From nobody Wed Nov 5 14:39:40 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) client-ip=209.132.183.28; envelope-from=libvir-list-bounces@redhat.com; helo=mx1.redhat.com; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass(p=none dis=none) header.from=redhat.com Return-Path: Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by mx.zohomail.com with SMTPS id 1535018246727645.6216156186283; Thu, 23 Aug 2018 02:57:26 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 845F48110B; Thu, 23 Aug 2018 09:57:24 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 503A82A2C4; Thu, 23 Aug 2018 09:57:24 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 040434A46C; Thu, 23 Aug 2018 09:57:24 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.rdu2.redhat.com [10.11.54.6]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id w7N9v0SK014005 for ; Thu, 23 Aug 2018 05:57:00 -0400 Received: by smtp.corp.redhat.com (Postfix) id 8C1EF2157F4A; Thu, 23 Aug 2018 09:57:00 +0000 (UTC) Received: from sirius.home.kraxel.org (ovpn-116-82.ams2.redhat.com [10.36.116.82]) by smtp.corp.redhat.com (Postfix) with ESMTP id 1DB712166BA8; Thu, 23 Aug 2018 09:56:58 +0000 (UTC) Received: by sirius.home.kraxel.org (Postfix, from userid 1000) id 9BA2F204B8; Thu, 23 Aug 2018 11:56:53 +0200 (CEST) From: Gerd Hoffmann To: qemu-devel@nongnu.org Date: Thu, 23 Aug 2018 11:56:47 +0200 Message-Id: <20180823095653.14556-7-kraxel@redhat.com> In-Reply-To: <20180823095653.14556-1-kraxel@redhat.com> References: <20180823095653.14556-1-kraxel@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.78 on 10.11.54.6 X-loop: libvir-list@redhat.com Cc: libvir-list@redhat.com, Gerd Hoffmann Subject: [libvirt] [PULL 06/12] vnc: remove support for deprecated tls, x509, x509verify options X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.28]); Thu, 23 Aug 2018 09:57:25 +0000 (UTC) X-ZohoMail: RDMRC_0 RSF_0 Z_629925259 SPT_0 From: Daniel P. Berrang=C3=A9 The 'tls-creds' option accepts the name of a TLS credentials object. This replaced the usage of 'tls', 'x509' and 'x509verify' options in 2.5.0. These deprecated options were grandfathered in when the deprecation policy was introduded in 2.10.0, so can now finally be removed. Signed-off-by: Daniel P. Berrang=C3=A9 Message-id: 20180725092751.21767-3-berrange@redhat.com Signed-off-by: Gerd Hoffmann --- ui/vnc.c | 91 ------------------------------------------------= ---- qemu-deprecated.texi | 20 ------------ qemu-options.hx | 43 ------------------------- 3 files changed, 154 deletions(-) diff --git a/ui/vnc.c b/ui/vnc.c index 359693238b..fd929b0957 100644 --- a/ui/vnc.c +++ b/ui/vnc.c @@ -3345,10 +3345,6 @@ static QemuOptsList qemu_vnc_opts =3D { .name =3D "tls-creds", .type =3D QEMU_OPT_STRING, },{ - /* Deprecated in favour of tls-creds */ - .name =3D "x509", - .type =3D QEMU_OPT_STRING, - },{ .name =3D "share", .type =3D QEMU_OPT_STRING, },{ @@ -3385,14 +3381,6 @@ static QemuOptsList qemu_vnc_opts =3D { .name =3D "sasl", .type =3D QEMU_OPT_BOOL, },{ - /* Deprecated in favour of tls-creds */ - .name =3D "tls", - .type =3D QEMU_OPT_BOOL, - },{ - /* Deprecated in favour of tls-creds */ - .name =3D "x509verify", - .type =3D QEMU_OPT_STRING, - },{ .name =3D "acl", .type =3D QEMU_OPT_BOOL, },{ @@ -3519,51 +3507,6 @@ vnc_display_setup_auth(int *auth, } =20 =20 -/* - * Handle back compat with old CLI syntax by creating some - * suitable QCryptoTLSCreds objects - */ -static QCryptoTLSCreds * -vnc_display_create_creds(bool x509, - bool x509verify, - const char *dir, - const char *id, - Error **errp) -{ - gchar *credsid =3D g_strdup_printf("tlsvnc%s", id); - Object *parent =3D object_get_objects_root(); - Object *creds; - Error *err =3D NULL; - - if (x509) { - creds =3D object_new_with_props(TYPE_QCRYPTO_TLS_CREDS_X509, - parent, - credsid, - &err, - "endpoint", "server", - "dir", dir, - "verify-peer", x509verify ? "yes" : = "no", - NULL); - } else { - creds =3D object_new_with_props(TYPE_QCRYPTO_TLS_CREDS_ANON, - parent, - credsid, - &err, - "endpoint", "server", - NULL); - } - - g_free(credsid); - - if (err) { - error_propagate(errp, err); - return NULL; - } - - return QCRYPTO_TLS_CREDS(creds); -} - - static int vnc_display_get_address(const char *addrstr, bool websocket, bool reverse, @@ -3930,15 +3873,6 @@ void vnc_display_open(const char *id, Error **errp) credid =3D qemu_opt_get(opts, "tls-creds"); if (credid) { Object *creds; - if (qemu_opt_get(opts, "tls") || - qemu_opt_get(opts, "x509") || - qemu_opt_get(opts, "x509verify")) { - error_setg(errp, - "'tls-creds' parameter is mutually exclusive with " - "'tls', 'x509' and 'x509verify' parameters"); - goto fail; - } - creds =3D object_resolve_path_component( object_get_objects_root(), credid); if (!creds) { @@ -3961,31 +3895,6 @@ void vnc_display_open(const char *id, Error **errp) "Expecting TLS credentials with a server endpoint"); goto fail; } - } else { - const char *path; - bool tls =3D false, x509 =3D false, x509verify =3D false; - tls =3D qemu_opt_get_bool(opts, "tls", false); - if (tls) { - path =3D qemu_opt_get(opts, "x509"); - - if (path) { - x509 =3D true; - } else { - path =3D qemu_opt_get(opts, "x509verify"); - if (path) { - x509 =3D true; - x509verify =3D true; - } - } - vd->tlscreds =3D vnc_display_create_creds(x509, - x509verify, - path, - vd->id, - errp); - if (!vd->tlscreds) { - goto fail; - } - } } acl =3D qemu_opt_get_bool(opts, "acl", false); =20 diff --git a/qemu-deprecated.texi b/qemu-deprecated.texi index 67b721156f..1993164695 100644 --- a/qemu-deprecated.texi +++ b/qemu-deprecated.texi @@ -40,26 +40,6 @@ which is the default. The ``-no-kvm'' argument is now a synonym for setting ``-machine accel=3Dtcg''. =20 -@subsection -vnc tls (since 2.5.0) - -The ``-vnc tls'' argument is now a synonym for setting -``-object tls-creds-anon,id=3Dtls0'' combined with -``-vnc tls-creds=3Dtls0' - -@subsection -vnc x509 (since 2.5.0) - -The ``-vnc x509=3D/path/to/certs'' argument is now a -synonym for setting -``-object tls-creds-x509,dir=3D/path/to/certs,id=3Dtls0,verify-peer=3Dno'' -combined with ``-vnc tls-creds=3Dtls0' - -@subsection -vnc x509verify (since 2.5.0) - -The ``-vnc x509verify=3D/path/to/certs'' argument is now a -synonym for setting -``-object tls-creds-x509,dir=3D/path/to/certs,id=3Dtls0,verify-peer=3Dyes'' -combined with ``-vnc tls-creds=3Dtls0' - @subsection -tftp (since 2.6.0) =20 The ``-tftp /some/dir'' argument is replaced by either diff --git a/qemu-options.hx b/qemu-options.hx index 4efdedfdbb..d52a6f56cd 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -1632,49 +1632,6 @@ will cause the VNC server socket to enable the VeNCr= ypt auth mechanism. The credentials should have been previously created using the @option{-object tls-creds} argument. =20 -The @option{tls-creds} parameter obsoletes the @option{tls}, -@option{x509}, and @option{x509verify} options, and as such -it is not permitted to set both new and old type options at -the same time. - -@item tls - -Require that client use TLS when communicating with the VNC server. This -uses anonymous TLS credentials so is susceptible to a man-in-the-middle -attack. It is recommended that this option be combined with either the -@option{x509} or @option{x509verify} options. - -This option is now deprecated in favor of using the @option{tls-creds} -argument. - -@item x509=3D@var{/path/to/certificate/dir} - -Valid if @option{tls} is specified. Require that x509 credentials are used -for negotiating the TLS session. The server will send its x509 certificate -to the client. It is recommended that a password be set on the VNC server -to provide authentication of the client when this is used. The path follow= ing -this option specifies where the x509 certificates are to be loaded from. -See the @ref{vnc_security} section for details on generating certificates. - -This option is now deprecated in favour of using the @option{tls-creds} -argument. - -@item x509verify=3D@var{/path/to/certificate/dir} - -Valid if @option{tls} is specified. Require that x509 credentials are used -for negotiating the TLS session. The server will send its x509 certificate -to the client, and request that the client send its own x509 certificate. -The server will validate the client's certificate against the CA certifica= te, -and reject clients when validation fails. If the certificate authority is -trusted, this is a sufficient authentication mechanism. You may still wish -to set a password on the VNC server as a second authentication layer. The -path following this option specifies where the x509 certificates are to -be loaded from. See the @ref{vnc_security} section for details on generati= ng -certificates. - -This option is now deprecated in favour of using the @option{tls-creds} -argument. - @item sasl =20 Require that the client use SASL to authenticate with the VNC server. --=20 2.9.3 -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list