Beispiel #1
0
func createDomain() {
	dt := template()
	if dt.Config.DomainInfo.GetPolicyKeysPath() == "" {
		options.Usage("Must supply a policy_keys_path in the domain configuration")
	}

	pwd := getKey("domain policy key password", "pass")

	domain, err := tao.CreateDomain(*dt.Config, configPath(), pwd)
	options.FailIf(err, "Can't create domain")

	if domain.Config.DomainInfo.GetGuardType() == "Datalog" {
		// Add any rules specified in the domain template.
		for _, rule := range dt.DatalogRules {
			err := domain.Guard.AddRule(rule)
			options.FailIf(err, "Can't add rule to domain")
		}
	} else if domain.Config.DomainInfo.GetGuardType() == "ACLs" {
		for _, rule := range dt.AclRules {
			err := domain.Guard.AddRule(rule)
			options.FailIf(err, "Can't add rule to domain")
		}
	}

	err = domain.Save()
	options.FailIf(err, "Can't save domain")

	// Optionally, create a public cached domain.
	if addr := *options.String["pub_domain_address"]; addr != "" {
		net := *options.String["pub_domain_network"]
		ttl := *options.Duration["pub_domain_ttl"]
		_, err = domain.CreatePublicCachedDomain(net, addr, int64(ttl))
		options.FailIf(err, "Can't create public cached domain")
	}
}
Beispiel #2
0
func main() {
	options.Help = "Usage: %s [options] (get|post ...)"
	options.Parse()

	srv := netlog.DefaultServer
	if *options.String["addr"] != "" {
		srv = &netlog.Server{Addr: *options.String["addr"]}
	}

	fmt.Printf("# connecting to netlog server %s using tao authentication.\n", srv.Addr)
	err := srv.Connect()
	options.FailIf(err, "couldn't connect to netlog server")

	args := options.Args()
	if len(args) == 1 && args[0] == "get" {
		log, err := srv.Entries()
		options.FailIf(err, "couldn't get netlog entries")
		fmt.Printf("# %d entries\n", len(log))
		for i, e := range log {
			fmt.Printf("%d %q %s\n", i, e.Prin, e.Msg)
		}
	} else if len(args) > 1 && args[0] == "post" {
		msg := strings.Join(args[1:], " ")
		err := srv.Log(msg)
		options.FailIf(err, "couldn't post netlog entry")
	} else {
		options.Usage("Unrecognized command: %s\n", args[0])
	}
}
Beispiel #3
0
func addContainerRules(host string, domain *tao.Domain) {
	dt := template()
	if domain.Config.DomainInfo.GetGuardType() == "Datalog" {
		for _, c := range dt.ContainerPaths {
			prin, err := makeContainerSubPrin(c)
			if err != nil {
				continue
			}
			pt := auth.PrinTail{Ext: prin}
			pred := auth.MakePredicate(dt.GetContainerPredicateName(), pt)
			err = domain.Guard.AddRule(fmt.Sprint(pred))
			options.FailIf(err, "Can't add rule to domain")
		}
	} else if domain.Config.DomainInfo.GetGuardType() == "ACLs" && host != "" {
		prin := makeHostPrin(host)
		for _, p := range dt.ContainerPaths {
			subprin, err := makeContainerSubPrin(p)
			if err != nil {
				continue
			}
			prog := prin.MakeSubprincipal(subprin)
			err = domain.Guard.Authorize(prog, "Execute", nil)
			options.FailIf(err, "Can't authorize program in domain")
		}
	}
	err := domain.Save()
	options.FailIf(err, "Can't save domain")
}
Beispiel #4
0
func doClient(domain *tao.Domain) {
	network := "tcp"
	keys, err := tao.NewTemporaryTaoDelegatedKeys(tao.Signing, nil, tao.Parent())
	options.FailIf(err, "client: couldn't generate temporary Tao keys")

	g := domain.Guard
	if *ca != "" {
		na, err := tao.RequestTruncatedAttestation(network, *ca, keys, domain.Keys.VerifyingKey)
		options.FailIf(err, "client: couldn't get a truncated attestation from %s: %s\n", *ca)

		keys.Delegation = na

		// If we're using a CA, then use a custom guard that accepts only
		// programs that have talked to the CA.
		g, err = newTempCAGuard(domain.Keys.VerifyingKey)
		options.FailIf(err, "client: couldn't set up a new guard")
	}

