rpms/libvirt
3
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
7c228b7521
libvirt/libvirt-add-default-spice-channel.patch
Cole Robinson 7c228b7521 Rebased to version 0.9.11.4 
Fix libnuma dependency (bz 812874)
Fix USB device attach ambiguity CVE-2012-2693 (bz 816560)
Add bundled(gnulib) provides (bz 821776)
Drop unneeded systemd unit deps (bz 824204)
Update qemu.conf augeas lens (bz 824672)
Fix several double close bugs (bz 827125)
Fix potential deadlock when launching sub processes (bz 828565)
2012-06-15 16:13:45 -04:00

181 lines
8.1 KiB
Diff
Raw Blame History

From f3997733f0bca081d71848e66ca7d728b4c0a864 Mon Sep 17 00:00:00 2001
From: Alon Levy <alevy@redhat.com>
Date: Tue, 8 May 2012 20:42:44 +0300
Subject: [PATCH] domain_conf: add "default" to list of valid spice channels
qemu's behavior in this case is to change the spice server behavior to
require secure connection to any channel not otherwise specified as
being in plaintext mode. libvirt doesn't currently allow requesting this
(via plaintext-channel=<channel name>).
RHBZ: 819499
Signed-off-by: Alon Levy <alevy@redhat.com>
(cherry picked from commit ba97e4edc6aa439a4f1e70855cf4503181efdb7f)
Signed-off-by: Cole Robinson <crobinso@redhat.com>
---
docs/formatdomain.html.in | 7 +++++++
docs/schemas/domaincommon.rng | 9 +++++++++
src/conf/domain_conf.c | 20 ++++++++++++++++++++
src/conf/domain_conf.h | 1 +
src/qemu/qemu_command.c | 13 +++++++++++++
.../qemuxml2argv-graphics-spice.args | 2 +-
.../qemuxml2argv-graphics-spice.xml | 2 +-
7 files changed, 52 insertions(+), 2 deletions(-)
diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in
index e33913f..4a70b0f 100644
--- a/docs/formatdomain.html.in
+++ b/docs/formatdomain.html.in
@@ -2913,6 +2913,13 @@ qemu-kvm -net nic,model=? /dev/null
<span class="since">Since 0.9.3</span>
NB, this may not be supported by all hypervisors.
<span class="since">"spice" since 0.8.6</span>.
+ The <code>defaultMode</code> attribute sets the default channel
+ security policy, valid values are <code>secure</code>,
+ <code>insecure</code> and the default <code>any</code>
+ (which is secure if possible, but falls back to insecure
+ rather than erroring out if no secure path is
+ available). <span class="since">"defaultMode" since
+ 0.9.12</span>.
</p>
<p>
When SPICE has both a normal and TLS secured TCP port
diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng
index 5bcf1b9..30ab4c6 100644
--- a/docs/schemas/domaincommon.rng
+++ b/docs/schemas/domaincommon.rng
@@ -1779,6 +1779,15 @@
</choice>
</attribute>
</optional>
+ <optional>
+ <attribute name="defaultMode">
+ <choice>
+ <value>any</value>
+ <value>secure</value>
+ <value>insecure</value>
+ </choice>
+ </attribute>
+ </optional>
<interleave>
<ref name="listenElements"/>
<zeroOrMore>
diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
index d017ea4..2b21b11 100644
--- a/src/conf/domain_conf.c
+++ b/src/conf/domain_conf.c
@@ -6069,6 +6069,8 @@ virDomainGraphicsDefParseXML(xmlNodePtr node,
char *port = virXMLPropString(node, "port");
char *tlsPort;
char *autoport;
+ char *defaultMode;
+ int defaultModeVal;
if (port) {
if (virStrToLong_i(port, NULL, 10, &def->data.spice.port) < 0) {
@@ -6101,6 +6103,20 @@ virDomainGraphicsDefParseXML(xmlNodePtr node,
VIR_FREE(autoport);
}
+ def->data.spice.defaultMode = VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_MODE_ANY;
+
+ if ((defaultMode = virXMLPropString(node, "defaultMode")) != NULL) {
+ if ((defaultModeVal = virDomainGraphicsSpiceChannelModeTypeFromString(defaultMode)) < 0) {
+ virDomainReportError(VIR_ERR_INTERNAL_ERROR,
+ _("unknown default spice channel mode %s"),
+ defaultMode);
+ VIR_FREE(defaultMode);
+ goto error;
+ }
+ def->data.spice.defaultMode = defaultModeVal;
+ VIR_FREE(defaultMode);
+ }
+
if (def->data.spice.port == -1 && def->data.spice.tlsPort == -1) {
