?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
block: define 'clock_type' for the accounting code
[qemu.git] / ui / vnc.c
blobf20c08db4a2dd0bdbb80b607f585b16140c0320c
1 /*
2 * QEMU VNC display driver
3 *
4 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5 * Copyright (C) 2006 Fabrice Bellard
6 * Copyright (C) 2009 Red Hat, Inc
7 *
8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to deal
10 * in the Software without restriction, including without limitation the rights
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12 * copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
14 *
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
17 *
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24 * THE SOFTWARE.
25 */
26
27 #include "vnc.h"
28 #include "vnc-jobs.h"
29 #include "trace.h"
30 #include "hw/qdev.h"
31 #include "sysemu/sysemu.h"
32 #include "qemu/error-report.h"
33 #include "qemu/sockets.h"
34 #include "qemu/timer.h"
35 #include "qemu/acl.h"
36 #include "qemu/config-file.h"
37 #include "qapi/qmp/qerror.h"
38 #include "qapi/qmp/types.h"
39 #include "qmp-commands.h"
40 #include "qemu/osdep.h"
41 #include "ui/input.h"
42 #include "qapi-event.h"
43 #include "crypto/hash.h"
44 #include "crypto/tlscredsanon.h"
45 #include "crypto/tlscredsx509.h"
46 #include "qom/object_interfaces.h"
47
48 #define VNC_REFRESH_INTERVAL_BASE GUI_REFRESH_INTERVAL_DEFAULT
49 #define VNC_REFRESH_INTERVAL_INC 50
50 #define VNC_REFRESH_INTERVAL_MAX GUI_REFRESH_INTERVAL_IDLE
51 static const struct timeval VNC_REFRESH_STATS = { 0, 500000 };
52 static const struct timeval VNC_REFRESH_LOSSY = { 2, 0 };
53
54 #include "vnc_keysym.h"
55 #include "crypto/cipher.h"
56
57 static QTAILQ_HEAD(, VncDisplay) vnc_displays =
58 QTAILQ_HEAD_INITIALIZER(vnc_displays);
59
60 static int vnc_cursor_define(VncState *vs);
61 static void vnc_release_modifiers(VncState *vs);
62
63 static void vnc_set_share_mode(VncState *vs, VncShareMode mode)
64 {
65 #ifdef _VNC_DEBUG
66 static const char *mn[] = {
67 [0] = "undefined",
68 [VNC_SHARE_MODE_CONNECTING] = "connecting",
69 [VNC_SHARE_MODE_SHARED] = "shared",
70 [VNC_SHARE_MODE_EXCLUSIVE] = "exclusive",
71 [VNC_SHARE_MODE_DISCONNECTED] = "disconnected",
72 };
73 fprintf(stderr, "%s/%d: %s -> %s\n", __func__,
74 vs->csock, mn[vs->share_mode], mn[mode]);
75 #endif
76
77 switch (vs->share_mode) {
78 case VNC_SHARE_MODE_CONNECTING:
79 vs->vd->num_connecting--;
80 break;
81 case VNC_SHARE_MODE_SHARED:
82 vs->vd->num_shared--;
83 break;
84 case VNC_SHARE_MODE_EXCLUSIVE:
85 vs->vd->num_exclusive--;
86 break;
87 default:
88 break;
89 }
90
91 vs->share_mode = mode;
92
93 switch (vs->share_mode) {
94 case VNC_SHARE_MODE_CONNECTING:
95 vs->vd->num_connecting++;
96 break;
97 case VNC_SHARE_MODE_SHARED:
98 vs->vd->num_shared++;
99 break;
100 case VNC_SHARE_MODE_EXCLUSIVE:
101 vs->vd->num_exclusive++;
102 break;
103 default:
104 break;
105 }
106 }
107
108 static char *addr_to_string(const char *format,
109 struct sockaddr_storage *sa,
110 socklen_t salen) {
111 char *addr;
112 char host[NI_MAXHOST];
113 char serv[NI_MAXSERV];
114 int err;
115 size_t addrlen;
116
117 if ((err = getnameinfo((struct sockaddr *)sa, salen,
118 host, sizeof(host),
119 serv, sizeof(serv),
120 NI_NUMERICHOST | NI_NUMERICSERV)) != 0) {
121 VNC_DEBUG("Cannot resolve address %d: %s\n",
122 err, gai_strerror(err));
123 return NULL;
124 }
125
126 /* Enough for the existing format + the 2 vars we're
127 * substituting in. */
128 addrlen = strlen(format) + strlen(host) + strlen(serv);
129 addr = g_malloc(addrlen + 1);
130 snprintf(addr, addrlen, format, host, serv);
131 addr[addrlen] = '\0';
132
133 return addr;
134 }
135
136
137 char *vnc_socket_local_addr(const char *format, int fd) {
138 struct sockaddr_storage sa;
139 socklen_t salen;
140
141 salen = sizeof(sa);
142 if (getsockname(fd, (struct sockaddr*)&sa, &salen) < 0)
143 return NULL;
144
145 return addr_to_string(format, &sa, salen);
146 }
147
148 char *vnc_socket_remote_addr(const char *format, int fd) {
149 struct sockaddr_storage sa;
150 socklen_t salen;
151
152 salen = sizeof(sa);
153 if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0)
154 return NULL;
155
156 return addr_to_string(format, &sa, salen);
157 }
158
159 static void vnc_init_basic_info(struct sockaddr_storage *sa,
160 socklen_t salen,
161 VncBasicInfo *info,
162 Error **errp)
163 {
164 char host[NI_MAXHOST];
165 char serv[NI_MAXSERV];
166 int err;
167
168 if ((err = getnameinfo((struct sockaddr *)sa, salen,
169 host, sizeof(host),
170 serv, sizeof(serv),
171 NI_NUMERICHOST | NI_NUMERICSERV)) != 0) {
172 error_setg(errp, "Cannot resolve address: %s",
173 gai_strerror(err));
174 return;
175 }
176
177 info->host = g_strdup(host);
178 info->service = g_strdup(serv);
179 info->family = inet_netfamily(sa->ss_family);
180 }
181
182 static void vnc_init_basic_info_from_server_addr(int fd, VncBasicInfo *info,
183 Error **errp)
184 {
185 struct sockaddr_storage sa;
186 socklen_t salen;
187
188 salen = sizeof(sa);
189 if (getsockname(fd, (struct sockaddr*)&sa, &salen) < 0) {
190 error_setg_errno(errp, errno, "getsockname failed");
191 return;
192 }
193
194 vnc_init_basic_info(&sa, salen, info, errp);
195 }
196
197 static void vnc_init_basic_info_from_remote_addr(int fd, VncBasicInfo *info,
198 Error **errp)
199 {
200 struct sockaddr_storage sa;
201 socklen_t salen;
202
203 salen = sizeof(sa);
204 if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0) {
205 error_setg_errno(errp, errno, "getpeername failed");
206 return;
207 }
208
209 vnc_init_basic_info(&sa, salen, info, errp);
210 }
211
212 static const char *vnc_auth_name(VncDisplay *vd) {
213 switch (vd->auth) {
214 case VNC_AUTH_INVALID:
215 return "invalid";
216 case VNC_AUTH_NONE:
217 return "none";
218 case VNC_AUTH_VNC:
219 return "vnc";
220 case VNC_AUTH_RA2:
221 return "ra2";
222 case VNC_AUTH_RA2NE:
223 return "ra2ne";
224 case VNC_AUTH_TIGHT:
225 return "tight";
226 case VNC_AUTH_ULTRA:
227 return "ultra";
228 case VNC_AUTH_TLS:
229 return "tls";
230 case VNC_AUTH_VENCRYPT:
231 switch (vd->subauth) {
232 case VNC_AUTH_VENCRYPT_PLAIN:
233 return "vencrypt+plain";
234 case VNC_AUTH_VENCRYPT_TLSNONE:
235 return "vencrypt+tls+none";
236 case VNC_AUTH_VENCRYPT_TLSVNC:
237 return "vencrypt+tls+vnc";
238 case VNC_AUTH_VENCRYPT_TLSPLAIN:
239 return "vencrypt+tls+plain";
240 case VNC_AUTH_VENCRYPT_X509NONE:
241 return "vencrypt+x509+none";
242 case VNC_AUTH_VENCRYPT_X509VNC:
243 return "vencrypt+x509+vnc";
244 case VNC_AUTH_VENCRYPT_X509PLAIN:
245 return "vencrypt+x509+plain";
246 case VNC_AUTH_VENCRYPT_TLSSASL:
247 return "vencrypt+tls+sasl";
248 case VNC_AUTH_VENCRYPT_X509SASL:
249 return "vencrypt+x509+sasl";
250 default:
251 return "vencrypt";
252 }
253 case VNC_AUTH_SASL:
254 return "sasl";
255 }
256 return "unknown";
257 }
258
259 static VncServerInfo *vnc_server_info_get(VncDisplay *vd)
260 {
261 VncServerInfo *info;
262 Error *err = NULL;
263
264 info = g_malloc(sizeof(*info));
265 vnc_init_basic_info_from_server_addr(vd->lsock,
266 qapi_VncServerInfo_base(info), &err);
267 info->has_auth = true;
268 info->auth = g_strdup(vnc_auth_name(vd));
269 if (err) {
270 qapi_free_VncServerInfo(info);
271 info = NULL;
272 error_free(err);
273 }
274 return info;
275 }
276
277 static void vnc_client_cache_auth(VncState *client)
278 {
279 if (!client->info) {
280 return;
281 }
282
283 if (client->tls) {
284 client->info->x509_dname =
285 qcrypto_tls_session_get_peer_name(client->tls);
286 client->info->has_x509_dname =
287 client->info->x509_dname != NULL;
288 }
289 #ifdef CONFIG_VNC_SASL
290 if (client->sasl.conn &&
291 client->sasl.username) {
292 client->info->has_sasl_username = true;
293 client->info->sasl_username = g_strdup(client->sasl.username);
294 }
295 #endif
296 }
297
298 static void vnc_client_cache_addr(VncState *client)
299 {
300 Error *err = NULL;
301
302 client->info = g_malloc0(sizeof(*client->info));
303 vnc_init_basic_info_from_remote_addr(client->csock,
304 qapi_VncClientInfo_base(client->info),
305 &err);
306 if (err) {
307 qapi_free_VncClientInfo(client->info);
308 client->info = NULL;
309 error_free(err);
310 }
311 }
312
313 static void vnc_qmp_event(VncState *vs, QAPIEvent event)
314 {
315 VncServerInfo *si;
316
317 if (!vs->info) {
318 return;
319 }
320
321 si = vnc_server_info_get(vs->vd);
322 if (!si) {
323 return;
324 }
325
326 switch (event) {
327 case QAPI_EVENT_VNC_CONNECTED:
328 qapi_event_send_vnc_connected(si, qapi_VncClientInfo_base(vs->info),
329 &error_abort);
330 break;
331 case QAPI_EVENT_VNC_INITIALIZED:
332 qapi_event_send_vnc_initialized(si, vs->info, &error_abort);
333 break;
334 case QAPI_EVENT_VNC_DISCONNECTED:
335 qapi_event_send_vnc_disconnected(si, vs->info, &error_abort);
336 break;
337 default:
338 break;
339 }
340
341 qapi_free_VncServerInfo(si);
342 }
343
344 static VncClientInfo *qmp_query_vnc_client(const VncState *client)
345 {
346 struct sockaddr_storage sa;
347 socklen_t salen = sizeof(sa);
348 char host[NI_MAXHOST];
349 char serv[NI_MAXSERV];
350 VncClientInfo *info;
351
352 if (getpeername(client->csock, (struct sockaddr *)&sa, &salen) < 0) {
353 return NULL;
354 }
355
356 if (getnameinfo((struct sockaddr *)&sa, salen,
357 host, sizeof(host),
358 serv, sizeof(serv),
359 NI_NUMERICHOST | NI_NUMERICSERV) < 0) {
360 return NULL;
361 }
362
363 info = g_malloc0(sizeof(*info));
364 info->host = g_strdup(host);
365 info->service = g_strdup(serv);
366 info->family = inet_netfamily(sa.ss_family);
367 info->websocket = client->websocket;
368
369 if (client->tls) {
370 info->x509_dname = qcrypto_tls_session_get_peer_name(client->tls);
371 info->has_x509_dname = info->x509_dname != NULL;
372 }
373 #ifdef CONFIG_VNC_SASL
374 if (client->sasl.conn && client->sasl.username) {
375 info->has_sasl_username = true;
376 info->sasl_username = g_strdup(client->sasl.username);
377 }
378 #endif
379
380 return info;
381 }
382
383 static VncDisplay *vnc_display_find(const char *id)
384 {
385 VncDisplay *vd;
386
387 if (id == NULL) {
388 return QTAILQ_FIRST(&vnc_displays);
389 }
390 QTAILQ_FOREACH(vd, &vnc_displays, next) {
391 if (strcmp(id, vd->id) == 0) {
392 return vd;
393 }
394 }
395 return NULL;
396 }
397
398 static VncClientInfoList *qmp_query_client_list(VncDisplay *vd)
399 {
400 VncClientInfoList *cinfo, *prev = NULL;
401 VncState *client;
402
403 QTAILQ_FOREACH(client, &vd->clients, next) {
404 cinfo = g_new0(VncClientInfoList, 1);
405 cinfo->value = qmp_query_vnc_client(client);
406 cinfo->next = prev;
407 prev = cinfo;
408 }
409 return prev;
410 }
411
412 VncInfo *qmp_query_vnc(Error **errp)
413 {
414 VncInfo *info = g_malloc0(sizeof(*info));
415 VncDisplay *vd = vnc_display_find(NULL);
416
417 if (vd == NULL || !vd->enabled) {
418 info->enabled = false;
419 } else {
420 struct sockaddr_storage sa;
421 socklen_t salen = sizeof(sa);
422 char host[NI_MAXHOST];
423 char serv[NI_MAXSERV];
424
425 info->enabled = true;
426
427 /* for compatibility with the original command */
428 info->has_clients = true;
429 info->clients = qmp_query_client_list(vd);
430
431 if (vd->lsock == -1) {
432 return info;
433 }
434
435 if (getsockname(vd->lsock, (struct sockaddr *)&sa,
436 &salen) == -1) {
437 error_setg(errp, QERR_UNDEFINED_ERROR);
438 goto out_error;
439 }
440
441 if (getnameinfo((struct sockaddr *)&sa, salen,
442 host, sizeof(host),
443 serv, sizeof(serv),
444 NI_NUMERICHOST | NI_NUMERICSERV) < 0) {
445 error_setg(errp, QERR_UNDEFINED_ERROR);
446 goto out_error;
447 }
448
449 info->has_host = true;
450 info->host = g_strdup(host);
451
452 info->has_service = true;
453 info->service = g_strdup(serv);
454
455 info->has_family = true;
456 info->family = inet_netfamily(sa.ss_family);
457
458 info->has_auth = true;
459 info->auth = g_strdup(vnc_auth_name(vd));
460 }
461
462 return info;
463
464 out_error:
465 qapi_free_VncInfo(info);
466 return NULL;
467 }
468
469 static VncBasicInfoList *qmp_query_server_entry(int socket,
470 bool websocket,
471 VncBasicInfoList *prev)
472 {
473 VncBasicInfoList *list;
474 VncBasicInfo *info;
475 struct sockaddr_storage sa;
476 socklen_t salen = sizeof(sa);
477 char host[NI_MAXHOST];
478 char serv[NI_MAXSERV];
479
480 if (getsockname(socket, (struct sockaddr *)&sa, &salen) < 0 ||
481 getnameinfo((struct sockaddr *)&sa, salen,
482 host, sizeof(host), serv, sizeof(serv),
483 NI_NUMERICHOST | NI_NUMERICSERV) < 0) {
484 return prev;
485 }
486
487 info = g_new0(VncBasicInfo, 1);
488 info->host = g_strdup(host);
489 info->service = g_strdup(serv);
490 info->family = inet_netfamily(sa.ss_family);
491 info->websocket = websocket;
492
493 list = g_new0(VncBasicInfoList, 1);
494 list->value = info;
495 list->next = prev;
496 return list;
497 }
498
499 static void qmp_query_auth(VncDisplay *vd, VncInfo2 *info)
500 {
501 switch (vd->auth) {
502 case VNC_AUTH_VNC:
503 info->auth = VNC_PRIMARY_AUTH_VNC;
504 break;
505 case VNC_AUTH_RA2:
506 info->auth = VNC_PRIMARY_AUTH_RA2;
507 break;
508 case VNC_AUTH_RA2NE:
509 info->auth = VNC_PRIMARY_AUTH_RA2NE;
510 break;
511 case VNC_AUTH_TIGHT:
512 info->auth = VNC_PRIMARY_AUTH_TIGHT;
513 break;
514 case VNC_AUTH_ULTRA:
515 info->auth = VNC_PRIMARY_AUTH_ULTRA;
516 break;
517 case VNC_AUTH_TLS:
518 info->auth = VNC_PRIMARY_AUTH_TLS;
519 break;
520 case VNC_AUTH_VENCRYPT:
521 info->auth = VNC_PRIMARY_AUTH_VENCRYPT;
522 info->has_vencrypt = true;
523 switch (vd->subauth) {
524 case VNC_AUTH_VENCRYPT_PLAIN:
525 info->vencrypt = VNC_VENCRYPT_SUB_AUTH_PLAIN;
526 break;
527 case VNC_AUTH_VENCRYPT_TLSNONE:
528 info->vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_NONE;
529 break;
530 case VNC_AUTH_VENCRYPT_TLSVNC:
531 info->vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_VNC;
532 break;
533 case VNC_AUTH_VENCRYPT_TLSPLAIN:
534 info->vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_PLAIN;
535 break;
536 case VNC_AUTH_VENCRYPT_X509NONE:
537 info->vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_NONE;
538 break;
539 case VNC_AUTH_VENCRYPT_X509VNC:
540 info->vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_VNC;
541 break;
542 case VNC_AUTH_VENCRYPT_X509PLAIN:
543 info->vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_PLAIN;
544 break;
545 case VNC_AUTH_VENCRYPT_TLSSASL:
546 info->vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_SASL;
547 break;
548 case VNC_AUTH_VENCRYPT_X509SASL:
549 info->vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_SASL;
550 break;
551 default:
552 info->has_vencrypt = false;
553 break;
554 }
555 break;
556 case VNC_AUTH_SASL:
557 info->auth = VNC_PRIMARY_AUTH_SASL;
558 break;
559 case VNC_AUTH_NONE:
560 default:
561 info->auth = VNC_PRIMARY_AUTH_NONE;
562 break;
563 }
564 }
565
566 VncInfo2List *qmp_query_vnc_servers(Error **errp)
567 {
568 VncInfo2List *item, *prev = NULL;
569 VncInfo2 *info;
570 VncDisplay *vd;
571 DeviceState *dev;
572
573 QTAILQ_FOREACH(vd, &vnc_displays, next) {
574 info = g_new0(VncInfo2, 1);
575 info->id = g_strdup(vd->id);
576 info->clients = qmp_query_client_list(vd);
577 qmp_query_auth(vd, info);
578 if (vd->dcl.con) {
579 dev = DEVICE(object_property_get_link(OBJECT(vd->dcl.con),
580 "device", NULL));
581 info->has_display = true;
582 info->display = g_strdup(dev->id);
583 }
584 if (vd->lsock != -1) {
585 info->server = qmp_query_server_entry(vd->lsock, false,
586 info->server);
587 }
588 if (vd->lwebsock != -1) {
589 info->server = qmp_query_server_entry(vd->lwebsock, true,
590 info->server);
591 }
592
593 item = g_new0(VncInfo2List, 1);
594 item->value = info;
595 item->next = prev;
596 prev = item;
597 }
598 return prev;
599 }
600
601 /* TODO
602 1) Get the queue working for IO.
