?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Clarify -soundhw documentation as to avoid hda confusion
[qemu-kvm/fedora.git] / vnc.c
blob538658a774df9b636fb9b5ab189249080a331e84
1 /*
2 * QEMU VNC display driver
3 *
4 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5 * Copyright (C) 2006 Fabrice Bellard
6 *
7 * Permission is hereby granted, free of charge, to any person obtaining a copy
8 * of this software and associated documentation files (the "Software"), to deal
9 * in the Software without restriction, including without limitation the rights
10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11 * copies of the Software, and to permit persons to whom the Software is
12 * furnished to do so, subject to the following conditions:
13 *
14 * The above copyright notice and this permission notice shall be included in
15 * all copies or substantial portions of the Software.
16 *
17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23 * THE SOFTWARE.
24 */
25
26 #include "qemu-common.h"
27 #include "console.h"
28 #include "sysemu.h"
29 #include "qemu_socket.h"
30 #include "qemu-timer.h"
31 #include "audio/audio.h"
32
33 #define VNC_REFRESH_INTERVAL (1000 / 30)
34
35 #include "vnc_keysym.h"
36 #include "keymaps.c"
37 #include "d3des.h"
38
39 #ifdef CONFIG_VNC_TLS
40 #include <gnutls/gnutls.h>
41 #include <gnutls/x509.h>
42 #endif /* CONFIG_VNC_TLS */
43
44 // #define _VNC_DEBUG 1
45
46 #ifdef _VNC_DEBUG
47 #define VNC_DEBUG(fmt, ...) do { fprintf(stderr, fmt, ## __VA_ARGS__); } while (0)
48
49 #if CONFIG_VNC_TLS && _VNC_DEBUG >= 2
50 /* Very verbose, so only enabled for _VNC_DEBUG >= 2 */
51 static void vnc_debug_gnutls_log(int level, const char* str) {
52 VNC_DEBUG("%d %s", level, str);
53 }
54 #endif /* CONFIG_VNC_TLS && _VNC_DEBUG */
55 #else
56 #define VNC_DEBUG(fmt, ...) do { } while (0)
57 #endif
58
59
60 typedef struct Buffer
61 {
62 size_t capacity;
63 size_t offset;
64 uint8_t *buffer;
65 } Buffer;
66
67 typedef struct VncState VncState;
68
69 typedef int VncReadEvent(VncState *vs, uint8_t *data, size_t len);
70
71 typedef void VncWritePixels(VncState *vs, void *data, int size);
72
73 typedef void VncSendHextileTile(VncState *vs,
74 int x, int y, int w, int h,
75 void *last_bg,
76 void *last_fg,
77 int *has_bg, int *has_fg);
78
79 #define VNC_MAX_WIDTH 2048
80 #define VNC_MAX_HEIGHT 2048
81 #define VNC_DIRTY_WORDS (VNC_MAX_WIDTH / (16 * 32))
82
83 #define VNC_AUTH_CHALLENGE_SIZE 16
84
85 enum {
86 VNC_AUTH_INVALID = 0,
87 VNC_AUTH_NONE = 1,
88 VNC_AUTH_VNC = 2,
89 VNC_AUTH_RA2 = 5,
90 VNC_AUTH_RA2NE = 6,
91 VNC_AUTH_TIGHT = 16,
92 VNC_AUTH_ULTRA = 17,
93 VNC_AUTH_TLS = 18,
94 VNC_AUTH_VENCRYPT = 19
95 };
96
97 #ifdef CONFIG_VNC_TLS
98 enum {
99 VNC_WIREMODE_CLEAR,
100 VNC_WIREMODE_TLS,
101 };
102
103 enum {
104 VNC_AUTH_VENCRYPT_PLAIN = 256,
105 VNC_AUTH_VENCRYPT_TLSNONE = 257,
106 VNC_AUTH_VENCRYPT_TLSVNC = 258,
107 VNC_AUTH_VENCRYPT_TLSPLAIN = 259,
108 VNC_AUTH_VENCRYPT_X509NONE = 260,
109 VNC_AUTH_VENCRYPT_X509VNC = 261,
110 VNC_AUTH_VENCRYPT_X509PLAIN = 262,
111 };
112
113 #define X509_CA_CERT_FILE "ca-cert.pem"
114 #define X509_CA_CRL_FILE "ca-crl.pem"
115 #define X509_SERVER_KEY_FILE "server-key.pem"
116 #define X509_SERVER_CERT_FILE "server-cert.pem"
117
118 #endif /* CONFIG_VNC_TLS */
119
120 struct VncState
121 {
122 QEMUTimer *timer;
123 int lsock;
124 int csock;
125 DisplayState *ds;
126 int need_update;
127 int width;
128 int height;
129 uint32_t dirty_row[VNC_MAX_HEIGHT][VNC_DIRTY_WORDS];
130 char *old_data;
131 int depth; /* internal VNC frame buffer byte per pixel */
132 int has_resize;
133 int has_hextile;
134 int has_pointer_type_change;
135 int has_WMVi;
136 int absolute;
137 int last_x;
138 int last_y;
139
140 int major;
141 int minor;
142
143 char *display;
144 char *password;
145 int auth;
146 #ifdef CONFIG_VNC_TLS
147 int subauth;
148 int x509verify;
149
150 char *x509cacert;
151 char *x509cacrl;
152 char *x509cert;
153 char *x509key;
154 #endif
155 char challenge[VNC_AUTH_CHALLENGE_SIZE];
156
157 #ifdef CONFIG_VNC_TLS
158 int wiremode;
159 gnutls_session_t tls_session;
160 #endif
161
162 Buffer output;
163 Buffer input;
164 kbd_layout_t *kbd_layout;
165 /* current output mode information */
166 VncWritePixels *write_pixels;
167 VncSendHextileTile *send_hextile_tile;
168 int pix_bpp, pix_big_endian;
169 int client_red_shift, client_red_max, server_red_shift, server_red_max;
170 int client_green_shift, client_green_max, server_green_shift, server_green_max;
171 int client_blue_shift, client_blue_max, server_blue_shift, server_blue_max;
172
173 CaptureVoiceOut *audio_cap;
174 struct audsettings as;
175
176 VncReadEvent *read_handler;
177 size_t read_handler_expect;
178 /* input */
179 uint8_t modifiers_state[256];
180 };
181
182 static VncState *vnc_state; /* needed for info vnc */
183
184 void do_info_vnc(void)
185 {
186 if (vnc_state == NULL)
187 term_printf("VNC server disabled\n");
188 else {
189 term_printf("VNC server active on: ");
190 term_print_filename(vnc_state->display);
191 term_printf("\n");
192
193 if (vnc_state->csock == -1)
194 term_printf("No client connected\n");
195 else
196 term_printf("Client connected\n");
197 }
198 }
199
200 /* TODO
201 1) Get the queue working for IO.
202 2) there is some weirdness when using the -S option (the screen is grey
203 and not totally invalidated
204 3) resolutions > 1024
205 */
206
207 static void vnc_write(VncState *vs, const void *data, size_t len);
208 static void vnc_write_u32(VncState *vs, uint32_t value);
209 static void vnc_write_s32(VncState *vs, int32_t value);
210 static void vnc_write_u16(VncState *vs, uint16_t value);
211 static void vnc_write_u8(VncState *vs, uint8_t value);
212 static void vnc_flush(VncState *vs);
213 static void vnc_update_client(void *opaque);
214 static void vnc_client_read(void *opaque);
215
216 static void vnc_colordepth(DisplayState *ds, int depth);
217
218 static inline void vnc_set_bit(uint32_t *d, int k)
219 {
220 d[k >> 5] |= 1 << (k & 0x1f);
221 }
222
223 static inline void vnc_clear_bit(uint32_t *d, int k)
224 {
225 d[k >> 5] &= ~(1 << (k & 0x1f));
226 }
227
228 static inline void vnc_set_bits(uint32_t *d, int n, int nb_words)
229 {
230 int j;
231
232 j = 0;
233 while (n >= 32) {
234 d[j++] = -1;
235 n -= 32;
236 }
237 if (n > 0)
238 d[j++] = (1 << n) - 1;
239 while (j < nb_words)
240 d[j++] = 0;
241 }
242
243 static inline int vnc_get_bit(const uint32_t *d, int k)
244 {
245 return (d[k >> 5] >> (k & 0x1f)) & 1;
246 }
247
248 static inline int vnc_and_bits(const uint32_t *d1, const uint32_t *d2,
249 int nb_words)
250 {
251 int i;
252 for(i = 0; i < nb_words; i++) {
253 if ((d1[i] & d2[i]) != 0)
254 return 1;
255 }
256 return 0;
257 }
258
259 static void vnc_dpy_update(DisplayState *ds, int x, int y, int w, int h)
260 {
261 VncState *vs = ds->opaque;
262 int i;
263
264 h += y;
265
266 /* round x down to ensure the loop only spans one 16-pixel block per,
267 iteration. otherwise, if (x % 16) != 0, the last iteration may span
268 two 16-pixel blocks but we only mark the first as dirty
269 */
270 w += (x % 16);
271 x -= (x % 16);
272
273 x = MIN(x, vs->width);
274 y = MIN(y, vs->height);
275 w = MIN(x + w, vs->width) - x;
276 h = MIN(h, vs->height);
277
278 for (; y < h; y++)
279 for (i = 0; i < w; i += 16)
280 vnc_set_bit(vs->dirty_row[y], (x + i) / 16);
281 }
282
283 static void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
284 int32_t encoding)
285 {
286 vnc_write_u16(vs, x);
287 vnc_write_u16(vs, y);
288 vnc_write_u16(vs, w);
289 vnc_write_u16(vs, h);
290
291 vnc_write_s32(vs, encoding);
292 }
293
294 static void vnc_dpy_resize(DisplayState *ds, int w, int h)
295 {
296 int size_changed;
297 VncState *vs = ds->opaque;
298
299 ds->data = qemu_realloc(ds->data, w * h * vs->depth);
300 vs->old_data = qemu_realloc(vs->old_data, w * h * vs->depth);
301
302 if (ds->data == NULL || vs->old_data == NULL) {
303 fprintf(stderr, "vnc: memory allocation failed\n");
304 exit(1);
305 }
306
307 if (ds->depth != vs->depth * 8) {
308 ds->depth = vs->depth * 8;
309 console_color_init(ds);
310 }
311 size_changed = ds->width != w || ds->height != h;
312 ds->width = w;
313 ds->height = h;
314 ds->linesize = w * vs->depth;
315 if (size_changed) {
316 vs->width = ds->width;
317 vs->height = ds->height;
318 if (vs->csock != -1 && vs->has_resize) {
319 vnc_write_u8(vs, 0); /* msg id */
320 vnc_write_u8(vs, 0);
321 vnc_write_u16(vs, 1); /* number of rects */
322 vnc_framebuffer_update(vs, 0, 0, ds->width, ds->height, -223);
323 vnc_flush(vs);
324 }
325 }
326
327 memset(vs->dirty_row, 0xFF, sizeof(vs->dirty_row));
328 memset(vs->old_data, 42, ds_get_linesize(vs->ds) * ds_get_height(vs->ds));
329 }
330
331 /* fastest code */
332 static void vnc_write_pixels_copy(VncState *vs, void *pixels, int size)
333 {
334 vnc_write(vs, pixels, size);
335 }
336
337 /* slowest but generic code. */
338 static void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
339 {
340 uint8_t r, g, b;
341
342 r = ((v >> vs->server_red_shift) & vs->server_red_max) * (vs->client_red_max + 1) /
