do not use novnc wsproxy

[qemu-server.git] / PVE / API2 / Qemu.pm

diff --git a/PVE/API2/Qemu.pm b/PVE/API2/Qemu.pm
index c06e5c7a7b33e9325431ee75770c7fd352744e58..2f07ae57449565400afb9c4a34d9083459fba1e6 100644 (file)
--- a/PVE/API2/Qemu.pm
+++ b/PVE/API2/Qemu.pm
@@ -18,6 +18,7 @@ use PVE::RPCEnvironment;
 use PVE::AccessControl;
 use PVE::INotify;
 use PVE::Network;
+use PVE::API2::Firewall::VM;
 
 use Data::Dumper; # fixme: remove
 
@@ -495,11 +496,17 @@ __PACKAGE__->register_method({
            { subdir => 'snapshot' },
            { subdir => 'spiceproxy' },
            { subdir => 'sendkey' },
+           { subdir => 'firewall' },
            ];
 
        return $res;
     }});
 
+__PACKAGE__->register_method ({
+    subclass => "PVE::API2::Firewall::VM",  
+    path => '{vmid}/firewall',
+});
+
 __PACKAGE__->register_method({
     name => 'rrd',
     path => '{vmid}/rrd',
@@ -831,9 +838,9 @@ my $vmconfig_update_net = sub {
                    PVE::Network::tap_rate_limit($iface, $newnet->{rate});
                }
 
-               if(($newnet->{bridge} ne $oldnet->{bridge}) || ($newnet->{tag} ne $oldnet->{tag})){
-                   eval{PVE::Network::tap_unplug($iface, $oldnet->{bridge}, $oldnet->{tag});};
-                   PVE::Network::tap_plug($iface, $newnet->{bridge}, $newnet->{tag});
+               if(($newnet->{bridge} ne $oldnet->{bridge}) || ($newnet->{tag} ne $oldnet->{tag}) || ($newnet->{firewall} ne $oldnet->{firewall})){
+                   PVE::Network::tap_unplug($iface);
+                   PVE::Network::tap_plug($iface, $newnet->{bridge}, $newnet->{tag}, $newnet->{firewall});
                }
 
            }else{
@@ -1263,6 +1270,11 @@ __PACKAGE__->register_method({
        properties => {
            node => get_standard_option('pve-node'),
            vmid => get_standard_option('pve-vmid'),
+           websocket => {
+               optional => 1,
+               type => 'boolean',
+               description => "starts websockify instead of vncproxy",
+           },
        },
     },
     returns => {
@@ -1284,6 +1296,7 @@ __PACKAGE__->register_method({
 
        my $vmid = $param->{vmid};
        my $node = $param->{node};
+       my $websocket = $param->{websocket};
 
        my $conf = PVE::QemuServer::load_config($vmid, $node); # check if VM exists
 
@@ -1301,7 +1314,7 @@ __PACKAGE__->register_method({
 
        if ($node ne 'localhost' && $node ne PVE::INotify::nodename()) {
            $remip = PVE::Cluster::remote_node_ip($node);
-           # NOTE: kvm VNC traffic is already TLS encrypted
+           # NOTE: kvm VNC traffic is already TLS encrypted or is known unsecure
            $remcmd = ['/usr/bin/ssh', '-T', '-o', 'BatchMode=yes', $remip];
        }
 
@@ -1316,6 +1329,8 @@ __PACKAGE__->register_method({
 
            if ($conf->{vga} && ($conf->{vga} =~ m/^serial\d+$/)) {
 
+               die "Websocket mode is not supported in vga serial mode!" if $websocket;
+
                my $termcmd = [ '/usr/sbin/qm', 'terminal', $vmid, '-iface', $conf->{vga} ];
                #my $termcmd = "/usr/bin/qm terminal -iface $conf->{vga}";
                $cmd = ['/usr/bin/vncterm', '-rfbport', $port,
@@ -1323,6 +1338,8 @@ __PACKAGE__->register_method({
                        '-perm', 'Sys.Console', '-c', @$remcmd, @$termcmd];
            } else {
 
+               $ENV{LC_PVE_TICKET} = $ticket if $websocket; # set ticket with "qm vncproxy"
+
                my $qmcmd = [@$remcmd, "/usr/sbin/qm", 'vncproxy', $vmid];
 
                my $qmstr = join(' ', @$qmcmd);
@@ -1349,6 +1366,55 @@ __PACKAGE__->register_method({
        };
     }});
 
+__PACKAGE__->register_method({
+    name => 'vncwebsocket',
+    path => '{vmid}/vncwebsocket',
+    method => 'GET',
+    proxyto => 'node',
+    permissions => {
+       check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
+    },
+    description => "Opens a weksocket for VNV traffic.",
+    parameters => {
+       additionalProperties => 0,
+       properties => {
+           node => get_standard_option('pve-node'),
+           vmid => get_standard_option('pve-vmid'),
+           port => {
+               description => "Port number returned by previous vncproxy call.",
+               type => 'integer',
+               minimum => 5900,
+               maximum => 5999,
+           },
+       },
+    },
+    returns => {
+       type => "object",
+       properties => {
+           port => { type => 'string' },
+       },
+    },
+    code => sub {
+       my ($param) = @_;
+
+       my $rpcenv = PVE::RPCEnvironment::get();
+
+       my $authuser = $rpcenv->get_user();
+
+       my $vmid = $param->{vmid};
+       my $node = $param->{node};
+
+       my $conf = PVE::QemuServer::load_config($vmid, $node); # VM exists ?
+
+       # Note: VNC ports are acessible from outside, so we do not gain any
+       # security if we verify that $param->{port} belongs to VM $vmid. This
+       # check is done by verifying the VNC ticket (inside VNC protocol).
+
+       my $port = $param->{port};
+       
+       return { port => $port };
+    }});
+
 __PACKAGE__->register_method({
     name => 'spiceproxy',
     path => '{vmid}/spiceproxy',
@@ -1379,8 +1445,8 @@ __PACKAGE__->register_method({
        my $node = $param->{node};
        my $proxy = $param->{proxy};
 
-    my $conf = PVE::QemuServer::load_config($vmid, $node);
-    my $title = "VM $vmid - $conf->{'name'}",
+       my $conf = PVE::QemuServer::load_config($vmid, $node);
+       my $title = "VM $vmid - $conf->{'name'}",
 
        my $port = PVE::QemuServer::spice_port($vmid);