Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Created attachment 1551367[details]
spice-debug.log
Description of problem:
If I migrate VM after spice password expires, the spice connection is interrupted
Version-Release number of selected component (if applicable):
client rhel8.0:
spice-glib-0.35-7.el8.x86_64
spice-gtk3-0.35-7.el8.x86_64
virt-viewer-7.0-3.el8.x86_64
guest rhel8.1:
spice-vdagent-0.18.0-3.el8.x86_64
spice-server-0.14.0-7.el8.x86_64
spice-glib-0.35-7.el8.x86_64
spice-gtk3-0.35-7.el8.x86_64
host rhel7.6-z:
qemu-kvm-rhev-2.12.0-21.el7.x86_64
spice-server-0.14.0-6.el7_6.1.x86_64
vdsm-4.30.12-1.el7ev.x86_64
libvirt-4.5.0-10.el7_6.6.x86_64
migration performed using rhv-4.3.3.1-0.1
How reproducible:
always
Steps to Reproduce:
1.run VM in RHV
2.connect to it using remote-viewer
3.wait 120s
4.migrate VM
Actual results:
Two possible results
Either remote-viewer prompts for spice password
or shows display of disconnected VM
Expected results:
Guest Vm is available through SPICE after migration
Additional info:
Target host has:
> (process:4881): Spice-WARNING **: 14:53:06.632: reds.c:2318:reds_handle_read_link_done: spice channels 1 should be encrypted
> (process:4881): Spice-WARNING **: 14:53:06.654: reds.c:2079:reds_handle_ticket: Ticketing is enabled, but no password is set. please set a ticket first
I have to double check but this is likely qemu/spice issue.
Discussed a bit with Frediano yesterday about this bug.
- Given that the password expires, this might be the right outcome (although the error message mentioned in comment #8 is a bit misleading).
- If that was working before, it might have been a security bug (pointed out by Frediano) as the migration data between source and target host
can't verify that is the same client connecting.
So, this might not be a bug but a feature and requiring that client stays connected on migration with expired password would be an RFE with new protocol.
I'll be looking at what might have changed from the versions you mentioned, many thanks for the test.
- stays connected: rhv-4.2.8.6_SNAPSHOT-163.g5b23737.0.scratch.master.el7ev
- this bug ..... : rhv-4.3.3.1-0.1
> So it seems this is a regression to me.
Just to clarify the comment #16 - this is a behavior regression but the expected behavior might have been a bug, which by fixing it introduced this change in behavior.
Let me see how it was working before and what changed before anything else.
With the following patch [0], the client would not hang any more. The authentication failure is raised from spice-gtk to remote-viewer which asks for user/password to login. Considering that the login was using the vv file, likely we should not request user input for user/password and just raise a notification that connection is dropped due lack of permissions on new host after migration, or something like that.
[0] https://lists.freedesktop.org/archives/spice-devel/2019-September/050710.html
As mentioned in comment #16 - having the client to connect from current host to target host with expired authentication would require some work, likely new protocol messages to keep sessions secure.
- Setting needinfo to PM to see what should be done and prioritized.
- Setting the bug to POST as patch [0] fixes the hang and exits the client after it cancels the user/password widget.
Hi Victor,
as the hang is resolved, I think reconnecting is something that could be done. For security reasons we should probably still investigate into that session persistence across live-migrations.
The main attack vectors I can see:
- The session disconnects
- Someone else connects to the session and reuses the users session
Of course we could lock the screen but would that happen in this scenario as well?
Can we ensure that the screen is locked everytime this happens?
As I believe that this is hard to achieve, I would suggest to open a new RFE for getting that session persistence.
Thanks!
Martin
Reproduced with spice-gtk-0.35-4.el7 so I'll clone for RHEL 7.8 too and as discussed, I'll be fixing the hang.
Moving this bug to spice-gtk and cloning it.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory (spice-gtk bug fix and enhancement update), and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHEA-2020:4817
Created attachment 1551367 [details] spice-debug.log Description of problem: If I migrate VM after spice password expires, the spice connection is interrupted Version-Release number of selected component (if applicable): client rhel8.0: spice-glib-0.35-7.el8.x86_64 spice-gtk3-0.35-7.el8.x86_64 virt-viewer-7.0-3.el8.x86_64 guest rhel8.1: spice-vdagent-0.18.0-3.el8.x86_64 spice-server-0.14.0-7.el8.x86_64 spice-glib-0.35-7.el8.x86_64 spice-gtk3-0.35-7.el8.x86_64 host rhel7.6-z: qemu-kvm-rhev-2.12.0-21.el7.x86_64 spice-server-0.14.0-6.el7_6.1.x86_64 vdsm-4.30.12-1.el7ev.x86_64 libvirt-4.5.0-10.el7_6.6.x86_64 migration performed using rhv-4.3.3.1-0.1 How reproducible: always Steps to Reproduce: 1.run VM in RHV 2.connect to it using remote-viewer 3.wait 120s 4.migrate VM Actual results: Two possible results Either remote-viewer prompts for spice password or shows display of disconnected VM Expected results: Guest Vm is available through SPICE after migration Additional info: