From patchwork Wed Jul 25 09:27:50 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= X-Patchwork-Id: 10543753 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 1B40F112E for ; Wed, 25 Jul 2018 09:29:12 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0B55C29A23 for ; Wed, 25 Jul 2018 09:29:12 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id F36D229A3E; Wed, 25 Jul 2018 09:29:11 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 977A629A23 for ; Wed, 25 Jul 2018 09:29:11 +0000 (UTC) Received: from localhost ([::1]:46991 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fiG6Y-0003Ir-Qm for patchwork-qemu-devel@patchwork.kernel.org; Wed, 25 Jul 2018 05:29:10 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:58267) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fiG5Q-0002Ri-9b for qemu-devel@nongnu.org; Wed, 25 Jul 2018 05:28:03 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fiG5N-0000eE-8q for qemu-devel@nongnu.org; Wed, 25 Jul 2018 05:28:00 -0400 Received: from mx3-rdu2.redhat.com ([66.187.233.73]:35426 helo=mx1.redhat.com) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fiG5N-0000dj-39 for qemu-devel@nongnu.org; Wed, 25 Jul 2018 05:27:57 -0400 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.rdu2.redhat.com [10.11.54.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id AE7E14077071 for ; Wed, 25 Jul 2018 09:27:56 +0000 (UTC) Received: from localhost.localdomain.com (unknown [10.33.36.89]) by smtp.corp.redhat.com (Postfix) with ESMTP id 50A992156898; Wed, 25 Jul 2018 09:27:54 +0000 (UTC) From: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= To: qemu-devel@nongnu.org Date: Wed, 25 Jul 2018 10:27:50 +0100 Message-Id: <20180725092751.21767-2-berrange@redhat.com> In-Reply-To: <20180725092751.21767-1-berrange@redhat.com> References: <20180725092751.21767-1-berrange@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.78 on 10.11.54.6 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.5]); Wed, 25 Jul 2018 09:27:56 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.5]); Wed, 25 Jul 2018 09:27:56 +0000 (UTC) for IP:'10.11.54.6' DOMAIN:'int-mx06.intmail.prod.int.rdu2.redhat.com' HELO:'smtp.corp.redhat.com' FROM:'berrange@redhat.com' RCPT:'' X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 66.187.233.73 Subject: [Qemu-devel] [PATCH 1/2] doc: switch to modern syntax for VNC TLS setup X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: libvir-list@redhat.com, Gerd Hoffmann Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP The use of 'tls', 'x509' and 'x509verify' properties is the deprecated backcompat syntax, replaced by use of TLS creds objects. Signed-off-by: Daniel P. Berrangé --- qemu-doc.texi | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/qemu-doc.texi b/qemu-doc.texi index abfd2db546..080548f79c 100644 --- a/qemu-doc.texi +++ b/qemu-doc.texi @@ -1097,7 +1097,9 @@ support provides a secure session, but no authentication. This allows any client to connect, and provides an encrypted session. @example -qemu-system-i386 [...OPTIONS...] -vnc :1,tls,x509=/etc/pki/qemu -monitor stdio +qemu-system-i386 [...OPTIONS...] \ + -object tls-creds-x509,id=tls0,dir=/etc/pki/qemu,endpoint=server,verify-peer=no \ + -vnc :1,tls-creds=tls0 -monitor stdio @end example In the above example @code{/etc/pki/qemu} should contain at least three files, @@ -1112,10 +1114,14 @@ only be readable by the user owning it. Certificates can also provide a means to authenticate the client connecting. The server will request that the client provide a certificate, which it will then validate against the CA certificate. This is a good choice if deploying -in an environment with a private internal certificate authority. +in an environment with a private internal certificate authority. It uses the +same syntax as previously, but with @code{verify-peer} set to @code{yes} +instead. @example -qemu-system-i386 [...OPTIONS...] -vnc :1,tls,x509verify=/etc/pki/qemu -monitor stdio +qemu-system-i386 [...OPTIONS...] \ + -object tls-creds-x509,id=tls0,dir=/etc/pki/qemu,endpoint=server,verify-peer=yes \ + -vnc :1,tls-creds=tls0 -monitor stdio @end example @@ -1126,7 +1132,9 @@ Finally, the previous method can be combined with VNC password authentication to provide two layers of authentication for clients. @example -qemu-system-i386 [...OPTIONS...] -vnc :1,password,tls,x509verify=/etc/pki/qemu -monitor stdio +qemu-system-i386 [...OPTIONS...] \ + -object tls-creds-x509,id=tls0,dir=/etc/pki/qemu,endpoint=server,verify-peer=yes \ + -vnc :1,tls-creds=tls0,password -monitor stdio (qemu) change vnc password Password: ******** (qemu) @@ -1163,7 +1171,9 @@ credentials. This can be enabled, by combining the 'sasl' option with the aforementioned TLS + x509 options: @example -qemu-system-i386 [...OPTIONS...] -vnc :1,tls,x509,sasl -monitor stdio +qemu-system-i386 [...OPTIONS...] \ + -object tls-creds-x509,id=tls0,dir=/etc/pki/qemu,endpoint=server,verify-peer=yes \ + -vnc :1,tls-creds=tls0,sasl -monitor stdio @end example @node vnc_setup_sasl From patchwork Wed Jul 25 09:27:51 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= X-Patchwork-Id: 10543755 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id C5981112E for ; Wed, 25 Jul 2018 09:29:13 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B3B2D29A23 for ; Wed, 25 Jul 2018 09:29:13 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id A644729A3E; Wed, 25 Jul 2018 09:29:13 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 07E4529A23 for ; Wed, 25 Jul 2018 09:29:13 +0000 (UTC) Received: from localhost ([::1]:46988 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fiG6a-0002UR-90 for patchwork-qemu-devel@patchwork.kernel.org; Wed, 25 Jul 2018 05:29:12 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:58278) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fiG5R-0002Rj-NN for qemu-devel@nongnu.org; Wed, 25 Jul 2018 05:28:04 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fiG5O-0000f3-NU for qemu-devel@nongnu.org; Wed, 25 Jul 2018 05:28:01 -0400 Received: from mx3-rdu2.redhat.com ([66.187.233.73]:52972 helo=mx1.redhat.com) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fiG5O-0000er-GH for qemu-devel@nongnu.org; Wed, 25 Jul 2018 05:27:58 -0400 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.rdu2.redhat.com [10.11.54.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 2572E40252EC for ; Wed, 25 Jul 2018 09:27:58 +0000 (UTC) Received: from localhost.localdomain.com (unknown [10.33.36.89]) by smtp.corp.redhat.com (Postfix) with ESMTP id 235DB2156898; Wed, 25 Jul 2018 09:27:56 +0000 (UTC) From: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= To: qemu-devel@nongnu.org Date: Wed, 25 Jul 2018 10:27:51 +0100 Message-Id: <20180725092751.21767-3-berrange@redhat.com> In-Reply-To: <20180725092751.21767-1-berrange@redhat.com> References: <20180725092751.21767-1-berrange@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.78 on 10.11.54.6 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.6]); Wed, 25 Jul 2018 09:27:58 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.6]); Wed, 25 Jul 2018 09:27:58 +0000 (UTC) for IP:'10.11.54.6' DOMAIN:'int-mx06.intmail.prod.int.rdu2.redhat.com' HELO:'smtp.corp.redhat.com' FROM:'berrange@redhat.com' RCPT:'' X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 66.187.233.73 Subject: [Qemu-devel] [PATCH 2/2] vnc: remove support for deprecated tls, x509, x509verify options X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: libvir-list@redhat.com, Gerd Hoffmann Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP The 'tls-creds' option accepts the name of a TLS credentials object. This replaced the usage of 'tls', 'x509' and 'x509verify' options in 2.5.0. These deprecated options were grandfathered in when the deprecation policy was introduded in 2.10.0, so can now finally be removed. Signed-off-by: Daniel P. Berrangé --- qemu-deprecated.texi | 20 ---------- qemu-options.hx | 43 --------------------- ui/vnc.c | 91 -------------------------------------------- 3 files changed, 154 deletions(-) diff --git a/qemu-deprecated.texi b/qemu-deprecated.texi index 9920a85adc..6b92cec48a 100644 --- a/qemu-deprecated.texi +++ b/qemu-deprecated.texi @@ -40,26 +40,6 @@ which is the default. The ``-no-kvm'' argument is now a synonym for setting ``-machine accel=tcg''. -@subsection -vnc tls (since 2.5.0) - -The ``-vnc tls'' argument is now a synonym for setting -``-object tls-creds-anon,id=tls0'' combined with -``-vnc tls-creds=tls0' - -@subsection -vnc x509 (since 2.5.0) - -The ``-vnc x509=/path/to/certs'' argument is now a -synonym for setting -``-object tls-creds-x509,dir=/path/to/certs,id=tls0,verify-peer=no'' -combined with ``-vnc tls-creds=tls0' - -@subsection -vnc x509verify (since 2.5.0) - -The ``-vnc x509verify=/path/to/certs'' argument is now a -synonym for setting -``-object tls-creds-x509,dir=/path/to/certs,id=tls0,verify-peer=yes'' -combined with ``-vnc tls-creds=tls0' - @subsection -tftp (since 2.6.0) The ``-tftp /some/dir'' argument is replaced by either diff --git a/qemu-options.hx b/qemu-options.hx index b1bf0f485f..bf09c5b4e7 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -1654,49 +1654,6 @@ will cause the VNC server socket to enable the VeNCrypt auth mechanism. The credentials should have been previously created using the @option{-object tls-creds} argument. -The @option{tls-creds} parameter obsoletes the @option{tls}, -@option{x509}, and @option{x509verify} options, and as