ui: fix regression in x509verify parameter for VNC server

PATCH In review Daniel P. Berrange 3 participants 9 messages Mar 10, 2015 – Mar 11, 2015

Share & tools

Daniel P. Berrange

author

2015-03-10 16:27 UTC #0 lore raw

PATCH 1/1 ui: fix regression in x509verify parameter for VNC server

The 'x509verify' parameter is documented as taking a path to the x509 certificates, ie the same syntax as the 'x509' parameter.

commit 4db14629c38611061fc19ec6927405923de84f08
Author: Gerd Hoffmann <[email protected]>
Date: Tue Sep 16 12:33:03 2014 +0200

vnc: switch to QemuOpts, allow multiple servers

caused a regression by turning 'x509verify' into a boolean parameter instead. This breaks setup from libvirt and is not consistent with the docs.

Signed-off-by Daniel P. Berrange <[email protected]>

---
 ui/vnc.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

ui/vnc.c +7 -2

index 10a2724..37290e7 100644
@@ -3304,7 +3304,7 @@ static QemuOptsList qemu_vnc_opts = {
             .type = QEMU_OPT_BOOL,
         },{
             .name = "x509verify",
-            .type = QEMU_OPT_BOOL,
+            .type = QEMU_OPT_STRING,
         },{
             .name = "acl",
             .type = QEMU_OPT_BOOL,

@@ -3391,9 +3391,14 @@ void vnc_display_open(const char *id, Error **errp)
 #ifdef CONFIG_VNC_TLS
     tls  = qemu_opt_get_bool(opts, "tls", false);
     path = qemu_opt_get(opts, "x509");
+    if (!path) {
+        path = qemu_opt_get(opts, "x509verify");
+        if (path) {
+            vs->tls.x509verify = true;
+        }
+    }
     if (path) {
         x509 = true;
-        vs->tls.x509verify = qemu_opt_get_bool(opts, "x509verify", false);
         if (vnc_tls_set_x509_creds_dir(vs, path) < 0) {
             error_setg(errp, "Failed to find x509 certificates/keys in %s",
                        path);

Signature · 1 line

2.1.0

Gonglei

2015-03-11 01:49 UTC #1 lore raw

Quoted 34 lines · Daniel P. Berrange

The 'x509verify' parameter is documented as taking a path to the x509 certificates, ie the same syntax as the 'x509' parameter.
commit 4db14629c38611061fc19ec6927405923de84f08
Author: Gerd Hoffmann <[email protected]>
Date: Tue Sep 16 12:33:03 2014 +0200
vnc: switch to QemuOpts, allow multiple servers
caused a regression by turning 'x509verify' into a boolean parameter instead. This breaks setup from libvirt and is not consistent with the docs.
Signed-off-by Daniel P. Berrange <[email protected]>
---
 ui/vnc.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)
ui/vnc.c +1 -1
index 10a2724..37290e7 100644
@@ -3304,7 +3304,7 @@ static QemuOptsList qemu_vnc_opts = {
             .type = QEMU_OPT_BOOL,
         },{
             .name = "x509verify",
-            .type = QEMU_OPT_BOOL,
+            .type = QEMU_OPT_STRING,
         },{
             .name = "acl",
             .type = QEMU_OPT_BOOL,
@@ -3391,9 +3391,14 @@ void vnc_display_open(const char *id, Error **errp)
 #ifdef CONFIG_VNC_TLS
     tls  = qemu_opt_get_bool(opts, "tls", false);

ui/vnc.c void vnc_display_open(const char *id, Error **errp) · line 3396

Quoted 10 lines

ui/vnc.c +6 -1

     path = qemu_opt_get(opts, "x509");
+    if (!path) {
+        path = qemu_opt_get(opts, "x509verify");
+        if (path) {
+            vs->tls.x509verify = true;
+        }
+    }
     if (path) {
         x509 = true;
-        vs->tls.x509verify = qemu_opt_get_bool(opts, "x509verify", false);

We still need to get the x509verify value, while both 'x509' and 'x509verify' are configured, isn't it?

