diff -r 961d4b1ca1d3 qemud/libvirtd_qemu.aug

--- a/qemud/libvirtd_qemu.aug	Wed Mar 04 13:17:44 2009 +0000

+++ b/qemud/libvirtd_qemu.aug	Thu Mar 05 14:22:50 2009 +0000

@@ -27,6 +27,8 @@ module Libvirtd_qemu =

                  | str_entry "vnc_tls_x509_cert_dir"

                  | bool_entry "vnc_tls_x509_verify"

                  | str_entry "vnc_password"

+                 | bool_entry "vnc_sasl"

+                 | str_entry "vnc_sasl_dir"

    (* Each enty in the config is one of the following three ... *)

    let entry = vnc_entry

diff -r 961d4b1ca1d3 qemud/test_libvirtd_qemu.aug

--- a/qemud/test_libvirtd_qemu.aug	Wed Mar 04 13:17:44 2009 +0000

+++ b/qemud/test_libvirtd_qemu.aug	Thu Mar 05 14:22:50 2009 +0000

@@ -60,6 +60,25 @@ vnc_tls_x509_verify = 1

 # example here before you set this

 #

 vnc_password = \"XYZ12345\"

+

+

+# Enable use of SASL encryption on the VNC server. This requires

+# a VNC client which supports the SASL protocol extension.

+# Examples include vinagre, virt-viewer and virt-manager

+# itself. UltraVNC, RealVNC, TightVNC do not support this

+#

+# It is necessary to configure /etc/sasl2/qemu.conf to choose

+# the desired SASL plugin (eg, GSSPI for Kerberos)

+#

+vnc_sasl = 1

+

+

+# The default SASL configuration file is located in /etc/sasl2/

+# When running libvirtd unprivileged, it may be desirable to

+# override the configs in this location. Set this parameter to

+# point to the directory, and create a qemu.conf in that location

+#

+vnc_sasl_dir = \"/some/directory/sasl2\"

 "

    test Libvirtd_qemu.lns get conf =

@@ -123,3 +142,22 @@ vnc_password = \"XYZ12345\"

 { "#comment" = "example here before you set this" }

 { "#comment" = "" }

 { "vnc_password" = "XYZ12345" }

+{ "#empty" }

+{ "#empty" }

+{ "#comment" = "Enable use of SASL encryption on the VNC server. This requires" }

+{ "#comment" = "a VNC client which supports the SASL protocol extension." }

+{ "#comment" = "Examples include vinagre, virt-viewer and virt-manager" }

+{ "#comment" = "itself. UltraVNC, RealVNC, TightVNC do not support this" }

+{ "#comment" = "" }

+{ "#comment" = "It is necessary to configure /etc/sasl2/qemu.conf to choose" }

+{ "#comment" = "the desired SASL plugin (eg, GSSPI for Kerberos)" }

+{ "#comment" = "" }

+{ "vnc_sasl" = "1" }

+{ "#empty" }

+{ "#empty" }

+{ "#comment" = "The default SASL configuration file is located in /etc/sasl2/" }

+{ "#comment" = "When running libvirtd unprivileged, it may be desirable to" }

+{ "#comment" = "override the configs in this location. Set this parameter to" }

+{ "#comment" = "point to the directory, and create a qemu.conf in that location" }

+{ "#comment" = "" }

+{ "vnc_sasl_dir" = "/some/directory/sasl2" }

diff -r 961d4b1ca1d3 src/qemu.conf

--- a/src/qemu.conf	Wed Mar 04 13:17:44 2009 +0000

+++ b/src/qemu.conf	Thu Mar 05 14:22:50 2009 +0000

@@ -60,6 +60,27 @@

 # vnc_password = "XYZ12345"

+# Enable use of SASL encryption on the VNC server. This requires

+# a VNC client which supports the SASL protocol extension.

+# Examples include vinagre, virt-viewer and virt-manager

+# itself. UltraVNC, RealVNC, TightVNC do not support this

+#

+# It is necessary to configure /etc/sasl2/qemu.conf to choose

+# the desired SASL plugin (eg, GSSPI for Kerberos)

+#

+# vnc_sasl = 1

+

+

+# The default SASL configuration file is located in /etc/sasl2/

+# When running libvirtd unprivileged, it may be desirable to

+# override the configs in this location. Set this parameter to

+# point to the directory, and create a qemu.conf in that location

+#

+# vnc_sasl_dir = "/some/directory/sasl2"

