[Spice-devel] Feature suggestion: Port tunneling between VM & client over spice-channel

Wed Nov 14 15:16:27 UTC 2018

Hi
El mié, 14-11-2018 a las 12:49 +0100, Victor Toso escribió:
> Hi,
> On Wed, Nov 14, 2018 at 11:38:23AM +0900, Boris Morozov wrote:
> Hello, dear friends. I would like a share idea with you aboutnew
> feature. Please forgive me if i wrong.
> Current approach to publish ports from virtual machine isconnecting
> it to network by network adapter.
> In this case administrator should to write:- Routes- DNS-records-
> Firewall rules
> In final result: - Virtual machine start going to Internet from host
> local or  ISP network.- Virtual machine user can attack gateways and
> peer nodes in  host network.- Virtual machine user can attack global
> sites, services and  leave host IP it will raise problems with owners
> of attacked  sites and services, authorities.- Virtual machine user
> can download illegal or forbidden  content and leave host IP it will
> raise problems with  authorities.- Virtual machine can be attacked
> from other nodes in host  network and internet.Internet gateway on
> host network should open extra ports toperform access to virtual
> machine.- Some computing power of host is begin to spent on NIC
> and  network emulation. - Some time of administrator was spent to
> configuring and  testing routing, dns, firewall.
> To avoid this responibility and performance problems and reducetime
> on configuration when public access to virtual machine notneeded it's
> better way to tunnel ports on virtual machine fromguest and vice-
> versa by SPICE.
> I think that was implemented at some point in the past, we dohave the
> deprecated type SPICE_CHANNEL_TUNNEL and AFAIK,something like using
> client's internet in the guest wassupported.
> In case of port tunneling over SPICE 
> 1. In virtual machine running services and they opened ports   (HTTP,
> SSH for example) on localhost (127.0.0.1). 2. Spice guest agent in
> virtual machine open client-port and   become ready to connect to
> services ports from client-port and   redirect data to spice channel.
> 3. In other end of spice channel on client spice client open   ports
> for listening incoming connections on client localhost   (127.0.0.1).
> 4. Client user connect to tunneled ports on client-side   localhost
> and start working with tunneled ports as with local   ones. 5. Spice
> client & guest agent perform traffic redirection.
> As we can see offered approach is more simple. It can't be
> usedagainst traditional approach in public access but in
> personalaccess it's look better. Also it's looks possible to tunnel
> notonly localhost ports on virtual machine and others nodes onesif
> network is working. 
> Use cases:- Web-browsing virtual machine sites on client machine-
> Web-sites, network services (daemons) development- Internet access in
> virtual machine via proxies on client  (TOR, VPN, SOCKS, HTTP)-
> Monitoring (getting access to API and dashboards) of
> various  services: printers, miners, solar power chargers, UPS
> and  others. - File transfer between client and virtual machine via
> FTP,  SFTP, HTTP- Stream transfer between client and virtual machine
> video,  audio and others.- VDI-hosting (Isolated preinstalled VM
> without NIC)
> Are you only suggesting the feature or do you plan to implementit? If
> the later, the best way to make guest talk to clientnowadays is by
> using port channel. We do have a spice-webdavddaemon that works in
> windows and linux guest that makes sharing afolder possible (with
> WebDAV protocol).

FYI, in flexVDI we have already implemented this feature. We just had
not the time to split it into meaningful patches and share it with the
list. If you are really interested, we can try to dedicate some time to
it.
Our implementation allows to redirect local and remote TCP ports, just
like -L and -R options in ssh. A SOCKS proxy shouldn't be hard to
implement too. However, we did not use a separate channel. We use the
main channel, like with file transfers, because the client communicates
with the vdagent in the guest. Our changes affect spice-gtk, spice-
protocol, vdagent-linux and vdagent-win32. Maybe it would be a better
idea to have a separate channel+virtio_port+agent for this, what do you
think?
You can have a look at our implementation in our spice-* repos at
GitHub:https://github.com/flexvdiThe vdagent-part is not there, but I
could share the code with you if you are interested.
Best regards
> Cheers,Victor
> _______________________________________________Spice-devel mailing
> listSpice-devel at lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/spice-devel
-- 


            Javier Celaya Alastrué
          
           Chief Technology Officer
      
      
        javier.celaya at flexvdi.com
        
        
        +34696969959 
      
          
        j_celaya
        
        
        Legal Information and Privacy Policy
          
      
            Política de confidencialidad
            Este mensaje y los ficheros anexos son confidenciales dirigiéndose exclusivamente al destinatario mencionado en el encabezamiento. Si usted ha recibido este correo por error, tenga la amabilidad de eliminarlo de su sistema y no divulgar el contenido a terceros. Los datos personales facilitados por usted o por terceros serán tratados por FLEXIBLE SOFTWARE SOLUTIONS S.L.U. con la finalidad de gestionar y mantener los contactos y relaciones que se produzcan como consecuencia de la relación que mantiene con FLEXIBLE SOFTWARE SOLUTIONS S.L.U. Normalmente, la base jurídica que legitima este tratamiento, será su consentimiento, el interés legítimo o la necesidad para gestionar una relación contractual o similar. El plazo de conservación de sus datos vendrá determinado por la relación que mantiene con nosotros. Para más información al respecto, o para ejercer sus derechos de acceso, rectificación, supresión, oposición, limitación o portabilidad, dirija una comunicación por escrito a FLEXIBLE SOFTWARE SOLUTIONS S.L.U: Avenida de Ranillas 1D, Planta 3, Oficina 3G, Zaragoza o al correo electrónico pdo at flexvdi.com. En caso de considerar vulnerado su derecho a la protección de datos personales, podrá interponer una reclamación ante la Agencia Española de Protección de Datos (www.agpd.es). 
        
    
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/spice-devel/attachments/20181114/4dde03c0/attachment.html>