?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
qemu:virtio-net: Enable filtering based on MAC, promisc, broadcast and allmulti ...
[qemu.git] / vnc.c
blob68df599615b4c048bc1a3824843c2b94686bb921
1 /*
2 * QEMU VNC display driver
3 *
4 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5 * Copyright (C) 2006 Fabrice Bellard
6 *
7 * Permission is hereby granted, free of charge, to any person obtaining a copy
8 * of this software and associated documentation files (the "Software"), to deal
9 * in the Software without restriction, including without limitation the rights
10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11 * copies of the Software, and to permit persons to whom the Software is
12 * furnished to do so, subject to the following conditions:
13 *
14 * The above copyright notice and this permission notice shall be included in
15 * all copies or substantial portions of the Software.
16 *
17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23 * THE SOFTWARE.
24 */
25
26 #include "qemu-common.h"
27 #include "console.h"
28 #include "sysemu.h"
29 #include "qemu_socket.h"
30 #include "qemu-timer.h"
31 #include "audio/audio.h"
32 #include <zlib.h>
33
34 #define VNC_REFRESH_INTERVAL (1000 / 30)
35
36 #include "vnc.h"
37 #include "vnc_keysym.h"
38 #include "keymaps.c"
39 #include "d3des.h"
40
41 #ifdef CONFIG_VNC_TLS
42 #include <gnutls/gnutls.h>
43 #include <gnutls/x509.h>
44 #endif /* CONFIG_VNC_TLS */
45
46 // #define _VNC_DEBUG 1
47
48 #ifdef _VNC_DEBUG
49 #define VNC_DEBUG(fmt, ...) do { fprintf(stderr, fmt, ## __VA_ARGS__); } while (0)
50
51 #if defined(CONFIG_VNC_TLS) && _VNC_DEBUG >= 2
52 /* Very verbose, so only enabled for _VNC_DEBUG >= 2 */
53 static void vnc_debug_gnutls_log(int level, const char* str) {
54 VNC_DEBUG("%d %s", level, str);
55 }
56 #endif /* CONFIG_VNC_TLS && _VNC_DEBUG */
57 #else
58 #define VNC_DEBUG(fmt, ...) do { } while (0)
59 #endif
60
61 #define count_bits(c, v) { \
62 for (c = 0; v; v >>= 1) \
63 { \
64 c += v & 1; \
65 } \
66 }
67
68 typedef struct Buffer
69 {
70 size_t capacity;
71 size_t offset;
72 uint8_t *buffer;
73 } Buffer;
74
75 typedef struct VncState VncState;
76
77 typedef int VncReadEvent(VncState *vs, uint8_t *data, size_t len);
78
79 typedef void VncWritePixels(VncState *vs, void *data, int size);
80
81 typedef void VncSendHextileTile(VncState *vs,
82 int x, int y, int w, int h,
83 void *last_bg,
84 void *last_fg,
85 int *has_bg, int *has_fg);
86
87 #define VNC_MAX_WIDTH 2048
88 #define VNC_MAX_HEIGHT 2048
89 #define VNC_DIRTY_WORDS (VNC_MAX_WIDTH / (16 * 32))
90
91 #define VNC_AUTH_CHALLENGE_SIZE 16
92
93 struct VncState
94 {
95 QEMUTimer *timer;
96 int lsock;
97 int csock;
98 DisplayState *ds;
99 int need_update;
100 uint32_t dirty_row[VNC_MAX_HEIGHT][VNC_DIRTY_WORDS];
101 char *old_data;
102 uint32_t features;
103 int absolute;
104 int last_x;
105 int last_y;
106
107 uint32_t vnc_encoding;
108 uint8_t tight_quality;
109 uint8_t tight_compression;
110
111 int major;
112 int minor;
113
114 char *display;
115 char *password;
116 int auth;
117 #ifdef CONFIG_VNC_TLS
118 int subauth;
119 int x509verify;
120
121 char *x509cacert;
122 char *x509cacrl;
123 char *x509cert;
124 char *x509key;
125 #endif
126 char challenge[VNC_AUTH_CHALLENGE_SIZE];
127
128 #ifdef CONFIG_VNC_TLS
129 int wiremode;
130 gnutls_session_t tls_session;
131 #endif
132
133 Buffer output;
134 Buffer input;
135 kbd_layout_t *kbd_layout;
136 /* current output mode information */
137 VncWritePixels *write_pixels;
138 VncSendHextileTile *send_hextile_tile;
139 DisplaySurface clientds, serverds;
140
141 CaptureVoiceOut *audio_cap;
142 struct audsettings as;
143
144 VncReadEvent *read_handler;
145 size_t read_handler_expect;
146 /* input */
147 uint8_t modifiers_state[256];
148
149 Buffer zlib;
150 Buffer zlib_tmp;
151 z_stream zlib_stream[4];
152 };
153
154 static VncState *vnc_state; /* needed for info vnc */
155 static DisplayChangeListener *dcl;
156
157 void do_info_vnc(void)
158 {
159 if (vnc_state == NULL || vnc_state->display == NULL)
160 term_printf("VNC server disabled\n");
161 else {
162 term_printf("VNC server active on: ");
163 term_print_filename(vnc_state->display);
164 term_printf("\n");
165
166 if (vnc_state->csock == -1)
167 term_printf("No client connected\n");
168 else
169 term_printf("Client connected\n");
170 }
171 }
172
173 static inline uint32_t vnc_has_feature(VncState *vs, int feature) {
174 return (vs->features & (1 << feature));
175 }
176
177 /* TODO
178 1) Get the queue working for IO.
179 2) there is some weirdness when using the -S option (the screen is grey
180 and not totally invalidated
181 3) resolutions > 1024
182 */
183
184 static void vnc_write(VncState *vs, const void *data, size_t len);
185 static void vnc_write_u32(VncState *vs, uint32_t value);
186 static void vnc_write_s32(VncState *vs, int32_t value);
187 static void vnc_write_u16(VncState *vs, uint16_t value);
188 static void vnc_write_u8(VncState *vs, uint8_t value);
189 static void vnc_flush(VncState *vs);
190 static void vnc_update_client(void *opaque);
191 static void vnc_client_read(void *opaque);
192
193 static void vnc_colordepth(DisplayState *ds);
194
195 static inline void vnc_set_bit(uint32_t *d, int k)
196 {
197 d[k >> 5] |= 1 << (k & 0x1f);
198 }
199
200 static inline void vnc_clear_bit(uint32_t *d, int k)
201 {
202 d[k >> 5] &= ~(1 << (k & 0x1f));
203 }
204
205 static inline void vnc_set_bits(uint32_t *d, int n, int nb_words)
206 {
207 int j;
208
209 j = 0;
210 while (n >= 32) {
211 d[j++] = -1;
212 n -= 32;
213 }
214 if (n > 0)
215 d[j++] = (1 << n) - 1;
216 while (j < nb_words)
217 d[j++] = 0;
218 }
219
220 static inline int vnc_get_bit(const uint32_t *d, int k)
221 {
222 return (d[k >> 5] >> (k & 0x1f)) & 1;
223 }
224
225 static inline int vnc_and_bits(const uint32_t *d1, const uint32_t *d2,
226 int nb_words)
227 {
228 int i;
229 for(i = 0; i < nb_words; i++) {
230 if ((d1[i] & d2[i]) != 0)
231 return 1;
232 }
233 return 0;
234 }
235
236 static void vnc_dpy_update(DisplayState *ds, int x, int y, int w, int h)
237 {
238 VncState *vs = ds->opaque;
239 int i;
240
241 h += y;
242
243 /* round x down to ensure the loop only spans one 16-pixel block per,
244 iteration. otherwise, if (x % 16) != 0, the last iteration may span
245 two 16-pixel blocks but we only mark the first as dirty
246 */
247 w += (x % 16);
248 x -= (x % 16);
249
250 x = MIN(x, vs->serverds.width);
251 y = MIN(y, vs->serverds.height);
252 w = MIN(x + w, vs->serverds.width) - x;
253 h = MIN(h, vs->serverds.height);
254
255 for (; y < h; y++)
256 for (i = 0; i < w; i += 16)
257 vnc_set_bit(vs->dirty_row[y], (x + i) / 16);
258 }
259
260 static void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
261 int32_t encoding)
262 {
263 vnc_write_u16(vs, x);
264 vnc_write_u16(vs, y);
265 vnc_write_u16(vs, w);
266 vnc_write_u16(vs, h);
267
268 vnc_write_s32(vs, encoding);
269 }
270
271 static void buffer_reserve(Buffer *buffer, size_t len)
272 {
273 if ((buffer->capacity - buffer->offset) < len) {
274 buffer->capacity += (len + 1024);
275 buffer->buffer = qemu_realloc(buffer->buffer, buffer->capacity);
276 if (buffer->buffer == NULL) {
277 fprintf(stderr, "vnc: out of memory\n");
278 exit(1);
279 }
280 }
281 }
282
283 static int buffer_empty(Buffer *buffer)
284 {
285 return buffer->offset == 0;
286 }
287
288 static uint8_t *buffer_end(Buffer *buffer)
289 {
290 return buffer->buffer + buffer->offset;
291 }
292
293 static void buffer_reset(Buffer *buffer)
294 {
295 buffer->offset = 0;
296 }
297
298 static void buffer_append(Buffer *buffer, const void *data, size_t len)
299 {
300 memcpy(buffer->buffer + buffer->offset, data, len);
301 buffer->offset += len;
302 }
303
304 static void vnc_dpy_resize(DisplayState *ds)
305 {
306 int size_changed;
307 VncState *vs = ds->opaque;
308
309 vs->old_data = qemu_realloc(vs->old_data, ds_get_linesize(ds) * ds_get_height(ds));
310
311 if (vs->old_data == NULL) {
312 fprintf(stderr, "vnc: memory allocation failed\n");
313 exit(1);
314 }
315
316 if (ds_get_bytes_per_pixel(ds) != vs->serverds.pf.bytes_per_pixel)
317 console_color_init(ds);
318 vnc_colordepth(ds);
319 size_changed = ds_get_width(ds) != vs->serverds.width ||
320 ds_get_height(ds) != vs->serverds.height;
321 vs->serverds = *(ds->surface);
322 if (size_changed) {
323 if (vs->csock != -1 && vnc_has_feature(vs, VNC_FEATURE_RESIZE)) {
324 vnc_write_u8(vs, 0); /* msg id */
325 vnc_write_u8(vs, 0);
326 vnc_write_u16(vs, 1); /* number of rects */
327 vnc_framebuffer_update(vs, 0, 0, ds_get_width(ds), ds_get_height(ds),
328 VNC_ENCODING_DESKTOPRESIZE);
329 vnc_flush(vs);
330 }
331 }
332
333 memset(vs->dirty_row, 0xFF, sizeof(vs->dirty_row));
334 memset(vs->old_data, 42, ds_get_linesize(vs->ds) * ds_get_height(vs->ds));
335 }
336
337 /* fastest code */
338 static void vnc_write_pixels_copy(VncState *vs, void *pixels, int size)
339 {
340 vnc_write(vs, pixels, size);
341 }
342
343 /* slowest but generic code. */
344 static void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
345 {
346 uint8_t r, g, b;
347
348 r = ((((v & vs->serverds.pf.rmask) >> vs->serverds.pf.rshift) << vs->clientds.pf.rbits) >>
349 vs->serverds.pf.rbits);
350 g = ((((v & vs->serverds.pf.gmask) >> vs->serverds.pf.gshift) << vs->clientds.pf.gbits) >>
351 vs->serverds.pf.gbits);
352 b = ((((v & vs->serverds.pf.bmask) >> vs->serverds.pf.bshift) << vs->clientds.pf.bbits) >>
353 vs->serverds.pf.bbits);
354 v = (r << vs->clientds.pf.rshift) |
355 (g << vs->clientds.pf.gshift) |
356 (b << vs->clientds.pf.bshift);
357 switch(vs->clientds.pf.bytes_per_pixel) {
358 case 1:
359 buf[0] = v;
360 break;
361 case 2:
362 if (vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) {
363 buf[0] = v >> 8;
364 buf[1] = v;
365 } else {
