[Qemu-devel] [PATCH] let management expire vnc password

[Dan Kenigsberg <danken@redhat.com>]

After a client connects to vnc server, management may wish to expire the
vnc password, so that an attacker has less time to break into the vm.
---
 console.h |    2 +-
 monitor.c |    5 ++++-
 vnc.c     |    5 +++--
 3 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/console.h b/console.h
index 9615f56..13e7314 100644
--- a/console.h
+++ b/console.h
@@ -321,7 +321,7 @@ void cocoa_display_init(DisplayState *ds, int full_screen);
 void vnc_display_init(DisplayState *ds);
 void vnc_display_close(DisplayState *ds);
 int vnc_display_open(DisplayState *ds, const char *display);
-int vnc_display_password(DisplayState *ds, const char *password);
+int vnc_display_password(DisplayState *ds, const char *password, int expired);
 void do_info_vnc(Monitor *mon);
 char *vnc_display_local_addr(DisplayState *ds);
 
diff --git a/monitor.c b/monitor.c
index 167041e..2d3dc40 100644
--- a/monitor.c
+++ b/monitor.c
@@ -497,7 +497,7 @@ static void do_change_block(Monitor *mon, const char *device,
 static void change_vnc_password_cb(Monitor *mon, const char *password,
                                    void *opaque)
 {
-    if (vnc_display_password(NULL, password) < 0)
+    if (vnc_display_password(NULL, password, (int)opaque) < 0)
         monitor_printf(mon, "could not set VNC server password\n");
 
     monitor_read_command(mon, 1);
@@ -515,6 +515,9 @@ static void do_change_vnc(Monitor *mon, const char *target, const char *arg)
         } else {
             monitor_read_password(mon, change_vnc_password_cb, NULL);
         }
+    } else if (strcmp(target, "expire_passwd") == 0 ||
+               strcmp(target, "expire_password") == 0) {
+        change_vnc_password_cb(mon, NULL, (void *)1);
     } else {
         if (vnc_display_open(NULL, target) < 0)
             monitor_printf(mon, "could not start VNC server on %s\n", target);
diff --git a/vnc.c b/vnc.c
index 5eaef6a..a002973 100644
--- a/vnc.c
+++ b/vnc.c
@@ -2259,7 +2259,7 @@ void vnc_display_close(DisplayState *ds)
 #endif
 }
 
-int vnc_display_password(DisplayState *ds, const char *password)
+int vnc_display_password(DisplayState *ds, const char *password, int expired)
 {
     VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
 
@@ -2278,7 +2278,8 @@ int vnc_display_password(DisplayState *ds, const char *password)
             vs->auth = VNC_AUTH_VNC;
         }
     } else {
-        vs->auth = VNC_AUTH_NONE;
+        if (!expired)
+            vs->auth = VNC_AUTH_NONE;
     }
 
     return 0;
-- 
1.6.2.5