?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Recognize V9 stores and CAS accesses as writes
[qemu-kvm/fedora.git] / vnc.c
blobab1f04448624837217b7e63ad4dd56ca86be7e6b
1 /*
2 * QEMU VNC display driver
3 *
4 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5 * Copyright (C) 2006 Fabrice Bellard
6 * Copyright (C) 2009 Red Hat, Inc
7 *
8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to deal
10 * in the Software without restriction, including without limitation the rights
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12 * copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
14 *
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
17 *
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24 * THE SOFTWARE.
25 */
26
27 #include "vnc.h"
28 #include "sysemu.h"
29 #include "qemu_socket.h"
30 #include "qemu-timer.h"
31 #include "acl.h"
32
33 #define VNC_REFRESH_INTERVAL (1000 / 30)
34
35 #include "vnc_keysym.h"
36 #include "d3des.h"
37
38 #define count_bits(c, v) { \
39 for (c = 0; v; v >>= 1) \
40 { \
41 c += v & 1; \
42 } \
43 }
44
45
46 static VncDisplay *vnc_display; /* needed for info vnc */
47 static DisplayChangeListener *dcl;
48
49 static char *addr_to_string(const char *format,
50 struct sockaddr_storage *sa,
51 socklen_t salen) {
52 char *addr;
53 char host[NI_MAXHOST];
54 char serv[NI_MAXSERV];
55 int err;
56 size_t addrlen;
57
58 if ((err = getnameinfo((struct sockaddr *)sa, salen,
59 host, sizeof(host),
60 serv, sizeof(serv),
61 NI_NUMERICHOST | NI_NUMERICSERV)) != 0) {
62 VNC_DEBUG("Cannot resolve address %d: %s\n",
63 err, gai_strerror(err));
64 return NULL;
65 }
66
67 /* Enough for the existing format + the 2 vars we're
68 * subsituting in. */
69 addrlen = strlen(format) + strlen(host) + strlen(serv);
70 addr = qemu_malloc(addrlen + 1);
71 snprintf(addr, addrlen, format, host, serv);
72 addr[addrlen] = '\0';
73
74 return addr;
75 }
76
77
78 char *vnc_socket_local_addr(const char *format, int fd) {
79 struct sockaddr_storage sa;
80 socklen_t salen;
81
82 salen = sizeof(sa);
83 if (getsockname(fd, (struct sockaddr*)&sa, &salen) < 0)
84 return NULL;
85
86 return addr_to_string(format, &sa, salen);
87 }
88
89
90 char *vnc_socket_remote_addr(const char *format, int fd) {
91 struct sockaddr_storage sa;
92 socklen_t salen;
93
94 salen = sizeof(sa);
95 if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0)
96 return NULL;
97
98 return addr_to_string(format, &sa, salen);
99 }
100
101 static const char *vnc_auth_name(VncDisplay *vd) {
102 switch (vd->auth) {
103 case VNC_AUTH_INVALID:
104 return "invalid";
105 case VNC_AUTH_NONE:
106 return "none";
107 case VNC_AUTH_VNC:
108 return "vnc";
109 case VNC_AUTH_RA2:
110 return "ra2";
111 case VNC_AUTH_RA2NE:
112 return "ra2ne";
113 case VNC_AUTH_TIGHT:
114 return "tight";
115 case VNC_AUTH_ULTRA:
116 return "ultra";
117 case VNC_AUTH_TLS:
118 return "tls";
119 case VNC_AUTH_VENCRYPT:
120 #ifdef CONFIG_VNC_TLS
121 switch (vd->subauth) {
122 case VNC_AUTH_VENCRYPT_PLAIN:
123 return "vencrypt+plain";
124 case VNC_AUTH_VENCRYPT_TLSNONE:
125 return "vencrypt+tls+none";
126 case VNC_AUTH_VENCRYPT_TLSVNC:
127 return "vencrypt+tls+vnc";
128 case VNC_AUTH_VENCRYPT_TLSPLAIN:
129 return "vencrypt+tls+plain";
130 case VNC_AUTH_VENCRYPT_X509NONE:
131 return "vencrypt+x509+none";
132 case VNC_AUTH_VENCRYPT_X509VNC:
133 return "vencrypt+x509+vnc";
134 case VNC_AUTH_VENCRYPT_X509PLAIN:
135 return "vencrypt+x509+plain";
136 case VNC_AUTH_VENCRYPT_TLSSASL:
137 return "vencrypt+tls+sasl";
138 case VNC_AUTH_VENCRYPT_X509SASL:
139 return "vencrypt+x509+sasl";
140 default:
141 return "vencrypt";
142 }
143 #else
144 return "vencrypt";
145 #endif
146 case VNC_AUTH_SASL:
147 return "sasl";
148 }
149 return "unknown";
150 }
151
152 static void do_info_vnc_client(Monitor *mon, VncState *client)
153 {
154 char *clientAddr =
155 vnc_socket_remote_addr(" address: %s:%s\n",
156 client->csock);
157 if (!clientAddr)
158 return;
159
160 monitor_printf(mon, "Client:\n");
161 monitor_printf(mon, "%s", clientAddr);
162 free(clientAddr);
163
164 #ifdef CONFIG_VNC_TLS
165 if (client->tls.session &&
166 client->tls.dname)
167 monitor_printf(mon, " x509 dname: %s\n", client->tls.dname);
168 else
169 monitor_printf(mon, " x509 dname: none\n");
170 #endif
171 #ifdef CONFIG_VNC_SASL
172 if (client->sasl.conn &&
173 client->sasl.username)
174 monitor_printf(mon, " username: %s\n", client->sasl.username);
175 else
176 monitor_printf(mon, " username: none\n");
177 #endif
178 }
179
180 void do_info_vnc(Monitor *mon)
181 {
182 if (vnc_display == NULL || vnc_display->display == NULL) {
183 monitor_printf(mon, "Server: disabled\n");
184 } else {
185 char *serverAddr = vnc_socket_local_addr(" address: %s:%s\n",
186 vnc_display->lsock);
187
188 if (!serverAddr)
189 return;
190
191 monitor_printf(mon, "Server:\n");
192 monitor_printf(mon, "%s", serverAddr);
193 free(serverAddr);
194 monitor_printf(mon, " auth: %s\n", vnc_auth_name(vnc_display));
195
196 if (vnc_display->clients) {
197 VncState *client = vnc_display->clients;
198 while (client) {
199 do_info_vnc_client(mon, client);
200 client = client->next;
201 }
202 } else {
203 monitor_printf(mon, "Client: none\n");
204 }
205 }
206 }
207
208 static inline uint32_t vnc_has_feature(VncState *vs, int feature) {
209 return (vs->features & (1 << feature));
210 }
211
212 /* TODO
213 1) Get the queue working for IO.
214 2) there is some weirdness when using the -S option (the screen is grey
215 and not totally invalidated
216 3) resolutions > 1024
217 */
218
219 static void vnc_update_client(void *opaque);
220
221 static void vnc_colordepth(VncState *vs);
222
223 static inline void vnc_set_bit(uint32_t *d, int k)
224 {
225 d[k >> 5] |= 1 << (k & 0x1f);
226 }
227
228 static inline void vnc_clear_bit(uint32_t *d, int k)
229 {
230 d[k >> 5] &= ~(1 << (k & 0x1f));
231 }
232
233 static inline void vnc_set_bits(uint32_t *d, int n, int nb_words)
234 {
235 int j;
236
237 j = 0;
238 while (n >= 32) {
239 d[j++] = -1;
240 n -= 32;
241 }
242 if (n > 0)
243 d[j++] = (1 << n) - 1;
244 while (j < nb_words)
245 d[j++] = 0;
246 }
247
248 static inline int vnc_get_bit(const uint32_t *d, int k)
249 {
250 return (d[k >> 5] >> (k & 0x1f)) & 1;
251 }
252
253 static inline int vnc_and_bits(const uint32_t *d1, const uint32_t *d2,
254 int nb_words)
255 {
256 int i;
257 for(i = 0; i < nb_words; i++) {
258 if ((d1[i] & d2[i]) != 0)
259 return 1;
260 }
261 return 0;
262 }
263
264 static void vnc_update(VncState *vs, int x, int y, int w, int h)
265 {
266 struct VncSurface *s = &vs->guest;
267 int i;
268
269 h += y;
270
271 /* round x down to ensure the loop only spans one 16-pixel block per,
272 iteration. otherwise, if (x % 16) != 0, the last iteration may span
273 two 16-pixel blocks but we only mark the first as dirty
274 */
275 w += (x % 16);
276 x -= (x % 16);
277
278 x = MIN(x, s->ds->width);
279 y = MIN(y, s->ds->height);
280 w = MIN(x + w, s->ds->width) - x;
281 h = MIN(h, s->ds->height);
282
283 for (; y < h; y++)
284 for (i = 0; i < w; i += 16)
285 vnc_set_bit(s->dirty[y], (x + i) / 16);
286 }
287
288 static void vnc_dpy_update(DisplayState *ds, int x, int y, int w, int h)
289 {
290 VncDisplay *vd = ds->opaque;
291 VncState *vs = vd->clients;
292 while (vs != NULL) {
293 vnc_update(vs, x, y, w, h);
294 vs = vs->next;
295 }
296 }
297
298 static void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
299 int32_t encoding)
300 {
301 vnc_write_u16(vs, x);
302 vnc_write_u16(vs, y);
303 vnc_write_u16(vs, w);
304 vnc_write_u16(vs, h);
305
306 vnc_write_s32(vs, encoding);
307 }
308
309 void buffer_reserve(Buffer *buffer, size_t len)