366 buf[1] = v >> 8;
367 buf[0] = v;
368 }
369 break;
370 default:
371 case 4:
372 if (vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) {
373 buf[0] = v >> 24;
374 buf[1] = v >> 16;
375 buf[2] = v >> 8;
376 buf[3] = v;
377 } else {
378 buf[3] = v >> 24;
379 buf[2] = v >> 16;
380 buf[1] = v >> 8;
381 buf[0] = v;
382 }
383 break;
384 }
385 }
386
387 static void vnc_write_pixels_generic(VncState *vs, void *pixels1, int size)
388 {
389 uint8_t buf[4];
390
391 if (vs->serverds.pf.bytes_per_pixel == 4) {
392 uint32_t *pixels = pixels1;
393 int n, i;
394 n = size >> 2;
395 for(i = 0; i < n; i++) {
396 vnc_convert_pixel(vs, buf, pixels[i]);
397 vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
398 }
399 } else if (vs->serverds.pf.bytes_per_pixel == 2) {
400 uint16_t *pixels = pixels1;
401 int n, i;
402 n = size >> 1;
403 for(i = 0; i < n; i++) {
404 vnc_convert_pixel(vs, buf, pixels[i]);
405 vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
406 }
407 } else if (vs->serverds.pf.bytes_per_pixel == 1) {
408 uint8_t *pixels = pixels1;
409 int n, i;
410 n = size;
411 for(i = 0; i < n; i++) {
412 vnc_convert_pixel(vs, buf, pixels[i]);
413 vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
414 }
415 } else {
416 fprintf(stderr, "vnc_write_pixels_generic: VncState color depth not supported\n");
417 }
418 }
419
420 static void send_framebuffer_update_raw(VncState *vs, int x, int y, int w, int h)
421 {
422 int i;
423 uint8_t *row;
424
425 row = ds_get_data(vs->ds) + y * ds_get_linesize(vs->ds) + x * ds_get_bytes_per_pixel(vs->ds);
426 for (i = 0; i < h; i++) {
427 vs->write_pixels(vs, row, w * ds_get_bytes_per_pixel(vs->ds));
428 row += ds_get_linesize(vs->ds);
429 }
430 }
431
432 static void hextile_enc_cord(uint8_t *ptr, int x, int y, int w, int h)
433 {
434 ptr[0] = ((x & 0x0F) << 4) | (y & 0x0F);
435 ptr[1] = (((w - 1) & 0x0F) << 4) | ((h - 1) & 0x0F);
436 }
437
438 #define BPP 8
439 #include "vnchextile.h"
440 #undef BPP
441
442 #define BPP 16
443 #include "vnchextile.h"
444 #undef BPP
445
446 #define BPP 32
447 #include "vnchextile.h"
448 #undef BPP
449
450 #define GENERIC
451 #define BPP 8
452 #include "vnchextile.h"
453 #undef BPP
454 #undef GENERIC
455
456 #define GENERIC
457 #define BPP 16
458 #include "vnchextile.h"
459 #undef BPP
460 #undef GENERIC
461
462 #define GENERIC
463 #define BPP 32
464 #include "vnchextile.h"
465 #undef BPP
466 #undef GENERIC
467
468 static void send_framebuffer_update_hextile(VncState *vs, int x, int y, int w, int h)
469 {
470 int i, j;
471 int has_fg, has_bg;
472 uint8_t *last_fg, *last_bg;
473
474 last_fg = (uint8_t *) qemu_malloc(vs->serverds.pf.bytes_per_pixel);
475 last_bg = (uint8_t *) qemu_malloc(vs->serverds.pf.bytes_per_pixel);
476 has_fg = has_bg = 0;
477 for (j = y; j < (y + h); j += 16) {
478 for (i = x; i < (x + w); i += 16) {
479 vs->send_hextile_tile(vs, i, j,
480 MIN(16, x + w - i), MIN(16, y + h - j),
481 last_bg, last_fg, &has_bg, &has_fg);
482 }
483 }
484 free(last_fg);
485 free(last_bg);
486
487 }
488
489 static void vnc_zlib_init(VncState *vs)
490 {
491 int i;
492 for (i=0; i<(sizeof(vs->zlib_stream) / sizeof(z_stream)); i++)
493 vs->zlib_stream[i].opaque = NULL;
494 }
495
496 static void vnc_zlib_start(VncState *vs)
497 {
498 buffer_reset(&vs->zlib);
499
500 // make the output buffer be the zlib buffer, so we can compress it later
501 vs->zlib_tmp = vs->output;
502 vs->output = vs->zlib;
503 }
504
505 static int vnc_zlib_stop(VncState *vs, int stream_id)
506 {
507 z_streamp zstream = &vs->zlib_stream[stream_id];
508 int previous_out;
509
510 // switch back to normal output/zlib buffers
511 vs->zlib = vs->output;
512 vs->output = vs->zlib_tmp;
513
514 // compress the zlib buffer
515
516 // initialize the stream
517 // XXX need one stream per session
518 if (zstream->opaque != vs) {
519 int err;
520
521 VNC_DEBUG("VNC: initializing zlib stream %d\n", stream_id);
522 VNC_DEBUG("VNC: opaque = %p | vs = %p\n", zstream->opaque, vs);
523 zstream->zalloc = Z_NULL;
524 zstream->zfree = Z_NULL;
525
526 err = deflateInit2(zstream, vs->tight_compression, Z_DEFLATED, MAX_WBITS,
527 MAX_MEM_LEVEL, Z_DEFAULT_STRATEGY);
528
529 if (err != Z_OK) {
530 fprintf(stderr, "VNC: error initializing zlib\n");
531 return -1;
532 }
533
534 zstream->opaque = vs;
535 }
536
537 // XXX what to do if tight_compression changed in between?
538
539 // reserve memory in output buffer
540 buffer_reserve(&vs->output, vs->zlib.offset + 64);
541
542 // set pointers
543 zstream->next_in = vs->zlib.buffer;
544 zstream->avail_in = vs->zlib.offset;
545 zstream->next_out = vs->output.buffer + vs->output.offset;
546 zstream->avail_out = vs->output.capacity - vs->output.offset;
547 zstream->data_type = Z_BINARY;
548 previous_out = zstream->total_out;
549
550 // start encoding
551 if (deflate(zstream, Z_SYNC_FLUSH) != Z_OK) {
552 fprintf(stderr, "VNC: error during zlib compression\n");
553 return -1;
554 }
555
556 vs->output.offset = vs->output.capacity - zstream->avail_out;
557 return zstream->total_out - previous_out;
558 }
559
560 static void send_framebuffer_update_zlib(VncState *vs, int x, int y, int w, int h)
561 {
562 int old_offset, new_offset, bytes_written;
563
564 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_ZLIB);
565
566 // remember where we put in the follow-up size
567 old_offset = vs->output.offset;
568 vnc_write_s32(vs, 0);
569
570 // compress the stream
571 vnc_zlib_start(vs);
572 send_framebuffer_update_raw(vs, x, y, w, h);
573 bytes_written = vnc_zlib_stop(vs, 0);
574
575 if (bytes_written == -1)
576 return;
577
578 // hack in the size
579 new_offset = vs->output.offset;
580 vs->output.offset = old_offset;
581 vnc_write_u32(vs, bytes_written);
582 vs->output.offset = new_offset;
583 }
584
585 static void send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
586 {
587 switch(vs->vnc_encoding) {
588 case VNC_ENCODING_ZLIB:
589 send_framebuffer_update_zlib(vs, x, y, w, h);
590 break;
591 case VNC_ENCODING_HEXTILE:
592 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE);
593 send_framebuffer_update_hextile(vs, x, y, w, h);
594 break;
595 default:
596 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW);
597 send_framebuffer_update_raw(vs, x, y, w, h);
598 break;
599 }
600 }
601
602 static void vnc_copy(DisplayState *ds, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
603 {
604 VncState *vs = ds->opaque;
605
606 vnc_update_client(vs);
607
608 vnc_write_u8(vs, 0); /* msg id */
609 vnc_write_u8(vs, 0);
610 vnc_write_u16(vs, 1); /* number of rects */
611 vnc_framebuffer_update(vs, dst_x, dst_y, w, h, VNC_ENCODING_COPYRECT);
612 vnc_write_u16(vs, src_x);
613 vnc_write_u16(vs, src_y);
614 vnc_flush(vs);
615 }
616
617 static int find_dirty_height(VncState *vs, int y, int last_x, int x)
618 {
619 int h;
620
621 for (h = 1; h < (vs->serverds.height - y); h++) {
622 int tmp_x;
623 if (!vnc_get_bit(vs->dirty_row[y + h], last_x))
624 break;
625 for (tmp_x = last_x; tmp_x < x; tmp_x++)
626 vnc_clear_bit(vs->dirty_row[y + h], tmp_x);
627 }
628
629 return h;
630 }
631
632 static void vnc_update_client(void *opaque)
633 {
634 VncState *vs = opaque;
635
636 if (vs->need_update && vs->csock != -1) {
637 int y;
638 uint8_t *row;
639 char *old_row;
640 uint32_t width_mask[VNC_DIRTY_WORDS];
641 int n_rectangles;
642 int saved_offset;
643 int has_dirty = 0;
644
645 vga_hw_update();
646
647 vnc_set_bits(width_mask, (ds_get_width(vs->ds) / 16), VNC_DIRTY_WORDS);
648
649 /* Walk through the dirty map and eliminate tiles that
650 really aren't dirty */
651 row = ds_get_data(vs->ds);
652 old_row = vs->old_data;
653
654 for (y = 0; y < ds_get_height(vs->ds); y++) {
655 if (vnc_and_bits(vs->dirty_row[y], width_mask, VNC_DIRTY_WORDS)) {
656 int x;
657 uint8_t *ptr;
658 char *old_ptr;
659
660 ptr = row;
661 old_ptr = (char*)old_row;
662
663 for (x = 0; x < ds_get_width(vs->ds); x += 16) {
664 if (memcmp(old_ptr, ptr, 16 * ds_get_bytes_per_pixel(vs->ds)) == 0) {
665 vnc_clear_bit(vs->dirty_row[y], (x / 16));
666 } else {
667 has_dirty = 1;
668 memcpy(old_ptr, ptr, 16 * ds_get_bytes_per_pixel(vs->ds));
669 }
670
671 ptr += 16 * ds_get_bytes_per_pixel(vs->ds);
672 old_ptr += 16 * ds_get_bytes_per_pixel(vs->ds);
673 }
674 }
675
676 row += ds_get_linesize(vs->ds);
677 old_row += ds_get_linesize(vs->ds);
678 }
679
680 if (!has_dirty && !vs->audio_cap) {
681 qemu_mod_timer(vs->timer, qemu_get_clock(rt_clock) + VNC_REFRESH_INTERVAL);
682 return;
683 }
684
685 /* Count rectangles */
686 n_rectangles = 0;
687 vnc_write_u8(vs, 0); /* msg id */
688 vnc_write_u8(vs, 0);
689 saved_offset = vs->output.offset;
690 vnc_write_u16(vs, 0);
691
692 for (y = 0; y < vs->serverds.height; y++) {
693 int x;
694 int last_x = -1;
695 for (x = 0; x < vs->serverds.width / 16; x++) {
696 if (vnc_get_bit(vs->dirty_row[y], x)) {
697 if (last_x == -1) {
698 last_x = x;
699 }
700 vnc_clear_bit(vs->dirty_row[y], x);
701 } else {
702 if (last_x != -1) {
703 int h = find_dirty_height(vs, y, last_x, x);
704 send_framebuffer_update(vs, last_x * 16, y, (x - last_x) * 16, h);
705 n_rectangles++;
706 }
707 last_x = -1;
708 }
709 }
710 if (last_x != -1) {
711 int h = find_dirty_height(vs, y, last_x, x);
712 send_framebuffer_update(vs, last_x * 16, y, (x - last_x) * 16, h);
713 n_rectangles++;
714 }
715 }
716 vs->output.buffer[saved_offset] = (n_rectangles >> 8) & 0xFF;
717 vs->output.buffer[saved_offset + 1] = n_rectangles & 0xFF;
718 vnc_flush(vs);
719
720 }
721
722 if (vs->csock != -1) {
723 qemu_mod_timer(vs->timer, qemu_get_clock(rt_clock) + VNC_REFRESH_INTERVAL);
724 }
725
726 }
727
728 static int vnc_listen_poll(void *opaque)
729 {
730 VncState *vs = opaque;
731 if (vs->csock == -1)
732 return 1;
733 return 0;
734 }
735
736 /* audio */
737 static void audio_capture_notify(void *opaque, audcnotification_e cmd)
