/d; /^modifyTimestamp:.*$/d' /etc/ldap/schema/converted/cn\=config/cn\=schema/cn=\{5\}mail.ldif
+
+    ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/converted/cn\=config/cn\=schema/cn=\{4\}mmc.ldif -Q 
+    ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/converted/cn\=config/cn\=schema/cn=\{5\}mail.ldif -Q 
+
+  fi
+
+  # TLS
+  if [ -e /etc/ldap/ssl/ldap.crt ] && [ -e /etc/ldap/ssl/ldap.key ] && [ -e /etc/ldap/ssl/ca.crt ]; then
+    status "certificates found"
+
+  else
+
+    # generate default tls certificate
+    export SSL_SLAPD_COMMON_NAME="$DOMAIN_NAME"
+    export SSL_SLAPD_ORGANIZATION="${LDAP_ORGANISATION}"
+
+    /sbin/ssl-gnutls-create-signed-cert slapd /etc/ldap/ssl/ldap.crt /etc/ldap/ssl/ldap.key
+    ln -s /etc/ssl/certs/docker_baseimage_gnutls_cacert.pem /etc/ldap/ssl/ca.crt
+
+  fi
+
+  # Fix permission on certificates
+  chown openldap:openldap -R /etc/ldap/ssl
+  chmod 600 /etc/ldap/ssl/ldap.key
+
+  # ldap client config
+  sed -i 's,TLS_CACERT.*,TLS_CACERT /etc/ldap/ssl/ca.crt,g' /etc/ldap/ldap.conf
+ 
+  # create DHParamFile if not found
+  [ -f /etc/ldap/ssl/dhparam.pem ] || openssl dhparam -out /etc/ldap/ssl/dhparam.pem 2048
+
+  ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ldap/config/modify/auto/tls.ldif -Q 
+
+  # add fake dnsmasq route to certificate cn
+  cn=$(openssl x509 -in /etc/ldap/ssl/ldap.crt -subject -noout | sed -n 's/.*CN=\(.*\)\/*\(.*\)/\1/p')
+  /sbin/dns-add-host 127.0.0.1 $cn
+
+  # Replication
+  # todo :)
+
+  # Add config
+  for f in $(find /etc/ldap/config/add -maxdepth 1 -name \*.ldif -type f); do
+    status "Processing file ${f}"
+    ldapadd -Y EXTERNAL -H ldapi:/// -f $f -Q 
+  done
+
+  # Modify config 
+  for f in $(find /etc/ldap/config/modify -maxdepth 1 -name \*.ldif -type f); do
+    status "Processing file ${f}"
+    ldapmodify -Y EXTERNAL -H ldapi:/// -f $f -Q 
+  done
+
+  kill -INT `cat /run/slapd/slapd.pid`
+
+  touch /etc/ldap/slapd.d/docker_bootstrapped
+
+else
+  status "found already-configured slapd"
+fi
+
+status "starting slapd on default port 389"
+set -x
+
+exec /usr/sbin/slapd -h "ldap:///" -u openldap -g openldap -d -1