603 2) there is some weirdness when using the -S option (the screen is grey
604 and not totally invalidated
605 3) resolutions > 1024
606 */
607
608 static int vnc_update_client(VncState *vs, int has_dirty, bool sync);
609 static void vnc_disconnect_start(VncState *vs);
610
611 static void vnc_colordepth(VncState *vs);
612 static void framebuffer_update_request(VncState *vs, int incremental,
613 int x_position, int y_position,
614 int w, int h);
615 static void vnc_refresh(DisplayChangeListener *dcl);
616 static int vnc_refresh_server_surface(VncDisplay *vd);
617
618 static void vnc_set_area_dirty(DECLARE_BITMAP(dirty[VNC_MAX_HEIGHT],
619 VNC_MAX_WIDTH / VNC_DIRTY_PIXELS_PER_BIT),
620 int width, int height,
621 int x, int y, int w, int h) {
622 /* this is needed this to ensure we updated all affected
623 * blocks if x % VNC_DIRTY_PIXELS_PER_BIT != 0 */
624 w += (x % VNC_DIRTY_PIXELS_PER_BIT);
625 x -= (x % VNC_DIRTY_PIXELS_PER_BIT);
626
627 x = MIN(x, width);
628 y = MIN(y, height);
629 w = MIN(x + w, width) - x;
630 h = MIN(y + h, height);
631
632 for (; y < h; y++) {
633 bitmap_set(dirty[y], x / VNC_DIRTY_PIXELS_PER_BIT,
634 DIV_ROUND_UP(w, VNC_DIRTY_PIXELS_PER_BIT));
635 }
636 }
637
638 static void vnc_dpy_update(DisplayChangeListener *dcl,
639 int x, int y, int w, int h)
640 {
641 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
642 struct VncSurface *s = &vd->guest;
643 int width = pixman_image_get_width(vd->server);
644 int height = pixman_image_get_height(vd->server);
645
646 vnc_set_area_dirty(s->dirty, width, height, x, y, w, h);
647 }
648
649 void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
650 int32_t encoding)
651 {
652 vnc_write_u16(vs, x);
653 vnc_write_u16(vs, y);
654 vnc_write_u16(vs, w);
655 vnc_write_u16(vs, h);
656
657 vnc_write_s32(vs, encoding);
658 }
659
660
661 static void vnc_desktop_resize(VncState *vs)
662 {
663 if (vs->csock == -1 || !vnc_has_feature(vs, VNC_FEATURE_RESIZE)) {
664 return;
665 }
666 if (vs->client_width == pixman_image_get_width(vs->vd->server) &&
667 vs->client_height == pixman_image_get_height(vs->vd->server)) {
668 return;
669 }
670 vs->client_width = pixman_image_get_width(vs->vd->server);
671 vs->client_height = pixman_image_get_height(vs->vd->server);
672 vnc_lock_output(vs);
673 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
674 vnc_write_u8(vs, 0);
675 vnc_write_u16(vs, 1); /* number of rects */
676 vnc_framebuffer_update(vs, 0, 0, vs->client_width, vs->client_height,
677 VNC_ENCODING_DESKTOPRESIZE);
678 vnc_unlock_output(vs);
679 vnc_flush(vs);
680 }
681
682 static void vnc_abort_display_jobs(VncDisplay *vd)
683 {
684 VncState *vs;
685
686 QTAILQ_FOREACH(vs, &vd->clients, next) {
687 vnc_lock_output(vs);
688 vs->abort = true;
689 vnc_unlock_output(vs);
690 }
691 QTAILQ_FOREACH(vs, &vd->clients, next) {
692 vnc_jobs_join(vs);
693 }
694 QTAILQ_FOREACH(vs, &vd->clients, next) {
695 vnc_lock_output(vs);
696 vs->abort = false;
697 vnc_unlock_output(vs);
698 }
699 }
700
701 int vnc_server_fb_stride(VncDisplay *vd)
702 {
703 return pixman_image_get_stride(vd->server);
704 }
705
706 void *vnc_server_fb_ptr(VncDisplay *vd, int x, int y)
707 {
708 uint8_t *ptr;
709
710 ptr = (uint8_t *)pixman_image_get_data(vd->server);
711 ptr += y * vnc_server_fb_stride(vd);
712 ptr += x * VNC_SERVER_FB_BYTES;
713 return ptr;
714 }
715
716 static void vnc_dpy_switch(DisplayChangeListener *dcl,
717 DisplaySurface *surface)
718 {
719 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
720 VncState *vs;
721 int width, height;
722
723 vnc_abort_display_jobs(vd);
724
725 /* server surface */
726 qemu_pixman_image_unref(vd->server);
727 vd->ds = surface;
728 width = MIN(VNC_MAX_WIDTH, ROUND_UP(surface_width(vd->ds),
729 VNC_DIRTY_PIXELS_PER_BIT));
730 height = MIN(VNC_MAX_HEIGHT, surface_height(vd->ds));
731 vd->server = pixman_image_create_bits(VNC_SERVER_FB_FORMAT,
732 width, height, NULL, 0);
733
734 /* guest surface */
735 #if 0 /* FIXME */
736 if (ds_get_bytes_per_pixel(ds) != vd->guest.ds->pf.bytes_per_pixel)
737 console_color_init(ds);
738 #endif
739 qemu_pixman_image_unref(vd->guest.fb);
740 vd->guest.fb = pixman_image_ref(surface->image);
741 vd->guest.format = surface->format;
742 memset(vd->guest.dirty, 0x00, sizeof(vd->guest.dirty));
743 vnc_set_area_dirty(vd->guest.dirty, width, height, 0, 0,
744 width, height);
745
746 QTAILQ_FOREACH(vs, &vd->clients, next) {
747 vnc_colordepth(vs);
748 vnc_desktop_resize(vs);
749 if (vs->vd->cursor) {
750 vnc_cursor_define(vs);
751 }
752 memset(vs->dirty, 0x00, sizeof(vs->dirty));
753 vnc_set_area_dirty(vs->dirty, width, height, 0, 0,
754 width, height);
755 }
756 }
757
758 /* fastest code */
759 static void vnc_write_pixels_copy(VncState *vs,
760 void *pixels, int size)
761 {
762 vnc_write(vs, pixels, size);
763 }
764
765 /* slowest but generic code. */
766 void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
767 {
768 uint8_t r, g, b;
769
770 #if VNC_SERVER_FB_FORMAT == PIXMAN_FORMAT(32, PIXMAN_TYPE_ARGB, 0, 8, 8, 8)
771 r = (((v & 0x00ff0000) >> 16) << vs->client_pf.rbits) >> 8;
772 g = (((v & 0x0000ff00) >> 8) << vs->client_pf.gbits) >> 8;
773 b = (((v & 0x000000ff) >> 0) << vs->client_pf.bbits) >> 8;
774 #else
775 # error need some bits here if you change VNC_SERVER_FB_FORMAT
776 #endif
777 v = (r << vs->client_pf.rshift) |
778 (g << vs->client_pf.gshift) |
779 (b << vs->client_pf.bshift);
780 switch (vs->client_pf.bytes_per_pixel) {
781 case 1:
782 buf[0] = v;
783 break;
784 case 2:
785 if (vs->client_be) {
786 buf[0] = v >> 8;
787 buf[1] = v;
788 } else {
789 buf[1] = v >> 8;
790 buf[0] = v;
791 }
792 break;
793 default:
794 case 4:
795 if (vs->client_be) {
796 buf[0] = v >> 24;
797 buf[1] = v >> 16;
798 buf[2] = v >> 8;
799 buf[3] = v;
800 } else {
801 buf[3] = v >> 24;
802 buf[2] = v >> 16;
803 buf[1] = v >> 8;
804 buf[0] = v;
805 }
806 break;
807 }
808 }
809
810 static void vnc_write_pixels_generic(VncState *vs,
811 void *pixels1, int size)
812 {
813 uint8_t buf[4];
814
815 if (VNC_SERVER_FB_BYTES == 4) {
816 uint32_t *pixels = pixels1;
817 int n, i;
818 n = size >> 2;
819 for (i = 0; i < n; i++) {
820 vnc_convert_pixel(vs, buf, pixels[i]);
821 vnc_write(vs, buf, vs->client_pf.bytes_per_pixel);
822 }
823 }
824 }
825
826 int vnc_raw_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
827 {
828 int i;
829 uint8_t *row;
830 VncDisplay *vd = vs->vd;
831
832 row = vnc_server_fb_ptr(vd, x, y);
833 for (i = 0; i < h; i++) {
834 vs->write_pixels(vs, row, w * VNC_SERVER_FB_BYTES);
835 row += vnc_server_fb_stride(vd);
836 }
837 return 1;
838 }
839
840 int vnc_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
841 {
842 int n = 0;
843 bool encode_raw = false;
844 size_t saved_offs = vs->output.offset;
845
846 switch(vs->vnc_encoding) {
847 case VNC_ENCODING_ZLIB:
848 n = vnc_zlib_send_framebuffer_update(vs, x, y, w, h);
849 break;
850 case VNC_ENCODING_HEXTILE:
851 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE);
852 n = vnc_hextile_send_framebuffer_update(vs, x, y, w, h);
853 break;
854 case VNC_ENCODING_TIGHT:
855 n = vnc_tight_send_framebuffer_update(vs, x, y, w, h);
856 break;
857 case VNC_ENCODING_TIGHT_PNG:
858 n = vnc_tight_png_send_framebuffer_update(vs, x, y, w, h);
859 break;
860 case VNC_ENCODING_ZRLE:
861 n = vnc_zrle_send_framebuffer_update(vs, x, y, w, h);
862 break;
863 case VNC_ENCODING_ZYWRLE:
864 n = vnc_zywrle_send_framebuffer_update(vs, x, y, w, h);
865 break;
866 default:
867 encode_raw = true;
868 break;
869 }
870
871 /* If the client has the same pixel format as our internal buffer and
872 * a RAW encoding would need less space fall back to RAW encoding to
873 * save bandwidth and processing power in the client. */
874 if (!encode_raw && vs->write_pixels == vnc_write_pixels_copy &&
875 12 + h * w * VNC_SERVER_FB_BYTES <= (vs->output.offset - saved_offs)) {
876 vs->output.offset = saved_offs;
877 encode_raw = true;
878 }
879
880 if (encode_raw) {
881 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW);
882 n = vnc_raw_send_framebuffer_update(vs, x, y, w, h);
883 }
884
885 return n;
886 }
887
888 static void vnc_copy(VncState *vs, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
889 {
890 /* send bitblit op to the vnc client */
891 vnc_lock_output(vs);
892 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
893 vnc_write_u8(vs, 0);
894 vnc_write_u16(vs, 1); /* number of rects */
895 vnc_framebuffer_update(vs, dst_x, dst_y, w, h, VNC_ENCODING_COPYRECT);
896 vnc_write_u16(vs, src_x);
897 vnc_write_u16(vs, src_y);
898 vnc_unlock_output(vs);
899 vnc_flush(vs);
900 }
901
902 static void vnc_dpy_copy(DisplayChangeListener *dcl,
903 int src_x, int src_y,
904 int dst_x, int dst_y, int w, int h)
905 {
906 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
907 VncState *vs, *vn;
908 uint8_t *src_row;
909 uint8_t *dst_row;
910 int i, x, y, pitch, inc, w_lim, s;
911 int cmp_bytes;
912
913 vnc_refresh_server_surface(vd);
914 QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {
915 if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
916 vs->force_update = 1;
917 vnc_update_client(vs, 1, true);
918 /* vs might be free()ed here */
919 }
920 }
921
922 /* do bitblit op on the local surface too */
923 pitch = vnc_server_fb_stride(vd);
924 src_row = vnc_server_fb_ptr(vd, src_x, src_y);
925 dst_row = vnc_server_fb_ptr(vd, dst_x, dst_y);
926 y = dst_y;
927 inc = 1;
928 if (dst_y > src_y) {
929 /* copy backwards */
930 src_row += pitch * (h-1);
931 dst_row += pitch * (h-1);
932 pitch = -pitch;
933 y = dst_y + h - 1;
934 inc = -1;
935 }
936 w_lim = w - (VNC_DIRTY_PIXELS_PER_BIT - (dst_x % VNC_DIRTY_PIXELS_PER_BIT));
937 if (w_lim < 0) {
938 w_lim = w;
939 } else {
940 w_lim = w - (w_lim % VNC_DIRTY_PIXELS_PER_BIT);
941 }
942 for (i = 0; i < h; i++) {
943 for (x = 0; x <= w_lim;
944 x += s, src_row += cmp_bytes, dst_row += cmp_bytes) {
945 if (x == w_lim) {
946 if ((s = w - w_lim) == 0)
947 break;
948 } else if (!x) {
949 s = (VNC_DIRTY_PIXELS_PER_BIT -
950 (dst_x % VNC_DIRTY_PIXELS_PER_BIT));
951 s = MIN(s, w_lim);
952 } else {
953 s = VNC_DIRTY_PIXELS_PER_BIT;
954 }
955 cmp_bytes = s * VNC_SERVER_FB_BYTES;
956 if (memcmp(src_row, dst_row, cmp_bytes) == 0)
957 continue;
958 memmove(dst_row, src_row, cmp_bytes);
959 QTAILQ_FOREACH(vs, &vd->clients, next) {
960 if (!vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
961 set_bit(((x + dst_x) / VNC_DIRTY_PIXELS_PER_BIT),
962 vs->dirty[y]);
963 }
964 }
965 }
966 src_row += pitch - w * VNC_SERVER_FB_BYTES;
967 dst_row += pitch - w * VNC_SERVER_FB_BYTES;
968 y += inc;
969 }
970
971 QTAILQ_FOREACH(vs, &vd->clients, next) {
972 if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
973 vnc_copy(vs, src_x, src_y, dst_x, dst_y, w, h);
974 }
975 }
976 }
977
978 static void vnc_mouse_set(DisplayChangeListener *dcl,
979 int x, int y, int visible)
980 {
981 /* can we ask the client(s) to move the pointer ??? */
982 }
983
984 static int vnc_cursor_define(VncState *vs)
985 {
986 QEMUCursor *c = vs->vd->cursor;
987 int isize;
988
989 if (vnc_has_feature(vs, VNC_FEATURE_RICH_CURSOR)) {
990 vnc_lock_output(vs);
991 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
992 vnc_write_u8(vs, 0); /* padding */
993 vnc_write_u16(vs, 1); /* # of rects */
994 vnc_framebuffer_update(vs, c->hot_x, c->hot_y, c->width, c->height,
995 VNC_ENCODING_RICH_CURSOR);
996 isize = c->width * c->height * vs->client_pf.bytes_per_pixel;
997 vnc_write_pixels_generic(vs, c->data, isize);
998 vnc_write(vs, vs->vd->cursor_mask, vs->vd->cursor_msize);
999 vnc_unlock_output(vs);
1000 return 0;
1001 }
1002 return -1;
1003 }
1004
1005 static void vnc_dpy_cursor_define(DisplayChangeListener *dcl,
1006 QEMUCursor *c)
1007 {
1008 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
1009 VncState *vs;
1010
1011 cursor_put(vd->cursor);
1012 g_free(vd->cursor_mask);
1013
1014 vd->cursor = c;
1015 cursor_get(vd->cursor);
1016 vd->cursor_msize = cursor_get_mono_bpl(c) * c->height;
1017 vd->cursor_mask = g_malloc0(vd->cursor_msize);
1018 cursor_get_mono_mask(c, 0, vd->cursor_mask);
1019
1020 QTAILQ_FOREACH(vs, &vd->clients, next) {
1021 vnc_cursor_define(vs);
1022 }
1023 }
1024
1025 static int find_and_clear_dirty_height(VncState *vs,
1026 int y, int last_x, int x, int height)
1027 {
1028 int h;
1029
1030 for (h = 1; h < (height - y); h++) {
1031 if (!test_bit(last_x, vs->dirty[y + h])) {
1032 break;
1033 }
1034 bitmap_clear(vs->dirty[y + h], last_x, x - last_x);
1035 }
1036
1037 return h;
1038 }
1039
1040 static int vnc_update_client(VncState *vs, int has_dirty, bool sync)
1041 {
1042 vs->has_dirty += has_dirty;
1043 if (vs->need_update && vs->csock != -1) {
1044 VncDisplay *vd = vs->vd;
1045 VncJob *job;
1046 int y;
1047 int height, width;
1048 int n = 0;
1049
1050 if (vs->output.offset && !vs->audio_cap && !vs->force_update)
1051 /* kernel send buffers are full -> drop frames to throttle */
1052 return 0;
1053
1054 if (!vs->has_dirty && !vs->audio_cap && !vs->force_update)
1055 return 0;
1056
1057 /*
1058 * Send screen updates to the vnc client using the server
1059 * surface and server dirty map. guest surface updates
1060 * happening in parallel don't disturb us, the next pass will
1061 * send them to the client.
