[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 01/11] ui: introduce "password-secret" option for VNC servers
From: |
Gerd Hoffmann |
Subject: |
[PULL 01/11] ui: introduce "password-secret" option for VNC servers |
Date: |
Tue, 16 Mar 2021 06:38:03 +0100 |
From: Daniel P. Berrangé <berrange@redhat.com>
Currently when using VNC the "password" flag turns on password based
authentication. The actual password has to be provided separately via
the monitor.
This introduces a "password-secret" option which lets the password be
provided up front.
$QEMU --object secret,id=vncsec0,file=passwd.txt \
--vnc localhost:0,password-secret=vncsec0
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20210311114343.439820-2-berrange@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
ui/vnc.c | 23 ++++++++++++++++++++++-
qemu-options.hx | 5 +++++
2 files changed, 27 insertions(+), 1 deletion(-)
diff --git a/ui/vnc.c b/ui/vnc.c
index 310abc937812..e8e3426a65c4 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -48,6 +48,7 @@
#include "crypto/tlscredsanon.h"
#include "crypto/tlscredsx509.h"
#include "crypto/random.h"
+#include "crypto/secret_common.h"
#include "qom/object_interfaces.h"
#include "qemu/cutils.h"
#include "qemu/help_option.h"
@@ -3459,6 +3460,9 @@ static QemuOptsList qemu_vnc_opts = {
},{
.name = "password",
.type = QEMU_OPT_BOOL,
+ },{
+ .name = "password-secret",
+ .type = QEMU_OPT_STRING,
},{
.name = "reverse",
.type = QEMU_OPT_BOOL,
@@ -3931,6 +3935,7 @@ void vnc_display_open(const char *id, Error **errp)
int lock_key_sync = 1;
int key_delay_ms;
const char *audiodev;
+ const char *passwordSecret;
if (!vd) {
error_setg(errp, "VNC display not active");
@@ -3948,7 +3953,23 @@ void vnc_display_open(const char *id, Error **errp)
goto fail;
}
- password = qemu_opt_get_bool(opts, "password", false);
+
+ passwordSecret = qemu_opt_get(opts, "password-secret");
+ if (passwordSecret) {
+ if (qemu_opt_get(opts, "password")) {
+ error_setg(errp,
+ "'password' flag is redundant with 'password-secret'");
+ goto fail;
+ }
+ vd->password = qcrypto_secret_lookup_as_utf8(passwordSecret,
+ errp);
+ if (!vd->password) {
+ goto fail;
+ }
+ password = true;
+ } else {
+ password = qemu_opt_get_bool(opts, "password", false);
+ }
if (password) {
if (fips_get_state()) {
error_setg(errp,
diff --git a/qemu-options.hx b/qemu-options.hx
index 622d3bfa5a7d..357fc4596ecc 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -2165,6 +2165,11 @@ SRST
time to allow <protocol> password to expire immediately or never
expire.
+ ``password-secret=<secret-id>``
+ Require that password based authentication is used for client
+ connections, using the password provided by the ``secret``
+ object identified by ``secret-id``.
+
``tls-creds=ID``
Provides the ID of a set of TLS credentials to use to secure the
VNC server. They will apply to both the normal VNC server socket
--
2.29.2
- [PULL 00/11] Ui 20210316 patches, Gerd Hoffmann, 2021/03/16
- [PULL 04/11] opengl: Do not convert format with glTexImage2D on OpenGL ES, Gerd Hoffmann, 2021/03/16
- [PULL 03/11] ui: deprecate "password" option for SPICE server, Gerd Hoffmann, 2021/03/16
- [PULL 02/11] ui: introduce "password-secret" option for SPICE server, Gerd Hoffmann, 2021/03/16
- [PULL 07/11] ui: avoid sending framebuffer updates outside client desktop bounds, Gerd Hoffmann, 2021/03/16
- [PULL 08/11] ui: use client width/height in WMVi message, Gerd Hoffmann, 2021/03/16
- [PULL 05/11] ui/cocoa: Do not exit immediately after shutdown, Gerd Hoffmann, 2021/03/16
- [PULL 01/11] ui: introduce "password-secret" option for VNC servers,
Gerd Hoffmann <=
- [PULL 10/11] ui: fold qemu_alloc_display in only caller, Gerd Hoffmann, 2021/03/16
- [PULL 09/11] ui: honour the actual guest display dimensions without rounding, Gerd Hoffmann, 2021/03/16
- [PULL 06/11] ui: add more trace points for VNC client/server messages, Gerd Hoffmann, 2021/03/16
- [PULL 11/11] ui/cocoa: Comment about modifier key input quirks, Gerd Hoffmann, 2021/03/16
- Re: [PULL 00/11] Ui 20210316 patches, Peter Maydell, 2021/03/17