	pingGood := 0
	pingFail := 0
	for i := 0; i < *pingCount || *pingCount < 0; i++ { // negative means forever
		if doRequest(g, domain, keys) {
			pingGood++
		} else {
			pingFail++
		}
		fmt.Printf("client: made %d connections, finished %d ok, %d bad pings\n", i+1, pingGood, pingFail)
	}
}
Beispiel #5
0
func outputPrincipal() {
	if path := *options.String["program"]; path != "" {
		subprin, err := makeProgramSubPrin(path)
		options.FailIf(err, "Can't create program principal")
		pt := auth.PrinTail{Ext: subprin}
		fmt.Println(pt)
	}
	if path := *options.String["container"]; path != "" {
		subprin, err := makeContainerSubPrin(path)
		options.FailIf(err, "Can't create container principal")
		pt := auth.PrinTail{Ext: subprin}
		fmt.Println(pt)
	}
	if *options.Bool["tpm"] {
		tpmPath, aikFile, pcrVals := getTPMConfig()
		prin := makeTPMPrin(tpmPath, aikFile, pcrVals)
		// In the domain template the host name is in quotes. We need to escape
		// quote strings in the Principal string so that domain_template.pb gets
		// parsed correctly.
		name := strings.Replace(prin.String(), "\"", "\\\"", -1)
		fmt.Println(name)
	}
	if lhpath := *options.String["soft"]; lhpath != "" {
		if !path.IsAbs(lhpath) {
			lhpath = path.Join(domainPath(), lhpath)
		}
		k, err := tao.NewOnDiskPBEKeys(tao.Signing, nil, lhpath, nil)
		options.FailIf(err, "Can't create soft tao keys")
		fmt.Println(k.VerifyingKey.ToPrincipal())
	}
}
Beispiel #6
0
func SubmitAndInstall(keys *tao.Keys, csr *CSR) {
	verbose.Printf("Obtaining certificate from CA (may take a while)\n")
	resp, err := Submit(keys, csr)
	options.FailIf(err, "can't obtain X509 certificate from CA")
	if len(resp) == 0 {
		options.Fail(nil, "no x509 certificates returned from CA")
	}
	// Add the certs to our keys...
	keys.Cert["default"] = resp[0]
	for i, c := range resp {
		name := "ca"
		if i > 0 {
			name = fmt.Sprintf("ca-%d", i)
		}
		keys.Cert[name] = c
	}
	if keys.X509Path("default") != "" {
		err = keys.SaveCerts()
	}
	options.FailIf(err, "can't save X509 certificates")

	chain := keys.CertChain("default")
	verbose.Printf("Obtained certfificate chain of length %d:\n", len(chain))
	for i, cert := range chain {
		verbose.Printf("  Cert[%d] Subject: %s\n", i, x509txt.RDNString(cert.Subject))
	}
	if Warn {
		fmt.Println("Note: You may need to install root CA's key into the browser.")
	}
}
Beispiel #7
0
func (mh ManifestHandler) ServeHTTP(w http.ResponseWriter, req *http.Request) {
	q := req.URL.Query()
	name, ok := q["p"]
	if !ok || len(name) != 1 {
		w.Header().Set("Content-Type", "text/html")
		t, err := template.New("show").Parse(ManifestIndexTemplate)
		options.FailIf(err, "can't parse template")
		err = t.Execute(w, mh)
		options.FailIf(err, "can't execute template")
		return
	}
	fmt.Printf("request for: %s\n", name[0])
	var p auth.Prin
	if _, err := fmt.Sscanf("("+name[0]+")", "%v", &p); err != nil {
		http.NotFound(w, req)
		return
	}

	m := tao.DeriveManifest(&p)
	var b bytes.Buffer
	Dump(indent.NewHtmlWriter(&b, "h2"), tao.Manifest{"Principal Manifest": m})
	s := b.String()

