diff options
author | Gerd Hoffmann <kraxel@redhat.com> | 2010-03-11 11:13:32 -0300 |
---|---|---|
committer | Gerd Hoffmann <kraxel@redhat.com> | 2010-08-04 15:32:44 +0200 |
commit | 2bb36dd7a2e960e7b2000df0977ddc7c2ed84c9c (patch) | |
tree | 2e1e525ac2d8cc2a9d550de99ef740c85da1f55f | |
parent | 94213a333e35e6aa5095044ef54f64792c2d0303 (diff) |
spice: tls support
Add options to the -spice command line switch to setup tls:
tls-port
listening port
x509-dir
x509 file directory. Expects same filenames as
-vnc $display,x509=$dir
x509-key-file
x509-key-password
x509-cert-file
x509-cacert-file
x509-dh-key-file
x509 files can also be set individually.
tls-ciphers
which ciphers to use.
-rw-r--r-- | qemu-config.c | 24 | ||||
-rw-r--r-- | spice.c | 66 |
2 files changed, 86 insertions, 4 deletions
diff --git a/qemu-config.c b/qemu-config.c index 4cf3b535d..41c9d3fcf 100644 --- a/qemu-config.c +++ b/qemu-config.c @@ -351,11 +351,35 @@ QemuOptsList qemu_spice_opts = { .name = "port", .type = QEMU_OPT_NUMBER, },{ + .name = "tls-port", + .type = QEMU_OPT_NUMBER, + },{ .name = "password", .type = QEMU_OPT_STRING, },{ .name = "disable-ticketing", .type = QEMU_OPT_BOOL, + },{ + .name = "x509-dir", + .type = QEMU_OPT_STRING, + },{ + .name = "x509-key-file", + .type = QEMU_OPT_STRING, + },{ + .name = "x509-key-password", + .type = QEMU_OPT_STRING, + },{ + .name = "x509-cert-file", + .type = QEMU_OPT_STRING, + },{ + .name = "x509-cacert-file", + .type = QEMU_OPT_STRING, + },{ + .name = "x509-dh-key-file", + .type = QEMU_OPT_STRING, + },{ + .name = "tls-ciphers", + .type = QEMU_OPT_STRING, }, { /* end if list */ } }, @@ -9,6 +9,7 @@ #include "qemu-spice.h" #include "qemu-timer.h" #include "qemu-queue.h" +#include "qemu-x509.h" #include "monitor.h" /* core bits */ @@ -126,18 +127,71 @@ static SpiceCoreInterface core_interface = { void qemu_spice_init(void) { QemuOpts *opts = QTAILQ_FIRST(&qemu_spice_opts.head); - const char *password; - int port; + const char *password, *str, *x509_dir, + *x509_key_password = NULL, + *x509_dh_file = NULL, + *tls_ciphers = NULL; + char *x509_key_file = NULL, + *x509_cert_file = NULL, + *x509_cacert_file = NULL; + int port, tls_port, len; if (!opts) return; port = qemu_opt_get_number(opts, "port", 0); - if (!port) + tls_port = qemu_opt_get_number(opts, "tls-port", 0); + if (!port && !tls_port) return; password = qemu_opt_get(opts, "password"); + if (tls_port) { + x509_dir = qemu_opt_get(opts, "x509-dir"); + if (NULL == x509_dir) + x509_dir = "."; + len = strlen(x509_dir) + 32; + + str = qemu_opt_get(opts, "x509-key-file"); + if (str) { + x509_key_file = qemu_strdup(str); + } else { + x509_key_file = qemu_malloc(len); + snprintf(x509_key_file, len, "%s/%s", x509_dir, X509_SERVER_KEY_FILE); + } + + str = qemu_opt_get(opts, "x509-cert-file"); + if (str) { + x509_cert_file = qemu_strdup(str); + } else { + x509_cert_file = qemu_malloc(len); + snprintf(x509_cert_file, len, "%s/%s", x509_dir, X509_SERVER_CERT_FILE); + } + + str = qemu_opt_get(opts, "x509-cacert-file"); + if (str) { + x509_cacert_file = qemu_strdup(str); + } else { + x509_cacert_file = qemu_malloc(len); + snprintf(x509_cacert_file, len, "%s/%s", x509_dir, X509_CA_CERT_FILE); + } + + x509_key_password = qemu_opt_get(opts, "x509-key-password"); + x509_dh_file = qemu_opt_get(opts, "x509-dh-file"); + tls_ciphers = qemu_opt_get(opts, "tls-ciphers"); + } + spice_server = spice_server_new(); - spice_server_set_port(spice_server, port); + if (port) { + spice_server_set_port(spice_server, port); + } + if (tls_port) { + spice_server_set_tls(spice_server, tls_port, + x509_cacert_file, + x509_cert_file, + x509_key_file, + x509_key_password, + x509_dh_file, + tls_ciphers); + } if (password) spice_server_set_ticket(spice_server, password, 0, 0, 0); if (qemu_opt_get_bool(opts, "disable-ticketing", 0)) @@ -150,4 +204,8 @@ void qemu_spice_init(void) using_spice = 1; qemu_spice_input_init(); + + qemu_free(x509_key_file); + qemu_free(x509_cert_file); + qemu_free(x509_cacert_file); } |