Bug 818041 - After spice passwdValidTo get expired, migration will disconnect the spice connection session
After spice passwdValidTo get expired, migration will disconnect the spice co...
Status: CLOSED NOTABUG
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: spice-server (Show other bugs)
6.3
x86_64 Linux
medium Severity medium
: rc
: 6.3
Assigned To: Uri Lublin
Desktop QE
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-05-02 00:49 EDT by EricLee
Modified: 2012-05-02 05:44 EDT (History)
11 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-05-02 05:44:54 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description EricLee 2012-05-02 00:49:44 EDT
Description of problem:
After spice passwdValidTo get expired, migration will disconnect the spice connection session

Version-Release number of selected component (if applicable):
libvirt-0.9.10-14.el6.x86_64
qemu-kvm-0.12.1.2-2.282.el6.x86_64
kernel-2.6.32-262.el6.x86_64
spice-gtk-0.11-8.el6.x86_64
spice-server-0.10.1-5.el6.x86_64
spice-client-0.8.2-15.el6.x86_64

How reproducible:
100%

Steps to Reproduce:
1.# date -u
Thu Apr 26 06:28:22 UTC 2012

2.define a guest with 
"<graphics type='spice' port='5900' tlsPort='5901' autoport='yes' passwd='redhat' passwdValidTo='2012-04-26T06:34:01'>
      <channel name='main' mode='secure'/>
      <channel name='record' mode='insecure'/>
    </graphics>"
in xml file.

3.modify the followings in /etc/libvirt/qemu.conf in both source and target machine for migration.
   -# spice_listen = "0.0.0.0"
   + spice_listen = "0.0.0.0"

   -# spice_tls = 1
   + spice_tls = 1

   -# spice_tls_x509_cert_dir = "/etc/pki/libvirt-spice"
   + spice_tls_x509_cert_dir = "/etc/pki/libvirt-spice"

4.#touch spice-script.sh
  #chmod +x spice-script.sh
  Add following content to the sh file:

#!/bin/bash

SERVER_KEY=server-key.pem

# creating a key for our ca
if [ ! -e ca-key.pem ]; then
    openssl genrsa -des3 -out ca-key.pem 1024
fi
# creating a ca
if [ ! -e ca-cert.pem ]; then
    openssl req -new -x509 -days 1095 -key ca-key.pem -out ca-cert.pem  -subj "/C=IL/L=Raanana/O=Red Hat/CN=my CA"
fi
# create server key
if [ ! -e $SERVER_KEY ]; then
    openssl genrsa -out $SERVER_KEY 1024
fi
# create a certificate signing request (csr)
if [ ! -e server-key.csr ]; then
    openssl req -new -key $SERVER_KEY -out server-key.csr -subj "/C=IL/L=Raanana/O=Red Hat/CN=my server"
fi
# signing our server certificate with this ca
if [ ! -e server-cert.pem ]; then
    openssl x509 -req -days 1095 -in server-key.csr -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 -out server-cert.pem
fi

# now create a key that doesn't require a passphrase
openssl rsa -in $SERVER_KEY -out $SERVER_KEY.insecure
mv $SERVER_KEY $SERVER_KEY.secure
mv $SERVER_KEY.insecure $SERVER_KEY

# show the results (no other effect)
openssl rsa -noout -text -in $SERVER_KEY
openssl rsa -noout -text -in ca-key.pem
openssl req -noout -text -in server-key.csr
openssl x509 -noout -text -in server-cert.pem
openssl x509 -noout -text -in ca-cert.pem

# copy *.pem file to /etc/pki/libvirt-spice
if [[ -d "/etc/pki/libvirt-spice" ]]
then
    cp ./*.pem /etc/pki/libvirt-spice
else
    mkdir /etc/pki/libvirt-spice
        cp ./*.pem /etc/pki/libvirt-spice
fi

# echo --host-subject
echo "your --host-subject is" \" `openssl x509 -noout -text -in server-cert.pem | grep Subject: | cut -f 10- -d " "` \"


5.# ./spice-script.sh

6.# scp /etc/pki/libvirt-spice/* $destination_IP:/etc/pki/libvirt-spice/

7. restart libvirtd in both two machines to rescan the configuration
   # service libvirtd restart

8. define and start the guest
   # virsh define guest.xml
   # virsh start guest 

9. access the spice interface with ssl connection on source machine , and keep the spice session connected
   # spicec -h 10.66.4.232 -p 5900 -s 5901 --host-subject "C=IL,L=Raanana,O=Red Hat,CN=my server" --ca-file /etc/pki/libvirt-spice/ca-cert.pem --secure-channels main --enable-channels all -w redhat

10. wait until spice passwdValidTo get expired , don't close the spice session on source machine, migrate guest on source machine 
   # date -u
   Thu Apr 26 06:35:00 UTC 2012 

   # virsh migrate --live guest qemu+ssh://$destination_IP/system

   Note:
   10.66.4.232 --- your source host IP
   5900 --- the port you defined in xml graphic section
   5901 --- the tlsPort you defined in xml graphic section
   redhat --- the passwd you set in the xml graphic section
   "C=IL,L=Raanana,O=Red Hat,CN=my server" --- is got from command #openssl x509 -noout -text -in server-cert.pem | grep Subject: | cut -f 10- -d " "

Actual results:
the spice session will disconnect after migration

Expected results:
still connecting

Additional info:
Before spice passwdValidTo get expired, after the migration operation spice session is still connecting
Comment 2 Uri Lublin 2012-05-02 02:54:21 EDT
This is not a bug.
Spice server can not accept expired passwd.

Instead make sure the passwd is valid on the destination host (or since libvirt is used, a valid passwd on the source host works too), when migration starts.
Comment 3 EricLee 2012-05-02 04:09:16 EDT
(In reply to comment #2)
> This is not a bug.
> Spice server can not accept expired passwd.
> 
> Instead make sure the passwd is valid on the destination host (or since libvirt
> is used, a valid passwd on the source host works too), when migration starts.

Is that mean we should do migration before the passwdValidTo get expired only? And the migration after passwd expired check point do not need to test ? Or disconnected is expected result of that option ?
Comment 4 Uri Lublin 2012-05-02 05:38:27 EDT
(In reply to comment #3)
> Is that mean we should do migration before the passwdValidTo get expired only?
> And the migration after passwd expired check point do not need to test ? Or
> disconnected is expected result of that option ?

It is expected of spice-client to disconnect when the passwd is invalid.

Similarly, you can think of a test that does not involve migration: just wait for the password to expire and try to connect with a spice-client. It would fail.

So there are two cases: When password is valid, spice-client should stay connected to the guest. When password expires, spice-client should disconnect upon a successful completion of migration.
Comment 5 Uri Lublin 2012-05-02 05:44:36 EDT
Making sure the password is valid on the destination host, is a responsibility of management layers.
My understanding is that libvirt developers feel this should be done in the layer above them.
When using RHEV-M, vdsm makes sure the password is valid when migration starts.

Note You need to log in before you can comment on or make changes to this bug.