343 (vs->server_red_max + 1);
344 g = ((v >> vs->server_green_shift) & vs->server_green_max) * (vs->client_green_max + 1) /
345 (vs->server_green_max + 1);
346 b = ((v >> vs->server_blue_shift) & vs->server_blue_max) * (vs->client_blue_max + 1) /
347 (vs->server_blue_max + 1);
348 v = (r << vs->client_red_shift) |
349 (g << vs->client_green_shift) |
350 (b << vs->client_blue_shift);
351 switch(vs->pix_bpp) {
352 case 1:
353 buf[0] = v;
354 break;
355 case 2:
356 if (vs->pix_big_endian) {
357 buf[0] = v >> 8;
358 buf[1] = v;
359 } else {
360 buf[1] = v >> 8;
361 buf[0] = v;
362 }
363 break;
364 default:
365 case 4:
366 if (vs->pix_big_endian) {
367 buf[0] = v >> 24;
368 buf[1] = v >> 16;
369 buf[2] = v >> 8;
370 buf[3] = v;
371 } else {
372 buf[3] = v >> 24;
373 buf[2] = v >> 16;
374 buf[1] = v >> 8;
375 buf[0] = v;
376 }
377 break;
378 }
379 }
380
381 static void vnc_write_pixels_generic(VncState *vs, void *pixels1, int size)
382 {
383 uint8_t buf[4];
384
385 if (vs->depth == 4) {
386 uint32_t *pixels = pixels1;
387 int n, i;
388 n = size >> 2;
389 for(i = 0; i < n; i++) {
390 vnc_convert_pixel(vs, buf, pixels[i]);
391 vnc_write(vs, buf, vs->pix_bpp);
392 }
393 } else if (vs->depth == 2) {
394 uint16_t *pixels = pixels1;
395 int n, i;
396 n = size >> 1;
397 for(i = 0; i < n; i++) {
398 vnc_convert_pixel(vs, buf, pixels[i]);
399 vnc_write(vs, buf, vs->pix_bpp);
400 }
401 } else if (vs->depth == 1) {
402 uint8_t *pixels = pixels1;
403 int n, i;
404 n = size;
405 for(i = 0; i < n; i++) {
406 vnc_convert_pixel(vs, buf, pixels[i]);
407 vnc_write(vs, buf, vs->pix_bpp);
408 }
409 } else {
410 fprintf(stderr, "vnc_write_pixels_generic: VncState color depth not supported\n");
411 }
412 }
413
414 static void send_framebuffer_update_raw(VncState *vs, int x, int y, int w, int h)
415 {
416 int i;
417 uint8_t *row;
418
419 vnc_framebuffer_update(vs, x, y, w, h, 0);
420
421 row = ds_get_data(vs->ds) + y * ds_get_linesize(vs->ds) + x * vs->depth;
422 for (i = 0; i < h; i++) {
423 vs->write_pixels(vs, row, w * vs->depth);
424 row += ds_get_linesize(vs->ds);
425 }
426 }
427
428 static void hextile_enc_cord(uint8_t *ptr, int x, int y, int w, int h)
429 {
430 ptr[0] = ((x & 0x0F) << 4) | (y & 0x0F);
431 ptr[1] = (((w - 1) & 0x0F) << 4) | ((h - 1) & 0x0F);
432 }
433
434 #define BPP 8
435 #include "vnchextile.h"
436 #undef BPP
437
438 #define BPP 16
439 #include "vnchextile.h"
440 #undef BPP
441
442 #define BPP 32
443 #include "vnchextile.h"
444 #undef BPP
445
446 #define GENERIC
447 #define BPP 8
448 #include "vnchextile.h"
449 #undef BPP
450 #undef GENERIC
451
452 #define GENERIC
453 #define BPP 16
454 #include "vnchextile.h"
455 #undef BPP
456 #undef GENERIC
457
458 #define GENERIC
459 #define BPP 32
460 #include "vnchextile.h"
461 #undef BPP
462 #undef GENERIC
463
464 static void send_framebuffer_update_hextile(VncState *vs, int x, int y, int w, int h)
465 {
466 int i, j;
467 int has_fg, has_bg;
468 uint8_t *last_fg, *last_bg;
469
470 vnc_framebuffer_update(vs, x, y, w, h, 5);
471
472 last_fg = (uint8_t *) malloc(vs->depth);
473 last_bg = (uint8_t *) malloc(vs->depth);
474 has_fg = has_bg = 0;
475 for (j = y; j < (y + h); j += 16) {
476 for (i = x; i < (x + w); i += 16) {
477 vs->send_hextile_tile(vs, i, j,
478 MIN(16, x + w - i), MIN(16, y + h - j),
479 last_bg, last_fg, &has_bg, &has_fg);
480 }
481 }
482 free(last_fg);
483 free(last_bg);
484
485 }
486
487 static void send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
488 {
489 if (vs->has_hextile)
490 send_framebuffer_update_hextile(vs, x, y, w, h);
491 else
492 send_framebuffer_update_raw(vs, x, y, w, h);
493 }
494
495 static void vnc_copy(DisplayState *ds, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
496 {
497 int src, dst;
498 uint8_t *src_row;
499 uint8_t *dst_row;
500 char *old_row;
501 int y = 0;
502 int pitch = ds_get_linesize(ds);
503 VncState *vs = ds->opaque;
504
505 vnc_update_client(vs);
506
507 if (dst_y > src_y) {
508 y = h - 1;
509 pitch = -pitch;
510 }
511
512 src = (ds_get_linesize(ds) * (src_y + y) + vs->depth * src_x);
513 dst = (ds_get_linesize(ds) * (dst_y + y) + vs->depth * dst_x);
514
515 src_row = ds_get_data(ds) + src;
516 dst_row = ds_get_data(ds) + dst;
517 old_row = vs->old_data + dst;
518
519 for (y = 0; y < h; y++) {
520 memmove(old_row, src_row, w * vs->depth);
521 memmove(dst_row, src_row, w * vs->depth);
522 src_row += pitch;
523 dst_row += pitch;
524 old_row += pitch;
525 }
526
527 vnc_write_u8(vs, 0); /* msg id */
528 vnc_write_u8(vs, 0);
529 vnc_write_u16(vs, 1); /* number of rects */
530 vnc_framebuffer_update(vs, dst_x, dst_y, w, h, 1);
531 vnc_write_u16(vs, src_x);
532 vnc_write_u16(vs, src_y);
533 vnc_flush(vs);
534 }
535
536 static int find_dirty_height(VncState *vs, int y, int last_x, int x)
537 {
538 int h;
539
540 for (h = 1; h < (vs->height - y); h++) {
541 int tmp_x;
542 if (!vnc_get_bit(vs->dirty_row[y + h], last_x))
543 break;
544 for (tmp_x = last_x; tmp_x < x; tmp_x++)
545 vnc_clear_bit(vs->dirty_row[y + h], tmp_x);
546 }
547
548 return h;
549 }
550
551 static void vnc_update_client(void *opaque)
552 {
553 VncState *vs = opaque;
554
555 if (vs->need_update && vs->csock != -1) {
556 int y;
557 uint8_t *row;
558 char *old_row;
559 uint32_t width_mask[VNC_DIRTY_WORDS];
560 int n_rectangles;
561 int saved_offset;
562 int has_dirty = 0;
563
564 vga_hw_update();
565
566 vnc_set_bits(width_mask, (vs->width / 16), VNC_DIRTY_WORDS);
567
568 /* Walk through the dirty map and eliminate tiles that
569 really aren't dirty */
570 row = ds_get_data(vs->ds);
571 old_row = vs->old_data;
572
573 for (y = 0; y < vs->height; y++) {
574 if (vnc_and_bits(vs->dirty_row[y], width_mask, VNC_DIRTY_WORDS)) {
575 int x;
576 uint8_t *ptr;
577 char *old_ptr;
578
579 ptr = row;
580 old_ptr = (char*)old_row;
581
582 for (x = 0; x < ds_get_width(vs->ds); x += 16) {
583 if (memcmp(old_ptr, ptr, 16 * vs->depth) == 0) {
584 vnc_clear_bit(vs->dirty_row[y], (x / 16));
585 } else {
586 has_dirty = 1;
587 memcpy(old_ptr, ptr, 16 * vs->depth);
588 }
589
590 ptr += 16 * vs->depth;
591 old_ptr += 16 * vs->depth;
592 }
593 }
594
595 row += ds_get_linesize(vs->ds);
596 old_row += ds_get_linesize(vs->ds);
597 }
598
599 if (!has_dirty && !vs->audio_cap) {
600 qemu_mod_timer(vs->timer, qemu_get_clock(rt_clock) + VNC_REFRESH_INTERVAL);
601 return;
602 }
603
604 /* Count rectangles */
605 n_rectangles = 0;
606 vnc_write_u8(vs, 0); /* msg id */
607 vnc_write_u8(vs, 0);
608 saved_offset = vs->output.offset;
609 vnc_write_u16(vs, 0);
610
611 for (y = 0; y < vs->height; y++) {
612 int x;
613 int last_x = -1;
614 for (x = 0; x < vs->width / 16; x++) {
615 if (vnc_get_bit(vs->dirty_row[y], x)) {
616 if (last_x == -1) {
617 last_x = x;
618 }
619 vnc_clear_bit(vs->dirty_row[y], x);
620 } else {
621 if (last_x != -1) {
622 int h = find_dirty_height(vs, y, last_x, x);
623 send_framebuffer_update(vs, last_x * 16, y, (x - last_x) * 16, h);
624 n_rectangles++;
625 }
626 last_x = -1;
627 }
628 }
629 if (last_x != -1) {
630 int h = find_dirty_height(vs, y, last_x, x);
631 send_framebuffer_update(vs, last_x * 16, y, (x - last_x) * 16, h);
632 n_rectangles++;
633 }
634 }
635 vs->output.buffer[saved_offset] = (n_rectangles >> 8) & 0xFF;
636 vs->output.buffer[saved_offset + 1] = n_rectangles & 0xFF;
637 vnc_flush(vs);
638
639 }
640
641 if (vs->csock != -1) {
642 qemu_mod_timer(vs->timer, qemu_get_clock(rt_clock) + VNC_REFRESH_INTERVAL);
643 }
644
645 }
646
647 static int vnc_listen_poll(void *opaque)
648 {
649 VncState *vs = opaque;
650 if (vs->csock == -1)
651 return 1;
652 return 0;
653 }
654
655 static void buffer_reserve(Buffer *buffer, size_t len)
656 {
657 if ((buffer->capacity - buffer->offset) < len) {
658 buffer->capacity += (len + 1024);
659 buffer->buffer = qemu_realloc(buffer->buffer, buffer->capacity);
660 if (buffer->buffer == NULL) {
661 fprintf(stderr, "vnc: out of memory\n");
662 exit(1);
663 }
664 }
665 }
666
667 static int buffer_empty(Buffer *buffer)
668 {
669 return buffer->offset == 0;
670 }
671
672 static uint8_t *buffer_end(Buffer *buffer)
673 {
674 return buffer->buffer + buffer->offset;
675 }
676
677 static void buffer_reset(Buffer *buffer)
678 {
679 buffer->offset = 0;
680 }
681
682 static void buffer_append(Buffer *buffer, const void *data, size_t len)
683 {
684 memcpy(buffer->buffer + buffer->offset, data, len);
685 buffer->offset += len;
686 }
687
688 /* audio */
689 static void audio_capture_notify(void *opaque, audcnotification_e cmd)
690 {
691 VncState *vs = opaque;
692
693 switch (cmd) {
694 case AUD_CNOTIFY_DISABLE:
695 vnc_write_u8(vs, 255);
696 vnc_write_u8(vs, 1);
697 vnc_write_u16(vs, 0);
698 vnc_flush(vs);
699 break;
700
701 case AUD_CNOTIFY_ENABLE:
702 vnc_write_u8(vs, 255);
703 vnc_write_u8(vs, 1);
704 vnc_write_u16(vs, 1);
705 vnc_flush(vs);
706 break;
707 }
708 }
709
710 static void audio_capture_destroy(void *opaque)
711 {
712 }
713
714 static void audio_capture(void *opaque, void *buf, int size)
715 {
716 VncState *vs = opaque;
717
718 vnc_write_u8(vs, 255);
719 vnc_write_u8(vs, 1);
