Patchwork [3/5] spice: add config options for channel security.

login
register
mail settings
Submitter Gerd Hoffmann
Date Oct. 7, 2010, 7:55 a.m.
Message ID <1286438126-11250-4-git-send-email-kraxel@redhat.com>
Download mbox | patch
Permalink /patch/67007/
State New
Headers show

Comments

Gerd Hoffmann - Oct. 7, 2010, 7:55 a.m.
This allows to enforce tls or plaintext usage for certain spice
channels.
---
 qemu-config.c   |    6 ++++++
 qemu-options.hx |    8 ++++++++
 ui/spice-core.c |   25 +++++++++++++++++++++++++
 3 files changed, 39 insertions(+), 0 deletions(-)
Stefan Weil - Oct. 7, 2010, 6:43 p.m.
Am 07.10.2010 09:55, schrieb Gerd Hoffmann:
> This allows to enforce tls or plaintext usage for certain spice
> channels.
> ---
>   qemu-config.c   |    6 ++++++
>   qemu-options.hx |    8 ++++++++
>   ui/spice-core.c |   25 +++++++++++++++++++++++++
>   3 files changed, 39 insertions(+), 0 deletions(-)
>
> diff --git a/qemu-config.c b/qemu-config.c
> index 8b545b1..f52e50c 100644
> --- a/qemu-config.c
> +++ b/qemu-config.c
> @@ -392,6 +392,12 @@ QemuOptsList qemu_spice_opts = {
>               .name = "tls-ciphers",
>               .type = QEMU_OPT_STRING,
>           },{
> +            .name = "tls-channel",
> +            .type = QEMU_OPT_STRING,
> +        },{
> +            .name = "plaintext-channel",
> +            .type = QEMU_OPT_STRING,
> +        },{
>               .name = "image-compression",
>               .type = QEMU_OPT_STRING,
>           },{
> diff --git a/qemu-options.hx b/qemu-options.hx
> index 59db632..bb45b67 100644
> --- a/qemu-options.hx
> +++ b/qemu-options.hx
> @@ -704,6 +704,14 @@ The x509 file names can also be configured individually.
>   @item tls-ciphers=<list>
>   Specify which ciphers to use.
>
> +@item tls-channel=[main|display|inputs|record|playback|tunnel]
> +@item plaintext-channel=[main|display|inputs|record|playback|tunnel]
> +Force specific channel to be used with or without TLS encryption.  The
> +options can be specified multiple times to configure multiple
> +channels.  The special name "default" can be used to set the default
> +mode.  For channels which are not explicitly forced into one mode the
> +spice client is allowed to pick tls/plaintext as he pleases.
> +
>   @item image-compression=[auto_glz|auto_lz|quic|glz|lz|off]
>   Configure image compression (lossless).
>   Default is auto_glz.
> diff --git a/ui/spice-core.c b/ui/spice-core.c
> index 1567046..8f73848 100644
> --- a/ui/spice-core.c
> +++ b/ui/spice-core.c
> @@ -192,6 +192,29 @@ static const char *wan_compression_names[] = {
>
>   /* functions for the rest of qemu */
>
> +static int add_channel(const char *name, const char *value, void *opaque)
> +{
> +    int security = 0;
> +    int rc;
> +
> +    if (strcmp(name, "tls-channel") == 0)
> +        security = SPICE_CHANNEL_SECURITY_SSL;
>    

CODING_STYLE (if (...) { ... })? Same in next lines.