Regards,
-Gonglei

Quoted 4 lines

ui/vnc.c +0 -0

         if (vnc_tls_set_x509_creds_dir(vs, path) < 0) {
             error_setg(errp, "Failed to find x509 certificates/keys in %s",
                        path);

Daniel P. Berrange

author

2015-03-11 09:45 UTC #2 lore raw

Quoted 40 lines · Gonglei

Quoted 39 lines · Daniel P. Berrange
The 'x509verify' parameter is documented as taking a path to the x509 certificates, ie the same syntax as the 'x509' parameter.
commit 4db14629c38611061fc19ec6927405923de84f08
Author: Gerd Hoffmann <[email protected]>
Date: Tue Sep 16 12:33:03 2014 +0200
vnc: switch to QemuOpts, allow multiple servers
caused a regression by turning 'x509verify' into a boolean parameter instead. This breaks setup from libvirt and is not consistent with the docs.
Signed-off-by Daniel P. Berrange <[email protected]>
---
 ui/vnc.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)
ui/vnc.c +5 -1
index 10a2724..37290e7 100644
@@ -3304,7 +3304,7 @@ static QemuOptsList qemu_vnc_opts = {
             .type = QEMU_OPT_BOOL,
         },{
             .name = "x509verify",
-            .type = QEMU_OPT_BOOL,
+            .type = QEMU_OPT_STRING,
         },{
             .name = "acl",
             .type = QEMU_OPT_BOOL,
@@ -3391,9 +3391,14 @@ void vnc_display_open(const char *id, Error **errp)
 #ifdef CONFIG_VNC_TLS
     tls  = qemu_opt_get_bool(opts, "tls", false);
     path = qemu_opt_get(opts, "x509");
+    if (!path) {
+        path = qemu_opt_get(opts, "x509verify");
+        if (path) {
+            vs->tls.x509verify = true;

Quoted 8 lines

ui/vnc.c void vnc_display_open(const char *id, Error **errp) · line 3396
Quoted 5 lines
ui/vnc.c +2 -1
+        }
+    }
     if (path) {
         x509 = true;
-        vs->tls.x509verify = qemu_opt_get_bool(opts, "x509verify", false);
We still need to get the x509verify value, while both 'x509' and 'x509verify' are configured, isn't it?

Err, the code 7 lines earlier gets the x509verify value. The x509 and x509verify parameters are never to be specified at the same time - either one or the other is used.

Regards,
Daniel

Signature · 4 lines

|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org       -o-       http://live.gnome.org/gtk-vnc :|

Gonglei

2015-03-11 11:09 UTC #3 lore raw

Quoted 50 lines · Daniel P. Berrange

Quoted 40 lines · Gonglei
Quoted 39 lines · Daniel P. Berrange
The 'x509verify' parameter is documented as taking a path to the x509 certificates, ie the same syntax as the 'x509' parameter.
commit 4db14629c38611061fc19ec6927405923de84f08
Author: Gerd Hoffmann <[email protected]>
Date: Tue Sep 16 12:33:03 2014 +0200
vnc: switch to QemuOpts, allow multiple servers
caused a regression by turning 'x509verify' into a boolean parameter instead. This breaks setup from libvirt and is not consistent with the docs.
Signed-off-by Daniel P. Berrange <[email protected]>
---
 ui/vnc.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)
ui/vnc.c +5 -1
index 10a2724..37290e7 100644
@@ -3304,7 +3304,7 @@ static QemuOptsList qemu_vnc_opts = {
             .type = QEMU_OPT_BOOL,
         },{
             .name = "x509verify",
-            .type = QEMU_OPT_BOOL,
+            .type = QEMU_OPT_STRING,
         },{
             .name = "acl",
             .type = QEMU_OPT_BOOL,
@@ -3391,9 +3391,14 @@ void vnc_display_open(const char *id, Error **errp)
 #ifdef CONFIG_VNC_TLS
     tls  = qemu_opt_get_bool(opts, "tls", false);
     path = qemu_opt_get(opts, "x509");
+    if (!path) {
+        path = qemu_opt_get(opts, "x509verify");
+        if (path) {
+            vs->tls.x509verify = true;
Quoted 8 lines
ui/vnc.c void vnc_display_open(const char *id, Error **errp) · line 3396
Quoted 5 lines
ui/vnc.c +2 -1
+        }
+    }
     if (path) {
         x509 = true;
-        vs->tls.x509verify = qemu_opt_get_bool(opts, "x509verify", false);
We still need to get the x509verify value, while both 'x509' and 'x509verify' are configured, isn't it?

Quoted 4 lines

Err, the code 7 lines earlier gets the x509verify value. The x509 and x509verify parameters are never to be specified at the same time - either one or the other is used.

I noticed that there are several places that check x509verify (or vs->tls.x509verify) value:

./ui/vnc-auth-vencrypt.c:85: if (vs->vd->tls.x509verify) {
./ui/vnc-tls.c:260: if (vs->vd->tls.x509verify) {
./ui/vnc-tls.c:388: if (vs->vd->tls.x509verify) {
./ui/vnc.c:3212: vs->tls.x509verify = 0;
./ui/vnc.c:3306: .name = "x509verify",
./ui/vnc.c:3396: vs->tls.x509verify = qemu_opt_get_bool(opts, "x509verify", false);
./ui/vnc.c:3456: if (acl && x509 && vs->tls.x509verify) {

If only 'x509' parameter is specified, can vnc-tls work after applying this patch? Am I missing something?

Regards,
-Gonglei

Daniel P. Berrange

author

2015-03-11 11:11 UTC #4 lore raw

Quoted 66 lines · Gonglei

Quoted 50 lines · Daniel P. Berrange
Quoted 40 lines · Gonglei
Quoted 39 lines · Daniel P. Berrange
The 'x509verify' parameter is documented as taking a path to the x509 certificates, ie the same syntax as the 'x509' parameter.
commit 4db14629c38611061fc19ec6927405923de84f08
Author: Gerd Hoffmann <[email protected]>
Date: Tue Sep 16 12:33:03 2014 +0200
vnc: switch to QemuOpts, allow multiple servers
caused a regression by turning 'x509verify' into a boolean parameter instead. This breaks setup from libvirt and is not consistent with the docs.
Signed-off-by Daniel P. Berrange <[email protected]>
---
 ui/vnc.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)
ui/vnc.c +5 -1
index 10a2724..37290e7 100644
@@ -3304,7 +3304,7 @@ static QemuOptsList qemu_vnc_opts = {
             .type = QEMU_OPT_BOOL,
         },{
             .name = "x509verify",
-            .type = QEMU_OPT_BOOL,
+            .type = QEMU_OPT_STRING,
         },{
             .name = "acl",
             .type = QEMU_OPT_BOOL,
@@ -3391,9 +3391,14 @@ void vnc_display_open(const char *id, Error **errp)
 #ifdef CONFIG_VNC_TLS
     tls  = qemu_opt_get_bool(opts, "tls", false);
     path = qemu_opt_get(opts, "x509");
+    if (!path) {
+        path = qemu_opt_get(opts, "x509verify");
+        if (path) {
+            vs->tls.x509verify = true;
Quoted 8 lines
ui/vnc.c void vnc_display_open(const char *id, Error **errp) · line 3396
Quoted 5 lines
ui/vnc.c +2 -1
+        }
+    }
     if (path) {
         x509 = true;
-        vs->tls.x509verify = qemu_opt_get_bool(opts, "x509verify", false);
We still need to get the x509verify value, while both 'x509' and 'x509verify' are configured, isn't it?
Quoted 4 lines
Err, the code 7 lines earlier gets the x509verify value. The x509 and x509verify parameters are never to be specified at the same time - either one or the other is used.
I noticed that there are several places that check x509verify (or vs->tls.x509verify) value:
./ui/vnc-auth-vencrypt.c:85: if (vs->vd->tls.x509verify) {
./ui/vnc-tls.c:260: if (vs->vd->tls.x509verify) {
./ui/vnc-tls.c:388: if (vs->vd->tls.x509verify) {
./ui/vnc.c:3212: vs->tls.x509verify = 0;
./ui/vnc.c:3306: .name = "x509verify",
./ui/vnc.c:3396: vs->tls.x509verify = qemu_opt_get_bool(opts, "x509verify", false);
./ui/vnc.c:3456: if (acl && x509 && vs->tls.x509verify) {

Quoted 2 lines

If only 'x509' parameter is specified, can vnc-tls work after applying this patch? Am I missing something?

x509 only says that the server must provide x509 certs to the client. The x509verify says that the server must also verify the client's certificate. So there are obviously extra codepaths for the latter.

Regards,
Daniel

Signature · 4 lines

|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org       -o-       http://live.gnome.org/gtk-vnc :|

Gonglei

2015-03-11 11:25 UTC #5 lore raw

Quoted 67 lines · Daniel P. Berrange

Quoted 66 lines · Gonglei
Quoted 50 lines · Daniel P. Berrange
Quoted 40 lines · Gonglei
Quoted 39 lines · Daniel P. Berrange
The 'x509verify' parameter is documented as taking a path to the x509 certificates, ie the same syntax as the 'x509' parameter.
commit 4db14629c38611061fc19ec6927405923de84f08
Author: Gerd Hoffmann <[email protected]>
Date: Tue Sep 16 12:33:03 2014 +0200
vnc: switch to QemuOpts, allow multiple servers
caused a regression by turning 'x509verify' into a boolean parameter instead. This breaks setup from libvirt and is not consistent with the docs.
Signed-off-by Daniel P. Berrange <[email protected]>
---
 ui/vnc.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)
ui/vnc.c +5 -1
index 10a2724..37290e7 100644
@@ -3304,7 +3304,7 @@ static QemuOptsList qemu_vnc_opts = {
             .type = QEMU_OPT_BOOL,
         },{
             .name = "x509verify",
-            .type = QEMU_OPT_BOOL,
+            .type = QEMU_OPT_STRING,
         },{
             .name = "acl",
             .type = QEMU_OPT_BOOL,
@@ -3391,9 +3391,14 @@ void vnc_display_open(const char *id, Error **errp)
 #ifdef CONFIG_VNC_TLS
     tls  = qemu_opt_get_bool(opts, "tls", false);
     path = qemu_opt_get(opts, "x509");
+    if (!path) {
+        path = qemu_opt_get(opts, "x509verify");
+        if (path) {
+            vs->tls.x509verify = true;
Quoted 8 lines
ui/vnc.c void vnc_display_open(const char *id, Error **errp) · line 3396
Quoted 5 lines
ui/vnc.c +2 -1
+        }
+    }
     if (path) {
         x509 = true;
-        vs->tls.x509verify = qemu_opt_get_bool(opts, "x509verify", false);
We still need to get the x509verify value, while both 'x509' and 'x509verify' are configured, isn't it?
Quoted 4 lines
Err, the code 7 lines earlier gets the x509verify value. The x509 and x509verify parameters are never to be specified at the same time - either one or the other is used.
I noticed that there are several places that check x509verify (or vs->tls.x509verify) value:
./ui/vnc-auth-vencrypt.c:85: if (vs->vd->tls.x509verify) {
./ui/vnc-tls.c:260: if (vs->vd->tls.x509verify) {
./ui/vnc-tls.c:388: if (vs->vd->tls.x509verify) {
./ui/vnc.c:3212: vs->tls.x509verify = 0;
./ui/vnc.c:3306: .name = "x509verify",
./ui/vnc.c:3396: vs->tls.x509verify = qemu_opt_get_bool(opts, "x509verify", false);
./ui/vnc.c:3456: if (acl && x509 && vs->tls.x509verify) {

Quoted 7 lines

Quoted 2 lines
If only 'x509' parameter is specified, can vnc-tls work after applying this patch? Am I missing something?
x509 only says that the server must provide x509 certs to the client. The x509verify says that the server must also verify the client's certificate. So there are obviously extra codepaths for the latter.

Okay, thanks for your explanation. :)

But since their different functions, Qemu should support the scenario that those two parameters are specified at the same time (by Qemu command line) IMHO because they are not mutually exclusive, isn't it?

