Let user set vnc password from command line or file

Here is a little patch to let the user specify the vnc server password in the command line (yes, it is visible with the ps command) or via an external file (better choice). This adds two new arguments, -vnc-password and -vnc-password-file. The file containing the vnc password is in clear.

Please let me know if there is any writing rule I was not following, I'll be glad to modify the patch accordingly. I was doubtful whether to use a straight fopen or the QEMU_fopen. Let me know the difference.

Thank you

Leandro

diff -u -p vl.c.orig vl.c
@@ -7606,6 +7606,8 @@ static void help(int exitcode)
           "-no-reboot      exit instead of rebooting\n"
           "-loadvm file    start right away with a saved state (loadvm 

in monitor)\n"
"-vnc display start a VNC server on display\n"

+          "-vnc-password password    set VNC server password\n"
+          "-vnc-password-file file   set VNC server password (in clear) from file\n"

#ifndef _WIN32
"-daemonize daemonize QEMU after initializing\n"
#endif
@@ -7717,6 +7719,8 @@ enum {
QEMU_OPTION_old_param,
QEMU_OPTION_clock,
QEMU_OPTION_startdate,
+ QEMU_OPTION_vnc_password,
+ QEMU_OPTION_vnc_password_file,
};

typedef struct QEMUOption {

@@ -7803,6 +7807,8 @@ const QEMUOption qemu_options[] = {
    { "usbdevice", HAS_ARG, QEMU_OPTION_usbdevice },
    { "smp", HAS_ARG, QEMU_OPTION_smp },
    { "vnc", HAS_ARG, QEMU_OPTION_vnc },

+ { "vnc-password", HAS_ARG, QEMU_OPTION_vnc_password },
+ { "vnc-password-file", HAS_ARG, QEMU_OPTION_vnc_password_file },

    /* temporary options */
    { "usb", 0, QEMU_OPTION_usb },
@@ -8085,6 +8091,9 @@ int main(int argc, char **argv)
    int fds[2];
    const char *pid_file = NULL;
    VLANState *vlan;
+    char vnc_password[9];
+    FILE *fd_vnc_password_file;
+    const char *vnc_password_file = NULL;

    LIST_INIT (&vm_change_state_head);
#ifndef _WIN32
@@ -8580,6 +8589,13 @@ int main(int argc, char **argv)
           case QEMU_OPTION_vnc:
               vnc_display = optarg;
               break;

+ case QEMU_OPTION_vnc_password:
+ strncpy(vnc_password,optarg,8);
+ vnc_password[8] = '\0';
+ break;
+ case QEMU_OPTION_vnc_password_file:
+ vnc_password_file = optarg;

+               break;
            case QEMU_OPTION_no_acpi:
                acpi_enabled = 0;
                break;
@@ -8849,8 +8865,21 @@ int main(int argc, char **argv)
        dumb_display_init(ds);
    } else if (vnc_display != NULL) {
        vnc_display_init(ds);

+ if (vnc_password_file != NULL) {
+ fd_vnc_password_file = fopen(vnc_password_file, "r");
+ if (!fd_vnc_password_file) {
+ fprintf(stderr, "qemu: could not open vnc server password file '%s'\n", vnc_password_file);
+ exit(1);

+         }
+         fgets(vnc_password,9,fd_vnc_password_file);
+         if (vnc_password[strlen(vnc_password) - 1] == '\n')

+ vnc_password[strlen(vnc_password) - 1] = '\0';
+ fclose(fd_vnc_password_file);
+ }
+ if (vnc_password && vnc_password[0])
+ vnc_display_password(NULL,vnc_password);
if (vnc_display_open(ds, vnc_display) < 0)
- exit(1);

+         exit(1);
    } else {
#if defined(CONFIG_SDL)
        sdl_display_init(ds, full_screen, no_frame);

Providing a password which is clearly visible on the command line to all users of a machine is unacceptable. This capability was *explicitly* left out when I did the original VNC password support in QEMU.

Providing a password via a file is reasonable, but this should be made more general than just VNC. QCow2 disks files can be encrypted and require passwords too. So I think it'd be more useful to have a '-passwd-file file' arg, and in that file have 1 line per (device, password) pair.

eg Assuming use of VNC, and 2 qcow encrypted disks one might have:

      vnc: 123456
      hda: mysecret
      hdb: othersecret

Perhaps 'hda' should be the more general syntax used by the -drive param instead, or even the qcow file name...

Regards,
Dan.

|=- Red Hat, Engineering, Emerging Technologies, Boston.  +1 978 392 2496 -=|
|=-           Perl modules: http://search.cpan.org/~danberr/              -=|
|=-               Projects: http://freshmeat.net/~danielpb/               -=|
|=-  GnuPG: 7D3B9505   F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505  -=|