310 {
311 if ((buffer->capacity - buffer->offset) < len) {
312 buffer->capacity += (len + 1024);
313 buffer->buffer = qemu_realloc(buffer->buffer, buffer->capacity);
314 if (buffer->buffer == NULL) {
315 fprintf(stderr, "vnc: out of memory\n");
316 exit(1);
317 }
318 }
319 }
320
321 int buffer_empty(Buffer *buffer)
322 {
323 return buffer->offset == 0;
324 }
325
326 uint8_t *buffer_end(Buffer *buffer)
327 {
328 return buffer->buffer + buffer->offset;
329 }
330
331 void buffer_reset(Buffer *buffer)
332 {
333 buffer->offset = 0;
334 }
335
336 void buffer_append(Buffer *buffer, const void *data, size_t len)
337 {
338 memcpy(buffer->buffer + buffer->offset, data, len);
339 buffer->offset += len;
340 }
341
342 static void vnc_resize(VncState *vs)
343 {
344 DisplayState *ds = vs->ds;
345 int size_changed;
346
347 /* guest surface */
348 if (!vs->guest.ds)
349 vs->guest.ds = qemu_mallocz(sizeof(*vs->guest.ds));
350 if (ds_get_bytes_per_pixel(ds) != vs->guest.ds->pf.bytes_per_pixel)
351 console_color_init(ds);
352 vnc_colordepth(vs);
353 size_changed = ds_get_width(ds) != vs->guest.ds->width ||
354 ds_get_height(ds) != vs->guest.ds->height;
355 *(vs->guest.ds) = *(ds->surface);
356 if (size_changed) {
357 if (vs->csock != -1 && vnc_has_feature(vs, VNC_FEATURE_RESIZE)) {
358 vnc_write_u8(vs, 0); /* msg id */
359 vnc_write_u8(vs, 0);
360 vnc_write_u16(vs, 1); /* number of rects */
361 vnc_framebuffer_update(vs, 0, 0, ds_get_width(ds), ds_get_height(ds),
362 VNC_ENCODING_DESKTOPRESIZE);
363 vnc_flush(vs);
364 }
365 }
366 memset(vs->guest.dirty, 0xFF, sizeof(vs->guest.dirty));
367
368 /* server surface */
369 if (!vs->server.ds) {
370 vs->server.ds = default_allocator.create_displaysurface(ds_get_width(ds),
371 ds_get_height(ds));
372 } else {
373 default_allocator.resize_displaysurface(vs->server.ds,
374 ds_get_width(ds), ds_get_height(ds));
375 }
376 if (vs->server.ds->data == NULL) {
377 fprintf(stderr, "vnc: memory allocation failed\n");
378 exit(1);
379 }
380 memset(vs->server.dirty, 0xFF, sizeof(vs->guest.dirty));
381 }
382
383 static void vnc_dpy_resize(DisplayState *ds)
384 {
385 VncDisplay *vd = ds->opaque;
386 VncState *vs = vd->clients;
387 while (vs != NULL) {
388 vnc_resize(vs);
389 vs = vs->next;
390 }
391 }
392
393 /* fastest code */
394 static void vnc_write_pixels_copy(VncState *vs, void *pixels, int size)
395 {
396 vnc_write(vs, pixels, size);
397 }
398
399 /* slowest but generic code. */
400 static void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
401 {
402 uint8_t r, g, b;
403
404 r = ((((v & vs->server.ds->pf.rmask) >> vs->server.ds->pf.rshift) << vs->clientds.pf.rbits) >>
405 vs->server.ds->pf.rbits);
406 g = ((((v & vs->server.ds->pf.gmask) >> vs->server.ds->pf.gshift) << vs->clientds.pf.gbits) >>
407 vs->server.ds->pf.gbits);
408 b = ((((v & vs->server.ds->pf.bmask) >> vs->server.ds->pf.bshift) << vs->clientds.pf.bbits) >>
409 vs->server.ds->pf.bbits);
410 v = (r << vs->clientds.pf.rshift) |
411 (g << vs->clientds.pf.gshift) |
412 (b << vs->clientds.pf.bshift);
413 switch(vs->clientds.pf.bytes_per_pixel) {
414 case 1:
415 buf[0] = v;
416 break;
417 case 2:
418 if (vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) {
419 buf[0] = v >> 8;
420 buf[1] = v;
421 } else {
422 buf[1] = v >> 8;
423 buf[0] = v;
424 }
425 break;
426 default:
427 case 4:
428 if (vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) {
429 buf[0] = v >> 24;
430 buf[1] = v >> 16;
431 buf[2] = v >> 8;
432 buf[3] = v;
433 } else {
434 buf[3] = v >> 24;
435 buf[2] = v >> 16;
436 buf[1] = v >> 8;
437 buf[0] = v;
438 }
439 break;
440 }
441 }
442
443 static void vnc_write_pixels_generic(VncState *vs, void *pixels1, int size)
444 {
445 uint8_t buf[4];
446
447 if (vs->server.ds->pf.bytes_per_pixel == 4) {
448 uint32_t *pixels = pixels1;
449 int n, i;
450 n = size >> 2;
451 for(i = 0; i < n; i++) {
452 vnc_convert_pixel(vs, buf, pixels[i]);
453 vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
454 }
455 } else if (vs->server.ds->pf.bytes_per_pixel == 2) {
456 uint16_t *pixels = pixels1;
457 int n, i;
458 n = size >> 1;
459 for(i = 0; i < n; i++) {
460 vnc_convert_pixel(vs, buf, pixels[i]);
461 vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
462 }
463 } else if (vs->server.ds->pf.bytes_per_pixel == 1) {
464 uint8_t *pixels = pixels1;
465 int n, i;
466 n = size;
467 for(i = 0; i < n; i++) {
468 vnc_convert_pixel(vs, buf, pixels[i]);
469 vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
470 }
471 } else {
472 fprintf(stderr, "vnc_write_pixels_generic: VncState color depth not supported\n");
473 }
474 }
475
476 static void send_framebuffer_update_raw(VncState *vs, int x, int y, int w, int h)
477 {
478 int i;
479 uint8_t *row;
480
481 row = vs->server.ds->data + y * ds_get_linesize(vs->ds) + x * ds_get_bytes_per_pixel(vs->ds);
482 for (i = 0; i < h; i++) {
483 vs->write_pixels(vs, row, w * ds_get_bytes_per_pixel(vs->ds));
484 row += ds_get_linesize(vs->ds);
485 }
486 }
487
488 static void hextile_enc_cord(uint8_t *ptr, int x, int y, int w, int h)
489 {
490 ptr[0] = ((x & 0x0F) << 4) | (y & 0x0F);
491 ptr[1] = (((w - 1) & 0x0F) << 4) | ((h - 1) & 0x0F);
492 }
493
494 #define BPP 8
495 #include "vnchextile.h"
496 #undef BPP
497
498 #define BPP 16
499 #include "vnchextile.h"
500 #undef BPP
501
502 #define BPP 32
503 #include "vnchextile.h"
504 #undef BPP
505
506 #define GENERIC
507 #define BPP 8
508 #include "vnchextile.h"
509 #undef BPP
510 #undef GENERIC
511
512 #define GENERIC
513 #define BPP 16
514 #include "vnchextile.h"
515 #undef BPP
516 #undef GENERIC
517
518 #define GENERIC
519 #define BPP 32
520 #include "vnchextile.h"
521 #undef BPP
522 #undef GENERIC
523
524 static void send_framebuffer_update_hextile(VncState *vs, int x, int y, int w, int h)
525 {
526 int i, j;
527 int has_fg, has_bg;
528 uint8_t *last_fg, *last_bg;
529
530 last_fg = (uint8_t *) qemu_malloc(vs->server.ds->pf.bytes_per_pixel);
531 last_bg = (uint8_t *) qemu_malloc(vs->server.ds->pf.bytes_per_pixel);
532 has_fg = has_bg = 0;
533 for (j = y; j < (y + h); j += 16) {
534 for (i = x; i < (x + w); i += 16) {
535 vs->send_hextile_tile(vs, i, j,
536 MIN(16, x + w - i), MIN(16, y + h - j),
537 last_bg, last_fg, &has_bg, &has_fg);
538 }
539 }
540 free(last_fg);
541 free(last_bg);
542
543 }
544
545 static void vnc_zlib_init(VncState *vs)
546 {
547 int i;
548 for (i=0; i<(sizeof(vs->zlib_stream) / sizeof(z_stream)); i++)
549 vs->zlib_stream[i].opaque = NULL;
550 }
551
552 static void vnc_zlib_start(VncState *vs)
553 {
554 buffer_reset(&vs->zlib);
555
556 // make the output buffer be the zlib buffer, so we can compress it later
557 vs->zlib_tmp = vs->output;
558 vs->output = vs->zlib;
559 }
560
561 static int vnc_zlib_stop(VncState *vs, int stream_id)
562 {
563 z_streamp zstream = &vs->zlib_stream[stream_id];
564 int previous_out;
565
566 // switch back to normal output/zlib buffers
567 vs->zlib = vs->output;
568 vs->output = vs->zlib_tmp;
569
570 // compress the zlib buffer
571
572 // initialize the stream
573 // XXX need one stream per session
574 if (zstream->opaque != vs) {
575 int err;
576
577 VNC_DEBUG("VNC: initializing zlib stream %d\n", stream_id);
578 VNC_DEBUG("VNC: opaque = %p | vs = %p\n", zstream->opaque, vs);
579 zstream->zalloc = Z_NULL;
580 zstream->zfree = Z_NULL;
581
582 err = deflateInit2(zstream, vs->tight_compression, Z_DEFLATED, MAX_WBITS,
583 MAX_MEM_LEVEL, Z_DEFAULT_STRATEGY);
584
585 if (err != Z_OK) {
586 fprintf(stderr, "VNC: error initializing zlib\n");
587 return -1;
588 }
589
590 zstream->opaque = vs;
591 }
592
593 // XXX what to do if tight_compression changed in between?
