- Kimchi-devel - oVirt List Archives

[PATCH] Bugfix Issue#398 UI: Add information when no cdrom exists
by wenwang＠linux.vnet.ibm.com 30 Jul '14

30 Jul '14

From: Wen Wang <wenwang(a)linux.vnet.ibm.com> Add one line "No CDROM found" under "Manage Media" diaguage when there is no CDROM found for an VM. Signed-off-by: Wen Wang <wenwang(a)linux.vnet.ibm.com> --- ui/js/src/kimchi.guest_media_main.js | 15 ++++++++++----- ui/pages/guest-media.html.tmpl | 5 +++++ 2 files changed, 15 insertions(+), 5 deletions(-) diff --git a/ui/js/src/kimchi.guest_media_main.js b/ui/js/src/kimchi.guest_media_main.js index d6dee2e..60d12ba 100644 --- a/ui/js/src/kimchi.guest_media_main.js +++ b/ui/js/src/kimchi.guest_media_main.js @@ -23,14 +23,19 @@ kimchi.guest_media_main = function() { storageType: 'cdrom' }, function(storages) { var rowHTML = $('#cdrom-row-tmpl').html(); + var noCDROMHTML = $('#empty-cdrom-tmpl').html(); var container = $('#guest-edit-cdrom-row-container'); $(container).empty(); - $.each(storages, function(index, storage) { - storage['vm'] = kimchi.selectedGuest; - var templated = kimchi.substitute(rowHTML, storage); - container.append(templated); - }); + if(storages.length > 0) { + $.each(storages, function(index, storage) { + storage['vm'] = kimchi.selectedGuest; + var templated = kimchi.substitute(rowHTML, storage); + container.append(templated); + }); + } else { + container.append(noCDROMHTML); + } var replaceCDROM = function(event) { event.preventDefault(); diff --git a/ui/pages/guest-media.html.tmpl b/ui/pages/guest-media.html.tmpl index 83ad6ab..fe2e8ef 100644 --- a/ui/pages/guest-media.html.tmpl +++ b/ui/pages/guest-media.html.tmpl @@ -51,6 +51,11 @@ </div> </div> </script> +<script id="empty-cdrom-tmpl" type="text/html"> + <div> + $_("No CDROM found.") + </div> +</script> <script type="text/javascript"> kimchi.guest_media_main(); -- 1.7.1

3 2

[PATCH] Bugfix Issue#397 UI Broken when cookie is clear
by wenwang＠linux.vnet.ibm.com 30 Jul '14