	w.Header().Set("Content-Type", "text/html")
	t, err := template.New("show").Parse(ManifestTemplate)
	options.FailIf(err, "can't parse template")
	err = t.Execute(w, template.HTML(s))
	options.FailIf(err, "can't execute template")
}
Beispiel #8
0
func addACLPrograms(host string, domain *tao.Domain) {
	if host == "" {
		return
	}
	dt := template()
	prin := makeHostPrin(host)
	for _, p := range dt.ProgramPaths {
		subprin, err := makeProgramSubPrin(p)
		if err != nil {
			continue
		}
		prog := prin.MakeSubprincipal(subprin)
		err = domain.Guard.Authorize(prog, "Execute", nil)
		options.FailIf(err, "Can't authorize program in domain")
	}
	for _, vm := range dt.VmPaths {
		vmPrin, err := makeVMSubPrin(vm)
		if err != nil {
			continue
		}
		for _, lh := range dt.LinuxHostPaths {
			lhPrin, err := makeLinuxHostSubPrin(lh)
			if err != nil {
				continue
			}
			var lsp auth.SubPrin
			lsp = append(lsp, vmPrin...)
			lsp = append(lsp, lhPrin...)
			lprog := prin.MakeSubprincipal(lsp)
			err = domain.Guard.Authorize(lprog, "Execute", nil)
			options.FailIf(err, "Can't authorize program in domain")

			for _, p := range dt.ProgramPaths {
				subprin, err := makeProgramSubPrin(p)
				if err != nil {
					continue
				}
				var sp auth.SubPrin
				sp = append(sp, vmPrin...)
				sp = append(sp, lhPrin...)
				sp = append(sp, subprin...)
				prog := prin.MakeSubprincipal(sp)
				err = domain.Guard.Authorize(prog, "Execute", nil)
				options.FailIf(err, "Can't authorize program in domain")

				var gsp auth.SubPrin
				gsp = append(gsp, vmPrin...)
				gsp = append(gsp, lhPrin...)
				gsp = append(gsp, domain.Guard.Subprincipal()...)
				gsp = append(gsp, subprin...)
				gprog := prin.MakeSubprincipal(gsp)
				err = domain.Guard.Authorize(gprog, "Execute", nil)
				options.FailIf(err, "Can't authorize program in domain")
			}
		}
	}
}
Beispiel #9
0
func main() {
	options.Parse()
	if *options.String["config"] != "" && !*options.Bool["init"] {
		err := options.Load(*options.String["config"])
		options.FailIf(err, "Can't load configuration")
	}

	fmt.Println("Cloudproxy HTTPS Server")

	if tao.Parent() == nil {
		options.Fail(nil, "can't continue: no host Tao available")
	}
	self, err := tao.Parent().GetTaoName()
	options.FailIf(err, "Can't get Tao name")

	// TODO(kwalsh) extend tao name with operating mode and policy

	addr := net.JoinHostPort(*options.String["host"], *options.String["port"])

	cpath := *options.String["config"]
	kdir := *options.String["keys"]
	if kdir == "" && cpath != "" {
		kdir = path.Dir(cpath)
	} else if kdir == "" {
		options.Fail(nil, "Option -keys or -config is required")
	}

	docs := *options.String["docs"]
	if docs == "" && cpath != "" {
		docs = path.Join(path.Dir(cpath), "docs")
	} else if docs == "" {
		options.Fail(nil, "Option -keys or -config is required")
	}

	var keys *tao.Keys

	if *options.Bool["init"] {
		keys = taoca.GenerateKeys(name, addr, kdir)
	} else {
		keys = taoca.LoadKeys(kdir)
	}

	fmt.Printf("Configuration file: %s\n", cpath)
	if *options.Bool["init"] && cpath != "" {
		err := options.Save(cpath, "HTTPS server configuration", "persistent")
		options.FailIf(err, "Can't save configuration")
	}

	http.Handle("/cert/", https.CertificateHandler{keys.CertificatePool})
	http.Handle("/prin/", https.ManifestHandler{"/prin/", self.String()})
	http.Handle("/", http.FileServer(https.LoggingFilesystem{http.Dir(docs)}))
	fmt.Printf("Listening at %s using HTTPS\n", addr)
	err = tao.ListenAndServeTLS(addr, keys)
	options.FailIf(err, "can't listen and serve")

	fmt.Println("Server Done")
}
Beispiel #10
0
func startHost(domain *tao.Domain) {

	if *options.Bool["daemon"] && *options.Bool["foreground"] {
		options.Usage("Can supply only one of -daemon and -foreground")
	}
	if *options.Bool["daemon"] {
		daemonize()
	}

