Hide Forgot
Description of problem: when issueing a setVmTicket with a spice connection there is an additional parameter available in qemu that determines the behavior with an existing client. This needs to be exported to libvirt users. The complete command that needs to be supported is: set_password protocol password action-if-connected action-if-connected supported (see monitor.c) are: fail disconnect keep
Patch sent upstream for review: https://www.redhat.com/archives/libvir-list/2011-May/msg01854.html
Wasn't good enough. Sent another version: https://www.redhat.com/archives/libvir-list/2011-June/msg00413.html
Pushed upstream: commit 30c43afd73e8c2931dc210562066ba37a8b9fe26 Author: Michal Privoznik <mprivozn> Date: Thu May 26 16:15:54 2011 +0200 graphics: add support for action_if_connected in qemu This option accepts 3 values: -keep, to keep current client connected (Spice+VNC) -disconnect, to disconnect client (Spice) -fail, to fail setting password if there is a client connected (Spice) v0.9.3-39-g30c43af This feature is accesible via 'connected' attribute of <graphics> element.
tested with libvirt-0.9.3-5.el6.x86_64 qemu-kvm-0.12.1.2-2.169.el6.x86_64 kernel-2.6.32-166.el6.x86_64 # virsh dumpxml --security-info spice <graphics type='spice' port='5900' tlsPort='5901' autoport='yes' listen='0.0.0.0' passwd='aaabbb' connected='disconnect'/> # cat spice-new.xml <graphics type='spice' port='5900' tlsPort='5901' autoport='yes' listen='0.0.0.0' passwd='cccddd' connected='disconnect'/> # virsh update-device spice spice-new.xml Device updated successfully spice client doesn't get disconnected # virsh dumpxml --security-info spice <graphics type='spice' port='5900' tlsPort='5901' autoport='yes' listen='0.0.0.0' passwd='aaabbb' connected='keep'/> # cat spice-new.xml <graphics type='spice' port='5900' tlsPort='5901' autoport='yes' listen='0.0.0.0' passwd='cccddd' connected='keep'/> # virsh update-device spice spice-new.xml Device updated successfully spice client keep connection # virsh dumpxml --security-info spice <graphics type='spice' port='5900' tlsPort='5901' autoport='yes' listen='0.0.0.0' passwd='aaabbb' connected='fail'/> # cat spice-new.xml <graphics type='spice' port='5900' tlsPort='5901' autoport='yes' listen='0.0.0.0' passwd='cccddd' connected='fail'/> # virsh update-device spice spice-new.xml Device updated successfully there is no error prompt for spice passwd changing . # virsh dumpxml --security-info vnc <graphics type='vnc' port='-1' autoport='yes' listen='0.0.0.0' passwd='aaabbb' connected='keep'/> # cat vnc-new.xml <graphics type='vnc' port='-1' autoport='yes' listen='0.0.0.0' passwd='cccddd' connected='keep'/> # virsh update-device spice spice-new.xml Device updated successfully vnc connection keeps connected . From the result ,we can see the spice part doesn't meet the expected result keep = keep them connected, disconnect - disconnect them, fail - fail changing password Set the bug status to ASSIGNED
Vivian, VNC supports "connected=keep" only. Spice should support all three parameters. Can you please provide a full libvirt debug log, so I can see what commands are send to QEMU (this means don't set any filter in config)? Thanks
Created attachment 514642 [details] /var/log/libvirtd.log tested with libvirt-0.9.3-7.el6.x86_64 steps: 1. set log_level=1 and log_outputs="1:file:/var/log/libvirtd.log" 2. repeat the steps in comment7 . Paste the required log here called libvirtd.log
VERIFIED with libvirt-0.9.4-0rc2.el6.x86_64 qemu-kvm-0.12.1.2-2.175.el6.x86_64 Steps: # virsh dumpxml --security-info spice <graphics type='spice' port='5900' tlsPort='5901' autoport='yes' listen='0.0.0.0' passwd='aaabbb' connected='disconnect'/> # cat spice-new.xml <graphics type='spice' port='5900' tlsPort='5901' autoport='yes' listen='0.0.0.0' passwd='cccddd' connected='disconnect'/> # virsh update-device spice spice-new.xml Device updated successfully spice console got disconnected # virsh dumpxml --security-info spice <graphics type='spice' port='5900' tlsPort='5901' autoport='yes' listen='0.0.0.0' passwd='aaabbb' connected='disconnect'/> # cat spice-new.xml <graphics type='spice' port='5900' tlsPort='5901' autoport='yes' listen='0.0.0.0' passwd='cccddd' connected='keep'/> # virsh update-device spice spice-new.xml Device updated successfully spice console session got kept # virsh