?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
ui: avoid risk of 32-bit int overflow in VNC buffer check
[qemu.git] / ui / vnc.c
blob746293ddfaf0fa91ae0249f241acedd953b274c5
1 /*
2 * QEMU VNC display driver
3 *
4 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5 * Copyright (C) 2006 Fabrice Bellard
6 * Copyright (C) 2009 Red Hat, Inc
7 *
8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to deal
10 * in the Software without restriction, including without limitation the rights
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12 * copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
14 *
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
17 *
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24 * THE SOFTWARE.
25 */
26
27 #include "qemu/osdep.h"
28 #include "vnc.h"
29 #include "vnc-jobs.h"
30 #include "trace.h"
31 #include "sysemu/sysemu.h"
32 #include "qemu/error-report.h"
33 #include "qemu/option.h"
34 #include "qemu/sockets.h"
35 #include "qemu/timer.h"
36 #include "qemu/acl.h"
37 #include "qemu/config-file.h"
38 #include "qapi/error.h"
39 #include "qmp-commands.h"
40 #include "ui/input.h"
41 #include "qapi-event.h"
42 #include "crypto/hash.h"
43 #include "crypto/tlscredsanon.h"
44 #include "crypto/tlscredsx509.h"
45 #include "qom/object_interfaces.h"
46 #include "qemu/cutils.h"
47 #include "io/dns-resolver.h"
48
49 #define VNC_REFRESH_INTERVAL_BASE GUI_REFRESH_INTERVAL_DEFAULT
50 #define VNC_REFRESH_INTERVAL_INC 50
51 #define VNC_REFRESH_INTERVAL_MAX GUI_REFRESH_INTERVAL_IDLE
52 static const struct timeval VNC_REFRESH_STATS = { 0, 500000 };
53 static const struct timeval VNC_REFRESH_LOSSY = { 2, 0 };
54
55 #include "vnc_keysym.h"
56 #include "crypto/cipher.h"
57
58 static QTAILQ_HEAD(, VncDisplay) vnc_displays =
59 QTAILQ_HEAD_INITIALIZER(vnc_displays);
60
61 static int vnc_cursor_define(VncState *vs);
62 static void vnc_release_modifiers(VncState *vs);
63 static void vnc_update_throttle_offset(VncState *vs);
64
65 static void vnc_set_share_mode(VncState *vs, VncShareMode mode)
66 {
67 #ifdef _VNC_DEBUG
68 static const char *mn[] = {
69 [0] = "undefined",
70 [VNC_SHARE_MODE_CONNECTING] = "connecting",
71 [VNC_SHARE_MODE_SHARED] = "shared",
72 [VNC_SHARE_MODE_EXCLUSIVE] = "exclusive",
73 [VNC_SHARE_MODE_DISCONNECTED] = "disconnected",
74 };
75 fprintf(stderr, "%s/%p: %s -> %s\n", __func__,
76 vs->ioc, mn[vs->share_mode], mn[mode]);
77 #endif
78
79 switch (vs->share_mode) {
80 case VNC_SHARE_MODE_CONNECTING:
81 vs->vd->num_connecting--;
82 break;
83 case VNC_SHARE_MODE_SHARED:
84 vs->vd->num_shared--;
85 break;
86 case VNC_SHARE_MODE_EXCLUSIVE:
87 vs->vd->num_exclusive--;
88 break;
89 default:
90 break;
91 }
92
93 vs->share_mode = mode;
94
95 switch (vs->share_mode) {
96 case VNC_SHARE_MODE_CONNECTING:
97 vs->vd->num_connecting++;
98 break;
99 case VNC_SHARE_MODE_SHARED:
100 vs->vd->num_shared++;
101 break;
102 case VNC_SHARE_MODE_EXCLUSIVE:
103 vs->vd->num_exclusive++;
104 break;
105 default:
106 break;
107 }
108 }
109
110
111 static void vnc_init_basic_info(SocketAddress *addr,
112 VncBasicInfo *info,
113 Error **errp)
114 {
115 switch (addr->type) {
116 case SOCKET_ADDRESS_TYPE_INET:
117 info->host = g_strdup(addr->u.inet.host);
118 info->service = g_strdup(addr->u.inet.port);
119 if (addr->u.inet.ipv6) {
120 info->family = NETWORK_ADDRESS_FAMILY_IPV6;
121 } else {
122 info->family = NETWORK_ADDRESS_FAMILY_IPV4;
123 }
124 break;
125
126 case SOCKET_ADDRESS_TYPE_UNIX:
127 info->host = g_strdup("");
128 info->service = g_strdup(addr->u.q_unix.path);
129 info->family = NETWORK_ADDRESS_FAMILY_UNIX;
130 break;
131
132 case SOCKET_ADDRESS_TYPE_VSOCK:
133 case SOCKET_ADDRESS_TYPE_FD:
134 error_setg(errp, "Unsupported socket address type %s",
135 SocketAddressType_str(addr->type));
136 break;
137 default:
138 abort();
139 }
140
141 return;
142 }
143
144 static void vnc_init_basic_info_from_server_addr(QIOChannelSocket *ioc,
145 VncBasicInfo *info,
146 Error **errp)
147 {
148 SocketAddress *addr = NULL;
149
150 if (!ioc) {
151 error_setg(errp, "No listener socket available");
152 return;
153 }
154
155 addr = qio_channel_socket_get_local_address(ioc, errp);
156 if (!addr) {
157 return;
158 }
159
160 vnc_init_basic_info(addr, info, errp);
161 qapi_free_SocketAddress(addr);
162 }
163
164 static void vnc_init_basic_info_from_remote_addr(QIOChannelSocket *ioc,
165 VncBasicInfo *info,
166 Error **errp)
167 {
168 SocketAddress *addr = NULL;
169
170 addr = qio_channel_socket_get_remote_address(ioc, errp);
171 if (!addr) {
172 return;
173 }
174
175 vnc_init_basic_info(addr, info, errp);
176 qapi_free_SocketAddress(addr);
177 }
178
179 static const char *vnc_auth_name(VncDisplay *vd) {
180 switch (vd->auth) {
181 case VNC_AUTH_INVALID:
182 return "invalid";
183 case VNC_AUTH_NONE:
184 return "none";
185 case VNC_AUTH_VNC:
186 return "vnc";
187 case VNC_AUTH_RA2:
188 return "ra2";
189 case VNC_AUTH_RA2NE:
190 return "ra2ne";
191 case VNC_AUTH_TIGHT:
192 return "tight";
193 case VNC_AUTH_ULTRA:
194 return "ultra";
195 case VNC_AUTH_TLS:
196 return "tls";
197 case VNC_AUTH_VENCRYPT:
198 switch (vd->subauth) {
199 case VNC_AUTH_VENCRYPT_PLAIN:
200 return "vencrypt+plain";
201 case VNC_AUTH_VENCRYPT_TLSNONE:
202 return "vencrypt+tls+none";
203 case VNC_AUTH_VENCRYPT_TLSVNC:
204 return "vencrypt+tls+vnc";
205 case VNC_AUTH_VENCRYPT_TLSPLAIN:
206 return "vencrypt+tls+plain";
207 case VNC_AUTH_VENCRYPT_X509NONE:
208 return "vencrypt+x509+none";
209 case VNC_AUTH_VENCRYPT_X509VNC:
210 return "vencrypt+x509+vnc";
211 case VNC_AUTH_VENCRYPT_X509PLAIN:
212 return "vencrypt+x509+plain";
213 case VNC_AUTH_VENCRYPT_TLSSASL:
214 return "vencrypt+tls+sasl";
215 case VNC_AUTH_VENCRYPT_X509SASL:
216 return "vencrypt+x509+sasl";
217 default:
218 return "vencrypt";
219 }
220 case VNC_AUTH_SASL:
221 return "sasl";
