Hi El mié, 14-11-2018 a las 12:49 +0100, Victor Toso escribió: Hi,On Wed, Nov 14, 2018 at 11:38:23AM +0900, Boris Morozov wrote:Hello, dear friends. I would like a share idea with you aboutnew feature. Please forgive me if i wrong.Current approach to publish ports from virtual machine isconnecting it to network by network adapter.In this case administrator should to write:- Routes- DNS-records- Firewall rulesIn final result:- Virtual machine start going to Internet from host local orISP network.- Virtual machine user can attack gateways and peer nodes inhost network.- Virtual machine user can attack global sites, services andleave host IP it will raise problems with owners of attackedsites and services, authorities.- Virtual machine user can download illegal or forbiddencontent and leave host IP it will raise problems withauthorities.- Virtual machine can be attacked from other nodes in hostnetwork and internet.Internet gateway on host network should open extra ports toperform access to virtual machine.- Some computing power of host is begin to spent on NIC andnetwork emulation.- Some time of administrator was spent to configuring andtesting routing, dns, firewall.To avoid this responibility and performance problems and reducetime on configuration when public access to virtual machine notneeded it's better way to tunnel ports on virtual machine fromguest and vice-versa by SPICE.I think that was implemented at some point in the past, we dohave the deprecated type SPICE_CHANNEL_TUNNEL and AFAIK,something like using client's internet in the guest wassupported.In case of port tunneling over SPICE1. In virtual machine running services and they opened ports(HTTP, SSH for example) on localhost (127.0.0.1).2. Spice guest agent in virtual machine open client-port andbecome ready to connect to services ports from client-port andredirect data to spice channel.3. In other end of spice channel on client spice client openports for listening incoming connections on client localhost(127.0.0.1).4. Client user connect to tunneled ports on client-sidelocalhost and start working with tunneled ports as with localones.5. Spice client & guest agent perform traffic redirection.As we can see offered approach is more simple. It can't be usedagainst traditional approach in public access but in personalaccess it's look better. Also it's looks possible to tunnel notonly localhost ports on virtual machine and others nodes onesif network is working.Use cases:- Web-browsing virtual machine sites on client machine- Web-sites, network services (daemons) development- Internet access in virtual machine via proxies on client(TOR, VPN, SOCKS, HTTP)- Monitoring (getting access to API and dashboards) of variousservices: printers, miners, solar power chargers, UPS andothers.- File transfer between client and virtual machine via FTP,SFTP, HTTP- Stream transfer between client and virtual machine video,audio and others.- VDI-hosting (Isolated preinstalled VM without NIC)Are you only suggesting the feature or do you plan to implementit? If the later, the best way to make guest talk to clientnowadays is by using port channel. We do have a spice-webdavddaemon that works in windows and linux guest that makes sharing afolder possible (with WebDAV protocol). FYI, in flexVDI we have already implemented this feature. We just had not the time to split it into meaningful patches and share it with the list. If you are really interested, we can try to dedicate some time to it. Our implementation allows to redirect local and remote TCP ports, just like -L and -R options in ssh. A SOCKS proxy shouldn't be hard to implement too. However, we did not use a separate channel. We use the main channel, like with file transfers, because the client communicates with the vdagent in the guest. Our changes affect spice-gtk, spice-protocol, vdagent-linux and vdagent-win32. Maybe it would be a better idea to have a separate channel+virtio_port+agent for this, what do you think? You can have a look at our implementation in our spice-* repos at GitHub: The vdagent-part is not there, but I could share the code with you if you are interested. Best regards Cheers,Victor_______________________________________________Spice-devel mailing listSpice-devel@xxxxxxxxxxxxxxxxxxxxxhttps://lists.freedesktop.org/mailman/listinfo/spice-devel --
| ||||
_______________________________________________ Spice-devel mailing list Spice-devel@xxxxxxxxxxxxxxxxxxxxx https://lists.freedesktop.org/mailman/listinfo/spice-devel