594
595 // reserve memory in output buffer
596 buffer_reserve(&vs->output, vs->zlib.offset + 64);
597
598 // set pointers
599 zstream->next_in = vs->zlib.buffer;
600 zstream->avail_in = vs->zlib.offset;
601 zstream->next_out = vs->output.buffer + vs->output.offset;
602 zstream->avail_out = vs->output.capacity - vs->output.offset;
603 zstream->data_type = Z_BINARY;
604 previous_out = zstream->total_out;
605
606 // start encoding
607 if (deflate(zstream, Z_SYNC_FLUSH) != Z_OK) {
608 fprintf(stderr, "VNC: error during zlib compression\n");
609 return -1;
610 }
611
612 vs->output.offset = vs->output.capacity - zstream->avail_out;
613 return zstream->total_out - previous_out;
614 }
615
616 static void send_framebuffer_update_zlib(VncState *vs, int x, int y, int w, int h)
617 {
618 int old_offset, new_offset, bytes_written;
619
620 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_ZLIB);
621
622 // remember where we put in the follow-up size
623 old_offset = vs->output.offset;
624 vnc_write_s32(vs, 0);
625
626 // compress the stream
627 vnc_zlib_start(vs);
628 send_framebuffer_update_raw(vs, x, y, w, h);
629 bytes_written = vnc_zlib_stop(vs, 0);
630
631 if (bytes_written == -1)
632 return;
633
634 // hack in the size
635 new_offset = vs->output.offset;
636 vs->output.offset = old_offset;
637 vnc_write_u32(vs, bytes_written);
638 vs->output.offset = new_offset;
639 }
640
641 static void send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
642 {
643 switch(vs->vnc_encoding) {
644 case VNC_ENCODING_ZLIB:
645 send_framebuffer_update_zlib(vs, x, y, w, h);
646 break;
647 case VNC_ENCODING_HEXTILE:
648 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE);
649 send_framebuffer_update_hextile(vs, x, y, w, h);
650 break;
651 default:
652 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW);
653 send_framebuffer_update_raw(vs, x, y, w, h);
654 break;
655 }
656 }
657
658 static void vnc_copy(VncState *vs, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
659 {
660 vs->force_update = 1;
661 vnc_update_client(vs);
662
663 vnc_write_u8(vs, 0); /* msg id */
664 vnc_write_u8(vs, 0);
665 vnc_write_u16(vs, 1); /* number of rects */
666 vnc_framebuffer_update(vs, dst_x, dst_y, w, h, VNC_ENCODING_COPYRECT);
667 vnc_write_u16(vs, src_x);
668 vnc_write_u16(vs, src_y);
669 vnc_flush(vs);
670 }
671
672 static void vnc_dpy_copy(DisplayState *ds, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
673 {
674 VncDisplay *vd = ds->opaque;
675 VncState *vs = vd->clients;
676 while (vs != NULL) {
677 if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT))
678 vnc_copy(vs, src_x, src_y, dst_x, dst_y, w, h);
679 else /* TODO */
680 vnc_update(vs, dst_x, dst_y, w, h);
681 vs = vs->next;
682 }
683 }
684
685 static int find_and_clear_dirty_height(struct VncSurface *s,
686 int y, int last_x, int x)
687 {
688 int h;
689
690 for (h = 1; h < (s->ds->height - y) && h < 1; h++) {
691 int tmp_x;
692 if (!vnc_get_bit(s->dirty[y + h], last_x))
693 break;
694 for (tmp_x = last_x; tmp_x < x; tmp_x++)
695 vnc_clear_bit(s->dirty[y + h], tmp_x);
696 }
697
698 return h;
699 }
700
701 static void vnc_update_client(void *opaque)
702 {
703 VncState *vs = opaque;
704 if (vs->need_update && vs->csock != -1) {
705 int y;
706 uint8_t *guest_row;
707 uint8_t *server_row;
708 int cmp_bytes = 16 * ds_get_bytes_per_pixel(vs->ds);
709 uint32_t width_mask[VNC_DIRTY_WORDS];
710 int n_rectangles;
711 int saved_offset;
712 int has_dirty = 0;
713
714 if (vs->output.offset && !vs->audio_cap && !vs->force_update) {
715 /* kernel send buffers are full -> drop frames to throttle */
716 qemu_mod_timer(vs->timer, qemu_get_clock(rt_clock) + VNC_REFRESH_INTERVAL);
717 return;
718 }
719
720 vga_hw_update();
721
722 /*
723 * Walk through the guest dirty map.
724 * Check and copy modified bits from guest to server surface.
725 * Update server dirty map.
726 */
727 vnc_set_bits(width_mask, (ds_get_width(vs->ds) / 16), VNC_DIRTY_WORDS);
728 guest_row = vs->guest.ds->data;
729 server_row = vs->server.ds->data;
730 for (y = 0; y < vs->guest.ds->height; y++) {
731 if (vnc_and_bits(vs->guest.dirty[y], width_mask, VNC_DIRTY_WORDS)) {
732 int x;
733 uint8_t *guest_ptr;
734 uint8_t *server_ptr;
735
736 guest_ptr = guest_row;
737 server_ptr = server_row;
738
739 for (x = 0; x < vs->guest.ds->width;
740 x += 16, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) {
741 if (!vnc_get_bit(vs->guest.dirty[y], (x / 16)))
742 continue;
743 vnc_clear_bit(vs->guest.dirty[y], (x / 16));
744 if (memcmp(server_ptr, guest_ptr, cmp_bytes) == 0)
745 continue;
746 memcpy(server_ptr, guest_ptr, cmp_bytes);
747 vnc_set_bit(vs->server.dirty[y], (x / 16));
748 has_dirty++;
749 }
750 }
751 guest_row += ds_get_linesize(vs->ds);
752 server_row += ds_get_linesize(vs->ds);
753 }
754
755 if (!has_dirty && !vs->audio_cap && !vs->force_update) {
756 qemu_mod_timer(vs->timer, qemu_get_clock(rt_clock) + VNC_REFRESH_INTERVAL);
757 return;
758 }
759
760 /*
761 * Send screen updates to the vnc client using the server
762 * surface and server dirty map. guest surface updates
763 * happening in parallel don't disturb us, the next pass will
764 * send them to the client.
765 */
766 n_rectangles = 0;
767 vnc_write_u8(vs, 0); /* msg id */
768 vnc_write_u8(vs, 0);
769 saved_offset = vs->output.offset;
770 vnc_write_u16(vs, 0);
771
772 for (y = 0; y < vs->server.ds->height; y++) {
773 int x;
774 int last_x = -1;
775 for (x = 0; x < vs->server.ds->width / 16; x++) {
776 if (vnc_get_bit(vs->server.dirty[y], x)) {
777 if (last_x == -1) {
778 last_x = x;
779 }
780 vnc_clear_bit(vs->server.dirty[y], x);
781 } else {
782 if (last_x != -1) {
783 int h = find_and_clear_dirty_height(&vs->server, y, last_x, x);
784 send_framebuffer_update(vs, last_x * 16, y, (x - last_x) * 16, h);
785 n_rectangles++;
786 }
787 last_x = -1;
788 }
789 }
790 if (last_x != -1) {
791 int h = find_and_clear_dirty_height(&vs->server, y, last_x, x);
792 send_framebuffer_update(vs, last_x * 16, y, (x - last_x) * 16, h);
793 n_rectangles++;
794 }
795 }
796 vs->output.buffer[saved_offset] = (n_rectangles >> 8) & 0xFF;
797 vs->output.buffer[saved_offset + 1] = n_rectangles & 0xFF;
798 vnc_flush(vs);
799 vs->force_update = 0;
800
801 }
802
803 if (vs->csock != -1) {
804 qemu_mod_timer(vs->timer, qemu_get_clock(rt_clock) + VNC_REFRESH_INTERVAL);
805 }
806
807 }
808
809 /* audio */
810 static void audio_capture_notify(void *opaque, audcnotification_e cmd)
811 {
812 VncState *vs = opaque;
813
814 switch (cmd) {
815 case AUD_CNOTIFY_DISABLE:
816 vnc_write_u8(vs, 255);
817 vnc_write_u8(vs, 1);
818 vnc_write_u16(vs, 0);
819 vnc_flush(vs);
820 break;
821
822 case AUD_CNOTIFY_ENABLE:
823 vnc_write_u8(vs, 255);
824 vnc_write_u8(vs, 1);
825 vnc_write_u16(vs, 1);
826 vnc_flush(vs);
827 break;
828 }
829 }
830
831 static void audio_capture_destroy(void *opaque)
832 {
833 }
834
835 static void audio_capture(void *opaque, void *buf, int size)
836 {
837 VncState *vs = opaque;
838
839 vnc_write_u8(vs, 255);
840 vnc_write_u8(vs, 1);
841 vnc_write_u16(vs, 2);
842 vnc_write_u32(vs, size);
843 vnc_write(vs, buf, size);
844 vnc_flush(vs);
845 }
846
847 static void audio_add(VncState *vs)
848 {
849 Monitor *mon = cur_mon;
850 struct audio_capture_ops ops;
851
852 if (vs->audio_cap) {
853 monitor_printf(mon, "audio already running\n");
854 return;
855 }
856
857 ops.notify = audio_capture_notify;
858 ops.destroy = audio_capture_destroy;
859 ops.capture = audio_capture;
860
861 vs->audio_cap = AUD_add_capture(NULL, &vs->as, &ops, vs);
862 if (!vs->audio_cap) {
863 monitor_printf(mon, "Failed to add audio capture\n");
864 }
865 }
866
867 static void audio_del(VncState *vs)
868 {
869 if (vs->audio_cap) {
870 AUD_del_capture(vs->audio_cap, vs);
871 vs->audio_cap = NULL;
872 }
873 }
874
875
876 int vnc_client_io_error(VncState *vs, int ret, int last_errno)
877 {
878 if (ret == 0 || ret == -1) {
879 if (ret == -1) {
880 switch (last_errno) {
881 case EINTR:
882 case EAGAIN:
883 #ifdef _WIN32
884 case WSAEWOULDBLOCK:
885 #endif
886 return 0;
887 default:
888 break;
889 }
890 }
891
892 VNC_DEBUG("Closing down client sock %d %d\n", ret, ret < 0 ? last_errno : 0);
893 qemu_set_fd_handler2(vs->csock, NULL, NULL, NULL, NULL);
894 closesocket(vs->csock);
895 qemu_del_timer(vs->timer);
896 qemu_free_timer(vs->timer);
897 if (vs->input.buffer) qemu_free(vs->input.buffer);
898 if (vs->output.buffer) qemu_free(vs->output.buffer);
899 #ifdef CONFIG_VNC_TLS
900 vnc_tls_client_cleanup(vs);
901 #endif /* CONFIG_VNC_TLS */
902 #ifdef CONFIG_VNC_SASL
903 vnc_sasl_client_cleanup(vs);
904 #endif /* CONFIG_VNC_SASL */
905 audio_del(vs);
906
907 VncState *p, *parent = NULL;
908 for (p = vs->vd->clients; p != NULL; p = p->next) {
909 if (p == vs) {
910 if (parent)
911 parent->next = p->next;
912 else
913 vs->vd->clients = p->next;
914 break;
915 }
916 parent = p;
917 }
918 if (!vs->vd->clients)
919 dcl->idle = 1;
920
921 default_allocator.free_displaysurface(vs->server.ds);
922 qemu_free(vs->guest.ds);
923 qemu_free(vs);
924
925 return 0;
926 }
927 return ret;
928 }
929
930
931 void vnc_client_error(VncState *vs)
932 {
933 vnc_client_io_error(vs, -1, EINVAL);
934 }
935
936
937 /*
938 * Called to write a chunk of data to the client socket. The data may
939 * be the raw data, or may have already been encoded by SASL.