slapd.sh

@@ -1,76 +0,0 @@
-#!/bin/sh
-
-set -eu
-
-status () {
-  echo "---> ${@}" >&2
-}
-
-set -x
-: LDAP_ADMIN_PWD=${LDAP_ADMIN_PWD}
-: LDAP_DOMAIN=${LDAP_DOMAIN}
-: LDAP_ORGANISATION=${LDAP_ORGANISATION}
-
-############ Base config ############
-if [ ! -e /var/lib/ldap/docker_bootstrapped ]; then
-  status "configuring slapd for first run"
-
-  cat <<EOF | debconf-set-selections
-slapd slapd/internal/generated_adminpw password ${LDAP_ADMIN_PWD}
-slapd slapd/internal/adminpw password ${LDAP_ADMIN_PWD}
-slapd slapd/password2 password ${LDAP_ADMIN_PWD}
-slapd slapd/password1 password ${LDAP_ADMIN_PWD}
-slapd slapd/dump_database_destdir string /var/backups/slapd-VERSION
-slapd slapd/domain string ${LDAP_DOMAIN}
-slapd shared/organization string ${LDAP_ORGANISATION}
-slapd slapd/backend string HDB
-slapd slapd/purge_database boolean true
-slapd slapd/move_old_database boolean true
-slapd slapd/allow_ldap_v2 boolean false
-slapd slapd/no_configuration boolean false
-slapd slapd/dump_database select when needed
-EOF
-
-  dpkg-reconfigure -f noninteractive slapd
-
-  touch /var/lib/ldap/docker_bootstrapped
-
-else
-  status "found already-configured slapd"
-fi
-
-############ Dynamic config ############
-slapd -h "ldap:/// ldapi:///" -u openldap -g openldap
-chown -R openldap:openldap /etc/ldap
-
-# TLS
-if [ -e /etc/ldap/ssl/ldap.crt ] && [ -e /etc/ldap/ssl/ldap.key ] && [ -e /etc/ldap/ssl/ca.crt ]; then
-  status "certificates found"
-
-  chmod 600 /etc/ldap/ssl/ldap.key
-
-  # create DHParamFile if not found
-  [ -f /etc/ldap/ssl/dhparam.pem ] || openssl dhparam -out /etc/ldap/ssl/dhparam.pem 2048
-
-  ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ldap/config/auto/tls_add.ldif 
-
-  # add fake dnsmasq route to certificate cn
-  cn=$(openssl x509 -in /etc/ldap/ssl/ldap.crt -subject -noout | sed -n 's/.*CN=\(.*\).\^*/\1/p')
-  echo "127.0.0.1	" $cn >> /etc/dhosts
-
-fi
-
-# Replication
-# todo
-
-# Other config files
-for f in $(find /etc/ldap/config -maxdepth 1 -name \*.ldif -type f); do
-  status "Processing file ${f}"
-  ldapmodify -Y EXTERNAL -H ldapi:/// -f $f
-done
-
-pkill slapd
-
-status "starting slapd on default port 389"
-set -x
-exec /usr/sbin/slapd -h "ldap:///" -u openldap -g openldap -d -1

test-repository.sh

@@ -0,0 +1,15 @@
+#!/bin/sh
+
+# Usage
+# sudo ./test.sh 
+# add -v for verbose mode (or type whatever you like !) :p
+
+. test/config-repository
+. test/tools/run.sh
+
+run_test simple.sh "dn: dc=example,dc=com"
+run_test tls.sh "dn: dc=example,dc=com"
+run_test db.sh "dn: dc=otherdomain,dc=com"
+
+. test/tools/end.sh
+

test.sh

@@ -0,0 +1,16 @@
+#!/bin/sh
+
+# Usage
+# sudo ./test.sh 
+# add -v for verbose mode (or type whatever you like !) :p
+
+. test/config
+. test/tools/run.sh
+
+run_test tools/build-container.sh "Successfully built"
+run_test simple.sh "dn: dc=example,dc=com"
+run_test tls.sh "dn: dc=example,dc=com"
+run_test db.sh "dn: dc=otherdomain,dc=com"
+
+. test/tools/end.sh
+

test/config

@@ -0,0 +1,8 @@
+testImage=openldap-test
+testContainer=openldap-test-container
+testDir=/osixia-test-docker-openldap
+
+export testImage
+export testContainer
+export testDir
+

test/config-repository

@@ -0,0 +1,7 @@
+testImage=osixia/openldap:latest
+testContainer=openldap-repository-test-container
+testDir=/osixia-repository-test-docker-openldap
+
+export testImage
+export testContainer
+export testDir

test/db.sh

@@ -0,0 +1,25 @@
+#!/bin/sh
+
+dir=$(dirname $0)
+
+if [ -d "$testDir" ]; then
+  rm -r $testDir
+fi
+
+mkdir $testDir
+mkdir $testDir/db
+mkdir $testDir/config
+
+runOptions="-e LDAP_DOMAIN=otherdomain.com -v $testDir/db:/var/lib/ldap -v $testDir/config:/etc/ldap/slapd.d"
+. $dir/tools/run-container.sh
+sleep 30
+$dir/tools/delete-container.sh
+
+runOptions="-v $testDir/db:/var/lib/ldap -v $testDir/config:/etc/ldap/slapd.d"
+. $dir/tools/run-container.sh
+sleep 30
+echo "ldapsearch -x -h $IP -b dc=otherdomain,dc=com"
+ldapsearch -x -h $IP -b dc=otherdomain,dc=com
+
+rm -r $testDir
+$dir/tools/delete-container.sh

test/simple.sh

@@ -0,0 +1,10 @@
+#!/bin/sh
+
+dir=$(dirname $0)
+. $dir/tools/run-container.sh
+
+echo "ldapsearch -x -h $IP -b dc=example,dc=com"
+sleep 30
+ldapsearch -x -h $IP -b dc=example,dc=com
+
+$dir/tools/delete-container.sh