738 {
739 VncState *vs = opaque;
740
741 switch (cmd) {
742 case AUD_CNOTIFY_DISABLE:
743 vnc_write_u8(vs, 255);
744 vnc_write_u8(vs, 1);
745 vnc_write_u16(vs, 0);
746 vnc_flush(vs);
747 break;
748
749 case AUD_CNOTIFY_ENABLE:
750 vnc_write_u8(vs, 255);
751 vnc_write_u8(vs, 1);
752 vnc_write_u16(vs, 1);
753 vnc_flush(vs);
754 break;
755 }
756 }
757
758 static void audio_capture_destroy(void *opaque)
759 {
760 }
761
762 static void audio_capture(void *opaque, void *buf, int size)
763 {
764 VncState *vs = opaque;
765
766 vnc_write_u8(vs, 255);
767 vnc_write_u8(vs, 1);
768 vnc_write_u16(vs, 2);
769 vnc_write_u32(vs, size);
770 vnc_write(vs, buf, size);
771 vnc_flush(vs);
772 }
773
774 static void audio_add(VncState *vs)
775 {
776 struct audio_capture_ops ops;
777
778 if (vs->audio_cap) {
779 term_printf ("audio already running\n");
780 return;
781 }
782
783 ops.notify = audio_capture_notify;
784 ops.destroy = audio_capture_destroy;
785 ops.capture = audio_capture;
786
787 vs->audio_cap = AUD_add_capture(NULL, &vs->as, &ops, vs);
788 if (!vs->audio_cap) {
789 term_printf ("Failed to add audio capture\n");
790 }
791 }
792
793 static void audio_del(VncState *vs)
794 {
795 if (vs->audio_cap) {
796 AUD_del_capture(vs->audio_cap, vs);
797 vs->audio_cap = NULL;
798 }
799 }
800
801 static int vnc_client_io_error(VncState *vs, int ret, int last_errno)
802 {
803 if (ret == 0 || ret == -1) {
804 if (ret == -1) {
805 switch (last_errno) {
806 case EINTR:
807 case EAGAIN:
808 #ifdef _WIN32
809 case WSAEWOULDBLOCK:
810 #endif
811 return 0;
812 default:
813 break;
814 }
815 }
816
817 VNC_DEBUG("Closing down client sock %d %d\n", ret, ret < 0 ? last_errno : 0);
818 qemu_set_fd_handler2(vs->csock, NULL, NULL, NULL, NULL);
819 closesocket(vs->csock);
820 vs->csock = -1;
821 dcl->idle = 1;
822 buffer_reset(&vs->input);
823 buffer_reset(&vs->output);
824 vs->need_update = 0;
825 #ifdef CONFIG_VNC_TLS
826 if (vs->tls_session) {
827 gnutls_deinit(vs->tls_session);
828 vs->tls_session = NULL;
829 }
830 vs->wiremode = VNC_WIREMODE_CLEAR;
831 #endif /* CONFIG_VNC_TLS */
832 audio_del(vs);
833 return 0;
834 }
835 return ret;
836 }
837
838 static void vnc_client_error(VncState *vs)
839 {
840 vnc_client_io_error(vs, -1, EINVAL);
841 }
842
843 static void vnc_client_write(void *opaque)
844 {
845 long ret;
846 VncState *vs = opaque;
847
848 #ifdef CONFIG_VNC_TLS
849 if (vs->tls_session) {
850 ret = gnutls_write(vs->tls_session, vs->output.buffer, vs->output.offset);
851 if (ret < 0) {
852 if (ret == GNUTLS_E_AGAIN)
853 errno = EAGAIN;
854 else
855 errno = EIO;
856 ret = -1;
857 }
858 } else
859 #endif /* CONFIG_VNC_TLS */
860 ret = send(vs->csock, vs->output.buffer, vs->output.offset, 0);
861 ret = vnc_client_io_error(vs, ret, socket_error());
862 if (!ret)
863 return;
864
865 memmove(vs->output.buffer, vs->output.buffer + ret, (vs->output.offset - ret));
866 vs->output.offset -= ret;
867
868 if (vs->output.offset == 0) {
869 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
870 }
871 }
872
873 static void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting)
874 {
875 vs->read_handler = func;
876 vs->read_handler_expect = expecting;
877 }
878
879 static void vnc_client_read(void *opaque)
880 {
881 VncState *vs = opaque;
882 long ret;
883
884 buffer_reserve(&vs->input, 4096);
885
886 #ifdef CONFIG_VNC_TLS
887 if (vs->tls_session) {
888 ret = gnutls_read(vs->tls_session, buffer_end(&vs->input), 4096);
889 if (ret < 0) {
890 if (ret == GNUTLS_E_AGAIN)
891 errno = EAGAIN;
892 else
893 errno = EIO;
894 ret = -1;
895 }
896 } else
897 #endif /* CONFIG_VNC_TLS */
898 ret = recv(vs->csock, buffer_end(&vs->input), 4096, 0);
899 ret = vnc_client_io_error(vs, ret, socket_error());
900 if (!ret)
901 return;
902
903 vs->input.offset += ret;
904
905 while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) {
906 size_t len = vs->read_handler_expect;
907 int ret;
908
909 ret = vs->read_handler(vs, vs->input.buffer, len);
910 if (vs->csock == -1)
911 return;
912
913 if (!ret) {
914 memmove(vs->input.buffer, vs->input.buffer + len, (vs->input.offset - len));
915 vs->input.offset -= len;
916 } else {
917 vs->read_handler_expect = ret;
918 }
919 }
920 }
921
922 static void vnc_write(VncState *vs, const void *data, size_t len)
923 {
924 buffer_reserve(&vs->output, len);
925
926 if (buffer_empty(&vs->output)) {
927 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, vnc_client_write, vs);
928 }
929
930 buffer_append(&vs->output, data, len);
931 }
932
933 static void vnc_write_s32(VncState *vs, int32_t value)
934 {
935 vnc_write_u32(vs, *(uint32_t *)&value);
936 }
937
938 static void vnc_write_u32(VncState *vs, uint32_t value)
939 {
940 uint8_t buf[4];
941
942 buf[0] = (value >> 24) & 0xFF;
943 buf[1] = (value >> 16) & 0xFF;
944 buf[2] = (value >> 8) & 0xFF;
945 buf[3] = value & 0xFF;
946
947 vnc_write(vs, buf, 4);
948 }
949
950 static void vnc_write_u16(VncState *vs, uint16_t value)
951 {
952 uint8_t buf[2];
953
954 buf[0] = (value >> 8) & 0xFF;
955 buf[1] = value & 0xFF;
956
957 vnc_write(vs, buf, 2);
958 }
959
960 static void vnc_write_u8(VncState *vs, uint8_t value)
961 {
962 vnc_write(vs, (char *)&value, 1);
963 }
964
965 static void vnc_flush(VncState *vs)
966 {
967 if (vs->output.offset)
968 vnc_client_write(vs);
969 }
970
971 static uint8_t read_u8(uint8_t *data, size_t offset)
972 {
973 return data[offset];
974 }
975
976 static uint16_t read_u16(uint8_t *data, size_t offset)
977 {
978 return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF);
979 }
980
981 static int32_t read_s32(uint8_t *data, size_t offset)
982 {
983 return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) |
984 (data[offset + 2] << 8) | data[offset + 3]);
985 }
986
987 static uint32_t read_u32(uint8_t *data, size_t offset)
988 {
989 return ((data[offset] << 24) | (data[offset + 1] << 16) |
990 (data[offset + 2] << 8) | data[offset + 3]);
991 }
992
993 #ifdef CONFIG_VNC_TLS
994 static ssize_t vnc_tls_push(gnutls_transport_ptr_t transport,
995 const void *data,
996 size_t len) {
997 struct VncState *vs = (struct VncState *)transport;
998 int ret;
999
1000 retry:
1001 ret = send(vs->csock, data, len, 0);
1002 if (ret < 0) {
1003 if (errno == EINTR)
1004 goto retry;
1005 return -1;
1006 }
1007 return ret;
1008 }
1009
1010
1011 static ssize_t vnc_tls_pull(gnutls_transport_ptr_t transport,
1012 void *data,
1013 size_t len) {
1014 struct VncState *vs = (struct VncState *)transport;
1015 int ret;
1016
1017 retry:
1018 ret = recv(vs->csock, data, len, 0);
1019 if (ret < 0) {
1020 if (errno == EINTR)
1021 goto retry;
1022 return -1;
1023 }
1024 return ret;
1025 }
1026 #endif /* CONFIG_VNC_TLS */
1027
1028 static void client_cut_text(VncState *vs, size_t len, uint8_t *text)
1029 {
1030 }
1031
1032 static void check_pointer_type_change(VncState *vs, int absolute)
1033 {
1034 if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) {
1035 vnc_write_u8(vs, 0);
1036 vnc_write_u8(vs, 0);
1037 vnc_write_u16(vs, 1);
1038 vnc_framebuffer_update(vs, absolute, 0,
1039 ds_get_width(vs->ds), ds_get_height(vs->ds),
1040 VNC_ENCODING_POINTER_TYPE_CHANGE);
1041 vnc_flush(vs);
1042 }
1043 vs->absolute = absolute;
1044 }
1045
1046 static void pointer_event(VncState *vs, int button_mask, int x, int y)
1047 {
1048 int buttons = 0;
1049 int dz = 0;
1050
1051 if (button_mask & 0x01)
1052 buttons |= MOUSE_EVENT_LBUTTON;
1053 if (button_mask & 0x02)
1054 buttons |= MOUSE_EVENT_MBUTTON;
1055 if (button_mask & 0x04)
1056 buttons |= MOUSE_EVENT_RBUTTON;
1057 if (button_mask & 0x08)
1058 dz = -1;
1059 if (button_mask & 0x10)
1060 dz = 1;
1061
1062 if (vs->absolute) {
1063 kbd_mouse_event(x * 0x7FFF / (ds_get_width(vs->ds) - 1),
1064 y * 0x7FFF / (ds_get_height(vs->ds) - 1),
1065 dz, buttons);
1066 } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) {
1067 x -= 0x7FFF;
1068 y -= 0x7FFF;
1069
1070 kbd_mouse_event(x, y, dz, buttons);
1071 } else {
1072 if (vs->last_x != -1)
1073 kbd_mouse_event(x - vs->last_x,
1074 y - vs->last_y,
1075 dz, buttons);
1076 vs->last_x = x;
1077 vs->last_y = y;
1078 }
1079
1080 check_pointer_type_change(vs, kbd_mouse_is_absolute());
1081 }
1082
1083 static void reset_keys(VncState *vs)
1084 {
1085 int i;
1086 for(i = 0; i < 256; i++) {
1087 if (vs->modifiers_state[i]) {
1088 if (i & 0x80)
1089 kbd_put_keycode(0xe0);
1090 kbd_put_keycode(i | 0x80);
1091 vs->modifiers_state[i] = 0;
1092 }
1093 }
1094 }
1095
1096 static void press_key(VncState *vs, int keysym)
1097 {
1098 kbd_put_keycode(keysym2scancode(vs->kbd_layout, keysym) & 0x7f);
1099 kbd_put_keycode(keysym2scancode(vs->kbd_layout, keysym) | 0x80);
1100 }
1101
1102 static void do_key_event(VncState *vs, int down, int keycode, int sym)
1103 {
1104 /* QEMU console switch */
1105 switch(keycode) {
1106 case 0x2a: /* Left Shift */
1107 case 0x36: /* Right Shift */
1108 case 0x1d: /* Left CTRL */
1109 case 0x9d: /* Right CTRL */
1110 case 0x38: /* Left ALT */
1111 case 0xb8: /* Right ALT */
1112 if (down)
1113 vs->modifiers_state[keycode] = 1;
1114 else
1115 vs->modifiers_state[keycode] = 0;
1116 break;
1117 case 0x02 ... 0x0a: /* '1' to '9' keys */
1118 if (down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) {
1119 /* Reset the modifiers sent to the current console */
1120 reset_keys(vs);
1121 console_select(keycode - 0x02);
1122 return;
1123 }
1124 break;
1125 case 0x3a: /* CapsLock */
1126 case 0x45: /* NumLock */
1127 if (!down)
1128 vs->modifiers_state[keycode] ^= 1;
1129 break;
1130 }
1131
1132 if (keycode_is_keypad(vs->kbd_layout, keycode)) {
1133 /* If the numlock state needs to change then simulate an additional
1134 keypress before sending this one. This will happen if the user
1135 toggles numlock away from the VNC window.