940 * The data will be written either straight onto the socket, or
941 * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled
942 *
943 * NB, it is theoretically possible to have 2 layers of encryption,
944 * both SASL, and this TLS layer. It is highly unlikely in practice
945 * though, since SASL encryption will typically be a no-op if TLS
946 * is active
947 *
948 * Returns the number of bytes written, which may be less than
949 * the requested 'datalen' if the socket would block. Returns
950 * -1 on error, and disconnects the client socket.
951 */
952 long vnc_client_write_buf(VncState *vs, const uint8_t *data, size_t datalen)
953 {
954 long ret;
955 #ifdef CONFIG_VNC_TLS
956 if (vs->tls.session) {
957 ret = gnutls_write(vs->tls.session, data, datalen);
958 if (ret < 0) {
959 if (ret == GNUTLS_E_AGAIN)
960 errno = EAGAIN;
961 else
962 errno = EIO;
963 ret = -1;
964 }
965 } else
966 #endif /* CONFIG_VNC_TLS */
967 ret = send(vs->csock, data, datalen, 0);
968 VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data, datalen, ret);
969 return vnc_client_io_error(vs, ret, socket_error());
970 }
971
972
973 /*
974 * Called to write buffered data to the client socket, when not
975 * using any SASL SSF encryption layers. Will write as much data
976 * as possible without blocking. If all buffered data is written,
977 * will switch the FD poll() handler back to read monitoring.
978 *
979 * Returns the number of bytes written, which may be less than
980 * the buffered output data if the socket would block. Returns
981 * -1 on error, and disconnects the client socket.
982 */
983 static long vnc_client_write_plain(VncState *vs)
984 {
985 long ret;
986
987 #ifdef CONFIG_VNC_SASL
988 VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n",
989 vs->output.buffer, vs->output.capacity, vs->output.offset,
990 vs->sasl.waitWriteSSF);
991
992 if (vs->sasl.conn &&
993 vs->sasl.runSSF &&
994 vs->sasl.waitWriteSSF) {
995 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF);
996 if (ret)
997 vs->sasl.waitWriteSSF -= ret;
998 } else
999 #endif /* CONFIG_VNC_SASL */
1000 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset);
1001 if (!ret)
1002 return 0;
1003
1004 memmove(vs->output.buffer, vs->output.buffer + ret, (vs->output.offset - ret));
1005 vs->output.offset -= ret;
1006
1007 if (vs->output.offset == 0) {
1008 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
1009 }
1010
1011 return ret;
1012 }
1013
1014
1015 /*
1016 * First function called whenever there is data to be written to
1017 * the client socket. Will delegate actual work according to whether
1018 * SASL SSF layers are enabled (thus requiring encryption calls)
1019 */
1020 void vnc_client_write(void *opaque)
1021 {
1022 long ret;
1023 VncState *vs = opaque;
1024
1025 #ifdef CONFIG_VNC_SASL
1026 if (vs->sasl.conn &&
1027 vs->sasl.runSSF &&
1028 !vs->sasl.waitWriteSSF)
1029 ret = vnc_client_write_sasl(vs);
1030 else
1031 #endif /* CONFIG_VNC_SASL */
1032 ret = vnc_client_write_plain(vs);
1033 }
1034
1035 void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting)
1036 {
1037 vs->read_handler = func;
1038 vs->read_handler_expect = expecting;
1039 }
1040
1041
1042 /*
1043 * Called to read a chunk of data from the client socket. The data may
1044 * be the raw data, or may need to be further decoded by SASL.
1045 * The data will be read either straight from to the socket, or
1046 * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1047 *
1048 * NB, it is theoretically possible to have 2 layers of encryption,
1049 * both SASL, and this TLS layer. It is highly unlikely in practice
1050 * though, since SASL encryption will typically be a no-op if TLS
1051 * is active
1052 *
1053 * Returns the number of bytes read, which may be less than
1054 * the requested 'datalen' if the socket would block. Returns
1055 * -1 on error, and disconnects the client socket.
1056 */
1057 long vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen)
1058 {
1059 long ret;
1060 #ifdef CONFIG_VNC_TLS
1061 if (vs->tls.session) {
1062 ret = gnutls_read(vs->tls.session, data, datalen);
1063 if (ret < 0) {
1064 if (ret == GNUTLS_E_AGAIN)
1065 errno = EAGAIN;
1066 else
1067 errno = EIO;
1068 ret = -1;
1069 }
1070 } else
1071 #endif /* CONFIG_VNC_TLS */
1072 ret = recv(vs->csock, data, datalen, 0);
1073 VNC_DEBUG("Read wire %p %zd -> %ld\n", data, datalen, ret);
1074 return vnc_client_io_error(vs, ret, socket_error());
1075 }
1076
1077
1078 /*
1079 * Called to read data from the client socket to the input buffer,
1080 * when not using any SASL SSF encryption layers. Will read as much
1081 * data as possible without blocking.
1082 *
1083 * Returns the number of bytes read. Returns -1 on error, and
1084 * disconnects the client socket.
1085 */
1086 static long vnc_client_read_plain(VncState *vs)
1087 {
1088 int ret;
1089 VNC_DEBUG("Read plain %p size %zd offset %zd\n",
1090 vs->input.buffer, vs->input.capacity, vs->input.offset);
1091 buffer_reserve(&vs->input, 4096);
1092 ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096);
1093 if (!ret)
1094 return 0;
1095 vs->input.offset += ret;
1096 return ret;
1097 }
1098
1099
1100 /*
1101 * First function called whenever there is more data to be read from
1102 * the client socket. Will delegate actual work according to whether
1103 * SASL SSF layers are enabled (thus requiring decryption calls)
1104 */
1105 void vnc_client_read(void *opaque)
1106 {
1107 VncState *vs = opaque;
1108 long ret;
1109
1110 #ifdef CONFIG_VNC_SASL
1111 if (vs->sasl.conn && vs->sasl.runSSF)
1112 ret = vnc_client_read_sasl(vs);
1113 else
1114 #endif /* CONFIG_VNC_SASL */
1115 ret = vnc_client_read_plain(vs);
1116 if (!ret)
1117 return;
1118
1119 while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) {
1120 size_t len = vs->read_handler_expect;
1121 int ret;
1122
1123 ret = vs->read_handler(vs, vs->input.buffer, len);
1124 if (vs->csock == -1)
1125 return;
1126
1127 if (!ret) {
1128 memmove(vs->input.buffer, vs->input.buffer + len, (vs->input.offset - len));
1129 vs->input.offset -= len;
1130 } else {
1131 vs->read_handler_expect = ret;
1132 }
1133 }
1134 }
1135
1136 void vnc_write(VncState *vs, const void *data, size_t len)
1137 {
1138 buffer_reserve(&vs->output, len);
1139
1140 if (buffer_empty(&vs->output)) {
1141 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, vnc_client_write, vs);
1142 }
1143
1144 buffer_append(&vs->output, data, len);
1145 }
1146
1147 void vnc_write_s32(VncState *vs, int32_t value)
1148 {
1149 vnc_write_u32(vs, *(uint32_t *)&value);
1150 }
1151
1152 void vnc_write_u32(VncState *vs, uint32_t value)
1153 {
1154 uint8_t buf[4];
1155
1156 buf[0] = (value >> 24) & 0xFF;
1157 buf[1] = (value >> 16) & 0xFF;
1158 buf[2] = (value >> 8) & 0xFF;
1159 buf[3] = value & 0xFF;
1160
1161 vnc_write(vs, buf, 4);
1162 }
1163
1164 void vnc_write_u16(VncState *vs, uint16_t value)
1165 {
1166 uint8_t buf[2];
1167
1168 buf[0] = (value >> 8) & 0xFF;
1169 buf[1] = value & 0xFF;
1170
1171 vnc_write(vs, buf, 2);
1172 }
1173
1174 void vnc_write_u8(VncState *vs, uint8_t value)
1175 {
1176 vnc_write(vs, (char *)&value, 1);
1177 }
1178
1179 void vnc_flush(VncState *vs)
1180 {
1181 if (vs->output.offset)
1182 vnc_client_write(vs);
1183 }
1184
1185 uint8_t read_u8(uint8_t *data, size_t offset)
1186 {
1187 return data[offset];
1188 }
1189
1190 uint16_t read_u16(uint8_t *data, size_t offset)
1191 {
1192 return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF);
1193 }
1194
1195 int32_t read_s32(uint8_t *data, size_t offset)
1196 {
1197 return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) |
1198 (data[offset + 2] << 8) | data[offset + 3]);
1199 }
1200
1201 uint32_t read_u32(uint8_t *data, size_t offset)
1202 {
1203 return ((data[offset] << 24) | (data[offset + 1] << 16) |