30 Jul '14

From: Wen Wang <wenwang(a)linux.vnet.ibm.com> 1)Fixed the bug that login page cannot find cookies when "roles" in the cookie is deleted in browser 2)Have the "eval()" function changed to JSON.parse() which is safer 3)Have the var "_tabMode" changed to "kimchi.tabMode" that better fit kimchi namespace 4)Changed lifetime of cookie "roles" to session Signed-off-by: Wen Wang <wenwang(a)linux.vnet.ibm.com> --- ui/js/src/kimchi.guest_main.js | 3 +-- ui/js/src/kimchi.login.js | 2 +- ui/js/src/kimchi.main.js | 23 +++++++++++++---------- ui/js/src/kimchi.network.js | 5 ++--- ui/js/src/kimchi.storage_main.js | 7 +++---- ui/js/src/kimchi.template_main.js | 3 +-- 6 files changed, 21 insertions(+), 22 deletions(-) diff --git a/ui/js/src/kimchi.guest_main.js b/ui/js/src/kimchi.guest_main.js index d81c6b7..394ec9d 100644 --- a/ui/js/src/kimchi.guest_main.js +++ b/ui/js/src/kimchi.guest_main.js @@ -323,8 +323,7 @@ kimchi.guestSetRequestHeader = function(xhr) { }; kimchi.guest_main = function() { - var guestsMode = _tabMode['guests']; - if(guestsMode === 'admin') { + if(kimchi.tabMode['guests'] === 'admin') { $('.tools').attr('style','display'); $("#vm-add").on("click", function(event) { kimchi.window.open('guest-add.html'); diff --git a/ui/js/src/kimchi.login.js b/ui/js/src/kimchi.login.js index b20f0b0..f9c9af0 100644 --- a/ui/js/src/kimchi.login.js +++ b/ui/js/src/kimchi.login.js @@ -57,7 +57,7 @@ kimchi.login_main = function() { var next_url = lastPage ? lastPage.replace(/\"/g,'') : "/"; } var next_url = lastPage ? lastPage.replace(/\"/g,'') : "/"; - kimchi.cookie.set('roles',JSON.stringify(data.roles), 365); + kimchi.cookie.set('roles',JSON.stringify(data.roles)); window.location.replace(next_url) }, function() { $("#messUserPass").show(); diff --git a/ui/js/src/kimchi.main.js b/ui/js/src/kimchi.main.js index 01ebded..b79c7f8 100644 --- a/ui/js/src/kimchi.main.js +++ b/ui/js/src/kimchi.main.js @@ -15,7 +15,7 @@ * See the License for the specific language governing permissions and * limitations under the License. */ -var _tabMode = {}; +kimchi.tabMode = {}; kimchi.main = function() { kimchi.popable(); @@ -46,15 +46,18 @@ kimchi.main = function() { var title = i18n[titleKey] ? i18n[titleKey] : titleKey; var path = $tab.find('path').text(); var roles = kimchi.cookie.get('roles'); - var roleString = 'JSON.parse(roles).' + titleKey.toLowerCase(); - var role = eval(roleString); - var mode = $tab.find('[role="' + role + '"]').attr('mode'); - _tabMode[titleKey.toLowerCase()] = mode; - tabs.push({ - title: title, - path: path, - mode: mode - }); + if (roles) { + var role = JSON.parse(roles)[titleKey.toLowerCase()]; + var mode = $tab.find('[role="' + role + '"]').attr('mode'); + kimchi.tabMode[titleKey.toLowerCase()] = mode; + tabs.push({ + title: title, + path: path, + mode: mode + }); + } else { + document.location.href = 'login.html'; + } }); return tabs; diff --git a/ui/js/src/kimchi.network.js b/ui/js/src/kimchi.network.js index 5b811ca..1530dd9 100644 --- a/ui/js/src/kimchi.network.js +++ b/ui/js/src/kimchi.network.js @@ -19,8 +19,7 @@ kimchi.NETWORK_TYPE_BRIDGE = "bridged"; kimchi.initNetwork = function() { - var networkMode = _tabMode['network']; - if(networkMode === 'admin') { + if(kimchi.tabMode['network'] === 'admin') { $('.tools').attr('style','display'); $('#network-content .header span:last-child').attr('style','display'); kimchi.initNetworkCreation(); @@ -53,7 +52,7 @@ kimchi.initNetworkListView = function() { kimchi.addNetworkItem = function(network) { $("#networkBody").append(kimchi.getNetworkItemHtml(network)); - if(_tabMode["network"] === "admin") { + if(kimchi.tabMode["network"] === "admin") { $(".column-action").attr("style","display"); } else { $(".column-space").addClass('column-space-no-border-right'); diff --git a/ui/js/src/kimchi.storage_main.js b/ui/js/src/kimchi.storage_main.js index 4b6fd13..49fcc4a 100644 --- a/ui/js/src/kimchi.storage_main.js +++ b/ui/js/src/kimchi.storage_main.js @@ -30,7 +30,7 @@ kimchi.doListStoragePools = function() { } }); $('#storagepoolsList').html(listHtml); - if(_tabMode['storage'] === 'admin') { + if(kimchi.tabMode['storage'] === 'admin') { $('.storage-button').attr('style','display'); } else { $('.storage-allocate').addClass('storage-allocate-padding-user'); @@ -79,7 +79,7 @@ kimchi.storageBindClick = function() { } }); - if(_tabMode['storage'] === 'admin') { + if(kimchi.tabMode['storage'] === 'admin') { $('.pool-delete').on('click', function(event) { var $pool = $(this); var settings = { @@ -242,8 +242,7 @@ kimchi.initLogicalPoolExtend = function() { } kimchi.storage_main = function() { - var storageMode = _tabMode['storage']; - if(storageMode === 'admin') { + if(kimchi.tabMode['storage'] === 'admin') { $('.tools').attr('style','display'); $('#storage-pool-add').on('click', function() { kimchi.window.open('storagepool-add.html'); diff --git a/ui/js/src/kimchi.template_main.js b/ui/js/src/kimchi.template_main.js index 7ce408f..4fa4dd8 100644 --- a/ui/js/src/kimchi.template_main.js +++ b/ui/js/src/kimchi.template_main.js @@ -83,8 +83,7 @@ kimchi.hideTitle = function() { }; kimchi.template_main = function() { - var templatesMode = _tabMode['templates']; - if(templatesMode === 'admin') { + if(kimchi.tabMode['templates'] === 'admin') { $('.tools').attr('style','display'); $("#template-add").on("click", function(event) { kimchi.window.open({ -- 1.7.1

