From 291a6ef3e41dd74ada7de3998f3f7f739dbbcfd6 Mon Sep 17 00:00:00 2001 From: "Daniel P. Berrange" Date: Fri, 24 Feb 2012 14:13:06 +0000 Subject: [PATCH] Add support for enabling SASL for SPICE guests QEMU has support for SASL auth for SPICE guests, but libvirt has no way to enable it. Following the example from VNC where it is globally enabled via qemu.conf Signed-off-by: Daniel P. Berrange --- src/qemu/libvirtd_qemu.aug | 2 ++ src/qemu/qemu.conf | 16 +++++++++ src/qemu/qemu_command.c | 10 ++++++ src/qemu/qemu_conf.c | 3 ++ src/qemu/qemu_conf.h | 2 ++ src/qemu/test_libvirtd_qemu.aug.in | 2 ++ .../qemuxml2argv-graphics-spice-sasl.args | 9 +++++ .../qemuxml2argv-graphics-spice-sasl.xml | 35 +++++++++++++++++++ tests/qemuxml2argvtest.c | 8 +++++ 9 files changed, 87 insertions(+) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-sasl.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-sasl.xml diff --git a/src/qemu/libvirtd_qemu.aug b/src/qemu/libvirtd_qemu.aug index 32db9839db..93a2a29aed 100644 --- a/src/qemu/libvirtd_qemu.aug +++ b/src/qemu/libvirtd_qemu.aug @@ -38,6 +38,8 @@ module Libvirtd_qemu = | bool_entry "spice_tls" | str_entry "spice_tls_x509_cert_dir" | str_entry "spice_password" + | bool_entry "spice_sasl" + | str_entry "spice_sasl_dir" let nogfx_entry = bool_entry "nographics_allow_host_audio" diff --git a/src/qemu/qemu.conf b/src/qemu/qemu.conf index bf57b9cf45..e5ff33d522 100644 --- a/src/qemu/qemu.conf +++ b/src/qemu/qemu.conf @@ -140,6 +140,22 @@ #spice_password = "XYZ12345" +# Enable use of SASL encryption on the SPICE server. This requires +# a SPICE client which supports the SASL protocol extension. +# +# It is necessary to configure /etc/sasl2/qemu.conf to choose +# the desired SASL plugin (eg, GSSPI for Kerberos) +# +#spice_sasl = 1 + +# The default SASL configuration file is located in /etc/sasl2/ +# When running libvirtd unprivileged, it may be desirable to +# override the configs in this location. Set this parameter to +# point to the directory, and create a qemu.conf in that location +# +#spice_sasl_dir = "/some/directory/sasl2" + + # By default, if no graphical front end is configured, libvirt will disable # QEMU audio output since directly talking to alsa/pulseaudio may not work # with various security settings. If you know what you're doing, enable diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index abb62e9236..814f368e06 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -7191,6 +7191,16 @@ qemuBuildGraphicsSPICECommandLine(virQEMUDriverConfigPtr cfg, virBufferAsprintf(&opt, "tls-port=%u", tlsPort); } + if (cfg->spiceSASL) { + virBufferAddLit(&opt, ",sasl"); + + if (cfg->spiceSASLdir) + virCommandAddEnvPair(cmd, "SASL_CONF_PATH", + cfg->spiceSASLdir); + + /* TODO: Support ACLs later */ + } + switch (virDomainGraphicsListenGetType(graphics, 0)) { case VIR_DOMAIN_GRAPHICS_LISTEN_TYPE_ADDRESS: listenAddr = virDomainGraphicsListenGetAddress(graphics, 0); diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index 44a2296dd8..8d7bee8296 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -284,6 +284,7 @@ static void virQEMUDriverConfigDispose(void *obj) VIR_FREE(cfg->spiceTLSx509certdir); VIR_FREE(cfg->spiceListen); VIR_FREE(cfg->spicePassword); + VIR_FREE(cfg->spiceSASLdir); VIR_FREE(cfg->hugetlbfsMount); VIR_FREE(cfg->hugepagePath); @@ -397,6 +398,8 @@ int virQEMUDriverConfigLoadFile(virQEMUDriverConfigPtr cfg, GET_VALUE_BOOL("spice_tls", cfg->spiceTLS); GET_VALUE_STR("spice_tls_x509_cert_dir", cfg->spiceTLSx509certdir); + GET_VALUE_BOOL("spice_sasl", cfg->spiceSASL); + GET_VALUE_STR("spice_sasl_dir", cfg->spiceSASLdir); GET_VALUE_STR("spice_listen", cfg->spiceListen); GET_VALUE_STR("spice_password", cfg->spicePassword); diff --git a/src/qemu/qemu_conf.h b/src/qemu/qemu_conf.h index ea3c69111d..d8304af93c 100644 --- a/src/qemu/qemu_conf.h +++ b/src/qemu/qemu_conf.h @@ -111,6 +111,8 @@ struct _virQEMUDriverConfig { bool spiceTLS; char *spiceTLSx509certdir; + bool spiceSASL; + char *spiceSASLdir; char *spiceListen; char *spicePassword; diff --git a/src/qemu/test_libvirtd_qemu.aug.in b/src/qemu/test_libvirtd_qemu.aug.in index 7af3f64786..7417d124e3 100644 --- a/src/qemu/test_libvirtd_qemu.aug.in +++ b/src/qemu/test_libvirtd_qemu.aug.in @@ -15,6 +15,8 @@ module Test_libvirtd_qemu = { "spice_tls" = "1" } { "spice_tls_x509_cert_dir" = "/etc/pki/libvirt-spice" } { "spice_password" = "XYZ12345" } +{ "spice_sasl" = "1" } +{ "spice_sasl_dir" = "/some/directory/sasl2" } { "nographics_allow_host_audio" = "1" } { "remote_display_port_min" = "5900" } { "remote_display_port_max" = "65535" } diff --git a/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-sasl.args b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-sasl.args new file mode 100644 index 0000000000..8847bcef9a --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-sasl.args @@ -0,0 +1,9 @@ +LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test \ +SASL_CONF_PATH=/root/.sasl2 QEMU_AUDIO_DRV=spice \ +/usr/bin/qemu -S -M pc -m 214 -smp 1 -nodefaults \ +-monitor unix:/tmp/test-monitor,server,nowait -no-acpi -boot c -usb -hda \ +/dev/HostVG/QEMUGuest1 \ +-spice port=5903,tls-port=5904,sasl,addr=127.0.0.1,\ +x509-dir=/etc/pki/libvirt-spice,tls-channel=default \ +-vga qxl -global qxl.ram_size=67108864 -global \ +qxl.vram_size=18874368 -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3 diff --git a/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-sasl.xml b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-sasl.xml new file mode 100644 index 0000000000..eb630fa545 --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-sasl.xml @@ -0,0 +1,35 @@ + + QEMUGuest1 + c7a5fdbd-edaf-9455-926a-d65c16db1809 + 219100 + 219100 + 1 + + hvm + + + + destroy + restart + destroy + + /usr/bin/qemu + + + + +
+ + + + + + + + + + + + diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c index 060acf29ba..b14e71384b 100644 --- a/tests/qemuxml2argvtest.c +++ b/tests/qemuxml2argvtest.c @@ -660,6 +660,14 @@ mymain(void) QEMU_CAPS_VGA, QEMU_CAPS_VGA_QXL, QEMU_CAPS_DEVICE, QEMU_CAPS_SPICE, QEMU_CAPS_DEVICE_QXL); + driver.config->spiceSASL = 1; + ignore_value(VIR_STRDUP(driver.config->spiceSASLdir, "/root/.sasl2")); + DO_TEST("graphics-spice-sasl", + QEMU_CAPS_VGA, QEMU_CAPS_VGA_QXL, + QEMU_CAPS_DEVICE, QEMU_CAPS_SPICE, + QEMU_CAPS_DEVICE_QXL); + VIR_FREE(driver.config->spiceSASLdir); + driver.config->spiceSASL = 0; DO_TEST("graphics-spice-agentmouse", QEMU_CAPS_VGA, QEMU_CAPS_VGA_QXL, QEMU_CAPS_DEVICE, QEMU_CAPS_SPICE,