	cfg := configureFromFile()
	configureFromOptions(cfg)
	host, err := loadHost(domain, cfg)
	options.FailIf(err, "Can't create host")

	sockPath := path.Join(hostPath(), "admin_socket")
	// Set the socketPath directory go+rx so tao_launch can access sockPath and
	// connect to this linux host, even when tao_launch is run as non-root.
	err = os.Chmod(path.Dir(sockPath), 0755)
	options.FailIf(err, "Can't change permissions")
	uaddr, err := net.ResolveUnixAddr("unix", sockPath)
	options.FailIf(err, "Can't resolve unix socket")
	sock, err := net.ListenUnix("unix", uaddr)
	options.FailIf(err, "Can't create admin socket")
	defer sock.Close()
	err = os.Chmod(sockPath, 0666)
	if err != nil {
		sock.Close()
		options.Fail(err, "Can't change permissions on admin socket")
	}

	go func() {
		verbose.Printf("Linux Tao Service (%s) started and waiting for requests\n", host.HostName())
		err = tao.NewLinuxHostAdminServer(host).Serve(sock)
		verbose.Printf("Linux Tao Service finished\n")
		sock.Close()
		options.FailIf(err, "Error serving admin requests")
		os.Exit(0)
	}()

	c := make(chan os.Signal, 1)
	signal.Notify(c, os.Interrupt, os.Kill, syscall.SIGTERM)
	<-c
	verbose.Printf("Linux Tao Service shutting down\n")
	err = shutdown()
	if err != nil {
		sock.Close()
		options.Fail(err, "Can't shut down admin socket")
	}

	// The above goroutine will normally end by calling os.Exit(), so we
	// can block here indefinitely. But if we get a second kill signal,
	// let's abort.
	verbose.Printf("Waiting for shutdown....\n")
	<-c
	options.Fail(nil, "Could not shut down linux_host")
}
Beispiel #11
0
func addHostRules(host string, domain *tao.Domain) {
	if host == "" {
		return
	}
	dt := template()
	prin := makeHostPrin(host)
	pred := auth.MakePredicate(dt.GetHostPredicateName(), prin)
	err := domain.Guard.AddRule(fmt.Sprint(pred))
	options.FailIf(err, "Can't add rule to domain")
	err = domain.Save()
	options.FailIf(err, "Can't save domain")
}
Beispiel #12
0
func queryGuard(query string) {
	domain, err := tao.LoadDomain(configPath(), nil)
	options.FailIf(err, "Can't load domain")

	ok, err := domain.Guard.Query(query)
	options.FailIf(err, "Can't process query")
	if ok {
		fmt.Println("The policy implies the statement.")
	} else {
		fmt.Println("The policy does not imply the statement")
	}
}
Beispiel #13
0
func addGuardRules(domain *tao.Domain) {
	dt := template()
	subprin := domain.Guard.Subprincipal()
	pt := auth.PrinTail{Ext: subprin}
	pred := auth.Pred{
		Name: dt.GetGuardPredicateName(),
		Arg:  []auth.Term{pt},
	}
	err := domain.Guard.AddRule(fmt.Sprint(pred))
	options.FailIf(err, "Can't add rule to domain")
	err = domain.Save()
	options.FailIf(err, "Can't save domain")
}
Beispiel #14
0
func template() *tao.DomainTemplate {
	if savedTemplate == nil {
		configTemplate := *options.String["config_template"]
		if configTemplate == "" {
			options.Usage("Must supply -config_template")
		}
		savedTemplate = new(tao.DomainTemplate)
		pbtext, err := ioutil.ReadFile(configTemplate)
		options.FailIf(err, "Can't read config template")
		err = proto.UnmarshalText(string(pbtext), savedTemplate)
		options.FailIf(err, "Can't parse config template: %s", configTemplate)
	}
	return savedTemplate
}
Beispiel #15
0
func template() *tao.DomainTemplate {
	if savedTemplate == nil {
		configTemplate := *options.String["config_template"]
		if configTemplate == "" {
			configTemplate = path.Join(apps.TaoDomainPath(), "domain_template.pb")
		}
		savedTemplate = new(tao.DomainTemplate)
		pbtext, err := ioutil.ReadFile(configTemplate)
		options.FailIf(err, "Can't read config template. Try -config_template instead?")
		err = proto.UnmarshalText(string(pbtext), savedTemplate)
		options.FailIf(err, "Can't parse config template: %s", configTemplate)
	}
	return savedTemplate
}
Beispiel #16
0
func initHost(domain *tao.Domain) {
	var cfg tao.LinuxHostConfig

	configureFromOptions(&cfg)
	_, err := loadHost(domain, &cfg)
	options.FailIf(err, "Can't create host")