Regards,
-Gonglei

Daniel P. Berrange

author

2015-03-11 11:27 UTC #6 lore raw

Quoted 75 lines · Gonglei

Quoted 67 lines · Daniel P. Berrange
Quoted 66 lines · Gonglei
Quoted 50 lines · Daniel P. Berrange
Quoted 40 lines · Gonglei
Quoted 39 lines · Daniel P. Berrange
The 'x509verify' parameter is documented as taking a path to the x509 certificates, ie the same syntax as the 'x509' parameter.
commit 4db14629c38611061fc19ec6927405923de84f08
Author: Gerd Hoffmann <[email protected]>
Date: Tue Sep 16 12:33:03 2014 +0200
vnc: switch to QemuOpts, allow multiple servers
caused a regression by turning 'x509verify' into a boolean parameter instead. This breaks setup from libvirt and is not consistent with the docs.
Signed-off-by Daniel P. Berrange <[email protected]>
---
 ui/vnc.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)
ui/vnc.c +5 -1
index 10a2724..37290e7 100644
@@ -3304,7 +3304,7 @@ static QemuOptsList qemu_vnc_opts = {
             .type = QEMU_OPT_BOOL,
         },{
             .name = "x509verify",
-            .type = QEMU_OPT_BOOL,
+            .type = QEMU_OPT_STRING,
         },{
             .name = "acl",
             .type = QEMU_OPT_BOOL,
@@ -3391,9 +3391,14 @@ void vnc_display_open(const char *id, Error **errp)
 #ifdef CONFIG_VNC_TLS
     tls  = qemu_opt_get_bool(opts, "tls", false);
     path = qemu_opt_get(opts, "x509");
+    if (!path) {
+        path = qemu_opt_get(opts, "x509verify");
+        if (path) {
+            vs->tls.x509verify = true;
Quoted 8 lines
ui/vnc.c void vnc_display_open(const char *id, Error **errp) · line 3396
Quoted 5 lines
ui/vnc.c +2 -1
+        }
+    }
     if (path) {
         x509 = true;
-        vs->tls.x509verify = qemu_opt_get_bool(opts, "x509verify", false);
We still need to get the x509verify value, while both 'x509' and 'x509verify' are configured, isn't it?
Quoted 4 lines
Err, the code 7 lines earlier gets the x509verify value. The x509 and x509verify parameters are never to be specified at the same time - either one or the other is used.
I noticed that there are several places that check x509verify (or vs->tls.x509verify) value:
./ui/vnc-auth-vencrypt.c:85: if (vs->vd->tls.x509verify) {
./ui/vnc-tls.c:260: if (vs->vd->tls.x509verify) {
./ui/vnc-tls.c:388: if (vs->vd->tls.x509verify) {
./ui/vnc.c:3212: vs->tls.x509verify = 0;
./ui/vnc.c:3306: .name = "x509verify",
./ui/vnc.c:3396: vs->tls.x509verify = qemu_opt_get_bool(opts, "x509verify", false);
./ui/vnc.c:3456: if (acl && x509 && vs->tls.x509verify) {
Quoted 7 lines
Quoted 2 lines
If only 'x509' parameter is specified, can vnc-tls work after applying this patch? Am I missing something?
x509 only says that the server must provide x509 certs to the client. The x509verify says that the server must also verify the client's certificate. So there are obviously extra codepaths for the latter.

Quoted 5 lines

Okay, thanks for your explanation. :)
But since their different functions, Qemu should support the scenario that those two parameters are specified at the same time (by Qemu command line) IMHO because they are not mutually exclusive, isn't it?

It does not make sense to supply both at the same time, as that would mean you were giving QEMU two sets of x509 certificates for the same server. Also since x509verify is a superset of x509, there is no reason to need to specify both at once.

