From patchwork Thu Oct 7 07:55:24 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gerd Hoffmann X-Patchwork-Id: 67007 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [199.232.76.165]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id BD317B70D2 for ; Thu, 7 Oct 2010 19:15:22 +1100 (EST) Received: from localhost ([127.0.0.1]:42146 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1P3ldI-0000lY-46 for incoming@patchwork.ozlabs.org; Thu, 07 Oct 2010 04:15:20 -0400 Received: from [140.186.70.92] (port=36335 helo=eggs.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1P3lKE-0006rU-8V for qemu-devel@nongnu.org; Thu, 07 Oct 2010 03:55:42 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1P3lKA-0003g5-AA for qemu-devel@nongnu.org; Thu, 07 Oct 2010 03:55:37 -0400 Received: from mx1.redhat.com ([209.132.183.28]:7792) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1P3lKA-0003fI-3h for qemu-devel@nongnu.org; Thu, 07 Oct 2010 03:55:34 -0400 Received: from int-mx02.intmail.prod.int.phx2.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id o977tXAv014913 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Thu, 7 Oct 2010 03:55:33 -0400 Received: from rincewind.home.kraxel.org (vpn1-5-214.ams2.redhat.com [10.36.5.214]) by int-mx02.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id o977tSis023320; Thu, 7 Oct 2010 03:55:30 -0400 Received: by rincewind.home.kraxel.org (Postfix, from userid 500) id 0BC8C454B5; Thu, 7 Oct 2010 09:55:26 +0200 (CEST) From: Gerd Hoffmann To: qemu-devel@nongnu.org Date: Thu, 7 Oct 2010 09:55:24 +0200 Message-Id: <1286438126-11250-4-git-send-email-kraxel@redhat.com> In-Reply-To: <1286438126-11250-1-git-send-email-kraxel@redhat.com> References: <1286438126-11250-1-git-send-email-kraxel@redhat.com> X-Scanned-By: MIMEDefang 2.67 on 10.5.11.12 X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. Cc: Gerd Hoffmann Subject: [Qemu-devel] [PATCH 3/5] spice: add config options for channel security. X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org This allows to enforce tls or plaintext usage for certain spice channels. --- qemu-config.c | 6 ++++++ qemu-options.hx | 8 ++++++++ ui/spice-core.c | 25 +++++++++++++++++++++++++ 3 files changed, 39 insertions(+), 0 deletions(-) diff --git a/qemu-config.c b/qemu-config.c index 8b545b1..f52e50c 100644 --- a/qemu-config.c +++ b/qemu-config.c @@ -392,6 +392,12 @@ QemuOptsList qemu_spice_opts = { .name = "tls-ciphers", .type = QEMU_OPT_STRING, },{ + .name = "tls-channel", + .type = QEMU_OPT_STRING, + },{ + .name = "plaintext-channel", + .type = QEMU_OPT_STRING, + },{ .name = "image-compression", .type = QEMU_OPT_STRING, },{ diff --git a/qemu-options.hx b/qemu-options.hx index 59db632..bb45b67 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -704,6 +704,14 @@ The x509 file names can also be configured individually. @item tls-ciphers= Specify which ciphers to use. +@item tls-channel=[main|display|inputs|record|playback|tunnel] +@item plaintext-channel=[main|display|inputs|record|playback|tunnel] +Force specific channel to be used with or without TLS encryption. The +options can be specified multiple times to configure multiple +channels. The special name "default" can be used to set the default +mode. For channels which are not explicitly forced into one mode the +spice client is allowed to pick tls/plaintext as he pleases. + @item image-compression=[auto_glz|auto_lz|quic|glz|lz|off] Configure image compression (lossless). Default is auto_glz. diff --git a/ui/spice-core.c b/ui/spice-core.c index 1567046..8f73848 100644 --- a/ui/spice-core.c +++ b/ui/spice-core.c @@ -192,6 +192,29 @@ static const char *wan_compression_names[] = { /* functions for the rest of qemu */ +static int add_channel(const char *name, const char *value, void *opaque) +{ + int security = 0; + int rc; + + if (strcmp(name, "tls-channel") == 0) + security = SPICE_CHANNEL_SECURITY_SSL; + if (strcmp(name, "plaintext-channel") == 0) + security = SPICE_CHANNEL_SECURITY_NONE; + if (security == 0) + return 0; + if (strcmp(value, "default") == 0) { + rc = spice_server_set_channel_security(spice_server, NULL, security); + } else { + rc = spice_server_set_channel_security(spice_server, value, security); + } + if (rc != 0) { + fprintf(stderr, "spice: failed to set channel security for %s\n", value); + exit(1); + } + return 0; +} + void qemu_spice_init(void) { QemuOpts *opts = QTAILQ_FIRST(&qemu_spice_opts.head); @@ -293,6 +316,8 @@ void qemu_spice_init(void) } spice_server_set_zlib_glz_compression(spice_server, wan_compr); + qemu_opt_foreach(opts, add_channel, NULL, 0); + spice_server_init(spice_server, &core_interface); using_spice = 1;