1062 */
1063 job = vnc_job_new(vs);
1064
1065 height = pixman_image_get_height(vd->server);
1066 width = pixman_image_get_width(vd->server);
1067
1068 y = 0;
1069 for (;;) {
1070 int x, h;
1071 unsigned long x2;
1072 unsigned long offset = find_next_bit((unsigned long *) &vs->dirty,
1073 height * VNC_DIRTY_BPL(vs),
1074 y * VNC_DIRTY_BPL(vs));
1075 if (offset == height * VNC_DIRTY_BPL(vs)) {
1076 /* no more dirty bits */
1077 break;
1078 }
1079 y = offset / VNC_DIRTY_BPL(vs);
1080 x = offset % VNC_DIRTY_BPL(vs);
1081 x2 = find_next_zero_bit((unsigned long *) &vs->dirty[y],
1082 VNC_DIRTY_BPL(vs), x);
1083 bitmap_clear(vs->dirty[y], x, x2 - x);
1084 h = find_and_clear_dirty_height(vs, y, x, x2, height);
1085 x2 = MIN(x2, width / VNC_DIRTY_PIXELS_PER_BIT);
1086 if (x2 > x) {
1087 n += vnc_job_add_rect(job, x * VNC_DIRTY_PIXELS_PER_BIT, y,
1088 (x2 - x) * VNC_DIRTY_PIXELS_PER_BIT, h);
1089 }
1090 if (!x && x2 == width / VNC_DIRTY_PIXELS_PER_BIT) {
1091 y += h;
1092 if (y == height) {
1093 break;
1094 }
1095 }
1096 }
1097
1098 vnc_job_push(job);
1099 if (sync) {
1100 vnc_jobs_join(vs);
1101 }
1102 vs->force_update = 0;
1103 vs->has_dirty = 0;
1104 return n;
1105 }
1106
1107 if (vs->csock == -1) {
1108 vnc_disconnect_finish(vs);
1109 } else if (sync) {
1110 vnc_jobs_join(vs);
1111 }
1112
1113 return 0;
1114 }
1115
1116 /* audio */
1117 static void audio_capture_notify(void *opaque, audcnotification_e cmd)
1118 {
1119 VncState *vs = opaque;
1120
1121 switch (cmd) {
1122 case AUD_CNOTIFY_DISABLE:
1123 vnc_lock_output(vs);
1124 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
1125 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
1126 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_END);
1127 vnc_unlock_output(vs);
1128 vnc_flush(vs);
1129 break;
1130
1131 case AUD_CNOTIFY_ENABLE:
1132 vnc_lock_output(vs);
1133 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
1134 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
1135 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_BEGIN);
1136 vnc_unlock_output(vs);
1137 vnc_flush(vs);
1138 break;
1139 }
1140 }
1141
1142 static void audio_capture_destroy(void *opaque)
1143 {
1144 }
1145
1146 static void audio_capture(void *opaque, void *buf, int size)
1147 {
1148 VncState *vs = opaque;
1149
1150 vnc_lock_output(vs);
1151 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
1152 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
1153 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_DATA);
1154 vnc_write_u32(vs, size);
1155 vnc_write(vs, buf, size);
1156 vnc_unlock_output(vs);
1157 vnc_flush(vs);
1158 }
1159
1160 static void audio_add(VncState *vs)
1161 {
1162 struct audio_capture_ops ops;
1163
1164 if (vs->audio_cap) {
1165 error_report("audio already running");
1166 return;
1167 }
1168
1169 ops.notify = audio_capture_notify;
1170 ops.destroy = audio_capture_destroy;
1171 ops.capture = audio_capture;
1172
1173 vs->audio_cap = AUD_add_capture(&vs->as, &ops, vs);
1174 if (!vs->audio_cap) {
1175 error_report("Failed to add audio capture");
1176 }
1177 }
1178
1179 static void audio_del(VncState *vs)
1180 {
1181 if (vs->audio_cap) {
1182 AUD_del_capture(vs->audio_cap, vs);
1183 vs->audio_cap = NULL;
1184 }
1185 }
1186
1187 static void vnc_disconnect_start(VncState *vs)
1188 {
1189 if (vs->csock == -1)
1190 return;
1191 vnc_set_share_mode(vs, VNC_SHARE_MODE_DISCONNECTED);
1192 qemu_set_fd_handler(vs->csock, NULL, NULL, NULL);
1193 closesocket(vs->csock);
1194 vs->csock = -1;
1195 }
1196
1197 void vnc_disconnect_finish(VncState *vs)
1198 {
1199 int i;
1200
1201 vnc_jobs_join(vs); /* Wait encoding jobs */
1202
1203 vnc_lock_output(vs);
1204 vnc_qmp_event(vs, QAPI_EVENT_VNC_DISCONNECTED);
1205
1206 buffer_free(&vs->input);
1207 buffer_free(&vs->output);
1208 buffer_free(&vs->ws_input);
1209 buffer_free(&vs->ws_output);
1210
1211 qapi_free_VncClientInfo(vs->info);
1212
1213 vnc_zlib_clear(vs);
1214 vnc_tight_clear(vs);
1215 vnc_zrle_clear(vs);
1216
1217 qcrypto_tls_session_free(vs->tls);
1218 #ifdef CONFIG_VNC_SASL
1219 vnc_sasl_client_cleanup(vs);
1220 #endif /* CONFIG_VNC_SASL */
1221 audio_del(vs);
1222 vnc_release_modifiers(vs);
1223
1224 if (vs->initialized) {
1225 QTAILQ_REMOVE(&vs->vd->clients, vs, next);
1226 qemu_remove_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
1227 }
1228
1229 if (vs->vd->lock_key_sync)
1230 qemu_remove_led_event_handler(vs->led);
1231 vnc_unlock_output(vs);
1232
1233 qemu_mutex_destroy(&vs->output_mutex);
1234 if (vs->bh != NULL) {
1235 qemu_bh_delete(vs->bh);
1236 }
1237 buffer_free(&vs->jobs_buffer);
1238
1239 for (i = 0; i < VNC_STAT_ROWS; ++i) {
1240 g_free(vs->lossy_rect[i]);
1241 }
1242 g_free(vs->lossy_rect);
1243 g_free(vs);
1244 }
1245
1246 ssize_t vnc_client_io_error(VncState *vs, ssize_t ret, int last_errno)
1247 {
1248 if (ret == 0 || ret == -1) {
1249 if (ret == -1) {
1250 switch (last_errno) {
1251 case EINTR:
1252 case EAGAIN:
1253 #ifdef _WIN32
1254 case WSAEWOULDBLOCK:
1255 #endif
1256 return 0;
1257 default:
1258 break;
1259 }
1260 }
1261
1262 VNC_DEBUG("Closing down client sock: ret %zd, errno %d\n",
1263 ret, ret < 0 ? last_errno : 0);
1264 vnc_disconnect_start(vs);
1265
1266 return 0;
1267 }
1268 return ret;
1269 }
1270
1271
1272 void vnc_client_error(VncState *vs)
1273 {
1274 VNC_DEBUG("Closing down client sock: protocol error\n");
1275 vnc_disconnect_start(vs);
1276 }
1277
1278
1279 ssize_t vnc_tls_pull(char *buf, size_t len, void *opaque)
1280 {
1281 VncState *vs = opaque;
1282 ssize_t ret;
1283
1284 retry:
1285 ret = qemu_recv(vs->csock, buf, len, 0);
1286 if (ret < 0) {
1287 if (errno == EINTR) {
1288 goto retry;
1289 }
1290 return -1;
1291 }
1292 return ret;
1293 }
1294
1295
1296 ssize_t vnc_tls_push(const char *buf, size_t len, void *opaque)
1297 {
1298 VncState *vs = opaque;
1299 ssize_t ret;
1300
1301 retry:
1302 ret = send(vs->csock, buf, len, 0);
1303 if (ret < 0) {
1304 if (errno == EINTR) {
1305 goto retry;
1306 }
1307 return -1;
1308 }
1309 return ret;
1310 }
1311
1312
1313 /*
1314 * Called to write a chunk of data to the client socket. The data may
1315 * be the raw data, or may have already been encoded by SASL.
1316 * The data will be written either straight onto the socket, or
1317 * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1318 *
1319 * NB, it is theoretically possible to have 2 layers of encryption,
1320 * both SASL, and this TLS layer. It is highly unlikely in practice
1321 * though, since SASL encryption will typically be a no-op if TLS
1322 * is active
1323 *
1324 * Returns the number of bytes written, which may be less than
1325 * the requested 'datalen' if the socket would block. Returns
1326 * -1 on error, and disconnects the client socket.
1327 */
1328 ssize_t vnc_client_write_buf(VncState *vs, const uint8_t *data, size_t datalen)
1329 {
1330 ssize_t ret;
1331 int err = 0;
1332 if (vs->tls) {
1333 ret = qcrypto_tls_session_write(vs->tls, (const char *)data, datalen);
1334 if (ret < 0) {
1335 err = errno;
1336 }
1337 } else {
1338 ret = send(vs->csock, (const void *)data, datalen, 0);
1339 if (ret < 0) {
1340 err = socket_error();
1341 }
1342 }
1343 VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data, datalen, ret);
1344 return vnc_client_io_error(vs, ret, err);
1345 }
1346
1347
1348 /*
1349 * Called to write buffered data to the client socket, when not
1350 * using any SASL SSF encryption layers. Will write as much data
1351 * as possible without blocking. If all buffered data is written,
1352 * will switch the FD poll() handler back to read monitoring.
1353 *
1354 * Returns the number of bytes written, which may be less than
1355 * the buffered output data if the socket would block. Returns
1356 * -1 on error, and disconnects the client socket.
1357 */
1358 static ssize_t vnc_client_write_plain(VncState *vs)
1359 {
1360 ssize_t ret;
1361
1362 #ifdef CONFIG_VNC_SASL
1363 VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n",
1364 vs->output.buffer, vs->output.capacity, vs->output.offset,
1365 vs->sasl.waitWriteSSF);
1366
1367 if (vs->sasl.conn &&
1368 vs->sasl.runSSF &&
1369 vs->sasl.waitWriteSSF) {
1370 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF);
1371 if (ret)
1372 vs->sasl.waitWriteSSF -= ret;
1373 } else
1374 #endif /* CONFIG_VNC_SASL */
1375 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset);
1376 if (!ret)
1377 return 0;
1378
1379 buffer_advance(&vs->output, ret);
1380
1381 if (vs->output.offset == 0) {
1382 qemu_set_fd_handler(vs->csock, vnc_client_read, NULL, vs);
1383 }
1384
1385 return ret;
1386 }
1387
1388
1389 /*
1390 * First function called whenever there is data to be written to
1391 * the client socket. Will delegate actual work according to whether
1392 * SASL SSF layers are enabled (thus requiring encryption calls)
1393 */
1394 static void vnc_client_write_locked(void *opaque)
1395 {
1396 VncState *vs = opaque;
1397
1398 #ifdef CONFIG_VNC_SASL
1399 if (vs->sasl.conn &&
1400 vs->sasl.runSSF &&
1401 !vs->sasl.waitWriteSSF) {
1402 vnc_client_write_sasl(vs);
1403 } else
1404 #endif /* CONFIG_VNC_SASL */
1405 {
1406 if (vs->encode_ws) {
1407 vnc_client_write_ws(vs);
1408 } else {
1409 vnc_client_write_plain(vs);
1410 }
1411 }
1412 }
1413
1414 void vnc_client_write(void *opaque)
1415 {
1416 VncState *vs = opaque;
1417
1418 vnc_lock_output(vs);
1419 if (vs->output.offset || vs->ws_output.offset) {
1420 vnc_client_write_locked(opaque);
1421 } else if (vs->csock != -1) {
1422 qemu_set_fd_handler(vs->csock, vnc_client_read, NULL, vs);
1423 }
1424 vnc_unlock_output(vs);
1425 }
1426
1427 void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting)
1428 {
1429 vs->read_handler = func;
1430 vs->read_handler_expect = expecting;
1431 }
1432
1433
1434 /*
1435 * Called to read a chunk of data from the client socket. The data may
1436 * be the raw data, or may need to be further decoded by SASL.
1437 * The data will be read either straight from to the socket, or
1438 * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1439 *
1440 * NB, it is theoretically possible to have 2 layers of encryption,
1441 * both SASL, and this TLS layer. It is highly unlikely in practice
1442 * though, since SASL encryption will typically be a no-op if TLS
1443 * is active
1444 *
1445 * Returns the number of bytes read, which may be less than
1446 * the requested 'datalen' if the socket would block. Returns
1447 * -1 on error, and disconnects the client socket.
1448 */
1449 ssize_t vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen)
1450 {
1451 ssize_t ret;
1452 int err = -1;
1453 if (vs->tls) {
1454 ret = qcrypto_tls_session_read(vs->tls, (char *)data, datalen);
1455 if (ret < 0) {
1456 err = errno;
1457 }
1458 } else {
1459 ret = qemu_recv(vs->csock, data, datalen, 0);
1460 if (ret < 0) {
1461 err = socket_error();
1462 }
1463 }
1464 VNC_DEBUG("Read wire %p %zd -> %ld\n", data, datalen, ret);
1465 return vnc_client_io_error(vs, ret, err);
1466 }
1467
1468
1469 /*
1470 * Called to read data from the client socket to the input buffer,
1471 * when not using any SASL SSF encryption layers. Will read as much
1472 * data as possible without blocking.
1473 *
1474 * Returns the number of bytes read. Returns -1 on error, and
1475 * disconnects the client socket.