3 2

[PATCH] Fix pep8 errors in make check
by lvroyce＠linux.vnet.ibm.com 30 Jul '14

30 Jul '14

From: Royce Lv <lvroyce(a)linux.vnet.ibm.com> Fix 2 pep8 errors in make check Signed-off-by: Royce Lv <lvroyce(a)linux.vnet.ibm.com> --- src/kimchi/control/base.py | 4 +--- src/kimchi/root.py | 1 - 2 files changed, 1 insertion(+), 4 deletions(-) diff --git a/src/kimchi/control/base.py b/src/kimchi/control/base.py index ac24b3f..4d1351f 100644 --- a/src/kimchi/control/base.py +++ b/src/kimchi/control/base.py @@ -65,9 +65,7 @@ class Resource(object): def generate_action_handler(self, action_name, action_args=None): def wrapper(*args, **kwargs): - method = validate_method(('POST'), - self.role_key, self.admin_methods) - + validate_method(('POST'), self.role_key, self.admin_methods) try: self.lookup() if not self.is_authorized(): diff --git a/src/kimchi/root.py b/src/kimchi/root.py index dec5862..1bae7be 100644 --- a/src/kimchi/root.py +++ b/src/kimchi/root.py @@ -17,7 +17,6 @@ # License along with this library; if not, write to the Free Software # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA -import base64 import cherrypy import json import os -- 1.8.3.2

3 3

[PATCH V2] bug fix: Avoid equals sign in VM console URL
by alinefm＠linux.vnet.ibm.com 30 Jul '14

30 Jul '14

From: Aline Manera <alinefm(a)linux.vnet.ibm.com> V1 -> V2: - Remove equals sign instead of replacing it for any other character as base64 can work well without it (Sheldon) Aline Manera (1): bug fix: Avoid equals sign in VM console URL src/kimchi/vnc.py | 9 ++++++++- ui/js/src/kimchi.api.js | 18 ++++++++++++++++-- 2 files changed, 24 insertions(+), 3 deletions(-) -- 1.9.3

3 3

[PATCH] Get user groups correctly
by Crístian Viana 30 Jul '14

30 Jul '14

Kimchi uses the Python API (module "grp") to get the groups which a user belongs to. But that implementation is not correct, in some cases some groups are left out. For example, take a look at the following commands. Here's the Python method of getting the user groups (user=vianac): $ python -c "import grp; u = 'vianac'; print [ g.gr_name for g in grp.getgrall() if u in g.gr_mem ]" ['wheel', 'vianac', 'desktop_admin_r', 'aline'] And here's another method of getting the same groups, using a GNU/Linux command: $ id -Gn vianac vianac wheel desktop_admin_r aline Now, let's try the same thing with a different user (user=root): $ python -c "import grp; u = 'root'; print [ g.gr_name for g in grp.getgrall() if u in g.gr_mem ]" [] $ id -Gn root root As shown above, the Python method doesn't always display the correct results. As the command "id" is bundled in the GNU/Linux package "coreutils", I'd say its output is the correct one. Use the external command "id" to get the user groups instead of the Python API. Signed-off-by: Crístian Viana <vianac(a)linux.vnet.ibm.com> --- src/kimchi/auth.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/kimchi/auth.py b/src/kimchi/auth.py index aabcb6c..41538f1 100644 --- a/src/kimchi/auth.py +++ b/src/kimchi/auth.py @@ -20,7 +20,6 @@ import base64 import cherrypy import fcntl -import grp import multiprocessing import os import PAM @@ -71,8 +70,10 @@ class User(object): self.user[USER_ROLES] = dict.fromkeys(tabs, 'user') def get_groups(self): - self.user[USER_GROUPS] = [g.gr_name for g in grp.getgrall() - if self.user[USER_NAME] in g.gr_mem] + out, err, rc = run_command([ 'id', '-Gn', self.user[USER_NAME] ]) + if rc == 0: + self.user[USER_GROUPS] = out.rstrip().split(" ") + return self.user[USER_GROUPS] def get_roles(self): -- 1.9.3

