From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from [140.186.70.92] (port=45975 helo=eggs.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1P3vVd-0001ku-Bv for qemu-devel@nongnu.org; Thu, 07 Oct 2010 14:48:07 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1P3vR4-0000Ok-6V for qemu-devel@nongnu.org; Thu, 07 Oct 2010 14:43:23 -0400 Received: from moutng.kundenserver.de ([212.227.126.187]:57217) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1P3vR3-0000O1-Om for qemu-devel@nongnu.org; Thu, 07 Oct 2010 14:43:22 -0400 Message-ID: <4CAE14C4.8090604@mail.berlios.de> Date: Thu, 07 Oct 2010 20:43:16 +0200 From: Stefan Weil MIME-Version: 1.0 Subject: Re: [Qemu-devel] [PATCH 3/5] spice: add config options for channel security. References: <1286438126-11250-1-git-send-email-kraxel@redhat.com> <1286438126-11250-4-git-send-email-kraxel@redhat.com> In-Reply-To: <1286438126-11250-4-git-send-email-kraxel@redhat.com> Content-Type: text/plain; charset=ISO-8859-15; format=flowed Content-Transfer-Encoding: 7bit List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Gerd Hoffmann Cc: qemu-devel@nongnu.org Am 07.10.2010 09:55, schrieb Gerd Hoffmann: > This allows to enforce tls or plaintext usage for certain spice > channels. > --- > qemu-config.c | 6 ++++++ > qemu-options.hx | 8 ++++++++ > ui/spice-core.c | 25 +++++++++++++++++++++++++ > 3 files changed, 39 insertions(+), 0 deletions(-) > > diff --git a/qemu-config.c b/qemu-config.c > index 8b545b1..f52e50c 100644 > --- a/qemu-config.c > +++ b/qemu-config.c > @@ -392,6 +392,12 @@ QemuOptsList qemu_spice_opts = { > .name = "tls-ciphers", > .type = QEMU_OPT_STRING, > },{ > + .name = "tls-channel", > + .type = QEMU_OPT_STRING, > + },{ > + .name = "plaintext-channel", > + .type = QEMU_OPT_STRING, > + },{ > .name = "image-compression", > .type = QEMU_OPT_STRING, > },{ > diff --git a/qemu-options.hx b/qemu-options.hx > index 59db632..bb45b67 100644 > --- a/qemu-options.hx > +++ b/qemu-options.hx > @@ -704,6 +704,14 @@ The x509 file names can also be configured individually. > @item tls-ciphers= > Specify which ciphers to use. > > +@item tls-channel=[main|display|inputs|record|playback|tunnel] > +@item plaintext-channel=[main|display|inputs|record|playback|tunnel] > +Force specific channel to be used with or without TLS encryption. The > +options can be specified multiple times to configure multiple > +channels. The special name "default" can be used to set the default > +mode. For channels which are not explicitly forced into one mode the > +spice client is allowed to pick tls/plaintext as he pleases. > + > @item image-compression=[auto_glz|auto_lz|quic|glz|lz|off] > Configure image compression (lossless). > Default is auto_glz. > diff --git a/ui/spice-core.c b/ui/spice-core.c > index 1567046..8f73848 100644 > --- a/ui/spice-core.c > +++ b/ui/spice-core.c > @@ -192,6 +192,29 @@ static const char *wan_compression_names[] = { > > /* functions for the rest of qemu */ > > +static int add_channel(const char *name, const char *value, void *opaque) > +{ > + int security = 0; > + int rc; > + > + if (strcmp(name, "tls-channel") == 0) > + security = SPICE_CHANNEL_SECURITY_SSL; > CODING_STYLE (if (...) { ... })? Same in next lines. > + if (strcmp(name, "plaintext-channel") == 0) > + security = SPICE_CHANNEL_SECURITY_NONE; > + if (security == 0) > + return 0; > + if (strcmp(value, "default") == 0) { > + rc = spice_server_set_channel_security(spice_server, NULL, security); > + } else { > + rc = spice_server_set_channel_security(spice_server, value, security); > + } > + if (rc != 0) { > + fprintf(stderr, "spice: failed to set channel security for %s\n", value); > + exit(1); > + } > + return 0; > +} > + > void qemu_spice_init(void) > { > QemuOpts *opts = QTAILQ_FIRST(&qemu_spice_opts.head); > @@ -293,6 +316,8 @@ void qemu_spice_init(void) > } > spice_server_set_zlib_glz_compression(spice_server, wan_compr); > > + qemu_opt_foreach(opts, add_channel, NULL, 0); > + > spice_server_init(spice_server,&core_interface); > using_spice = 1; > >