test/tls.sh

@@ -0,0 +1,10 @@
+#!/bin/sh
+
+dir=$(dirname $0)
+. $dir/tls/run.sh
+
+echo "ldapsearch -x -h $certCN -b dc=example,dc=com -ZZ"
+sleep 30
+ldapsearch -x -h $certCN -b dc=example,dc=com -ZZ
+
+. $dir/tls/end.sh

test/tls/end.sh

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+sed -i '/'"$addLine"'/d' /etc/hosts
+cp /etc/ldap/ldap.conf.old /etc/ldap/ldap.conf
+rm /etc/ldap/ldap.conf.old
+
+$dir/tools/delete-container.sh

test/tls/run.sh

@@ -0,0 +1,16 @@
+#!/bin/sh
+
+
+runOptions="--dns=127.0.0.1 -v `pwd`/test/tls/ssl:/etc/ldap/ssl"
+. $dir/tools/run-container.sh
+
+cert=$(echo $dir/tls/ssl/ldap.crt)
+certCN=$(openssl x509 -in $cert -subject -noout | sed -n 's/.*CN=\(.*\)\/*\(.*\)/\1/p')
+addLine=$(echo $IP $certCN)
+
+echo $addLine >> /etc/hosts
+cp /etc/ldap/ldap.conf /etc/ldap/ldap.conf.old
+sed -i 's,TLS_CACERT.*,TLS_CACERT '"$cert"',g' /etc/ldap/ldap.conf
+
+sleep 5
+

test/tls/ssl/ca.crt

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDZzCCAh+gAwIBAgIEU2ehnzANBgkqhkiG9w0BAQsFADAjMSEwHwYDVQQDExhU
+ZXN0IENBIENvbXBhbnkgLSBPc2l4aWEwHhcNMTQwNTA1MTQzNTExWhcNMTUwNTA1
+MTQzNTExWjAjMSEwHwYDVQQDExhUZXN0IENBIENvbXBhbnkgLSBPc2l4aWEwggFS
+MA0GCSqGSIb3DQEBAQUAA4IBPwAwggE6AoIBMQDdf+DVT4rPGxNB1SwL6git8Lw1
+AsEvd+rHAMKyCSRxbJywvtN/OKxVz4qWCkoRvcffG0uyoWRE+1w6DnT8ON+8uvuI
+2wbrLydFxuZdouZZJiX0QbXWra9lQpDWO2EAiPFchbN/K9+fXwV4SpsI3B7bGwM/
+sVtn6khbxvtzn+9yUmjIpA7q8i9NLVoX8UwagANtFIVE/Dc/MwaX7ayu6yYiNLXx
+GHzWXzQcTS6vWcVaf+pkq6/zZdXn0jVNfqnwAu3ooTWO3BeuQvGaQeRpRVlM0lPh
+oM7YFhR8b13Y5EmkZtSjoM+7ZOKF5mqBvluj65gIcQxnx4l4YCZ4MUVAlZBYc87h
+2JSYrAlq6eBhJzkNDi21jqtqSr1i08XICZrz4Vk8lrexWbRGzyz537La1LYNAgMB
+AAGjQzBBMA8GA1UdEwEB/wQFMAMBAf8wDwYDVR0PAQH/BAUDAwcEADAdBgNVHQ4E
+FgQUnod7FQfSDLyWVeBSTTdCriQoEHYwDQYJKoZIhvcNAQELBQADggExAGtv/8Ot
+3Acs+KlR+0OBtnWe6sfzfQ2fRJvol7szp0Nto+zTZLbtCEvNGIVkd8eLrm9a9soa
+pY/pC6dAPPZHho/G46quSjtSARU/tlbabkRsCfHiWIvtjqKIyzqk+YjOc767pd0G
+iWKxF98sI4fKdlZ+Aqw+9vO2KwQMYEtrIiCbPUYMff/BzxkrwUBnYcTjISPwEd3Z
+JylfG78qsB8N6UOf89jRX2O7HCy6CGJvcuxbkwaCd5iqgLhBXj9bU7xgy/A2udav
+JV/uV+vWDcy8cI22Xz1jfPpimAZjv+Qb3NjDX5nxjTciAEsNges0QdxZ71dfEqo+
+DGSImtM8ORivPw7oXADztCC+11KcV4THa6wmu+Sblsxe46ldAwb6MLvMN04zALUN
+mW4ojToqYgz9Jgc=
+-----END CERTIFICATE-----