222 }
223 return "unknown";
224 }
225
226 static VncServerInfo *vnc_server_info_get(VncDisplay *vd)
227 {
228 VncServerInfo *info;
229 Error *err = NULL;
230
231 if (!vd->listener || !vd->listener->nsioc) {
232 return NULL;
233 }
234
235 info = g_malloc0(sizeof(*info));
236 vnc_init_basic_info_from_server_addr(vd->listener->sioc[0],
237 qapi_VncServerInfo_base(info), &err);
238 info->has_auth = true;
239 info->auth = g_strdup(vnc_auth_name(vd));
240 if (err) {
241 qapi_free_VncServerInfo(info);
242 info = NULL;
243 error_free(err);
244 }
245 return info;
246 }
247
248 static void vnc_client_cache_auth(VncState *client)
249 {
250 if (!client->info) {
251 return;
252 }
253
254 if (client->tls) {
255 client->info->x509_dname =
256 qcrypto_tls_session_get_peer_name(client->tls);
257 client->info->has_x509_dname =
258 client->info->x509_dname != NULL;
259 }
260 #ifdef CONFIG_VNC_SASL
261 if (client->sasl.conn &&
262 client->sasl.username) {
263 client->info->has_sasl_username = true;
264 client->info->sasl_username = g_strdup(client->sasl.username);
265 }
266 #endif
267 }
268
269 static void vnc_client_cache_addr(VncState *client)
270 {
271 Error *err = NULL;
272
273 client->info = g_malloc0(sizeof(*client->info));
274 vnc_init_basic_info_from_remote_addr(client->sioc,
275 qapi_VncClientInfo_base(client->info),
276 &err);
277 if (err) {
278 qapi_free_VncClientInfo(client->info);
279 client->info = NULL;
280 error_free(err);
281 }
282 }
283
284 static void vnc_qmp_event(VncState *vs, QAPIEvent event)
285 {
286 VncServerInfo *si;
287
288 if (!vs->info) {
289 return;
290 }
291
292 si = vnc_server_info_get(vs->vd);
293 if (!si) {
294 return;
295 }
296
297 switch (event) {
298 case QAPI_EVENT_VNC_CONNECTED:
299 qapi_event_send_vnc_connected(si, qapi_VncClientInfo_base(vs->info),
300 &error_abort);
301 break;
302 case QAPI_EVENT_VNC_INITIALIZED:
303 qapi_event_send_vnc_initialized(si, vs->info, &error_abort);
304 break;
305 case QAPI_EVENT_VNC_DISCONNECTED:
306 qapi_event_send_vnc_disconnected(si, vs->info, &error_abort);
307 break;
308 default:
309 break;
310 }
311
312 qapi_free_VncServerInfo(si);
313 }
314
315 static VncClientInfo *qmp_query_vnc_client(const VncState *client)
316 {
317 VncClientInfo *info;
318 Error *err = NULL;
319
320 info = g_malloc0(sizeof(*info));
321
322 vnc_init_basic_info_from_remote_addr(client->sioc,
323 qapi_VncClientInfo_base(info),
324 &err);
325 if (err) {
326 error_free(err);
327 qapi_free_VncClientInfo(info);
328 return NULL;
329 }
330
331 info->websocket = client->websocket;
332
333 if (client->tls) {
334 info->x509_dname = qcrypto_tls_session_get_peer_name(client->tls);
335 info->has_x509_dname = info->x509_dname != NULL;
336 }
337 #ifdef CONFIG_VNC_SASL
338 if (client->sasl.conn && client->sasl.username) {
339 info->has_sasl_username = true;
340 info->sasl_username = g_strdup(client->sasl.username);
341 }
342 #endif
343
344 return info;
345 }
346
347 static VncDisplay *vnc_display_find(const char *id)
348 {
349 VncDisplay *vd;
350
351 if (id == NULL) {
352 return QTAILQ_FIRST(&vnc_displays);
353 }
354 QTAILQ_FOREACH(vd, &vnc_displays, next) {
355 if (strcmp(id, vd->id) == 0) {
356 return vd;
357 }
358 }
359 return NULL;
360 }
361
362 static VncClientInfoList *qmp_query_client_list(VncDisplay *vd)
363 {
364 VncClientInfoList *cinfo, *prev = NULL;
365 VncState *client;
366
367 QTAILQ_FOREACH(client, &vd->clients, next) {
368 cinfo = g_new0(VncClientInfoList, 1);
369 cinfo->value = qmp_query_vnc_client(client);
370 cinfo->next = prev;
371 prev = cinfo;
372 }
373 return prev;
374 }
375
376 VncInfo *qmp_query_vnc(Error **errp)
377 {
378 VncInfo *info = g_malloc0(sizeof(*info));
379 VncDisplay *vd = vnc_display_find(NULL);
380 SocketAddress *addr = NULL;
381
382 if (vd == NULL || !vd->listener || !vd->listener->nsioc) {
383 info->enabled = false;
384 } else {
385 info->enabled = true;
386
387 /* for compatibility with the original command */
388 info->has_clients = true;
389 info->clients = qmp_query_client_list(vd);
390
391 addr = qio_channel_socket_get_local_address(vd->listener->sioc[0],
392 errp);
393 if (!addr) {
394 goto out_error;
395 }
396
397 switch (addr->type) {
398 case SOCKET_ADDRESS_TYPE_INET:
399 info->host = g_strdup(addr->u.inet.host);
400 info->service = g_strdup(addr->u.inet.port);
401 if (addr->u.inet.ipv6) {
402 info->family = NETWORK_ADDRESS_FAMILY_IPV6;
403 } else {
404 info->family = NETWORK_ADDRESS_FAMILY_IPV4;
405 }
406 break;
407
408 case SOCKET_ADDRESS_TYPE_UNIX:
409 info->host = g_strdup("");
410 info->service = g_strdup(addr->u.q_unix.path);
411 info->family = NETWORK_ADDRESS_FAMILY_UNIX;
412 break;
413
414 case SOCKET_ADDRESS_TYPE_VSOCK:
415 case SOCKET_ADDRESS_TYPE_FD:
416 error_setg(errp, "Unsupported socket address type %s",
417 SocketAddressType_str(addr->type));
418 goto out_error;
419 default:
420 abort();
421 }
422
423 info->has_host = true;
424 info->has_service = true;
425 info->has_family = true;
426
427 info->has_auth = true;
428 info->auth = g_strdup(vnc_auth_name(vd));
429 }
430
431 qapi_free_SocketAddress(addr);
432 return info;
433
434 out_error:
435 qapi_free_SocketAddress(addr);
436 qapi_free_VncInfo(info);
437 return NULL;
438 }
439
440
441 static void qmp_query_auth(int auth, int subauth,
442 VncPrimaryAuth *qmp_auth,
443 VncVencryptSubAuth *qmp_vencrypt,
444 bool *qmp_has_vencrypt);
445
446 static VncServerInfo2List *qmp_query_server_entry(QIOChannelSocket *ioc,
447 bool websocket,
448 int auth,
449 int subauth,
450 VncServerInfo2List *prev)
451 {
452 VncServerInfo2List *list;
453 VncServerInfo2 *info;
454 Error *err = NULL;
455 SocketAddress *addr;
456
457 addr = qio_channel_socket_get_local_address(ioc, &err);
458 if (!addr) {
459 error_free(err);
460 return prev;
461 }
462
463 info = g_new0(VncServerInfo2, 1);