1136 */
1137 if (keysym_is_numlock(vs->kbd_layout, sym & 0xFFFF)) {
1138 if (!vs->modifiers_state[0x45]) {
1139 vs->modifiers_state[0x45] = 1;
1140 press_key(vs, 0xff7f);
1141 }
1142 } else {
1143 if (vs->modifiers_state[0x45]) {
1144 vs->modifiers_state[0x45] = 0;
1145 press_key(vs, 0xff7f);
1146 }
1147 }
1148 }
1149
1150 if (is_graphic_console()) {
1151 if (keycode & 0x80)
1152 kbd_put_keycode(0xe0);
1153 if (down)
1154 kbd_put_keycode(keycode & 0x7f);
1155 else
1156 kbd_put_keycode(keycode | 0x80);
1157 } else {
1158 /* QEMU console emulation */
1159 if (down) {
1160 switch (keycode) {
1161 case 0x2a: /* Left Shift */
1162 case 0x36: /* Right Shift */
1163 case 0x1d: /* Left CTRL */
1164 case 0x9d: /* Right CTRL */
1165 case 0x38: /* Left ALT */
1166 case 0xb8: /* Right ALT */
1167 break;
1168 case 0xc8:
1169 kbd_put_keysym(QEMU_KEY_UP);
1170 break;
1171 case 0xd0:
1172 kbd_put_keysym(QEMU_KEY_DOWN);
1173 break;
1174 case 0xcb:
1175 kbd_put_keysym(QEMU_KEY_LEFT);
1176 break;
1177 case 0xcd:
1178 kbd_put_keysym(QEMU_KEY_RIGHT);
1179 break;
1180 case 0xd3:
1181 kbd_put_keysym(QEMU_KEY_DELETE);
1182 break;
1183 case 0xc7:
1184 kbd_put_keysym(QEMU_KEY_HOME);
1185 break;
1186 case 0xcf:
1187 kbd_put_keysym(QEMU_KEY_END);
1188 break;
1189 case 0xc9:
1190 kbd_put_keysym(QEMU_KEY_PAGEUP);
1191 break;
1192 case 0xd1:
1193 kbd_put_keysym(QEMU_KEY_PAGEDOWN);
1194 break;
1195 default:
1196 kbd_put_keysym(sym);
1197 break;
1198 }
1199 }
1200 }
1201 }
1202
1203 static void key_event(VncState *vs, int down, uint32_t sym)
1204 {
1205 int keycode;
1206
1207 if (sym >= 'A' && sym <= 'Z' && is_graphic_console())
1208 sym = sym - 'A' + 'a';
1209
1210 keycode = keysym2scancode(vs->kbd_layout, sym & 0xFFFF);
1211 do_key_event(vs, down, keycode, sym);
1212 }
1213
1214 static void ext_key_event(VncState *vs, int down,
1215 uint32_t sym, uint16_t keycode)
1216 {
1217 /* if the user specifies a keyboard layout, always use it */
1218 if (keyboard_layout)
1219 key_event(vs, down, sym);
1220 else
1221 do_key_event(vs, down, keycode, sym);
1222 }
1223
1224 static void framebuffer_update_request(VncState *vs, int incremental,
1225 int x_position, int y_position,
1226 int w, int h)
1227 {
1228 if (x_position > ds_get_width(vs->ds))
1229 x_position = ds_get_width(vs->ds);
1230 if (y_position > ds_get_height(vs->ds))
1231 y_position = ds_get_height(vs->ds);
1232 if (x_position + w >= ds_get_width(vs->ds))
1233 w = ds_get_width(vs->ds) - x_position;
1234 if (y_position + h >= ds_get_height(vs->ds))
1235 h = ds_get_height(vs->ds) - y_position;
1236
1237 int i;
1238 vs->need_update = 1;
1239 if (!incremental) {
1240 char *old_row = vs->old_data + y_position * ds_get_linesize(vs->ds);
1241
1242 for (i = 0; i < h; i++) {
1243 vnc_set_bits(vs->dirty_row[y_position + i],
1244 (ds_get_width(vs->ds) / 16), VNC_DIRTY_WORDS);
1245 memset(old_row, 42, ds_get_width(vs->ds) * ds_get_bytes_per_pixel(vs->ds));
1246 old_row += ds_get_linesize(vs->ds);
1247 }
1248 }
1249 }
1250
1251 static void send_ext_key_event_ack(VncState *vs)
1252 {
1253 vnc_write_u8(vs, 0);
1254 vnc_write_u8(vs, 0);
1255 vnc_write_u16(vs, 1);
1256 vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
1257 VNC_ENCODING_EXT_KEY_EVENT);
1258 vnc_flush(vs);
1259 }
1260
1261 static void send_ext_audio_ack(VncState *vs)
1262 {
1263 vnc_write_u8(vs, 0);
1264 vnc_write_u8(vs, 0);
1265 vnc_write_u16(vs, 1);
1266 vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
1267 VNC_ENCODING_AUDIO);
1268 vnc_flush(vs);
1269 }
1270
1271 static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
1272 {
1273 int i;
1274 unsigned int enc = 0;
1275
1276 vnc_zlib_init(vs);
1277 vs->features = 0;
1278 vs->vnc_encoding = 0;
1279 vs->tight_compression = 9;
1280 vs->tight_quality = 9;
1281 vs->absolute = -1;
1282 dcl->dpy_copy = NULL;
1283
1284 for (i = n_encodings - 1; i >= 0; i--) {
1285 enc = encodings[i];
1286 switch (enc) {
1287 case VNC_ENCODING_RAW:
1288 vs->vnc_encoding = enc;
1289 break;
1290 case VNC_ENCODING_COPYRECT:
1291 dcl->dpy_copy = vnc_copy;
1292 break;
1293 case VNC_ENCODING_HEXTILE:
1294 vs->features |= VNC_FEATURE_HEXTILE_MASK;
1295 vs->vnc_encoding = enc;
1296 break;
1297 case VNC_ENCODING_ZLIB:
1298 vs->features |= VNC_FEATURE_ZLIB_MASK;
1299 vs->vnc_encoding = enc;
1300 break;
1301 case VNC_ENCODING_DESKTOPRESIZE:
1302 vs->features |= VNC_FEATURE_RESIZE_MASK;
1303 break;
1304 case VNC_ENCODING_POINTER_TYPE_CHANGE:
1305 vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK;
1306 break;
1307 case VNC_ENCODING_EXT_KEY_EVENT:
1308 send_ext_key_event_ack(vs);
1309 break;
1310 case VNC_ENCODING_AUDIO:
1311 send_ext_audio_ack(vs);
1312 break;
1313 case VNC_ENCODING_WMVi:
1314 vs->features |= VNC_FEATURE_WMVI_MASK;
1315 break;
1316 case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9:
1317 vs->tight_compression = (enc & 0x0F);
1318 break;
1319 case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9:
1320 vs->tight_quality = (enc & 0x0F);
1321 break;
1322 default:
1323 VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc);
1324 break;
1325 }
1326 }
1327
1328 check_pointer_type_change(vs, kbd_mouse_is_absolute());
1329 }
1330
1331 static void set_pixel_conversion(VncState *vs)
1332 {
1333 if ((vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) ==
1334 (vs->ds->surface->flags & QEMU_BIG_ENDIAN_FLAG) &&
1335 !memcmp(&(vs->clientds.pf), &(vs->ds->surface->pf), sizeof(PixelFormat))) {
1336 vs->write_pixels = vnc_write_pixels_copy;
1337 switch (vs->ds->surface->pf.bits_per_pixel) {
1338 case 8:
1339 vs->send_hextile_tile = send_hextile_tile_8;
1340 break;
1341 case 16:
1342 vs->send_hextile_tile = send_hextile_tile_16;
1343 break;
1344 case 32:
1345 vs->send_hextile_tile = send_hextile_tile_32;
1346 break;
1347 }
1348 } else {
1349 vs->write_pixels = vnc_write_pixels_generic;
1350 switch (vs->ds->surface->pf.bits_per_pixel) {
1351 case 8:
1352 vs->send_hextile_tile = send_hextile_tile_generic_8;
1353 break;
1354 case 16:
1355 vs->send_hextile_tile = send_hextile_tile_generic_16;
1356 break;
1357 case 32:
1358 vs->send_hextile_tile = send_hextile_tile_generic_32;
1359 break;
1360 }
1361 }
1362 }
1363
1364 static void set_pixel_format(VncState *vs,
1365 int bits_per_pixel, int depth,
1366 int big_endian_flag, int true_color_flag,
1367 int red_max, int green_max, int blue_max,
1368 int red_shift, int green_shift, int blue_shift)
1369 {
1370 if (!true_color_flag) {
1371 vnc_client_error(vs);
1372 return;
1373 }
1374
1375 vs->clientds = vs->serverds;
1376 vs->clientds.pf.rmax = red_max;
1377 count_bits(vs->clientds.pf.rbits, red_max);
1378 vs->clientds.pf.rshift = red_shift;
1379 vs->clientds.pf.rmask = red_max << red_shift;
1380 vs->clientds.pf.gmax = green_max;
1381 count_bits(vs->clientds.pf.gbits, green_max);
1382 vs->clientds.pf.gshift = green_shift;
1383 vs->clientds.pf.gmask = green_max << green_shift;
1384 vs->clientds.pf.bmax = blue_max;
1385 count_bits(vs->clientds.pf.bbits, blue_max);
1386 vs->clientds.pf.bshift = blue_shift;
1387 vs->clientds.pf.bmask = blue_max << blue_shift;
1388 vs->clientds.pf.bits_per_pixel = bits_per_pixel;
1389 vs->clientds.pf.bytes_per_pixel = bits_per_pixel / 8;
1390 vs->clientds.pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;
1391 vs->clientds.flags = big_endian_flag ? QEMU_BIG_ENDIAN_FLAG : 0x00;
1392
1393 set_pixel_conversion(vs);
1394
1395 vga_hw_invalidate();
1396 vga_hw_update();
1397 }
1398
1399 static void pixel_format_message (VncState *vs) {
1400 char pad[3] = { 0, 0, 0 };
1401
1402 vnc_write_u8(vs, vs->ds->surface->pf.bits_per_pixel); /* bits-per-pixel */
1403 vnc_write_u8(vs, vs->ds->surface->pf.depth); /* depth */
1404
1405 #ifdef WORDS_BIGENDIAN
1406 vnc_write_u8(vs, 1); /* big-endian-flag */
1407 #else
1408 vnc_write_u8(vs, 0); /* big-endian-flag */
1409 #endif
1410 vnc_write_u8(vs, 1); /* true-color-flag */
1411 vnc_write_u16(vs, vs->ds->surface->pf.rmax); /* red-max */