dumpxml --security-info spice <graphics type='spice' port='5900' tlsPort='5901' autoport='yes' listen='0.0.0.0' passwd='aaabbb' connected='disconnect'/> # cat spice-new.xml <graphics type='spice' port='5900' tlsPort='5901' autoport='yes' listen='0.0.0.0' passwd='cccddd' connected='fail'/> # virsh update-device spice spice-new.xml error: Failed to update device from spice-new.xml error: internal error unable to execute QEMU command '__com.redhat_set_password': Could not set password threw error when failed to update passwd , and spice session kept # virsh dumpxml --security-info vnc <graphics type='vnc' port='-1' autoport='yes' listen='0.0.0.0' passwd='aaabbb' connected='keep'/> # cat vnc-new.xml <graphics type='vnc' port='-1' autoport='yes' listen='0.0.0.0' passwd='cccddd' connected='keep'/> # virsh update-device spice spice-new.xml Device updated successfully vnc connection keeps connected . So set bug status to VERIFIED
tried with libvirt-0.9.4-0rc2.el6.x86_64 qemu-kvm-0.12.1.2-2.175.el6.x86_64 steps # virsh dumpxml --security-info spice <graphics type='spice' port='5900' tlsPort='5901' autoport='yes' listen='0.0.0.0' passwd='aaabbb' connected='disconnect'/> # cat spice-new.xml <graphics type='spice' port='5900' tlsPort='5901' autoport='yes' listen='0.0.0.0' passwd='aaabbb' connected='disconnect'/> # virsh update-device spice spice-new.xml Device updated successfully with the same password , after updating device , spice console DID NOT get disconnected So have to reassign this bug
next version of patch in POST (but with poor subject line): http://post-office.corp.redhat.com/archives/rhvirt-patches/2011-July/msg01023.html
*** Bug 727841 has been marked as a duplicate of this bug. ***
The patch committed in CVS does not match what Eric posted in comment #14, so putting this back to POST
Yeah I will have to incorporate this in a follow8ing build, possibly next monday libvirt-0.9.4-2.el6 Daniel
VERIFIED with libvirt-0.9.4-2.el6.x86_64 qemu-kvm-0.12.1.2-2.175.el6.x86_64 Steps: # virsh dumpxml --security-info spice <graphics type='spice' port='5900' tlsPort='5901' autoport='yes' listen='0.0.0.0' passwd='aaabbb' connected='disconnect'/> # cat spice-new.xml <graphics type='spice' port='5900' tlsPort='5901' autoport='yes' listen='0.0.0.0' passwd='cccddd' connected='disconnect'/> # virsh update-device spice spice-new.xml Device updated successfully spice console got disconnected # virsh dumpxml --security-info spice <graphics type='spice' port='5900' tlsPort='5901' autoport='yes' listen='0.0.0.0' passwd='aaabbb' connected='disconnect'/> # cat spice-new.xml <graphics type='spice' port='5900' tlsPort='5901' autoport='yes' listen='0.0.0.0' passwd='cccddd' connected='keep'/> # virsh update-device spice spice-new.xml Device updated successfully spice console session got kept # virsh dumpxml --security-info spice <graphics type='spice' port='5900' tlsPort='5901' autoport='yes' listen='0.0.0.0' passwd='aaabbb' connected='disconnect'/> # cat spice-new.xml <graphics type='spice' port='5900' tlsPort='5901' autoport='yes' listen='0.0.0.0' passwd='cccddd' connected='fail'/> # virsh update-device spice spice-new.xml error: Failed to update device from spice-new.xml error: internal error unable to execute QEMU command '__com.redhat_set_password': Could not set password threw error when failed to update passwd , and spice session kept # virsh dumpxml --security-info vnc <graphics type='vnc' port='-1' autoport='yes' listen='0.0.0.0' passwd='aaabbb' connected='keep'/> # cat vnc-new.xml <graphics type='vnc' port='-1' autoport='yes' listen='0.0.0.0' passwd='cccddd' connected='keep'/> # virsh update-device spice spice-new.xml Device updated successfully vnc connection keeps connected . # virsh dumpxml --security-info spice <graphics type='spice' port='5900' tlsPort='5901' autoport='yes' listen='0.0.0.0' passwd='aaabbb' connected='disconnect'/> # cat spice-new.xml <graphics type='spice' port='5900' tlsPort='5901' autoport='yes' listen='0.0.0.0' passwd='aaabbb' connected='disconnect'/> # virsh update-device spice spice-new.xml Device updated successfully with the same password , after updating device , spice console gets disconnected without connected option set , guest could be started successfully . So set bug status to VERIFIED
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2011-1513.html