1204 (data[offset + 2] << 8) | data[offset + 3]);
1205 }
1206
1207 static void client_cut_text(VncState *vs, size_t len, uint8_t *text)
1208 {
1209 }
1210
1211 static void check_pointer_type_change(VncState *vs, int absolute)
1212 {
1213 if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) {
1214 vnc_write_u8(vs, 0);
1215 vnc_write_u8(vs, 0);
1216 vnc_write_u16(vs, 1);
1217 vnc_framebuffer_update(vs, absolute, 0,
1218 ds_get_width(vs->ds), ds_get_height(vs->ds),
1219 VNC_ENCODING_POINTER_TYPE_CHANGE);
1220 vnc_flush(vs);
1221 }
1222 vs->absolute = absolute;
1223 }
1224
1225 static void pointer_event(VncState *vs, int button_mask, int x, int y)
1226 {
1227 int buttons = 0;
1228 int dz = 0;
1229
1230 if (button_mask & 0x01)
1231 buttons |= MOUSE_EVENT_LBUTTON;
1232 if (button_mask & 0x02)
1233 buttons |= MOUSE_EVENT_MBUTTON;
1234 if (button_mask & 0x04)
1235 buttons |= MOUSE_EVENT_RBUTTON;
1236 if (button_mask & 0x08)
1237 dz = -1;
1238 if (button_mask & 0x10)
1239 dz = 1;
1240
1241 if (vs->absolute) {
1242 kbd_mouse_event(x * 0x7FFF / (ds_get_width(vs->ds) - 1),
1243 y * 0x7FFF / (ds_get_height(vs->ds) - 1),
1244 dz, buttons);
1245 } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) {
1246 x -= 0x7FFF;
1247 y -= 0x7FFF;
1248
1249 kbd_mouse_event(x, y, dz, buttons);
1250 } else {
1251 if (vs->last_x != -1)
1252 kbd_mouse_event(x - vs->last_x,
1253 y - vs->last_y,
1254 dz, buttons);
1255 vs->last_x = x;
1256 vs->last_y = y;
1257 }
1258
1259 check_pointer_type_change(vs, kbd_mouse_is_absolute());
1260 }
1261
1262 static void reset_keys(VncState *vs)
1263 {
1264 int i;
1265 for(i = 0; i < 256; i++) {
1266 if (vs->modifiers_state[i]) {
1267 if (i & 0x80)
1268 kbd_put_keycode(0xe0);
1269 kbd_put_keycode(i | 0x80);
1270 vs->modifiers_state[i] = 0;
1271 }
1272 }
1273 }
1274
1275 static void press_key(VncState *vs, int keysym)
1276 {
1277 kbd_put_keycode(keysym2scancode(vs->vd->kbd_layout, keysym) & 0x7f);
1278 kbd_put_keycode(keysym2scancode(vs->vd->kbd_layout, keysym) | 0x80);
1279 }
1280
1281 static void do_key_event(VncState *vs, int down, int keycode, int sym)
1282 {
1283 /* QEMU console switch */
1284 switch(keycode) {
1285 case 0x2a: /* Left Shift */
1286 case 0x36: /* Right Shift */
1287 case 0x1d: /* Left CTRL */
1288 case 0x9d: /* Right CTRL */
1289 case 0x38: /* Left ALT */
1290 case 0xb8: /* Right ALT */
1291 if (down)
1292 vs->modifiers_state[keycode] = 1;
1293 else
1294 vs->modifiers_state[keycode] = 0;
1295 break;
1296 case 0x02 ... 0x0a: /* '1' to '9' keys */
1297 if (down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) {
1298 /* Reset the modifiers sent to the current console */
1299 reset_keys(vs);
1300 console_select(keycode - 0x02);
1301 return;
1302 }
1303 break;
1304 case 0x3a: /* CapsLock */
1305 case 0x45: /* NumLock */
1306 if (!down)
1307 vs->modifiers_state[keycode] ^= 1;
1308 break;
1309 }
1310
1311 if (keycode_is_keypad(vs->vd->kbd_layout, keycode)) {
1312 /* If the numlock state needs to change then simulate an additional
1313 keypress before sending this one. This will happen if the user
1314 toggles numlock away from the VNC window.
1315 */
1316 if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) {
1317 if (!vs->modifiers_state[0x45]) {
1318 vs->modifiers_state[0x45] = 1;
1319 press_key(vs, 0xff7f);
1320 }
1321 } else {
1322 if (vs->modifiers_state[0x45]) {
1323 vs->modifiers_state[0x45] = 0;
1324 press_key(vs, 0xff7f);
1325 }
1326 }
1327 }
1328
1329 if (is_graphic_console()) {
1330 if (keycode & 0x80)
1331 kbd_put_keycode(0xe0);
1332 if (down)
1333 kbd_put_keycode(keycode & 0x7f);
1334 else
1335 kbd_put_keycode(keycode | 0x80);
1336 } else {
1337 /* QEMU console emulation */
1338 if (down) {
1339 switch (keycode) {
1340 case 0x2a: /* Left Shift */
1341 case 0x36: /* Right Shift */
1342 case 0x1d: /* Left CTRL */
1343 case 0x9d: /* Right CTRL */
1344 case 0x38: /* Left ALT */
1345 case 0xb8: /* Right ALT */
1346 break;
1347 case 0xc8:
1348 kbd_put_keysym(QEMU_KEY_UP);
1349 break;
1350 case 0xd0:
1351 kbd_put_keysym(QEMU_KEY_DOWN);
1352 break;
1353 case 0xcb:
1354 kbd_put_keysym(QEMU_KEY_LEFT);
1355 break;
1356 case 0xcd:
1357 kbd_put_keysym(QEMU_KEY_RIGHT);
1358 break;
1359 case 0xd3:
1360 kbd_put_keysym(QEMU_KEY_DELETE);
1361 break;
1362 case 0xc7:
1363 kbd_put_keysym(QEMU_KEY_HOME);
1364 break;
1365 case 0xcf:
1366 kbd_put_keysym(QEMU_KEY_END);
1367 break;
1368 case 0xc9:
1369 kbd_put_keysym(QEMU_KEY_PAGEUP);
1370 break;
1371 case 0xd1:
1372 kbd_put_keysym(QEMU_KEY_PAGEDOWN);
1373 break;
1374 default:
1375 kbd_put_keysym(sym);
1376 break;
1377 }
1378 }
1379 }
1380 }
1381
1382 static void key_event(VncState *vs, int down, uint32_t sym)
1383 {
1384 int keycode;
1385
1386 if (sym >= 'A' && sym <= 'Z' && is_graphic_console())
1387 sym = sym - 'A' + 'a';
1388
1389 keycode = keysym2scancode(vs->vd->kbd_layout, sym & 0xFFFF);
1390 do_key_event(vs, down, keycode, sym);
1391 }
1392
1393 static void ext_key_event(VncState *vs, int down,
1394 uint32_t sym, uint16_t keycode)
1395 {
1396 /* if the user specifies a keyboard layout, always use it */
1397 if (keyboard_layout)
1398 key_event(vs, down, sym);
1399 else
1400 do_key_event(vs, down, keycode, sym);
1401 }
1402
1403 static void framebuffer_update_request(VncState *vs, int incremental,
1404 int x_position, int y_position,
1405 int w, int h)
1406 {
1407 if (x_position > ds_get_width(vs->ds))
1408 x_position = ds_get_width(vs->ds);
1409 if (y_position > ds_get_height(vs->ds))
1410 y_position = ds_get_height(vs->ds);
1411 if (x_position + w >= ds_get_width(vs->ds))
1412 w = ds_get_width(vs->ds) - x_position;
1413 if (y_position + h >= ds_get_height(vs->ds))
1414 h = ds_get_height(vs->ds) - y_position;
1415
1416 int i;
1417 vs->need_update = 1;
1418 vs->force_update = 1;
1419 if (!incremental) {
1420 for (i = 0; i < h; i++) {
1421 vnc_set_bits(vs->guest.dirty[y_position + i],
1422 (ds_get_width(vs->ds) / 16), VNC_DIRTY_WORDS);
1423 vnc_set_bits(vs->server.dirty[y_position + i],
1424 (ds_get_width(vs->ds) / 16), VNC_DIRTY_WORDS);
1425 }
1426 }
1427 }
1428
1429 static void send_ext_key_event_ack(VncState *vs)
1430 {
1431 vnc_write_u8(vs, 0);
1432 vnc_write_u8(vs, 0);
1433 vnc_write_u16(vs, 1);
1434 vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
1435 VNC_ENCODING_EXT_KEY_EVENT);
1436 vnc_flush(vs);
1437 }
1438
1439 static void send_ext_audio_ack(VncState *vs)
1440 {
1441 vnc_write_u8(vs, 0);
1442 vnc_write_u8(vs, 0);
1443 vnc_write_u16(vs, 1);
1444 vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
1445 VNC_ENCODING_AUDIO);
1446 vnc_flush(vs);
1447 }
1448
1449 static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
1450 {
1451 int i;
1452 unsigned int enc = 0;
1453
1454 vnc_zlib_init(vs);
1455 vs->features = 0;
1456 vs->vnc_encoding = 0;
1457 vs->tight_compression = 9;
1458 vs->tight_quality = 9;
1459 vs->absolute = -1;
1460
1461 for (i = n_encodings - 1; i >= 0; i--) {
1462 enc = encodings[i];
1463 switch (enc) {
1464 case VNC_ENCODING_RAW:
1465 vs->vnc_encoding = enc;
1466 break;
1467 case VNC_ENCODING_COPYRECT:
1468 vs->features |= VNC_FEATURE_COPYRECT_MASK;
1469 break;
1470 case VNC_ENCODING_HEXTILE:
1471 vs->features |= VNC_FEATURE_HEXTILE_MASK;
1472 vs->vnc_encoding = enc;
1473 break;
1474 case VNC_ENCODING_ZLIB:
1475 vs->features |= VNC_FEATURE_ZLIB_MASK;
1476 vs->vnc_encoding = enc;
1477 break;
1478 case VNC_ENCODING_DESKTOPRESIZE:
1479 vs->features |= VNC_FEATURE_RESIZE_MASK;
1480 break;
1481 case VNC_ENCODING_POINTER_TYPE_CHANGE:
1482 vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK;
1483 break;
1484 case VNC_ENCODING_EXT_KEY_EVENT:
1485 send_ext_key_event_ack(vs);
1486 break;
1487 case VNC_ENCODING_AUDIO:
1488 send_ext_audio_ack(vs);
1489 break;
1490 case VNC_ENCODING_WMVi:
1491 vs->features |= VNC_FEATURE_WMVI_MASK;