test/tls/ssl/dhparam.pem

@@ -0,0 +1,8 @@
+-----BEGIN DH PARAMETERS-----
+MIIBCAKCAQEAwC8hQ6nZ2kNNmZAGGYN8++rUvNlDjKqdwWubUnqY08ng6FfGcouL
+VSvgsF3LeERW/h4hrkgN983QjwrbBOrNp+7B59lhCs6Acvi87dXf3iaGNy4Gca43
+ERVkAJ7IWdXydyb9COANRtmBb1JvvYMAeVeMdofk8EcOW/kUV2adAQKluAcVhgRQ
+Pesp5i6Lv1kN5zVHDGkrJz5h0Mzi35aYia0gSnVCqEzmU7Omnz/gXY3Jdx91ym5Y
+2dTZuUZgIhco2bfPbhDl/1g0a1PWz7rxw24KJloNZC3nEt3JqIto83GsgaUtYxFT
+EWINSpghTjl4Z0CGCamJ6HXsNJGaVUXuGwIBAg==
+-----END DH PARAMETERS-----

test/tls/ssl/ldap.crt

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDAzCCAbugAwIBAgIEU2eiHTANBgkqhkiG9w0BAQsFADAjMSEwHwYDVQQDExhU
+ZXN0IENBIENvbXBhbnkgLSBPc2l4aWEwHhcNMTQwNTA1MTQzNzE3WhcNMjQwNTAy
+MTQzNzE3WjBAMR4wHAYDVQQKExVUZXN0IENvbXBhbnkgLSBPc2l4aWExHjAcBgNV
+BAMTFWxkYXAtdGVzdC5leGFtcGxlLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAw
+gYkCgYEA0/9/VYQARBLg7TrEiO4DAjcBAt3u3IQNNo8YdsL9iGwmRTPOspxOBVuQ
+2AVEIuT+4KLnm01q1NA+tEvXdfXI9eIN5zjCVTdt6VqwrF9E3zWxYEkuSJ4FWOhN
+dc0837hWBg+mBl/d6fSTkmeRc9fpwwr1jK7t10/BIzMr/pCzf10CAwEAAaN2MHQw
+DAYDVR0TAQH/BAIwADATBgNVHSUEDDAKBggrBgEFBQcDATAPBgNVHQ8BAf8EBQMD
+B6AAMB0GA1UdDgQWBBThLwuObrBzlp4qsKs0NHFMrCgn8jAfBgNVHSMEGDAWgBSe
+h3sVB9IMvJZV4FJNN0KuJCgQdjANBgkqhkiG9w0BAQsFAAOCATEAiAl9RGibKsfQ
+5Vbz2ZjsykzYj9Dhkxp7fc7RdrK0SEHGXn8Qeg5jf+j9DtfhTrZPVF7Jn4WOvuqh
+okQPrwRaDox6rtFPjsIR9JIO3/N2OvA3ozQyWqzB1ksU7CHJ5jGRskHBftSH2xwF
+kdGvSMIAmr9VpZ/sp4ykmADWC/bfz8BXYJDOsCBzJMtss/12hBqiJQhSsuBAsOT7
+40hG0t2S7mjGHWDF9PoARmNQ7X3Xc8j7V+dXLpNfZfc+htgI27WcOv7al4kxd//p
+22a77U/q+9B1CV8T2q1UTRnQqPHxtgoRLd+5qzEtzBW37ecAs2eAs9Z7D3O/fScu
+v0RxHSpnZDtL/JZcf3KO96l4sqCp6Ue5Ldg3tOvD4O46hjrlvUYnHcDdJjNYZ7rD
+f5kGXs20Mg==
+-----END CERTIFICATE-----