464 vnc_init_basic_info(addr, qapi_VncServerInfo2_base(info), &err);
465 qapi_free_SocketAddress(addr);
466 if (err) {
467 qapi_free_VncServerInfo2(info);
468 error_free(err);
469 return prev;
470 }
471 info->websocket = websocket;
472
473 qmp_query_auth(auth, subauth, &info->auth,
474 &info->vencrypt, &info->has_vencrypt);
475
476 list = g_new0(VncServerInfo2List, 1);
477 list->value = info;
478 list->next = prev;
479 return list;
480 }
481
482 static void qmp_query_auth(int auth, int subauth,
483 VncPrimaryAuth *qmp_auth,
484 VncVencryptSubAuth *qmp_vencrypt,
485 bool *qmp_has_vencrypt)
486 {
487 switch (auth) {
488 case VNC_AUTH_VNC:
489 *qmp_auth = VNC_PRIMARY_AUTH_VNC;
490 break;
491 case VNC_AUTH_RA2:
492 *qmp_auth = VNC_PRIMARY_AUTH_RA2;
493 break;
494 case VNC_AUTH_RA2NE:
495 *qmp_auth = VNC_PRIMARY_AUTH_RA2NE;
496 break;
497 case VNC_AUTH_TIGHT:
498 *qmp_auth = VNC_PRIMARY_AUTH_TIGHT;
499 break;
500 case VNC_AUTH_ULTRA:
501 *qmp_auth = VNC_PRIMARY_AUTH_ULTRA;
502 break;
503 case VNC_AUTH_TLS:
504 *qmp_auth = VNC_PRIMARY_AUTH_TLS;
505 break;
506 case VNC_AUTH_VENCRYPT:
507 *qmp_auth = VNC_PRIMARY_AUTH_VENCRYPT;
508 *qmp_has_vencrypt = true;
509 switch (subauth) {
510 case VNC_AUTH_VENCRYPT_PLAIN:
511 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_PLAIN;
512 break;
513 case VNC_AUTH_VENCRYPT_TLSNONE:
514 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_NONE;
515 break;
516 case VNC_AUTH_VENCRYPT_TLSVNC:
517 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_VNC;
518 break;
519 case VNC_AUTH_VENCRYPT_TLSPLAIN:
520 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_PLAIN;
521 break;
522 case VNC_AUTH_VENCRYPT_X509NONE:
523 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_NONE;
524 break;
525 case VNC_AUTH_VENCRYPT_X509VNC:
526 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_VNC;
527 break;
528 case VNC_AUTH_VENCRYPT_X509PLAIN:
529 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_PLAIN;
530 break;
531 case VNC_AUTH_VENCRYPT_TLSSASL:
532 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_SASL;
533 break;
534 case VNC_AUTH_VENCRYPT_X509SASL:
535 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_SASL;
536 break;
537 default:
538 *qmp_has_vencrypt = false;
539 break;
540 }
541 break;
542 case VNC_AUTH_SASL:
543 *qmp_auth = VNC_PRIMARY_AUTH_SASL;
544 break;
545 case VNC_AUTH_NONE:
546 default:
547 *qmp_auth = VNC_PRIMARY_AUTH_NONE;
548 break;
549 }
550 }
551
552 VncInfo2List *qmp_query_vnc_servers(Error **errp)
553 {
554 VncInfo2List *item, *prev = NULL;
555 VncInfo2 *info;
556 VncDisplay *vd;
557 DeviceState *dev;
558 size_t i;
559
560 QTAILQ_FOREACH(vd, &vnc_displays, next) {
561 info = g_new0(VncInfo2, 1);
562 info->id = g_strdup(vd->id);
563 info->clients = qmp_query_client_list(vd);
564 qmp_query_auth(vd->auth, vd->subauth, &info->auth,
565 &info->vencrypt, &info->has_vencrypt);
566 if (vd->dcl.con) {
567 dev = DEVICE(object_property_get_link(OBJECT(vd->dcl.con),
568 "device", NULL));
569 info->has_display = true;
570 info->display = g_strdup(dev->id);
571 }
572 for (i = 0; vd->listener != NULL && i < vd->listener->nsioc; i++) {
573 info->server = qmp_query_server_entry(
574 vd->listener->sioc[i], false, vd->auth, vd->subauth,
575 info->server);
576 }
577 for (i = 0; vd->wslistener != NULL && i < vd->wslistener->nsioc; i++) {
578 info->server = qmp_query_server_entry(
579 vd->wslistener->sioc[i], true, vd->ws_auth,
580 vd->ws_subauth, info->server);
581 }
582
583 item = g_new0(VncInfo2List, 1);
584 item->value = info;
585 item->next = prev;
586 prev = item;
587 }
588 return prev;
589 }
590
591 /* TODO
592 1) Get the queue working for IO.
593 2) there is some weirdness when using the -S option (the screen is grey
594 and not totally invalidated
595 3) resolutions > 1024
596 */
597
598 static int vnc_update_client(VncState *vs, int has_dirty);
599 static void vnc_disconnect_start(VncState *vs);
600
601 static void vnc_colordepth(VncState *vs);
602 static void framebuffer_update_request(VncState *vs, int incremental,
603 int x_position, int y_position,
604 int w, int h);
605 static void vnc_refresh(DisplayChangeListener *dcl);
606 static int vnc_refresh_server_surface(VncDisplay *vd);
607
608 static int vnc_width(VncDisplay *vd)
609 {
610 return MIN(VNC_MAX_WIDTH, ROUND_UP(surface_width(vd->ds),
611 VNC_DIRTY_PIXELS_PER_BIT));
612 }
613
614 static int vnc_height(VncDisplay *vd)
615 {
616 return MIN(VNC_MAX_HEIGHT, surface_height(vd->ds));
617 }
618
619 static void vnc_set_area_dirty(DECLARE_BITMAP(dirty[VNC_MAX_HEIGHT],
620 VNC_MAX_WIDTH / VNC_DIRTY_PIXELS_PER_BIT),
621 VncDisplay *vd,
622 int x, int y, int w, int h)
623 {
624 int width = vnc_width(vd);
625 int height = vnc_height(vd);
626
627 /* this is needed this to ensure we updated all affected
628 * blocks if x % VNC_DIRTY_PIXELS_PER_BIT != 0 */
629 w += (x % VNC_DIRTY_PIXELS_PER_BIT);
630 x -= (x % VNC_DIRTY_PIXELS_PER_BIT);
631
632 x = MIN(x, width);
633 y = MIN(y, height);
634 w = MIN(x + w, width) - x;
635 h = MIN(y + h, height);
636
637 for (; y < h; y++) {
638 bitmap_set(dirty[y], x / VNC_DIRTY_PIXELS_PER_BIT,
639 DIV_ROUND_UP(w, VNC_DIRTY_PIXELS_PER_BIT));
640 }
641 }
642
643 static void vnc_dpy_update(DisplayChangeListener *dcl,
644 int x, int y, int w, int h)
645 {
646 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
647 struct VncSurface *s = &vd->guest;
648
649 vnc_set_area_dirty(s->dirty, vd, x, y, w, h);
650 }
651
652 void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
653 int32_t encoding)
654 {
655 vnc_write_u16(vs, x);
656 vnc_write_u16(vs, y);
657 vnc_write_u16(vs, w);
658 vnc_write_u16(vs, h);
659
660 vnc_write_s32(vs, encoding);
661 }
662
663
664 static void vnc_desktop_resize(VncState *vs)
665 {
666 if (vs->ioc == NULL || !vnc_has_feature(vs, VNC_FEATURE_RESIZE)) {
667 return;
668 }