1492 break;
1493 case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9:
1494 vs->tight_compression = (enc & 0x0F);
1495 break;
1496 case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9:
1497 vs->tight_quality = (enc & 0x0F);
1498 break;
1499 default:
1500 VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc);
1501 break;
1502 }
1503 }
1504
1505 check_pointer_type_change(vs, kbd_mouse_is_absolute());
1506 }
1507
1508 static void set_pixel_conversion(VncState *vs)
1509 {
1510 if ((vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) ==
1511 (vs->ds->surface->flags & QEMU_BIG_ENDIAN_FLAG) &&
1512 !memcmp(&(vs->clientds.pf), &(vs->ds->surface->pf), sizeof(PixelFormat))) {
1513 vs->write_pixels = vnc_write_pixels_copy;
1514 switch (vs->ds->surface->pf.bits_per_pixel) {
1515 case 8:
1516 vs->send_hextile_tile = send_hextile_tile_8;
1517 break;
1518 case 16:
1519 vs->send_hextile_tile = send_hextile_tile_16;
1520 break;
1521 case 32:
1522 vs->send_hextile_tile = send_hextile_tile_32;
1523 break;
1524 }
1525 } else {
1526 vs->write_pixels = vnc_write_pixels_generic;
1527 switch (vs->ds->surface->pf.bits_per_pixel) {
1528 case 8:
1529 vs->send_hextile_tile = send_hextile_tile_generic_8;
1530 break;
1531 case 16:
1532 vs->send_hextile_tile = send_hextile_tile_generic_16;
1533 break;
1534 case 32:
1535 vs->send_hextile_tile = send_hextile_tile_generic_32;
1536 break;
1537 }
1538 }
1539 }
1540
1541 static void set_pixel_format(VncState *vs,
1542 int bits_per_pixel, int depth,
1543 int big_endian_flag, int true_color_flag,
1544 int red_max, int green_max, int blue_max,
1545 int red_shift, int green_shift, int blue_shift)
1546 {
1547 if (!true_color_flag) {
1548 vnc_client_error(vs);
1549 return;
1550 }
1551
1552 vs->clientds = *(vs->guest.ds);
1553 vs->clientds.pf.rmax = red_max;
1554 count_bits(vs->clientds.pf.rbits, red_max);
1555 vs->clientds.pf.rshift = red_shift;
1556 vs->clientds.pf.rmask = red_max << red_shift;
1557 vs->clientds.pf.gmax = green_max;
1558 count_bits(vs->clientds.pf.gbits, green_max);
1559 vs->clientds.pf.gshift = green_shift;
1560 vs->clientds.pf.gmask = green_max << green_shift;
1561 vs->clientds.pf.bmax = blue_max;
1562 count_bits(vs->clientds.pf.bbits, blue_max);
1563 vs->clientds.pf.bshift = blue_shift;
1564 vs->clientds.pf.bmask = blue_max << blue_shift;
1565 vs->clientds.pf.bits_per_pixel = bits_per_pixel;
1566 vs->clientds.pf.bytes_per_pixel = bits_per_pixel / 8;
1567 vs->clientds.pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;
1568 vs->clientds.flags = big_endian_flag ? QEMU_BIG_ENDIAN_FLAG : 0x00;
1569
1570 set_pixel_conversion(vs);
1571
1572 vga_hw_invalidate();
1573 vga_hw_update();
1574 }
1575
1576 static void pixel_format_message (VncState *vs) {
1577 char pad[3] = { 0, 0, 0 };
1578
1579 vnc_write_u8(vs, vs->ds->surface->pf.bits_per_pixel); /* bits-per-pixel */
1580 vnc_write_u8(vs, vs->ds->surface->pf.depth); /* depth */
1581
1582 #ifdef WORDS_BIGENDIAN
1583 vnc_write_u8(vs, 1); /* big-endian-flag */
1584 #else
1585 vnc_write_u8(vs, 0); /* big-endian-flag */
1586 #endif
1587 vnc_write_u8(vs, 1); /* true-color-flag */
1588 vnc_write_u16(vs, vs->ds->surface->pf.rmax); /* red-max */
1589 vnc_write_u16(vs, vs->ds->surface->pf.gmax); /* green-max */
1590 vnc_write_u16(vs, vs->ds->surface->pf.bmax); /* blue-max */
1591 vnc_write_u8(vs, vs->ds->surface->pf.rshift); /* red-shift */
1592 vnc_write_u8(vs, vs->ds->surface->pf.gshift); /* green-shift */
1593 vnc_write_u8(vs, vs->ds->surface->pf.bshift); /* blue-shift */
1594 if (vs->ds->surface->pf.bits_per_pixel == 32)
1595 vs->send_hextile_tile = send_hextile_tile_32;
1596 else if (vs->ds->surface->pf.bits_per_pixel == 16)
1597 vs->send_hextile_tile = send_hextile_tile_16;
1598 else if (vs->ds->surface->pf.bits_per_pixel == 8)
1599 vs->send_hextile_tile = send_hextile_tile_8;
1600 vs->clientds = *(vs->ds->surface);
1601 vs->clientds.flags &= ~QEMU_ALLOCATED_FLAG;
1602 vs->write_pixels = vnc_write_pixels_copy;
1603
1604 vnc_write(vs, pad, 3); /* padding */
1605 }
1606
1607 static void vnc_dpy_setdata(DisplayState *ds)
1608 {
1609 /* We don't have to do anything */
1610 }
1611
1612 static void vnc_colordepth(VncState *vs)
1613 {
1614 if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) {
1615 /* Sending a WMVi message to notify the client*/
1616 vnc_write_u8(vs, 0); /* msg id */
1617 vnc_write_u8(vs, 0);
1618 vnc_write_u16(vs, 1); /* number of rects */
1619 vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds),
1620 ds_get_height(vs->ds), VNC_ENCODING_WMVi);
1621 pixel_format_message(vs);
1622 vnc_flush(vs);
1623 } else {
1624 set_pixel_conversion(vs);
1625 }
1626 }
1627
1628 static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
1629 {
1630 int i;
1631 uint16_t limit;
1632
1633 switch (data[0]) {
1634 case 0:
1635 if (len == 1)
1636 return 20;
1637
1638 set_pixel_format(vs, read_u8(data, 4), read_u8(data, 5),
1639 read_u8(data, 6), read_u8(data, 7),
1640 read_u16(data, 8), read_u16(data, 10),
1641 read_u16(data, 12), read_u8(data, 14),
1642 read_u8(data, 15), read_u8(data, 16));
1643 break;
1644 case 2:
1645 if (len == 1)
1646 return 4;
1647
1648 if (len == 4) {
1649 limit = read_u16(data, 2);
1650 if (limit > 0)
1651 return 4 + (limit * 4);
1652 } else
1653 limit = read_u16(data, 2);
1654
1655 for (i = 0; i < limit; i++) {
1656 int32_t val = read_s32(data, 4 + (i * 4));
1657 memcpy(data + 4 + (i * 4), &val, sizeof(val));
1658 }
1659
1660 set_encodings(vs, (int32_t *)(data + 4), limit);
1661 break;
1662 case 3:
1663 if (len == 1)
1664 return 10;
1665
1666 framebuffer_update_request(vs,
1667 read_u8(data, 1), read_u16(data, 2), read_u16(data, 4),
1668 read_u16(data, 6), read_u16(data, 8));
1669 break;
1670 case 4:
1671 if (len == 1)
1672 return 8;
1673
1674 key_event(vs, read_u8(data, 1), read_u32(data, 4));
1675 break;
1676 case 5:
1677 if (len == 1)
1678 return 6;
1679
1680 pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
1681 break;
1682 case 6:
1683 if (len == 1)
1684 return 8;
1685
1686 if (len == 8) {
1687 uint32_t dlen = read_u32(data, 4);
1688 if (dlen > 0)
1689 return 8 + dlen;
1690 }
1691
1692 client_cut_text(vs, read_u32(data, 4), data + 8);
1693 break;
1694 case 255:
1695 if (len == 1)
1696 return 2;
1697
1698 switch (read_u8(data, 1)) {
1699 case 0:
1700 if (len == 2)
1701 return 12;
1702
1703 ext_key_event(vs, read_u16(data, 2),
1704 read_u32(data, 4), read_u32(data, 8));
1705 break;
1706 case 1:
1707 if (len == 2)
1708 return 4;
1709
1710 switch (read_u16 (data, 2)) {
1711 case 0:
1712 audio_add(vs);
1713 break;
1714 case 1:
1715 audio_del(vs);
1716 break;
1717 case 2:
1718 if (len == 4)
1719 return 10;
1720 switch (read_u8(data, 4)) {
1721 case 0: vs->as.fmt = AUD_FMT_U8; break;
1722 case 1: vs->as.fmt = AUD_FMT_S8; break;
1723 case 2: vs->as.fmt = AUD_FMT_U16; break;
1724 case 3: vs->as.fmt = AUD_FMT_S16; break;
1725 case 4: vs->as.fmt = AUD_FMT_U32; break;
1726 case 5: vs->as.fmt = AUD_FMT_S32; break;
1727 default:
1728 printf("Invalid audio format %d\n", read_u8(data, 4));
1729 vnc_client_error(vs);
1730 break;
1731 }
1732 vs->as.nchannels = read_u8(data, 5);
1733 if (vs->as.nchannels != 1 && vs->as.nchannels != 2) {
1734 printf("Invalid audio channel coount %d\n",
1735 read_u8(data, 5));
1736 vnc_client_error(vs);
1737 break;
1738 }
1739 vs->as.freq = read_u32(data, 6);
1740 break;
1741 default:
1742 printf ("Invalid audio message %d\n", read_u8(data, 4));
1743 vnc_client_error(vs);
1744 break;
1745 }
1746 break;
1747
1748 default:
1749 printf("Msg: %d\n", read_u16(data, 0));
1750 vnc_client_error(vs);
1751 break;
1752 }
1753 break;
1754 default:
1755 printf("Msg: %d\n", data[0]);
1756 vnc_client_error(vs);
1757 break;
1758 }
1759
1760 vnc_read_when(vs, protocol_client_msg, 1);
1761 return 0;
1762 }
1763