	// If we get here, keys were created and flags must be ok.

	file, err := util.CreatePath(hostConfigPath(), 0777, 0666)
	options.FailIf(err, "Can't create host configuration")
	cs := proto.MarshalTextString(&cfg)
	fmt.Fprint(file, cs)
	file.Close()
}
Beispiel #17
0
func addExecute(path, host string, domain *tao.Domain) {
	prin := makeHostPrin(host)
	subprin, err := makeProgramSubPrin(path)
	if err == nil {
		prog := prin.MakeSubprincipal(subprin)
		fmt.Fprintf(noise, "Authorizing program to execute:\n"+
			"  path: %s\n"+
			"  host: %s\n"+
			"  name: %s\n", path, prin, subprin)
		err := domain.Guard.Authorize(prog, "Execute", nil)
		options.FailIf(err, "Can't authorize program in domain")
		err = domain.Save()
		options.FailIf(err, "Can't save domain")
	}
}
Beispiel #18
0
func main() {
	options.Parse()
	if *options.String["config"] != "" && !*options.Bool["init"] {
		err := options.Load(*options.String["config"])
		options.FailIf(err, "Can't load configuration")
	}

	fmt.Println("Cloudproxy HTTPS Netlog Viewer")

	if tao.Parent() == nil {
		options.Fail(nil, "can't continue: no host Tao available")
	}

	// TODO(kwalsh) extend tao name with operating mode and policy

	addr := net.JoinHostPort(*options.String["host"], *options.String["port"])

	cpath := *options.String["config"]
	kdir := *options.String["keys"]
	if kdir == "" && cpath != "" {
		kdir = path.Dir(cpath)
	} else if kdir == "" {
		options.Fail(nil, "Option -keys or -config is required")
	}

	var keys *tao.Keys

	if *options.Bool["init"] {
		keys = taoca.GenerateKeys(name, addr, kdir)
	} else {
		keys = taoca.LoadKeys(kdir)
	}

	fmt.Printf("Configuration file: %s\n", cpath)
	if *options.Bool["init"] && cpath != "" {
		err := options.Save(cpath, "Cloudproxy HTTPS netlog viewer configuration", "persistent")
		options.FailIf(err, "Can't save configuration")
	}

	http.Handle("/cert/", https.CertificateHandler{keys.CertificatePool})
	http.Handle("/index.html", http.RedirectHandler("/", 301))
	http.HandleFunc("/", netlog_show)
	fmt.Printf("Listening at %s using HTTPS\n", addr)
	err := tao.ListenAndServeTLS(addr, keys)
	options.FailIf(err, "can't listen and serve")

	fmt.Println("Server Done")
}
Beispiel #19
0
func showHost(domain *tao.Domain) {
	cfg := configureFromFile()
	configureFromOptions(cfg)
	host, err := loadHost(domain, cfg)
	options.FailIf(err, "Can't create host")
	fmt.Printf("%v\n", host.HostName())
}
Beispiel #20
0
func getTPMConfig() (string, string, []int) {
	domain, err := tao.LoadDomain(configPath(), nil)
	options.FailIf(err, "Can't load domain")
	tpmPath := domain.Config.GetTpmInfo().GetTpmPath()
	aikFile := domain.Config.GetTpmInfo().GetAikPath()
	pcrVals := domain.Config.GetTpmInfo().GetPcrs()
	var pcrNums []int
	for _, s := range strings.Split(pcrVals, ",") {
		v, err := strconv.ParseInt(s, 10, 32)
		options.FailIf(err, "Can't parse TPM PCR spec")

		pcrNums = append(pcrNums, int(v))
	}

	return tpmPath, aikFile, pcrNums
}
func main() {
	flag.Parse()

