boot root filesystem over tls

boot root filesystem over tls

[mischief]

[-- Attachment #1: Type: text/plain, Size: 240 bytes --]

attached is a diff to boot the root filesystem over tls. a new bootargs argument is added, tcptls. if used, the fingerprint of the remote server is checked against fsthumb=, set in plan9.ini, in thumbprint(6) format.

any comments on this?

[-- Attachment #2: Type: text/plain, Size: 1257 bytes --]

diff -r 27d6b9ab8cce sys/src/9/boot/bootfs.proto
--- a/sys/src/9/boot/bootfs.proto	Fri Jan 23 14:01:56 2015 +0100
+++ b/sys/src/9/boot/bootfs.proto	Sat Jan 24 16:12:33 2015 -0800
@@ -35,6 +35,7 @@
 		sleep
 		srv
 		test
+		tlsclient
 		unmount
 		nusb
 			usbd
diff -r 27d6b9ab8cce sys/src/9/boot/bootrc
--- a/sys/src/9/boot/bootrc	Fri Jan 23 14:01:56 2015 +0100
+++ b/sys/src/9/boot/bootrc	Sat Jan 24 16:12:33 2015 -0800
@@ -66,7 +66,7 @@
 		if(~ $#nobootprompt 0){
 			echo
 			showlocaldevs
-			ask bootargs ' is (tcp, il, local!device)' $"bootargs
+			ask bootargs ' is (tcp, tcptls, il, local!device)' $"bootargs
 		}
 		if not bootargs=$nobootprompt
 		nobootprompt=()
diff -r 27d6b9ab8cce sys/src/9/boot/net.rc
--- a/sys/src/9/boot/net.rc	Fri Jan 23 14:01:56 2015 +0100
+++ b/sys/src/9/boot/net.rc	Sat Jan 24 16:12:33 2015 -0800
@@ -48,6 +48,12 @@
 	fs=$fs(1)
 }
 
+fn connecttcptls{
+	while(! ~ $#fs 0 && ! srv -qe 'tlsclient -t <{echo $fsthumb} tcp!'^$fs(1)^!5564 boot)
+		fs=$fs(2-);
+	fs=$fs(1)
+}
+
 fn connectil{
 	while(! ~ $#fs 0 && ! srv -q il!$fs(1)^!17008 boot)
 		fs=$fs(2-);
@@ -55,5 +61,7 @@
 }
 
 mtcp=(confignet connecttcp)
+mtcptls=(confignet connecttcptls)
 mil=(confignet connectil)
-mt=(mtcp mil $mt)
+mt=(mtcp mtcptls mil $mt)
+