720 vnc_write_u16(vs, 2);
721 vnc_write_u32(vs, size);
722 vnc_write(vs, buf, size);
723 vnc_flush(vs);
724 }
725
726 static void audio_add(VncState *vs)
727 {
728 struct audio_capture_ops ops;
729
730 if (vs->audio_cap) {
731 term_printf ("audio already running\n");
732 return;
733 }
734
735 ops.notify = audio_capture_notify;
736 ops.destroy = audio_capture_destroy;
737 ops.capture = audio_capture;
738
739 vs->audio_cap = AUD_add_capture(NULL, &vs->as, &ops, vs);
740 if (!vs->audio_cap) {
741 term_printf ("Failed to add audio capture\n");
742 }
743 }
744
745 static void audio_del(VncState *vs)
746 {
747 if (vs->audio_cap) {
748 AUD_del_capture(vs->audio_cap, vs);
749 vs->audio_cap = NULL;
750 }
751 }
752
753 static int vnc_client_io_error(VncState *vs, int ret, int last_errno)
754 {
755 if (ret == 0 || ret == -1) {
756 if (ret == -1) {
757 switch (last_errno) {
758 case EINTR:
759 case EAGAIN:
760 #ifdef _WIN32
761 case WSAEWOULDBLOCK:
762 #endif
763 return 0;
764 default:
765 break;
766 }
767 }
768
769 VNC_DEBUG("Closing down client sock %d %d\n", ret, ret < 0 ? last_errno : 0);
770 qemu_set_fd_handler2(vs->csock, NULL, NULL, NULL, NULL);
771 closesocket(vs->csock);
772 vs->csock = -1;
773 vs->ds->idle = 1;
774 buffer_reset(&vs->input);
775 buffer_reset(&vs->output);
776 vs->need_update = 0;
777 #ifdef CONFIG_VNC_TLS
778 if (vs->tls_session) {
779 gnutls_deinit(vs->tls_session);
780 vs->tls_session = NULL;
781 }
782 vs->wiremode = VNC_WIREMODE_CLEAR;
783 #endif /* CONFIG_VNC_TLS */
784 audio_del(vs);
785 return 0;
786 }
787 return ret;
788 }
789
790 static void vnc_client_error(VncState *vs)
791 {
792 vnc_client_io_error(vs, -1, EINVAL);
793 }
794
795 static void vnc_client_write(void *opaque)
796 {
797 long ret;
798 VncState *vs = opaque;
799
800 #ifdef CONFIG_VNC_TLS
801 if (vs->tls_session) {
802 ret = gnutls_write(vs->tls_session, vs->output.buffer, vs->output.offset);
803 if (ret < 0) {
804 if (ret == GNUTLS_E_AGAIN)
805 errno = EAGAIN;
806 else
807 errno = EIO;
808 ret = -1;
809 }
810 } else
811 #endif /* CONFIG_VNC_TLS */
812 ret = send(vs->csock, vs->output.buffer, vs->output.offset, 0);
813 ret = vnc_client_io_error(vs, ret, socket_error());
814 if (!ret)
815 return;
816
817 memmove(vs->output.buffer, vs->output.buffer + ret, (vs->output.offset - ret));
818 vs->output.offset -= ret;
819
820 if (vs->output.offset == 0) {
821 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
822 }
823 }
824
825 static void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting)
826 {
827 vs->read_handler = func;
828 vs->read_handler_expect = expecting;
829 }
830
831 static void vnc_client_read(void *opaque)
832 {
833 VncState *vs = opaque;
834 long ret;
835
836 buffer_reserve(&vs->input, 4096);
837
838 #ifdef CONFIG_VNC_TLS
839 if (vs->tls_session) {
840 ret = gnutls_read(vs->tls_session, buffer_end(&vs->input), 4096);
841 if (ret < 0) {
842 if (ret == GNUTLS_E_AGAIN)
843 errno = EAGAIN;
844 else
845 errno = EIO;
846 ret = -1;
847 }
848 } else
849 #endif /* CONFIG_VNC_TLS */
850 ret = recv(vs->csock, buffer_end(&vs->input), 4096, 0);
851 ret = vnc_client_io_error(vs, ret, socket_error());
852 if (!ret)
853 return;
854
855 vs->input.offset += ret;
856
857 while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) {
858 size_t len = vs->read_handler_expect;
859 int ret;
860
861 ret = vs->read_handler(vs, vs->input.buffer, len);
862 if (vs->csock == -1)
863 return;
864
865 if (!ret) {
866 memmove(vs->input.buffer, vs->input.buffer + len, (vs->input.offset - len));
867 vs->input.offset -= len;
868 } else {
869 vs->read_handler_expect = ret;
870 }
871 }
872 }
873
874 static void vnc_write(VncState *vs, const void *data, size_t len)
875 {
876 buffer_reserve(&vs->output, len);
877
878 if (buffer_empty(&vs->output)) {
879 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, vnc_client_write, vs);
880 }
881
882 buffer_append(&vs->output, data, len);
883 }
884
885 static void vnc_write_s32(VncState *vs, int32_t value)
886 {
887 vnc_write_u32(vs, *(uint32_t *)&value);
888 }
889
890 static void vnc_write_u32(VncState *vs, uint32_t value)
891 {
892 uint8_t buf[4];
893
894 buf[0] = (value >> 24) & 0xFF;
895 buf[1] = (value >> 16) & 0xFF;
896 buf[2] = (value >> 8) & 0xFF;
897 buf[3] = value & 0xFF;
898
899 vnc_write(vs, buf, 4);
900 }
901
902 static void vnc_write_u16(VncState *vs, uint16_t value)
903 {
904 uint8_t buf[2];
905
906 buf[0] = (value >> 8) & 0xFF;
907 buf[1] = value & 0xFF;
908
909 vnc_write(vs, buf, 2);
910 }
911
912 static void vnc_write_u8(VncState *vs, uint8_t value)
913 {
914 vnc_write(vs, (char *)&value, 1);
915 }
916
917 static void vnc_flush(VncState *vs)
918 {
919 if (vs->output.offset)
920 vnc_client_write(vs);
921 }
922
923 static uint8_t read_u8(uint8_t *data, size_t offset)
924 {
925 return data[offset];
926 }
927
928 static uint16_t read_u16(uint8_t *data, size_t offset)
929 {
930 return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF);
931 }
932
933 static int32_t read_s32(uint8_t *data, size_t offset)
934 {
935 return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) |
936 (data[offset + 2] << 8) | data[offset + 3]);
937 }
938
939 static uint32_t read_u32(uint8_t *data, size_t offset)
940 {
941 return ((data[offset] << 24) | (data[offset + 1] << 16) |
942 (data[offset + 2] << 8) | data[offset + 3]);
943 }
944
945 #ifdef CONFIG_VNC_TLS
946 static ssize_t vnc_tls_push(gnutls_transport_ptr_t transport,
947 const void *data,
948 size_t len) {
949 struct VncState *vs = (struct VncState *)transport;
950 int ret;
951
952 retry:
953 ret = send(vs->csock, data, len, 0);
954 if (ret < 0) {
955 if (errno == EINTR)
956 goto retry;
957 return -1;
958 }
959 return ret;
960 }
961
962
963 static ssize_t vnc_tls_pull(gnutls_transport_ptr_t transport,
964 void *data,
965 size_t len) {
966 struct VncState *vs = (struct VncState *)transport;
967 int ret;
968
969 retry:
970 ret = recv(vs->csock, data, len, 0);
971 if (ret < 0) {
972 if (errno == EINTR)
973 goto retry;
974 return -1;
975 }
976 return ret;
977 }
978 #endif /* CONFIG_VNC_TLS */
979
980 static void client_cut_text(VncState *vs, size_t len, uint8_t *text)
981 {
982 }
983
984 static void check_pointer_type_change(VncState *vs, int absolute)
985 {
986 if (vs->has_pointer_type_change && vs->absolute != absolute) {
987 vnc_write_u8(vs, 0);
988 vnc_write_u8(vs, 0);
989 vnc_write_u16(vs, 1);
990 vnc_framebuffer_update(vs, absolute, 0,
991 ds_get_width(vs->ds), ds_get_height(vs->ds), -257);
992 vnc_flush(vs);
993 }
994 vs->absolute = absolute;
995 }
996
997 static void pointer_event(VncState *vs, int button_mask, int x, int y)
998 {
999 int buttons = 0;
1000 int dz = 0;
1001
1002 if (button_mask & 0x01)
1003 buttons |= MOUSE_EVENT_LBUTTON;
1004 if (button_mask & 0x02)
1005 buttons |= MOUSE_EVENT_MBUTTON;
1006 if (button_mask & 0x04)
1007 buttons |= MOUSE_EVENT_RBUTTON;
1008 if (button_mask & 0x08)
1009 dz = -1;
1010 if (button_mask & 0x10)
1011 dz = 1;
1012
1013 if (vs->absolute) {
1014 kbd_mouse_event(x * 0x7FFF / (ds_get_width(vs->ds) - 1),
1015 y * 0x7FFF / (ds_get_height(vs->ds) - 1),
1016 dz, buttons);
1017 } else if (vs->has_pointer_type_change) {
1018 x -= 0x7FFF;
1019 y -= 0x7FFF;
1020
1021 kbd_mouse_event(x, y, dz, buttons);
1022 } else {
1023 if (vs->last_x != -1)
1024 kbd_mouse_event(x - vs->last_x,
1025 y - vs->last_y,
1026 dz, buttons);
1027 vs->last_x = x;
1028 vs->last_y = y;
1029 }
1030
1031 check_pointer_type_change(vs, kbd_mouse_is_absolute());
1032 }
1033
1034 static void reset_keys(VncState *vs)
1035 {
1036 int i;
1037 for(i = 0; i < 256; i++) {
1038 if (vs->modifiers_state[i]) {
1039 if (i & 0x80)
1040 kbd_put_keycode(0xe0);
1041 kbd_put_keycode(i | 0x80);
1042 vs->modifiers_state[i] = 0;
1043 }
1044 }
1045 }
1046
1047 static void press_key(VncState *vs, int keysym)
1048 {
1049 kbd_put_keycode(keysym2scancode(vs->kbd_layout, keysym) & 0x7f);
1050 kbd_put_keycode(keysym2scancode(vs->kbd_layout, keysym) | 0x80);
1051 }
1052
1053 static void do_key_event(VncState *vs, int down, int keycode, int sym)
1054 {
1055 /* QEMU console switch */
1056 switch(keycode) {
1057 case 0x2a: /* Left Shift */
1058 case 0x36: /* Right Shift */
1059 case 0x1d: /* Left CTRL */
1060 case 0x9d: /* Right CTRL */
1061 case 0x38: /* Left ALT */
1062 case 0xb8: /* Right ALT */
1063 if (down)
1064 vs->modifiers_state[keycode] = 1;
1065 else
1066 vs->modifiers_state[keycode] = 0;
1067 break;
1068 case 0x02 ... 0x0a: /* '1' to '9' keys */
1069 if (down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) {
1070 /* Reset the modifiers sent to the current console */
1071 reset_keys(vs);
1072 console_select(keycode - 0x02);
1073 return;
1074 }
1075 break;
1076 case 0x3a: /* CapsLock */
1077 case 0x45: /* NumLock */
1078 if (!down)
1079 vs->modifiers_state[keycode] ^= 1;
1080 break;
1081 }
1082
1083 if (keycode_is_keypad(vs->kbd_layout, keycode)) {
1084 /* If the numlock state needs to change then simulate an additional
1085 keypress before sending this one. This will happen if the user
1086 toggles numlock away from the VNC window.