+

+

+

+

 # The default security driver is SELinux. If SELinux is disabled

 # on the host, then the security driver will automatically disable

 # itself. If you wish to disable QEMU SELinux security driver while

diff -r 961d4b1ca1d3 src/qemu_conf.c

--- a/src/qemu_conf.c	Wed Mar 04 13:17:44 2009 +0000

+++ b/src/qemu_conf.c	Thu Mar 05 14:22:50 2009 +0000

@@ -161,6 +161,21 @@ int qemudLoadDriverConfig(struct qemud_d

         }

     }

+    p = virConfGetValue (conf, "vnc_sasl");

+    CHECK_TYPE ("vnc_sasl", VIR_CONF_LONG);

+    if (p) driver->vncSASL = p->l;

+

+    p = virConfGetValue (conf, "vnc_sasl_dir");

+    CHECK_TYPE ("vnc_sasl_dir", VIR_CONF_STRING);

+    if (p && p->str) {

+        VIR_FREE(driver->vncSASLdir);

+        if (!(driver->vncSASLdir = strdup(p->str))) {

+            virReportOOMError(NULL);

+            virConfFree(conf);

+            return -1;

+        }

+    }

+

     virConfFree (conf);

     return 0;

 }

@@ -838,15 +853,20 @@ int qemudBuildCommandLine(virConnectPtr 

             goto no_memory;                                             \

     } while (0)

+#define ADD_ENV_PAIR(envname, val)                                      \

+    do {                                                                \

+        char *envval;                                                   \

+        ADD_ENV_SPACE;                                                  \

+        if (virAsprintf(&envval, "%s=%s", envname, val) < 0)            \

+            goto no_memory;                                             \

+        qenv[qenvc++] = envval;                                         \

+    } while (0)

+

 #define ADD_ENV_COPY(envname)                                           \

     do {                                                                \

         char *val = getenv(envname);                                    \

-        char *envval;                                                   \

-        ADD_ENV_SPACE;                                                  \

         if (val != NULL) {                                              \

-            if (virAsprintf(&envval, "%s=%s", envname, val) < 0)        \

-                goto no_memory;                                         \

-            qenv[qenvc++] = envval;                                     \

+            ADD_ENV_PAIR(envname, val);                                 \

         }                                                               \

     } while (0)

@@ -1295,6 +1315,15 @@ int qemudBuildCommandLine(virConnectPtr 

                                       driver->vncTLSx509certdir);

                 }

             }

+

+            if (driver->vncSASL) {

+                virBufferAddLit(&opt, ",sasl");

+

+                if (driver->vncSASLdir)

+                    ADD_ENV_PAIR("SASL_CONF_DIR", driver->vncSASLdir);

+

+                /* TODO: Support ACLs later */

+            }

         } else {

             virBufferVSprintf(&opt, "%d",

                               vm->def->graphics->data.vnc.port - 5900);

diff -r 961d4b1ca1d3 src/qemu_conf.h

--- a/src/qemu_conf.h	Wed Mar 04 13:17:44 2009 +0000

+++ b/src/qemu_conf.h	Thu Mar 05 14:22:50 2009 +0000

@@ -73,9 +73,11 @@ struct qemud_driver {

     char *stateDir;

     unsigned int vncTLS : 1;

     unsigned int vncTLSx509verify : 1;

+    unsigned int vncSASL : 1;

     char *vncTLSx509certdir;

     char *vncListen;

     char *vncPassword;

+    char *vncSASLdir;

     virCapsPtr caps;

diff -r 961d4b1ca1d3 src/qemu_driver.c

--- a/src/qemu_driver.c	Wed Mar 04 13:17:44 2009 +0000

+++ b/src/qemu_driver.c	Thu Mar 05 14:22:50 2009 +0000

@@ -620,6 +620,7 @@ qemudShutdown(void) {

     VIR_FREE(qemu_driver->vncTLSx509certdir);

     VIR_FREE(qemu_driver->vncListen);

     VIR_FREE(qemu_driver->vncPassword);

+    VIR_FREE(qemu_driver->vncSASLdir);

     /* Free domain callback list */

     virDomainEventCallbackListFree(qemu_driver->domainEventCallbacks);

diff -r 961d4b1ca1d3 tests/qemuxml2argvdata/qemuxml2argv-graphics-vnc-sasl.args

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000

+++ b/tests/qemuxml2argvdata/qemuxml2argv-graphics-vnc-sasl.args	Thu Mar 05 14:22:50 2009 +0000

@@ -0,0 +1,1 @@

+LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test SASL_CONF_DIR=/root/.sasl2 /usr/bin/qemu -S -M pc -m 214 -smp 1 -monitor pty -pidfile /nowhere/QEMUGuest1.pid -no-acpi -boot c -hda /dev/HostVG/QEMUGuest1 -net none -serial none -parallel none -usb -vnc 127.0.0.1:3,sasl

diff -r 961d4b1ca1d3 tests/qemuxml2argvdata/qemuxml2argv-graphics-vnc-sasl.xml

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000

+++ b/tests/qemuxml2argvdata/qemuxml2argv-graphics-vnc-sasl.xml	Thu Mar 05 14:22:50 2009 +0000