	// Check to see if we are running in Docker mode with linked containers.
	// If so, then there will be an environment variable SERVER_PORT that
	// will contain a value of the form tcp://<ip>:<port>
	serverEnvVar := os.Getenv("SERVER_PORT")
	if serverEnvVar == "" {
		serverAddr = net.JoinHostPort(*serverHost, *serverPort)
	} else {
		serverAddr = strings.TrimPrefix(serverEnvVar, "tcp://")
		if serverAddr == serverEnvVar {
			options.Usage("client: invalid SERVER_PORT environment variable value '%s'\n", serverEnvVar)
		}
	}

	switch *demoAuth {
	case "tcp", "tls", "tao":
	default:
		options.Usage("unrecognized authentication mode: %s\n", *demoAuth)
	}

	fmt.Println("Go Tao Demo Client")

	if tao.Parent() == nil {
		options.Fail(nil, "can't continue: No host Tao available")
	}

	domain, err := tao.LoadDomain(configPath(), nil)
	options.FailIf(err, "error: couldn't load the tao domain from %s\n", configPath())

	doClient(domain)
	fmt.Println("Client Done")
}
Beispiel #22
0
func netlog_show(w http.ResponseWriter, r *http.Request) {
	w.Header().Set("Content-Type", "text/html")
	e, err := netlog.Entries()
	if err != nil {
		t, _ := template.New("error").Parse(err_tpl)
		err = t.Execute(w, err)
		if err != nil {
			fmt.Printf("error showing netlog: %s\n", err)
		}
		return
	}
	s := compress(e)
	t, err := template.New("show").Parse(show_tpl)
	options.FailIf(err, "can't parse template")
	err = t.Execute(w, s)
	options.FailIf(err, "can't execute template")
}
Beispiel #23
0
func addLinuxHostRules(domain *tao.Domain) {
	dt := template()
	for _, c := range dt.LinuxHostPaths {
		prin, err := makeLinuxHostSubPrin(c)
		if err != nil {
			continue
		}
		pt := auth.PrinTail{Ext: prin}
		pred := auth.MakePredicate(dt.GetLinuxHostPredicateName(), pt)
		err = domain.Guard.AddRule(fmt.Sprint(pred))
		options.FailIf(err, "Can't add rule to domain")
	}
	// The ACLs need the full name, so that only happens for containers and
	// programs.
	err := domain.Save()
	options.FailIf(err, "Can't save domain")
}
Beispiel #24
0
func makeHostPrin(host string) auth.Prin {
	if host == "" {
		options.Usage("The domain template must contain a Tao host in host_name")
	}
	var prin auth.Prin
	_, err := fmt.Sscanf(host, "%v", &prin)
	options.FailIf(err, "Can't create host principal")
	return prin
}
Beispiel #25
0
func UrlBasename(loc string) string {
	u, err := url.ParseRequestURI(loc)
	options.FailIf(err, "can't parse url in certificate: %s", u)
	s := strings.Split(u.Path, "/")
	if len(s) < 2 {
		options.Fail(nil, "can't parse url in certificate: %s", u)
	}
	return s[len(s)-1]
}
Beispiel #26
0
// TODO(tmroeder): The keys for the TPM2 have to already be created here so
// that we can produce the name of the TPM2 key. For now, this just returns a
// dummy key.
func makeTPM2Prin(tpmPath string, pcrNums []int) auth.Prin {
	// TODO(tmroeder): The following key is generated on the spot. This should
	// instead be the key read from a file.
	privKey, err := rsa.GenerateKey(rand.Reader, 2048)
	options.FailIf(err, "Can't generate a temp RSA key")

	// Open a connection to the TPM.
	tpmFile, err := os.OpenFile(tpmPath, os.O_RDWR, 0)
	options.FailIf(err, "Can't access TPM")

	pcrVals, err := tao.ReadTPM2PCRs(tpmFile, pcrNums)
	tpmFile.Close()
	options.FailIf(err, "Can't get the PCRs from a TPM 2.0")

	prin, err := tao.MakeTPM2Prin(&privKey.PublicKey, pcrNums, pcrVals)
	options.FailIf(err, "Can't create a TPM2 principal")
	return prin
}
Beispiel #27
0
func main() {
	verbose.Set(true)
	options.Parse()

	if *options.String["config"] != "" && !*options.Bool["init"] {
		err := options.Load(*options.String["config"])
		options.FailIf(err, "Can't load configuration")
	}