1087 */
1088 if (keysym_is_numlock(vs->kbd_layout, sym & 0xFFFF)) {
1089 if (!vs->modifiers_state[0x45]) {
1090 vs->modifiers_state[0x45] = 1;
1091 press_key(vs, 0xff7f);
1092 }
1093 } else {
1094 if (vs->modifiers_state[0x45]) {
1095 vs->modifiers_state[0x45] = 0;
1096 press_key(vs, 0xff7f);
1097 }
1098 }
1099 }
1100
1101 if (is_graphic_console()) {
1102 if (keycode & 0x80)
1103 kbd_put_keycode(0xe0);
1104 if (down)
1105 kbd_put_keycode(keycode & 0x7f);
1106 else
1107 kbd_put_keycode(keycode | 0x80);
1108 } else {
1109 /* QEMU console emulation */
1110 if (down) {
1111 switch (keycode) {
1112 case 0x2a: /* Left Shift */
1113 case 0x36: /* Right Shift */
1114 case 0x1d: /* Left CTRL */
1115 case 0x9d: /* Right CTRL */
1116 case 0x38: /* Left ALT */
1117 case 0xb8: /* Right ALT */
1118 break;
1119 case 0xc8:
1120 kbd_put_keysym(QEMU_KEY_UP);
1121 break;
1122 case 0xd0:
1123 kbd_put_keysym(QEMU_KEY_DOWN);
1124 break;
1125 case 0xcb:
1126 kbd_put_keysym(QEMU_KEY_LEFT);
1127 break;
1128 case 0xcd:
1129 kbd_put_keysym(QEMU_KEY_RIGHT);
1130 break;
1131 case 0xd3:
1132 kbd_put_keysym(QEMU_KEY_DELETE);
1133 break;
1134 case 0xc7:
1135 kbd_put_keysym(QEMU_KEY_HOME);
1136 break;
1137 case 0xcf:
1138 kbd_put_keysym(QEMU_KEY_END);
1139 break;
1140 case 0xc9:
1141 kbd_put_keysym(QEMU_KEY_PAGEUP);
1142 break;
1143 case 0xd1:
1144 kbd_put_keysym(QEMU_KEY_PAGEDOWN);
1145 break;
1146 default:
1147 kbd_put_keysym(sym);
1148 break;
1149 }
1150 }
1151 }
1152 }
1153
1154 static void key_event(VncState *vs, int down, uint32_t sym)
1155 {
1156 int keycode;
1157
1158 if (sym >= 'A' && sym <= 'Z' && is_graphic_console())
1159 sym = sym - 'A' + 'a';
1160
1161 keycode = keysym2scancode(vs->kbd_layout, sym & 0xFFFF);
1162 do_key_event(vs, down, keycode, sym);
1163 }
1164
1165 static void ext_key_event(VncState *vs, int down,
1166 uint32_t sym, uint16_t keycode)
1167 {
1168 /* if the user specifies a keyboard layout, always use it */
1169 if (keyboard_layout)
1170 key_event(vs, down, sym);
1171 else
1172 do_key_event(vs, down, keycode, sym);
1173 }
1174
1175 static void framebuffer_update_request(VncState *vs, int incremental,
1176 int x_position, int y_position,
1177 int w, int h)
1178 {
1179 if (x_position > ds_get_width(vs->ds))
1180 x_position = ds_get_width(vs->ds);
1181 if (y_position > ds_get_height(vs->ds))
1182 y_position = ds_get_height(vs->ds);
1183 if (x_position + w >= ds_get_width(vs->ds))
1184 w = ds_get_width(vs->ds) - x_position;
1185 if (y_position + h >= ds_get_height(vs->ds))
1186 h = ds_get_height(vs->ds) - y_position;
1187
1188 int i;
1189 vs->need_update = 1;
1190 if (!incremental) {
1191 char *old_row = vs->old_data + y_position * ds_get_linesize(vs->ds);
1192
1193 for (i = 0; i < h; i++) {
1194 vnc_set_bits(vs->dirty_row[y_position + i],
1195 (ds_get_width(vs->ds) / 16), VNC_DIRTY_WORDS);
1196 memset(old_row, 42, ds_get_width(vs->ds) * vs->depth);
1197 old_row += ds_get_linesize(vs->ds);
1198 }
1199 }
1200 }
1201
1202 static void send_ext_key_event_ack(VncState *vs)
1203 {
1204 vnc_write_u8(vs, 0);
1205 vnc_write_u8(vs, 0);
1206 vnc_write_u16(vs, 1);
1207 vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds), -258);
1208 vnc_flush(vs);
1209 }
1210
1211 static void send_ext_audio_ack(VncState *vs)
1212 {
1213 vnc_write_u8(vs, 0);
1214 vnc_write_u8(vs, 0);
1215 vnc_write_u16(vs, 1);
1216 vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds), -259);
1217 vnc_flush(vs);
1218 }
1219
1220 static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
1221 {
1222 int i;
1223
1224 vs->has_hextile = 0;
1225 vs->has_resize = 0;
1226 vs->has_pointer_type_change = 0;
1227 vs->has_WMVi = 0;
1228 vs->absolute = -1;
1229 vs->ds->dpy_copy = NULL;
1230
1231 for (i = n_encodings - 1; i >= 0; i--) {
1232 switch (encodings[i]) {
1233 case 0: /* Raw */
1234 vs->has_hextile = 0;
1235 break;
1236 case 1: /* CopyRect */
1237 vs->ds->dpy_copy = vnc_copy;
1238 break;
1239 case 5: /* Hextile */
1240 vs->has_hextile = 1;
1241 break;
1242 case -223: /* DesktopResize */
1243 vs->has_resize = 1;
1244 break;
1245 case -257:
1246 vs->has_pointer_type_change = 1;
1247 break;
1248 case -258:
1249 send_ext_key_event_ack(vs);
1250 break;
1251 case -259:
1252 send_ext_audio_ack(vs);
1253 break;
1254 case 0x574D5669:
1255 vs->has_WMVi = 1;
1256 break;
1257 default:
1258 break;
1259 }
1260 }
1261
1262 check_pointer_type_change(vs, kbd_mouse_is_absolute());
1263 }
1264
1265 static void set_pixel_format(VncState *vs,
1266 int bits_per_pixel, int depth,
1267 int big_endian_flag, int true_color_flag,
1268 int red_max, int green_max, int blue_max,
1269 int red_shift, int green_shift, int blue_shift)
1270 {
1271 int host_big_endian_flag;
1272
1273 #ifdef WORDS_BIGENDIAN
1274 host_big_endian_flag = 1;
1275 #else
1276 host_big_endian_flag = 0;
1277 #endif
1278 if (!true_color_flag) {
1279 fail:
1280 vnc_client_error(vs);
1281 return;
1282 }
1283 if (bits_per_pixel == 32 &&
1284 bits_per_pixel == vs->depth * 8 &&
1285 host_big_endian_flag == big_endian_flag &&
1286 red_max == 0xff && green_max == 0xff && blue_max == 0xff &&
1287 red_shift == 16 && green_shift == 8 && blue_shift == 0) {
1288 vs->depth = 4;
1289 vs->write_pixels = vnc_write_pixels_copy;
1290 vs->send_hextile_tile = send_hextile_tile_32;
1291 } else
1292 if (bits_per_pixel == 16 &&
1293 bits_per_pixel == vs->depth * 8 &&
1294 host_big_endian_flag == big_endian_flag &&
1295 red_max == 31 && green_max == 63 && blue_max == 31 &&
1296 red_shift == 11 && green_shift == 5 && blue_shift == 0) {
1297 vs->depth = 2;
1298 vs->write_pixels = vnc_write_pixels_copy;
1299 vs->send_hextile_tile = send_hextile_tile_16;
1300 } else
1301 if (bits_per_pixel == 8 &&
1302 bits_per_pixel == vs->depth * 8 &&
1303 red_max == 7 && green_max == 7 && blue_max == 3 &&
1304 red_shift == 5 && green_shift == 2 && blue_shift == 0) {
1305 vs->depth = 1;
1306 vs->write_pixels = vnc_write_pixels_copy;
1307 vs->send_hextile_tile = send_hextile_tile_8;
1308 } else
1309 {
1310 /* generic and slower case */
1311 if (bits_per_pixel != 8 &&
1312 bits_per_pixel != 16 &&
1313 bits_per_pixel != 32)
1314 goto fail;
1315 if (vs->depth == 4) {
1316 vs->send_hextile_tile = send_hextile_tile_generic_32;
1317 } else if (vs->depth == 2) {
1318 vs->send_hextile_tile = send_hextile_tile_generic_16;
1319 } else {
1320 vs->send_hextile_tile = send_hextile_tile_generic_8;
1321 }
1322
1323 vs->pix_big_endian = big_endian_flag;
1324 vs->write_pixels = vnc_write_pixels_generic;
1325 }
1326
1327 vs->client_red_shift = red_shift;
1328 vs->client_red_max = red_max;
1329 vs->client_green_shift = green_shift;
1330 vs->client_green_max = green_max;
1331 vs->client_blue_shift = blue_shift;
1332 vs->client_blue_max = blue_max;
1333 vs->pix_bpp = bits_per_pixel / 8;
1334
1335 vga_hw_invalidate();
1336 vga_hw_update();
1337 }
1338
1339 static void pixel_format_message (VncState *vs) {
1340 char pad[3] = { 0, 0, 0 };
1341
1342 vnc_write_u8(vs, vs->depth * 8); /* bits-per-pixel */
1343 if (vs->depth == 4) vnc_write_u8(vs, 24); /* depth */
1344 else vnc_write_u8(vs, vs->depth * 8); /* depth */
1345
1346 #ifdef WORDS_BIGENDIAN
1347 vnc_write_u8(vs, 1); /* big-endian-flag */
1348 #else
1349 vnc_write_u8(vs, 0); /* big-endian-flag */
1350 #endif
1351 vnc_write_u8(vs, 1); /* true-color-flag */
1352 if (vs->depth == 4) {
1353 vnc_write_u16(vs, 0xFF); /* red-max */
1354 vnc_write_u16(vs, 0xFF); /* green-max */
1355 vnc_write_u16(vs, 0xFF); /* blue-max */
1356 vnc_write_u8(vs, 16); /* red-shift */
1357 vnc_write_u8(vs, 8); /* green-shift */
1358 vnc_write_u8(vs, 0); /* blue-shift */
1359 vs->send_hextile_tile = send_hextile_tile_32;
1360 } else if (vs->depth == 2) {
1361 vnc_write_u16(vs, 31); /* red-max */
1362 vnc_write_u16(vs, 63); /* green-max */
1363 vnc_write_u16(vs, 31); /* blue-max */
1364 vnc_write_u8(vs, 11); /* red-shift */
1365 vnc_write_u8(vs, 5); /* green-shift */
1366 vnc_write_u8(vs, 0); /* blue-shift */
1367 vs->send_hextile_tile = send_hextile_tile_16;
1368 } else if (vs->depth == 1) {
1369 /* XXX: change QEMU pixel 8 bit pixel format to match the VNC one ? */
1370 vnc_write_u16(vs, 7); /* red-max */
1371 vnc_write_u16(vs, 7); /* green-max */
1372 vnc_write_u16(vs, 3); /* blue-max */
1373 vnc_write_u8(vs, 5); /* red-shift */
1374 vnc_write_u8(vs, 2); /* green-shift */
1375 vnc_write_u8(vs, 0); /* blue-shift */
1376 vs->send_hextile_tile = send_hextile_tile_8;
1377 }