1412 vnc_write_u16(vs, vs->ds->surface->pf.gmax); /* green-max */
1413 vnc_write_u16(vs, vs->ds->surface->pf.bmax); /* blue-max */
1414 vnc_write_u8(vs, vs->ds->surface->pf.rshift); /* red-shift */
1415 vnc_write_u8(vs, vs->ds->surface->pf.gshift); /* green-shift */
1416 vnc_write_u8(vs, vs->ds->surface->pf.bshift); /* blue-shift */
1417 if (vs->ds->surface->pf.bits_per_pixel == 32)
1418 vs->send_hextile_tile = send_hextile_tile_32;
1419 else if (vs->ds->surface->pf.bits_per_pixel == 16)
1420 vs->send_hextile_tile = send_hextile_tile_16;
1421 else if (vs->ds->surface->pf.bits_per_pixel == 8)
1422 vs->send_hextile_tile = send_hextile_tile_8;
1423 vs->clientds = *(vs->ds->surface);
1424 vs->clientds.flags |= ~QEMU_ALLOCATED_FLAG;
1425 vs->write_pixels = vnc_write_pixels_copy;
1426
1427 vnc_write(vs, pad, 3); /* padding */
1428 }
1429
1430 static void vnc_dpy_setdata(DisplayState *ds)
1431 {
1432 /* We don't have to do anything */
1433 }
1434
1435 static void vnc_colordepth(DisplayState *ds)
1436 {
1437 struct VncState *vs = ds->opaque;
1438
1439 if (vs->csock != -1 && vnc_has_feature(vs, VNC_FEATURE_WMVI)) {
1440 /* Sending a WMVi message to notify the client*/
1441 vnc_write_u8(vs, 0); /* msg id */
1442 vnc_write_u8(vs, 0);
1443 vnc_write_u16(vs, 1); /* number of rects */
1444 vnc_framebuffer_update(vs, 0, 0, ds_get_width(ds), ds_get_height(ds),
1445 VNC_ENCODING_WMVi);
1446 pixel_format_message(vs);
1447 vnc_flush(vs);
1448 } else {
1449 set_pixel_conversion(vs);
1450 }
1451 }
1452
1453 static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
1454 {
1455 int i;
1456 uint16_t limit;
1457
1458 switch (data[0]) {
1459 case 0:
1460 if (len == 1)
1461 return 20;
1462
1463 set_pixel_format(vs, read_u8(data, 4), read_u8(data, 5),
1464 read_u8(data, 6), read_u8(data, 7),
1465 read_u16(data, 8), read_u16(data, 10),
1466 read_u16(data, 12), read_u8(data, 14),
1467 read_u8(data, 15), read_u8(data, 16));
1468 break;
1469 case 2:
1470 if (len == 1)
1471 return 4;
1472
1473 if (len == 4) {
1474 limit = read_u16(data, 2);
1475 if (limit > 0)
1476 return 4 + (limit * 4);
1477 } else
1478 limit = read_u16(data, 2);
1479
1480 for (i = 0; i < limit; i++) {
1481 int32_t val = read_s32(data, 4 + (i * 4));
1482 memcpy(data + 4 + (i * 4), &val, sizeof(val));
1483 }
1484
1485 set_encodings(vs, (int32_t *)(data + 4), limit);
1486 break;
1487 case 3:
1488 if (len == 1)
1489 return 10;
1490
1491 framebuffer_update_request(vs,
1492 read_u8(data, 1), read_u16(data, 2), read_u16(data, 4),
1493 read_u16(data, 6), read_u16(data, 8));
1494 break;
1495 case 4:
1496 if (len == 1)
1497 return 8;
1498
1499 key_event(vs, read_u8(data, 1), read_u32(data, 4));
1500 break;
1501 case 5:
1502 if (len == 1)
1503 return 6;
1504
1505 pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
1506 break;
1507 case 6:
1508 if (len == 1)
1509 return 8;
1510
1511 if (len == 8) {
1512 uint32_t dlen = read_u32(data, 4);
1513 if (dlen > 0)
1514 return 8 + dlen;
1515 }
1516
1517 client_cut_text(vs, read_u32(data, 4), data + 8);
1518 break;
1519 case 255:
1520 if (len == 1)
1521 return 2;
1522
1523 switch (read_u8(data, 1)) {
1524 case 0:
1525 if (len == 2)
1526 return 12;
1527
1528 ext_key_event(vs, read_u16(data, 2),
1529 read_u32(data, 4), read_u32(data, 8));
1530 break;
1531 case 1:
1532 if (len == 2)
1533 return 4;
1534
1535 switch (read_u16 (data, 2)) {
1536 case 0:
1537 audio_add(vs);
1538 break;
1539 case 1:
1540 audio_del(vs);
1541 break;
1542 case 2:
1543 if (len == 4)
1544 return 10;
1545 switch (read_u8(data, 4)) {
1546 case 0: vs->as.fmt = AUD_FMT_U8; break;
1547 case 1: vs->as.fmt = AUD_FMT_S8; break;
1548 case 2: vs->as.fmt = AUD_FMT_U16; break;
1549 case 3: vs->as.fmt = AUD_FMT_S16; break;
1550 case 4: vs->as.fmt = AUD_FMT_U32; break;
1551 case 5: vs->as.fmt = AUD_FMT_S32; break;
1552 default:
1553 printf("Invalid audio format %d\n", read_u8(data, 4));
1554 vnc_client_error(vs);
1555 break;
1556 }
1557 vs->as.nchannels = read_u8(data, 5);
1558 if (vs->as.nchannels != 1 && vs->as.nchannels != 2) {
1559 printf("Invalid audio channel coount %d\n",
1560 read_u8(data, 5));
1561 vnc_client_error(vs);
1562 break;
1563 }
1564 vs->as.freq = read_u32(data, 6);
1565 break;
1566 default:
1567 printf ("Invalid audio message %d\n", read_u8(data, 4));
1568 vnc_client_error(vs);
1569 break;
1570 }
1571 break;
1572
1573 default:
1574 printf("Msg: %d\n", read_u16(data, 0));
1575 vnc_client_error(vs);
1576 break;
1577 }
1578 break;
1579 default:
1580 printf("Msg: %d\n", data[0]);
1581 vnc_client_error(vs);
1582 break;
1583 }
1584
1585 vnc_read_when(vs, protocol_client_msg, 1);
1586 return 0;
1587 }
1588
1589 static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
1590 {
1591 char buf[1024];
1592 int size;
1593
1594 vnc_write_u16(vs, ds_get_width(vs->ds));
1595 vnc_write_u16(vs, ds_get_height(vs->ds));
1596
1597 pixel_format_message(vs);
1598
1599 if (qemu_name)
1600 size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
1601 else
1602 size = snprintf(buf, sizeof(buf), "QEMU");
1603
1604 vnc_write_u32(vs, size);
1605 vnc_write(vs, buf, size);
1606 vnc_flush(vs);
1607
1608 vnc_read_when(vs, protocol_client_msg, 1);
1609
1610 return 0;
1611 }
1612
1613 static void make_challenge(VncState *vs)
1614 {
1615 int i;
1616
1617 srand(time(NULL)+getpid()+getpid()*987654+rand());
1618
1619 for (i = 0 ; i < sizeof(vs->challenge) ; i++)
1620 vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
1621 }
1622
1623 static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
1624 {
1625 unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
1626 int i, j, pwlen;
1627 unsigned char key[8];
1628
1629 if (!vs->password || !vs->password[0]) {
1630 VNC_DEBUG("No password configured on server");
1631 vnc_write_u32(vs, 1); /* Reject auth */
1632 if (vs->minor >= 8) {
1633 static const char err[] = "Authentication failed";
1634 vnc_write_u32(vs, sizeof(err));
1635 vnc_write(vs, err, sizeof(err));
1636 }
1637 vnc_flush(vs);
1638 vnc_client_error(vs);
1639 return 0;
1640 }
1641
1642 memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
1643
1644 /* Calculate the expected challenge response */
1645 pwlen = strlen(vs->password);
1646 for (i=0; i<sizeof(key); i++)
1647 key[i] = i<pwlen ? vs->password[i] : 0;
1648 deskey(key, EN0);
1649 for (j = 0; j < VNC_AUTH_CHALLENGE_SIZE; j += 8)
1650 des(response+j, response+j);
1651
1652 /* Compare expected vs actual challenge response */
1653 if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) {
1654 VNC_DEBUG("Client challenge reponse did not match\n");
1655 vnc_write_u32(vs, 1); /* Reject auth */
1656 if (vs->minor >= 8) {
1657 static const char err[] = "Authentication failed";
1658 vnc_write_u32(vs, sizeof(err));
1659 vnc_write(vs, err, sizeof(err));
1660 }
1661 vnc_flush(vs);
1662 vnc_client_error(vs);
1663 } else {
1664 VNC_DEBUG("Accepting VNC challenge response\n");
1665 vnc_write_u32(vs, 0); /* Accept auth */
1666 vnc_flush(vs);
1667
1668 vnc_read_when(vs, protocol_client_init, 1);
1669 }
1670 return 0;
1671 }
1672
1673 static int start_auth_vnc(VncState *vs)
1674 {
1675 make_challenge(vs);
1676 /* Send client a 'random' challenge */
1677 vnc_write(vs, vs->challenge, sizeof(vs->challenge));
1678 vnc_flush(vs);
1679
1680 vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge));
1681 return 0;
1682 }
1683
1684
1685 #ifdef CONFIG_VNC_TLS
1686 #define DH_BITS 1024
1687 static gnutls_dh_params_t dh_params;
1688
1689 static int vnc_tls_initialize(void)
1690 {
1691 static int tlsinitialized = 0;
1692
1693 if (tlsinitialized)
1694 return 1;
1695
1696 if (gnutls_global_init () < 0)
1697 return 0;
1698
1699 /* XXX ought to re-generate diffie-hellmen params periodically */
1700 if (gnutls_dh_params_init (&dh_params) < 0)
1701 return 0;
1702 if (gnutls_dh_params_generate2 (dh_params, DH_BITS) < 0)
1703 return 0;
1704
