page-xfer: Add TLS support with X509 certificates

This commit adds Transport Layer Security (TLS) support for remote
page-server connections.

The following command-line options are introduced with this commit:

--tls-cacert  FILE    Trust certificates signed only by this CA
--tls-cacrl   FILE    CA certificate revocation list
--tls-cert    FILE    TLS certificate
--tls-key     FILE    TLS private key
--tls                   Use TLS to secure remote connections

The default PKI locations are:

CA certificate              /etc/pki/CA/cacert.pem
CA revocation list          /etc/pki/CA/cacrl.pem
Client/server certificate   /etc/pki/criu/cert.pem
Client/server private key   /etc/pki/criu/private/key.pem

The files cacert.pem and cacrl.pem are optional. If they are not
present, and not explicitly specified with a command-line option,
CRIU will use only the system's trusted CAs to verify the remote
peer's identity. This implies that if a CA certificate is specified
using "--tls-cacert" only this CA will be used for verification.
If CA certificate (cacert.pem) is not present, certificate revocation
list (cacrl.pem) will be ignored.

Both (client and server) sides require a private key and certificate.

When the "--tls" option is specified, a TLS handshake (key exchange)
will be performed immediately after the remote TCP connection has been
accepted.

X.509 certificates can be generated as follows:
-------------------------%<-------------------------
	# Generate CA key and certificate
	echo -ne "ca\ncert_signing_key" > temp
	certtool --generate-privkey > cakey.pem
	certtool --generate-self-signed \
	    --template temp \
	    --load-privkey cakey.pem \
	    --outfile cacert.pem

	# Generate server key and certificate
	echo -ne "cn=$HOSTNAME\nencryption_key\nsigning_key" > temp
	certtool --generate-privkey > key.pem
	certtool --generate-certificate \
	    --template temp \
	    --load-privkey key.pem \
	    --load-ca-certificate cacert.pem \
	    --load-ca-privkey cakey.pem \
	    --outfile cert.pem
	rm temp

	mkdir -p /etc/pki/CA
	mkdir -p /etc/pki/criu/private

	mv cacert.pem /etc/pki/CA/
	mv cert.pem /etc/pki/criu/
	mv key.pem /etc/pki/criu/private
-------------------------%<-------------------------

Usage Example:

Page-server:

 [src]# criu page-server -D <PATH> --port <PORT> --tls

 [dst]# criu dump --page-server --address <SRC> --port <PORT> \
	-t <PID> -D <PATH> --tls

Lazy migration:

 [src]# criu dump --lazy-pages --port <PORT> -t <PID> -D <PATH> --tls

 [dst]# criu lazy-pages --page-server --address <SRC> --port <PORT> \
	-D <PATH> --tls

 [dst]# criu restore -D <PATH> --lazy-pages

Signed-off-by: Radostin Stoyanov <rstoyanov1@gmail.com>

1 files changed, 1 insertions, 0 deletions

diff --git a/Makefile b/Makefile
index 09cf2406a..9d83862d1 100644
--- a/Makefile
+++ b/Makefile
@@ -193,6 +193,7 @@ include Makefile.config
 else
 # To clean all files, enable make/build options here
 export CONFIG_COMPAT := y
+export CONFIG_GNUTLS := y
 endif
 
 #