|
 |
9c6c51 |
From 549657f96937eee9d31a44f9cb202bd61a4ce99d Mon Sep 17 00:00:00 2001
|
|
|
9c6c51 |
Message-Id: <549657f96937eee9d31a44f9cb202bd61a4ce99d@dist-git>
|
|
|
9c6c51 |
From: =?UTF-8?q?J=C3=A1n=20Tomko?= <jtomko@redhat.com>
|
|
|
9c6c51 |
Date: Tue, 28 Aug 2018 12:46:45 +0200
|
|
|
9c6c51 |
Subject: [PATCH] qemu: vnc: switch to tls-creds-x509
|
|
|
9c6c51 |
MIME-Version: 1.0
|
|
|
9c6c51 |
Content-Type: text/plain; charset=UTF-8
|
|
|
9c6c51 |
Content-Transfer-Encoding: 8bit
|
|
|
9c6c51 |
|
|
|
9c6c51 |
The tls, x509 and x509verify options were deprecated in QEMU v2.5.0:
|
|
|
9c6c51 |
|
|
|
9c6c51 |
commit 3e305e4a4752f70c0b5c3cf5b43ec957881714f7
|
|
|
9c6c51 |
Author: Daniel P. Berrange <berrange@redhat.com>
|
|
|
9c6c51 |
|
|
|
9c6c51 |
ui: convert VNC server to use QCryptoTLSSession
|
|
|
9c6c51 |
|
|
|
9c6c51 |
Use the tls-creds-x509 object when available.
|
|
|
9c6c51 |
|
|
|
9c6c51 |
https://bugzilla.redhat.com/show_bug.cgi?id=1598167
|
|
|
9c6c51 |
|
|
|
9c6c51 |
Signed-off-by: Ján Tomko <jtomko@redhat.com>
|
|
|
9c6c51 |
(cherry picked from commit 17f50c82600c11c0ebcb4fc944b3f38b8e06bcdb)
|
|
|
9c6c51 |
Signed-off-by: Ján Tomko <jtomko@redhat.com>
|
|
|
9c6c51 |
|
|
|
9c6c51 |
https: //bugzilla.redhat.com/show_bug.cgi?id=1598167
|
|
|
9c6c51 |
Reviewed-by: Erik Skultety <eskultet@redhat.com>
|
|
|
9c6c51 |
---
|
|
|
9c6c51 |
src/qemu/qemu_command.c | 26 ++++++++++++++-----
|
|
|
9c6c51 |
.../graphics-vnc-tls.x86_64-latest.args | 4 ++-
|
|
|
9c6c51 |
2 files changed, 23 insertions(+), 7 deletions(-)
|
|
|
9c6c51 |
|
|
|
9c6c51 |
diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
|
|
|
9c6c51 |
index f2b64ed720..5c71abab96 100644
|
|
|
9c6c51 |
--- a/src/qemu/qemu_command.c
|
|
|
9c6c51 |
+++ b/src/qemu/qemu_command.c
|
|
|
9c6c51 |
@@ -7892,13 +7892,27 @@ qemuBuildGraphicsVNCCommandLine(virQEMUDriverConfigPtr cfg,
|
|
|
9c6c51 |
virBufferAddLit(&opt, ",password");
|
|
|
9c6c51 |
|
|
|
9c6c51 |
if (cfg->vncTLS) {
|
|
|
9c6c51 |
- virBufferAddLit(&opt, ",tls");
|
|
|
9c6c51 |
- if (cfg->vncTLSx509verify) {
|
|
|
9c6c51 |
- virBufferAddLit(&opt, ",x509verify=");
|
|
|
9c6c51 |
- virQEMUBuildBufferEscapeComma(&opt, cfg->vncTLSx509certdir);
|
|
|
9c6c51 |
+ if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_OBJECT_TLS_CREDS_X509)) {
|
|
|
9c6c51 |
+ const char *alias = "vnc-tls-creds0";
|
|
|
9c6c51 |
+ if (qemuBuildTLSx509CommandLine(cmd,
|
|
|
9c6c51 |
+ cfg->vncTLSx509certdir,
|
|
|
9c6c51 |
+ true,
|
|
|
9c6c51 |
+ cfg->vncTLSx509verify,
|
|
|
9c6c51 |
+ NULL,
|
|
|
9c6c51 |
+ alias,
|
|
|
9c6c51 |
+ qemuCaps) < 0)
|
|
|
9c6c51 |
+ goto error;
|
|
|
9c6c51 |
+
|
|
|
9c6c51 |
+ virBufferAsprintf(&opt, ",tls-creds=%s", alias);
|
|
|
9c6c51 |
} else {
|
|
|
9c6c51 |
- virBufferAddLit(&opt, ",x509=");
|
|
|
9c6c51 |
- virQEMUBuildBufferEscapeComma(&opt, cfg->vncTLSx509certdir);
|
|
|
9c6c51 |
+ virBufferAddLit(&opt, ",tls");
|
|
|
9c6c51 |
+ if (cfg->vncTLSx509verify) {
|
|
|
9c6c51 |
+ virBufferAddLit(&opt, ",x509verify=");
|
|
|
9c6c51 |
+ virQEMUBuildBufferEscapeComma(&opt, cfg->vncTLSx509certdir);
|
|
|
9c6c51 |
+ } else {
|
|
|
9c6c51 |
+ virBufferAddLit(&opt, ",x509=");
|
|
|
9c6c51 |
+ virQEMUBuildBufferEscapeComma(&opt, cfg->vncTLSx509certdir);
|
|
|
9c6c51 |
+ }
|
|
|
9c6c51 |
}
|
|
|
9c6c51 |
}
|
|
|
9c6c51 |
|
|
|
9c6c51 |
diff --git a/tests/qemuxml2argvdata/graphics-vnc-tls.x86_64-latest.args b/tests/qemuxml2argvdata/graphics-vnc-tls.x86_64-latest.args
|
|
|
9c6c51 |
index 01743eff2a..97775fad42 100644
|
|
|
9c6c51 |
--- a/tests/qemuxml2argvdata/graphics-vnc-tls.x86_64-latest.args
|
|
|
9c6c51 |
+++ b/tests/qemuxml2argvdata/graphics-vnc-tls.x86_64-latest.args
|
|
|
9c6c51 |
@@ -24,7 +24,9 @@ file=/tmp/lib/domain--1-QEMUGuest1/master-key.aes \
|
|
|
9c6c51 |
-no-acpi \
|
|
|
9c6c51 |
-boot strict=on \
|
|
|
9c6c51 |
-device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 \
|
|
|
9c6c51 |
--vnc 127.0.0.1:3,tls,x509verify=/etc/pki/libvirt-vnc,sasl \
|
|
|
9c6c51 |
+-object tls-creds-x509,id=vnc-tls-creds0,dir=/etc/pki/libvirt-vnc,\
|
|
|
9c6c51 |
+endpoint=server,verify-peer=yes \
|
|
|
9c6c51 |
+-vnc 127.0.0.1:3,tls-creds=vnc-tls-creds0,sasl \
|
|
|
9c6c51 |
-device cirrus-vga,id=video0,bus=pci.0,addr=0x2 \
|
|
|
9c6c51 |
-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,\
|
|
|
9c6c51 |
resourcecontrol=deny \
|
|
|
9c6c51 |
--
|
|
|
9c6c51 |
2.18.0
|
|
|
9c6c51 |
|