Add support for gRPC authenticated communications

Also, make a few namespace corrections and some minor refactoring.

Change-Id: Iedcaf6b43cb7576bc11dfefe980abd190c838831

authentication/01gen_root_cert.sh

@@ -0,0 +1,30 @@
+#!/bin/bash
+
+# This script should be called only once to generate a root
+# certificate
+
+mkdir -p CA
+pushd CA
+mkdir private newcerts
+chmod 700 private newcerts
+
+#  Our next step is to create a database for the certificates we will sign:
+echo '01' >serial
+touch index.txt
+
+# openssl_part1.cnf
+
+# Create the Root Certificate
+# This call of openssl encrypts the keys
+# openssl req -new -x509 extensions v3_ca -keyout private/rdc_cakey.pem \
+#	 -out rdc_cacert.pem -days 3650 -config ../openssl.cnf
+
+# This call of openssl does not encrypt the keys
+openssl req -new -x509 -nodes -extensions v3_ca -keyout private/rdc_cakey.pem \
+	 -out rdc_cacert.pem -days 3650 -config ../openssl.cnf
+# This generates:
+# A private key in private/rdc_cakey.pem
+# A root CA certificate in rdc_cacert.pem (distribute to clients)
+
+popd
+

authentication/02gen_ssl_artifacts.sh

@@ -0,0 +1,42 @@
+#!/bin/bash
+
+# This script generates ssl keys and self-signed certificates
+
+INSTALL_RT="artifacts"
+
+generate_artifacts() {
+  HOST=$1
+  echo "**********************************"
+  echo "*** Generating $HOST artifacts ***"
+  echo "**********************************"
+
+  mkdir -p ${INSTALL_RT}/${HOST}/private
+  mkdir -p ${INSTALL_RT}/${HOST}/certs
+
+  echo "Generate CSR..."
+  openssl req -new -nodes -out rdc_csr.pem -config ../openssl.cnf
+  echo "Sign Certificate..."
+  openssl ca -out rdc_${HOST}_cert.pem -config ../openssl.cnf -infiles rdc_csr.pem
+  mv rdc_${HOST}_cert.pem ${INSTALL_RT}/${HOST}/certs/
+  mv key.pem ${INSTALL_RT}/${HOST}/private/rdc_${HOST}_cert.key
+  cp rdc_cacert.pem ${INSTALL_RT}/${HOST}/certs/
+}
+
+pushd CA
+echo
+echo "**********************"
+echo "IMPORTANT:"
+echo " * Make sure to use the same hostname (wildcards accepted) each"
+echo "   time when prompted for \"Common Name\""
+echo " * Make sure to select \"y\" when you are asked whether you want"
+echo "   to sign the certificates"
+echo "**********************"
+echo
+generate_artifacts "server"
+generate_artifacts "client"
+rm rdc_cacert.pem
+cp ../install_client.sh ../install_server.sh $INSTALL_RT
+
+popd
+
+

authentication/install_client.sh

@@ -0,0 +1,15 @@
+#!/bin/bash
+
+# Note:
+# * This script should reside in the artifacts directory
+#   when executed.
+# * This script may require root privilege
+
+if [ $# -lt 1 ]; then
+  echo "Need to specify a installation root directory (e.g., /etc/rdc)"
+  exit 1
+fi
+
+INSTALL_DIR=$1
+cp -R client $INSTALL_DIR
+

authentication/install_server.sh

@@ -0,0 +1,18 @@
+#!/bin/bash
+
+# Note:
+# * This script should reside in the artifacts directory
+#   when executed.
+# * This script may require root privilege
+
+if [ $# -lt 1 ]; then
+  echo "Need to specify a installation root directory (e.g., /etc/rdc)"
+  exit 1
+fi
+
+INSTALL_DIR=$1
+cp -R server $INSTALL_DIR
+mkdir -p $INSTALL_DIR/client/certs
+cp client/certs/rdc_cacert.pem $INSTALL_DIR/client/certs
+chmod 700 $INSTALL_DIR/server/private
+

authentication/openssl.cnf

@@ -0,0 +1,88 @@
+#
+# OpenSSL configuration file.
+#
+
+# Establish working directory.
+
+dir			= .
+
+[ ca ]
+default_ca		= CA_default
+
+[ CA_default ]
+serial			= $dir/serial
+database		= $dir/index.txt
+new_certs_dir		= $dir/newcerts
+certificate		= $dir/rdc_cacert.pem
+private_key		= $dir/private/rdc_cakey.pem
+default_days		= 365
+default_md		= sha512
+preserve		= no
+email_in_dn		= no
+nameopt			= default_ca
+certopt			= default_ca
+policy			= policy_match
+unique_subject		= no
+
+[ policy_match ]
+countryName		= match
+stateOrProvinceName	= match
+organizationName	= match
+organizationalUnitName	= optional
+commonName		= supplied
+emailAddress		= optional
+
+[ req ]
+default_bits		= 4096			# Size of keys
+default_keyfile		= key.pem		# name of generated keys
+default_md		= sha512		# message digest algorithm
+string_mask		= nombstr		# permitted characters
+distinguished_name	= req_distinguished_name
+req_extensions		= v3_req
+
+[ req_distinguished_name ]
+# Variable name		  Prompt string
+#----------------------	  ----------------------------------
+0.organizationName	= Organization Name (company)
+organizationalUnitName	= Organizational Unit Name (department, division)
+emailAddress		= Email Address
+emailAddress_max	= 40
+localityName		= Locality Name (city, district)
+stateOrProvinceName	= State or Province Name (full name)
+countryName		= Country Name (2 letter code)
+countryName_min		= 2
+countryName_max		= 2
+commonName		= Common Name (hostname, IP, or your name)
+commonName_max		= 64
+
+#-------------------------------------------------------------------------------
+# Specify default values below for the fields above. This speeds things up if
+# and is more consistent if you have to run the openssl commands repeatedly.
+#-------------------------------------------------------------------------------
+# < ** REPLACE VALUES IN THIS SECTION WITH APPROPRIATE VALUES FOR YOUR ORG. **>
+0.organizationName_default	= MyCompany
+organizationalUnitName_default  = MyCompanyUnit
+emailAddress_default            = MyEmailAddress
+localityName_default		= MyCity
+stateOrProvinceName_default	= MyStateProvince
+countryName_default		= MC
+# wildcards are acceptable for domain; e.g., *.amd.com
+commonName_default              = Mydomain
+
+[ v3_ca ]
+basicConstraints	= CA:TRUE
+subjectKeyIdentifier	= hash
+authorityKeyIdentifier	= keyid:always,issuer:always
+
+[ v3_req ]
+basicConstraints	= CA:FALSE
+subjectKeyIdentifier	= hash
+
+[ req_ext ]
+subjectAltName = @alt_names
+
+[alt_names]
+# < ** MODIFY BELOW TO YOUR NEEDS. WILDCARDS ARE ACCEPTED. **>
+DNS.1   = localhost
+DNS.2   = another-website.dev
+