@@ -0,0 +1,24 @@

+<domain type='qemu'>

+  <name>QEMUGuest1</name>

+  <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>

+  <memory>219200</memory>

+  <currentMemory>219200</currentMemory>

+  <vcpu>1</vcpu>

+  <os>

+    <type arch='i686' machine='pc'>hvm</type>

+    <boot dev='hd'/>

+  </os>

+  <clock offset='utc'/>

+  <on_poweroff>destroy</on_poweroff>

+  <on_reboot>restart</on_reboot>

+  <on_crash>destroy</on_crash>

+  <devices>

+    <emulator>/usr/bin/qemu</emulator>

+    <disk type='block' device='disk'>

+      <source dev='/dev/HostVG/QEMUGuest1'/>

+      <target dev='hda' bus='ide'/>

+    </disk>

+    <input type='mouse' bus='ps2'/>

+    <graphics type='vnc' port='5903' autoport='no' listen='127.0.0.1'/>

+  </devices>

+</domain>

diff -r 961d4b1ca1d3 tests/qemuxml2argvdata/qemuxml2argv-graphics-vnc-tls.args

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000

+++ b/tests/qemuxml2argvdata/qemuxml2argv-graphics-vnc-tls.args	Thu Mar 05 14:22:50 2009 +0000

@@ -0,0 +1,1 @@

+LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test SASL_CONF_DIR=/root/.sasl2 /usr/bin/qemu -S -M pc -m 214 -smp 1 -monitor pty -pidfile /nowhere/QEMUGuest1.pid -no-acpi -boot c -hda /dev/HostVG/QEMUGuest1 -net none -serial none -parallel none -usb -vnc 127.0.0.1:3,tls,x509verify=/etc/pki/tls/qemu,sasl

diff -r 961d4b1ca1d3 tests/qemuxml2argvdata/qemuxml2argv-graphics-vnc-tls.xml

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000

+++ b/tests/qemuxml2argvdata/qemuxml2argv-graphics-vnc-tls.xml	Thu Mar 05 14:22:50 2009 +0000

@@ -0,0 +1,24 @@

+<domain type='qemu'>

+  <name>QEMUGuest1</name>

+  <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>

+  <memory>219200</memory>

+  <currentMemory>219200</currentMemory>

+  <vcpu>1</vcpu>

+  <os>

+    <type arch='i686' machine='pc'>hvm</type>

+    <boot dev='hd'/>

+  </os>

+  <clock offset='utc'/>

+  <on_poweroff>destroy</on_poweroff>

+  <on_reboot>restart</on_reboot>

+  <on_crash>destroy</on_crash>

+  <devices>

+    <emulator>/usr/bin/qemu</emulator>

+    <disk type='block' device='disk'>

+      <source dev='/dev/HostVG/QEMUGuest1'/>

+      <target dev='hda' bus='ide'/>

+    </disk>

+    <input type='mouse' bus='ps2'/>

+    <graphics type='vnc' port='5903' autoport='no' listen='127.0.0.1'/>

+  </devices>

+</domain>

diff -r 961d4b1ca1d3 tests/qemuxml2argvtest.c

--- a/tests/qemuxml2argvtest.c	Wed Mar 04 13:17:44 2009 +0000

+++ b/tests/qemuxml2argvtest.c	Thu Mar 05 14:22:50 2009 +0000

@@ -213,6 +213,19 @@ mymain(int argc, char **argv)

             QEMUD_CMD_FLAG_DRIVE_CACHE_V2);

     DO_TEST("disk-usb", 0);

     DO_TEST("graphics-vnc", 0);

+

+    driver.vncSASL = 1;

+    driver.vncSASLdir = strdup("/root/.sasl2");

+    DO_TEST("graphics-vnc-sasl", 0);

+    driver.vncTLS = 1;

+    driver.vncTLSx509verify = 1;

+    driver.vncTLSx509certdir = strdup("/etc/pki/tls/qemu");

+    DO_TEST("graphics-vnc-tls", 0);

+    driver.vncSASL = driver.vncTLSx509verify = driver.vncTLS = 0;

+    free(driver.vncSASLdir);

+    free(driver.vncTLSx509certdir);

+    driver.vncSASLdir = driver.vncTLSx509certdir = NULL;

+

     DO_TEST("graphics-sdl", 0);

     DO_TEST("graphics-sdl-fullscreen", 0);

     DO_TEST("input-usbmouse", 0);