1476 */
1477 static ssize_t vnc_client_read_plain(VncState *vs)
1478 {
1479 ssize_t ret;
1480 VNC_DEBUG("Read plain %p size %zd offset %zd\n",
1481 vs->input.buffer, vs->input.capacity, vs->input.offset);
1482 buffer_reserve(&vs->input, 4096);
1483 ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096);
1484 if (!ret)
1485 return 0;
1486 vs->input.offset += ret;
1487 return ret;
1488 }
1489
1490 static void vnc_jobs_bh(void *opaque)
1491 {
1492 VncState *vs = opaque;
1493
1494 vnc_jobs_consume_buffer(vs);
1495 }
1496
1497 /*
1498 * First function called whenever there is more data to be read from
1499 * the client socket. Will delegate actual work according to whether
1500 * SASL SSF layers are enabled (thus requiring decryption calls)
1501 */
1502 void vnc_client_read(void *opaque)
1503 {
1504 VncState *vs = opaque;
1505 ssize_t ret;
1506
1507 #ifdef CONFIG_VNC_SASL
1508 if (vs->sasl.conn && vs->sasl.runSSF)
1509 ret = vnc_client_read_sasl(vs);
1510 else
1511 #endif /* CONFIG_VNC_SASL */
1512 if (vs->encode_ws) {
1513 ret = vnc_client_read_ws(vs);
1514 if (ret == -1) {
1515 vnc_disconnect_start(vs);
1516 return;
1517 } else if (ret == -2) {
1518 vnc_client_error(vs);
1519 return;
1520 }
1521 } else {
1522 ret = vnc_client_read_plain(vs);
1523 }
1524 if (!ret) {
1525 if (vs->csock == -1)
1526 vnc_disconnect_finish(vs);
1527 return;
1528 }
1529
1530 while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) {
1531 size_t len = vs->read_handler_expect;
1532 int ret;
1533
1534 ret = vs->read_handler(vs, vs->input.buffer, len);
1535 if (vs->csock == -1) {
1536 vnc_disconnect_finish(vs);
1537 return;
1538 }
1539
1540 if (!ret) {
1541 buffer_advance(&vs->input, len);
1542 } else {
1543 vs->read_handler_expect = ret;
1544 }
1545 }
1546 }
1547
1548 void vnc_write(VncState *vs, const void *data, size_t len)
1549 {
1550 buffer_reserve(&vs->output, len);
1551
1552 if (vs->csock != -1 && buffer_empty(&vs->output)) {
1553 qemu_set_fd_handler(vs->csock, vnc_client_read, vnc_client_write, vs);
1554 }
1555
1556 buffer_append(&vs->output, data, len);
1557 }
1558
1559 void vnc_write_s32(VncState *vs, int32_t value)
1560 {
1561 vnc_write_u32(vs, *(uint32_t *)&value);
1562 }
1563
1564 void vnc_write_u32(VncState *vs, uint32_t value)
1565 {
1566 uint8_t buf[4];
1567
1568 buf[0] = (value >> 24) & 0xFF;
1569 buf[1] = (value >> 16) & 0xFF;
1570 buf[2] = (value >> 8) & 0xFF;
1571 buf[3] = value & 0xFF;
1572
1573 vnc_write(vs, buf, 4);
1574 }
1575
1576 void vnc_write_u16(VncState *vs, uint16_t value)
1577 {
1578 uint8_t buf[2];
1579
1580 buf[0] = (value >> 8) & 0xFF;
1581 buf[1] = value & 0xFF;
1582
1583 vnc_write(vs, buf, 2);
1584 }
1585
1586 void vnc_write_u8(VncState *vs, uint8_t value)
1587 {
1588 vnc_write(vs, (char *)&value, 1);
1589 }
1590
1591 void vnc_flush(VncState *vs)
1592 {
1593 vnc_lock_output(vs);
1594 if (vs->csock != -1 && (vs->output.offset ||
1595 vs->ws_output.offset)) {
1596 vnc_client_write_locked(vs);
1597 }
1598 vnc_unlock_output(vs);
1599 }
1600
1601 static uint8_t read_u8(uint8_t *data, size_t offset)
1602 {
1603 return data[offset];
1604 }
1605
1606 static uint16_t read_u16(uint8_t *data, size_t offset)
1607 {
1608 return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF);
1609 }
1610
1611 static int32_t read_s32(uint8_t *data, size_t offset)
1612 {
1613 return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) |
1614 (data[offset + 2] << 8) | data[offset + 3]);
1615 }
1616
1617 uint32_t read_u32(uint8_t *data, size_t offset)
1618 {
1619 return ((data[offset] << 24) | (data[offset + 1] << 16) |
1620 (data[offset + 2] << 8) | data[offset + 3]);
1621 }
1622
1623 static void client_cut_text(VncState *vs, size_t len, uint8_t *text)
1624 {
1625 }
1626
1627 static void check_pointer_type_change(Notifier *notifier, void *data)
1628 {
1629 VncState *vs = container_of(notifier, VncState, mouse_mode_notifier);
1630 int absolute = qemu_input_is_absolute();
1631
1632 if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) {
1633 vnc_lock_output(vs);
1634 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1635 vnc_write_u8(vs, 0);
1636 vnc_write_u16(vs, 1);
1637 vnc_framebuffer_update(vs, absolute, 0,
1638 pixman_image_get_width(vs->vd->server),
1639 pixman_image_get_height(vs->vd->server),
1640 VNC_ENCODING_POINTER_TYPE_CHANGE);
1641 vnc_unlock_output(vs);
1642 vnc_flush(vs);
1643 }
1644 vs->absolute = absolute;
1645 }
1646
1647 static void pointer_event(VncState *vs, int button_mask, int x, int y)
1648 {
1649 static uint32_t bmap[INPUT_BUTTON_MAX] = {
1650 [INPUT_BUTTON_LEFT] = 0x01,
1651 [INPUT_BUTTON_MIDDLE] = 0x02,
1652 [INPUT_BUTTON_RIGHT] = 0x04,
1653 [INPUT_BUTTON_WHEEL_UP] = 0x08,
1654 [INPUT_BUTTON_WHEEL_DOWN] = 0x10,
1655 };
1656 QemuConsole *con = vs->vd->dcl.con;
1657 int width = pixman_image_get_width(vs->vd->server);
1658 int height = pixman_image_get_height(vs->vd->server);
1659
1660 if (vs->last_bmask != button_mask) {
1661 qemu_input_update_buttons(con, bmap, vs->last_bmask, button_mask);
1662 vs->last_bmask = button_mask;
1663 }
1664
1665 if (vs->absolute) {
1666 qemu_input_queue_abs(con, INPUT_AXIS_X, x, width);
1667 qemu_input_queue_abs(con, INPUT_AXIS_Y, y, height);
1668 } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) {
1669 qemu_input_queue_rel(con, INPUT_AXIS_X, x - 0x7FFF);
1670 qemu_input_queue_rel(con, INPUT_AXIS_Y, y - 0x7FFF);
1671 } else {
1672 if (vs->last_x != -1) {
1673 qemu_input_queue_rel(con, INPUT_AXIS_X, x - vs->last_x);
1674 qemu_input_queue_rel(con, INPUT_AXIS_Y, y - vs->last_y);
1675 }
1676 vs->last_x = x;
1677 vs->last_y = y;
1678 }
1679 qemu_input_event_sync();
1680 }
1681
1682 static void reset_keys(VncState *vs)
1683 {
1684 int i;
1685 for(i = 0; i < 256; i++) {
1686 if (vs->modifiers_state[i]) {
1687 qemu_input_event_send_key_number(vs->vd->dcl.con, i, false);
1688 vs->modifiers_state[i] = 0;
1689 }
1690 }
1691 }
1692
1693 static void press_key(VncState *vs, int keysym)
1694 {
1695 int keycode = keysym2scancode(vs->vd->kbd_layout, keysym) & SCANCODE_KEYMASK;
1696 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, true);
1697 qemu_input_event_send_key_delay(0);
1698 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, false);
1699 qemu_input_event_send_key_delay(0);
1700 }
1701
1702 static int current_led_state(VncState *vs)
1703 {
1704 int ledstate = 0;
1705
1706 if (vs->modifiers_state[0x46]) {
1707 ledstate |= QEMU_SCROLL_LOCK_LED;
1708 }
1709 if (vs->modifiers_state[0x45]) {
1710 ledstate |= QEMU_NUM_LOCK_LED;
1711 }
1712 if (vs->modifiers_state[0x3a]) {
1713 ledstate |= QEMU_CAPS_LOCK_LED;
1714 }
1715
1716 return ledstate;
1717 }
1718
1719 static void vnc_led_state_change(VncState *vs)
1720 {
1721 int ledstate = 0;
1722
1723 if (!vnc_has_feature(vs, VNC_FEATURE_LED_STATE)) {
1724 return;
1725 }
1726
1727 ledstate = current_led_state(vs);
1728 vnc_lock_output(vs);
1729 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1730 vnc_write_u8(vs, 0);
1731 vnc_write_u16(vs, 1);
1732 vnc_framebuffer_update(vs, 0, 0, 1, 1, VNC_ENCODING_LED_STATE);
1733 vnc_write_u8(vs, ledstate);
1734 vnc_unlock_output(vs);
1735 vnc_flush(vs);
1736 }
1737
1738 static void kbd_leds(void *opaque, int ledstate)
1739 {
1740 VncState *vs = opaque;
1741 int caps, num, scr;
1742 bool has_changed = (ledstate != current_led_state(vs));
1743
1744 trace_vnc_key_guest_leds((ledstate & QEMU_CAPS_LOCK_LED),
1745 (ledstate & QEMU_NUM_LOCK_LED),
1746 (ledstate & QEMU_SCROLL_LOCK_LED));
1747
1748 caps = ledstate & QEMU_CAPS_LOCK_LED ? 1 : 0;
1749 num = ledstate & QEMU_NUM_LOCK_LED ? 1 : 0;
1750 scr = ledstate & QEMU_SCROLL_LOCK_LED ? 1 : 0;
1751
1752 if (vs->modifiers_state[0x3a] != caps) {
1753 vs->modifiers_state[0x3a] = caps;
1754 }
1755 if (vs->modifiers_state[0x45] != num) {
1756 vs->modifiers_state[0x45] = num;
1757 }
1758 if (vs->modifiers_state[0x46] != scr) {
1759 vs->modifiers_state[0x46] = scr;
1760 }
1761
1762 /* Sending the current led state message to the client */
1763 if (has_changed) {
1764 vnc_led_state_change(vs);
1765 }
1766 }
1767
1768 static void do_key_event(VncState *vs, int down, int keycode, int sym)
1769 {
1770 /* QEMU console switch */
1771 switch(keycode) {
1772 case 0x2a: /* Left Shift */
1773 case 0x36: /* Right Shift */
1774 case 0x1d: /* Left CTRL */
1775 case 0x9d: /* Right CTRL */
1776 case 0x38: /* Left ALT */
1777 case 0xb8: /* Right ALT */
1778 if (down)
1779 vs->modifiers_state[keycode] = 1;
1780 else
1781 vs->modifiers_state[keycode] = 0;
1782 break;
1783 case 0x02 ... 0x0a: /* '1' to '9' keys */
1784 if (vs->vd->dcl.con == NULL &&
1785 down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) {
1786 /* Reset the modifiers sent to the current console */
1787 reset_keys(vs);
1788 console_select(keycode - 0x02);
1789 return;
1790 }
1791 break;
1792 case 0x3a: /* CapsLock */
1793 case 0x45: /* NumLock */
1794 if (down)
1795 vs->modifiers_state[keycode] ^= 1;
1796 break;
1797 }
1798
1799 /* Turn off the lock state sync logic if the client support the led
1800 state extension.
1801 */
1802 if (down && vs->vd->lock_key_sync &&
1803 !vnc_has_feature(vs, VNC_FEATURE_LED_STATE) &&
1804 keycode_is_keypad(vs->vd->kbd_layout, keycode)) {
1805 /* If the numlock state needs to change then simulate an additional
1806 keypress before sending this one. This will happen if the user
1807 toggles numlock away from the VNC window.
1808 */
1809 if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) {
1810 if (!vs->modifiers_state[0x45]) {
1811 trace_vnc_key_sync_numlock(true);
1812 vs->modifiers_state[0x45] = 1;
1813 press_key(vs, 0xff7f);
1814 }
1815 } else {
1816 if (vs->modifiers_state[0x45]) {
1817 trace_vnc_key_sync_numlock(false);
1818 vs->modifiers_state[0x45] = 0;
1819 press_key(vs, 0xff7f);
1820 }
1821 }
1822 }
1823
1824 if (down && vs->vd->lock_key_sync &&
1825 !vnc_has_feature(vs, VNC_FEATURE_LED_STATE) &&
1826 ((sym >= 'A' && sym <= 'Z') || (sym >= 'a' && sym <= 'z'))) {
1827 /* If the capslock state needs to change then simulate an additional
1828 keypress before sending this one. This will happen if the user
1829 toggles capslock away from the VNC window.
1830 */
1831 int uppercase = !!(sym >= 'A' && sym <= 'Z');
1832 int shift = !!(vs->modifiers_state[0x2a] | vs->modifiers_state[0x36]);
1833 int capslock = !!(vs->modifiers_state[0x3a]);
1834 if (capslock) {
1835 if (uppercase == shift) {
1836 trace_vnc_key_sync_capslock(false);
1837 vs->modifiers_state[0x3a] = 0;
1838 press_key(vs, 0xffe5);
1839 }
1840 } else {
1841 if (uppercase != shift) {
1842 trace_vnc_key_sync_capslock(true);
1843 vs->modifiers_state[0x3a] = 1;
1844 press_key(vs, 0xffe5);
1845 }
1846 }
1847 }
1848
1849 if (qemu_console_is_graphic(NULL)) {
1850 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, down);
1851 } else {
1852 bool numlock = vs->modifiers_state[0x45];
1853 bool control = (vs->modifiers_state[0x1d] ||
1854 vs->modifiers_state[0x9d]);
1855 /* QEMU console emulation */
1856 if (down) {
1857 switch (keycode) {
1858 case 0x2a: /* Left Shift */
1859 case 0x36: /* Right Shift */
1860 case 0x1d: /* Left CTRL */
1861 case 0x9d: /* Right CTRL */
1862 case 0x38: /* Left ALT */
1863 case 0xb8: /* Right ALT */
1864 break;
1865 case 0xc8:
1866 kbd_put_keysym(QEMU_KEY_UP);
1867 break;
1868 case 0xd0:
1869 kbd_put_keysym(QEMU_KEY_DOWN);
1870 break;
1871 case 0xcb:
1872 kbd_put_keysym(QEMU_KEY_LEFT);
1873 break;
1874 case 0xcd:
1875 kbd_put_keysym(QEMU_KEY_RIGHT);
1876 break;
1877 case 0xd3:
1878 kbd_put_keysym(QEMU_KEY_DELETE);
1879 break;
1880 case 0xc7:
1881 kbd_put_keysym(QEMU_KEY_HOME);
1882 break;
1883 case 0xcf:
1884 kbd_put_keysym(QEMU_KEY_END);
1885 break;
1886 case 0xc9:
1887 kbd_put_keysym(QEMU_KEY_PAGEUP);
1888 break;
1889 case 0xd1:
1890 kbd_put_keysym(QEMU_KEY_PAGEDOWN);
1891 break;
1892
1893 case 0x47:
1894 kbd_put_keysym(numlock ? '7' : QEMU_KEY_HOME);
1895 break;
1896 case 0x48:
1897 kbd_put_keysym(numlock ? '8' : QEMU_KEY_UP);
1898 break;
1899 case 0x49:
1900 kbd_put_keysym(numlock ? '9' : QEMU_KEY_PAGEUP);
1901 break;
1902 case 0x4b:
1903 kbd_put_keysym(numlock ? '4' : QEMU_KEY_LEFT);
1904 break;
1905 case 0x4c:
1906 kbd_put_keysym('5');
1907 break;
1908 case 0x4d:
1909 kbd_put_keysym(numlock ? '6' : QEMU_KEY_RIGHT);
1910 break;
1911 case 0x4f:
1912 kbd_put_keysym(numlock ? '1' : QEMU_KEY_END);
1913 break;
1914 case 0x50:
1915 kbd_put_keysym(numlock ? '2' : QEMU_KEY_DOWN);
1916 break;
1917 case 0x51:
1918 kbd_put_keysym(numlock ? '3' : QEMU_KEY_PAGEDOWN);
1919 break;
1920 case 0x52:
1921 kbd_put_keysym('0');
1922 break;
1923 case 0x53:
1924 kbd_put_keysym(numlock ? '.' : QEMU_KEY_DELETE);
1925 break;
1926
1927 case 0xb5:
1928 kbd_put_keysym('/');
1929 break;
1930 case 0x37:
1931 kbd_put_keysym('*');
1932 break;
1933 case 0x4a:
1934 kbd_put_keysym('-');
1935 break;
1936 case 0x4e:
1937 kbd_put_keysym('+');
1938 break;
1939 case 0x9c:
1940 kbd_put_keysym('\n');
1941 break;
1942
1943 default:
1944 if (control) {
1945 kbd_put_keysym(sym & 0x1f);
1946 } else {
1947 kbd_put_keysym(sym);
1948 }
1949 break;
1950 }
1951 }
1952 }
1953 }
1954
1955 static void vnc_release_modifiers(VncState *vs)
1956 {
1957 static const int keycodes[] = {
1958 /* shift, control, alt keys, both left & right */
1959 0x2a, 0x36, 0x1d, 0x9d, 0x38, 0xb8,
1960 };
1961 int i, keycode;
1962
1963 if (!qemu_console_is_graphic(NULL)) {
1964 return;
1965 }
1966 for (i = 0; i < ARRAY_SIZE(keycodes); i++) {
1967 keycode = keycodes[i];
1968 if (!vs->modifiers_state[keycode]) {
1969 continue;
1970 }
1971 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, false);
1972 }
1973 }
1974
1975 static const char *code2name(int keycode)
1976 {
1977 return QKeyCode_lookup[qemu_input_key_number_to_qcode(keycode)];
1978 }
1979
1980 static void key_event(VncState *vs, int down, uint32_t sym)
1981 {
1982 int keycode;
1983 int lsym = sym;
1984
1985 if (lsym >= 'A' && lsym <= 'Z' && qemu_console_is_graphic(NULL)) {
1986 lsym = lsym - 'A' + 'a';
1987 }
1988
1989 keycode = keysym2scancode(vs->vd->kbd_layout, lsym & 0xFFFF) & SCANCODE_KEYMASK;
1990 trace_vnc_key_event_map(down, sym, keycode, code2name(keycode));
1991 do_key_event(vs, down, keycode, sym);
1992 }
1993
1994 static void ext_key_event(VncState *vs, int down,
1995 uint32_t sym, uint16_t keycode)
1996 {
1997 /* if the user specifies a keyboard layout, always use it */
1998 if (keyboard_layout) {
1999 key_event(vs, down, sym);
2000 } else {
2001 trace_vnc_key_event_ext(down, sym, keycode, code2name(keycode));
2002 do_key_event(vs, down, keycode, sym);
2003 }
2004 }
2005
2006 static void framebuffer_update_request(VncState *vs, int incremental,
2007 int x, int y, int w, int h)
2008 {
2009 int width = pixman_image_get_width(vs->vd->server);
2010 int height = pixman_image_get_height(vs->vd->server);
2011
2012 vs->need_update = 1;
2013
2014 if (incremental) {
2015 return;
2016 }
2017
2018 vs->force_update = 1;
2019 vnc_set_area_dirty(vs->dirty, width, height, x, y, w, h);
2020 }
2021
2022 static void send_ext_key_event_ack(VncState *vs)
2023 {
2024 vnc_lock_output(vs);
2025 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
2026 vnc_write_u8(vs, 0);
2027 vnc_write_u16(vs, 1);
2028 vnc_framebuffer_update(vs, 0, 0,
2029 pixman_image_get_width(vs->vd->server),
2030 pixman_image_get_height(vs->vd->server),
2031 VNC_ENCODING_EXT_KEY_EVENT);
2032 vnc_unlock_output(vs);
2033 vnc_flush(vs);
2034 }
2035
2036 static void send_ext_audio_ack(VncState *vs)
2037 {
2038 vnc_lock_output(vs);
2039 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
2040 vnc_write_u8(vs, 0);
2041 vnc_write_u16(vs, 1);
2042 vnc_framebuffer_update(vs, 0, 0,
2043 pixman_image_get_width(vs->vd->server),
2044 pixman_image_get_height(vs->vd->server),
2045 VNC_ENCODING_AUDIO);
2046 vnc_unlock_output(vs);
2047 vnc_flush(vs);
2048 }
2049
2050 static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
2051 {
2052 int i;
2053 unsigned int enc = 0;
2054
2055 vs->features = 0;
2056 vs->vnc_encoding = 0;
2057 vs->tight.compression = 9;
2058 vs->tight.quality = -1; /* Lossless by default */
2059 vs->absolute = -1;
2060
2061 /*
2062 * Start from the end because the encodings are sent in order of preference.