1378 vs->client_red_max = vs->server_red_max;
1379 vs->client_green_max = vs->server_green_max;
1380 vs->client_blue_max = vs->server_blue_max;
1381 vs->client_red_shift = vs->server_red_shift;
1382 vs->client_green_shift = vs->server_green_shift;
1383 vs->client_blue_shift = vs->server_blue_shift;
1384 vs->pix_bpp = vs->depth * 8;
1385 vs->write_pixels = vnc_write_pixels_copy;
1386
1387 vnc_write(vs, pad, 3); /* padding */
1388 }
1389
1390 static void vnc_colordepth(DisplayState *ds, int depth)
1391 {
1392 int host_big_endian_flag;
1393 struct VncState *vs = ds->opaque;
1394
1395 switch (depth) {
1396 case 24:
1397 if (ds->depth == 32) return;
1398 depth = 32;
1399 break;
1400 case 15:
1401 case 8:
1402 case 0:
1403 return;
1404 default:
1405 break;
1406 }
1407
1408 #ifdef WORDS_BIGENDIAN
1409 host_big_endian_flag = 1;
1410 #else
1411 host_big_endian_flag = 0;
1412 #endif
1413
1414 switch (depth) {
1415 case 8:
1416 vs->depth = depth / 8;
1417 vs->server_red_max = 7;
1418 vs->server_green_max = 7;
1419 vs->server_blue_max = 3;
1420 vs->server_red_shift = 5;
1421 vs->server_green_shift = 2;
1422 vs->server_blue_shift = 0;
1423 break;
1424 case 16:
1425 vs->depth = depth / 8;
1426 vs->server_red_max = 31;
1427 vs->server_green_max = 63;
1428 vs->server_blue_max = 31;
1429 vs->server_red_shift = 11;
1430 vs->server_green_shift = 5;
1431 vs->server_blue_shift = 0;
1432 break;
1433 case 32:
1434 vs->depth = 4;
1435 vs->server_red_max = 255;
1436 vs->server_green_max = 255;
1437 vs->server_blue_max = 255;
1438 vs->server_red_shift = 16;
1439 vs->server_green_shift = 8;
1440 vs->server_blue_shift = 0;
1441 break;
1442 default:
1443 return;
1444 }
1445
1446 if (vs->csock != -1 && vs->has_WMVi) {
1447 /* Sending a WMVi message to notify the client*/
1448 vnc_write_u8(vs, 0); /* msg id */
1449 vnc_write_u8(vs, 0);
1450 vnc_write_u16(vs, 1); /* number of rects */
1451 vnc_framebuffer_update(vs, 0, 0, ds->width, ds->height, 0x574D5669);
1452 pixel_format_message(vs);
1453 vnc_flush(vs);
1454 } else {
1455 if (vs->pix_bpp == 4 && vs->depth == 4 &&
1456 host_big_endian_flag == vs->pix_big_endian &&
1457 vs->client_red_max == 0xff && vs->client_green_max == 0xff && vs->client_blue_max == 0xff &&
1458 vs->client_red_shift == 16 && vs->client_green_shift == 8 && vs->client_blue_shift == 0) {
1459 vs->write_pixels = vnc_write_pixels_copy;
1460 vs->send_hextile_tile = send_hextile_tile_32;
1461 } else if (vs->pix_bpp == 2 && vs->depth == 2 &&
1462 host_big_endian_flag == vs->pix_big_endian &&
1463 vs->client_red_max == 31 && vs->client_green_max == 63 && vs->client_blue_max == 31 &&
1464 vs->client_red_shift == 11 && vs->client_green_shift == 5 && vs->client_blue_shift == 0) {
1465 vs->write_pixels = vnc_write_pixels_copy;
1466 vs->send_hextile_tile = send_hextile_tile_16;
1467 } else if (vs->pix_bpp == 1 && vs->depth == 1 &&
1468 host_big_endian_flag == vs->pix_big_endian &&
1469 vs->client_red_max == 7 && vs->client_green_max == 7 && vs->client_blue_max == 3 &&
1470 vs->client_red_shift == 5 && vs->client_green_shift == 2 && vs->client_blue_shift == 0) {
1471 vs->write_pixels = vnc_write_pixels_copy;
1472 vs->send_hextile_tile = send_hextile_tile_8;
1473 } else {
1474 if (vs->depth == 4) {
1475 vs->send_hextile_tile = send_hextile_tile_generic_32;
1476 } else if (vs->depth == 2) {
1477 vs->send_hextile_tile = send_hextile_tile_generic_16;
1478 } else {
1479 vs->send_hextile_tile = send_hextile_tile_generic_8;
1480 }
1481 vs->write_pixels = vnc_write_pixels_generic;
1482 }
1483 }
1484 }
1485
1486 static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
1487 {
1488 int i;
1489 uint16_t limit;
1490
1491 switch (data[0]) {
1492 case 0:
1493 if (len == 1)
1494 return 20;
1495
1496 set_pixel_format(vs, read_u8(data, 4), read_u8(data, 5),
1497 read_u8(data, 6), read_u8(data, 7),
1498 read_u16(data, 8), read_u16(data, 10),
1499 read_u16(data, 12), read_u8(data, 14),
1500 read_u8(data, 15), read_u8(data, 16));
1501 break;
1502 case 2:
1503 if (len == 1)
1504 return 4;
1505
1506 if (len == 4)
1507 return 4 + (read_u16(data, 2) * 4);
1508
1509 limit = read_u16(data, 2);
1510 for (i = 0; i < limit; i++) {
1511 int32_t val = read_s32(data, 4 + (i * 4));
1512 memcpy(data + 4 + (i * 4), &val, sizeof(val));
1513 }
1514
1515 set_encodings(vs, (int32_t *)(data + 4), limit);
1516 break;
1517 case 3:
1518 if (len == 1)
1519 return 10;
1520
1521 framebuffer_update_request(vs,
1522 read_u8(data, 1), read_u16(data, 2), read_u16(data, 4),
1523 read_u16(data, 6), read_u16(data, 8));
1524 break;
1525 case 4:
1526 if (len == 1)
1527 return 8;
1528
1529 key_event(vs, read_u8(data, 1), read_u32(data, 4));
1530 break;
1531 case 5:
1532 if (len == 1)
1533 return 6;
1534
1535 pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
1536 break;
1537 case 6:
1538 if (len == 1)
1539 return 8;
1540
1541 if (len == 8) {
1542 uint32_t dlen = read_u32(data, 4);
1543 if (dlen > 0)
1544 return 8 + dlen;
1545 }
1546
1547 client_cut_text(vs, read_u32(data, 4), data + 8);
1548 break;
1549 case 255:
1550 if (len == 1)
1551 return 2;
1552
1553 switch (read_u8(data, 1)) {
1554 case 0:
1555 if (len == 2)
1556 return 12;
1557
1558 ext_key_event(vs, read_u16(data, 2),
1559 read_u32(data, 4), read_u32(data, 8));
1560 break;
1561 case 1:
1562 if (len == 2)
1563 return 4;
1564
1565 switch (read_u16 (data, 2)) {
1566 case 0:
1567 audio_add(vs);
1568 break;
1569 case 1:
1570 audio_del(vs);
1571 break;
1572 case 2:
1573 if (len == 4)
1574 return 10;
1575 switch (read_u8(data, 4)) {
1576 case 0: vs->as.fmt = AUD_FMT_U8; break;
1577 case 1: vs->as.fmt = AUD_FMT_S8; break;
1578 case 2: vs->as.fmt = AUD_FMT_U16; break;
1579 case 3: vs->as.fmt = AUD_FMT_S16; break;
1580 case 4: vs->as.fmt = AUD_FMT_U32; break;
1581 case 5: vs->as.fmt = AUD_FMT_S32; break;
1582 default:
1583 printf("Invalid audio format %d\n", read_u8(data, 4));
1584 vnc_client_error(vs);
1585 break;
1586 }
1587 vs->as.nchannels = read_u8(data, 5);
1588 if (vs->as.nchannels != 1 && vs->as.nchannels != 2) {
1589 printf("Invalid audio channel coount %d\n",
1590 read_u8(data, 5));
1591 vnc_client_error(vs);
1592 break;
1593 }
1594 vs->as.freq = read_u32(data, 6);
1595 break;
1596 default:
1597 printf ("Invalid audio message %d\n", read_u8(data, 4));
1598 vnc_client_error(vs);
1599 break;
1600 }
1601 break;
1602
1603 default:
1604 printf("Msg: %d\n", read_u16(data, 0));
1605 vnc_client_error(vs);
1606 break;
1607 }
1608 break;
1609 default:
1610 printf("Msg: %d\n", data[0]);
1611 vnc_client_error(vs);
1612 break;
1613 }
1614
1615 vnc_read_when(vs, protocol_client_msg, 1);
1616 return 0;
1617 }
1618
1619 static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
1620 {
1621 char buf[1024];
1622 int size;
1623
1624 vs->width = ds_get_width(vs->ds);
1625 vs->height = ds_get_height(vs->ds);
1626 vnc_write_u16(vs, ds_get_width(vs->ds));
1627 vnc_write_u16(vs, ds_get_height(vs->ds));
1628
1629 pixel_format_message(vs);
1630
1631 if (qemu_name)
1632 size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
1633 else
1634 size = snprintf(buf, sizeof(buf), "QEMU");
1635
1636 vnc_write_u32(vs, size);
1637 vnc_write(vs, buf, size);
1638 vnc_flush(vs);
1639
1640 vnc_read_when(vs, protocol_client_msg, 1);
1641
1642 return 0;
1643 }
1644
1645 static void make_challenge(VncState *vs)
1646 {
1647 int i;
1648
1649 srand(time(NULL)+getpid()+getpid()*987654+rand());
1650
1651 for (i = 0 ; i < sizeof(vs->challenge) ; i++)
1652 vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
1653 }
1654
1655 static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
1656 {
1657 unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
1658 int i, j, pwlen;
1659 unsigned char key[8];
1660
1661 if (!vs->password || !vs->password[0]) {
1662 VNC_DEBUG("No password configured on server");
1663 vnc_write_u32(vs, 1); /* Reject auth */
1664 if (vs->minor >= 8) {
1665 static const char err[] = "Authentication failed";
1666 vnc_write_u32(vs, sizeof(err));
1667 vnc_write(vs, err, sizeof(err));
1668 }
1669 vnc_flush(vs);
1670 vnc_client_error(vs);
1671 return 0;
1672 }
1673
1674 memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
1675
1676 /* Calculate the expected challenge response */
1677 pwlen = strlen(vs->password);
1678 for (i=0; i<sizeof(key); i++)
1679 key[i] = i<pwlen ? vs->password[i] : 0;
1680 deskey(key, EN0);
1681 for (j = 0; j < VNC_AUTH_CHALLENGE_SIZE; j += 8)
1682 des(response+j, response+j);
