Re: Feature suggestion: Port tunneling between VM & client over spice-channel

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi.
 
Nice job Javier! It is what i mean. SSH-like tunneling.
 
It's realy intresting feature. It's looks like a virtual machine networking revolution. This feature change the approach to VDI-network planing and operation.
 
Using one port is good idea when network traffic flow is low and simple.
Using separate port looks good when traffic flow is high.
 
Also may be better to separate port on host in addition to spice port in order to traffic shaping and delivery improvement by splitting traffic by protocols: udp, tcp, quic and others.
 
Please share the vdagent code with SPICE-community. If you wish to recieve revenue for your R&D work you can publish bitcoin, litecoin or other altcoin wallet address on site or git repo. All intrested users are able to thank you. Bitcoin price today is fall but exist and can be converted to your favorite paper money.
 
15.11.2018, 00:16, "Javier Celaya" <javier.celaya@xxxxxxxxxxx>:
Hi
 
El mié, 14-11-2018 a las 12:49 +0100, Victor Toso escribió:
Hi,
 
On Wed, Nov 14, 2018 at 11:38:23AM +0900, Boris Morozov wrote:
 
Hello, dear friends. I would like a share idea with you about
new feature. Please forgive me if i wrong.
 
Current approach to publish ports from virtual machine is
connecting it to network by network adapter.
 
In this case administrator should to write:
- Routes
- DNS-records
- Firewall rules
 
In final result: 
- Virtual machine start going to Internet from host local or
  ISP network.
- Virtual machine user can attack gateways and peer nodes in
  host network.
- Virtual machine user can attack global sites, services and
  leave host IP it will raise problems with owners of attacked
  sites and services, authorities.
- Virtual machine user can download illegal or forbidden
  content and leave host IP it will raise problems with
  authorities.
- Virtual machine can be attacked from other nodes in host
  network and internet.
Internet gateway on host network should open extra ports to
perform access to virtual machine.
- Some computing power of host is begin to spent on NIC and
  network emulation. 
- Some time of administrator was spent to configuring and
  testing routing, dns, firewall.
 
To avoid this responibility and performance problems and reduce
time on configuration when public access to virtual machine not
needed it's better way to tunnel ports on virtual machine from
guest and vice-versa by SPICE.
 
 
I think that was implemented at some point in the past, we do
have the deprecated type SPICE_CHANNEL_TUNNEL and AFAIK,
something like using client's internet in the guest was
supported.
 
 
In case of port tunneling over SPICE 
 
1. In virtual machine running services and they opened ports
   (HTTP, SSH for example) on localhost (127.0.0.1). 
2. Spice guest agent in virtual machine open client-port and
   become ready to connect to services ports from client-port and
   redirect data to spice channel. 
3. In other end of spice channel on client spice client open
   ports for listening incoming connections on client localhost
   (127.0.0.1). 
4. Client user connect to tunneled ports on client-side
   localhost and start working with tunneled ports as with local
   ones. 
5. Spice client & guest agent perform traffic redirection.
 
As we can see offered approach is more simple. It can't be used
against traditional approach in public access but in personal
access it's look better. Also it's looks possible to tunnel not
only localhost ports on virtual machine and others nodes ones
if network is working. 
 
Use cases:
- Web-browsing virtual machine sites on client machine
- Web-sites, network services (daemons) development
- Internet access in virtual machine via proxies on client
  (TOR, VPN, SOCKS, HTTP)
- Monitoring (getting access to API and dashboards) of various
  services: printers, miners, solar power chargers, UPS and
  others. 
- File transfer between client and virtual machine via FTP,
  SFTP, HTTP
- Stream transfer between client and virtual machine video,
  audio and others.
- VDI-hosting (Isolated preinstalled VM without NIC)
 
 
Are you only suggesting the feature or do you plan to implement
it? If the later, the best way to make guest talk to client
nowadays is by using port channel. We do have a spice-webdavd
daemon that works in windows and linux guest that makes sharing a
folder possible (with WebDAV protocol).
 
FYI, in flexVDI we have already implemented this feature. We just had not the time to split it into meaningful patches and share it with the list. If you are really interested, we can try to dedicate some time to it.
 
Our implementation allows to redirect local and remote TCP ports, just like -L and -R options in ssh. A SOCKS proxy shouldn't be hard to implement too. However, we did not use a separate channel. We use the main channel, like with file transfers, because the client communicates with the vdagent in the guest. Our changes affect spice-gtk, spice-protocol, vdagent-linux and vdagent-win32. Maybe it would be a better idea to have a separate channel+virtio_port+agent for this, what do you think?
 
You can have a look at our implementation in our spice-* repos at GitHub:
https://github.com/flexvdi
The vdagent-part is not there, but I could share the code with you if you are interested.
 
Best regards
 
 
Cheers,
Victor
 
_______________________________________________
Spice-devel mailing list
Spice-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.freedesktop.org/mailman/listinfo/spice-devel
 
-- 
 

flexVDI

Javier Celaya Alastrué

Chief Technology Officer

email javier.celaya@xxxxxxxxxxx

Phone +34696969959

Skype j_celaya

Legal Legal Information and Privacy Policy

Política de confidencialidad

Este mensaje y los ficheros anexos son confidenciales dirigiéndose exclusivamente al destinatario mencionado en el encabezamiento. Si usted ha recibido este correo por error, tenga la amabilidad de eliminarlo de su sistema y no divulgar el contenido a terceros. Los datos personales facilitados por usted o por terceros serán tratados por FLEXIBLE SOFTWARE SOLUTIONS S.L.U. con la finalidad de gestionar y mantener los contactos y relaciones que se produzcan como consecuencia de la relación que mantiene con FLEXIBLE SOFTWARE SOLUTIONS S.L.U. Normalmente, la base jurídica que legitima este tratamiento, será su consentimiento, el interés legítimo o la necesidad para gestionar una relación contractual o similar. El plazo de conservación de sus datos vendrá determinado por la relación que mantiene con nosotros. Para más información al respecto, o para ejercer sus derechos de acceso, rectificación, supresión, oposición, limitación o portabilidad, dirija una comunicación por escrito a FLEXIBLE SOFTWARE SOLUTIONS S.L.U: Avenida de Ranillas 1D, Planta 3, Oficina 3G, Zaragoza o al correo electrónico pdo@xxxxxxxxxxx. En caso de considerar vulnerado su derecho a la protección de datos personales, podrá interponer una reclamación ante la Agencia Española de Protección de Datos (www.agpd.es).

 
 
-- 
Best regards, Boris Morozov.
 
_______________________________________________
Spice-devel mailing list
Spice-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.freedesktop.org/mailman/listinfo/spice-devel

[Index of Archives]     [Linux Virtualization]     [Linux Virtualization]     [Linux ARM Kernel]     [Linux ARM]     [Linux Omap]     [Fedora ARM]     [IETF Annouce]     [Security]     [Bugtraq]     [Linux OMAP]     [Linux MIPS]     [ECOS]     [Asterisk Internet PBX]     [Linux API]     [Monitors]