1764 static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
1765 {
1766 char buf[1024];
1767 int size;
1768
1769 vnc_write_u16(vs, ds_get_width(vs->ds));
1770 vnc_write_u16(vs, ds_get_height(vs->ds));
1771
1772 pixel_format_message(vs);
1773
1774 if (qemu_name)
1775 size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
1776 else
1777 size = snprintf(buf, sizeof(buf), "QEMU");
1778
1779 vnc_write_u32(vs, size);
1780 vnc_write(vs, buf, size);
1781 vnc_flush(vs);
1782
1783 vnc_read_when(vs, protocol_client_msg, 1);
1784
1785 return 0;
1786 }
1787
1788 void start_client_init(VncState *vs)
1789 {
1790 vnc_read_when(vs, protocol_client_init, 1);
1791 }
1792
1793 static void make_challenge(VncState *vs)
1794 {
1795 int i;
1796
1797 srand(time(NULL)+getpid()+getpid()*987654+rand());
1798
1799 for (i = 0 ; i < sizeof(vs->challenge) ; i++)
1800 vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
1801 }
1802
1803 static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
1804 {
1805 unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
1806 int i, j, pwlen;
1807 unsigned char key[8];
1808
1809 if (!vs->vd->password || !vs->vd->password[0]) {
1810 VNC_DEBUG("No password configured on server");
1811 vnc_write_u32(vs, 1); /* Reject auth */
1812 if (vs->minor >= 8) {
1813 static const char err[] = "Authentication failed";
1814 vnc_write_u32(vs, sizeof(err));
1815 vnc_write(vs, err, sizeof(err));
1816 }
1817 vnc_flush(vs);
1818 vnc_client_error(vs);
1819 return 0;
1820 }
1821
1822 memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
1823
1824 /* Calculate the expected challenge response */
1825 pwlen = strlen(vs->vd->password);
1826 for (i=0; i<sizeof(key); i++)
1827 key[i] = i<pwlen ? vs->vd->password[i] : 0;
1828 deskey(key, EN0);
1829 for (j = 0; j < VNC_AUTH_CHALLENGE_SIZE; j += 8)
1830 des(response+j, response+j);
1831
1832 /* Compare expected vs actual challenge response */
1833 if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) {
1834 VNC_DEBUG("Client challenge reponse did not match\n");
1835 vnc_write_u32(vs, 1); /* Reject auth */
1836 if (vs->minor >= 8) {
1837 static const char err[] = "Authentication failed";
1838 vnc_write_u32(vs, sizeof(err));
1839 vnc_write(vs, err, sizeof(err));
1840 }
1841 vnc_flush(vs);
1842 vnc_client_error(vs);
1843 } else {
1844 VNC_DEBUG("Accepting VNC challenge response\n");
1845 vnc_write_u32(vs, 0); /* Accept auth */
1846 vnc_flush(vs);
1847
1848 start_client_init(vs);
1849 }
1850 return 0;
1851 }
1852
1853 void start_auth_vnc(VncState *vs)
1854 {
1855 make_challenge(vs);
1856 /* Send client a 'random' challenge */
1857 vnc_write(vs, vs->challenge, sizeof(vs->challenge));
1858 vnc_flush(vs);
1859
1860 vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge));
1861 }
1862
1863
1864 static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
1865 {
1866 /* We only advertise 1 auth scheme at a time, so client
1867 * must pick the one we sent. Verify this */
1868 if (data[0] != vs->vd->auth) { /* Reject auth */
1869 VNC_DEBUG("Reject auth %d because it didn't match advertized\n", (int)data[0]);
1870 vnc_write_u32(vs, 1);
1871 if (vs->minor >= 8) {
1872 static const char err[] = "Authentication failed";
1873 vnc_write_u32(vs, sizeof(err));
1874 vnc_write(vs, err, sizeof(err));
1875 }
1876 vnc_client_error(vs);
1877 } else { /* Accept requested auth */
1878 VNC_DEBUG("Client requested auth %d\n", (int)data[0]);
1879 switch (vs->vd->auth) {
1880 case VNC_AUTH_NONE:
1881 VNC_DEBUG("Accept auth none\n");
1882 if (vs->minor >= 8) {
1883 vnc_write_u32(vs, 0); /* Accept auth completion */
1884 vnc_flush(vs);
1885 }
1886 start_client_init(vs);
1887 break;
1888
1889 case VNC_AUTH_VNC:
1890 VNC_DEBUG("Start VNC auth\n");
1891 start_auth_vnc(vs);
1892 break;
1893
1894 #ifdef CONFIG_VNC_TLS
1895 case VNC_AUTH_VENCRYPT:
1896 VNC_DEBUG("Accept VeNCrypt auth\n");;
1897 start_auth_vencrypt(vs);
1898 break;
1899 #endif /* CONFIG_VNC_TLS */
1900
1901 #ifdef CONFIG_VNC_SASL
1902 case VNC_AUTH_SASL:
1903 VNC_DEBUG("Accept SASL auth\n");
1904 start_auth_sasl(vs);
1905 break;
1906 #endif /* CONFIG_VNC_SASL */
1907
1908 default: /* Should not be possible, but just in case */
1909 VNC_DEBUG("Reject auth %d server code bug\n", vs->vd->auth);
1910 vnc_write_u8(vs, 1);
1911 if (vs->minor >= 8) {
1912 static const char err[] = "Authentication failed";
1913 vnc_write_u32(vs, sizeof(err));
1914 vnc_write(vs, err, sizeof(err));
1915 }
1916 vnc_client_error(vs);
1917 }
1918 }
1919 return 0;
1920 }
1921
1922 static int protocol_version(VncState *vs, uint8_t *version, size_t len)
1923 {
1924 char local[13];
1925
1926 memcpy(local, version, 12);
1927 local[12] = 0;
1928
1929 if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) {
1930 VNC_DEBUG("Malformed protocol version %s\n", local);
1931 vnc_client_error(vs);
1932 return 0;
1933 }
1934 VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor);
1935 if (vs->major != 3 ||
1936 (vs->minor != 3 &&
1937 vs->minor != 4 &&
1938 vs->minor != 5 &&
1939 vs->minor != 7 &&
1940 vs->minor != 8)) {
1941 VNC_DEBUG("Unsupported client version\n");
1942 vnc_write_u32(vs, VNC_AUTH_INVALID);
1943 vnc_flush(vs);
1944 vnc_client_error(vs);
1945 return 0;
1946 }
1947 /* Some broken clients report v3.4 or v3.5, which spec requires to be treated
1948 * as equivalent to v3.3 by servers
1949 */
1950 if (vs->minor == 4 || vs->minor == 5)
1951 vs->minor = 3;
1952
1953 if (vs->minor == 3) {
1954 if (vs->vd->auth == VNC_AUTH_NONE) {
1955 VNC_DEBUG("Tell client auth none\n");
1956 vnc_write_u32(vs, vs->vd->auth);
1957 vnc_flush(vs);
1958 start_client_init(vs);
1959 } else if (vs->vd->auth == VNC_AUTH_VNC) {
1960 VNC_DEBUG("Tell client VNC auth\n");
1961 vnc_write_u32(vs, vs->vd->auth);
1962 vnc_flush(vs);
1963 start_auth_vnc(vs);
1964 } else {
1965 VNC_DEBUG("Unsupported auth %d for protocol 3.3\n", vs->vd->auth);
1966 vnc_write_u32(vs, VNC_AUTH_INVALID);
1967 vnc_flush(vs);
1968 vnc_client_error(vs);
1969 }
1970 } else {
1971 VNC_DEBUG("Telling client we support auth %d\n", vs->vd->auth);
1972 vnc_write_u8(vs, 1); /* num auth */
1973 vnc_write_u8(vs, vs->vd->auth);
1974 vnc_read_when(vs, protocol_client_auth, 1);
1975 vnc_flush(vs);
1976 }
1977
1978 return 0;
1979 }
1980
1981 static void vnc_connect(VncDisplay *vd, int csock)
1982 {
1983 VncState *vs = qemu_mallocz(sizeof(VncState));
1984 vs->csock = csock;
1985
1986 VNC_DEBUG("New client on socket %d\n", csock);
1987 dcl->idle = 0;
1988 socket_set_nonblock(vs->csock);
1989 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
1990
1991 vs->vd = vd;
1992 vs->ds = vd->ds;
1993 vs->timer = qemu_new_timer(rt_clock, vnc_update_client, vs);
1994 vs->last_x = -1;
1995 vs->last_y = -1;
1996
1997 vs->as.freq = 44100;
1998 vs->as.nchannels = 2;
1999 vs->as.fmt = AUD_FMT_S16;
2000 vs->as.endianness = 0;
2001
2002 vnc_resize(vs);
2003 vnc_write(vs, "RFB 003.008\n", 12);
2004 vnc_flush(vs);
2005 vnc_read_when(vs, protocol_version, 12);
2006 vnc_update_client(vs);
2007 reset_keys(vs);
2008
2009 vs->next = vd->clients;
2010 vd->clients = vs;
2011 }
2012
2013 static void vnc_listen_read(void *opaque)
2014 {
2015 VncDisplay *vs = opaque;
2016 struct sockaddr_in addr;
2017 socklen_t addrlen = sizeof(addr);
2018
2019 /* Catch-up */
2020 vga_hw_update();
2021
2022 int csock = accept(vs->lsock, (struct sockaddr *)&addr, &addrlen);
2023 if (csock != -1) {
2024 vnc_connect(vs, csock);
2025 }
2026 }
2027
2028 void vnc_display_init(DisplayState *ds)
2029 {
2030 VncDisplay *vs;
2031
2032 vs = qemu_mallocz(sizeof(VncState));
2033 dcl = qemu_mallocz(sizeof(DisplayChangeListener));
2034
2035 ds->opaque = vs;
2036 dcl->idle = 1;
2037 vnc_display = vs;
2038
2039 vs->lsock = -1;
2040
2041 vs->ds = ds;
2042
2043 if (keyboard_layout)
2044 vs->kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout);
