Bug 1435352

Summary: qemu started with "-vnc none,..." doesn't support any VNC authentication
Product: Red Hat Enterprise Linux 7 Reporter: Pavel Hrdina <phrdina>
Component: qemu-kvmAssignee: Marc-Andre Lureau <marcandre.lureau>
Status: CLOSED ERRATA QA Contact: Guo, Zhiyi <zhguo>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 7.4CC: chayang, jinzhao, juzhang, juzhou, knoel, mrezanin, phrdina, rbalakri, tzheng, virt-maint, xiaodwan
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: qemu-kvm-1.5.3-142.el7 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-04-10 14:32:19 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Pavel Hrdina 2017-03-23 15:20:44 UTC
Description of problem:

The issue here is that qemu started with "-vnc none,..." reports invalid authentication method to VNC clients like virt-manager or virt-viewer and they are forced to tell qemu to skip authentication via libvirt.

See Bug 1434551 how virt-manager needs to workaround this issue.

Version-Release number of selected component (if applicable):
all versions of qemu

Comment 2 Marc-Andre Lureau 2017-03-28 16:07:22 UTC
Sent to QEMU list:
[PATCH] vnc: allow to connect with add_client when -vnc none

Comment 3 Marc-Andre Lureau 2017-06-06 09:07:50 UTC
The bug does not seem to happen with qemu-kvm-1.5.3-139.el7, I suppose it's a regression of a later version refactoring (the code change significantly there).

Pavel, could you confirm? I suggest to close this bug if it doesn't happen.

Comment 5 Pavel Hrdina 2017-06-07 11:24:01 UTC
This bug is valid also for qemu-kvm, I've just tested it with qemu-kvm-1.5.3-140.el7.  The code is significantly different but the same issue is there:

vnc.c:2996

    ...
    if (strcmp(display, "none") == 0)
        return;
    ...

To test it you can comment these lines in /usr/share/virt-manager/virtManager/domain.py:1198

        graphics = self.get_graphics_devices()[0]
        if (graphics.type == "vnc" and
            graphics.get_first_listen_type() == "none"):
            flags = libvirt.VIR_DOMAIN_OPEN_GRAPHICS_SKIPAUTH

and create a guest with VNC and listen type set to "none".  If the workaround in virt-manager is commented you get a message "Viewer was disconnected".

Comment 6 Marc-Andre Lureau 2017-06-09 14:24:13 UTC
Sent patch "[RHEL-7.4 qemu-kvm PATCH] vnc: allow to connect with add_client when -vnc none" on rhvirt-list.

Comment 8 Miroslav Rezanina 2017-09-20 12:28:40 UTC
Fix included in qemu-kvm-1.5.3-142.el7

Comment 10 Guo, Zhiyi 2017-12-25 00:52:45 UTC
Reproduce this issue against qemu-kvm-1.5.3-140.el7.x86_64.

Steps:
1. Try to boot guest with xml:
    </channel>
    <input type='tablet' bus='usb'>
      <alias name='input0'/>
      <address type='usb' bus='0' port='1'/>
    </input>
    <input type='mouse' bus='ps2'>
      <alias name='input1'/>
    </input>
    <input type='keyboard' bus='ps2'>
      <alias name='input2'/>
    </input>
    <graphics type='vnc' port='-1' autoport='yes'>
      <listen type='none'/>
    </graphics>
    <sound model='ich9'>
      <alias name='sound0'/>
      <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/>
    </sound>
    <video>
      <model type='cirrus' heads='1' primary='yes'/>
      <alias name='video0'/>
      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>
    </video>
    <redirdev bus='usb' type='spicevmc'>
      <alias name='redir0'/>
      <address type='usb' bus='0' port='2'/>
    </redirdev>
    <redirdev bus='usb' type='spicevmc'>
      <alias name='redir1'/>
      <address type='usb' bus='0' port='3'/>
    </redirdev>
    <memballoon model='virtio'>
      <alias name='balloon0'/>
      <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/>
    </memballoon>
  </devices>
  <seclabel type='dynamic' model='selinux' relabel='yes'>
    <label>system_u:system_r:svirt_t:s0:c218,c534</label>
    <imagelabel>system_u:object_r:svirt_image_t:s0:c218,c534</imagelabel>
  </seclabel>
  <seclabel type='dynamic' model='dac' relabel='yes'>
    <label>+107:+107</label>
    <imagelabel>+107:+107</imagelabel>
  </seclabel>
</domain>
2. launch virt-manager, try to connect this domain.

Results:
qemu display cannot be opened and virt-manager will prompt: Viewer was disconnected.

Verify this issue against qemu-kvm-1.5.3-151.el7.x86_64.
After step2, qemu display will be opened correctly.

Comment 11 Guo, Zhiyi 2017-12-25 00:53:20 UTC
Verified per comment 10

Comment 15 errata-xmlrpc 2018-04-10 14:32:19 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2018:0816