669 if (vs->client_width == pixman_image_get_width(vs->vd->server) &&
670 vs->client_height == pixman_image_get_height(vs->vd->server)) {
671 return;
672 }
673
674 assert(pixman_image_get_width(vs->vd->server) < 65536 &&
675 pixman_image_get_width(vs->vd->server) >= 0);
676 assert(pixman_image_get_height(vs->vd->server) < 65536 &&
677 pixman_image_get_height(vs->vd->server) >= 0);
678 vs->client_width = pixman_image_get_width(vs->vd->server);
679 vs->client_height = pixman_image_get_height(vs->vd->server);
680 vnc_lock_output(vs);
681 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
682 vnc_write_u8(vs, 0);
683 vnc_write_u16(vs, 1); /* number of rects */
684 vnc_framebuffer_update(vs, 0, 0, vs->client_width, vs->client_height,
685 VNC_ENCODING_DESKTOPRESIZE);
686 vnc_unlock_output(vs);
687 vnc_flush(vs);
688 }
689
690 static void vnc_abort_display_jobs(VncDisplay *vd)
691 {
692 VncState *vs;
693
694 QTAILQ_FOREACH(vs, &vd->clients, next) {
695 vnc_lock_output(vs);
696 vs->abort = true;
697 vnc_unlock_output(vs);
698 }
699 QTAILQ_FOREACH(vs, &vd->clients, next) {
700 vnc_jobs_join(vs);
701 }
702 QTAILQ_FOREACH(vs, &vd->clients, next) {
703 vnc_lock_output(vs);
704 vs->abort = false;
705 vnc_unlock_output(vs);
706 }
707 }
708
709 int vnc_server_fb_stride(VncDisplay *vd)
710 {
711 return pixman_image_get_stride(vd->server);
712 }
713
714 void *vnc_server_fb_ptr(VncDisplay *vd, int x, int y)
715 {
716 uint8_t *ptr;
717
718 ptr = (uint8_t *)pixman_image_get_data(vd->server);
719 ptr += y * vnc_server_fb_stride(vd);
720 ptr += x * VNC_SERVER_FB_BYTES;
721 return ptr;
722 }
723
724 static void vnc_update_server_surface(VncDisplay *vd)
725 {
726 int width, height;
727
728 qemu_pixman_image_unref(vd->server);
729 vd->server = NULL;
730
731 if (QTAILQ_EMPTY(&vd->clients)) {
732 return;
733 }
734
735 width = vnc_width(vd);
736 height = vnc_height(vd);
737 vd->server = pixman_image_create_bits(VNC_SERVER_FB_FORMAT,
738 width, height,
739 NULL, 0);
740
741 memset(vd->guest.dirty, 0x00, sizeof(vd->guest.dirty));
742 vnc_set_area_dirty(vd->guest.dirty, vd, 0, 0,
743 width, height);
744 }
745
746 static void vnc_dpy_switch(DisplayChangeListener *dcl,
747 DisplaySurface *surface)
748 {
749 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
750 VncState *vs;
751
752 vnc_abort_display_jobs(vd);
753 vd->ds = surface;
754
755 /* server surface */
756 vnc_update_server_surface(vd);
757
758 /* guest surface */
759 qemu_pixman_image_unref(vd->guest.fb);
760 vd->guest.fb = pixman_image_ref(surface->image);
761 vd->guest.format = surface->format;
762
763 QTAILQ_FOREACH(vs, &vd->clients, next) {
764 vnc_colordepth(vs);
765 vnc_desktop_resize(vs);
766 if (vs->vd->cursor) {
767 vnc_cursor_define(vs);
768 }
769 memset(vs->dirty, 0x00, sizeof(vs->dirty));
770 vnc_set_area_dirty(vs->dirty, vd, 0, 0,
771 vnc_width(vd),
772 vnc_height(vd));
773 vnc_update_throttle_offset(vs);
774 }
775 }
776
777 /* fastest code */
778 static void vnc_write_pixels_copy(VncState *vs,
779 void *pixels, int size)
780 {
781 vnc_write(vs, pixels, size);
782 }
783
784 /* slowest but generic code. */
785 void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
786 {
787 uint8_t r, g, b;
788
789 #if VNC_SERVER_FB_FORMAT == PIXMAN_FORMAT(32, PIXMAN_TYPE_ARGB, 0, 8, 8, 8)
790 r = (((v & 0x00ff0000) >> 16) << vs->client_pf.rbits) >> 8;
791 g = (((v & 0x0000ff00) >> 8) << vs->client_pf.gbits) >> 8;
792 b = (((v & 0x000000ff) >> 0) << vs->client_pf.bbits) >> 8;
793 #else
794 # error need some bits here if you change VNC_SERVER_FB_FORMAT
795 #endif
796 v = (r << vs->client_pf.rshift) |
797 (g << vs->client_pf.gshift) |
798 (b << vs->client_pf.bshift);
799 switch (vs->client_pf.bytes_per_pixel) {
800 case 1:
801 buf[0] = v;
802 break;
803 case 2:
804 if (vs->client_be) {
805 buf[0] = v >> 8;
806 buf[1] = v;
807 } else {
808 buf[1] = v >> 8;
809 buf[0] = v;
810 }
811 break;
812 default:
813 case 4:
814 if (vs->client_be) {
815 buf[0] = v >> 24;
816 buf[1] = v >> 16;
817 buf[2] = v >> 8;
818 buf[3] = v;
819 } else {
820 buf[3] = v >> 24;
821 buf[2] = v >> 16;
822 buf[1] = v >> 8;
823 buf[0] = v;
824 }
825 break;
826 }
827 }
828
829 static void vnc_write_pixels_generic(VncState *vs,
830 void *pixels1, int size)
831 {
832 uint8_t buf[4];
833
834 if (VNC_SERVER_FB_BYTES == 4) {
835 uint32_t *pixels = pixels1;
836 int n, i;
837 n = size >> 2;
838 for (i = 0; i < n; i++) {
839 vnc_convert_pixel(vs, buf, pixels[i]);
840 vnc_write(vs, buf, vs->client_pf.bytes_per_pixel);
841 }
842 }
843 }
844
845 int vnc_raw_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
846 {
847 int i;
848 uint8_t *row;
849 VncDisplay *vd = vs->vd;
850
851 row = vnc_server_fb_ptr(vd, x, y);
852 for (i = 0; i < h; i++) {
853 vs->write_pixels(vs, row, w * VNC_SERVER_FB_BYTES);
854 row += vnc_server_fb_stride(vd);
855 }
856 return 1;
857 }
858
859 int vnc_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
860 {
861 int n = 0;
862 bool encode_raw = false;
863 size_t saved_offs = vs->output.offset;
864
865 switch(vs->vnc_encoding) {
866 case VNC_ENCODING_ZLIB:
867 n = vnc_zlib_send_framebuffer_update(vs, x, y, w, h);
868 break;
869 case VNC_ENCODING_HEXTILE:
870 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE);
871 n = vnc_hextile_send_framebuffer_update(vs, x, y, w, h);
872 break;
873 case VNC_ENCODING_TIGHT:
874 n = vnc_tight_send_framebuffer_update(vs, x, y, w, h);
875 break;
876 case VNC_ENCODING_TIGHT_PNG:
877 n = vnc_tight_png_send_framebuffer_update(vs, x, y, w, h);
878 break;
879 case VNC_ENCODING_ZRLE:
880 n = vnc_zrle_send_framebuffer_update(vs, x, y, w, h);
881 break;
882 case VNC_ENCODING_ZYWRLE:
883 n = vnc_zywrle_send_framebuffer_update(vs, x, y, w, h);
884 break;
885 default:
886 encode_raw = true;
887 break;
888 }
889
890 /* If the client has the same pixel format as our internal buffer and