1705 #if defined(_VNC_DEBUG) && _VNC_DEBUG >= 2
1706 gnutls_global_set_log_level(10);
1707 gnutls_global_set_log_function(vnc_debug_gnutls_log);
1708 #endif
1709
1710 tlsinitialized = 1;
1711
1712 return 1;
1713 }
1714
1715 static gnutls_anon_server_credentials vnc_tls_initialize_anon_cred(void)
1716 {
1717 gnutls_anon_server_credentials anon_cred;
1718 int ret;
1719
1720 if ((ret = gnutls_anon_allocate_server_credentials(&anon_cred)) < 0) {
1721 VNC_DEBUG("Cannot allocate credentials %s\n", gnutls_strerror(ret));
1722 return NULL;
1723 }
1724
1725 gnutls_anon_set_server_dh_params(anon_cred, dh_params);
1726
1727 return anon_cred;
1728 }
1729
1730
1731 static gnutls_certificate_credentials_t vnc_tls_initialize_x509_cred(VncState *vs)
1732 {
1733 gnutls_certificate_credentials_t x509_cred;
1734 int ret;
1735
1736 if (!vs->x509cacert) {
1737 VNC_DEBUG("No CA x509 certificate specified\n");
1738 return NULL;
1739 }
1740 if (!vs->x509cert) {
1741 VNC_DEBUG("No server x509 certificate specified\n");
1742 return NULL;
1743 }
1744 if (!vs->x509key) {
1745 VNC_DEBUG("No server private key specified\n");
1746 return NULL;
1747 }
1748
1749 if ((ret = gnutls_certificate_allocate_credentials(&x509_cred)) < 0) {
1750 VNC_DEBUG("Cannot allocate credentials %s\n", gnutls_strerror(ret));
1751 return NULL;
1752 }
1753 if ((ret = gnutls_certificate_set_x509_trust_file(x509_cred,
1754 vs->x509cacert,
1755 GNUTLS_X509_FMT_PEM)) < 0) {
1756 VNC_DEBUG("Cannot load CA certificate %s\n", gnutls_strerror(ret));
1757 gnutls_certificate_free_credentials(x509_cred);
1758 return NULL;
1759 }
1760
1761 if ((ret = gnutls_certificate_set_x509_key_file (x509_cred,
1762 vs->x509cert,
1763 vs->x509key,
1764 GNUTLS_X509_FMT_PEM)) < 0) {
1765 VNC_DEBUG("Cannot load certificate & key %s\n", gnutls_strerror(ret));
1766 gnutls_certificate_free_credentials(x509_cred);
1767 return NULL;
1768 }
1769
1770 if (vs->x509cacrl) {
1771 if ((ret = gnutls_certificate_set_x509_crl_file(x509_cred,
1772 vs->x509cacrl,
1773 GNUTLS_X509_FMT_PEM)) < 0) {
1774 VNC_DEBUG("Cannot load CRL %s\n", gnutls_strerror(ret));
1775 gnutls_certificate_free_credentials(x509_cred);
1776 return NULL;
1777 }
1778 }
1779
1780 gnutls_certificate_set_dh_params (x509_cred, dh_params);
1781
1782 return x509_cred;
1783 }
1784
1785 static int vnc_validate_certificate(struct VncState *vs)
1786 {
1787 int ret;
1788 unsigned int status;
1789 const gnutls_datum_t *certs;
1790 unsigned int nCerts, i;
1791 time_t now;
1792
1793 VNC_DEBUG("Validating client certificate\n");
1794 if ((ret = gnutls_certificate_verify_peers2 (vs->tls_session, &status)) < 0) {
1795 VNC_DEBUG("Verify failed %s\n", gnutls_strerror(ret));
1796 return -1;
1797 }
1798
1799 if ((now = time(NULL)) == ((time_t)-1)) {
1800 return -1;
1801 }
1802
1803 if (status != 0) {
1804 if (status & GNUTLS_CERT_INVALID)
1805 VNC_DEBUG("The certificate is not trusted.\n");
1806
1807 if (status & GNUTLS_CERT_SIGNER_NOT_FOUND)
1808 VNC_DEBUG("The certificate hasn't got a known issuer.\n");
1809
1810 if (status & GNUTLS_CERT_REVOKED)
1811 VNC_DEBUG("The certificate has been revoked.\n");
1812
1813 if (status & GNUTLS_CERT_INSECURE_ALGORITHM)
1814 VNC_DEBUG("The certificate uses an insecure algorithm\n");
1815
1816 return -1;
1817 } else {
1818 VNC_DEBUG("Certificate is valid!\n");
1819 }
1820
1821 /* Only support x509 for now */
1822 if (gnutls_certificate_type_get(vs->tls_session) != GNUTLS_CRT_X509)
1823 return -1;
1824
1825 if (!(certs = gnutls_certificate_get_peers(vs->tls_session, &nCerts)))
1826 return -1;
1827
1828 for (i = 0 ; i < nCerts ; i++) {
1829 gnutls_x509_crt_t cert;
1830 VNC_DEBUG ("Checking certificate chain %d\n", i);
1831 if (gnutls_x509_crt_init (&cert) < 0)
1832 return -1;
1833
1834 if (gnutls_x509_crt_import(cert, &certs[i], GNUTLS_X509_FMT_DER) < 0) {
1835 gnutls_x509_crt_deinit (cert);
1836 return -1;
1837 }
1838
1839 if (gnutls_x509_crt_get_expiration_time (cert) < now) {
1840 VNC_DEBUG("The certificate has expired\n");
1841 gnutls_x509_crt_deinit (cert);
1842 return -1;
1843 }
1844
1845 if (gnutls_x509_crt_get_activation_time (cert) > now) {
1846 VNC_DEBUG("The certificate is not yet activated\n");
1847 gnutls_x509_crt_deinit (cert);
1848 return -1;
1849 }
1850
1851 if (gnutls_x509_crt_get_activation_time (cert) > now) {
1852 VNC_DEBUG("The certificate is not yet activated\n");
1853 gnutls_x509_crt_deinit (cert);
1854 return -1;
1855 }
1856
1857 gnutls_x509_crt_deinit (cert);
1858 }
1859
1860 return 0;
1861 }
1862
1863
1864 static int start_auth_vencrypt_subauth(VncState *vs)
1865 {
1866 switch (vs->subauth) {
1867 case VNC_AUTH_VENCRYPT_TLSNONE:
1868 case VNC_AUTH_VENCRYPT_X509NONE:
1869 VNC_DEBUG("Accept TLS auth none\n");
1870 vnc_write_u32(vs, 0); /* Accept auth completion */
1871 vnc_read_when(vs, protocol_client_init, 1);
1872 break;
1873
1874 case VNC_AUTH_VENCRYPT_TLSVNC:
1875 case VNC_AUTH_VENCRYPT_X509VNC:
1876 VNC_DEBUG("Start TLS auth VNC\n");
1877 return start_auth_vnc(vs);
1878
1879 default: /* Should not be possible, but just in case */
1880 VNC_DEBUG("Reject auth %d\n", vs->auth);
1881 vnc_write_u8(vs, 1);
1882 if (vs->minor >= 8) {
1883 static const char err[] = "Unsupported authentication type";
1884 vnc_write_u32(vs, sizeof(err));
1885 vnc_write(vs, err, sizeof(err));
1886 }
1887 vnc_client_error(vs);
1888 }
1889
1890 return 0;
1891 }
1892
1893 static void vnc_handshake_io(void *opaque);
1894
1895 static int vnc_continue_handshake(struct VncState *vs) {
1896 int ret;
1897
1898 if ((ret = gnutls_handshake(vs->tls_session)) < 0) {
1899 if (!gnutls_error_is_fatal(ret)) {
1900 VNC_DEBUG("Handshake interrupted (blocking)\n");
1901 if (!gnutls_record_get_direction(vs->tls_session))
1902 qemu_set_fd_handler(vs->csock, vnc_handshake_io, NULL, vs);
1903 else
1904 qemu_set_fd_handler(vs->csock, NULL, vnc_handshake_io, vs);
1905 return 0;
1906 }
1907 VNC_DEBUG("Handshake failed %s\n", gnutls_strerror(ret));
1908 vnc_client_error(vs);
1909 return -1;
1910 }
1911
1912 if (vs->x509verify) {
1913 if (vnc_validate_certificate(vs) < 0) {
1914 VNC_DEBUG("Client verification failed\n");
1915 vnc_client_error(vs);
1916 return -1;
1917 } else {
1918 VNC_DEBUG("Client verification passed\n");
1919 }
1920 }
1921
1922 VNC_DEBUG("Handshake done, switching to TLS data mode\n");
1923 vs->wiremode = VNC_WIREMODE_TLS;
1924 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, vnc_client_write, vs);
1925
1926 return start_auth_vencrypt_subauth(vs);
1927 }
1928
1929 static void vnc_handshake_io(void *opaque) {
1930 struct VncState *vs = (struct VncState *)opaque;
1931
1932 VNC_DEBUG("Handshake IO continue\n");
1933 vnc_continue_handshake(vs);
1934 }
1935
1936 #define NEED_X509_AUTH(vs) \
1937 ((vs)->subauth == VNC_AUTH_VENCRYPT_X509NONE || \
1938 (vs)->subauth == VNC_AUTH_VENCRYPT_X509VNC || \
1939 (vs)->subauth == VNC_AUTH_VENCRYPT_X509PLAIN)
1940
1941
1942 static int vnc_start_tls(struct VncState *vs) {
1943 static const int cert_type_priority[] = { GNUTLS_CRT_X509, 0 };
1944 static const int protocol_priority[]= { GNUTLS_TLS1_1, GNUTLS_TLS1_0, GNUTLS_SSL3, 0 };
1945 static const int kx_anon[] = {GNUTLS_KX_ANON_DH, 0};
1946 static const int kx_x509[] = {GNUTLS_KX_DHE_DSS, GNUTLS_KX_RSA, GNUTLS_KX_DHE_RSA, GNUTLS_KX_SRP, 0};
1947
1948 VNC_DEBUG("Do TLS setup\n");
1949 if (vnc_tls_initialize() < 0) {
1950 VNC_DEBUG("Failed to init TLS\n");
1951 vnc_client_error(vs);
1952 return -1;
1953 }
1954 if (vs->tls_session == NULL) {
1955 if (gnutls_init(&vs->tls_session, GNUTLS_SERVER) < 0) {
1956 vnc_client_error(vs);
1957 return -1;
1958 }
1959
1960 if (gnutls_set_default_priority(vs->tls_session) < 0) {
1961 gnutls_deinit(vs->tls_session);
1962 vs->tls_session = NULL;
1963 vnc_client_error(vs);
1964 return -1;
1965 }
1966
1967 if (gnutls_kx_set_priority(vs->tls_session, NEED_X509_AUTH(vs) ? kx_x509 : kx_anon) < 0) {
1968 gnutls_deinit(vs->tls_session);
