Commit 48b3ed0a authored by Marc-André Lureau's avatar Marc-André Lureau Committed by Gerd Hoffmann
Browse files

spice: add SASL support 



Turn on SASL support by appending "sasl" to the spice arguments, which
requires that the client use SASL to authenticate with the spice.  The
exact choice of authentication method used is controlled from the
system / user's SASL configuration file for the 'qemu' service. This
is typically found in /etc/sasl2/qemu.conf. If running QEMU as an
unprivileged user, an environment variable SASL_CONF_PATH can be used
to make it search alternate locations for the service config.  While
some SASL auth methods can also provide data encryption (eg GSSAPI),
it is recommended that SASL always be combined with the 'tls' and
'x509' settings to enable use of SSL and server certificates. This
ensures a data encryption preventing compromise of authentication
credentials.

It requires support from spice 0.8.1.

[ kraxel: moved spell fix to separate commit ]

Signed-off-by: default avatarGerd Hoffmann <kraxel@redhat.com>
parent 42138043

qemu-config.c

+3 −0
Original line number Diff line number Diff line
@@ -387,6 +387,9 @@ QemuOptsList qemu_spice_opts = { 
        },{

            .name = "disable-copy-paste",

            .type = QEMU_OPT_BOOL,

        },{

            .name = "sasl",

            .type = QEMU_OPT_BOOL,

        },{

            .name = "x509-dir",

            .type = QEMU_OPT_STRING,

qemu-options.hx

+13 −0
Original line number Diff line number Diff line
@@ -714,6 +714,19 @@ Force using the specified IP version. 
@item password=<secret>

Set the password you need to authenticate.



@item sasl

Require that the client use SASL to authenticate with the spice.

The exact choice of authentication method used is controlled from the

system / user's SASL configuration file for the 'qemu' service. This

is typically found in /etc/sasl2/qemu.conf. If running QEMU as an

unprivileged user, an environment variable SASL_CONF_PATH can be used

to make it search alternate locations for the service config.

While some SASL auth methods can also provide data encryption (eg GSSAPI),

it is recommended that SASL always be combined with the 'tls' and

'x509' settings to enable use of SSL and server certificates. This

ensures a data encryption preventing compromise of authentication

credentials.



@item disable-ticketing

Allow client connects without authentication.

ui/spice-core.c

+12 −0
Original line number Diff line number Diff line
@@ -549,6 +549,18 @@ void qemu_spice_init(void) 
    if (password) {

        spice_server_set_ticket(spice_server, password, 0, 0, 0);

    }

    if (qemu_opt_get_bool(opts, "sasl", 0)) {

#if SPICE_SERVER_VERSION >= 0x000900 /* 0.9.0 */

        if (spice_server_set_sasl_appname(spice_server, "qemu") == -1 ||

            spice_server_set_sasl(spice_server, 1) == -1) {

            fprintf(stderr, "spice: failed to enable sasl\n");

            exit(1);

        }

#else

        fprintf(stderr, "spice: sasl is not available (spice >= 0.9 required)\n");

        exit(1);

#endif

    }

    if (qemu_opt_get_bool(opts, "disable-ticketing", 0)) {

        auth = "none";

        spice_server_set_noauth(spice_server);