Skip to content

Q
qemu

openeuler / qemu

通知 10
Star 0
Fork 0
Q
qemu
切换分支/标签
  1. 21 5月, 2009 1 次提交
    • A
      Eliminate --disable-gfx-check and make VNC default when SDL not available · f92f8afe
      由 Anthony Liguori 提交于 
       --disable-gfx-check predates VNC server support.  It made sense back then
because the only thing you could do without SDL was use -nographic mode or
similar tricks.  Since this is a very advanced mode of operation, gfx-check
provided a good safety net for casual users.

A casual user is very likely to use VNC to interact with a guest.  In fact, it's
often frustrating to install QEMU on a server and have to specify
disable-gfx-check when you only want to use VNC.

This patch eliminates disable-gfx-check and makes SDL behave like every other
optional dependency.  If SDL is not available, instead of failing ungracefully
if no special options are specified, we default to -vnc localhost:0,to=99.
When we do default to VNC, we also print a message to tell the user that we've
done this include which port we're currently listening on.
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
      f92f8afe
  3. 19 5月, 2009 1 次提交
    • P
      Hardware convenience library · 1ad2134f
      由 Paul Brook 提交于 
      The only target dependency for most hardware is sizeof(target_phys_addr_t).
Build these files into a convenience library, and use that instead of
building for every target.

Remove and poison various target specific macros to avoid bogus target
dependencies creeping back in.

Big/Little endian is not handled because devices should not know or care
about this to start with.
Signed-off-by: NPaul Brook <paul@codesourcery.com>
      1ad2134f
  5. 15 5月, 2009 2 次提交
  7. 14 5月, 2009 1 次提交
  9. 08 5月, 2009 1 次提交
    • J
      Drop CONFIG_GDBSTUB · 322f9d01
      由 Jan Kiszka 提交于 
      This is no user-flippable switch, and no arch makes use of disabling
gdbstub support. So it's pointless to keep the related #ifdefs and
configure hunks around - and risking breakages like 711c410fdd again.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
      322f9d01
  11. 29 4月, 2009 1 次提交
  13. 28 4月, 2009 1 次提交
  15. 25 4月, 2009 1 次提交
  17. 22 4月, 2009 2 次提交
  19. 19 4月, 2009 2 次提交
  21. 18 4月, 2009 1 次提交
  23. 17 4月, 2009 1 次提交
  25. 16 4月, 2009 3 次提交
  27. 14 4月, 2009 5 次提交
  29. 11 4月, 2009 1 次提交
  31. 08 4月, 2009 3 次提交
  33. 06 4月, 2009 3 次提交
  35. 04 4月, 2009 1 次提交
  37. 19 3月, 2009 1 次提交
  39. 10 3月, 2009 1 次提交
  41. 09 3月, 2009 1 次提交
  43. 08 3月, 2009 2 次提交
  45. 07 3月, 2009 2 次提交
    • A
      Support ACLs for controlling VNC access ("Daniel P. Berrange") · 76655d6d
      由 aliguori 提交于 
      This patch introduces a generic internal API for access control lists
to be used by network servers in QEMU. It adds support for checking
these ACL in the VNC server, in two places. The first ACL is for the
SASL authentication mechanism, checking the SASL username. This ACL
is called 'vnc.username'. The second is for the TLS authentication
mechanism, when x509 client certificates are turned on, checking against
the Distinguished Name of the client. This ACL is called 'vnc.x509dname'

The internal API provides for an ACL with the following characteristics

 - A unique name, eg  vnc.username, and vnc.x509dname.
 - A default policy, allow or deny
 - An ordered series of match rules, with allow or deny policy

If none of the match rules apply, then the default policy is
used.

There is a monitor API to manipulate the ACLs, which I'll describe via
examples

  (qemu) acl show vnc.username
  policy: allow
  (qemu) acl policy vnc.username denya
  acl: policy set to 'deny'
  (qemu) acl allow vnc.username fred
  acl: added rule at position 1
  (qemu) acl allow vnc.username bob
  acl: added rule at position 2
  (qemu) acl allow vnc.username joe 1
  acl: added rule at position 1
  (qemu) acl show vnc.username
  policy: deny
  0: allow fred
  1: allow joe
  2: allow bob


  (qemu) acl show vnc.x509dname
  policy: allow
  (qemu) acl policy vnc.x509dname deny
  acl: policy set to 'deny'
  (qemu) acl allow vnc.x509dname C=GB,O=ACME,L=London,CN=*
  acl: added rule at position 1
  (qemu) acl allow vnc.x509dname C=GB,O=ACME,L=Boston,CN=bob
  acl: added rule at position 2
  (qemu) acl show vnc.x509dname
  policy: deny
  0: allow C=GB,O=ACME,L=London,CN=*
  1: allow C=GB,O=ACME,L=Boston,CN=bob