891 * a RAW encoding would need less space fall back to RAW encoding to
892 * save bandwidth and processing power in the client. */
893 if (!encode_raw && vs->write_pixels == vnc_write_pixels_copy &&
894 12 + h * w * VNC_SERVER_FB_BYTES <= (vs->output.offset - saved_offs)) {
895 vs->output.offset = saved_offs;
896 encode_raw = true;
897 }
898
899 if (encode_raw) {
900 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW);
901 n = vnc_raw_send_framebuffer_update(vs, x, y, w, h);
902 }
903
904 return n;
905 }
906
907 static void vnc_mouse_set(DisplayChangeListener *dcl,
908 int x, int y, int visible)
909 {
910 /* can we ask the client(s) to move the pointer ??? */
911 }
912
913 static int vnc_cursor_define(VncState *vs)
914 {
915 QEMUCursor *c = vs->vd->cursor;
916 int isize;
917
918 if (vnc_has_feature(vs, VNC_FEATURE_RICH_CURSOR)) {
919 vnc_lock_output(vs);
920 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
921 vnc_write_u8(vs, 0); /* padding */
922 vnc_write_u16(vs, 1); /* # of rects */
923 vnc_framebuffer_update(vs, c->hot_x, c->hot_y, c->width, c->height,
924 VNC_ENCODING_RICH_CURSOR);
925 isize = c->width * c->height * vs->client_pf.bytes_per_pixel;
926 vnc_write_pixels_generic(vs, c->data, isize);
927 vnc_write(vs, vs->vd->cursor_mask, vs->vd->cursor_msize);
928 vnc_unlock_output(vs);
929 return 0;
930 }
931 return -1;
932 }
933
934 static void vnc_dpy_cursor_define(DisplayChangeListener *dcl,
935 QEMUCursor *c)
936 {
937 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
938 VncState *vs;
939
940 cursor_put(vd->cursor);
941 g_free(vd->cursor_mask);
942
943 vd->cursor = c;
944 cursor_get(vd->cursor);
945 vd->cursor_msize = cursor_get_mono_bpl(c) * c->height;
946 vd->cursor_mask = g_malloc0(vd->cursor_msize);
947 cursor_get_mono_mask(c, 0, vd->cursor_mask);
948
949 QTAILQ_FOREACH(vs, &vd->clients, next) {
950 vnc_cursor_define(vs);
951 }
952 }
953
954 static int find_and_clear_dirty_height(VncState *vs,
955 int y, int last_x, int x, int height)
956 {
957 int h;
958
959 for (h = 1; h < (height - y); h++) {
960 if (!test_bit(last_x, vs->dirty[y + h])) {
961 break;
962 }
963 bitmap_clear(vs->dirty[y + h], last_x, x - last_x);
964 }
965
966 return h;
967 }
968
969 /*
970 * Figure out how much pending data we should allow in the output
971 * buffer before we throttle incremental display updates, and/or
972 * drop audio samples.
973 *
974 * We allow for equiv of 1 full display's worth of FB updates,
975 * and 1 second of audio samples. If audio backlog was larger
976 * than that the client would already suffering awful audio
977 * glitches, so dropping samples is no worse really).
978 */
979 static void vnc_update_throttle_offset(VncState *vs)
980 {
981 size_t offset =
982 vs->client_width * vs->client_height * vs->client_pf.bytes_per_pixel;
983
984 if (vs->audio_cap) {
985 int freq = vs->as.freq;
986 /* We don't limit freq when reading settings from client, so
987 * it could be upto MAX_INT in size. 48khz is a sensible
988 * upper bound for trustworthy clients */
989 int bps;
990 if (freq > 48000) {
991 freq = 48000;
992 }
993 switch (vs->as.fmt) {
994 default:
995 case AUD_FMT_U8:
996 case AUD_FMT_S8:
997 bps = 1;
998 break;
999 case AUD_FMT_U16:
1000 case AUD_FMT_S16:
1001 bps = 2;
1002 break;
1003 case AUD_FMT_U32:
1004 case AUD_FMT_S32:
1005 bps = 4;
1006 break;
1007 }
1008 offset += freq * bps * vs->as.nchannels;
1009 }
1010
1011 /* Put a floor of 1MB on offset, so that if we have a large pending
1012 * buffer and the display is resized to a small size & back again
1013 * we don't suddenly apply a tiny send limit
1014 */
1015 offset = MAX(offset, 1024 * 1024);
1016
1017 if (vs->throttle_output_offset != offset) {
1018 trace_vnc_client_throttle_threshold(
1019 vs, vs->ioc, vs->throttle_output_offset, offset, vs->client_width,
1020 vs->client_height, vs->client_pf.bytes_per_pixel, vs->audio_cap);
1021 }
1022
1023 vs->throttle_output_offset = offset;
1024 }
1025
1026 static bool vnc_should_update(VncState *vs)
1027 {
1028 switch (vs->update) {
1029 case VNC_STATE_UPDATE_NONE:
1030 break;
1031 case VNC_STATE_UPDATE_INCREMENTAL:
1032 /* Only allow incremental updates if the pending send queue
1033 * is less than the permitted threshold, and the job worker
1034 * is completely idle.
1035 */
1036 if (vs->output.offset < vs->throttle_output_offset &&
1037 vs->job_update == VNC_STATE_UPDATE_NONE) {
1038 return true;
1039 }
1040 trace_vnc_client_throttle_incremental(
1041 vs, vs->ioc, vs->job_update, vs->output.offset);
1042 break;
1043 case VNC_STATE_UPDATE_FORCE:
1044 /* Only allow forced updates if the pending send queue
1045 * does not contain a previous forced update, and the
1046 * job worker is completely idle.
1047 *
1048 * Note this means we'll queue a forced update, even if
1049 * the output buffer size is otherwise over the throttle
1050 * output limit.
1051 */
1052 if (vs->force_update_offset == 0 &&
1053 vs->job_update == VNC_STATE_UPDATE_NONE) {
1054 return true;
1055 }
1056 trace_vnc_client_throttle_forced(
1057 vs, vs->ioc, vs->job_update, vs->force_update_offset);
1058 break;
1059 }
1060 return false;
1061 }
1062
1063 static int vnc_update_client(VncState *vs, int has_dirty)
1064 {
1065 VncDisplay *vd = vs->vd;
1066 VncJob *job;
1067 int y;
1068 int height, width;
1069 int n = 0;
1070
1071 if (vs->disconnecting) {
1072 vnc_disconnect_finish(vs);
1073 return 0;
1074 }
1075
1076 vs->has_dirty += has_dirty;
1077 if (!vnc_should_update(vs)) {
1078 return 0;
1079 }
1080
1081 if (!vs->has_dirty && vs->update != VNC_STATE_UPDATE_FORCE) {
1082 return 0;
1083 }
1084
1085 /*
1086 * Send screen updates to the vnc client using the server
1087 * surface and server dirty map. guest surface updates
1088 * happening in parallel don't disturb us, the next pass will
1089 * send them to the client.