Regards,
Daniel

Signature · 4 lines

|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org       -o-       http://live.gnome.org/gtk-vnc :|

Gonglei

2015-03-11 11:30 UTC #7 lore raw

Quoted 82 lines · Daniel P. Berrange

Quoted 75 lines · Gonglei
Quoted 67 lines · Daniel P. Berrange
Quoted 66 lines · Gonglei
Quoted 50 lines · Daniel P. Berrange
Quoted 40 lines · Gonglei
Quoted 39 lines · Daniel P. Berrange
The 'x509verify' parameter is documented as taking a path to the x509 certificates, ie the same syntax as the 'x509' parameter.
commit 4db14629c38611061fc19ec6927405923de84f08
Author: Gerd Hoffmann <[email protected]>
Date: Tue Sep 16 12:33:03 2014 +0200
vnc: switch to QemuOpts, allow multiple servers
caused a regression by turning 'x509verify' into a boolean parameter instead. This breaks setup from libvirt and is not consistent with the docs.
Signed-off-by Daniel P. Berrange <[email protected]>
---
 ui/vnc.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)
ui/vnc.c +5 -1
index 10a2724..37290e7 100644
@@ -3304,7 +3304,7 @@ static QemuOptsList qemu_vnc_opts = {
             .type = QEMU_OPT_BOOL,
         },{
             .name = "x509verify",
-            .type = QEMU_OPT_BOOL,
+            .type = QEMU_OPT_STRING,
         },{
             .name = "acl",
             .type = QEMU_OPT_BOOL,
@@ -3391,9 +3391,14 @@ void vnc_display_open(const char *id, Error **errp)
 #ifdef CONFIG_VNC_TLS
     tls  = qemu_opt_get_bool(opts, "tls", false);
     path = qemu_opt_get(opts, "x509");
+    if (!path) {
+        path = qemu_opt_get(opts, "x509verify");
+        if (path) {
+            vs->tls.x509verify = true;
Quoted 8 lines
ui/vnc.c void vnc_display_open(const char *id, Error **errp) · line 3396
Quoted 5 lines
ui/vnc.c +2 -1
+        }
+    }
     if (path) {
         x509 = true;
-        vs->tls.x509verify = qemu_opt_get_bool(opts, "x509verify", false);
We still need to get the x509verify value, while both 'x509' and 'x509verify' are configured, isn't it?
Quoted 4 lines
Err, the code 7 lines earlier gets the x509verify value. The x509 and x509verify parameters are never to be specified at the same time - either one or the other is used.
I noticed that there are several places that check x509verify (or vs->tls.x509verify) value:
./ui/vnc-auth-vencrypt.c:85: if (vs->vd->tls.x509verify) {
./ui/vnc-tls.c:260: if (vs->vd->tls.x509verify) {
./ui/vnc-tls.c:388: if (vs->vd->tls.x509verify) {
./ui/vnc.c:3212: vs->tls.x509verify = 0;
./ui/vnc.c:3306: .name = "x509verify",
./ui/vnc.c:3396: vs->tls.x509verify = qemu_opt_get_bool(opts, "x509verify", false);
./ui/vnc.c:3456: if (acl && x509 && vs->tls.x509verify) {
Quoted 7 lines
Quoted 2 lines
If only 'x509' parameter is specified, can vnc-tls work after applying this patch? Am I missing something?
x509 only says that the server must provide x509 certs to the client. The x509verify says that the server must also verify the client's certificate. So there are obviously extra codepaths for the latter.
Quoted 5 lines
Okay, thanks for your explanation. :)
But since their different functions, Qemu should support the scenario that those two parameters are specified at the same time (by Qemu command line) IMHO because they are not mutually exclusive, isn't it?

Quoted 8 lines

It does not make sense to supply both at the same time, as that would mean you were giving QEMU two sets of x509 certificates for the same server. Also since x509verify is a superset of x509, there is no reason to need to specify both at once.
Regards,
Daniel

Get it, thanks.

Regards,
-Gonglei

Gerd Hoffmann

2015-03-11 13:25 UTC #8 lore raw

In reply to Daniel P. Berrange

Quoted 7 lines · Daniel P. Berrange

The 'x509verify' parameter is documented as taking a path to the x509 certificates, ie the same syntax as the 'x509' parameter.
commit 4db14629c38611061fc19ec6927405923de84f08
Author: Gerd Hoffmann <[email protected]>
Date: Tue Sep 16 12:33:03 2014 +0200

Quoted 5 lines

vnc: switch to QemuOpts, allow multiple servers
caused a regression by turning 'x509verify' into a boolean parameter instead. This breaks setup from libvirt and is not consistent with the docs.

added to vnc patch queue.

thanks,
Gerd