2063 * This way the preferred encoding (first encoding defined in the array)
2064 * will be set at the end of the loop.
2065 */
2066 for (i = n_encodings - 1; i >= 0; i--) {
2067 enc = encodings[i];
2068 switch (enc) {
2069 case VNC_ENCODING_RAW:
2070 vs->vnc_encoding = enc;
2071 break;
2072 case VNC_ENCODING_COPYRECT:
2073 vs->features |= VNC_FEATURE_COPYRECT_MASK;
2074 break;
2075 case VNC_ENCODING_HEXTILE:
2076 vs->features |= VNC_FEATURE_HEXTILE_MASK;
2077 vs->vnc_encoding = enc;
2078 break;
2079 case VNC_ENCODING_TIGHT:
2080 vs->features |= VNC_FEATURE_TIGHT_MASK;
2081 vs->vnc_encoding = enc;
2082 break;
2083 #ifdef CONFIG_VNC_PNG
2084 case VNC_ENCODING_TIGHT_PNG:
2085 vs->features |= VNC_FEATURE_TIGHT_PNG_MASK;
2086 vs->vnc_encoding = enc;
2087 break;
2088 #endif
2089 case VNC_ENCODING_ZLIB:
2090 vs->features |= VNC_FEATURE_ZLIB_MASK;
2091 vs->vnc_encoding = enc;
2092 break;
2093 case VNC_ENCODING_ZRLE:
2094 vs->features |= VNC_FEATURE_ZRLE_MASK;
2095 vs->vnc_encoding = enc;
2096 break;
2097 case VNC_ENCODING_ZYWRLE:
2098 vs->features |= VNC_FEATURE_ZYWRLE_MASK;
2099 vs->vnc_encoding = enc;
2100 break;
2101 case VNC_ENCODING_DESKTOPRESIZE:
2102 vs->features |= VNC_FEATURE_RESIZE_MASK;
2103 break;
2104 case VNC_ENCODING_POINTER_TYPE_CHANGE:
2105 vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK;
2106 break;
2107 case VNC_ENCODING_RICH_CURSOR:
2108 vs->features |= VNC_FEATURE_RICH_CURSOR_MASK;
2109 break;
2110 case VNC_ENCODING_EXT_KEY_EVENT:
2111 send_ext_key_event_ack(vs);
2112 break;
2113 case VNC_ENCODING_AUDIO:
2114 send_ext_audio_ack(vs);
2115 break;
2116 case VNC_ENCODING_WMVi:
2117 vs->features |= VNC_FEATURE_WMVI_MASK;
2118 break;
2119 case VNC_ENCODING_LED_STATE:
2120 vs->features |= VNC_FEATURE_LED_STATE_MASK;
2121 break;
2122 case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9:
2123 vs->tight.compression = (enc & 0x0F);
2124 break;
2125 case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9:
2126 if (vs->vd->lossy) {
2127 vs->tight.quality = (enc & 0x0F);
2128 }
2129 break;
2130 default:
2131 VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc);
2132 break;
2133 }
2134 }
2135 vnc_desktop_resize(vs);
2136 check_pointer_type_change(&vs->mouse_mode_notifier, NULL);
2137 vnc_led_state_change(vs);
2138 }
2139
2140 static void set_pixel_conversion(VncState *vs)
2141 {
2142 pixman_format_code_t fmt = qemu_pixman_get_format(&vs->client_pf);
2143
2144 if (fmt == VNC_SERVER_FB_FORMAT) {
2145 vs->write_pixels = vnc_write_pixels_copy;
2146 vnc_hextile_set_pixel_conversion(vs, 0);
2147 } else {
2148 vs->write_pixels = vnc_write_pixels_generic;
2149 vnc_hextile_set_pixel_conversion(vs, 1);
2150 }
2151 }
2152
2153 static void set_pixel_format(VncState *vs,
2154 int bits_per_pixel, int depth,
2155 int big_endian_flag, int true_color_flag,
2156 int red_max, int green_max, int blue_max,
2157 int red_shift, int green_shift, int blue_shift)
2158 {
2159 if (!true_color_flag) {
2160 vnc_client_error(vs);
2161 return;
2162 }
2163
2164 switch (bits_per_pixel) {
2165 case 8:
2166 case 16:
2167 case 32:
2168 break;
2169 default:
2170 vnc_client_error(vs);
2171 return;
2172 }
2173
2174 vs->client_pf.rmax = red_max;
2175 vs->client_pf.rbits = hweight_long(red_max);
2176 vs->client_pf.rshift = red_shift;
2177 vs->client_pf.rmask = red_max << red_shift;
2178 vs->client_pf.gmax = green_max;
2179 vs->client_pf.gbits = hweight_long(green_max);
2180 vs->client_pf.gshift = green_shift;
2181 vs->client_pf.gmask = green_max << green_shift;
2182 vs->client_pf.bmax = blue_max;
2183 vs->client_pf.bbits = hweight_long(blue_max);
2184 vs->client_pf.bshift = blue_shift;
2185 vs->client_pf.bmask = blue_max << blue_shift;
2186 vs->client_pf.bits_per_pixel = bits_per_pixel;
2187 vs->client_pf.bytes_per_pixel = bits_per_pixel / 8;
2188 vs->client_pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;
2189 vs->client_be = big_endian_flag;
2190
2191 set_pixel_conversion(vs);
2192
2193 graphic_hw_invalidate(vs->vd->dcl.con);
2194 graphic_hw_update(vs->vd->dcl.con);
2195 }
2196
2197 static void pixel_format_message (VncState *vs) {
2198 char pad[3] = { 0, 0, 0 };
2199
2200 vs->client_pf = qemu_default_pixelformat(32);
2201
2202 vnc_write_u8(vs, vs->client_pf.bits_per_pixel); /* bits-per-pixel */
2203 vnc_write_u8(vs, vs->client_pf.depth); /* depth */
2204
2205 #ifdef HOST_WORDS_BIGENDIAN
2206 vnc_write_u8(vs, 1); /* big-endian-flag */
2207 #else
2208 vnc_write_u8(vs, 0); /* big-endian-flag */
2209 #endif
2210 vnc_write_u8(vs, 1); /* true-color-flag */
2211 vnc_write_u16(vs, vs->client_pf.rmax); /* red-max */
2212 vnc_write_u16(vs, vs->client_pf.gmax); /* green-max */
2213 vnc_write_u16(vs, vs->client_pf.bmax); /* blue-max */
2214 vnc_write_u8(vs, vs->client_pf.rshift); /* red-shift */
2215 vnc_write_u8(vs, vs->client_pf.gshift); /* green-shift */
2216 vnc_write_u8(vs, vs->client_pf.bshift); /* blue-shift */
2217 vnc_write(vs, pad, 3); /* padding */
2218
2219 vnc_hextile_set_pixel_conversion(vs, 0);
2220 vs->write_pixels = vnc_write_pixels_copy;
2221 }
2222
2223 static void vnc_colordepth(VncState *vs)
2224 {
2225 if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) {
2226 /* Sending a WMVi message to notify the client*/
2227 vnc_lock_output(vs);
2228 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
2229 vnc_write_u8(vs, 0);
2230 vnc_write_u16(vs, 1); /* number of rects */
2231 vnc_framebuffer_update(vs, 0, 0,
2232 pixman_image_get_width(vs->vd->server),
2233 pixman_image_get_height(vs->vd->server),
2234 VNC_ENCODING_WMVi);
2235 pixel_format_message(vs);
2236 vnc_unlock_output(vs);
2237 vnc_flush(vs);
2238 } else {
2239 set_pixel_conversion(vs);
2240 }
2241 }
2242
2243 static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
2244 {
2245 int i;
2246 uint16_t limit;
2247 VncDisplay *vd = vs->vd;
2248
2249 if (data[0] > 3) {
2250 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
2251 }
2252
2253 switch (data[0]) {
2254 case VNC_MSG_CLIENT_SET_PIXEL_FORMAT:
2255 if (len == 1)
2256 return 20;
2257
2258 set_pixel_format(vs, read_u8(data, 4), read_u8(data, 5),
2259 read_u8(data, 6), read_u8(data, 7),
2260 read_u16(data, 8), read_u16(data, 10),
2261 read_u16(data, 12), read_u8(data, 14),
2262 read_u8(data, 15), read_u8(data, 16));
2263 break;
2264 case VNC_MSG_CLIENT_SET_ENCODINGS:
2265 if (len == 1)
2266 return 4;
2267
2268 if (len == 4) {
2269 limit = read_u16(data, 2);
2270 if (limit > 0)
2271 return 4 + (limit * 4);
2272 } else
2273 limit = read_u16(data, 2);
2274
2275 for (i = 0; i < limit; i++) {
2276 int32_t val = read_s32(data, 4 + (i * 4));
2277 memcpy(data + 4 + (i * 4), &val, sizeof(val));
2278 }
2279
2280 set_encodings(vs, (int32_t *)(data + 4), limit);
2281 break;
2282 case VNC_MSG_CLIENT_FRAMEBUFFER_UPDATE_REQUEST:
2283 if (len == 1)
2284 return 10;
2285
2286 framebuffer_update_request(vs,
2287 read_u8(data, 1), read_u16(data, 2), read_u16(data, 4),
2288 read_u16(data, 6), read_u16(data, 8));
2289 break;
2290 case VNC_MSG_CLIENT_KEY_EVENT:
2291 if (len == 1)
2292 return 8;
2293
2294 key_event(vs, read_u8(data, 1), read_u32(data, 4));
2295 break;
2296 case VNC_MSG_CLIENT_POINTER_EVENT:
2297 if (len == 1)
2298 return 6;
2299
2300 pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
2301 break;
2302 case VNC_MSG_CLIENT_CUT_TEXT:
2303 if (len == 1) {
2304 return 8;
2305 }
2306 if (len == 8) {
2307 uint32_t dlen = read_u32(data, 4);
2308 if (dlen > (1 << 20)) {
2309 error_report("vnc: client_cut_text msg payload has %u bytes"
2310 " which exceeds our limit of 1MB.", dlen);
2311 vnc_client_error(vs);
2312 break;
2313 }
2314 if (dlen > 0) {
2315 return 8 + dlen;
2316 }
2317 }
2318
2319 client_cut_text(vs, read_u32(data, 4), data + 8);
2320 break;
2321 case VNC_MSG_CLIENT_QEMU:
2322 if (len == 1)
2323 return 2;
2324
2325 switch (read_u8(data, 1)) {
2326 case VNC_MSG_CLIENT_QEMU_EXT_KEY_EVENT:
2327 if (len == 2)
2328 return 12;
2329
2330 ext_key_event(vs, read_u16(data, 2),
2331 read_u32(data, 4), read_u32(data, 8));
2332 break;
2333 case VNC_MSG_CLIENT_QEMU_AUDIO:
2334 if (len == 2)
2335 return 4;
2336
2337 switch (read_u16 (data, 2)) {
2338 case VNC_MSG_CLIENT_QEMU_AUDIO_ENABLE:
2339 audio_add(vs);
2340 break;
2341 case VNC_MSG_CLIENT_QEMU_AUDIO_DISABLE:
2342 audio_del(vs);
2343 break;
2344 case VNC_MSG_CLIENT_QEMU_AUDIO_SET_FORMAT:
2345 if (len == 4)
2346 return 10;
2347 switch (read_u8(data, 4)) {
2348 case 0: vs->as.fmt = AUD_FMT_U8; break;
2349 case 1: vs->as.fmt = AUD_FMT_S8; break;
2350 case 2: vs->as.fmt = AUD_FMT_U16; break;
2351 case 3: vs->as.fmt = AUD_FMT_S16; break;
2352 case 4: vs->as.fmt = AUD_FMT_U32; break;
2353 case 5: vs->as.fmt = AUD_FMT_S32; break;
2354 default:
2355 VNC_DEBUG("Invalid audio format %d\n", read_u8(data, 4));
2356 vnc_client_error(vs);
2357 break;
2358 }
2359 vs->as.nchannels = read_u8(data, 5);
2360 if (vs->as.nchannels != 1 && vs->as.nchannels != 2) {
2361 VNC_DEBUG("Invalid audio channel coount %d\n",
2362 read_u8(data, 5));
2363 vnc_client_error(vs);
2364 break;
2365 }
2366 vs->as.freq = read_u32(data, 6);
2367 break;
2368 default:
2369 VNC_DEBUG("Invalid audio message %d\n", read_u8(data, 4));
2370 vnc_client_error(vs);
2371 break;
2372 }
2373 break;
2374
2375 default:
2376 VNC_DEBUG("Msg: %d\n", read_u16(data, 0));
2377 vnc_client_error(vs);
2378 break;
2379 }
2380 break;
2381 default:
2382 VNC_DEBUG("Msg: %d\n", data[0]);
2383 vnc_client_error(vs);
2384 break;
2385 }
2386
2387 vnc_read_when(vs, protocol_client_msg, 1);
2388 return 0;
2389 }
2390
2391 static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
2392 {
2393 char buf[1024];
2394 VncShareMode mode;
2395 int size;
2396
2397 mode = data[0] ? VNC_SHARE_MODE_SHARED : VNC_SHARE_MODE_EXCLUSIVE;
2398 switch (vs->vd->share_policy) {
2399 case VNC_SHARE_POLICY_IGNORE:
2400 /*
2401 * Ignore the shared flag. Nothing to do here.
2402 *
2403 * Doesn't conform to the rfb spec but is traditional qemu
2404 * behavior, thus left here as option for compatibility
2405 * reasons.
2406 */
2407 break;
2408 case VNC_SHARE_POLICY_ALLOW_EXCLUSIVE:
2409 /*
2410 * Policy: Allow clients ask for exclusive access.
2411 *
2412 * Implementation: When a client asks for exclusive access,
2413 * disconnect all others. Shared connects are allowed as long
2414 * as no exclusive connection exists.
2415 *
2416 * This is how the rfb spec suggests to handle the shared flag.
2417 */
2418 if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2419 VncState *client;
2420 QTAILQ_FOREACH(client, &vs->vd->clients, next) {
2421 if (vs == client) {
2422 continue;
2423 }
2424 if (client->share_mode != VNC_SHARE_MODE_EXCLUSIVE &&
2425 client->share_mode != VNC_SHARE_MODE_SHARED) {
2426 continue;
2427 }
2428 vnc_disconnect_start(client);
2429 }
2430 }
2431 if (mode == VNC_SHARE_MODE_SHARED) {
2432 if (vs->vd->num_exclusive > 0) {
2433 vnc_disconnect_start(vs);
2434 return 0;
2435 }
2436 }
2437 break;
2438 case VNC_SHARE_POLICY_FORCE_SHARED:
2439 /*
2440 * Policy: Shared connects only.
2441 * Implementation: Disallow clients asking for exclusive access.
2442 *
2443 * Useful for shared desktop sessions where you don't want
2444 * someone forgetting to say -shared when running the vnc
2445 * client disconnect everybody else.