	if *options.Bool["init"] {
		cpath := *options.String["config"]
		if cpath == "" {
			options.Fail(nil, "Option -init requires option -config")
		}
		fmt.Println("Initializing configuration file: " + cpath)
		err := options.Save(cpath, "Tao rendezvous configuration", "persistent")
		options.FailIf(err, "Can't save configuration")
	}

	fmt.Println("Cloudproxy Rendezvous Service")

	if tao.Parent() == nil {
		options.Fail(nil, "can't continue: no host Tao available")
	}

	allowAnon = *options.Bool["anon"]
	manualMode = *options.Bool["manual"]
	fcfsMode = *options.Bool["fcfs"]
	addr := *options.String["addr"]

	netlog.Log("rendezvous: init")
	netlog.Log("rendezvous: allow anon? %v", allowAnon)
	netlog.Log("rendezvous: manual? %v", manualMode)
	netlog.Log("rendezvous: fcfs? %v", fcfsMode)
	netlog.Log("rendezvous: addr = %v", addr)

	// TODO(kwalsh) extend tao name with operating mode and policy

	err := tao.NewOpenServer(tao.ConnHandlerFunc(doResponses)).ListenAndServe(addr)
	options.FailIf(err, "server died")

	netlog.Log("rendezvous: done")
}
Beispiel #28
0
func getTPM2Config() (string, []int) {
	domain, err := tao.LoadDomain(configPath(), nil)
	options.FailIf(err, "Can't load domain")
	// TODO(tmroeder): This ignores the info path, since it ignores the cert
	// files.
	tpmPath := domain.Config.GetTpm2Info().GetTpm2Device()
	pcrVals := domain.Config.GetTpm2Info().GetTpm2Pcrs()
	// TODO(tmroeder): This currently ignores the paths to the ek_cert and
	// quote_cert, since it creates its own keys.
	var pcrNums []int
	for _, s := range strings.Split(pcrVals, ",") {
		v, err := strconv.ParseInt(s, 10, 32)
		options.FailIf(err, "Can't parse TPM PCR spec")

		pcrNums = append(pcrNums, int(v))
	}

	return tpmPath, pcrNums
}
Beispiel #29
0
// Main provides the main functionality of linux_host. This is provided as a
// separate function to allow other code to register other Tao implementations
// (with tao.Register) before starting the code.
func Main() {
	flag.Usage = help

	// Get options before the command verb
	flag.Parse()
	// Get command verb
	cmd := "help"
	if flag.NArg() > 0 {
		cmd = flag.Arg(0)
	}
	// Get options after the command verb
	if flag.NArg() > 1 {
		flag.CommandLine.Parse(flag.Args()[1:])
	}

	if !*options.Bool["quiet"] {
		noise = os.Stdout
	}

	// Load the domain.
	domain, err := tao.LoadDomain(domainConfigPath(), nil)
	options.FailIf(err, "Can't load domain")

	// Set $TAO_DOMAIN so it will be inherited by hosted programs
	os.Unsetenv("TAO_DOMAIN")
	err = os.Setenv("TAO_DOMAIN", domainPath())
	options.FailIf(err, "Can't set $TAO_DOMAIN")

	switch cmd {
	case "help":
		help()
	case "init":
		initHost(domain)
	case "show":
		showHost(domain)
	case "start":
		startHost(domain)
	case "stop", "shutdown":
		stopHost(domain)
	default:
		options.Usage("Unrecognized command: %s", cmd)
	}
}
Beispiel #30
0
func addTPM2Rules(domain *tao.Domain) {
	dt := template()
	tpmPath, pcrNums := getTPM2Config()
	prin := makeTPM2Prin(tpmPath, pcrNums)

	// TrustedOS predicate from PCR principal tail.
	prinPCRs := auth.PrinTail{Ext: prin.Ext}
	predTrustedOS := auth.MakePredicate(dt.GetOsPredicateName(), prinPCRs)
	err := domain.Guard.AddRule(fmt.Sprint(predTrustedOS))
	options.FailIf(err, "Can't add rule to domain")

	// TrustedTPM predicate from TPM principal.
	prin.Ext = nil
	predTrustedTPM2 := auth.MakePredicate(dt.GetTpm2PredicateName(), prin)
	err = domain.Guard.AddRule(fmt.Sprint(predTrustedTPM2))
	options.FailIf(err, "Can't add rule to domain")

	err = domain.Save()
	options.FailIf(err, "Can't save domain")
}