Re: [PATCH] fix #6079: use vncticket endpoint for VM serial terminal

[Fiona Ebner <f.ebner@proxmox.com>]

Hi,

Am 20.04.26 um 4:17 PM schrieb Koji Nishimura:
> Use the vncticket endpoint for the VM serial terminal termproxy path.
> 
> The node shell termproxy path already uses the vncticket endpoint,
> but the VM serial terminal path still uses the older authentication
> flow.
> 
> That older flow prevents VM /termproxy from working with API tokens,
> because authentication fails before the websocket connection can use
> the VNC ticket verification path.
> 
> Make the VM serial terminal path use the same vncticket-based
> authentication flow as the node shell path.
> 
> This fixes the VM /termproxy side of bug 6079. In local testing,
> this was required together with the already-posted access-control
> change for token-owned VNC ticket verification.
> 
> Signed-off-by: Koji Nishimura <nsm.kkoji@gmail.com>
> ---
>  src/PVE/API2/Qemu.pm | 11 ++++++++++-
>  1 file changed, 10 insertions(+), 1 deletion(-)
> 
> diff --git a/src/PVE/API2/Qemu.pm b/src/PVE/API2/Qemu.pm
> index 2a1e3854..0b8859fb 100644
> --- a/src/PVE/API2/Qemu.pm
> +++ b/src/PVE/API2/Qemu.pm
> @@ -3152,7 +3152,16 @@ __PACKAGE__->register_method({
>              syslog('info', "starting qemu termproxy $upid\n");
>  
>              my $cmd =
> -                ['/usr/bin/termproxy', $port, '--path', $authpath, '--perm', 'VM.Console', '--'];
> +                [
> +                    '/usr/bin/termproxy',
> +                    $port,
> +                    '--path',
> +                    $authpath,
> +                    '--perm',
> +                    'VM.Console',
> +                    '--vncticket-endpoint',
> +                    '--',
> +                ];
>              push @$cmd, @$remcmd, @$termcmd;
>  
>              run_command($cmd);

many thanks for your contribution! FYI, the issue was independently
fixed already with commit c9ee34b5 ("api: vnc/termproxy: encode and
verify port in ticket") [0] as part of some other changes, which also
switched to using the 'vncticket' endpoint.

Best Regards,
Fiona

[0]:
https://git.proxmox.com/?p=qemu-server.git;a=commitdiff;h=c9ee34b50280f46b793e93b9652fbbd5a742c6e4