From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:36078) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YXp8w-0008Rr-VK for qemu-devel@nongnu.org; Tue, 17 Mar 2015 06:54:40 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YXp8t-0006Hu-Qd for qemu-devel@nongnu.org; Tue, 17 Mar 2015 06:54:38 -0400 Received: from mx1.redhat.com ([209.132.183.28]:38945) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YXp8t-0006Hm-KQ for qemu-devel@nongnu.org; Tue, 17 Mar 2015 06:54:35 -0400 Received: from int-mx09.intmail.prod.int.phx2.redhat.com (int-mx09.intmail.prod.int.phx2.redhat.com [10.5.11.22]) by mx1.redhat.com (Postfix) with ESMTPS id 13DB08EA36 for ; Tue, 17 Mar 2015 10:54:35 +0000 (UTC) Message-ID: <1426589673.27188.70.camel@nilsson.home.kraxel.org> From: Gerd Hoffmann Date: Tue, 17 Mar 2015 11:54:33 +0100 In-Reply-To: <20150317103333.GC6540@redhat.com> References: <1426509364-19513-1-git-send-email-berrange@redhat.com> <1426509364-19513-4-git-send-email-berrange@redhat.com> <1426577800.27188.20.camel@nilsson.home.kraxel.org> <20150317103333.GC6540@redhat.com> Content-Type: text/plain; charset="UTF-8" Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH 3/3] ui: fix VNC websockets TLS integration List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: "Daniel P. Berrange" Cc: qemu-devel@nongnu.org On Di, 2015-03-17 at 10:33 +0000, Daniel P. Berrange wrote: > On Tue, Mar 17, 2015 at 08:36:40AM +0100, Gerd Hoffmann wrote: > > Hi, > > > > > - Separate VNC auth scheme is tracked for websockets server, > > > since it makes no sense to try to use VeNCrypt over a TLS > > > enabled websockets connection. > > > > Hmm. That is a problem for the QAPI, the auth scheme is linked to the > > vnc server not the socket. > > It seems straightforward enough to just do this: > > diff --git a/qapi-schema.json b/qapi-schema.json > index d7c3eec..3362956 100644 > --- a/qapi-schema.json > +++ b/qapi-schema.json > @@ -808,6 +808,7 @@ > 'clients' : ['VncClientInfo'], > 'auth' : 'VncPrimaryAuth', > '*vencrypt' : 'VncVencryptSubAuth', > + '*ws-auth' : 'VncPrimaryAuth', > '*display' : 'str' } } > > And document that 'ws-auth' is used if server->websocket == true When doing it this way we probably want add '*ws-tls' : 'bool' too. I'm fine either way (adding both or -- given the fixed scheme mapping we have -- none). Pick whatever suits libvirt best. cheers, Gerd