By default the VNC server will not use any ACLs, allowing access to
the server if the user successfully authenticates. To enable use of
ACLs to restrict user access, the ',acl' flag should be given when
starting QEMU. The initial ACL activated will be a 'deny all' policy
and should be customized using monitor commands.

eg enable SASL auth and ACLs

    qemu ....  -vnc localhost:1,sasl,acl

The next patch will provide a way to load a pre-defined ACL when
starting up


 Makefile        |    6 +
 b/acl.c         |  185 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 b/acl.h         |   74 ++++++++++++++++++++++
 configure       |   18 +++++
 monitor.c       |   95 ++++++++++++++++++++++++++++
 qemu-doc.texi   |   49 ++++++++++++++
 vnc-auth-sasl.c |   16 +++-
 vnc-auth-sasl.h |    7 ++
 vnc-tls.c       |   19 +++++
 vnc-tls.h       |    3 
 vnc.c           |   21 ++++++
 vnc.h           |    3 
 12 files changed, 491 insertions(+), 5 deletions(-)
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6726 c046a42c-6fe2-441c-8c8c-71466251a162
      76655d6d
    • A
      Add SASL authentication support ("Daniel P. Berrange") · 2f9606b3
      由 aliguori 提交于 
      This patch adds the new SASL authentication protocol to the VNC server.

It is enabled by setting the 'sasl' flag when launching VNC. SASL can
optionally provide encryption via its SSF layer, if a suitable mechanism
is configured (eg, GSSAPI/Kerberos, or Digest-MD5).  If an SSF layer is
not available, then it should be combined with the x509 VNC authentication
protocol which provides encryption.

eg, if using GSSAPI

   qemu -vnc localhost:1,sasl

eg if using  TLS/x509 for encryption

   qemu -vnc localhost:1,sasl,tls,x509


By default the Cyrus SASL library will look for its configuration in
the file /etc/sasl2/qemu.conf.  For non-root users, this can be overridden
by setting the SASL_CONF_PATH environment variable, eg to make it look in
$HOME/.sasl2.  NB unprivileged users may not have access to the full range
of SASL mechanisms, since some of them require some administrative privileges
to configure. The patch includes an example SASL configuration file which
illustrates config for GSSAPI and Digest-MD5, though it should be noted that
the latter is not really considered secure any more.

Most of the SASL authentication code is located in a separate source file,
vnc-auth-sasl.c.  The main vnc.c file only contains minimal integration
glue, specifically parsing of command line flags / setup, and calls to
start the SASL auth process, to do encoding/decoding for data.

There are several possible stacks for reading & writing of data, depending
on the combo of VNC authentication methods in use

 - Clear.    read/write straight to socket
 - TLS.      read/write via GNUTLS helpers
 - SASL.     encode/decode via SASL SSF layer, then read/write to socket
 - SASL+TLS. encode/decode via SASL SSF layer, then read/write via GNUTLS

Hence, the vnc_client_read & vnc_client_write methods have been refactored
a little.

   vnc_client_read:  main entry point for reading, calls either

       - vnc_client_read_plain   reading, with no intermediate decoding
       - vnc_client_read_sasl    reading, with SASL SSF decoding

   These two methods, then call vnc_client_read_buf(). This decides
   whether to write to the socket directly or write via GNUTLS.

The situation is the same for writing data. More extensive comments
have been added in the code / patch. The vnc_client_read_sasl and
vnc_client_write_sasl method implementations live in the separate
vnc-auth-sasl.c file.

The state required for the SASL auth mechanism is kept in a separate
VncStateSASL struct, defined in vnc-auth-sasl.h and included in the
main VncState.

The configure script probes for SASL and automatically enables it
if found, unless --disable-vnc-sasl was given to override it.


 Makefile            |    7 
 Makefile.target     |    5 
 b/qemu.sasl         |   34 ++
 b/vnc-auth-sasl.c   |  626 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 b/vnc-auth-sasl.h   |   67 +++++
 configure           |   34 ++
 qemu-doc.texi       |   97 ++++++++
 vnc-auth-vencrypt.c |   12 
 vnc.c               |  249 ++++++++++++++++++--
 vnc.h               |   31 ++
 10 files changed, 1129 insertions(+), 33 deletions(-)
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6724 c046a42c-6fe2-441c-8c8c-71466251a162
      2f9606b3
  47. 04 3月, 2009 1 次提交
  49. 23 2月, 2009 1 次提交