[Spice-devel] [PATCH 17/35] spice: add config options for channel security.

[alexl at redhat.com]

From: Gerd Hoffmann <kraxel at redhat.com>

This allows to enforce tls or plaintext usage for certain spice
channels.
---
 qemu-config.c   |    6 ++++++
 qemu-options.hx |    8 ++++++++
 ui/spice-core.c |   25 +++++++++++++++++++++++++
 3 files changed, 39 insertions(+), 0 deletions(-)

diff --git a/qemu-config.c b/qemu-config.c
index b305286..7b447d7 100644
--- a/qemu-config.c
+++ b/qemu-config.c
@@ -374,6 +374,12 @@ QemuOptsList qemu_spice_opts = {
             .name = "tls-ciphers",
             .type = QEMU_OPT_STRING,
         },{
+            .name = "tls-channel",
+            .type = QEMU_OPT_STRING,
+        },{
+            .name = "plaintext-channel",
+            .type = QEMU_OPT_STRING,
+        },{
             .name = "image-compression",
             .type = QEMU_OPT_STRING,
         },{
diff --git a/qemu-options.hx b/qemu-options.hx
index 9f3e3d2..fcb3ccd 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -704,6 +704,14 @@ The x509 file names can also be configured individually.
 @item tls-ciphers=<list>
 Specify which ciphers to use.
 
+ at item tls-channel=[main|display|inputs|record|playback|tunnel]
+ at item plaintext-channel=[main|display|inputs|record|playback|tunnel]
+Force specific channel to be used with or without TLS encryption.  The
+options can be specified multiple times to configure multiple
+channels.  The special name "default" can be used to set the default
+mode.  For channels which are not explicitly forced into one mode the
+spice client is allowed to pick tls/plaintext as he pleases.
+
 @item image-compression=[auto_glz|auto_lz|quic|glz|lz|off]
 Configure image compression (lossless).
 Default is auto_glz.
diff --git a/ui/spice-core.c b/ui/spice-core.c
index 1567046..8f73848 100644
--- a/ui/spice-core.c
+++ b/ui/spice-core.c
@@ -192,6 +192,29 @@ static const char *wan_compression_names[] = {
 
 /* functions for the rest of qemu */
 
+static int add_channel(const char *name, const char *value, void *opaque)
+{
+    int security = 0;
+    int rc;
+
+    if (strcmp(name, "tls-channel") == 0)
+        security = SPICE_CHANNEL_SECURITY_SSL;
+    if (strcmp(name, "plaintext-channel") == 0)
+        security = SPICE_CHANNEL_SECURITY_NONE;
+    if (security == 0)
+        return 0;
+    if (strcmp(value, "default") == 0) {
+        rc = spice_server_set_channel_security(spice_server, NULL, security);
+    } else {
+        rc = spice_server_set_channel_security(spice_server, value, security);
+    }
+    if (rc != 0) {
+        fprintf(stderr, "spice: failed to set channel security for %s\n", value);
+        exit(1);
+    }
+    return 0;
+}
+
 void qemu_spice_init(void)
 {
     QemuOpts *opts = QTAILQ_FIRST(&qemu_spice_opts.head);
@@ -293,6 +316,8 @@ void qemu_spice_init(void)
     }
     spice_server_set_zlib_glz_compression(spice_server, wan_compr);
 
+    qemu_opt_foreach(opts, add_channel, NULL, 0);
+
     spice_server_init(spice_server, &core_interface);
     using_spice = 1;
 
-- 
1.7.0.1