1683
1684 /* Compare expected vs actual challenge response */
1685 if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) {
1686 VNC_DEBUG("Client challenge reponse did not match\n");
1687 vnc_write_u32(vs, 1); /* Reject auth */
1688 if (vs->minor >= 8) {
1689 static const char err[] = "Authentication failed";
1690 vnc_write_u32(vs, sizeof(err));
1691 vnc_write(vs, err, sizeof(err));
1692 }
1693 vnc_flush(vs);
1694 vnc_client_error(vs);
1695 } else {
1696 VNC_DEBUG("Accepting VNC challenge response\n");
1697 vnc_write_u32(vs, 0); /* Accept auth */
1698 vnc_flush(vs);
1699
1700 vnc_read_when(vs, protocol_client_init, 1);
1701 }
1702 return 0;
1703 }
1704
1705 static int start_auth_vnc(VncState *vs)
1706 {
1707 make_challenge(vs);
1708 /* Send client a 'random' challenge */
1709 vnc_write(vs, vs->challenge, sizeof(vs->challenge));
1710 vnc_flush(vs);
1711
1712 vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge));
1713 return 0;
1714 }
1715
1716
1717 #ifdef CONFIG_VNC_TLS
1718 #define DH_BITS 1024
1719 static gnutls_dh_params_t dh_params;
1720
1721 static int vnc_tls_initialize(void)
1722 {
1723 static int tlsinitialized = 0;
1724
1725 if (tlsinitialized)
1726 return 1;
1727
1728 if (gnutls_global_init () < 0)
1729 return 0;
1730
1731 /* XXX ought to re-generate diffie-hellmen params periodically */
1732 if (gnutls_dh_params_init (&dh_params) < 0)
1733 return 0;
1734 if (gnutls_dh_params_generate2 (dh_params, DH_BITS) < 0)
1735 return 0;
1736
1737 #if defined(_VNC_DEBUG) && _VNC_DEBUG >= 2
1738 gnutls_global_set_log_level(10);
1739 gnutls_global_set_log_function(vnc_debug_gnutls_log);
1740 #endif
1741
1742 tlsinitialized = 1;
1743
1744 return 1;
1745 }
1746
1747 static gnutls_anon_server_credentials vnc_tls_initialize_anon_cred(void)
1748 {
1749 gnutls_anon_server_credentials anon_cred;
1750 int ret;
1751
1752 if ((ret = gnutls_anon_allocate_server_credentials(&anon_cred)) < 0) {
1753 VNC_DEBUG("Cannot allocate credentials %s\n", gnutls_strerror(ret));
1754 return NULL;
1755 }
1756
1757 gnutls_anon_set_server_dh_params(anon_cred, dh_params);
1758
1759 return anon_cred;
1760 }
1761
1762
1763 static gnutls_certificate_credentials_t vnc_tls_initialize_x509_cred(VncState *vs)
1764 {
1765 gnutls_certificate_credentials_t x509_cred;
1766 int ret;
1767
1768 if (!vs->x509cacert) {
1769 VNC_DEBUG("No CA x509 certificate specified\n");
1770 return NULL;
1771 }
1772 if (!vs->x509cert) {
1773 VNC_DEBUG("No server x509 certificate specified\n");
1774 return NULL;
1775 }
1776 if (!vs->x509key) {
1777 VNC_DEBUG("No server private key specified\n");
1778 return NULL;
1779 }
1780
1781 if ((ret = gnutls_certificate_allocate_credentials(&x509_cred)) < 0) {
1782 VNC_DEBUG("Cannot allocate credentials %s\n", gnutls_strerror(ret));
1783 return NULL;
1784 }
1785 if ((ret = gnutls_certificate_set_x509_trust_file(x509_cred,
1786 vs->x509cacert,
1787 GNUTLS_X509_FMT_PEM)) < 0) {
1788 VNC_DEBUG("Cannot load CA certificate %s\n", gnutls_strerror(ret));
1789 gnutls_certificate_free_credentials(x509_cred);
1790 return NULL;
1791 }
1792
1793 if ((ret = gnutls_certificate_set_x509_key_file (x509_cred,
1794 vs->x509cert,
1795 vs->x509key,
1796 GNUTLS_X509_FMT_PEM)) < 0) {
1797 VNC_DEBUG("Cannot load certificate & key %s\n", gnutls_strerror(ret));
1798 gnutls_certificate_free_credentials(x509_cred);
1799 return NULL;
1800 }
1801
1802 if (vs->x509cacrl) {
1803 if ((ret = gnutls_certificate_set_x509_crl_file(x509_cred,
1804 vs->x509cacrl,
1805 GNUTLS_X509_FMT_PEM)) < 0) {
1806 VNC_DEBUG("Cannot load CRL %s\n", gnutls_strerror(ret));
1807 gnutls_certificate_free_credentials(x509_cred);
1808 return NULL;
1809 }
1810 }
1811
1812 gnutls_certificate_set_dh_params (x509_cred, dh_params);
1813
1814 return x509_cred;
1815 }
1816
1817 static int vnc_validate_certificate(struct VncState *vs)
1818 {
1819 int ret;
1820 unsigned int status;
1821 const gnutls_datum_t *certs;
1822 unsigned int nCerts, i;
1823 time_t now;
1824
1825 VNC_DEBUG("Validating client certificate\n");
1826 if ((ret = gnutls_certificate_verify_peers2 (vs->tls_session, &status)) < 0) {
1827 VNC_DEBUG("Verify failed %s\n", gnutls_strerror(ret));
1828 return -1;
1829 }
1830
1831 if ((now = time(NULL)) == ((time_t)-1)) {
1832 return -1;
1833 }
1834
1835 if (status != 0) {
1836 if (status & GNUTLS_CERT_INVALID)
1837 VNC_DEBUG("The certificate is not trusted.\n");
1838
1839 if (status & GNUTLS_CERT_SIGNER_NOT_FOUND)
1840 VNC_DEBUG("The certificate hasn't got a known issuer.\n");
1841
1842 if (status & GNUTLS_CERT_REVOKED)
1843 VNC_DEBUG("The certificate has been revoked.\n");
1844
1845 if (status & GNUTLS_CERT_INSECURE_ALGORITHM)
1846 VNC_DEBUG("The certificate uses an insecure algorithm\n");
1847
1848 return -1;
1849 } else {
1850 VNC_DEBUG("Certificate is valid!\n");
1851 }
1852
1853 /* Only support x509 for now */
1854 if (gnutls_certificate_type_get(vs->tls_session) != GNUTLS_CRT_X509)
1855 return -1;
1856
1857 if (!(certs = gnutls_certificate_get_peers(vs->tls_session, &nCerts)))
1858 return -1;
1859
1860 for (i = 0 ; i < nCerts ; i++) {
1861 gnutls_x509_crt_t cert;
1862 VNC_DEBUG ("Checking certificate chain %d\n", i);
1863 if (gnutls_x509_crt_init (&cert) < 0)
1864 return -1;
1865
1866 if (gnutls_x509_crt_import(cert, &certs[i], GNUTLS_X509_FMT_DER) < 0) {
1867 gnutls_x509_crt_deinit (cert);
1868 return -1;
1869 }
1870
1871 if (gnutls_x509_crt_get_expiration_time (cert) < now) {
1872 VNC_DEBUG("The certificate has expired\n");
1873 gnutls_x509_crt_deinit (cert);
1874 return -1;
1875 }
1876
1877 if (gnutls_x509_crt_get_activation_time (cert) > now) {
1878 VNC_DEBUG("The certificate is not yet activated\n");
1879 gnutls_x509_crt_deinit (cert);
1880 return -1;
1881 }
1882
1883 if (gnutls_x509_crt_get_activation_time (cert) > now) {
1884 VNC_DEBUG("The certificate is not yet activated\n");
1885 gnutls_x509_crt_deinit (cert);
1886 return -1;
1887 }
1888
1889 gnutls_x509_crt_deinit (cert);
1890 }
1891
1892 return 0;
1893 }
1894
1895
1896 static int start_auth_vencrypt_subauth(VncState *vs)
1897 {
1898 switch (vs->subauth) {
1899 case VNC_AUTH_VENCRYPT_TLSNONE:
1900 case VNC_AUTH_VENCRYPT_X509NONE:
1901 VNC_DEBUG("Accept TLS auth none\n");
1902 vnc_write_u32(vs, 0); /* Accept auth completion */
1903 vnc_read_when(vs, protocol_client_init, 1);
1904 break;
1905
1906 case VNC_AUTH_VENCRYPT_TLSVNC:
1907 case VNC_AUTH_VENCRYPT_X509VNC:
1908 VNC_DEBUG("Start TLS auth VNC\n");
1909 return start_auth_vnc(vs);
1910
1911 default: /* Should not be possible, but just in case */
1912 VNC_DEBUG("Reject auth %d\n", vs->auth);
1913 vnc_write_u8(vs, 1);
1914 if (vs->minor >= 8) {
1915 static const char err[] = "Unsupported authentication type";
1916 vnc_write_u32(vs, sizeof(err));
1917 vnc_write(vs, err, sizeof(err));
1918 }
1919 vnc_client_error(vs);
1920 }
1921
1922 return 0;
1923 }
1924
1925 static void vnc_handshake_io(void *opaque);
1926
1927 static int vnc_continue_handshake(struct VncState *vs) {
1928 int ret;
1929
1930 if ((ret = gnutls_handshake(vs->tls_session)) < 0) {
1931 if (!gnutls_error_is_fatal(ret)) {
1932 VNC_DEBUG("Handshake interrupted (blocking)\n");
1933 if (!gnutls_record_get_direction(vs->tls_session))
1934 qemu_set_fd_handler(vs->csock, vnc_handshake_io, NULL, vs);
1935 else
1936 qemu_set_fd_handler(vs->csock, NULL, vnc_handshake_io, vs);
1937 return 0;
1938 }
1939 VNC_DEBUG("Handshake failed %s\n", gnutls_strerror(ret));
1940 vnc_client_error(vs);
1941 return -1;
1942 }
1943
1944 if (vs->x509verify) {
1945 if (vnc_validate_certificate(vs) < 0) {
1946 VNC_DEBUG("Client verification failed\n");
1947 vnc_client_error(vs);
1948 return -1;
1949 } else {
1950 VNC_DEBUG("Client verification passed\n");
1951 }
1952 }
1953
1954 VNC_DEBUG("Handshake done, switching to TLS data mode\n");
1955 vs->wiremode = VNC_WIREMODE_TLS;
1956 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, vnc_client_write, vs);
1957
1958 return start_auth_vencrypt_subauth(vs);
1959 }
1960
1961 static void vnc_handshake_io(void *opaque) {
1962 struct VncState *vs = (struct VncState *)opaque;
1963
1964 VNC_DEBUG("Handshake IO continue\n");
1965 vnc_continue_handshake(vs);
1966 }
1967
1968 #define NEED_X509_AUTH(vs) \
1969 ((vs)->subauth == VNC_AUTH_VENCRYPT_X509NONE || \
1970 (vs)->subauth == VNC_AUTH_VENCRYPT_X509VNC || \
1971 (vs)->subauth == VNC_AUTH_VENCRYPT_X509PLAIN)
1972
1973
1974 static int vnc_start_tls(struct VncState *vs) {