> +    if (strcmp(name, "plaintext-channel") == 0)
> +        security = SPICE_CHANNEL_SECURITY_NONE;
> +    if (security == 0)
> +        return 0;
> +    if (strcmp(value, "default") == 0) {
> +        rc = spice_server_set_channel_security(spice_server, NULL, security);
> +    } else {
> +        rc = spice_server_set_channel_security(spice_server, value, security);
> +    }
> +    if (rc != 0) {
> +        fprintf(stderr, "spice: failed to set channel security for %s\n", value);
> +        exit(1);
> +    }
> +    return 0;
> +}
> +
>   void qemu_spice_init(void)
>   {
>       QemuOpts *opts = QTAILQ_FIRST(&qemu_spice_opts.head);
> @@ -293,6 +316,8 @@ void qemu_spice_init(void)
>       }
>       spice_server_set_zlib_glz_compression(spice_server, wan_compr);
>
> +    qemu_opt_foreach(opts, add_channel, NULL, 0);
> +
>       spice_server_init(spice_server,&core_interface);
>       using_spice = 1;
>
>
Gerd Hoffmann - Oct. 7, 2010, 7:26 p.m.
>> + if (strcmp(name, "tls-channel") == 0)
>> + security = SPICE_CHANNEL_SECURITY_SSL;
>
> CODING_STYLE (if (...) { ... })? Same in next lines.

Oops.  Slipped through, will fix.

thanks,
   Gerd

Patch

diff --git a/qemu-config.c b/qemu-config.c
index 8b545b1..f52e50c 100644
--- a/qemu-config.c
+++ b/qemu-config.c
@@ -392,6 +392,12 @@  QemuOptsList qemu_spice_opts = {
             .name = "tls-ciphers",
             .type = QEMU_OPT_STRING,
         },{
+            .name = "tls-channel",
+            .type = QEMU_OPT_STRING,
+        },{
+            .name = "plaintext-channel",
+            .type = QEMU_OPT_STRING,
+        },{
             .name = "image-compression",
             .type = QEMU_OPT_STRING,
         },{
diff --git a/qemu-options.hx b/qemu-options.hx
index 59db632..bb45b67 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -704,6 +704,14 @@  The x509 file names can also be configured individually.
 @item tls-ciphers=<list>
 Specify which ciphers to use.
 
+@item tls-channel=[main|display|inputs|record|playback|tunnel]
+@item plaintext-channel=[main|display|inputs|record|playback|tunnel]
+Force specific channel to be used with or without TLS encryption.  The
+options can be specified multiple times to configure multiple
+channels.  The special name "default" can be used to set the default
+mode.  For channels which are not explicitly forced into one mode the
+spice client is allowed to pick tls/plaintext as he pleases.
+
 @item image-compression=[auto_glz|auto_lz|quic|glz|lz|off]
 Configure image compression (lossless).
 Default is auto_glz.
diff --git a/ui/spice-core.c b/ui/spice-core.c
index 1567046..8f73848 100644
--- a/ui/spice-core.c
+++ b/ui/spice-core.c
@@ -192,6 +192,29 @@  static const char *wan_compression_names[] = {
 
 /* functions for the rest of qemu */
 
+static int add_channel(const char *name, const char *value, void *opaque)
+{
+    int security = 0;
+    int rc;
+
+    if (strcmp(name, "tls-channel") == 0)
+        security = SPICE_CHANNEL_SECURITY_SSL;
+    if (strcmp(name, "plaintext-channel") == 0)
+        security = SPICE_CHANNEL_SECURITY_NONE;
+    if (security == 0)
+        return 0;
+    if (strcmp(value, "default") == 0) {
+        rc = spice_server_set_channel_security(spice_server, NULL, security);
+    } else {
+        rc = spice_server_set_channel_security(spice_server, value, security);
+    }
+    if (rc != 0) {
+        fprintf(stderr, "spice: failed to set channel security for %s\n", value);
+        exit(1);
+    }
+    return 0;
+}
+
 void qemu_spice_init(void)
 {
     QemuOpts *opts = QTAILQ_FIRST(&qemu_spice_opts.head);
@@ -293,6 +316,8 @@  void qemu_spice_init(void)
     }
     spice_server_set_zlib_glz_compression(spice_server, wan_compr);
 
+    qemu_opt_foreach(opts, add_channel, NULL, 0);
+
     spice_server_init(spice_server, &core_interface);
     using_spice = 1;