From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1Mq12H-0008Pn-N7 for qemu-devel@nongnu.org; Tue, 22 Sep 2009 04:47:45 -0400 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1Mq12D-0008LS-1g for qemu-devel@nongnu.org; Tue, 22 Sep 2009 04:47:45 -0400 Received: from [199.232.76.173] (port=55250 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1Mq12C-0008L5-NB for qemu-devel@nongnu.org; Tue, 22 Sep 2009 04:47:40 -0400 Received: from mx1.redhat.com ([209.132.183.28]:60320) by monty-python.gnu.org with esmtp (Exim 4.60) (envelope-from ) id 1Mq12B-0000Ar-W6 for qemu-devel@nongnu.org; Tue, 22 Sep 2009 04:47:40 -0400 Received: from int-mx04.intmail.prod.int.phx2.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.17]) by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id n8M8lcJm022223 for ; Tue, 22 Sep 2009 04:47:38 -0400 Received: from localhost (dhcp-1-196.tlv.redhat.com [10.35.1.196]) by int-mx04.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id n8M8lafP021653 for ; Tue, 22 Sep 2009 04:47:37 -0400 From: Dan Kenigsberg Date: Tue, 22 Sep 2009 11:47:35 +0300 Message-Id: <1253609255-13016-1-git-send-email-danken@redhat.com> Subject: [Qemu-devel] [PATCH] let management expire vnc password List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org After a client connects to vnc server, management may wish to expire the vnc password, so that an attacker has less time to break into the vm. --- console.h | 2 +- monitor.c | 5 ++++- vnc.c | 5 +++-- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/console.h b/console.h index 9615f56..13e7314 100644 --- a/console.h +++ b/console.h @@ -321,7 +321,7 @@ void cocoa_display_init(DisplayState *ds, int full_screen); void vnc_display_init(DisplayState *ds); void vnc_display_close(DisplayState *ds); int vnc_display_open(DisplayState *ds, const char *display); -int vnc_display_password(DisplayState *ds, const char *password); +int vnc_display_password(DisplayState *ds, const char *password, int expired); void do_info_vnc(Monitor *mon); char *vnc_display_local_addr(DisplayState *ds); diff --git a/monitor.c b/monitor.c index 167041e..2d3dc40 100644 --- a/monitor.c +++ b/monitor.c @@ -497,7 +497,7 @@ static void do_change_block(Monitor *mon, const char *device, static void change_vnc_password_cb(Monitor *mon, const char *password, void *opaque) { - if (vnc_display_password(NULL, password) < 0) + if (vnc_display_password(NULL, password, (int)opaque) < 0) monitor_printf(mon, "could not set VNC server password\n"); monitor_read_command(mon, 1); @@ -515,6 +515,9 @@ static void do_change_vnc(Monitor *mon, const char *target, const char *arg) } else { monitor_read_password(mon, change_vnc_password_cb, NULL); } + } else if (strcmp(target, "expire_passwd") == 0 || + strcmp(target, "expire_password") == 0) { + change_vnc_password_cb(mon, NULL, (void *)1); } else { if (vnc_display_open(NULL, target) < 0) monitor_printf(mon, "could not start VNC server on %s\n", target); diff --git a/vnc.c b/vnc.c index 5eaef6a..a002973 100644 --- a/vnc.c +++ b/vnc.c @@ -2259,7 +2259,7 @@ void vnc_display_close(DisplayState *ds) #endif } -int vnc_display_password(DisplayState *ds, const char *password) +int vnc_display_password(DisplayState *ds, const char *password, int expired) { VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display; @@ -2278,7 +2278,8 @@ int vnc_display_password(DisplayState *ds, const char *password) vs->auth = VNC_AUTH_VNC; } } else { - vs->auth = VNC_AUTH_NONE; + if (!expired) + vs->auth = VNC_AUTH_NONE; } return 0; -- 1.6.2.5