func doClient(domain *tao.Domain) {
network := "tcp"
keys, err := tao.NewTemporaryTaoDelegatedKeys(tao.Signing, nil, tao.Parent())
options.FailIf(err, "client: couldn't generate temporary Tao keys")
g := domain.Guard
if *ca != "" {
na, err := tao.RequestTruncatedAttestation(network, *ca, keys, domain.Keys.VerifyingKey)
options.FailIf(err, "client: couldn't get a truncated attestation from %s: %s\n", *ca)
keys.Delegation = na
// If we're using a CA, then use a custom guard that accepts only
// programs that have talked to the CA.
g, err = newTempCAGuard(domain.Keys.VerifyingKey)
options.FailIf(err, "client: couldn't set up a new guard")
}
pingGood := 0
pingFail := 0
for i := 0; i < *pingCount || *pingCount < 0; i++ { // negative means forever
if doRequest(g, domain, keys) {
pingGood++
} else {
pingFail++
}
fmt.Printf("client: made %d connections, finished %d ok, %d bad pings\n", i+1, pingGood, pingFail)
}
}
func doClient(domain *tao.Domain) {
network := "tcp"
keys, err := tao.NewTemporaryTaoDelegatedKeys(tao.Signing, tao.Parent())
options.FailIf(err, "client: couldn't generate temporary Tao keys")
// TODO(tmroeder): fix the name
cert, err := keys.SigningKey.CreateSelfSignedX509(&pkix.Name{
Organization: []string{"Google Tao Demo"}})
options.FailIf(err, "client: couldn't create a self-signed X.509 cert")
// TODO(kwalsh) keys should save cert on disk if keys are on disk
keys.Cert = cert
g := domain.Guard
if *ca != "" {
na, err := tao.RequestTruncatedAttestation(network, *ca, keys, domain.Keys.VerifyingKey)
options.FailIf(err, "client: couldn't get a truncated attestation from %s: %s\n", *ca)
keys.Delegation = na
// If we're using a CA, then use a custom guard that accepts only
// programs that have talked to the CA.
g, err = newTempCAGuard(domain.Keys.VerifyingKey)
options.FailIf(err, "client: couldn't set up a new guard")
}
pingGood := 0
pingFail := 0
for i := 0; i < *pingCount || *pingCount < 0; i++ { // negative means forever
if doRequest(g, domain, keys) {
pingGood++
} else {
pingFail++
}
fmt.Printf("client: made %d connections, finished %d ok, %d bad pings\n", i+1, pingGood, pingFail)
}
}
func doServer() {
var sock net.Listener
var err error
var keys *tao.Keys
network := "tcp"
domain, err := tao.LoadDomain(configPath(), nil)
options.FailIf(err, "error: couldn't load the tao domain from %s\n", configPath())
switch *demoAuth {
case "tcp":
sock, err = net.Listen(network, serverAddr)
options.FailIf(err, "server: couldn't listen to the network")
case "tls", "tao":
// Generate a private/public key for this hosted program (hp) and
// request attestation from the host of the statement "hp speaksFor
// host". The resulting certificate, keys.Delegation, is a chain of
// "says" statements extending to the policy key. The policy is
// checked by the host before this program is executed.
keys, err = tao.NewTemporaryTaoDelegatedKeys(tao.Signing, tao.Parent())
options.FailIf(err, "server: failed to generate delegated keys")
// Create a certificate for the hp.
keys.Cert, err = keys.SigningKey.CreateSelfSignedX509(&pkix.Name{
Organization: []string{"Google Tao Demo"}})
options.FailIf(err, "server: couldn't create certificate")
g := domain.Guard
if *ca != "" {
// Replace keys.Delegation with a "says" statement directly from
// the policy key.
na, err := tao.RequestTruncatedAttestation(network, *ca, keys, domain.Keys.VerifyingKey)
options.FailIf(err, "server: truncated attestation request failed")
keys.Delegation = na
g, err = newTempCAGuard(domain.Keys.VerifyingKey)
options.FailIf(err, "server: couldn't set up a new guard")
}
tlsc, err := tao.EncodeTLSCert(keys)
options.FailIf(err, "server: couldn't encode TLS certificate")
conf := &tls.Config{
RootCAs: x509.NewCertPool(),
Certificates: []tls.Certificate{*tlsc},
InsecureSkipVerify: true,
ClientAuth: tls.RequireAnyClientCert,
}
if *demoAuth == "tao" {
sock, err = tao.Listen(network, serverAddr, conf, g, domain.Keys.VerifyingKey, keys.Delegation)
options.FailIf(err, "sever: couldn't create a taonet listener")
} else {
sock, err = tls.Listen(network, serverAddr, conf)
options.FailIf(err, "server: couldn't create a tls listener")
}
}
fmt.Printf("server: listening at %s using %s authentication.\n", serverAddr, *demoAuth)
defer sock.Close()
pings := make(chan bool, 5)
connCount := 0
go func() {
for connCount = 0; connCount < *pingCount || *pingCount < 0; connCount++ { // negative means forever
conn, err := sock.Accept()
options.FailIf(err, "server: can't accept connection")
go doResponse(conn, pings)
}
}()
pingGood := 0
pingFail := 0
for {
select {
case ok := <-pings:
if ok {
pingGood++
} else {
pingFail++
}
}
}
}