1969 vs->tls_session = NULL;
1970 vnc_client_error(vs);
1971 return -1;
1972 }
1973
1974 if (gnutls_certificate_type_set_priority(vs->tls_session, cert_type_priority) < 0) {
1975 gnutls_deinit(vs->tls_session);
1976 vs->tls_session = NULL;
1977 vnc_client_error(vs);
1978 return -1;
1979 }
1980
1981 if (gnutls_protocol_set_priority(vs->tls_session, protocol_priority) < 0) {
1982 gnutls_deinit(vs->tls_session);
1983 vs->tls_session = NULL;
1984 vnc_client_error(vs);
1985 return -1;
1986 }
1987
1988 if (NEED_X509_AUTH(vs)) {
1989 gnutls_certificate_server_credentials x509_cred = vnc_tls_initialize_x509_cred(vs);
1990 if (!x509_cred) {
1991 gnutls_deinit(vs->tls_session);
1992 vs->tls_session = NULL;
1993 vnc_client_error(vs);
1994 return -1;
1995 }
1996 if (gnutls_credentials_set(vs->tls_session, GNUTLS_CRD_CERTIFICATE, x509_cred) < 0) {
1997 gnutls_deinit(vs->tls_session);
1998 vs->tls_session = NULL;
1999 gnutls_certificate_free_credentials(x509_cred);
2000 vnc_client_error(vs);
2001 return -1;
2002 }
2003 if (vs->x509verify) {
2004 VNC_DEBUG("Requesting a client certificate\n");
2005 gnutls_certificate_server_set_request (vs->tls_session, GNUTLS_CERT_REQUEST);
2006 }
2007
2008 } else {
2009 gnutls_anon_server_credentials anon_cred = vnc_tls_initialize_anon_cred();
2010 if (!anon_cred) {
2011 gnutls_deinit(vs->tls_session);
2012 vs->tls_session = NULL;
2013 vnc_client_error(vs);
2014 return -1;
2015 }
2016 if (gnutls_credentials_set(vs->tls_session, GNUTLS_CRD_ANON, anon_cred) < 0) {
2017 gnutls_deinit(vs->tls_session);
2018 vs->tls_session = NULL;
2019 gnutls_anon_free_server_credentials(anon_cred);
2020 vnc_client_error(vs);
2021 return -1;
2022 }
2023 }
2024
2025 gnutls_transport_set_ptr(vs->tls_session, (gnutls_transport_ptr_t)vs);
2026 gnutls_transport_set_push_function(vs->tls_session, vnc_tls_push);
2027 gnutls_transport_set_pull_function(vs->tls_session, vnc_tls_pull);
2028 }
2029
2030 VNC_DEBUG("Start TLS handshake process\n");
2031 return vnc_continue_handshake(vs);
2032 }
2033
2034 static int protocol_client_vencrypt_auth(VncState *vs, uint8_t *data, size_t len)
2035 {
2036 int auth = read_u32(data, 0);
2037
2038 if (auth != vs->subauth) {
2039 VNC_DEBUG("Rejecting auth %d\n", auth);
2040 vnc_write_u8(vs, 0); /* Reject auth */
2041 vnc_flush(vs);
2042 vnc_client_error(vs);
2043 } else {
2044 VNC_DEBUG("Accepting auth %d, starting handshake\n", auth);
2045 vnc_write_u8(vs, 1); /* Accept auth */
2046 vnc_flush(vs);
2047
2048 if (vnc_start_tls(vs) < 0) {
2049 VNC_DEBUG("Failed to complete TLS\n");
2050 return 0;
2051 }
2052
2053 if (vs->wiremode == VNC_WIREMODE_TLS) {
2054 VNC_DEBUG("Starting VeNCrypt subauth\n");
2055 return start_auth_vencrypt_subauth(vs);
2056 } else {
2057 VNC_DEBUG("TLS handshake blocked\n");
2058 return 0;
2059 }
2060 }
2061 return 0;
2062 }
2063
2064 static int protocol_client_vencrypt_init(VncState *vs, uint8_t *data, size_t len)
2065 {
2066 if (data[0] != 0 ||
2067 data[1] != 2) {
2068 VNC_DEBUG("Unsupported VeNCrypt protocol %d.%d\n", (int)data[0], (int)data[1]);
2069 vnc_write_u8(vs, 1); /* Reject version */
2070 vnc_flush(vs);
2071 vnc_client_error(vs);
2072 } else {
2073 VNC_DEBUG("Sending allowed auth %d\n", vs->subauth);
2074 vnc_write_u8(vs, 0); /* Accept version */
2075 vnc_write_u8(vs, 1); /* Number of sub-auths */
2076 vnc_write_u32(vs, vs->subauth); /* The supported auth */
2077 vnc_flush(vs);
2078 vnc_read_when(vs, protocol_client_vencrypt_auth, 4);
2079 }
2080 return 0;
2081 }
2082
2083 static int start_auth_vencrypt(VncState *vs)
2084 {
2085 /* Send VeNCrypt version 0.2 */
2086 vnc_write_u8(vs, 0);
2087 vnc_write_u8(vs, 2);
2088
2089 vnc_read_when(vs, protocol_client_vencrypt_init, 2);
2090 return 0;
2091 }
2092 #endif /* CONFIG_VNC_TLS */
2093
2094 static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
2095 {
2096 /* We only advertise 1 auth scheme at a time, so client
2097 * must pick the one we sent. Verify this */
2098 if (data[0] != vs->auth) { /* Reject auth */
2099 VNC_DEBUG("Reject auth %d\n", (int)data[0]);
2100 vnc_write_u32(vs, 1);
2101 if (vs->minor >= 8) {
2102 static const char err[] = "Authentication failed";
2103 vnc_write_u32(vs, sizeof(err));
2104 vnc_write(vs, err, sizeof(err));
2105 }
2106 vnc_client_error(vs);
2107 } else { /* Accept requested auth */
2108 VNC_DEBUG("Client requested auth %d\n", (int)data[0]);
2109 switch (vs->auth) {
2110 case VNC_AUTH_NONE:
2111 VNC_DEBUG("Accept auth none\n");
2112 if (vs->minor >= 8) {
2113 vnc_write_u32(vs, 0); /* Accept auth completion */
2114 vnc_flush(vs);
2115 }
2116 vnc_read_when(vs, protocol_client_init, 1);
2117 break;
2118
2119 case VNC_AUTH_VNC:
2120 VNC_DEBUG("Start VNC auth\n");
2121 return start_auth_vnc(vs);
2122
2123 #ifdef CONFIG_VNC_TLS
2124 case VNC_AUTH_VENCRYPT:
2125 VNC_DEBUG("Accept VeNCrypt auth\n");;
2126 return start_auth_vencrypt(vs);
2127 #endif /* CONFIG_VNC_TLS */
2128
2129 default: /* Should not be possible, but just in case */
2130 VNC_DEBUG("Reject auth %d\n", vs->auth);
2131 vnc_write_u8(vs, 1);
2132 if (vs->minor >= 8) {
2133 static const char err[] = "Authentication failed";
2134 vnc_write_u32(vs, sizeof(err));
2135 vnc_write(vs, err, sizeof(err));
2136 }
2137 vnc_client_error(vs);
2138 }
2139 }
2140 return 0;
2141 }
2142
2143 static int protocol_version(VncState *vs, uint8_t *version, size_t len)
2144 {
2145 char local[13];
2146
2147 memcpy(local, version, 12);
2148 local[12] = 0;
2149
2150 if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) {
2151 VNC_DEBUG("Malformed protocol version %s\n", local);
2152 vnc_client_error(vs);
2153 return 0;
2154 }
2155 VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor);
2156 if (vs->major != 3 ||
2157 (vs->minor != 3 &&
2158 vs->minor != 4 &&
2159 vs->minor != 5 &&
2160 vs->minor != 7 &&
2161 vs->minor != 8)) {
2162 VNC_DEBUG("Unsupported client version\n");
2163 vnc_write_u32(vs, VNC_AUTH_INVALID);
2164 vnc_flush(vs);
2165 vnc_client_error(vs);
2166 return 0;
2167 }
2168 /* Some broken clients report v3.4 or v3.5, which spec requires to be treated
2169 * as equivalent to v3.3 by servers
2170 */
2171 if (vs->minor == 4 || vs->minor == 5)
2172 vs->minor = 3;
2173
2174 if (vs->minor == 3) {
2175 if (vs->auth == VNC_AUTH_NONE) {
2176 VNC_DEBUG("Tell client auth none\n");
2177 vnc_write_u32(vs, vs->auth);
2178 vnc_flush(vs);
2179 vnc_read_when(vs, protocol_client_init, 1);
2180 } else if (vs->auth == VNC_AUTH_VNC) {
2181 VNC_DEBUG("Tell client VNC auth\n");
2182 vnc_write_u32(vs, vs->auth);
2183 vnc_flush(vs);
2184 start_auth_vnc(vs);
2185 } else {
2186 VNC_DEBUG("Unsupported auth %d for protocol 3.3\n", vs->auth);
2187 vnc_write_u32(vs, VNC_AUTH_INVALID);
2188 vnc_flush(vs);
2189 vnc_client_error(vs);
2190 }
2191 } else {
2192 VNC_DEBUG("Telling client we support auth %d\n", vs->auth);
2193 vnc_write_u8(vs, 1); /* num auth */
2194 vnc_write_u8(vs, vs->auth);
2195 vnc_read_when(vs, protocol_client_auth, 1);
2196 vnc_flush(vs);
2197 }
2198
2199 return 0;
2200 }
2201
2202 static void vnc_connect(VncState *vs)
2203 {
2204 VNC_DEBUG("New client on socket %d\n", vs->csock);
2205 dcl->idle = 0;
2206 socket_set_nonblock(vs->csock);
2207 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
2208 vnc_write(vs, "RFB 003.008\n", 12);
2209 vnc_flush(vs);
2210 vnc_read_when(vs, protocol_version, 12);
2211 memset(vs->old_data, 0, ds_get_linesize(vs->ds) * ds_get_height(vs->ds));
2212 memset(vs->dirty_row, 0xFF, sizeof(vs->dirty_row));
2213 vs->features = 0;
2214 dcl->dpy_copy = NULL;
2215 vnc_update_client(vs);
2216 reset_keys(vs);
2217 }
2218
2219 static void vnc_listen_read(void *opaque)
2220 {
2221 VncState *vs = opaque;
2222 struct sockaddr_in addr;
2223 socklen_t addrlen = sizeof(addr);
2224
2225 /* Catch-up */
2226 vga_hw_update();
2227
2228 vs->csock = accept(vs->lsock, (struct sockaddr *)&addr, &addrlen);
2229 if (vs->csock != -1) {
2230 vnc_connect(vs);
