From nobody Mon Feb 9 02:14:29 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zoho.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1486645704705367.92022167492075; Thu, 9 Feb 2017 05:08:24 -0800 (PST) Received: from localhost ([::1]:37799 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cboSU-0005mb-50 for importer@patchew.org; Thu, 09 Feb 2017 08:08:22 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:33952) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cboM7-0000DD-GL for qemu-devel@nongnu.org; Thu, 09 Feb 2017 08:01:50 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cboM3-00025w-BZ for qemu-devel@nongnu.org; Thu, 09 Feb 2017 08:01:47 -0500 Received: from mx1.redhat.com ([209.132.183.28]:55908) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1cboM3-00025Y-2K for qemu-devel@nongnu.org; Thu, 09 Feb 2017 08:01:43 -0500 Received: from smtp.corp.redhat.com (int-mx16.intmail.prod.int.phx2.redhat.com [10.5.11.28]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 14590274877 for ; Thu, 9 Feb 2017 13:01:43 +0000 (UTC) Received: from nilsson.home.kraxel.org (ovpn-117-196.ams2.redhat.com [10.36.117.196]) by smtp.corp.redhat.com (Postfix) with ESMTP id A7BDB660FC; Thu, 9 Feb 2017 13:01:36 +0000 (UTC) Received: by nilsson.home.kraxel.org (Postfix, from userid 500) id A3AA480E22; Thu, 9 Feb 2017 14:01:19 +0100 (CET) From: Gerd Hoffmann To: qemu-devel@nongnu.org Date: Thu, 9 Feb 2017 14:01:11 +0100 Message-Id: <1486645277-4724-5-git-send-email-kraxel@redhat.com> In-Reply-To: <1486645277-4724-1-git-send-email-kraxel@redhat.com> References: <1486645277-4724-1-git-send-email-kraxel@redhat.com> X-Scanned-By: MIMEDefang 2.74 on 10.5.11.28 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.38]); Thu, 09 Feb 2017 13:01:43 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PULL 04/10] ui: fix reporting of VNC auth in query-vnc-servers X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Gerd Hoffmann , Markus Armbruster Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" From: "Daniel P. Berrange" Currently the VNC authentication info is emitted at the top level of the query-vnc-servers data. This is wrong because the authentication scheme differs between plain and websockets when TLS is enabled. We should instead report auth against the individual servers. e.g. (QEMU) query-vnc-servers { "return": [ { "clients": [], "id": "default", "auth": "vencrypt", "vencrypt": "x509-vnc", "server": [ { "host": "127.0.0.1" "service": "5901", "websocket": false, "family": "ipv4", "auth": "vencrypt", "vencrypt": "x509-vnc" }, { "host": "127.0.0.1", "service": "5902", "websocket": true, "family": "ipv4", "auth": "vnc" } ] } ] } This also future proofs the QMP schema so that we can cope with multiple VNC server instances, listening on different interfaces or ports, with different auth setup. Reviewed-by: Eric Blake Signed-off-by: Daniel P. Berrange Message-id: 20170203120649.15637-3-berrange@redhat.com Signed-off-by: Gerd Hoffmann --- qapi-schema.json | 28 ++++++++++++++++--- ui/vnc.c | 85 +++++++++++++++++++++++++++++++++-------------------= ---- 2 files changed, 74 insertions(+), 39 deletions(-) diff --git a/qapi-schema.json b/qapi-schema.json index cbdffdd..61151f3 100644 --- a/qapi-schema.json +++ b/qapi-schema.json @@ -1506,7 +1506,8 @@ # # The network connection information for server # -# @auth: #optional authentication method +# @auth: #optional authentication method used for +# the plain (non-websocket) VNC server # # Since: 2.1 ## @@ -1597,6 +1598,25 @@ 'tls-plain', 'x509-plain', 'tls-sasl', 'x509-sasl' ] } =20 + +## +# @VncServerInfo2: +# +# The network connection information for server +# +# @auth: The current authentication type used by the servers +# +# @vencrypt: #optional The vencrypt sub authentication type used by the +# servers, only specified in case auth =3D=3D vencrypt. +# +# Since: 2.9 +## +{ 'struct': 'VncServerInfo2', + 'base': 'VncBasicInfo', + 'data': { 'auth' : 'VncPrimaryAuth', + '*vencrypt' : 'VncVencryptSubAuth' } } + + ## # @VncInfo2: # @@ -1612,9 +1632,9 @@ # @clients: A list of @VncClientInfo of all currently connected clients. # The list can be empty, for obvious reasons. # -# @auth: The current authentication type used by the server +# @auth: The current authentication type used by the non-websockets servers # -# @vencrypt: #optional The vencrypt sub authentication type used by the se= rver, +# @vencrypt: #optional The vencrypt authentication type used by the server= s, # only specified in case auth =3D=3D vencrypt. # # @display: #optional The display device the vnc server is linked to. @@ -1623,7 +1643,7 @@ ## { 'struct': 'VncInfo2', 'data': { 'id' : 'str', - 'server' : ['VncBasicInfo'], + 'server' : ['VncServerInfo2'], 'clients' : ['VncClientInfo'], 'auth' : 'VncPrimaryAuth', '*vencrypt' : 'VncVencryptSubAuth', diff --git a/ui/vnc.c b/ui/vnc.c index b0889b1..d0a08a7 100644 --- a/ui/vnc.c +++ b/ui/vnc.c @@ -429,12 +429,20 @@ out_error: return NULL; } =20 -static VncBasicInfoList *qmp_query_server_entry(QIOChannelSocket *ioc, - bool websocket, - VncBasicInfoList *prev) + +static void qmp_query_auth(int auth, int subauth, + VncPrimaryAuth *qmp_auth, + VncVencryptSubAuth *qmp_vencrypt, + bool *qmp_has_vencrypt); + +static VncServerInfo2List *qmp_query_server_entry(QIOChannelSocket *ioc, + bool websocket, + int auth, + int subauth, + VncServerInfo2List *prev) { - VncBasicInfoList *list; - VncBasicInfo *info; + VncServerInfo2List *list; + VncServerInfo2 *info; Error *err =3D NULL; SocketAddress *addr; =20 @@ -444,85 +452,91 @@ static VncBasicInfoList *qmp_query_server_entry(QIOCh= annelSocket *ioc, return prev; } =20 - info =3D g_new0(VncBasicInfo, 1); - vnc_init_basic_info(addr, info, &err); + info =3D g_new0(VncServerInfo2, 1); + vnc_init_basic_info(addr, qapi_VncServerInfo2_base(info), &err); qapi_free_SocketAddress(addr); if (err) { - qapi_free_VncBasicInfo(info); + qapi_free_VncServerInfo2(info); error_free(err); return prev; } info->websocket =3D websocket; =20 - list =3D g_new0(VncBasicInfoList, 1); + qmp_query_auth(auth, subauth, &info->auth, + &info->vencrypt, &info->has_vencrypt); + + list =3D g_new0(VncServerInfo2List, 1); list->value =3D info; list->next =3D prev; return list; } =20 -static void qmp_query_auth(VncDisplay *vd, VncInfo2 *info) +static void qmp_query_auth(int auth, int subauth, + VncPrimaryAuth *qmp_auth, + VncVencryptSubAuth *qmp_vencrypt, + bool *qmp_has_vencrypt) { - switch (vd->auth) { + switch (auth) { case VNC_AUTH_VNC: - info->auth =3D VNC_PRIMARY_AUTH_VNC; + *qmp_auth =3D VNC_PRIMARY_AUTH_VNC; break; case VNC_AUTH_RA2: - info->auth =3D VNC_PRIMARY_AUTH_RA2; + *qmp_auth =3D VNC_PRIMARY_AUTH_RA2; break; case VNC_AUTH_RA2NE: - info->auth =3D VNC_PRIMARY_AUTH_RA2NE; + *qmp_auth =3D VNC_PRIMARY_AUTH_RA2NE; break; case VNC_AUTH_TIGHT: - info->auth =3D VNC_PRIMARY_AUTH_TIGHT; + *qmp_auth =3D VNC_PRIMARY_AUTH_TIGHT; break; case VNC_AUTH_ULTRA: - info->auth =3D VNC_PRIMARY_AUTH_ULTRA; + *qmp_auth =3D VNC_PRIMARY_AUTH_ULTRA; break; case VNC_AUTH_TLS: - info->auth =3D VNC_PRIMARY_AUTH_TLS; + *qmp_auth =3D VNC_PRIMARY_AUTH_TLS; break; case VNC_AUTH_VENCRYPT: - info->auth =3D VNC_PRIMARY_AUTH_VENCRYPT; - info->has_vencrypt =3D true; - switch (vd->subauth) { + *qmp_auth =3D VNC_PRIMARY_AUTH_VENCRYPT; + *qmp_has_vencrypt =3D true; + switch (subauth) { case VNC_AUTH_VENCRYPT_PLAIN: - info->vencrypt =3D VNC_VENCRYPT_SUB_AUTH_PLAIN; + *qmp_vencrypt =3D VNC_VENCRYPT_SUB_AUTH_PLAIN; break; case VNC_AUTH_VENCRYPT_TLSNONE: - info->vencrypt =3D VNC_VENCRYPT_SUB_AUTH_TLS_NONE; + *qmp_vencrypt =3D VNC_VENCRYPT_SUB_AUTH_TLS_NONE; break; case VNC_AUTH_VENCRYPT_TLSVNC: - info->vencrypt =3D VNC_VENCRYPT_SUB_AUTH_TLS_VNC; + *qmp_vencrypt =3D VNC_VENCRYPT_SUB_AUTH_TLS_VNC; break; case VNC_AUTH_VENCRYPT_TLSPLAIN: - info->vencrypt =3D VNC_VENCRYPT_SUB_AUTH_TLS_PLAIN; + *qmp_vencrypt =3D VNC_VENCRYPT_SUB_AUTH_TLS_PLAIN; break; case VNC_AUTH_VENCRYPT_X509NONE: - info->vencrypt =3D VNC_VENCRYPT_SUB_AUTH_X509_NONE; + *qmp_vencrypt =3D VNC_VENCRYPT_SUB_AUTH_X509_NONE; break; case VNC_AUTH_VENCRYPT_X509VNC: - info->vencrypt =3D VNC_VENCRYPT_SUB_AUTH_X509_VNC; + *qmp_vencrypt =3D VNC_VENCRYPT_SUB_AUTH_X509_VNC; break; case VNC_AUTH_VENCRYPT_X509PLAIN: - info->vencrypt =3D VNC_VENCRYPT_SUB_AUTH_X509_PLAIN; + *qmp_vencrypt =3D VNC_VENCRYPT_SUB_AUTH_X509_PLAIN; break; case VNC_AUTH_VENCRYPT_TLSSASL: - info->vencrypt =3D VNC_VENCRYPT_SUB_AUTH_TLS_SASL; + *qmp_vencrypt =3D VNC_VENCRYPT_SUB_AUTH_TLS_SASL; break; case VNC_AUTH_VENCRYPT_X509SASL: - info->vencrypt =3D VNC_VENCRYPT_SUB_AUTH_X509_SASL; + *qmp_vencrypt =3D VNC_VENCRYPT_SUB_AUTH_X509_SASL; break; default: - info->has_vencrypt =3D false; + *qmp_has_vencrypt =3D false; break; } break; case VNC_AUTH_SASL: - info->auth =3D VNC_PRIMARY_AUTH_SASL; + *qmp_auth =3D VNC_PRIMARY_AUTH_SASL; break; case VNC_AUTH_NONE: default: - info->auth =3D VNC_PRIMARY_AUTH_NONE; + *qmp_auth =3D VNC_PRIMARY_AUTH_NONE; break; } } @@ -538,7 +552,8 @@ VncInfo2List *qmp_query_vnc_servers(Error **errp) info =3D g_new0(VncInfo2, 1); info->id =3D g_strdup(vd->id); info->clients =3D qmp_query_client_list(vd); - qmp_query_auth(vd, info); + qmp_query_auth(vd->auth, vd->subauth, &info->auth, + &info->vencrypt, &info->has_vencrypt); if (vd->dcl.con) { dev =3D DEVICE(object_property_get_link(OBJECT(vd->dcl.con), "device", NULL)); @@ -547,11 +562,11 @@ VncInfo2List *qmp_query_vnc_servers(Error **errp) } if (vd->lsock !=3D NULL) { info->server =3D qmp_query_server_entry( - vd->lsock, false, info->server); + vd->lsock, false, vd->auth, vd->subauth, info->server); } if (vd->lwebsock !=3D NULL) { info->server =3D qmp_query_server_entry( - vd->lwebsock, true, info->server); + vd->lwebsock, true, vd->ws_auth, vd->ws_subauth, info->ser= ver); } =20 item =3D g_new0(VncInfo2List, 1); --=20 1.8.3.1