Revert "Enable encryption in vm VNC console connection"

This reverts commit 06238f292aaf236c456dcc50d0aea1efcbb05584.

This patch was exposing all the noVNC files and let websockify web server
render the noVNC page.
The websockify web server is limited and only renders content in a directory.

So if someone has the URL
https://host-ip:64667/vnc.html?port=64667&path=?token=my-vm&encrypt=1
he/she can access the VM console without Kimchi authentication.

The idea is let Kimchi render the noVNC page and also add authentication
to it.

Signed-off-by: Aline Manera <alinefm@br.ibm.com>
Enable encryption in vm console connection

The current vm ui console connection is unencrypted. This patch enables
encrypted vm console connection. But browsers doesn't
support well for the usage self-signed certs in the ssl websocket
connection. For details, please see:
https://github.com/kanaka/websockify/wiki/Encrypted-Connections

For chrome browser, the encrypted console connection should work after
you login with ssl connection. But for firefox, you have to connect to
https://host-ip:64667/ and accept the self-signed cert.

Signed-off-by: Mark Wu <wudxw@linux.vnet.ibm.com>
Make use of the mini Web server in the websockify

Some browsers doesn't support well for the usage self-signed certs in the ssl
websocket connection. For details, please see:
https://github.com/kanaka/websockify/wiki/Encrypted-Connections

For chrome browser, the encrypted console connection should work after
you login with ssl connection. But for firefox, it does not show a
confirmation page for the user the accept the self-signed cert when
the HTTPs connection is started from a websocket.

So this patch makes use of the Web server in the websockify. The mini
Web server in the websockify can serve static contents like html, css
and js.
This patch add a simple HTMl file (console.html) to pages/websockify and have
websockify serve this file.

When the user clicks the console icon, Kimchi brings the user to
https://host:64667/console.html, which is served by websockify. Then
firefox would prompt a confirmation page for the self-signed cert. After
the user accept the cert, the user will be redirected to noVNC/SPICE page
provided by Kimchi server.

It is important to have Kimchi providing the noVNC/SPICE page to be able to
add authentication to console pages (vnc_auto.html and spice.html)

Signed-off-by: Aline Manera <alinefm@br.ibm.com>
Signed-off-by: Mark Wu <wudxw@linux.vnet.ibm.com>
Signed-off-by: Zhou Zheng Sheng <zhshzhou@linux.vnet.ibm.com>
Enable Kimchi authentication in console pages

noVNC and spice pages were not protected by authentication.
So if a non-authenticated user has access to the URL
http://host-ip:port/vnc.html?port=64667&path=?token=<my-vm>&encrypt=1
he/she would be able to get control of the VM.
Fix it by using kimchiauth tool.

Signed-off-by: Aline Manera <alinefm@br.ibm.com>
backend: Redirect 401 error to default page

When a non-authenticated user tries to access the URL
http://host-ip:port/vnc.html?port=64667&path=?token=<my-vm>&encrypt=1
Kimchi server will return 401 error code before loading the HTML file.

So we need to redirect the 401 error for vnc_auto.html and spice.html
pages to Kimchi default page which will require the user authentication to
proceed.

Also save the current console page to redirect user to properly location
after logging.

Signed-off-by: Aline Manera <alinefm@br.ibm.com>
UI: Redirect user to console page after logging

vnc_auto.html and spice.html are now protected through Kimchi
authentication.
When a non-authenticated user tries to access those URLs he/she will be
redirected to login page. After it, he/she will get the console page
according to cookies console_type and console_uri (set by nginx)

Signed-off-by: Aline Manera <alinefm@br.ibm.com>
websockets: Disallow non-encrypted client connections

As all HTTP requests are redirected to HTTPS, we should only use
encryted connections to websockets.
Fix it.

Signed-off-by: Aline Manera <alinefm@br.ibm.com>
bug fix: Properly set the listen IP to SPICE console

When using secure websockets connections, the listen IP must be the same
of the server IP, otherwise the connection will not be stabilished.

Signed-off-by: Aline Manera <alinefm@br.ibm.com>
Signed-off-by: Royce Lv <lvroyce@linux.vnet.ibm.com>