1090 */
1091 job = vnc_job_new(vs);
1092
1093 height = pixman_image_get_height(vd->server);
1094 width = pixman_image_get_width(vd->server);
1095
1096 y = 0;
1097 for (;;) {
1098 int x, h;
1099 unsigned long x2;
1100 unsigned long offset = find_next_bit((unsigned long *) &vs->dirty,
1101 height * VNC_DIRTY_BPL(vs),
1102 y * VNC_DIRTY_BPL(vs));
1103 if (offset == height * VNC_DIRTY_BPL(vs)) {
1104 /* no more dirty bits */
1105 break;
1106 }
1107 y = offset / VNC_DIRTY_BPL(vs);
1108 x = offset % VNC_DIRTY_BPL(vs);
1109 x2 = find_next_zero_bit((unsigned long *) &vs->dirty[y],
1110 VNC_DIRTY_BPL(vs), x);
1111 bitmap_clear(vs->dirty[y], x, x2 - x);
1112 h = find_and_clear_dirty_height(vs, y, x, x2, height);
1113 x2 = MIN(x2, width / VNC_DIRTY_PIXELS_PER_BIT);
1114 if (x2 > x) {
1115 n += vnc_job_add_rect(job, x * VNC_DIRTY_PIXELS_PER_BIT, y,
1116 (x2 - x) * VNC_DIRTY_PIXELS_PER_BIT, h);
1117 }
1118 if (!x && x2 == width / VNC_DIRTY_PIXELS_PER_BIT) {
1119 y += h;
1120 if (y == height) {
1121 break;
1122 }
1123 }
1124 }
1125
1126 vs->job_update = vs->update;
1127 vs->update = VNC_STATE_UPDATE_NONE;
1128 vnc_job_push(job);
1129 vs->has_dirty = 0;
1130 return n;
1131 }
1132
1133 /* audio */
1134 static void audio_capture_notify(void *opaque, audcnotification_e cmd)
1135 {
1136 VncState *vs = opaque;
1137
1138 switch (cmd) {
1139 case AUD_CNOTIFY_DISABLE:
1140 vnc_lock_output(vs);
1141 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
1142 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
1143 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_END);
1144 vnc_unlock_output(vs);
1145 vnc_flush(vs);
1146 break;
1147
1148 case AUD_CNOTIFY_ENABLE:
1149 vnc_lock_output(vs);
1150 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
1151 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
1152 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_BEGIN);
1153 vnc_unlock_output(vs);
1154 vnc_flush(vs);
1155 break;
1156 }
1157 }
1158
1159 static void audio_capture_destroy(void *opaque)
1160 {
1161 }
1162
1163 static void audio_capture(void *opaque, void *buf, int size)
1164 {
1165 VncState *vs = opaque;
1166
1167 vnc_lock_output(vs);
1168 if (vs->output.offset < vs->throttle_output_offset) {
1169 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
1170 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
1171 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_DATA);
1172 vnc_write_u32(vs, size);
1173 vnc_write(vs, buf, size);
1174 } else {
1175 trace_vnc_client_throttle_audio(vs, vs->ioc, vs->output.offset);
1176 }
1177 vnc_unlock_output(vs);
1178 vnc_flush(vs);
1179 }
1180
1181 static void audio_add(VncState *vs)
1182 {
1183 struct audio_capture_ops ops;
1184
1185 if (vs->audio_cap) {
1186 error_report("audio already running");
1187 return;
1188 }
1189
1190 ops.notify = audio_capture_notify;
1191 ops.destroy = audio_capture_destroy;
1192 ops.capture = audio_capture;
1193
1194 vs->audio_cap = AUD_add_capture(&vs->as, &ops, vs);
1195 if (!vs->audio_cap) {
1196 error_report("Failed to add audio capture");
1197 }
1198 }
1199
1200 static void audio_del(VncState *vs)
1201 {
1202 if (vs->audio_cap) {
1203 AUD_del_capture(vs->audio_cap, vs);
1204 vs->audio_cap = NULL;
1205 }
1206 }
1207
1208 static void vnc_disconnect_start(VncState *vs)
1209 {
1210 if (vs->disconnecting) {
1211 return;
1212 }
1213 trace_vnc_client_disconnect_start(vs, vs->ioc);
1214 vnc_set_share_mode(vs, VNC_SHARE_MODE_DISCONNECTED);
1215 if (vs->ioc_tag) {
1216 g_source_remove(vs->ioc_tag);
1217 vs->ioc_tag = 0;
1218 }
1219 qio_channel_close(vs->ioc, NULL);
1220 vs->disconnecting = TRUE;
1221 }
1222
1223 void vnc_disconnect_finish(VncState *vs)
1224 {
1225 int i;
1226
1227 trace_vnc_client_disconnect_finish(vs, vs->ioc);
1228
1229 vnc_jobs_join(vs); /* Wait encoding jobs */
1230
1231 vnc_lock_output(vs);
1232 vnc_qmp_event(vs, QAPI_EVENT_VNC_DISCONNECTED);
1233
1234 buffer_free(&vs->input);
1235 buffer_free(&vs->output);
1236
1237 qapi_free_VncClientInfo(vs->info);
1238
1239 vnc_zlib_clear(vs);
1240 vnc_tight_clear(vs);
1241 vnc_zrle_clear(vs);
1242
1243 #ifdef CONFIG_VNC_SASL
1244 vnc_sasl_client_cleanup(vs);
1245 #endif /* CONFIG_VNC_SASL */
1246 audio_del(vs);
1247 vnc_release_modifiers(vs);
1248
1249 if (vs->mouse_mode_notifier.notify != NULL) {
1250 qemu_remove_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
1251 }
1252 QTAILQ_REMOVE(&vs->vd->clients, vs, next);
1253 if (QTAILQ_EMPTY(&vs->vd->clients)) {
1254 /* last client gone */
1255 vnc_update_server_surface(vs->vd);
1256 }
1257
1258 vnc_unlock_output(vs);
1259
1260 qemu_mutex_destroy(&vs->output_mutex);
1261 if (vs->bh != NULL) {
1262 qemu_bh_delete(vs->bh);
1263 }
1264 buffer_free(&vs->jobs_buffer);
1265
1266 for (i = 0; i < VNC_STAT_ROWS; ++i) {
1267 g_free(vs->lossy_rect[i]);
1268 }
1269 g_free(vs->lossy_rect);
1270
1271 object_unref(OBJECT(vs->ioc));
1272 vs->ioc = NULL;
1273 object_unref(OBJECT(vs->sioc));
1274 vs->sioc = NULL;
1275 g_free(vs);
1276 }
1277
1278 size_t vnc_client_io_error(VncState *vs, ssize_t ret, Error **errp)
1279 {
1280 if (ret <= 0) {
1281 if (ret == 0) {
1282 trace_vnc_client_eof(vs, vs->ioc);
1283 vnc_disconnect_start(vs);
1284 } else if (ret != QIO_CHANNEL_ERR_BLOCK) {
1285 trace_vnc_client_io_error(vs, vs->ioc,
1286 errp ? error_get_pretty(*errp) :
1287 "Unknown");
1288 vnc_disconnect_start(vs);
1289 }
1290
1291 if (errp) {
1292 error_free(*errp);
1293 *errp = NULL;
1294 }
1295 return 0;
1296 }
1297 return ret;
1298 }
1299
1300
1301 void vnc_client_error(VncState *vs)
1302 {
1303 VNC_DEBUG("Closing down client sock: protocol error\n");
1304 vnc_disconnect_start(vs);
1305 }
1306
1307
1308 /*
1309 * Called to write a chunk of data to the client socket. The data may
1310 * be the raw data, or may have already been encoded by SASL.