2 2

[PATCH 1/2] Update Kimchi tag to remove 'kimchi-' prefix
by alinefm＠linux.vnet.ibm.com 30 Jul '14

30 Jul '14

From: Aline Manera <alinefm(a)linux.vnet.ibm.com> As the tags on Kimchi repository is only related to it, we don't need to prefix it witk 'kimchi-' Signed-off-by: Aline Manera <alinefm(a)linux.vnet.ibm.com> --- build-aux/pkg-version | 25 ++++++++++++------------- 1 file changed, 12 insertions(+), 13 deletions(-) diff --git a/build-aux/pkg-version b/build-aux/pkg-version index 5e3e333..749cf6c 100755 --- a/build-aux/pkg-version +++ b/build-aux/pkg-version @@ -17,25 +17,24 @@ # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA # tags and output versions: -# - kimchi-4.9.0 => 4.9.0 (upstream clean) -# - kimchi-4.9.0-1 => 4.9.0 (downstream clean) -# - kimchi-4.9.0-2-g34e62f => 4.9.0 (upstream dirty) -# - kimchi-4.9.0-1-2-g34e62f => 4.9.0 (downstream dirty) +# - 4.9.0 => 4.9.0 (upstream clean) +# - 4.9.0-1 => 4.9.0 (downstream clean) +# - 4.9.0-2-g34e62f => 4.9.0 (upstream dirty) +# - 4.9.0-1-2-g34e62f => 4.9.0 (downstream dirty) AWK_VERSION=' BEGIN { FS="-" } - /^kimchi-[0-9]/ { - sub(/^kimchi-/,"") ; print $1 + /^[0-9]/ { + print $1 }' # tags and output releases: -# - kimchi-4.9.0 => 0 (upstream clean) -# - kimchi-4.9.0-1 => 1 (downstream clean) -# - kimchi-4.9.0-2-g34e62f1 => 2.git34e62f1 (upstream dirty) -# - kimchi-4.9.0-1-2-g34e62f1 => 1.2.git34e62f1 (downstream dirty) +# - 4.9.0 => 0 (upstream clean) +# - 4.9.0-1 => 1 (downstream clean) +# - 4.9.0-2-g34e62f1 => 2.git34e62f1 (upstream dirty) +# - 4.9.0-1-2-g34e62f1 => 1.2.git34e62f1 (downstream dirty) AWK_RELEASE=' BEGIN { FS="-"; OFS="." } - /^kimchi-[0-9]/ { - sub(/^kimchi-/,"") + /^[0-9]/ { if (NF == 1) print 0 else if (NF == 2) print $2 else if (NF == 3) print $2, "git" substr($3, 2) @@ -45,7 +44,7 @@ AWK_RELEASE=' if [ ! -d .git ]; then PKG_VERSION=`cat VERSION` else - PKG_VERSION=`git describe --tags --match "kimchi-[0-9]*" || cat VERSION` + PKG_VERSION=`git describe --tags --match "[0-9]*" || cat VERSION` fi if test "x$1" = "x--full"; then -- 1.9.3

3 2

[RFC] Directories in storage pools and Filesystem Passthrough
by Christy Perez 30 Jul '14