2045 else
2046 vs->kbd_layout = init_keyboard_layout(name2keysym, "en-us");
2047
2048 if (!vs->kbd_layout)
2049 exit(1);
2050
2051 dcl->dpy_copy = vnc_dpy_copy;
2052 dcl->dpy_update = vnc_dpy_update;
2053 dcl->dpy_resize = vnc_dpy_resize;
2054 dcl->dpy_setdata = vnc_dpy_setdata;
2055 register_displaychangelistener(ds, dcl);
2056 }
2057
2058
2059 void vnc_display_close(DisplayState *ds)
2060 {
2061 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2062
2063 if (!vs)
2064 return;
2065 if (vs->display) {
2066 qemu_free(vs->display);
2067 vs->display = NULL;
2068 }
2069 if (vs->lsock != -1) {
2070 qemu_set_fd_handler2(vs->lsock, NULL, NULL, NULL, NULL);
2071 close(vs->lsock);
2072 vs->lsock = -1;
2073 }
2074 vs->auth = VNC_AUTH_INVALID;
2075 #ifdef CONFIG_VNC_TLS
2076 vs->subauth = VNC_AUTH_INVALID;
2077 vs->tls.x509verify = 0;
2078 #endif
2079 }
2080
2081 int vnc_display_password(DisplayState *ds, const char *password)
2082 {
2083 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2084
2085 if (vs->password) {
2086 qemu_free(vs->password);
2087 vs->password = NULL;
2088 }
2089 if (password && password[0]) {
2090 if (!(vs->password = qemu_strdup(password)))
2091 return -1;
2092 }
2093
2094 return 0;
2095 }
2096
2097 int vnc_display_open(DisplayState *ds, const char *display)
2098 {
2099 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2100 const char *options;
2101 int password = 0;
2102 int reverse = 0;
2103 int to_port = 0;
2104 #ifdef CONFIG_VNC_TLS
2105 int tls = 0, x509 = 0;
2106 #endif
2107 #ifdef CONFIG_VNC_SASL
2108 int sasl = 0;
2109 int saslErr;
2110 #endif
2111 int acl = 0;
2112
2113 if (!vnc_display)
2114 return -1;
2115 vnc_display_close(ds);
2116 if (strcmp(display, "none") == 0)
2117 return 0;
2118
2119 if (!(vs->display = strdup(display)))
2120 return -1;
2121
2122 options = display;
2123 while ((options = strchr(options, ','))) {
2124 options++;
2125 if (strncmp(options, "password", 8) == 0) {
2126 password = 1; /* Require password auth */
2127 } else if (strncmp(options, "reverse", 7) == 0) {
2128 reverse = 1;
2129 } else if (strncmp(options, "to=", 3) == 0) {
2130 to_port = atoi(options+3) + 5900;
2131 #ifdef CONFIG_VNC_SASL
2132 } else if (strncmp(options, "sasl", 4) == 0) {
2133 sasl = 1; /* Require SASL auth */
2134 #endif
2135 #ifdef CONFIG_VNC_TLS
2136 } else if (strncmp(options, "tls", 3) == 0) {
2137 tls = 1; /* Require TLS */
2138 } else if (strncmp(options, "x509", 4) == 0) {
2139 char *start, *end;
2140 x509 = 1; /* Require x509 certificates */
2141 if (strncmp(options, "x509verify", 10) == 0)
2142 vs->tls.x509verify = 1; /* ...and verify client certs */
2143
2144 /* Now check for 'x509=/some/path' postfix
2145 * and use that to setup x509 certificate/key paths */
2146 start = strchr(options, '=');
2147 end = strchr(options, ',');
2148 if (start && (!end || (start < end))) {
2149 int len = end ? end-(start+1) : strlen(start+1);
2150 char *path = qemu_strndup(start + 1, len);
2151
2152 VNC_DEBUG("Trying certificate path '%s'\n", path);
2153 if (vnc_tls_set_x509_creds_dir(vs, path) < 0) {
2154 fprintf(stderr, "Failed to find x509 certificates/keys in %s\n", path);
2155 qemu_free(path);
2156 qemu_free(vs->display);
2157 vs->display = NULL;
2158 return -1;
2159 }
2160 qemu_free(path);
2161 } else {
2162 fprintf(stderr, "No certificate path provided\n");
2163 qemu_free(vs->display);
2164 vs->display = NULL;
2165 return -1;
2166 }
2167 #endif
2168 } else if (strncmp(options, "acl", 3) == 0) {
2169 acl = 1;
2170 }
2171 }
2172
2173 #ifdef CONFIG_VNC_TLS
2174 if (acl && x509 && vs->tls.x509verify) {
2175 if (!(vs->tls.acl = qemu_acl_init("vnc.x509dname"))) {
2176 fprintf(stderr, "Failed to create x509 dname ACL\n");
2177 exit(1);
2178 }
2179 }
2180 #endif
2181 #ifdef CONFIG_VNC_SASL
2182 if (acl && sasl) {
2183 if (!(vs->sasl.acl = qemu_acl_init("vnc.username"))) {
2184 fprintf(stderr, "Failed to create username ACL\n");
2185 exit(1);
2186 }
2187 }
2188 #endif
2189
2190 /*
2191 * Combinations we support here:
2192 *
2193 * - no-auth (clear text, no auth)
2194 * - password (clear text, weak auth)
2195 * - sasl (encrypt, good auth *IF* using Kerberos via GSSAPI)
2196 * - tls (encrypt, weak anonymous creds, no auth)
2197 * - tls + password (encrypt, weak anonymous creds, weak auth)
2198 * - tls + sasl (encrypt, weak anonymous creds, good auth)
2199 * - tls + x509 (encrypt, good x509 creds, no auth)
2200 * - tls + x509 + password (encrypt, good x509 creds, weak auth)
2201 * - tls + x509 + sasl (encrypt, good x509 creds, good auth)
2202 *
2203 * NB1. TLS is a stackable auth scheme.
2204 * NB2. the x509 schemes have option to validate a client cert dname
2205 */
2206 if (password) {
2207 #ifdef CONFIG_VNC_TLS
2208 if (tls) {
2209 vs->auth = VNC_AUTH_VENCRYPT;
2210 if (x509) {
2211 VNC_DEBUG("Initializing VNC server with x509 password auth\n");
2212 vs->subauth = VNC_AUTH_VENCRYPT_X509VNC;
2213 } else {
2214 VNC_DEBUG("Initializing VNC server with TLS password auth\n");
2215 vs->subauth = VNC_AUTH_VENCRYPT_TLSVNC;
2216 }
2217 } else {
2218 #endif /* CONFIG_VNC_TLS */
2219 VNC_DEBUG("Initializing VNC server with password auth\n");
2220 vs->auth = VNC_AUTH_VNC;
2221 #ifdef CONFIG_VNC_TLS
2222 vs->subauth = VNC_AUTH_INVALID;
2223 }
2224 #endif /* CONFIG_VNC_TLS */
2225 #ifdef CONFIG_VNC_SASL
2226 } else if (sasl) {
2227 #ifdef CONFIG_VNC_TLS
2228 if (tls) {
2229 vs->auth = VNC_AUTH_VENCRYPT;
2230 if (x509) {
2231 VNC_DEBUG("Initializing VNC server with x509 SASL auth\n");
2232 vs->subauth = VNC_AUTH_VENCRYPT_X509SASL;
2233 } else {
2234 VNC_DEBUG("Initializing VNC server with TLS SASL auth\n");
2235 vs->subauth = VNC_AUTH_VENCRYPT_TLSSASL;
2236 }
2237 } else {
2238 #endif /* CONFIG_VNC_TLS */
2239 VNC_DEBUG("Initializing VNC server with SASL auth\n");
2240 vs->auth = VNC_AUTH_SASL;
2241 #ifdef CONFIG_VNC_TLS
2242 vs->subauth = VNC_AUTH_INVALID;
2243 }
2244 #endif /* CONFIG_VNC_TLS */
2245 #endif /* CONFIG_VNC_SASL */
2246 } else {
2247 #ifdef CONFIG_VNC_TLS
2248 if (tls) {
2249 vs->auth = VNC_AUTH_VENCRYPT;
2250 if (x509) {
2251 VNC_DEBUG("Initializing VNC server with x509 no auth\n");
2252 vs->subauth = VNC_AUTH_VENCRYPT_X509NONE;
2253 } else {
2254 VNC_DEBUG("Initializing VNC server with TLS no auth\n");
2255 vs->subauth = VNC_AUTH_VENCRYPT_TLSNONE;
2256 }
2257 } else {
2258 #endif
2259 VNC_DEBUG("Initializing VNC server with no auth\n");
2260 vs->auth = VNC_AUTH_NONE;
2261 #ifdef CONFIG_VNC_TLS
2262 vs->subauth = VNC_AUTH_INVALID;
2263 }
2264 #endif
2265 }
2266
2267 #ifdef CONFIG_VNC_SASL
2268 if ((saslErr = sasl_server_init(NULL, "qemu")) != SASL_OK) {
2269 fprintf(stderr, "Failed to initialize SASL auth %s",
2270 sasl_errstring(saslErr, NULL, NULL));
2271 free(vs->display);
2272 vs->display = NULL;
2273 return -1;
2274 }
2275 #endif
2276
2277 if (reverse) {
2278 /* connect to viewer */
2279 if (strncmp(display, "unix:", 5) == 0)
2280 vs->lsock = unix_connect(display+5);
2281 else
2282 vs->lsock = inet_connect(display, SOCK_STREAM);
2283 if (-1 == vs->lsock) {
2284 free(vs->display);
2285 vs->display = NULL;
2286 return -1;
2287 } else {
2288 int csock = vs->lsock;
2289 vs->lsock = -1;
2290 vnc_connect(vs, csock);
2291 }
2292 return 0;
2293
2294 } else {
2295 /* listen for connects */
2296 char *dpy;
2297 dpy = qemu_malloc(256);
2298 if (strncmp(display, "unix:", 5) == 0) {
2299 pstrcpy(dpy, 256, "unix:");
2300 vs->lsock = unix_listen(display+5, dpy+5, 256-5);
2301 } else {
2302 vs->lsock = inet_listen(display, dpy, 256, SOCK_STREAM, 5900);
2303 }
2304 if (-1 == vs->lsock) {
2305 free(dpy);
2306 return -1;
2307 } else {
2308 free(vs->display);
2309 vs->display = dpy;
2310 }
2311 }
2312 return qemu_set_fd_handler2(vs->lsock, NULL, vnc_listen_read, NULL, vs);
2313 }
Patches shipped by Fedora