2231 }
2232 }
2233
2234 void vnc_display_init(DisplayState *ds)
2235 {
2236 VncState *vs;
2237
2238 vs = qemu_mallocz(sizeof(VncState));
2239 dcl = qemu_mallocz(sizeof(DisplayChangeListener));
2240
2241 ds->opaque = vs;
2242 dcl->idle = 1;
2243 vnc_state = vs;
2244 vs->display = NULL;
2245 vs->password = NULL;
2246
2247 vs->lsock = -1;
2248 vs->csock = -1;
2249 vs->last_x = -1;
2250 vs->last_y = -1;
2251
2252 vs->ds = ds;
2253
2254 if (keyboard_layout)
2255 vs->kbd_layout = init_keyboard_layout(keyboard_layout);
2256 else
2257 vs->kbd_layout = init_keyboard_layout("en-us");
2258
2259 if (!vs->kbd_layout)
2260 exit(1);
2261
2262 vs->timer = qemu_new_timer(rt_clock, vnc_update_client, vs);
2263
2264 dcl->dpy_update = vnc_dpy_update;
2265 dcl->dpy_resize = vnc_dpy_resize;
2266 dcl->dpy_setdata = vnc_dpy_setdata;
2267 dcl->dpy_refresh = NULL;
2268 register_displaychangelistener(ds, dcl);
2269
2270 vs->as.freq = 44100;
2271 vs->as.nchannels = 2;
2272 vs->as.fmt = AUD_FMT_S16;
2273 vs->as.endianness = 0;
2274 }
2275
2276 #ifdef CONFIG_VNC_TLS
2277 static int vnc_set_x509_credential(VncState *vs,
2278 const char *certdir,
2279 const char *filename,
2280 char **cred,
2281 int ignoreMissing)
2282 {
2283 struct stat sb;
2284
2285 if (*cred) {
2286 qemu_free(*cred);
2287 *cred = NULL;
2288 }
2289
2290 *cred = qemu_malloc(strlen(certdir) + strlen(filename) + 2);
2291
2292 strcpy(*cred, certdir);
2293 strcat(*cred, "/");
2294 strcat(*cred, filename);
2295
2296 VNC_DEBUG("Check %s\n", *cred);
2297 if (stat(*cred, &sb) < 0) {
2298 qemu_free(*cred);
2299 *cred = NULL;
2300 if (ignoreMissing && errno == ENOENT)
2301 return 0;
2302 return -1;
2303 }
2304
2305 return 0;
2306 }
2307
2308 static int vnc_set_x509_credential_dir(VncState *vs,
2309 const char *certdir)
2310 {
2311 if (vnc_set_x509_credential(vs, certdir, X509_CA_CERT_FILE, &vs->x509cacert, 0) < 0)
2312 goto cleanup;
2313 if (vnc_set_x509_credential(vs, certdir, X509_CA_CRL_FILE, &vs->x509cacrl, 1) < 0)
2314 goto cleanup;
2315 if (vnc_set_x509_credential(vs, certdir, X509_SERVER_CERT_FILE, &vs->x509cert, 0) < 0)
2316 goto cleanup;
2317 if (vnc_set_x509_credential(vs, certdir, X509_SERVER_KEY_FILE, &vs->x509key, 0) < 0)
2318 goto cleanup;
2319
2320 return 0;
2321
2322 cleanup:
2323 qemu_free(vs->x509cacert);
2324 qemu_free(vs->x509cacrl);
2325 qemu_free(vs->x509cert);
2326 qemu_free(vs->x509key);
2327 vs->x509cacert = vs->x509cacrl = vs->x509cert = vs->x509key = NULL;
2328 return -1;
2329 }
2330 #endif /* CONFIG_VNC_TLS */
2331
2332 void vnc_display_close(DisplayState *ds)
2333 {
2334 VncState *vs = ds ? (VncState *)ds->opaque : vnc_state;
2335
2336 if (vs->display) {
2337 qemu_free(vs->display);
2338 vs->display = NULL;
2339 }
2340 if (vs->lsock != -1) {
2341 qemu_set_fd_handler2(vs->lsock, NULL, NULL, NULL, NULL);
2342 close(vs->lsock);
2343 vs->lsock = -1;
2344 }
2345 if (vs->csock != -1) {
2346 qemu_set_fd_handler2(vs->csock, NULL, NULL, NULL, NULL);
2347 closesocket(vs->csock);
2348 vs->csock = -1;
2349 buffer_reset(&vs->input);
2350 buffer_reset(&vs->output);
2351 vs->need_update = 0;
2352 #ifdef CONFIG_VNC_TLS
2353 if (vs->tls_session) {
2354 gnutls_deinit(vs->tls_session);
2355 vs->tls_session = NULL;
2356 }
2357 vs->wiremode = VNC_WIREMODE_CLEAR;
2358 #endif /* CONFIG_VNC_TLS */
2359 }
2360 vs->auth = VNC_AUTH_INVALID;
2361 #ifdef CONFIG_VNC_TLS
2362 vs->subauth = VNC_AUTH_INVALID;
2363 vs->x509verify = 0;
2364 #endif
2365 audio_del(vs);
2366 }
2367
2368 int vnc_display_password(DisplayState *ds, const char *password)
2369 {
2370 VncState *vs = ds ? (VncState *)ds->opaque : vnc_state;
2371
2372 if (vs->password) {
2373 qemu_free(vs->password);
2374 vs->password = NULL;
2375 }
2376 if (password && password[0]) {
2377 if (!(vs->password = qemu_strdup(password)))
2378 return -1;
2379 }
2380
2381 return 0;
2382 }
2383
2384 int vnc_display_open(DisplayState *ds, const char *display)
2385 {
2386 VncState *vs = ds ? (VncState *)ds->opaque : vnc_state;
2387 const char *options;
2388 int password = 0;
2389 int reverse = 0;
2390 int to_port = 0;
2391 #ifdef CONFIG_VNC_TLS
2392 int tls = 0, x509 = 0;
2393 #endif
2394
2395 vnc_display_close(ds);
2396 if (strcmp(display, "none") == 0)
2397 return 0;
2398
2399 if (!(vs->display = strdup(display)))
2400 return -1;
2401
2402 options = display;
2403 while ((options = strchr(options, ','))) {
2404 options++;
2405 if (strncmp(options, "password", 8) == 0) {
2406 password = 1; /* Require password auth */
2407 } else if (strncmp(options, "reverse", 7) == 0) {
2408 reverse = 1;
2409 } else if (strncmp(options, "to=", 3) == 0) {
2410 to_port = atoi(options+3) + 5900;
2411 #ifdef CONFIG_VNC_TLS
2412 } else if (strncmp(options, "tls", 3) == 0) {
2413 tls = 1; /* Require TLS */
2414 } else if (strncmp(options, "x509", 4) == 0) {
2415 char *start, *end;
2416 x509 = 1; /* Require x509 certificates */
2417 if (strncmp(options, "x509verify", 10) == 0)
2418 vs->x509verify = 1; /* ...and verify client certs */
2419
2420 /* Now check for 'x509=/some/path' postfix
2421 * and use that to setup x509 certificate/key paths */
2422 start = strchr(options, '=');
2423 end = strchr(options, ',');
2424 if (start && (!end || (start < end))) {
2425 int len = end ? end-(start+1) : strlen(start+1);
2426 char *path = qemu_strndup(start + 1, len);
2427
2428 VNC_DEBUG("Trying certificate path '%s'\n", path);
2429 if (vnc_set_x509_credential_dir(vs, path) < 0) {
2430 fprintf(stderr, "Failed to find x509 certificates/keys in %s\n", path);
2431 qemu_free(path);
2432 qemu_free(vs->display);
2433 vs->display = NULL;
2434 return -1;
2435 }
2436 qemu_free(path);
2437 } else {
2438 fprintf(stderr, "No certificate path provided\n");
2439 qemu_free(vs->display);
2440 vs->display = NULL;
2441 return -1;
2442 }
2443 #endif
2444 }
2445 }
2446
2447 if (password) {
2448 #ifdef CONFIG_VNC_TLS
2449 if (tls) {
2450 vs->auth = VNC_AUTH_VENCRYPT;
2451 if (x509) {
2452 VNC_DEBUG("Initializing VNC server with x509 password auth\n");
2453 vs->subauth = VNC_AUTH_VENCRYPT_X509VNC;
2454 } else {
2455 VNC_DEBUG("Initializing VNC server with TLS password auth\n");
2456 vs->subauth = VNC_AUTH_VENCRYPT_TLSVNC;
2457 }
2458 } else {
2459 #endif
2460 VNC_DEBUG("Initializing VNC server with password auth\n");
2461 vs->auth = VNC_AUTH_VNC;
2462 #ifdef CONFIG_VNC_TLS
2463 vs->subauth = VNC_AUTH_INVALID;
2464 }
2465 #endif
2466 } else {
2467 #ifdef CONFIG_VNC_TLS
2468 if (tls) {
2469 vs->auth = VNC_AUTH_VENCRYPT;
2470 if (x509) {
2471 VNC_DEBUG("Initializing VNC server with x509 no auth\n");
2472 vs->subauth = VNC_AUTH_VENCRYPT_X509NONE;
2473 } else {
2474 VNC_DEBUG("Initializing VNC server with TLS no auth\n");
2475 vs->subauth = VNC_AUTH_VENCRYPT_TLSNONE;
2476 }
2477 } else {
2478 #endif
2479 VNC_DEBUG("Initializing VNC server with no auth\n");
2480 vs->auth = VNC_AUTH_NONE;
2481 #ifdef CONFIG_VNC_TLS
2482 vs->subauth = VNC_AUTH_INVALID;
2483 }
2484 #endif
2485 }
2486
2487 if (reverse) {
2488 /* connect to viewer */
2489 if (strncmp(display, "unix:", 5) == 0)
2490 vs->lsock = unix_connect(display+5);
2491 else
2492 vs->lsock = inet_connect(display, SOCK_STREAM);
2493 if (-1 == vs->lsock) {
2494 free(vs->display);
2495 vs->display = NULL;
2496 return -1;
2497 } else {
2498 vs->csock = vs->lsock;
2499 vs->lsock = -1;
2500 vnc_connect(vs);
2501 }
2502 return 0;
2503
2504 } else {
2505 /* listen for connects */
2506 char *dpy;
2507 dpy = qemu_malloc(256);
2508 if (strncmp(display, "unix:", 5) == 0) {
2509 pstrcpy(dpy, 256, "unix:");
2510 vs->lsock = unix_listen(display+5, dpy+5, 256-5);
2511 } else {
2512 vs->lsock = inet_listen(display, dpy, 256, SOCK_STREAM, 5900);
2513 }
2514 if (-1 == vs->lsock) {
2515 free(dpy);
2516 return -1;
2517 } else {
2518 free(vs->display);
2519 vs->display = dpy;
2520 }
2521 }
2522
2523 return qemu_set_fd_handler2(vs->lsock, vnc_listen_poll, vnc_listen_read, NULL, vs);
2524 }
QEmu