30 Jul '14

Hi team, A colleague has noticed that directories (even the 'lost+found') directory are showing up as images in storage pools. Here's an old mail thread discussing the addition of directories to storage pools: http://www.redhat.com/archives/libvir-list/2011-May/msg01901.html, but it was because they can be used for 'filesystem passthrough.' See http://libvirt.org/formatdomain.html#elementsFilesystems So my question is: How should kimchi treat directories? My thoughts are, we can filter them out of storage pools, and then in the future, add a feature for filesystem passthrough. FYI: virt-manager has this capability for reference. Regards, - Christy

2 1

[PATCH v8 0/4] Host device passthrough: Summary
by Zhou Zheng Sheng 29 Jul '14

29 Jul '14

Hi, This patch series is to enable Kimchi to assign hos devices directly to a VM, thus greately improve VM performance. Currently we support assigning PCI device, USB device and SCSI LUN. For example, we can assign an NIC to VM to improve guest network throughput, or passthrough a USB camera to enable the guest OS to record video. Host devices form a tree. We can assign most of the devices in the tree to VM. By assigning a device, all the devices in its sub-tree are also assigned. It might not make sense to assign a USB controller, because the host may be using one of the devices connected to the controller. Instead, Kimchi just presents the "leaf" devices to assign to guest. In recent Linux kernel and KVM, it is able to recognize the IOMMU group of a PCI device. The "leaf" PCI devices in the same IOMMU group should be assigned and dismissed together. The IOMMU group is the actual smallest isolation granularity of the PCI devices. The first patch is to list all host devices information. It's useful on its own to show host devices information. The second patch is to list all eligible host devices to assign, as well as the "affected" devices in the same IOMMU group. The third patch creates a sub-collection "hostdevs" to the VM resource, and deals with assigning and dismissing devices. The fourth patch adds a sub-collection "vm_holders" to the host device resource. It's to list all VMs that are holding the device. I'll update API and unit test once everyone is happy with the interface and logic. v8: Change the URI for listing affected passthrough devices, suggested by Aline. Move hostdev.py to src/kimchi/model.py. Still discussing API with the front-end developer. Once the API accepted, The author should add tests for model and mockmodel, and change API.md and API.json accordingly. v7: Some minor coding style improvements. v6: Do not passthrough PCI device of class code 0x07. It might contains system device not suitable to assign to guest. v5: Filter ealigible pci devices according to pci class. When assigning a device to VM, check if there are other VMs holding it. Use "kimchi.model.utils.get_vm_config_flag()" to correctly set the device attaching API flag. v4: Add new sub-collection to host device to list the VMs holding the device. v3: Fix a small naming error introduced by rebase. v2: Handle the devices in VM's sub-collection "hostdevs". v1: Handle the devices in VM template. Zhou Zheng Sheng (4): Host device passthrough: List all types of host devices Host device passthrough: List eligible device to passthrough Host device passthrough: Directly assign and dissmis host device from VM Host device passthrough: List VMs that are holding a host device docs/API.md | 11 +- src/kimchi/control/host.py | 7 + src/kimchi/control/vm/hostdevs.py | 44 +++++ src/kimchi/featuretests.py | 10 +- src/kimchi/i18n.py | 10 + src/kimchi/mockmodel.py | 7 +- src/kimchi/model/config.py | 2 + src/kimchi/model/host.py | 38 ++-- src/kimchi/model/hostdev.py | 311 +++++++++++++++++++++++++++++++ src/kimchi/model/libvirtstoragepool.py | 18 +- src/kimchi/model/vmhostdevs.py | 324 +++++++++++++++++++++++++++++++++ src/kimchi/rollbackcontext.py | 3 + src/kimchi/xmlutils.py | 26 ++- tests/test_rest.py | 6 +- tests/test_storagepool.py | 7 +- 15 files changed, 784 insertions(+), 40 deletions(-) create mode 100644 src/kimchi/control/vm/hostdevs.py create mode 100644 src/kimchi/model/hostdev.py create mode 100644 src/kimchi/model/vmhostdevs.py -- 1.9.3

3 19

Re: [Kimchi-devel] [PATCH] bug fix: Avoid equals sign in VM console URL
by Sheldon 29 Jul '14