2446 */
2447 if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2448 vnc_disconnect_start(vs);
2449 return 0;
2450 }
2451 break;
2452 }
2453 vnc_set_share_mode(vs, mode);
2454
2455 if (vs->vd->num_shared > vs->vd->connections_limit) {
2456 vnc_disconnect_start(vs);
2457 return 0;
2458 }
2459
2460 vs->client_width = pixman_image_get_width(vs->vd->server);
2461 vs->client_height = pixman_image_get_height(vs->vd->server);
2462 vnc_write_u16(vs, vs->client_width);
2463 vnc_write_u16(vs, vs->client_height);
2464
2465 pixel_format_message(vs);
2466
2467 if (qemu_name)
2468 size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
2469 else
2470 size = snprintf(buf, sizeof(buf), "QEMU");
2471
2472 vnc_write_u32(vs, size);
2473 vnc_write(vs, buf, size);
2474 vnc_flush(vs);
2475
2476 vnc_client_cache_auth(vs);
2477 vnc_qmp_event(vs, QAPI_EVENT_VNC_INITIALIZED);
2478
2479 vnc_read_when(vs, protocol_client_msg, 1);
2480
2481 return 0;
2482 }
2483
2484 void start_client_init(VncState *vs)
2485 {
2486 vnc_read_when(vs, protocol_client_init, 1);
2487 }
2488
2489 static void make_challenge(VncState *vs)
2490 {
2491 int i;
2492
2493 srand(time(NULL)+getpid()+getpid()*987654+rand());
2494
2495 for (i = 0 ; i < sizeof(vs->challenge) ; i++)
2496 vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
2497 }
2498
2499 static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
2500 {
2501 unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
2502 size_t i, pwlen;
2503 unsigned char key[8];
2504 time_t now = time(NULL);
2505 QCryptoCipher *cipher = NULL;
2506 Error *err = NULL;
2507
2508 if (!vs->vd->password) {
2509 VNC_DEBUG("No password configured on server");
2510 goto reject;
2511 }
2512 if (vs->vd->expires < now) {
2513 VNC_DEBUG("Password is expired");
2514 goto reject;
2515 }
2516
2517 memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
2518
2519 /* Calculate the expected challenge response */
2520 pwlen = strlen(vs->vd->password);
2521 for (i=0; i<sizeof(key); i++)
2522 key[i] = i<pwlen ? vs->vd->password[i] : 0;
2523
2524 cipher = qcrypto_cipher_new(
2525 QCRYPTO_CIPHER_ALG_DES_RFB,
2526 QCRYPTO_CIPHER_MODE_ECB,
2527 key, G_N_ELEMENTS(key),
2528 &err);
2529 if (!cipher) {
2530 VNC_DEBUG("Cannot initialize cipher %s",
2531 error_get_pretty(err));
2532 error_free(err);
2533 goto reject;
2534 }
2535
2536 if (qcrypto_cipher_encrypt(cipher,
2537 vs->challenge,
2538 response,
2539 VNC_AUTH_CHALLENGE_SIZE,
2540 &err) < 0) {
2541 VNC_DEBUG("Cannot encrypt challenge %s",
2542 error_get_pretty(err));
2543 error_free(err);
2544 goto reject;
2545 }
2546
2547 /* Compare expected vs actual challenge response */
2548 if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) {
2549 VNC_DEBUG("Client challenge response did not match\n");
2550 goto reject;
2551 } else {
2552 VNC_DEBUG("Accepting VNC challenge response\n");
2553 vnc_write_u32(vs, 0); /* Accept auth */
2554 vnc_flush(vs);
2555
2556 start_client_init(vs);
2557 }
2558
2559 qcrypto_cipher_free(cipher);
2560 return 0;
2561
2562 reject:
2563 vnc_write_u32(vs, 1); /* Reject auth */
2564 if (vs->minor >= 8) {
2565 static const char err[] = "Authentication failed";
2566 vnc_write_u32(vs, sizeof(err));
2567 vnc_write(vs, err, sizeof(err));
2568 }
2569 vnc_flush(vs);
2570 vnc_client_error(vs);
2571 qcrypto_cipher_free(cipher);
2572 return 0;
2573 }
2574
2575 void start_auth_vnc(VncState *vs)
2576 {
2577 make_challenge(vs);
2578 /* Send client a 'random' challenge */
2579 vnc_write(vs, vs->challenge, sizeof(vs->challenge));
2580 vnc_flush(vs);
2581
2582 vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge));
2583 }
2584
2585
2586 static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
2587 {
2588 /* We only advertise 1 auth scheme at a time, so client
2589 * must pick the one we sent. Verify this */
2590 if (data[0] != vs->auth) { /* Reject auth */
2591 VNC_DEBUG("Reject auth %d because it didn't match advertized\n", (int)data[0]);
2592 vnc_write_u32(vs, 1);
2593 if (vs->minor >= 8) {
2594 static const char err[] = "Authentication failed";
2595 vnc_write_u32(vs, sizeof(err));
2596 vnc_write(vs, err, sizeof(err));
2597 }
2598 vnc_client_error(vs);
2599 } else { /* Accept requested auth */
2600 VNC_DEBUG("Client requested auth %d\n", (int)data[0]);
2601 switch (vs->auth) {
2602 case VNC_AUTH_NONE:
2603 VNC_DEBUG("Accept auth none\n");
2604 if (vs->minor >= 8) {
2605 vnc_write_u32(vs, 0); /* Accept auth completion */
2606 vnc_flush(vs);
2607 }
2608 start_client_init(vs);
2609 break;
2610
2611 case VNC_AUTH_VNC:
2612 VNC_DEBUG("Start VNC auth\n");
2613 start_auth_vnc(vs);
2614 break;
2615
2616 case VNC_AUTH_VENCRYPT:
2617 VNC_DEBUG("Accept VeNCrypt auth\n");
2618 start_auth_vencrypt(vs);
2619 break;
2620
2621 #ifdef CONFIG_VNC_SASL
2622 case VNC_AUTH_SASL:
2623 VNC_DEBUG("Accept SASL auth\n");
2624 start_auth_sasl(vs);
2625 break;
2626 #endif /* CONFIG_VNC_SASL */
2627
2628 default: /* Should not be possible, but just in case */
2629 VNC_DEBUG("Reject auth %d server code bug\n", vs->auth);
2630 vnc_write_u8(vs, 1);
2631 if (vs->minor >= 8) {
2632 static const char err[] = "Authentication failed";
2633 vnc_write_u32(vs, sizeof(err));
2634 vnc_write(vs, err, sizeof(err));
2635 }
2636 vnc_client_error(vs);
2637 }
2638 }
2639 return 0;
2640 }
2641
2642 static int protocol_version(VncState *vs, uint8_t *version, size_t len)
2643 {
2644 char local[13];
2645
2646 memcpy(local, version, 12);
2647 local[12] = 0;
2648
2649 if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) {
2650 VNC_DEBUG("Malformed protocol version %s\n", local);
2651 vnc_client_error(vs);
2652 return 0;
2653 }
2654 VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor);
2655 if (vs->major != 3 ||
2656 (vs->minor != 3 &&
2657 vs->minor != 4 &&
2658 vs->minor != 5 &&
2659 vs->minor != 7 &&
2660 vs->minor != 8)) {
2661 VNC_DEBUG("Unsupported client version\n");
2662 vnc_write_u32(vs, VNC_AUTH_INVALID);
2663 vnc_flush(vs);
2664 vnc_client_error(vs);
2665 return 0;
2666 }
2667 /* Some broken clients report v3.4 or v3.5, which spec requires to be treated
2668 * as equivalent to v3.3 by servers
2669 */
2670 if (vs->minor == 4 || vs->minor == 5)
2671 vs->minor = 3;
2672
2673 if (vs->minor == 3) {
2674 if (vs->auth == VNC_AUTH_NONE) {
2675 VNC_DEBUG("Tell client auth none\n");
2676 vnc_write_u32(vs, vs->auth);
2677 vnc_flush(vs);
2678 start_client_init(vs);
2679 } else if (vs->auth == VNC_AUTH_VNC) {
2680 VNC_DEBUG("Tell client VNC auth\n");
2681 vnc_write_u32(vs, vs->auth);
2682 vnc_flush(vs);
2683 start_auth_vnc(vs);
2684 } else {
2685 VNC_DEBUG("Unsupported auth %d for protocol 3.3\n", vs->auth);
2686 vnc_write_u32(vs, VNC_AUTH_INVALID);
2687 vnc_flush(vs);
2688 vnc_client_error(vs);
2689 }
2690 } else {
2691 VNC_DEBUG("Telling client we support auth %d\n", vs->auth);
2692 vnc_write_u8(vs, 1); /* num auth */
2693 vnc_write_u8(vs, vs->auth);
2694 vnc_read_when(vs, protocol_client_auth, 1);
2695 vnc_flush(vs);
2696 }
2697
2698 return 0;
2699 }
2700
2701 static VncRectStat *vnc_stat_rect(VncDisplay *vd, int x, int y)
2702 {
2703 struct VncSurface *vs = &vd->guest;
2704
2705 return &vs->stats[y / VNC_STAT_RECT][x / VNC_STAT_RECT];
2706 }
2707
2708 void vnc_sent_lossy_rect(VncState *vs, int x, int y, int w, int h)
2709 {
2710 int i, j;
2711
2712 w = (x + w) / VNC_STAT_RECT;
2713 h = (y + h) / VNC_STAT_RECT;
2714 x /= VNC_STAT_RECT;
2715 y /= VNC_STAT_RECT;
2716
2717 for (j = y; j <= h; j++) {
2718 for (i = x; i <= w; i++) {
2719 vs->lossy_rect[j][i] = 1;
2720 }
2721 }
2722 }
2723
2724 static int vnc_refresh_lossy_rect(VncDisplay *vd, int x, int y)
2725 {
2726 VncState *vs;
2727 int sty = y / VNC_STAT_RECT;
2728 int stx = x / VNC_STAT_RECT;
2729 int has_dirty = 0;
2730
2731 y = y / VNC_STAT_RECT * VNC_STAT_RECT;
2732 x = x / VNC_STAT_RECT * VNC_STAT_RECT;
2733
2734 QTAILQ_FOREACH(vs, &vd->clients, next) {
2735 int j;
2736
2737 /* kernel send buffers are full -> refresh later */
2738 if (vs->output.offset) {
2739 continue;
2740 }
2741
2742 if (!vs->lossy_rect[sty][stx]) {
2743 continue;
2744 }
2745
2746 vs->lossy_rect[sty][stx] = 0;
2747 for (j = 0; j < VNC_STAT_RECT; ++j) {
2748 bitmap_set(vs->dirty[y + j],
2749 x / VNC_DIRTY_PIXELS_PER_BIT,
2750 VNC_STAT_RECT / VNC_DIRTY_PIXELS_PER_BIT);
2751 }
2752 has_dirty++;
2753 }
2754
2755 return has_dirty;
2756 }
2757
2758 static int vnc_update_stats(VncDisplay *vd, struct timeval * tv)
2759 {
2760 int width = pixman_image_get_width(vd->guest.fb);
2761 int height = pixman_image_get_height(vd->guest.fb);
2762 int x, y;
2763 struct timeval res;
2764 int has_dirty = 0;
2765
2766 for (y = 0; y < height; y += VNC_STAT_RECT) {
2767 for (x = 0; x < width; x += VNC_STAT_RECT) {
2768 VncRectStat *rect = vnc_stat_rect(vd, x, y);
2769
2770 rect->updated = false;
2771 }
2772 }
2773
2774 qemu_timersub(tv, &VNC_REFRESH_STATS, &res);
2775
2776 if (timercmp(&vd->guest.last_freq_check, &res, >)) {
2777 return has_dirty;
2778 }
2779 vd->guest.last_freq_check = *tv;
2780
2781 for (y = 0; y < height; y += VNC_STAT_RECT) {
2782 for (x = 0; x < width; x += VNC_STAT_RECT) {
2783 VncRectStat *rect= vnc_stat_rect(vd, x, y);
2784 int count = ARRAY_SIZE(rect->times);
2785 struct timeval min, max;
2786
2787 if (!timerisset(&rect->times[count - 1])) {
2788 continue ;
2789 }
2790
2791 max = rect->times[(rect->idx + count - 1) % count];
2792 qemu_timersub(tv, &max, &res);
2793
2794 if (timercmp(&res, &VNC_REFRESH_LOSSY, >)) {
2795 rect->freq = 0;
2796 has_dirty += vnc_refresh_lossy_rect(vd, x, y);
2797 memset(rect->times, 0, sizeof (rect->times));
2798 continue ;
2799 }
2800
2801 min = rect->times[rect->idx];
2802 max = rect->times[(rect->idx + count - 1) % count];
2803 qemu_timersub(&max, &min, &res);
2804
2805 rect->freq = res.tv_sec + res.tv_usec / 1000000.;
2806 rect->freq /= count;
2807 rect->freq = 1. / rect->freq;
2808 }
2809 }
2810 return has_dirty;
2811 }
2812
2813 double vnc_update_freq(VncState *vs, int x, int y, int w, int h)
2814 {
2815 int i, j;
2816 double total = 0;
2817 int num = 0;
2818
2819 x = (x / VNC_STAT_RECT) * VNC_STAT_RECT;
2820 y = (y / VNC_STAT_RECT) * VNC_STAT_RECT;
2821
2822 for (j = y; j <= y + h; j += VNC_STAT_RECT) {
2823 for (i = x; i <= x + w; i += VNC_STAT_RECT) {
2824 total += vnc_stat_rect(vs->vd, i, j)->freq;
2825 num++;
2826 }
2827 }
2828
2829 if (num) {
2830 return total / num;
2831 } else {
2832 return 0;
2833 }
2834 }
2835
2836 static void vnc_rect_updated(VncDisplay *vd, int x, int y, struct timeval * tv)
2837 {
2838 VncRectStat *rect;
2839
2840 rect = vnc_stat_rect(vd, x, y);
2841 if (rect->updated) {
2842 return ;
2843 }
2844 rect->times[rect->idx] = *tv;
2845 rect->idx = (rect->idx + 1) % ARRAY_SIZE(rect->times);
2846 rect->updated = true;
2847 }
2848
2849 static int vnc_refresh_server_surface(VncDisplay *vd)
2850 {
2851 int width = MIN(pixman_image_get_width(vd->guest.fb),
2852 pixman_image_get_width(vd->server));
2853 int height = MIN(pixman_image_get_height(vd->guest.fb),
2854 pixman_image_get_height(vd->server));
2855 int cmp_bytes, server_stride, line_bytes, guest_ll, guest_stride, y = 0;
2856 uint8_t *guest_row0 = NULL, *server_row0;
2857 VncState *vs;
2858 int has_dirty = 0;
2859 pixman_image_t *tmpbuf = NULL;
2860
2861 struct timeval tv = { 0, 0 };
2862
2863 if (!vd->non_adaptive) {
2864 gettimeofday(&tv, NULL);
2865 has_dirty = vnc_update_stats(vd, &tv);
2866 }
2867
2868 /*
2869 * Walk through the guest dirty map.
2870 * Check and copy modified bits from guest to server surface.
2871 * Update server dirty map.