1975 static const int cert_type_priority[] = { GNUTLS_CRT_X509, 0 };
1976 static const int protocol_priority[]= { GNUTLS_TLS1_1, GNUTLS_TLS1_0, GNUTLS_SSL3, 0 };
1977 static const int kx_anon[] = {GNUTLS_KX_ANON_DH, 0};
1978 static const int kx_x509[] = {GNUTLS_KX_DHE_DSS, GNUTLS_KX_RSA, GNUTLS_KX_DHE_RSA, GNUTLS_KX_SRP, 0};
1979
1980 VNC_DEBUG("Do TLS setup\n");
1981 if (vnc_tls_initialize() < 0) {
1982 VNC_DEBUG("Failed to init TLS\n");
1983 vnc_client_error(vs);
1984 return -1;
1985 }
1986 if (vs->tls_session == NULL) {
1987 if (gnutls_init(&vs->tls_session, GNUTLS_SERVER) < 0) {
1988 vnc_client_error(vs);
1989 return -1;
1990 }
1991
1992 if (gnutls_set_default_priority(vs->tls_session) < 0) {
1993 gnutls_deinit(vs->tls_session);
1994 vs->tls_session = NULL;
1995 vnc_client_error(vs);
1996 return -1;
1997 }
1998
1999 if (gnutls_kx_set_priority(vs->tls_session, NEED_X509_AUTH(vs) ? kx_x509 : kx_anon) < 0) {
2000 gnutls_deinit(vs->tls_session);
2001 vs->tls_session = NULL;
2002 vnc_client_error(vs);
2003 return -1;
2004 }
2005
2006 if (gnutls_certificate_type_set_priority(vs->tls_session, cert_type_priority) < 0) {
2007 gnutls_deinit(vs->tls_session);
2008 vs->tls_session = NULL;
2009 vnc_client_error(vs);
2010 return -1;
2011 }
2012
2013 if (gnutls_protocol_set_priority(vs->tls_session, protocol_priority) < 0) {
2014 gnutls_deinit(vs->tls_session);
2015 vs->tls_session = NULL;
2016 vnc_client_error(vs);
2017 return -1;
2018 }
2019
2020 if (NEED_X509_AUTH(vs)) {
2021 gnutls_certificate_server_credentials x509_cred = vnc_tls_initialize_x509_cred(vs);
2022 if (!x509_cred) {
2023 gnutls_deinit(vs->tls_session);
2024 vs->tls_session = NULL;
2025 vnc_client_error(vs);
2026 return -1;
2027 }
2028 if (gnutls_credentials_set(vs->tls_session, GNUTLS_CRD_CERTIFICATE, x509_cred) < 0) {
2029 gnutls_deinit(vs->tls_session);
2030 vs->tls_session = NULL;
2031 gnutls_certificate_free_credentials(x509_cred);
2032 vnc_client_error(vs);
2033 return -1;
2034 }
2035 if (vs->x509verify) {
2036 VNC_DEBUG("Requesting a client certificate\n");
2037 gnutls_certificate_server_set_request (vs->tls_session, GNUTLS_CERT_REQUEST);
2038 }
2039
2040 } else {
2041 gnutls_anon_server_credentials anon_cred = vnc_tls_initialize_anon_cred();
2042 if (!anon_cred) {
2043 gnutls_deinit(vs->tls_session);
2044 vs->tls_session = NULL;
2045 vnc_client_error(vs);
2046 return -1;
2047 }
2048 if (gnutls_credentials_set(vs->tls_session, GNUTLS_CRD_ANON, anon_cred) < 0) {
2049 gnutls_deinit(vs->tls_session);
2050 vs->tls_session = NULL;
2051 gnutls_anon_free_server_credentials(anon_cred);
2052 vnc_client_error(vs);
2053 return -1;
2054 }
2055 }
2056
2057 gnutls_transport_set_ptr(vs->tls_session, (gnutls_transport_ptr_t)vs);
2058 gnutls_transport_set_push_function(vs->tls_session, vnc_tls_push);
2059 gnutls_transport_set_pull_function(vs->tls_session, vnc_tls_pull);
2060 }
2061
2062 VNC_DEBUG("Start TLS handshake process\n");
2063 return vnc_continue_handshake(vs);
2064 }
2065
2066 static int protocol_client_vencrypt_auth(VncState *vs, uint8_t *data, size_t len)
2067 {
2068 int auth = read_u32(data, 0);
2069
2070 if (auth != vs->subauth) {
2071 VNC_DEBUG("Rejecting auth %d\n", auth);
2072 vnc_write_u8(vs, 0); /* Reject auth */
2073 vnc_flush(vs);
2074 vnc_client_error(vs);
2075 } else {
2076 VNC_DEBUG("Accepting auth %d, starting handshake\n", auth);
2077 vnc_write_u8(vs, 1); /* Accept auth */
2078 vnc_flush(vs);
2079
2080 if (vnc_start_tls(vs) < 0) {
2081 VNC_DEBUG("Failed to complete TLS\n");
2082 return 0;
2083 }
2084
2085 if (vs->wiremode == VNC_WIREMODE_TLS) {
2086 VNC_DEBUG("Starting VeNCrypt subauth\n");
2087 return start_auth_vencrypt_subauth(vs);
2088 } else {
2089 VNC_DEBUG("TLS handshake blocked\n");
2090 return 0;
2091 }
2092 }
2093 return 0;
2094 }
2095
2096 static int protocol_client_vencrypt_init(VncState *vs, uint8_t *data, size_t len)
2097 {
2098 if (data[0] != 0 ||
2099 data[1] != 2) {
2100 VNC_DEBUG("Unsupported VeNCrypt protocol %d.%d\n", (int)data[0], (int)data[1]);
2101 vnc_write_u8(vs, 1); /* Reject version */
2102 vnc_flush(vs);
2103 vnc_client_error(vs);
2104 } else {
2105 VNC_DEBUG("Sending allowed auth %d\n", vs->subauth);
2106 vnc_write_u8(vs, 0); /* Accept version */
2107 vnc_write_u8(vs, 1); /* Number of sub-auths */
2108 vnc_write_u32(vs, vs->subauth); /* The supported auth */
2109 vnc_flush(vs);
2110 vnc_read_when(vs, protocol_client_vencrypt_auth, 4);
2111 }
2112 return 0;
2113 }
2114
2115 static int start_auth_vencrypt(VncState *vs)
2116 {
2117 /* Send VeNCrypt version 0.2 */
2118 vnc_write_u8(vs, 0);
2119 vnc_write_u8(vs, 2);
2120
2121 vnc_read_when(vs, protocol_client_vencrypt_init, 2);
2122 return 0;
2123 }
2124 #endif /* CONFIG_VNC_TLS */
2125
2126 static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
2127 {
2128 /* We only advertise 1 auth scheme at a time, so client
2129 * must pick the one we sent. Verify this */
2130 if (data[0] != vs->auth) { /* Reject auth */
2131 VNC_DEBUG("Reject auth %d\n", (int)data[0]);
2132 vnc_write_u32(vs, 1);
2133 if (vs->minor >= 8) {
2134 static const char err[] = "Authentication failed";
2135 vnc_write_u32(vs, sizeof(err));
2136 vnc_write(vs, err, sizeof(err));
2137 }
2138 vnc_client_error(vs);
2139 } else { /* Accept requested auth */
2140 VNC_DEBUG("Client requested auth %d\n", (int)data[0]);
2141 switch (vs->auth) {
2142 case VNC_AUTH_NONE:
2143 VNC_DEBUG("Accept auth none\n");
2144 if (vs->minor >= 8) {
2145 vnc_write_u32(vs, 0); /* Accept auth completion */
2146 vnc_flush(vs);
2147 }
2148 vnc_read_when(vs, protocol_client_init, 1);
2149 break;
2150
2151 case VNC_AUTH_VNC:
2152 VNC_DEBUG("Start VNC auth\n");
2153 return start_auth_vnc(vs);
2154
2155 #ifdef CONFIG_VNC_TLS
2156 case VNC_AUTH_VENCRYPT:
2157 VNC_DEBUG("Accept VeNCrypt auth\n");;
2158 return start_auth_vencrypt(vs);
2159 #endif /* CONFIG_VNC_TLS */
2160
2161 default: /* Should not be possible, but just in case */
2162 VNC_DEBUG("Reject auth %d\n", vs->auth);
2163 vnc_write_u8(vs, 1);
2164 if (vs->minor >= 8) {
2165 static const char err[] = "Authentication failed";
2166 vnc_write_u32(vs, sizeof(err));
2167 vnc_write(vs, err, sizeof(err));
2168 }
2169 vnc_client_error(vs);
2170 }
2171 }
2172 return 0;
2173 }
2174
2175 static int protocol_version(VncState *vs, uint8_t *version, size_t len)
2176 {
2177 char local[13];
2178
2179 memcpy(local, version, 12);
2180 local[12] = 0;
2181
2182 if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) {
2183 VNC_DEBUG("Malformed protocol version %s\n", local);
2184 vnc_client_error(vs);
2185 return 0;
2186 }
2187 VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor);
2188 if (vs->major != 3 ||
2189 (vs->minor != 3 &&
2190 vs->minor != 4 &&
2191 vs->minor != 5 &&
2192 vs->minor != 7 &&
2193 vs->minor != 8)) {
2194 VNC_DEBUG("Unsupported client version\n");
2195 vnc_write_u32(vs, VNC_AUTH_INVALID);
2196 vnc_flush(vs);
2197 vnc_client_error(vs);
2198 return 0;
2199 }
2200 /* Some broken clients report v3.4 or v3.5, which spec requires to be treated
2201 * as equivalent to v3.3 by servers
2202 */
2203 if (vs->minor == 4 || vs->minor == 5)
2204 vs->minor = 3;
2205
2206 if (vs->minor == 3) {
2207 if (vs->auth == VNC_AUTH_NONE) {
2208 VNC_DEBUG("Tell client auth none\n");
2209 vnc_write_u32(vs, vs->auth);
2210 vnc_flush(vs);
2211 vnc_read_when(vs, protocol_client_init, 1);
2212 } else if (vs->auth == VNC_AUTH_VNC) {
2213 VNC_DEBUG("Tell client VNC auth\n");
2214 vnc_write_u32(vs, vs->auth);
2215 vnc_flush(vs);
2216 start_auth_vnc(vs);
2217 } else {
2218 VNC_DEBUG("Unsupported auth %d for protocol 3.3\n", vs->auth);
2219 vnc_write_u32(vs, VNC_AUTH_INVALID);
2220 vnc_flush(vs);
2221 vnc_client_error(vs);
2222 }
2223 } else {
2224 VNC_DEBUG("Telling client we support auth %d\n", vs->auth);
2225 vnc_write_u8(vs, 1); /* num auth */
2226 vnc_write_u8(vs, vs->auth);
2227 vnc_read_when(vs, protocol_client_auth, 1);
2228 vnc_flush(vs);
2229 }
2230
2231 return 0;
2232 }
2233
2234 static void vnc_connect(VncState *vs)
2235 {
2236 VNC_DEBUG("New client on socket %d\n", vs->csock);
2237 vs->ds->idle = 0;
2238 socket_set_nonblock(vs->csock);
2239 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
2240 vnc_write(vs, "RFB 003.008\n", 12);
2241 vnc_flush(vs);
2242 vnc_read_when(vs, protocol_version, 12);
2243 memset(vs->old_data, 0, ds_get_linesize(vs->ds) * ds_get_height(vs->ds));
2244 memset(vs->dirty_row, 0xFF, sizeof(vs->dirty_row));
