[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 4/7] spice: add SASL support
From: |
Gerd Hoffmann |
Subject: |
[Qemu-devel] [PATCH 4/7] spice: add SASL support |
Date: |
Mon, 6 Jun 2011 14:49:37 +0200 |
From: Marc-André Lureau <address@hidden>
Turn on SASL support by appending "sasl" to the spice arguments, which
requires that the client use SASL to authenticate with the spice. The
exact choice of authentication method used is controlled from the
system / user's SASL configuration file for the 'qemu' service. This
is typically found in /etc/sasl2/qemu.conf. If running QEMU as an
unprivileged user, an environment variable SASL_CONF_PATH can be used
to make it search alternate locations for the service config. While
some SASL auth methods can also provide data encryption (eg GSSAPI),
it is recommended that SASL always be combined with the 'tls' and
'x509' settings to enable use of SSL and server certificates. This
ensures a data encryption preventing compromise of authentication
credentials.
It requires support from spice 0.8.1.
[ kraxel: moved spell fix to separate commit ]
Signed-off-by: Gerd Hoffmann <address@hidden>
---
qemu-config.c | 3 +++
qemu-options.hx | 13 +++++++++++++
ui/spice-core.c | 12 ++++++++++++
3 files changed, 28 insertions(+), 0 deletions(-)
diff --git a/qemu-config.c b/qemu-config.c
index 04c97e5..b00aa3a 100644
--- a/qemu-config.c
+++ b/qemu-config.c
@@ -388,6 +388,9 @@ QemuOptsList qemu_spice_opts = {
.name = "disable-copy-paste",
.type = QEMU_OPT_BOOL,
},{
+ .name = "sasl",
+ .type = QEMU_OPT_BOOL,
+ },{
.name = "x509-dir",
.type = QEMU_OPT_STRING,
},{
diff --git a/qemu-options.hx b/qemu-options.hx
index 63e8cb0..d9edff7 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -714,6 +714,19 @@ Force using the specified IP version.
@item password=<secret>
Set the password you need to authenticate.
address@hidden sasl
+Require that the client use SASL to authenticate with the spice.
+The exact choice of authentication method used is controlled from the
+system / user's SASL configuration file for the 'qemu' service. This
+is typically found in /etc/sasl2/qemu.conf. If running QEMU as an
+unprivileged user, an environment variable SASL_CONF_PATH can be used
+to make it search alternate locations for the service config.
+While some SASL auth methods can also provide data encryption (eg GSSAPI),
+it is recommended that SASL always be combined with the 'tls' and
+'x509' settings to enable use of SSL and server certificates. This
+ensures a data encryption preventing compromise of authentication
+credentials.
+
@item disable-ticketing
Allow client connects without authentication.
diff --git a/ui/spice-core.c b/ui/spice-core.c
index a3351f3..457d34d 100644
--- a/ui/spice-core.c
+++ b/ui/spice-core.c
@@ -549,6 +549,18 @@ void qemu_spice_init(void)
if (password) {
spice_server_set_ticket(spice_server, password, 0, 0, 0);
}
+ if (qemu_opt_get_bool(opts, "sasl", 0)) {
+#if SPICE_SERVER_VERSION >= 0x000900 /* 0.9.0 */
+ if (spice_server_set_sasl_appname(spice_server, "qemu") == -1 ||
+ spice_server_set_sasl(spice_server, 1) == -1) {
+ fprintf(stderr, "spice: failed to enable sasl\n");
+ exit(1);
+ }
+#else
+ fprintf(stderr, "spice: sasl is not available (spice >= 0.9
required)\n");
+ exit(1);
+#endif
+ }
if (qemu_opt_get_bool(opts, "disable-ticketing", 0)) {
auth = "none";
spice_server_set_noauth(spice_server);
--
1.7.1
- [Qemu-devel] [PULL] spice patch queue, Gerd Hoffmann, 2011/06/06
- [Qemu-devel] [PATCH 2/7] spice: add option for disabling copy paste support, Gerd Hoffmann, 2011/06/06
- [Qemu-devel] [PATCH 3/7] qxl: add to the list of devices which disable the default vga, Gerd Hoffmann, 2011/06/06
- [Qemu-devel] [PATCH 1/7] spice-qemu-char: Fix flow control in client -> guest direction, Gerd Hoffmann, 2011/06/06
- [Qemu-devel] [PATCH 5/7] qemu-config: comment spell fix, Gerd Hoffmann, 2011/06/06
- [Qemu-devel] [PATCH 7/7] qxl: fix cmdlog for vga, Gerd Hoffmann, 2011/06/06
- [Qemu-devel] [PATCH 6/7] spice: require spice 0.6.0 or newer., Gerd Hoffmann, 2011/06/06
- [Qemu-devel] [PATCH 4/7] spice: add SASL support,
Gerd Hoffmann <=
- Re: [Qemu-devel] [PULL] spice patch queue, Anthony Liguori, 2011/06/09
- Re: [Qemu-devel] [PULL] spice patch queue, Anthony Liguori, 2011/06/09