such -it is not permitted to set both new and old type options at -the same time. - -@item tls - -Require that client use TLS when communicating with the VNC server. This -uses anonymous TLS credentials so is susceptible to a man-in-the-middle -attack. It is recommended that this option be combined with either the -@option{x509} or @option{x509verify} options. - -This option is now deprecated in favor of using the @option{tls-creds} -argument. - -@item x509=@var{/path/to/certificate/dir} - -Valid if @option{tls} is specified. Require that x509 credentials are used -for negotiating the TLS session. The server will send its x509 certificate -to the client. It is recommended that a password be set on the VNC server -to provide authentication of the client when this is used. The path following -this option specifies where the x509 certificates are to be loaded from. -See the @ref{vnc_security} section for details on generating certificates. - -This option is now deprecated in favour of using the @option{tls-creds} -argument. - -@item x509verify=@var{/path/to/certificate/dir} - -Valid if @option{tls} is specified. Require that x509 credentials are used -for negotiating the TLS session. The server will send its x509 certificate -to the client, and request that the client send its own x509 certificate. -The server will validate the client's certificate against the CA certificate, -and reject clients when validation fails. If the certificate authority is -trusted, this is a sufficient authentication mechanism. You may still wish -to set a password on the VNC server as a second authentication layer. The -path following this option specifies where the x509 certificates are to -be loaded from. See the @ref{vnc_security} section for details on generating -certificates. - -This option is now deprecated in favour of using the @option{tls-creds} -argument. - @item sasl Require that the client use SASL to authenticate with the VNC server. diff --git a/ui/vnc.c b/ui/vnc.c index 359693238b..fd929b0957 100644 --- a/ui/vnc.c +++ b/ui/vnc.c @@ -3344,10 +3344,6 @@ static QemuOptsList qemu_vnc_opts = { },{ .name = "tls-creds", .type = QEMU_OPT_STRING, - },{ - /* Deprecated in favour of tls-creds */ - .name = "x509", - .type = QEMU_OPT_STRING, },{ .name = "share", .type = QEMU_OPT_STRING, @@ -3384,14 +3380,6 @@ static QemuOptsList qemu_vnc_opts = { },{ .name = "sasl", .type = QEMU_OPT_BOOL, - },{ - /* Deprecated in favour of tls-creds */ - .name = "tls", - .type = QEMU_OPT_BOOL, - },{ - /* Deprecated in favour of tls-creds */ - .name = "x509verify", - .type = QEMU_OPT_STRING, },{ .name = "acl", .type = QEMU_OPT_BOOL, @@ -3519,51 +3507,6 @@ vnc_display_setup_auth(int *auth, } -/* - * Handle back compat with old CLI syntax by creating some - * suitable QCryptoTLSCreds objects - */ -static QCryptoTLSCreds * -vnc_display_create_creds(bool x509, - bool x509verify, - const char *dir, - const char *id, - Error **errp) -{ - gchar *credsid = g_strdup_printf("tlsvnc%s", id); - Object *parent = object_get_objects_root(); - Object *creds; - Error *err = NULL; - - if (x509) { - creds = object_new_with_props(TYPE_QCRYPTO_TLS_CREDS_X509, - parent, - credsid, - &err, - "endpoint", "server", - "dir", dir, - "verify-peer", x509verify ? "yes" : "no", - NULL); - } else { - creds = object_new_with_props(TYPE_QCRYPTO_TLS_CREDS_ANON, - parent, - credsid, - &err, - "endpoint", "server", - NULL); - } - - g_free(credsid); - - if (err) { - error_propagate(errp, err); - return NULL; - } - - return QCRYPTO_TLS_CREDS(creds); -} - - static int vnc_display_get_address(const char *addrstr, bool websocket, bool reverse, @@ -3930,15 +3873,6 @@ void vnc_display_open(const char *id, Error **errp) credid = qemu_opt_get(opts, "tls-creds"); if (credid) { Object *creds; - if (qemu_opt_get(opts, "tls") || - qemu_opt_get(opts, "x509") || - qemu_opt_get(opts, "x509verify")) { - error_setg(errp, - "'tls-creds' parameter is mutually exclusive with " - "'tls', 'x509' and 'x509verify' parameters"); - goto fail; - } - creds = object_resolve_path_component( object_get_objects_root(), credid); if (!creds) { @@ -3961,31 +3895,6 @@ void vnc_display_open(const char *id, Error **errp) "Expecting TLS credentials with a server endpoint"); goto fail; } - } else { - const char *path; - bool tls = false, x509 = false, x509verify = false; - tls = qemu_opt_get_bool(opts, "tls", false); - if (tls) { - path = qemu_opt_get(opts, "x509"); - - if (path) { - x509 = true; - } else { - path = qemu_opt_get(opts, "x509verify"); - if (path) { - x509 = true; - x509verify = true; - } - } - vd->tlscreds = vnc_display_create_creds(x509, - x509verify, - path, - vd->id, - errp); - if (!vd->tlscreds) { - goto fail; - } - } } acl = qemu_opt_get_bool(opts, "acl", false);