diff options
| -rw-r--r-- | qemu-deprecated.texi | 20 | ||||
| -rw-r--r-- | qemu-options.hx | 43 | ||||
| -rw-r--r-- | ui/vnc.c | 91 |
3 files changed, 0 insertions, 154 deletions
diff --git a/qemu-deprecated.texi b/qemu-deprecated.texi index 87212b62f2..1b9c007f12 100644 --- a/qemu-deprecated.texi +++ b/qemu-deprecated.texi @@ -40,26 +40,6 @@ which is the default. The ``-no-kvm'' argument is now a synonym for setting ``-machine accel=tcg''. -@subsection -vnc tls (since 2.5.0) - -The ``-vnc tls'' argument is now a synonym for setting -``-object tls-creds-anon,id=tls0'' combined with -``-vnc tls-creds=tls0' - -@subsection -vnc x509 (since 2.5.0) - -The ``-vnc x509=/path/to/certs'' argument is now a -synonym for setting -``-object tls-creds-x509,dir=/path/to/certs,id=tls0,verify-peer=no'' -combined with ``-vnc tls-creds=tls0' - -@subsection -vnc x509verify (since 2.5.0) - -The ``-vnc x509verify=/path/to/certs'' argument is now a -synonym for setting -``-object tls-creds-x509,dir=/path/to/certs,id=tls0,verify-peer=yes'' -combined with ``-vnc tls-creds=tls0' - @subsection -tftp (since 2.6.0) The ``-tftp /some/dir'' argument is replaced by either diff --git a/qemu-options.hx b/qemu-options.hx index 5515dfaba5..2417154a70 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -1632,49 +1632,6 @@ will cause the VNC server socket to enable the VeNCrypt auth mechanism. The credentials should have been previously created using the @option{-object tls-creds} argument. -The @option{tls-creds} parameter obsoletes the @option{tls}, -@option{x509}, and @option{x509verify} options, and as such -it is not permitted to set both new and old type options at -the same time. - -@item tls - -Require that client use TLS when communicating with the VNC server. This -uses anonymous TLS credentials so is susceptible to a man-in-the-middle -attack. It is recommended that this option be combined with either the -@option{x509} or @option{x509verify} options. - -This option is now deprecated in favor of using the @option{tls-creds} -argument. - -@item x509=@var{/path/to/certificate/dir} - -Valid if @option{tls} is specified. Require that x509 credentials are used -for negotiating the TLS session. The server will send its x509 certificate -to the client. It is recommended that a password be set on the VNC server -to provide authentication of the client when this is used. The path following -this option specifies where the x509 certificates are to be loaded from. -See the @ref{vnc_security} section for details on generating certificates. - -This option is now deprecated in favour of using the @option{tls-creds} -argument. - -@item x509verify=@var{/path/to/certificate/dir} - -Valid if @option{tls} is specified. Require that x509 credentials are used -for negotiating the TLS session. The server will send its x509 certificate -to the client, and request that the client send its own x509 certificate. -The server will validate the client's certificate against the CA certificate, -and reject clients when validation fails. If the certificate authority is -trusted, this is a sufficient authentication mechanism. You may still wish -to set a password on the VNC server as a second authentication layer. The -path following this option specifies where the x509 certificates are to -be loaded from. See the @ref{vnc_security} section for details on generating -certificates. - -This option is now deprecated in favour of using the @option{tls-creds} -argument. - @item sasl Require that the client use SASL to authenticate with the VNC server. @@ -3345,10 +3345,6 @@ static QemuOptsList qemu_vnc_opts = { .name = "tls-creds", .type = QEMU_OPT_STRING, },{ - /* Deprecated in favour of tls-creds */ - .name = "x509", - .type = QEMU_OPT_STRING, - },{ .name = "share", .type = QEMU_OPT_STRING, },{ @@ -3385,14 +3381,6 @@ static QemuOptsList qemu_vnc_opts = { .name = "sasl", .type = QEMU_OPT_BOOL, },{ - /* Deprecated in favour of tls-creds */ - .name = "tls", - .type = QEMU_OPT_BOOL, - },{ - /* Deprecated in favour of tls-creds */ - .name = "x509verify", - .type = QEMU_OPT_STRING, - },{ .name = "acl", .type = QEMU_OPT_BOOL, },{ @@ -3519,51 +3507,6 @@ vnc_display_setup_auth(int *auth, } -/* - * Handle back compat with old CLI syntax by creating some - * suitable QCryptoTLSCreds objects - */ -static QCryptoTLSCreds * -vnc_display_create_creds(bool x509, - bool x509verify, - const char *dir, - const char *id, - Error **errp) -{ - gchar *credsid = g_strdup_printf("tlsvnc%s", id); - Object *parent = object_get_objects_root(); - Object *creds; - Error *err = NULL; - - if (x509) { - creds = object_new_with_props(TYPE_QCRYPTO_TLS_CREDS_X509, - parent, - credsid, - &err, - "endpoint", "server", - "dir", dir, - "verify-peer", x509verify ? "yes" : "no", - NULL); - } else { - creds = object_new_with_props(TYPE_QCRYPTO_TLS_CREDS_ANON, - parent, - credsid, - &err, - "endpoint", "server", - NULL); - } - - g_free(credsid); - - if (err) { - error_propagate(errp, err); - return NULL; - } - - return QCRYPTO_TLS_CREDS(creds); -} - - static int vnc_display_get_address(const char *addrstr, bool websocket, bool reverse, @@ -3930,15 +3873,6 @@ void vnc_display_open(const char *id, Error **errp) credid = qemu_opt_get(opts, "tls-creds"); if (credid) { Object *creds; - if (qemu_opt_get(opts, "tls") || - qemu_opt_get(opts, "x509") || - qemu_opt_get(opts, "x509verify")) { - error_setg(errp, - "'tls-creds' parameter is mutually exclusive with " - "'tls', 'x509' and 'x509verify' parameters"); - goto fail; - } - creds = object_resolve_path_component( object_get_objects_root(), credid); if (!creds) { @@ -3961,31 +3895,6 @@ void vnc_display_open(const char *id, Error **errp) "Expecting TLS credentials with a server endpoint"); goto fail; } - } else { - const char *path; - bool tls = false, x509 = false, x509verify = false; - tls = qemu_opt_get_bool(opts, "tls", false); - if (tls) { - path = qemu_opt_get(opts, "x509"); - - if (path) { - x509 = true; - } else { - path = qemu_opt_get(opts, "x509verify"); - if (path) { - x509 = true; - x509verify = true; - } - } - vd->tlscreds = vnc_display_create_creds(x509, - x509verify, - path, - vd->id, - errp); - if (!vd->tlscreds) { - goto fail; - } - } } acl = qemu_opt_get_bool(opts, "acl", false); |