29 Jul '14

On 07/29/2014 10:22 AM, Zheng Sheng ZS Zhou wrote: > > Sheldon <shaohef(a)linux.vnet.ibm.com> wrote 2014-07-28 17:23:21: > > > From: Sheldon <shaohef(a)linux.vnet.ibm.com> > > To: alinefm(a)linux.vnet.ibm.com, Kimchi Devel <kimchi- > > devel(a)ovirt.org>, Zheng Sheng ZS Zhou/China/IBM@IBMCN > > Date: 2014-07-28 17:22 > > Subject: Re: [Kimchi-devel] [PATCH] bug fix: Avoid equals sign in VM > > console URL > > > > On 07/26/2014 05:01 AM, alinefm(a)linux.vnet.ibm.com wrote: > > > From: Aline Manera <alinefm(a)linux.vnet.ibm.com> > > > > > > >From python documentation, base64.urlsafe_b64encode(s) > > substitutes - instead > > > of + and _ instead of / in the standard Base64 alphabet, BUT the > result can > > > still contain = which is not safe in a URL query component. > > > As token value is not decoded nowhere, replace = by A > > also in our kimchi I have try: > > In [45]: base64.urlsafe_b64encode("abcd") > > Out[45]: 'YWJjZA==' > > In [41]: base64.urlsafe_b64encode("abcde") > > Out[41]: 'YWJjZGU=' > > > > > > JS is very cool, it can decode base64 without "=" padding well > > kimchi.urlSafeB64Decode("YWJjZA") > > "abcd" > > kimchi.urlSafeB64Decode("YWJjZGU") > > "abcde" > > > > we just need in python: > > In [48]: base64.urlsafe_b64encode("abcd").rstrip("=") > > Out[48]: 'YWJjZA' > > > > > > A friendly remind: We have to make sure this trick also works in IE > and Chome. > Try chrom can work. But No IE environment. > > > > > The problem with equals sign was only identified on Spice connections. > > > noVNC can deal well with that. > > > > > > For reference: https://docs.python.org/2/library/base64.html > > > > > > Signed-off-by: Aline Manera <alinefm(a)linux.vnet.ibm.com> > > > --- > > > src/kimchi/vnc.py | 9 ++++++++- > > > ui/js/src/kimchi.api.js | 18 ++++++++++++++++-- > > > 2 files changed, 24 insertions(+), 3 deletions(-) > > > > > > diff --git a/src/kimchi/vnc.py b/src/kimchi/vnc.py > > > index 9380e21..4159049 100644 > > > --- a/src/kimchi/vnc.py > > > +++ b/src/kimchi/vnc.py > > > @@ -54,7 +54,14 @@ def new_ws_proxy(): > > > > > > def add_proxy_token(name, port): > > > with open(os.path.join(WS_TOKENS_DIR, name), 'w') as f: > > > - name = base64.urlsafe_b64encode(name) > > > + """ > > > + From python documentation base64.urlsafe_b64encode(s) > > > + substitutes - instead of + and _ instead of / in the > > > + standard Base64 alphabet, BUT the result can still > > > + contain = which is not safe in a URL query component. > > > + As token value is not decoded nowhere, replace = by A > > > + """ > > > + name = base64.urlsafe_b64encode(name).replace('=', 'A') > > > f.write('%s: localhost:%s' % (name.encode('utf-8'), port)) > > > > > > > > > diff --git a/ui/js/src/kimchi.api.js b/ui/js/src/kimchi.api.js > > > index 8f5b68f..30360c5 100644 > > > --- a/ui/js/src/kimchi.api.js > > > +++ b/ui/js/src/kimchi.api.js > > > @@ -352,7 +352,14 @@ var kimchi = { > > > }).done(function() { > > > url = 'https://' + location.hostname + ':' + proxy_port; > > > url += "/console.html?url=vnc_auto.html&port=" + > > proxy_port; > > > - url += "&path=?token=" + kimchi.urlSafeB64Encode(vm); > > > + /* > > > + * From python documentation base64.urlsafe_b64encode(s) > > > + * substitutes - instead of + and _ instead of / in the > > > + * standard Base64 alphabet, BUT the result can still > > > + * contain = which is not safe in a URL query component. > > > + * As token value is not decoded nowhere, replace = by A > > > + * */ > > > + url += "&path=?token=" + kimchi.urlSafeB64Encode > > (vm).replace(/=/g, 'A'); > > > url += "&kimchi=" + location.port; > > > url += '&encrypt=1'; > > > window.open(url); > > > @@ -377,7 +384,14 @@ var kimchi = { > > > url = 'https://' + location.hostname + ':' + proxy_port; > > > url += "/console.html?url=spice.html&port=" + proxy_port; > > > url += "&listen=" + location.hostname; > > > - url += "&token=" + kimchi.urlSafeB64Encode(vm); > > > + /* > > > + * From python documentation base64.urlsafe_b64encode(s) > > > + * substitutes - instead of + and _ instead of / in the > > > + * standard Base64 alphabet, BUT the result can still > > > + * contain = which is not safe in a URL query component. > > > + * As token value is not decoded nowhere, replace = by A > > > + * */ > > > + url += "&token=" + kimchi.urlSafeB64Encode > > (vm).replace(/=/g, 'A'); > > > url += "&kimchi=" + location.port; > > > url += '&encrypt=1'; > > > window.open(url); > > > > > > -- > > Thanks and best regards! > > > > Sheldon Feng(冯少合)<shaohef(a)linux.vnet.ibm.com> > > IBM Linux Technology Center > > > -- Thanks and best regards! Sheldon Feng(冯少合)<shaohef(a)linux.vnet.ibm.com> IBM Linux Technology Center