2872 */
2873 server_row0 = (uint8_t *)pixman_image_get_data(vd->server);
2874 server_stride = guest_stride = guest_ll =
2875 pixman_image_get_stride(vd->server);
2876 cmp_bytes = MIN(VNC_DIRTY_PIXELS_PER_BIT * VNC_SERVER_FB_BYTES,
2877 server_stride);
2878 if (vd->guest.format != VNC_SERVER_FB_FORMAT) {
2879 int width = pixman_image_get_width(vd->server);
2880 tmpbuf = qemu_pixman_linebuf_create(VNC_SERVER_FB_FORMAT, width);
2881 } else {
2882 int guest_bpp =
2883 PIXMAN_FORMAT_BPP(pixman_image_get_format(vd->guest.fb));
2884 guest_row0 = (uint8_t *)pixman_image_get_data(vd->guest.fb);
2885 guest_stride = pixman_image_get_stride(vd->guest.fb);
2886 guest_ll = pixman_image_get_width(vd->guest.fb) * ((guest_bpp + 7) / 8);
2887 }
2888 line_bytes = MIN(server_stride, guest_ll);
2889
2890 for (;;) {
2891 int x;
2892 uint8_t *guest_ptr, *server_ptr;
2893 unsigned long offset = find_next_bit((unsigned long *) &vd->guest.dirty,
2894 height * VNC_DIRTY_BPL(&vd->guest),
2895 y * VNC_DIRTY_BPL(&vd->guest));
2896 if (offset == height * VNC_DIRTY_BPL(&vd->guest)) {
2897 /* no more dirty bits */
2898 break;
2899 }
2900 y = offset / VNC_DIRTY_BPL(&vd->guest);
2901 x = offset % VNC_DIRTY_BPL(&vd->guest);
2902
2903 server_ptr = server_row0 + y * server_stride + x * cmp_bytes;
2904
2905 if (vd->guest.format != VNC_SERVER_FB_FORMAT) {
2906 qemu_pixman_linebuf_fill(tmpbuf, vd->guest.fb, width, 0, y);
2907 guest_ptr = (uint8_t *)pixman_image_get_data(tmpbuf);
2908 } else {
2909 guest_ptr = guest_row0 + y * guest_stride;
2910 }
2911 guest_ptr += x * cmp_bytes;
2912
2913 for (; x < DIV_ROUND_UP(width, VNC_DIRTY_PIXELS_PER_BIT);
2914 x++, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) {
2915 int _cmp_bytes = cmp_bytes;
2916 if (!test_and_clear_bit(x, vd->guest.dirty[y])) {
2917 continue;
2918 }
2919 if ((x + 1) * cmp_bytes > line_bytes) {
2920 _cmp_bytes = line_bytes - x * cmp_bytes;
2921 }
2922 assert(_cmp_bytes >= 0);
2923 if (memcmp(server_ptr, guest_ptr, _cmp_bytes) == 0) {
2924 continue;
2925 }
2926 memcpy(server_ptr, guest_ptr, _cmp_bytes);
2927 if (!vd->non_adaptive) {
2928 vnc_rect_updated(vd, x * VNC_DIRTY_PIXELS_PER_BIT,
2929 y, &tv);
2930 }
2931 QTAILQ_FOREACH(vs, &vd->clients, next) {
2932 set_bit(x, vs->dirty[y]);
2933 }
2934 has_dirty++;
2935 }
2936
2937 y++;
2938 }
2939 qemu_pixman_image_unref(tmpbuf);
2940 return has_dirty;
2941 }
2942
2943 static void vnc_refresh(DisplayChangeListener *dcl)
2944 {
2945 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
2946 VncState *vs, *vn;
2947 int has_dirty, rects = 0;
2948
2949 if (QTAILQ_EMPTY(&vd->clients)) {
2950 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_MAX);
2951 return;
2952 }
2953
2954 graphic_hw_update(vd->dcl.con);
2955
2956 if (vnc_trylock_display(vd)) {
2957 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
2958 return;
2959 }
2960
2961 has_dirty = vnc_refresh_server_surface(vd);
2962 vnc_unlock_display(vd);
2963
2964 QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {
2965 rects += vnc_update_client(vs, has_dirty, false);
2966 /* vs might be free()ed here */
2967 }
2968
2969 if (has_dirty && rects) {
2970 vd->dcl.update_interval /= 2;
2971 if (vd->dcl.update_interval < VNC_REFRESH_INTERVAL_BASE) {
2972 vd->dcl.update_interval = VNC_REFRESH_INTERVAL_BASE;
2973 }
2974 } else {
2975 vd->dcl.update_interval += VNC_REFRESH_INTERVAL_INC;
2976 if (vd->dcl.update_interval > VNC_REFRESH_INTERVAL_MAX) {
2977 vd->dcl.update_interval = VNC_REFRESH_INTERVAL_MAX;
2978 }
2979 }
2980 }
2981
2982 static void vnc_connect(VncDisplay *vd, int csock,
2983 bool skipauth, bool websocket)
2984 {
2985 VncState *vs = g_new0(VncState, 1);
2986 int i;
2987
2988 vs->csock = csock;
2989 vs->vd = vd;
2990
2991 if (skipauth) {
2992 vs->auth = VNC_AUTH_NONE;
2993 vs->subauth = VNC_AUTH_INVALID;
2994 } else {
2995 if (websocket) {
2996 vs->auth = vd->ws_auth;
2997 vs->subauth = VNC_AUTH_INVALID;
2998 } else {
2999 vs->auth = vd->auth;
3000 vs->subauth = vd->subauth;
3001 }
3002 }
3003 VNC_DEBUG("Client sock=%d ws=%d auth=%d subauth=%d\n",
3004 csock, websocket, vs->auth, vs->subauth);
3005
3006 vs->lossy_rect = g_malloc0(VNC_STAT_ROWS * sizeof (*vs->lossy_rect));
3007 for (i = 0; i < VNC_STAT_ROWS; ++i) {
3008 vs->lossy_rect[i] = g_new0(uint8_t, VNC_STAT_COLS);
3009 }
3010
3011 VNC_DEBUG("New client on socket %d\n", csock);
3012 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
3013 qemu_set_nonblock(vs->csock);
3014 if (websocket) {
3015 vs->websocket = 1;
3016 if (vd->ws_tls) {
3017 qemu_set_fd_handler(vs->csock, vncws_tls_handshake_io, NULL, vs);
3018 } else {
3019 qemu_set_fd_handler(vs->csock, vncws_handshake_read, NULL, vs);
3020 }
3021 } else
3022 {
3023 qemu_set_fd_handler(vs->csock, vnc_client_read, NULL, vs);
3024 }
3025
3026 vnc_client_cache_addr(vs);
3027 vnc_qmp_event(vs, QAPI_EVENT_VNC_CONNECTED);
3028 vnc_set_share_mode(vs, VNC_SHARE_MODE_CONNECTING);
3029
3030 if (!vs->websocket) {
3031 vnc_init_state(vs);
3032 }
3033
3034 if (vd->num_connecting > vd->connections_limit) {
3035 QTAILQ_FOREACH(vs, &vd->clients, next) {
3036 if (vs->share_mode == VNC_SHARE_MODE_CONNECTING) {
3037 vnc_disconnect_start(vs);
3038 return;
3039 }
3040 }
3041 }
3042 }
3043
3044 void vnc_init_state(VncState *vs)
3045 {
3046 vs->initialized = true;
3047 VncDisplay *vd = vs->vd;
3048
3049 vs->last_x = -1;
3050 vs->last_y = -1;
3051
3052 vs->as.freq = 44100;
3053 vs->as.nchannels = 2;
3054 vs->as.fmt = AUD_FMT_S16;
3055 vs->as.endianness = 0;
3056
3057 qemu_mutex_init(&vs->output_mutex);
3058 vs->bh = qemu_bh_new(vnc_jobs_bh, vs);
3059
3060 QTAILQ_INSERT_TAIL(&vd->clients, vs, next);
3061
3062 graphic_hw_update(vd->dcl.con);
3063
3064 vnc_write(vs, "RFB 003.008\n", 12);
3065 vnc_flush(vs);
3066 vnc_read_when(vs, protocol_version, 12);
3067 reset_keys(vs);
3068 if (vs->vd->lock_key_sync)
3069 vs->led = qemu_add_led_event_handler(kbd_leds, vs);
3070
3071 vs->mouse_mode_notifier.notify = check_pointer_type_change;
3072 qemu_add_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
3073
3074 /* vs might be free()ed here */
3075 }
3076
3077 static void vnc_listen_read(void *opaque, bool websocket)
3078 {
3079 VncDisplay *vs = opaque;
3080 struct sockaddr_in addr;
3081 socklen_t addrlen = sizeof(addr);
3082 int csock;
3083
3084 /* Catch-up */
3085 graphic_hw_update(vs->dcl.con);
3086 if (websocket) {
3087 csock = qemu_accept(vs->lwebsock, (struct sockaddr *)&addr, &addrlen);
3088 } else {
3089 csock = qemu_accept(vs->lsock, (struct sockaddr *)&addr, &addrlen);
3090 }
3091
3092 if (csock != -1) {
3093 socket_set_nodelay(csock);
3094 vnc_connect(vs, csock, false, websocket);
3095 }
3096 }
3097
3098 static void vnc_listen_regular_read(void *opaque)
3099 {
3100 vnc_listen_read(opaque, false);
3101 }
3102
3103 static void vnc_listen_websocket_read(void *opaque)
3104 {
3105 vnc_listen_read(opaque, true);
3106 }
3107
3108 static const DisplayChangeListenerOps dcl_ops = {
3109 .dpy_name = "vnc",
3110 .dpy_refresh = vnc_refresh,
3111 .dpy_gfx_copy = vnc_dpy_copy,
3112 .dpy_gfx_update = vnc_dpy_update,
3113 .dpy_gfx_switch = vnc_dpy_switch,
3114 .dpy_gfx_check_format = qemu_pixman_check_format,
3115 .dpy_mouse_set = vnc_mouse_set,
3116 .dpy_cursor_define = vnc_dpy_cursor_define,
3117 };
3118
3119 void vnc_display_init(const char *id)
3120 {
3121 VncDisplay *vs;
3122
3123 if (vnc_display_find(id) != NULL) {
3124 return;
3125 }
3126 vs = g_malloc0(sizeof(*vs));
3127
3128 vs->id = strdup(id);
3129 QTAILQ_INSERT_TAIL(&vnc_displays, vs, next);
3130
3131 vs->lsock = -1;
3132 vs->lwebsock = -1;
3133
3134 QTAILQ_INIT(&vs->clients);
3135 vs->expires = TIME_MAX;
3136
3137 if (keyboard_layout) {
3138 trace_vnc_key_map_init(keyboard_layout);
3139 vs->kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout);
3140 } else {
3141 vs->kbd_layout = init_keyboard_layout(name2keysym, "en-us");
3142 }
3143
3144 if (!vs->kbd_layout)
3145 exit(1);
3146
3147 qemu_mutex_init(&vs->mutex);
3148 vnc_start_worker_thread();
3149
3150 vs->dcl.ops = &dcl_ops;
3151 register_displaychangelistener(&vs->dcl);
3152 }
3153
3154
3155 static void vnc_display_close(VncDisplay *vs)
3156 {
3157 if (!vs)
3158 return;
3159 vs->enabled = false;
3160 vs->is_unix = false;
3161 if (vs->lsock != -1) {
3162 qemu_set_fd_handler(vs->lsock, NULL, NULL, NULL);
3163 close(vs->lsock);
3164 vs->lsock = -1;
3165 }
3166 vs->ws_enabled = false;
3167 if (vs->lwebsock != -1) {
3168 qemu_set_fd_handler(vs->lwebsock, NULL, NULL, NULL);
3169 close(vs->lwebsock);
3170 vs->lwebsock = -1;
3171 }
3172 vs->auth = VNC_AUTH_INVALID;
3173 vs->subauth = VNC_AUTH_INVALID;
3174 if (vs->tlscreds) {
3175 object_unparent(OBJECT(vs->tlscreds));
3176 }
3177 g_free(vs->tlsaclname);
3178 vs->tlsaclname = NULL;
3179 }
3180
3181 int vnc_display_password(const char *id, const char *password)
3182 {
3183 VncDisplay *vs = vnc_display_find(id);
3184
3185 if (!vs) {
3186 return -EINVAL;
3187 }
3188 if (vs->auth == VNC_AUTH_NONE) {
3189 error_printf_unless_qmp("If you want use passwords please enable "
3190 "password auth using '-vnc ${dpy},password'.");
3191 return -EINVAL;
3192 }
3193
3194 g_free(vs->password);
3195 vs->password = g_strdup(password);
3196
3197 return 0;
3198 }
3199
3200 int vnc_display_pw_expire(const char *id, time_t expires)
3201 {
3202 VncDisplay *vs = vnc_display_find(id);
3203
3204 if (!vs) {
3205 return -EINVAL;
3206 }
3207
3208 vs->expires = expires;
3209 return 0;
3210 }
3211
3212 char *vnc_display_local_addr(const char *id)
3213 {
3214 VncDisplay *vs = vnc_display_find(id);
3215
3216 assert(vs);
3217 return vnc_socket_local_addr("%s:%s", vs->lsock);
3218 }
3219
3220 static QemuOptsList qemu_vnc_opts = {
3221 .name = "vnc",
3222 .head = QTAILQ_HEAD_INITIALIZER(qemu_vnc_opts.head),
3223 .implied_opt_name = "vnc",
3224 .desc = {
3225 {
3226 .name = "vnc",
3227 .type = QEMU_OPT_STRING,
3228 },{
3229 .name = "websocket",
3230 .type = QEMU_OPT_STRING,
3231 },{
3232 .name = "tls-creds",
3233 .type = QEMU_OPT_STRING,
3234 },{
3235 /* Deprecated in favour of tls-creds */
3236 .name = "x509",
3237 .type = QEMU_OPT_STRING,
3238 },{
3239 .name = "share",
3240 .type = QEMU_OPT_STRING,
3241 },{
3242 .name = "display",
3243 .type = QEMU_OPT_STRING,
3244 },{
3245 .name = "head",
3246 .type = QEMU_OPT_NUMBER,
3247 },{
3248 .name = "connections",
3249 .type = QEMU_OPT_NUMBER,
3250 },{
3251 .name = "to",
3252 .type = QEMU_OPT_NUMBER,
3253 },{
3254 .name = "ipv4",
3255 .type = QEMU_OPT_BOOL,
3256 },{
3257 .name = "ipv6",
3258 .type = QEMU_OPT_BOOL,
3259 },{
3260 .name = "password",
3261 .type = QEMU_OPT_BOOL,
3262 },{
3263 .name = "reverse",
3264 .type = QEMU_OPT_BOOL,
3265 },{
3266 .name = "lock-key-sync",
3267 .type = QEMU_OPT_BOOL,
3268 },{
3269 .name = "sasl",
3270 .type = QEMU_OPT_BOOL,
3271 },{
3272 /* Deprecated in favour of tls-creds */
3273 .name = "tls",
3274 .type = QEMU_OPT_BOOL,
3275 },{
3276 /* Deprecated in favour of tls-creds */
3277 .name = "x509verify",
3278 .type = QEMU_OPT_STRING,
3279 },{
3280 .name = "acl",
3281 .type = QEMU_OPT_BOOL,
3282 },{
3283 .name = "lossy",
3284 .type = QEMU_OPT_BOOL,
3285 },{
3286 .name = "non-adaptive",
3287 .type = QEMU_OPT_BOOL,
3288 },
3289 { /* end of list */ }
3290 },
3291 };
3292
3293
3294 static int
3295 vnc_display_setup_auth(VncDisplay *vs,
3296 bool password,
3297 bool sasl,
3298 bool websocket,
3299 Error **errp)
3300 {
3301 /*
3302 * We have a choice of 3 authentication options
3303 *
3304 * 1. none
3305 * 2. vnc
3306 * 3. sasl
3307 *
3308 * The channel can be run in 2 modes
3309 *
3310 * 1. clear
3311 * 2. tls
3312 *
3313 * And TLS can use 2 types of credentials
3314 *
3315 * 1. anon
3316 * 2. x509
3317 *
3318 * We thus have 9 possible logical combinations
3319 *
3320 * 1. clear + none
3321 * 2. clear + vnc
3322 * 3. clear + sasl
3323 * 4. tls + anon + none
3324 * 5. tls + anon + vnc
3325 * 6. tls + anon + sasl
3326 * 7. tls + x509 + none
3327 * 8. tls + x509 + vnc
3328 * 9. tls + x509 + sasl
3329 *
3330 * These need to be mapped into the VNC auth schemes
3331 * in an appropriate manner. In regular VNC, all the
3332 * TLS options get mapped into VNC_AUTH_VENCRYPT
3333 * sub-auth types.
3334 *
3335 * In websockets, the https:// protocol already provides
3336 * TLS support, so there is no need to make use of the
3337 * VeNCrypt extension. Furthermore, websockets browser
3338 * clients could not use VeNCrypt even if they wanted to,
3339 * as they cannot control when the TLS handshake takes
3340 * place. Thus there is no option but to rely on https://,
3341 * meaning combinations 4->6 and 7->9 will be mapped to
3342 * VNC auth schemes in the same way as combos 1->3.
3343 *
3344 * Regardless of fact that we have a different mapping to
3345 * VNC auth mechs for plain VNC vs websockets VNC, the end
3346 * result has the same security characteristics.
