Message ID | 1286438126-11250-4-git-send-email-kraxel@redhat.com |
---|---|
State | New |
Headers | show |
Am 07.10.2010 09:55, schrieb Gerd Hoffmann: > This allows to enforce tls or plaintext usage for certain spice > channels. > --- > qemu-config.c | 6 ++++++ > qemu-options.hx | 8 ++++++++ > ui/spice-core.c | 25 +++++++++++++++++++++++++ > 3 files changed, 39 insertions(+), 0 deletions(-) > > diff --git a/qemu-config.c b/qemu-config.c > index 8b545b1..f52e50c 100644 > --- a/qemu-config.c > +++ b/qemu-config.c > @@ -392,6 +392,12 @@ QemuOptsList qemu_spice_opts = { > .name = "tls-ciphers", > .type = QEMU_OPT_STRING, > },{ > + .name = "tls-channel", > + .type = QEMU_OPT_STRING, > + },{ > + .name = "plaintext-channel", > + .type = QEMU_OPT_STRING, > + },{ > .name = "image-compression", > .type = QEMU_OPT_STRING, > },{ > diff --git a/qemu-options.hx b/qemu-options.hx > index 59db632..bb45b67 100644 > --- a/qemu-options.hx > +++ b/qemu-options.hx > @@ -704,6 +704,14 @@ The x509 file names can also be configured individually. > @item tls-ciphers=<list> > Specify which ciphers to use. > > +@item tls-channel=[main|display|inputs|record|playback|tunnel] > +@item plaintext-channel=[main|display|inputs|record|playback|tunnel] > +Force specific channel to be used with or without TLS encryption. The > +options can be specified multiple times to configure multiple > +channels. The special name "default" can be used to set the default > +mode. For channels which are not explicitly forced into one mode the > +spice client is allowed to pick tls/plaintext as he pleases. > + > @item image-compression=[auto_glz|auto_lz|quic|glz|lz|off] > Configure image compression (lossless). > Default is auto_glz. > diff --git a/ui/spice-core.c b/ui/spice-core.c > index 1567046..8f73848 100644 > --- a/ui/spice-core.c > +++ b/ui/spice-core.c > @@ -192,6 +192,29 @@ static const char *wan_compression_names[] = { > > /* functions for the rest of qemu */ > > +static int add_channel(const char *name, const char *value, void *opaque) > +{ > + int security = 0; > + int rc; > + > + if (strcmp(name, "tls-channel") == 0) > + security = SPICE_CHANNEL_SECURITY_SSL; > CODING_STYLE (if (...) { ... })? Same in next lines. > + if (strcmp(name, "plaintext-channel") == 0) > + security = SPICE_CHANNEL_SECURITY_NONE; > + if (security == 0) > + return 0; > + if (strcmp(value, "default") == 0) { > + rc = spice_server_set_channel_security(spice_server, NULL, security); > + } else { > + rc = spice_server_set_channel_security(spice_server, value, security); > + } > + if (rc != 0) { > + fprintf(stderr, "spice: failed to set channel security for %s\n", value); > + exit(1); > + } > + return 0; > +} > + > void qemu_spice_init(void) > { > QemuOpts *opts = QTAILQ_FIRST(&qemu_spice_opts.head); > @@ -293,6 +316,8 @@ void qemu_spice_init(void) > } > spice_server_set_zlib_glz_compression(spice_server, wan_compr); > > + qemu_opt_foreach(opts, add_channel, NULL, 0); > + > spice_server_init(spice_server,&core_interface); > using_spice = 1; > >
>> + if (strcmp(name, "tls-channel") == 0) >> + security = SPICE_CHANNEL_SECURITY_SSL; > > CODING_STYLE (if (...) { ... })? Same in next lines. Oops. Slipped through, will fix. thanks, Gerd
diff --git a/qemu-config.c b/qemu-config.c index 8b545b1..f52e50c 100644 --- a/qemu-config.c +++ b/qemu-config.c @@ -392,6 +392,12 @@ QemuOptsList qemu_spice_opts = { .name = "tls-ciphers", .type = QEMU_OPT_STRING, },{ + .name = "tls-channel", + .type = QEMU_OPT_STRING, + },{ + .name = "plaintext-channel", + .type = QEMU_OPT_STRING, + },{ .name = "image-compression", .type = QEMU_OPT_STRING, },{ diff --git a/qemu-options.hx b/qemu-options.hx index 59db632..bb45b67 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -704,6 +704,14 @@ The x509 file names can also be configured individually. @item tls-ciphers=<list> Specify which ciphers to use. +@item tls-channel=[main|display|inputs|record|playback|tunnel] +@item plaintext-channel=[main|display|inputs|record|playback|tunnel] +Force specific channel to be used with or without TLS encryption. The +options can be specified multiple times to configure multiple +channels. The special name "default" can be used to set the default +mode. For channels which are not explicitly forced into one mode the +spice client is allowed to pick tls/plaintext as he pleases. + @item image-compression=[auto_glz|auto_lz|quic|glz|lz|off] Configure image compression (lossless). Default is auto_glz. diff --git a/ui/spice-core.c b/ui/spice-core.c index 1567046..8f73848 100644 --- a/ui/spice-core.c +++ b/ui/spice-core.c @@ -192,6 +192,29 @@ static const char *wan_compression_names[] = { /* functions for the rest of qemu */ +static int add_channel(const char *name, const char *value, void *opaque) +{ + int security = 0; + int rc; + + if (strcmp(name, "tls-channel") == 0) + security = SPICE_CHANNEL_SECURITY_SSL; + if (strcmp(name, "plaintext-channel") == 0) + security = SPICE_CHANNEL_SECURITY_NONE; + if (security == 0) + return 0; + if (strcmp(value, "default") == 0) { + rc = spice_server_set_channel_security(spice_server, NULL, security); + } else { + rc = spice_server_set_channel_security(spice_server, value, security); + } + if (rc != 0) { + fprintf(stderr, "spice: failed to set channel security for %s\n", value); + exit(1); + } + return 0; +} + void qemu_spice_init(void) { QemuOpts *opts = QTAILQ_FIRST(&qemu_spice_opts.head); @@ -293,6 +316,8 @@ void qemu_spice_init(void) } spice_server_set_zlib_glz_compression(spice_server, wan_compr); + qemu_opt_foreach(opts, add_channel, NULL, 0); + spice_server_init(spice_server, &core_interface); using_spice = 1;