1311 * The data will be written either straight onto the socket, or
1312 * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1313 *
1314 * NB, it is theoretically possible to have 2 layers of encryption,
1315 * both SASL, and this TLS layer. It is highly unlikely in practice
1316 * though, since SASL encryption will typically be a no-op if TLS
1317 * is active
1318 *
1319 * Returns the number of bytes written, which may be less than
1320 * the requested 'datalen' if the socket would block. Returns
1321 * 0 on I/O error, and disconnects the client socket.
1322 */
1323 size_t vnc_client_write_buf(VncState *vs, const uint8_t *data, size_t datalen)
1324 {
1325 Error *err = NULL;
1326 ssize_t ret;
1327 ret = qio_channel_write(
1328 vs->ioc, (const char *)data, datalen, &err);
1329 VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data, datalen, ret);
1330 return vnc_client_io_error(vs, ret, &err);
1331 }
1332
1333
1334 /*
1335 * Called to write buffered data to the client socket, when not
1336 * using any SASL SSF encryption layers. Will write as much data
1337 * as possible without blocking. If all buffered data is written,
1338 * will switch the FD poll() handler back to read monitoring.
1339 *
1340 * Returns the number of bytes written, which may be less than
1341 * the buffered output data if the socket would block. Returns
1342 * 0 on I/O error, and disconnects the client socket.
1343 */
1344 static size_t vnc_client_write_plain(VncState *vs)
1345 {
1346 size_t offset;
1347 size_t ret;
1348
1349 #ifdef CONFIG_VNC_SASL
1350 VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n",
1351 vs->output.buffer, vs->output.capacity, vs->output.offset,
1352 vs->sasl.waitWriteSSF);
1353
1354 if (vs->sasl.conn &&
1355 vs->sasl.runSSF &&
1356 vs->sasl.waitWriteSSF) {
1357 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF);
1358 if (ret)
1359 vs->sasl.waitWriteSSF -= ret;
1360 } else
1361 #endif /* CONFIG_VNC_SASL */
1362 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset);
1363 if (!ret)
1364 return 0;
1365
1366 if (ret >= vs->force_update_offset) {
1367 if (vs->force_update_offset != 0) {
1368 trace_vnc_client_unthrottle_forced(vs, vs->ioc);
1369 }
1370 vs->force_update_offset = 0;
1371 } else {
1372 vs->force_update_offset -= ret;
1373 }
1374 offset = vs->output.offset;
1375 buffer_advance(&vs->output, ret);
1376 if (offset >= vs->throttle_output_offset &&
1377 vs->output.offset < vs->throttle_output_offset) {
1378 trace_vnc_client_unthrottle_incremental(vs, vs->ioc, vs->output.offset);
1379 }
1380
1381 if (vs->output.offset == 0) {
1382 if (vs->ioc_tag) {
1383 g_source_remove(vs->ioc_tag);
1384 }
1385 vs->ioc_tag = qio_channel_add_watch(
1386 vs->ioc, G_IO_IN, vnc_client_io, vs, NULL);
1387 }
1388
1389 return ret;
1390 }
1391
1392
1393 /*
1394 * First function called whenever there is data to be written to
1395 * the client socket. Will delegate actual work according to whether
1396 * SASL SSF layers are enabled (thus requiring encryption calls)
1397 */
1398 static void vnc_client_write_locked(VncState *vs)
1399 {
1400 #ifdef CONFIG_VNC_SASL
1401 if (vs->sasl.conn &&
1402 vs->sasl.runSSF &&
1403 !vs->sasl.waitWriteSSF) {
1404 vnc_client_write_sasl(vs);
1405 } else
1406 #endif /* CONFIG_VNC_SASL */
1407 {
1408 vnc_client_write_plain(vs);
1409 }
1410 }
1411
1412 static void vnc_client_write(VncState *vs)
1413 {
1414
1415 vnc_lock_output(vs);
1416 if (vs->output.offset) {
1417 vnc_client_write_locked(vs);
1418 } else if (vs->ioc != NULL) {
1419 if (vs->ioc_tag) {
1420 g_source_remove(vs->ioc_tag);
1421 }
1422 vs->ioc_tag = qio_channel_add_watch(
1423 vs->ioc, G_IO_IN, vnc_client_io, vs, NULL);
1424 }
1425 vnc_unlock_output(vs);
1426 }
1427
1428 void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting)
1429 {
1430 vs->read_handler = func;
1431 vs->read_handler_expect = expecting;
1432 }
1433
1434
1435 /*
1436 * Called to read a chunk of data from the client socket. The data may
1437 * be the raw data, or may need to be further decoded by SASL.
1438 * The data will be read either straight from to the socket, or
1439 * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1440 *
1441 * NB, it is theoretically possible to have 2 layers of encryption,
1442 * both SASL, and this TLS layer. It is highly unlikely in practice
1443 * though, since SASL encryption will typically be a no-op if TLS
1444 * is active
1445 *
1446 * Returns the number of bytes read, which may be less than
1447 * the requested 'datalen' if the socket would block. Returns
1448 * 0 on I/O error or EOF, and disconnects the client socket.
1449 */
1450 size_t vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen)
1451 {
1452 ssize_t ret;
1453 Error *err = NULL;
1454 ret = qio_channel_read(
1455 vs->ioc, (char *)data, datalen, &err);
1456 VNC_DEBUG("Read wire %p %zd -> %ld\n", data, datalen, ret);
1457 return vnc_client_io_error(vs, ret, &err);
1458 }
1459
1460
1461 /*
1462 * Called to read data from the client socket to the input buffer,
1463 * when not using any SASL SSF encryption layers. Will read as much
1464 * data as possible without blocking.
1465 *
1466 * Returns the number of bytes read, which may be less than
1467 * the requested 'datalen' if the socket would block. Returns
1468 * 0 on I/O error or EOF, and disconnects the client socket.
