7.232. spice-gtk

Bug Fixes

BZ#834283

When part of a key combination matched the grab sequence, the last key of the combination was sometimes not sent to the guest. As a consequence, the Left Ctrl+Alt+Del key combination was not passed to guests. This update ensures that all the keys are sent to the SPICE server even if they are part of a combination. Now, when a key combination matches the grab sequence, the procedure works as expected.

BZ#813865

Previously, when a Uniform Resource Identifier (URI) contained an IPv6 address, errors occurred when parsing URIs in remote-viewer. As a consequence, remote-viewer could not be started from the command line with an IPv6 URI. Parsing of URIs containing IPv6 addresses is now fixed and it is possible to connect to an IPv6 address when starting remote-viewer from the command line.

BZ#812347

High network jitter caused some key strokes to enter multiple characters instead of one. Improvements on the SPICE protocol have been made to avoid unwanted character repetition.

BZ#818848

When the QEMU application was started with the --spice-disable-effects option and an invalid value, spice-gtk did not print any error message, which could confuse users. This bug is now fixed and QEMU exits when an invalid value is encountered.

BZ#881072

Previously, an attempt to close connection to a display failed until one of the remaining windows got resized. Consequently, a previously closed window could be opened again without user's intention. Reopening of the closed display is now fixed and closing the remote-viewer windows works as expected.

BZ#835997

Previously, SPICE motion messages were not properly synchronized between client and server after migration. As a consequence, mouse cursor state could get out of sync after migration. This update ensures SPICE motion messages are synchronized between client and server and mouse cursor state no longer gets out of sync.

BZ#846666

Previously, the following error code was returned in various scenarios:

main-1:0: SSL_connect: error:00000001:lib(0):func(0):reason(1)

This code made debugging of connections failures cumbersome. With this update, the corresponding error message is printed for each of the different scenarios.

BZ#818847

When using the --spice-color-value option with an invalid value, an error message is displayed. However, previously, the message was not clear enough. After the update, when using the --spice-color-value option with an invalid value, SPICE returns an error message including a suggestion of the value.

BZ#843134

After connecting to an agent-less guest with 16-bit color depth, the initial screen was black and got drawn on change only. This bug is now fixed and the guest screen is rendered fully upon connection to an agent-less guest with 16-bit color depth.

BZ#867885

Disabling client-side mouse acceleration temporarily when the pointer was in server mode and grabbed caused the mouse pointer to "jump" over the guest desktop at any faster movement. This bug is now fixed and the mouse pointer moves in a guest as supposed in a physical client.

BZ#851090

Previously, the Ctrl+Shift composite key did not work, resulting in the same actions being triggered by different composite keys. This bug is now fixed and Ctrl+Shift works as expected.

BZ#858228

Previously, when no host subject was specified, the remote-viewer tool failed to connect with the following error message:

Spice-Warning **: ssl_verify.c:484:openssl_verify: ssl: subject '' verification failed

With this update, when no host subject is specified, remote-viewer treats it like an empty host subject and verifies a common name CN= from the subject field with hostname.

BZ#858232

Under certain circumstances, an unclear warning message was returned, incorrectly suggesting that a needless network connection was attempted. The error message has been improved to correctly reflect the state.

BZ#859392

Previously, for security reasons, users were prompted to enter the root password when trying to redirect a USB device from a Red Hat Enterprise Linux 6.4 client to a SPICE guest. However, regular users do not have the root password. As this behavior is controlled by PolicyKit, changes in the /usr/share/polkit-1/actions/org.spice-space.lowlevelusbaccess.policy file have been made to allow access to the raw USB device without prompting for a password. A warning about the security implications of this have been included in the documentation.

BZ#807771

Previously, implementation of the CONTROLLER_SEND_CAD event was missing in the spice-gtk controller. As a consequence, checking the box the "Pass Ctrl+Alt+Del to virtual machine box" in the user interface did not produce any result. Implementation for CONTROLLER_SEND_CAD has been added to the underlying source code and users can now tick the checkbox for Ctrl+Alt+Del to be intercepted on the virtual guest.

BZ#861332

After a non-seamless migration of virtual machines with redirected USB devices, SPICE did not evaluate the USB state correctly. With this update, the related functions called from the channel_reset() function can rely on the state accurately, reflecting the USB state.

BZ#804187

When there was no device to redirect, the redirection dialogue window did not provide clear enough information. With this update, a help message indicating that there is no device to redirect is included in the dialogue window as well as additional related guidance.

BZ#868237

In some situations, SPICE attempted to send the 00 scan codes to virtual machines, which resulted in the unknown key pressed error messages being printed by the client. After this update, SPICE no longer sends the 00 scan codes to the spice-server.

Enhancements

BZ#846911

The previous SPICE migration pathway was almost equivalent to automatically connecting the client to the migration target and starting the session from scratch. This pathway resulted in unrecoverable data loss, mainly USB, smartcard or copy-paste data that was on its way from the client to the guest and vice versa, when the non-live phase of the migration started. This update prevents data loss and the migration process completes successfully in this scenario.

BZ#842411

RandR multi-monitor support for Linux guests and arbitrary resolution support for Linux and Windows guests have been added to the spice-gtk package. It is now possible to dynamically add new screens while using a virtual machine. Also, after resizing the window of the SPICE client, the resolution of the guest is automatically adjusted to match the size of the window.

BZ#820964

Auto-discovery of already plugged-in USB devices on Red Hat Enterprise Linux clients by the USB Redirector has been added to the spice-gtk package.

BZ#834504

This update adds more informative error messages to the spice-gtk package; the messages deal with host subject mismatch when invalid SSL certificates or SSL options are passed to QEMU to the spice-gtk package.

Security Fix

CVE-2013-4324

spice-gtk communicated with PolicyKit for authorization via an API that is vulnerable to a race condition. This could lead to intended PolicyKit authorizations being bypassed. This update modifies spice-gtk to communicate with PolicyKit via a different API that is not vulnerable to the race condition.