1 0

[PATCH] issue #389: Use 127.0.0.1 as VNC listener IP
by alinefm＠linux.vnet.ibm.com 28 Jul '14

28 Jul '14

From: Aline Manera <alinefm(a)linux.vnet.ibm.com> When setting the listener IP to 0.0.0.0 anyone can connect to the freshly configured kimchi virtual machine manager box on port 5900, 5901, etc. and take over any virtual machine, since VNC is per default configured by kimchi to listen on all IPs. As websockets proxy connects to QEMU-VNC from 127.0.0.1 also set VNC listener IP to 127.0.0.1 Signed-off-by: Aline Manera <alinefm(a)linux.vnet.ibm.com> --- src/kimchi/mockmodel.py | 2 +- src/kimchi/osinfo.py | 2 +- tests/test_mockmodel.py | 2 +- tests/test_model.py | 2 +- tests/test_rest.py | 6 +++--- tests/test_vmtemplate.py | 8 ++++---- 6 files changed, 11 insertions(+), 11 deletions(-) diff --git a/src/kimchi/mockmodel.py b/src/kimchi/mockmodel.py index 1584471..ed275d5 100644 --- a/src/kimchi/mockmodel.py +++ b/src/kimchi/mockmodel.py @@ -1064,7 +1064,7 @@ def __init__(self, uuid, name, template_info): 'memory': self.memory, 'cpus': self.cpus, 'icon': None, - 'graphics': {'type': 'vnc', 'listen': '0.0.0.0', + 'graphics': {'type': 'vnc', 'listen': '127.0.0.1', 'port': None}, 'users': ['user1', 'user2', 'root'], 'groups': ['group1', 'group2', 'admin'], diff --git a/src/kimchi/osinfo.py b/src/kimchi/osinfo.py index 39c9163..d2a1c1d 100644 --- a/src/kimchi/osinfo.py +++ b/src/kimchi/osinfo.py @@ -94,7 +94,7 @@ defaults = {'networks': ['default'], 'storagepool': '/storagepools/default', 'domain': 'kvm', 'arch': os.uname()[4], - 'graphics': {'type': 'vnc', 'listen': '0.0.0.0'}} + 'graphics': {'type': 'vnc', 'listen': '127.0.0.1'}} def _get_arch(): diff --git a/tests/test_mockmodel.py b/tests/test_mockmodel.py index 223879c..97b5fdb 100644 --- a/tests/test_mockmodel.py +++ b/tests/test_mockmodel.py @@ -154,7 +154,7 @@ def test_vm_info(self): self.assertEquals('images/icon-vm.png', info['icon']) self.assertEquals(stats_keys, set(info['stats'].keys())) self.assertEquals('vnc', info['graphics']['type']) - self.assertEquals('0.0.0.0', info['graphics']['listen']) + self.assertEquals('127.0.0.1', info['graphics']['listen']) def test_packages_update(self): pkgs = model.packagesupdate_get_list() diff --git a/tests/test_model.py b/tests/test_model.py index da9dae5..cab8288 100644 --- a/tests/test_model.py +++ b/tests/test_model.py @@ -118,7 +118,7 @@ def test_vm_graphics(self): info = inst.vm_lookup('kimchi-vnc') self.assertEquals('vnc', info['graphics']['type']) - self.assertEquals('0.0.0.0', info['graphics']['listen']) + self.assertEquals('127.0.0.1', info['graphics']['listen']) graphics = {'type': 'spice', 'listen': '127.0.0.1'} params = {'name': 'kimchi-spice', 