Merge pull request #49 from tych0/readme-subuids

Add a note about creating sub{u,g}ids in README.md
Introduce the bulk of certification code

This partially (largely) addresses https://github.com/lxc/lxd/issues/4

Client and server talk over tlsv1.2

Client and server each create a x509 certificate on first startup.

Server has a 'admin password' which can be set over the local unix
socket, or by a trusted remote lxc using 'lxc config set remote password xxx'

When a client does 'lxc remote add r1 127.0.0.1:5555', it will check
127.0.0.1:5555/ping to check whether it is already trusted (meaning
its certificate is already on the server's list of trusted certs).  If not,
then it will query the user for the server's admin password, and pass that
along over 127.0.0.1:5555/trust/add to request adding the client's cert
to the server's list of trusted certs.

All (non-unix-socket) requests except for /trust/add are rejected by
the server unless the client's certificate is trusted.

To have a client present the server certificate fingerprint to the user
will require golang 1.3.  So that will come soon.

The result at the moment is fully usable and an improvement over the
master branch.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
some updates

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
move 'set' from remote to config where it belongs

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
commonize the certificate creation boilerplate

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Merge pull request #51 from stgraber/master

Update REST API
tests: skip the remote tests for now

Until I can get lxd to run under travis

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
remove double return

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
switch snake case out in favor of camel case

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Merge pull request #50 from hallyn/cert.merge.1

Introduce the bulk of certification code
Merge pull request #52 from stgraber/master

REST API update
Move toward the actual REST api w/ json

This patch moves us more toward the rest API in the spec. ping and container
creation are now restificated (with the small caveat that create is currently a
sync response, I will implement async ASAP).

I've defined several helpers (/lxd/response.go) for generating the API-style
response json objects. I've also defined (/client.go) a Response that
represents a response from the API.

Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>
`go fmt` the patch

Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>
Add ApiCompat and use that instead of ApiVersion in ping

Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>
Merge pull request #53 from tych0/rest-refactoring

Move toward the actual REST api w/ json
remove 'lxc config set <remote> password foo'

After talking with Serge this command is slightly non-sensical, and it confuses
other config options we'd like to have.

Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>
Merge pull request #54 from tych0/remove-set-remote

remove 'lxc config set <remote> password foo'
Try to read remote pwd from stdin as a file

In case someone does 'echo foo | lxc remote add' (as we do in the tests), if we
get an ioctl error from trying to treat stdin as a tty, we should try to read
it as a file.

Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>
allow lxd to start w/o subuids

Per specs/userns-idmap.md, we should not fail to boot if there aren't enough
(or any) subuids, we should just not allow any operations that require
subuids.

This also re-enables the remote test.

Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>
Merge pull request #56 from tych0/start-with-no-subuids

Start with no subuids