3347 */
3348 if (password) {
3349 if (vs->tlscreds) {
3350 vs->auth = VNC_AUTH_VENCRYPT;
3351 if (websocket) {
3352 vs->ws_tls = true;
3353 }
3354 if (object_dynamic_cast(OBJECT(vs->tlscreds),
3355 TYPE_QCRYPTO_TLS_CREDS_X509)) {
3356 VNC_DEBUG("Initializing VNC server with x509 password auth\n");
3357 vs->subauth = VNC_AUTH_VENCRYPT_X509VNC;
3358 } else if (object_dynamic_cast(OBJECT(vs->tlscreds),
3359 TYPE_QCRYPTO_TLS_CREDS_ANON)) {
3360 VNC_DEBUG("Initializing VNC server with TLS password auth\n");
3361 vs->subauth = VNC_AUTH_VENCRYPT_TLSVNC;
3362 } else {
3363 error_setg(errp,
3364 "Unsupported TLS cred type %s",
3365 object_get_typename(OBJECT(vs->tlscreds)));
3366 return -1;
3367 }
3368 } else {
3369 VNC_DEBUG("Initializing VNC server with password auth\n");
3370 vs->auth = VNC_AUTH_VNC;
3371 vs->subauth = VNC_AUTH_INVALID;
3372 }
3373 if (websocket) {
3374 vs->ws_auth = VNC_AUTH_VNC;
3375 } else {
3376 vs->ws_auth = VNC_AUTH_INVALID;
3377 }
3378 } else if (sasl) {
3379 if (vs->tlscreds) {
3380 vs->auth = VNC_AUTH_VENCRYPT;
3381 if (websocket) {
3382 vs->ws_tls = true;
3383 }
3384 if (object_dynamic_cast(OBJECT(vs->tlscreds),
3385 TYPE_QCRYPTO_TLS_CREDS_X509)) {
3386 VNC_DEBUG("Initializing VNC server with x509 SASL auth\n");
3387 vs->subauth = VNC_AUTH_VENCRYPT_X509SASL;
3388 } else if (object_dynamic_cast(OBJECT(vs->tlscreds),
3389 TYPE_QCRYPTO_TLS_CREDS_ANON)) {
3390 VNC_DEBUG("Initializing VNC server with TLS SASL auth\n");
3391 vs->subauth = VNC_AUTH_VENCRYPT_TLSSASL;
3392 } else {
3393 error_setg(errp,
3394 "Unsupported TLS cred type %s",
3395 object_get_typename(OBJECT(vs->tlscreds)));
3396 return -1;
3397 }
3398 } else {
3399 VNC_DEBUG("Initializing VNC server with SASL auth\n");
3400 vs->auth = VNC_AUTH_SASL;
3401 vs->subauth = VNC_AUTH_INVALID;
3402 }
3403 if (websocket) {
3404 vs->ws_auth = VNC_AUTH_SASL;
3405 } else {
3406 vs->ws_auth = VNC_AUTH_INVALID;
3407 }
3408 } else {
3409 if (vs->tlscreds) {
3410 vs->auth = VNC_AUTH_VENCRYPT;
3411 if (websocket) {
3412 vs->ws_tls = true;
3413 }
3414 if (object_dynamic_cast(OBJECT(vs->tlscreds),
3415 TYPE_QCRYPTO_TLS_CREDS_X509)) {
3416 VNC_DEBUG("Initializing VNC server with x509 no auth\n");
3417 vs->subauth = VNC_AUTH_VENCRYPT_X509NONE;
3418 } else if (object_dynamic_cast(OBJECT(vs->tlscreds),
3419 TYPE_QCRYPTO_TLS_CREDS_ANON)) {
3420 VNC_DEBUG("Initializing VNC server with TLS no auth\n");
3421 vs->subauth = VNC_AUTH_VENCRYPT_TLSNONE;
3422 } else {
3423 error_setg(errp,
3424 "Unsupported TLS cred type %s",
3425 object_get_typename(OBJECT(vs->tlscreds)));
3426 return -1;
3427 }
3428 } else {
3429 VNC_DEBUG("Initializing VNC server with no auth\n");
3430 vs->auth = VNC_AUTH_NONE;
3431 vs->subauth = VNC_AUTH_INVALID;
3432 }
3433 if (websocket) {
3434 vs->ws_auth = VNC_AUTH_NONE;
3435 } else {
3436 vs->ws_auth = VNC_AUTH_INVALID;
3437 }
3438 }
3439 return 0;
3440 }
3441
3442
3443 /*
3444 * Handle back compat with old CLI syntax by creating some
3445 * suitable QCryptoTLSCreds objects
3446 */
3447 static QCryptoTLSCreds *
3448 vnc_display_create_creds(bool x509,
3449 bool x509verify,
3450 const char *dir,
3451 const char *id,
3452 Error **errp)
3453 {
3454 gchar *credsid = g_strdup_printf("tlsvnc%s", id);
3455 Object *parent = object_get_objects_root();
3456 Object *creds;
3457 Error *err = NULL;
3458
3459 if (x509) {
3460 creds = object_new_with_props(TYPE_QCRYPTO_TLS_CREDS_X509,
3461 parent,
3462 credsid,
3463 &err,
3464 "endpoint", "server",
3465 "dir", dir,
3466 "verify-peer", x509verify ? "yes" : "no",
3467 NULL);
3468 } else {
3469 creds = object_new_with_props(TYPE_QCRYPTO_TLS_CREDS_ANON,
3470 parent,
3471 credsid,
3472 &err,
3473 "endpoint", "server",
3474 NULL);
3475 }
3476
3477 g_free(credsid);
3478
3479 if (err) {
3480 error_propagate(errp, err);
3481 return NULL;
3482 }
3483
3484 return QCRYPTO_TLS_CREDS(creds);
3485 }
3486
3487
3488 void vnc_display_open(const char *id, Error **errp)
3489 {
3490 VncDisplay *vs = vnc_display_find(id);
3491 QemuOpts *opts = qemu_opts_find(&qemu_vnc_opts, id);
3492 SocketAddress *saddr = NULL, *wsaddr = NULL;
3493 const char *share, *device_id;
3494 QemuConsole *con;
3495 bool password = false;
3496 bool reverse = false;
3497 const char *vnc;
3498 char *h;
3499 const char *credid;
3500 bool sasl = false;
3501 #ifdef CONFIG_VNC_SASL
3502 int saslErr;
3503 #endif
3504 int acl = 0;
3505 int lock_key_sync = 1;
3506
3507 if (!vs) {
3508 error_setg(errp, "VNC display not active");
3509 return;
3510 }
3511 vnc_display_close(vs);
3512
3513 if (!opts) {
3514 return;
3515 }
3516 vnc = qemu_opt_get(opts, "vnc");
3517 if (!vnc || strcmp(vnc, "none") == 0) {
3518 return;
3519 }
3520
3521 h = strrchr(vnc, ':');
3522 if (h) {
3523 size_t hlen = h - vnc;
3524
3525 const char *websocket = qemu_opt_get(opts, "websocket");
3526 int to = qemu_opt_get_number(opts, "to", 0);
3527 bool has_ipv4 = qemu_opt_get_bool(opts, "ipv4", false);
3528 bool has_ipv6 = qemu_opt_get_bool(opts, "ipv6", false);
3529
3530 saddr = g_new0(SocketAddress, 1);
3531 if (websocket) {
3532 if (!qcrypto_hash_supports(QCRYPTO_HASH_ALG_SHA1)) {
3533 error_setg(errp,
3534 "SHA1 hash support is required for websockets");
3535 goto fail;
3536 }
3537
3538 wsaddr = g_new0(SocketAddress, 1);
3539 vs->ws_enabled = true;
3540 }
3541
3542 if (strncmp(vnc, "unix:", 5) == 0) {
3543 saddr->type = SOCKET_ADDRESS_KIND_UNIX;
3544 saddr->u.q_unix = g_new0(UnixSocketAddress, 1);
3545 saddr->u.q_unix->path = g_strdup(vnc + 5);
3546
3547 if (vs->ws_enabled) {
3548 error_setg(errp, "UNIX sockets not supported with websock");
3549 goto fail;
3550 }
3551 } else {
3552 unsigned long long baseport;
3553 saddr->type = SOCKET_ADDRESS_KIND_INET;
3554 saddr->u.inet = g_new0(InetSocketAddress, 1);
3555 if (vnc[0] == '[' && vnc[hlen - 1] == ']') {
3556 saddr->u.inet->host = g_strndup(vnc + 1, hlen - 2);
3557 } else {
3558 saddr->u.inet->host = g_strndup(vnc, hlen);
3559 }
3560 if (parse_uint_full(h + 1, &baseport, 10) < 0) {
3561 error_setg(errp, "can't convert to a number: %s", h + 1);
3562 goto fail;
3563 }
3564 if (baseport > 65535 ||
3565 baseport + 5900 > 65535) {
3566 error_setg(errp, "port %s out of range", h + 1);
3567 goto fail;
3568 }
3569 saddr->u.inet->port = g_strdup_printf(
3570 "%d", (int)baseport + 5900);
3571
3572 if (to) {
3573 saddr->u.inet->has_to = true;
3574 saddr->u.inet->to = to;
3575 saddr->u.inet->has_to = true;
3576 saddr->u.inet->to = to + 5900;
3577 }
3578 saddr->u.inet->ipv4 = saddr->u.inet->has_ipv4 = has_ipv4;
3579 saddr->u.inet->ipv6 = saddr->u.inet->has_ipv6 = has_ipv6;
3580
3581 if (vs->ws_enabled) {
3582 wsaddr->type = SOCKET_ADDRESS_KIND_INET;
3583 wsaddr->u.inet = g_new0(InetSocketAddress, 1);
3584 wsaddr->u.inet->host = g_strdup(saddr->u.inet->host);
3585 wsaddr->u.inet->port = g_strdup(websocket);
3586
3587 if (to) {
3588 wsaddr->u.inet->has_to = true;
3589 wsaddr->u.inet->to = to;
3590 }
3591 wsaddr->u.inet->ipv4 = wsaddr->u.inet->has_ipv4 = has_ipv4;
3592 wsaddr->u.inet->ipv6 = wsaddr->u.inet->has_ipv6 = has_ipv6;
3593 }
3594 }
3595 } else {
3596 error_setg(errp, "no vnc port specified");
3597 goto fail;
3598 }
3599
3600 password = qemu_opt_get_bool(opts, "password", false);
3601 if (password) {
3602 if (fips_get_state()) {
3603 error_setg(errp,
3604 "VNC password auth disabled due to FIPS mode, "
3605 "consider using the VeNCrypt or SASL authentication "
3606 "methods as an alternative");
3607 goto fail;
3608 }
3609 if (!qcrypto_cipher_supports(
3610 QCRYPTO_CIPHER_ALG_DES_RFB)) {
3611 error_setg(errp,
3612 "Cipher backend does not support DES RFB algorithm");
3613 goto fail;
3614 }
3615 }
3616
3617 reverse = qemu_opt_get_bool(opts, "reverse", false);
3618 lock_key_sync = qemu_opt_get_bool(opts, "lock-key-sync", true);
3619 sasl = qemu_opt_get_bool(opts, "sasl", false);
3620 #ifndef CONFIG_VNC_SASL
3621 if (sasl) {
3622 error_setg(errp, "VNC SASL auth requires cyrus-sasl support");
3623 goto fail;
3624 }
3625 #endif /* CONFIG_VNC_SASL */
3626 credid = qemu_opt_get(opts, "tls-creds");
3627 if (credid) {
3628 Object *creds;
3629 if (qemu_opt_get(opts, "tls") ||
3630 qemu_opt_get(opts, "x509") ||
3631 qemu_opt_get(opts, "x509verify")) {
3632 error_setg(errp,
3633 "'credid' parameter is mutually exclusive with "
3634 "'tls', 'x509' and 'x509verify' parameters");
3635 goto fail;
3636 }
3637
3638 creds = object_resolve_path_component(
3639 object_get_objects_root(), credid);
3640 if (!creds) {
3641 error_setg(errp, "No TLS credentials with id '%s'",
3642 credid);
3643 goto fail;
3644 }
3645 vs->tlscreds = (QCryptoTLSCreds *)
3646 object_dynamic_cast(creds,
3647 TYPE_QCRYPTO_TLS_CREDS);
3648 if (!vs->tlscreds) {
3649 error_setg(errp, "Object with id '%s' is not TLS credentials",
3650 credid);
3651 goto fail;
3652 }
3653 object_ref(OBJECT(vs->tlscreds));
3654
3655 if (vs->tlscreds->endpoint != QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
3656 error_setg(errp,
3657 "Expecting TLS credentials with a server endpoint");
3658 goto fail;
3659 }
3660 } else {
3661 const char *path;
3662 bool tls = false, x509 = false, x509verify = false;
3663 tls = qemu_opt_get_bool(opts, "tls", false);
3664 if (tls) {
3665 path = qemu_opt_get(opts, "x509");
3666
3667 if (path) {
3668 x509 = true;
3669 } else {
3670 path = qemu_opt_get(opts, "x509verify");
3671 if (path) {
3672 x509 = true;
3673 x509verify = true;
3674 }
3675 }
3676 vs->tlscreds = vnc_display_create_creds(x509,
3677 x509verify,
3678 path,
3679 vs->id,
3680 errp);
3681 if (!vs->tlscreds) {
3682 goto fail;
3683 }
3684 }
3685 }
3686 acl = qemu_opt_get_bool(opts, "acl", false);
3687
3688 share = qemu_opt_get(opts, "share");
3689 if (share) {
3690 if (strcmp(share, "ignore") == 0) {
3691 vs->share_policy = VNC_SHARE_POLICY_IGNORE;
3692 } else if (strcmp(share, "allow-exclusive") == 0) {
3693 vs->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
3694 } else if (strcmp(share, "force-shared") == 0) {
3695 vs->share_policy = VNC_SHARE_POLICY_FORCE_SHARED;
3696 } else {
3697 error_setg(errp, "unknown vnc share= option");
3698 goto fail;
3699 }
3700 } else {
3701 vs->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
3702 }
3703 vs->connections_limit = qemu_opt_get_number(opts, "connections", 32);
3704
3705 #ifdef CONFIG_VNC_JPEG
3706 vs->lossy = qemu_opt_get_bool(opts, "lossy", false);
3707 #endif
3708 vs->non_adaptive = qemu_opt_get_bool(opts, "non-adaptive", false);
3709 /* adaptive updates are only used with tight encoding and
3710 * if lossy updates are enabled so we can disable all the
3711 * calculations otherwise */
3712 if (!vs->lossy) {
3713 vs->non_adaptive = true;
3714 }
3715
3716 if (acl) {
3717 if (strcmp(vs->id, "default") == 0) {
3718 vs->tlsaclname = g_strdup("vnc.x509dname");
3719 } else {
3720 vs->tlsaclname = g_strdup_printf("vnc.%s.x509dname", vs->id);
3721 }
3722 qemu_acl_init(vs->tlsaclname);
3723 }
3724 #ifdef CONFIG_VNC_SASL
3725 if (acl && sasl) {
3726 char *aclname;
3727
3728 if (strcmp(vs->id, "default") == 0) {
3729 aclname = g_strdup("vnc.username");
3730 } else {
3731 aclname = g_strdup_printf("vnc.%s.username", vs->id);
3732 }
3733 vs->sasl.acl = qemu_acl_init(aclname);
3734 g_free(aclname);
3735 }
3736 #endif
3737
3738 if (vnc_display_setup_auth(vs, password, sasl, vs->ws_enabled, errp) < 0) {
3739 goto fail;
3740 }
3741
3742 #ifdef CONFIG_VNC_SASL
3743 if ((saslErr = sasl_server_init(NULL, "qemu")) != SASL_OK) {
3744 error_setg(errp, "Failed to initialize SASL auth: %s",
3745 sasl_errstring(saslErr, NULL, NULL));
3746 goto fail;
3747 }
3748 #endif
3749 vs->lock_key_sync = lock_key_sync;
3750
3751 device_id = qemu_opt_get(opts, "display");
3752 if (device_id) {
3753 DeviceState *dev;
3754 int head = qemu_opt_get_number(opts, "head", 0);
3755
3756 dev = qdev_find_recursive(sysbus_get_default(), device_id);
3757 if (dev == NULL) {
3758 error_setg(errp, "Device '%s' not found", device_id);
3759 goto fail;
3760 }
3761
3762 con = qemu_console_lookup_by_device(dev, head);
3763 if (con == NULL) {
3764 error_setg(errp, "Device %s is not bound to a QemuConsole",
3765 device_id);
3766 goto fail;
3767 }
3768 } else {
3769 con = NULL;
3770 }
3771
3772 if (con != vs->dcl.con) {
3773 unregister_displaychangelistener(&vs->dcl);
3774 vs->dcl.con = con;
3775 register_displaychangelistener(&vs->dcl);
3776 }
3777
3778 if (reverse) {
3779 /* connect to viewer */
3780 int csock;
3781 vs->lsock = -1;
3782 vs->lwebsock = -1;
3783 if (vs->ws_enabled) {
3784 error_setg(errp, "Cannot use websockets in reverse mode");
3785 goto fail;
3786 }
3787 csock = socket_connect(saddr, errp, NULL, NULL);
3788 if (csock < 0) {
3789 goto fail;
3790 }
3791 vs->is_unix = saddr->type == SOCKET_ADDRESS_KIND_UNIX;
3792 vnc_connect(vs, csock, false, false);
3793 } else {
3794 /* listen for connects */
3795 vs->lsock = socket_listen(saddr, errp);
3796 if (vs->lsock < 0) {
3797 goto fail;
3798 }
3799 vs->is_unix = saddr->type == SOCKET_ADDRESS_KIND_UNIX;
3800 if (vs->ws_enabled) {
3801 vs->lwebsock = socket_listen(wsaddr, errp);
3802 if (vs->lwebsock < 0) {
3803 if (vs->lsock != -1) {
3804 close(vs->lsock);
3805 vs->lsock = -1;
3806 }
3807 goto fail;
3808 }
3809 }
3810 vs->enabled = true;
3811 qemu_set_fd_handler(vs->lsock, vnc_listen_regular_read, NULL, vs);
3812 if (vs->ws_enabled) {
3813 qemu_set_fd_handler(vs->lwebsock, vnc_listen_websocket_read,
3814 NULL, vs);
3815 }
3816 }
3817
3818 qapi_free_SocketAddress(saddr);
3819 qapi_free_SocketAddress(wsaddr);
3820 return;
3821
3822 fail:
3823 qapi_free_SocketAddress(saddr);
3824 qapi_free_SocketAddress(wsaddr);
3825 vs->enabled = false;
3826 vs->ws_enabled = false;
3827 }
3828
3829 void vnc_display_add_client(const char *id, int csock, bool skipauth)
3830 {
3831 VncDisplay *vs = vnc_display_find(id);
3832
3833 if (!vs) {
3834 return;
3835 }
3836 vnc_connect(vs, csock, skipauth, false);
3837 }
3838
3839 static void vnc_auto_assign_id(QemuOptsList *olist, QemuOpts *opts)
3840 {
3841 int i = 2;
3842 char *id;
3843
3844 id = g_strdup("default");
3845 while (qemu_opts_find(olist, id)) {
3846 g_free(id);
3847 id = g_strdup_printf("vnc%d", i++);
3848 }
3849 qemu_opts_set_id(opts, id);
3850 }
3851
3852 QemuOpts *vnc_parse(const char *str, Error **errp)
3853 {
3854 QemuOptsList *olist = qemu_find_opts("vnc");
3855 QemuOpts *opts = qemu_opts_parse(olist, str, true, errp);
3856 const char *id;
3857
3858 if (!opts) {
3859 return NULL;
3860 }
3861
3862 id = qemu_opts_id(opts);
3863 if (!id) {
3864 /* auto-assign id if not present */
3865 vnc_auto_assign_id(olist, opts);
3866 }
3867 return opts;
3868 }
3869
3870 int vnc_init_func(void *opaque, QemuOpts *opts, Error **errp)
3871 {
3872 Error *local_err = NULL;
3873 char *id = (char *)qemu_opts_id(opts);
3874
3875 assert(id);
3876 vnc_display_init(id);
3877 vnc_display_open(id, &local_err);
3878 if (local_err != NULL) {
3879 error_report("Failed to start VNC server: %s",
3880 error_get_pretty(local_err));
3881 error_free(local_err);
3882 exit(1);
3883 }
3884 return 0;
3885 }
3886
3887 static void vnc_register_config(void)
3888 {
3889 qemu_add_opts(&qemu_vnc_opts);
3890 }
3891 machine_init(vnc_register_config);
QEmu