lxc/lxd — pull request #50 by hallyn (2014-11-18 17:20:45+00:00)
Title: Introduce the bulk of certification code

This partially (largely) addresses https://github.com/lxc/lxd/issues/4

Client and server talk over tlsv1.2

Client and server each create a x509 certificate on first startup.

Server has a 'admin password' which can be set over the local unix
socket, or by a trusted remote lxc using 'lxc config set remote password xxx'

When a client does 'lxc remote add r1 127.0.0.1:5555', it will check
127.0.0.1:5555/ping to check whether it is already trusted (meaning
its certificate is already on the server's list of trusted certs). If not,
then it will query the user for the server's admin password, and pass that
along over 127.0.0.1:5555/trust/add to request adding the client's cert
to the server's list of trusted certs.

All (non-unix-socket) requests except for /trust/add are rejected by
the server unless the client's certificate is trusted.

To have a client present the server certificate fingerprint to the user
will require golang 1.3. So that will come soon.

The result at the moment is fully usable and an improvement over the
master branch.

Signed-off-by: Serge Hallyn