test/tls/ssl/ldap.key

@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICWwIBAAKBgQDT/39VhABEEuDtOsSI7gMCNwEC3e7chA02jxh2wv2IbCZFM86y
+nE4FW5DYBUQi5P7gouebTWrU0D60S9d19cj14g3nOMJVN23pWrCsX0TfNbFgSS5I
+ngVY6E11zTzfuFYGD6YGX93p9JOSZ5Fz1+nDCvWMru3XT8EjMyv+kLN/XQIDAQAB
+AoGAHY7OgKxWYydkr/7VHyhcSAdGP1GVN667ruM1rH1UXxyBG331MEcFw853+/6D
++P+Hn+dmtmsNXZ2pWHcIk/xQZ+MEsAdm+OZ1qpBJjHA0izJ6sqZaNxSToKCR4SHM
+/ACPAKqM9r2g1jqXzLKzgHBVc25Fonb1vUilTpC3YfaN+sECQQDmQGEcEK9Lvyi9
+RV1fONDP3Z9cPRaSzpjUjlQAWNbhvcoUYV4AOy+tVClDErRIs/Oo+wCOL+bHlMom
+zghcmxThAkEA67SPV0pNFR32gXvRZT4uKvCJcAjmNY4LMpet5DJ41Spq6+lbqXwY
+1e87zEei1UvdmEXOjVsa1wXcg8Ks+/59/QJAHh+CFOfh5ykFLW3rv09xkiBOfwTG
+9UHuILDWMI1u322zCGOMpr8Xh7ehBlNmHrTcRdlAw1lk+etvXxBJa8QmQQJABbNT
+OCg63wTfflgxQ0KSuUUh/cypTKhHywxyDy/NTlJ9TYFSTzIKI7pqdtFQtdnk3Rbr
+HO4UIxkoMSOXLW0FPQJARScXqZd7Lmwlw+ovAubfdOZdxjWGFZLRRZifiYZqtnQ1
+aw8PjdkaIPxLjCwSOelV9SsMue6a7nvkxKEn6QbT0w==
+-----END RSA PRIVATE KEY-----

test/tools/build-container.sh

@@ -0,0 +1,5 @@
+#!/bin/sh
+
+docker build -t $testImage .
+#docker build --no-cache=true -t $testImage .
+

test/tools/delete-container.sh

@@ -0,0 +1,9 @@
+#!/bin/sh
+
+# remove test container
+res=$(docker ps -a | grep -c "$testContainer")
+
+if [ $res -ne 0 ]; then
+  docker stop $testContainer
+  docker rm $testContainer
+fi

test/tools/delete-image.sh

@@ -0,0 +1,8 @@
+#!/bin/sh
+
+# remove test image
+res=$(docker images | grep -c "$testImage")
+
+if [ $res -ne 0 ]; then
+  docker rmi $testImage
+fi

test/tools/end.sh

@@ -0,0 +1,15 @@
+#!/bin/sh
+
+
+rm -rf $testDir
+./test/tools/delete-container.sh 
+./test/tools/delete-image.sh > /dev/null 2>&1
+
+echo "------- End -------"
+echo $error " failed " $ok " succeeded"
+
+if [ "$error" -eq 0 ]; then
+  exit 0
+else
+  exit 1
+fi

test/tools/prepare.sh

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+mkdir -p $testDir
+
+dir=$(dirname $0)
+$dir/delete-container.sh
+$dir/delete-image.sh

test/tools/run-container.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+
+echo "docker run --name $testContainer $runOptions -d $testImage $runCommand /sbin/my_init --enable-insecure-key"
+ID=`docker run --name $testContainer $runOptions -d $testImage $runCommand /sbin/my_init --enable-insecure-key`
+sleep 10
+
+echo " --> Obtaining IP"
+IP=`docker inspect -f "{{ .NetworkSettings.IPAddress }}" $ID`
+if [ "$IP" = "" ]; then
+	abort "Unable to obtain container IP"
+	exit 1
+else
+  echo " -->" $IP
+fi

test/tools/run.sh

@@ -0,0 +1,46 @@
+#!/bin/sh
+
+# Usage
+# sudo ./test.sh 
+# add -v for verbose mode (or type whatever you like !) :p
+
+verbose=$1
+error=0
+ok=0
+
+echo_start () {
+  echo "------- Test: $* -------"
+}
+
+echo_error () {
+  echo "\n$(tput setaf 1)/!\ $* failed$(tput sgr0)\n"
+  error=`expr $error + 1`
+}
+
+echo_ok () {
+  echo "\n--> $* ok\n"
+  ok=`expr $ok + 1`
+}
+
+run_test () {
+  test=$1
+  out=test/test.out
+
+  echo_start $test
+
+  if [ -z ${verbose} ]; then
+    ./test/$test > $out 2>&1
+  else
+    ./test/$test | tee $out 2>&1
+  fi
+  
+  if [ "$(grep -c "$2" $out)" -eq 0 ]; then
+    echo_error $test
+  else
+    echo_ok  $test
+  fi
+
+  rm $out
+}
+
+./test/tools/prepare.sh > /dev/null 2>&1