'template': '/templates/test', diff --git a/tests/test_rest.py b/tests/test_rest.py index 3ea1927..4feb298 100644 --- a/tests/test_rest.py +++ b/tests/test_rest.py @@ -370,7 +370,7 @@ def test_vm_graphics(self): self.assertEquals(201, resp.status) # Verify the VM vm = json.loads(self.request('/vms/test-vm').read()) - self.assertEquals('0.0.0.0', vm['graphics']['listen']) + self.assertEquals('127.0.0.1', vm['graphics']['listen']) self.assertEquals('vnc', vm['graphics']['type']) # Delete the VM resp = self.request('/vms/test-vm', '{}', 'DELETE') @@ -412,7 +412,7 @@ def test_vm_graphics(self): self.assertEquals(201, resp.status) # Verify the VM vm = json.loads(self.request('/vms/test-vm').read()) - self.assertEquals('0.0.0.0', vm['graphics']['listen']) + self.assertEquals('127.0.0.1', vm['graphics']['listen']) self.assertEquals('spice', vm['graphics']['type']) # Delete the VM resp = self.request('/vms/test-vm', '{}', 'DELETE') @@ -1132,7 +1132,7 @@ def verify_template(t, res): # Update the template t['os_distro'] = 'Linux.ISO' t['os_version'] = '1.1' - t['graphics'] = {'type': 'vnc', 'listen': '0.0.0.0'} + t['graphics'] = {'type': 'vnc', 'listen': '127.0.0.1'} req = json.dumps(t) resp = self.request('/templates/%s' % t['name'], req, 'PUT') self.assertEquals(200, resp.status) diff --git a/tests/test_vmtemplate.py b/tests/test_vmtemplate.py index 821ca24..acf0150 100644 --- a/tests/test_vmtemplate.py +++ b/tests/test_vmtemplate.py @@ -31,7 +31,7 @@ def test_minimal_construct(self): ('os_version', 'unknown'), ('cpus', 1), ('memory', 1024), ('cdrom', ''), ('networks', ['default']), ('disk_bus', 'ide'), ('nic_model', 'e1000'), - ('graphics', {'type': 'vnc', 'listen': '0.0.0.0'})) + ('graphics', {'type': 'vnc', 'listen': '127.0.0.1'})) args = {'name': 'test'} t = VMTemplate(args) @@ -55,7 +55,7 @@ def test_specified_graphics(self): self.assertEquals(graphics, t.info['graphics']) # Test specified type - graphics = {'type': 'spice', 'listen': '0.0.0.0'} + graphics = {'type': 'spice', 'listen': '127.0.0.1'} args['graphics'] = graphics t = VMTemplate(args) self.assertEquals(graphics, t.info['graphics']) @@ -65,10 +65,10 @@ def test_specified_graphics(self): args['graphics'] = graphics t = VMTemplate(args) self.assertEquals(graphics['type'], t.info['graphics']['type']) - self.assertEquals('0.0.0.0', t.info['graphics']['listen']) + self.assertEquals('127.0.0.1', t.info['graphics']['listen']) def test_to_xml(self): - graphics = {'type': 'spice', 'listen': '0.0.0.0'} + graphics = {'type': 'spice', 'listen': '127.0.0.1'} vm_uuid = str(uuid.uuid4()).replace('-', '') t = VMTemplate({'name': 'test-template'}) xml = t.to_vm_xml('test-vm', vm_uuid, graphics=graphics) -- 1.9.3

4 3