2245 vs->has_resize = 0;
2246 vs->has_hextile = 0;
2247 vs->ds->dpy_copy = NULL;
2248 vnc_update_client(vs);
2249 reset_keys(vs);
2250 }
2251
2252 static void vnc_listen_read(void *opaque)
2253 {
2254 VncState *vs = opaque;
2255 struct sockaddr_in addr;
2256 socklen_t addrlen = sizeof(addr);
2257
2258 /* Catch-up */
2259 vga_hw_update();
2260
2261 vs->csock = accept(vs->lsock, (struct sockaddr *)&addr, &addrlen);
2262 if (vs->csock != -1) {
2263 vnc_connect(vs);
2264 }
2265 }
2266
2267 void vnc_display_init(DisplayState *ds)
2268 {
2269 VncState *vs;
2270
2271 vs = qemu_mallocz(sizeof(VncState));
2272 if (!vs)
2273 exit(1);
2274
2275 ds->opaque = vs;
2276 ds->idle = 1;
2277 vnc_state = vs;
2278 vs->display = NULL;
2279 vs->password = NULL;
2280
2281 vs->lsock = -1;
2282 vs->csock = -1;
2283 vs->last_x = -1;
2284 vs->last_y = -1;
2285
2286 vs->ds = ds;
2287
2288 if (keyboard_layout)
2289 vs->kbd_layout = init_keyboard_layout(keyboard_layout);
2290 else
2291 vs->kbd_layout = init_keyboard_layout("en-us");
2292
2293 if (!vs->kbd_layout)
2294 exit(1);
2295
2296 vs->timer = qemu_new_timer(rt_clock, vnc_update_client, vs);
2297
2298 vs->ds->data = NULL;
2299 vs->ds->dpy_update = vnc_dpy_update;
2300 vs->ds->dpy_resize = vnc_dpy_resize;
2301 vs->ds->dpy_refresh = NULL;
2302
2303 vnc_colordepth(vs->ds, 32);
2304 vnc_dpy_resize(vs->ds, 640, 400);
2305
2306 vs->as.freq = 44100;
2307 vs->as.nchannels = 2;
2308 vs->as.fmt = AUD_FMT_S16;
2309 vs->as.endianness = 0;
2310 }
2311
2312 #ifdef CONFIG_VNC_TLS
2313 static int vnc_set_x509_credential(VncState *vs,
2314 const char *certdir,
2315 const char *filename,
2316 char **cred,
2317 int ignoreMissing)
2318 {
2319 struct stat sb;
2320
2321 if (*cred) {
2322 qemu_free(*cred);
2323 *cred = NULL;
2324 }
2325
2326 if (!(*cred = qemu_malloc(strlen(certdir) + strlen(filename) + 2)))
2327 return -1;
2328
2329 strcpy(*cred, certdir);
2330 strcat(*cred, "/");
2331 strcat(*cred, filename);
2332
2333 VNC_DEBUG("Check %s\n", *cred);
2334 if (stat(*cred, &sb) < 0) {
2335 qemu_free(*cred);
2336 *cred = NULL;
2337 if (ignoreMissing && errno == ENOENT)
2338 return 0;
2339 return -1;
2340 }
2341
2342 return 0;
2343 }
2344
2345 static int vnc_set_x509_credential_dir(VncState *vs,
2346 const char *certdir)
2347 {
2348 if (vnc_set_x509_credential(vs, certdir, X509_CA_CERT_FILE, &vs->x509cacert, 0) < 0)
2349 goto cleanup;
2350 if (vnc_set_x509_credential(vs, certdir, X509_CA_CRL_FILE, &vs->x509cacrl, 1) < 0)
2351 goto cleanup;
2352 if (vnc_set_x509_credential(vs, certdir, X509_SERVER_CERT_FILE, &vs->x509cert, 0) < 0)
2353 goto cleanup;
2354 if (vnc_set_x509_credential(vs, certdir, X509_SERVER_KEY_FILE, &vs->x509key, 0) < 0)
2355 goto cleanup;
2356
2357 return 0;
2358
2359 cleanup:
2360 qemu_free(vs->x509cacert);
2361 qemu_free(vs->x509cacrl);
2362 qemu_free(vs->x509cert);
2363 qemu_free(vs->x509key);
2364 vs->x509cacert = vs->x509cacrl = vs->x509cert = vs->x509key = NULL;
2365 return -1;
2366 }
2367 #endif /* CONFIG_VNC_TLS */
2368
2369 void vnc_display_close(DisplayState *ds)
2370 {
2371 VncState *vs = ds ? (VncState *)ds->opaque : vnc_state;
2372
2373 if (vs->display) {
2374 qemu_free(vs->display);
2375 vs->display = NULL;
2376 }
2377 if (vs->lsock != -1) {
2378 qemu_set_fd_handler2(vs->lsock, NULL, NULL, NULL, NULL);
2379 close(vs->lsock);
2380 vs->lsock = -1;
2381 }
2382 if (vs->csock != -1) {
2383 qemu_set_fd_handler2(vs->csock, NULL, NULL, NULL, NULL);
2384 closesocket(vs->csock);
2385 vs->csock = -1;
2386 buffer_reset(&vs->input);
2387 buffer_reset(&vs->output);
2388 vs->need_update = 0;
2389 #ifdef CONFIG_VNC_TLS
2390 if (vs->tls_session) {
2391 gnutls_deinit(vs->tls_session);
2392 vs->tls_session = NULL;
2393 }
2394 vs->wiremode = VNC_WIREMODE_CLEAR;
2395 #endif /* CONFIG_VNC_TLS */
2396 }
2397 vs->auth = VNC_AUTH_INVALID;
2398 #ifdef CONFIG_VNC_TLS
2399 vs->subauth = VNC_AUTH_INVALID;
2400 vs->x509verify = 0;
2401 #endif
2402 audio_del(vs);
2403 }
2404
2405 int vnc_display_password(DisplayState *ds, const char *password)
2406 {
2407 VncState *vs = ds ? (VncState *)ds->opaque : vnc_state;
2408
2409 if (vs->password) {
2410 qemu_free(vs->password);
2411 vs->password = NULL;
2412 }
2413 if (password && password[0]) {
2414 if (!(vs->password = qemu_strdup(password)))
2415 return -1;
2416 }
2417
2418 return 0;
2419 }
2420
2421 int vnc_display_open(DisplayState *ds, const char *display)
2422 {
2423 VncState *vs = ds ? (VncState *)ds->opaque : vnc_state;
2424 const char *options;
2425 int password = 0;
2426 int reverse = 0;
2427 int to_port = 0;
2428 #ifdef CONFIG_VNC_TLS
2429 int tls = 0, x509 = 0;
2430 #endif
2431
2432 vnc_display_close(ds);
2433 if (strcmp(display, "none") == 0)
2434 return 0;
2435
2436 if (!(vs->display = strdup(display)))
2437 return -1;
2438
2439 options = display;
2440 while ((options = strchr(options, ','))) {
2441 options++;
2442 if (strncmp(options, "password", 8) == 0) {
2443 password = 1; /* Require password auth */
2444 } else if (strncmp(options, "reverse", 7) == 0) {
2445 reverse = 1;
2446 } else if (strncmp(options, "to=", 3) == 0) {
2447 to_port = atoi(options+3) + 5900;
2448 #ifdef CONFIG_VNC_TLS
2449 } else if (strncmp(options, "tls", 3) == 0) {
2450 tls = 1; /* Require TLS */
2451 } else if (strncmp(options, "x509", 4) == 0) {
2452 char *start, *end;
2453 x509 = 1; /* Require x509 certificates */
2454 if (strncmp(options, "x509verify", 10) == 0)
2455 vs->x509verify = 1; /* ...and verify client certs */
2456
2457 /* Now check for 'x509=/some/path' postfix
2458 * and use that to setup x509 certificate/key paths */
2459 start = strchr(options, '=');
2460 end = strchr(options, ',');
2461 if (start && (!end || (start < end))) {
2462 int len = end ? end-(start+1) : strlen(start+1);
2463 char *path = qemu_strndup(start + 1, len);
2464
2465 VNC_DEBUG("Trying certificate path '%s'\n", path);
2466 if (vnc_set_x509_credential_dir(vs, path) < 0) {
2467 fprintf(stderr, "Failed to find x509 certificates/keys in %s\n", path);
2468 qemu_free(path);
2469 qemu_free(vs->display);
2470 vs->display = NULL;
2471 return -1;
2472 }
2473 qemu_free(path);
2474 } else {
2475 fprintf(stderr, "No certificate path provided\n");
2476 qemu_free(vs->display);
2477 vs->display = NULL;
2478 return -1;
2479 }
2480 #endif
2481 }
2482 }
2483
2484 if (password) {
2485 #ifdef CONFIG_VNC_TLS
2486 if (tls) {
2487 vs->auth = VNC_AUTH_VENCRYPT;
2488 if (x509) {
2489 VNC_DEBUG("Initializing VNC server with x509 password auth\n");
2490 vs->subauth = VNC_AUTH_VENCRYPT_X509VNC;
2491 } else {
2492 VNC_DEBUG("Initializing VNC server with TLS password auth\n");
2493 vs->subauth = VNC_AUTH_VENCRYPT_TLSVNC;
2494 }
2495 } else {
2496 #endif
2497 VNC_DEBUG("Initializing VNC server with password auth\n");
2498 vs->auth = VNC_AUTH_VNC;
2499 #ifdef CONFIG_VNC_TLS
2500 vs->subauth = VNC_AUTH_INVALID;
2501 }
2502 #endif
2503 } else {
2504 #ifdef CONFIG_VNC_TLS
2505 if (tls) {
2506 vs->auth = VNC_AUTH_VENCRYPT;
2507 if (x509) {
2508 VNC_DEBUG("Initializing VNC server with x509 no auth\n");
2509 vs->subauth = VNC_AUTH_VENCRYPT_X509NONE;
2510 } else {
2511 VNC_DEBUG("Initializing VNC server with TLS no auth\n");
2512 vs->subauth = VNC_AUTH_VENCRYPT_TLSNONE;
2513 }
2514 } else {
2515 #endif
2516 VNC_DEBUG("Initializing VNC server with no auth\n");
2517 vs->auth = VNC_AUTH_NONE;
2518 #ifdef CONFIG_VNC_TLS
2519 vs->subauth = VNC_AUTH_INVALID;
2520 }
2521 #endif
2522 }
2523
2524 if (reverse) {
2525 /* connect to viewer */
2526 if (strncmp(display, "unix:", 5) == 0)
2527 vs->lsock = unix_connect(display+5);
2528 else
2529 vs->lsock = inet_connect(display, SOCK_STREAM);
2530 if (-1 == vs->lsock) {
2531 free(vs->display);
2532 vs->display = NULL;
2533 return -1;
2534 } else {
2535 vs->csock = vs->lsock;
2536 vs->lsock = -1;
2537 vnc_connect(vs);
2538 }
2539 return 0;
2540
2541 } else {
2542 /* listen for connects */
2543 char *dpy;
2544 dpy = qemu_malloc(256);
2545 if (strncmp(display, "unix:", 5) == 0) {
2546 strcpy(dpy, "unix:");
2547 vs->lsock = unix_listen(display+5, dpy+5, 256-5);
2548 } else {
2549 vs->lsock = inet_listen(display, dpy, 256, SOCK_STREAM, 5900);
2550 }
2551 if (-1 == vs->lsock) {
2552 free(dpy);
2553 return -1;
2554 } else {
2555 free(vs->display);
2556 vs->display = dpy;
2557 }
2558 }
2559
2560 return qemu_set_fd_handler2(vs->lsock, vnc_listen_poll, vnc_listen_read, NULL, vs);
2561 }
Patches shipped by Fedora