/* Legacy compat syntax, used -1 for auto-port */
def->data.spice.autoport = 1;
@@ -12111,6 +12127,10 @@ virDomainGraphicsDefFormat(virBufferPtr buf,
virBufferEscapeString(buf, " keymap='%s'",
def->data.spice.keymap);
+ if (def->data.spice.defaultMode != VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_MODE_ANY)
+ virBufferAsprintf(buf, " defaultMode='%s'",
+ virDomainGraphicsSpiceChannelModeTypeToString(def->data.spice.defaultMode));
+
virDomainGraphicsAuthDefFormatAttr(buf, &def->data.spice.auth, flags);
break;
diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h
index a2fea00..62eaafb 100644
--- a/src/conf/domain_conf.h
+++ b/src/conf/domain_conf.h
@@ -1233,6 +1233,7 @@ struct _virDomainGraphicsDef {
virDomainGraphicsAuthDef auth;
unsigned int autoport :1;
int channels[VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_LAST];
+ int defaultMode; /* enum virDomainGraphicsSpiceChannelMode */
int image;
int jpeg;
int zlib;
diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
index 55e772f..f411712 100644
--- a/src/qemu/qemu_command.c
+++ b/src/qemu/qemu_command.c
@@ -5499,6 +5499,7 @@ qemuBuildCommandLine(virConnectPtr conn,
const char *listenAddr = NULL;
char *netAddr = NULL;
int ret;
+ int defaultMode = def->graphics[0]->data.spice.defaultMode;
if (!qemuCapsGet(qemuCaps, QEMU_CAPS_SPICE)) {
qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
@@ -5582,6 +5583,18 @@ qemuBuildCommandLine(virConnectPtr conn,
virBufferAsprintf(&opt, ",x509-dir=%s",
driver->spiceTLSx509certdir);
+ switch (defaultMode) {
+ case VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_MODE_SECURE:
+ virBufferAsprintf(&opt, ",tls-channel=default");
+ break;
+ case VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_MODE_INSECURE:
+ virBufferAsprintf(&opt, ",plaintext-channel=default");
+ break;
+ case VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_MODE_ANY:
+ /* nothing */
+ break;
+ }
+
for (i = 0 ; i < VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_LAST ; i++) {
int mode = def->graphics[0]->data.spice.channels[i];
switch (mode) {
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.args b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.args
index c9fdb99..698e39c 100644
--- a/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.args
+++ b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.args
@@ -2,7 +2,7 @@ LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=spice \
/usr/bin/qemu -S -M pc -m 214 -smp 1 -nodefaults -monitor \
unix:/tmp/test-monitor,server,nowait -no-acpi -boot c -hda \
/dev/HostVG/QEMUGuest1 -usb -spice port=5903,tls-port=5904,addr=127.0.0.1,\
-x509-dir=/etc/pki/libvirt-spice,tls-channel=main,plaintext-channel=inputs,\
+x509-dir=/etc/pki/libvirt-spice,tls-channel=default,tls-channel=main,plaintext-channel=inputs,\
image-compression=auto_glz,jpeg-wan-compression=auto,zlib-glz-wan-compression=auto,\
playback-compression=on,streaming-video=filter,disable-copy-paste -vga \
qxl -global qxl.vram_size=18874368 -device qxl,id=video1,vram_size=33554432,bus=pci.0,addr=0x4 \
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.xml b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.xml
index 8930b60..a3789f2 100644
--- a/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.xml
+++ b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.xml
@@ -22,7 +22,7 @@
<controller type='usb' index='0'/>
<controller type='ide' index='0'/>
<input type='mouse' bus='ps2'/>
- <graphics type='spice' port='5903' tlsPort='5904' autoport='no' listen='127.0.0.1'>
+ <graphics type='spice' port='5903' tlsPort='5904' autoport='no' listen='127.0.0.1' defaultMode='secure'>
<listen type='address' address='127.0.0.1'/>
<channel name='main' mode='secure'/>
<channel name='inputs' mode='insecure'/>
--
1.7.7.6
Reference in New Issue View Git Blame Copy Permalink