1469 */
1470 static size_t vnc_client_read_plain(VncState *vs)
1471 {
1472 size_t ret;
1473 VNC_DEBUG("Read plain %p size %zd offset %zd\n",
1474 vs->input.buffer, vs->input.capacity, vs->input.offset);
1475 buffer_reserve(&vs->input, 4096);
1476 ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096);
1477 if (!ret)
1478 return 0;
1479 vs->input.offset += ret;
1480 return ret;
1481 }
1482
1483 static void vnc_jobs_bh(void *opaque)
1484 {
1485 VncState *vs = opaque;
1486
1487 vnc_jobs_consume_buffer(vs);
1488 }
1489
1490 /*
1491 * First function called whenever there is more data to be read from
1492 * the client socket. Will delegate actual work according to whether
1493 * SASL SSF layers are enabled (thus requiring decryption calls)
1494 * Returns 0 on success, -1 if client disconnected
1495 */
1496 static int vnc_client_read(VncState *vs)
1497 {
1498 size_t ret;
1499
1500 #ifdef CONFIG_VNC_SASL
1501 if (vs->sasl.conn && vs->sasl.runSSF)
1502 ret = vnc_client_read_sasl(vs);
1503 else
1504 #endif /* CONFIG_VNC_SASL */
1505 ret = vnc_client_read_plain(vs);
1506 if (!ret) {
1507 if (vs->disconnecting) {
1508 vnc_disconnect_finish(vs);
1509 return -1;
1510 }
1511 return 0;
1512 }
1513
1514 while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) {
1515 size_t len = vs->read_handler_expect;
1516 int ret;
1517
1518 ret = vs->read_handler(vs, vs->input.buffer, len);
1519 if (vs->disconnecting) {
1520 vnc_disconnect_finish(vs);
1521 return -1;
1522 }
1523
1524 if (!ret) {
1525 buffer_advance(&vs->input, len);
1526 } else {
1527 vs->read_handler_expect = ret;
1528 }
1529 }
1530 return 0;
1531 }
1532
1533 gboolean vnc_client_io(QIOChannel *ioc G_GNUC_UNUSED,
1534 GIOCondition condition, void *opaque)
1535 {
1536 VncState *vs = opaque;
1537 if (condition & G_IO_IN) {
1538 if (vnc_client_read(vs) < 0) {
1539 goto end;
1540 }
1541 }
1542 if (condition & G_IO_OUT) {
1543 vnc_client_write(vs);
1544 }
1545 end:
1546 if (vs->disconnecting) {
1547 if (vs->ioc_tag != 0) {
1548 g_source_remove(vs->ioc_tag);
1549 }
1550 vs->ioc_tag = 0;
1551 }
1552 return TRUE;
1553 }
1554
1555
1556 /*
1557 * Scale factor to apply to vs->throttle_output_offset when checking for
1558 * hard limit. Worst case normal usage could be x2, if we have a complete
1559 * incremental update and complete forced update in the output buffer.
1560 * So x3 should be good enough, but we pick x5 to be conservative and thus
1561 * (hopefully) never trigger incorrectly.
1562 */
1563 #define VNC_THROTTLE_OUTPUT_LIMIT_SCALE 5
1564
1565 void vnc_write(VncState *vs, const void *data, size_t len)
1566 {
1567 if (vs->disconnecting) {
1568 return;
1569 }
1570 /* Protection against malicious client/guest to prevent our output
1571 * buffer growing without bound if client stops reading data. This
1572 * should rarely trigger, because we have earlier throttling code
1573 * which stops issuing framebuffer updates and drops audio data
1574 * if the throttle_output_offset value is exceeded. So we only reach
1575 * this higher level if a huge number of pseudo-encodings get
1576 * triggered while data can't be sent on the socket.
1577 *
1578 * NB throttle_output_offset can be zero during early protocol
1579 * handshake, or from the job thread's VncState clone
1580 */
1581 if (vs->throttle_output_offset != 0 &&
1582 (vs->output.offset / VNC_THROTTLE_OUTPUT_LIMIT_SCALE) >
1583 vs->throttle_output_offset) {
1584 trace_vnc_client_output_limit(vs, vs->ioc, vs->output.offset,
1585 vs->throttle_output_offset);
1586 vnc_disconnect_start(vs);
1587 return;
1588 }
1589 buffer_reserve(&vs->output, len);
1590
1591 if (vs->ioc != NULL && buffer_empty(&vs->output)) {
1592 if (vs->ioc_tag) {
1593 g_source_remove(vs->ioc_tag);
1594 }
1595 vs->ioc_tag = qio_channel_add_watch(
1596 vs->ioc, G_IO_IN | G_IO_OUT, vnc_client_io, vs, NULL);
1597 }
1598
1599 buffer_append(&vs->output, data, len);
1600 }
1601
1602 void vnc_write_s32(VncState *vs, int32_t value)
1603 {
1604 vnc_write_u32(vs, *(uint32_t *)&value);
1605 }
1606
1607 void vnc_write_u32(VncState *vs, uint32_t value)
1608 {
1609 uint8_t buf[4];
1610
1611 buf[0] = (value >> 24) & 0xFF;
1612 buf[1] = (value >> 16) & 0xFF;
1613 buf[2] = (value >> 8) & 0xFF;
1614 buf[3] = value & 0xFF;
1615
1616 vnc_write(vs, buf, 4);
1617 }
1618
1619 void vnc_write_u16(VncState *vs, uint16_t value)
1620 {
1621 uint8_t buf[2];
1622
1623 buf[0] = (value >> 8) & 0xFF;
1624 buf[1] = value & 0xFF;
1625
1626 vnc_write(vs, buf, 2);
1627 }
1628
1629 void vnc_write_u8(VncState *vs, uint8_t value)
1630 {
1631 vnc_write(vs, (char *)&value, 1);
1632 }
1633
1634 void vnc_flush(VncState *vs)
1635 {
1636 vnc_lock_output(vs);
1637 if (vs->ioc != NULL && vs->output.offset) {
1638 vnc_client_write_locked(vs);
1639 }
1640 if (vs->disconnecting) {
1641 if (vs->ioc_tag != 0) {
1642 g_source_remove(vs->ioc_tag);
1643 }
1644 vs->ioc_tag = 0;
1645 }
1646 vnc_unlock_output(vs);
1647 }
1648
1649 static uint8_t read_u8(uint8_t *data, size_t offset)
1650 {
1651 return data[offset];
1652 }
1653
1654 static uint16_t read_u16(uint8_t *data, size_t offset)
1655 {
1656 return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF);
1657 }
1658
1659 static int32_t read_s32(uint8_t *data, size_t offset)
1660 {
1661 return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) |
1662 (data[offset + 2] << 8) | data[offset + 3]);
1663 }
1664
1665 uint32_t read_u32(uint8_t *data, size_t offset)
1666 {
1667 return ((data[offset] << 24) | (data[offset + 1] << 16) |
1668 (data[offset + 2] << 8) | data[offset + 3]);
1669 }
1670
1671 static void client_cut_text(VncState *vs, size_t len, uint8_t *text)
1672 {
1673 }
1674
1675 static void check_pointer_type_change(Notifier *notifier, void *data)
1676 {
1677 VncState *vs = container_of(notifier, VncState, mouse_mode_notifier);
1678 int absolute = qemu_input_is_absolute();
1679
1680 if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) {
1681 vnc_lock_output(vs);
1682 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1683 vnc_write_u8(vs, 0);
1684 vnc_write_u16(vs, 1);
1685 vnc_framebuffer_update(vs, absolute, 0,
1686 pixman_image_get_width(vs->vd->server),
1687 pixman_image_get_height(vs->vd->server),
1688 VNC_ENCODING_POINTER_TYPE_CHANGE);
1689 vnc_unlock_output(vs);
1690 vnc_flush(vs);
1691 }
1692 vs->absolute = absolute;
1693 }
1694
1695 static void pointer_event(VncState *vs, int button_mask, int x, int y)
1696 {
1697 static uint32_t bmap[INPUT_BUTTON__MAX] = {
1698 [INPUT_BUTTON_LEFT] = 0x01,
1699 [INPUT_BUTTON_MIDDLE] = 0x02,
1700 [INPUT_BUTTON_RIGHT] = 0x04,
1701 [INPUT_BUTTON_WHEEL_UP] = 0x08,
1702 [INPUT_BUTTON_WHEEL_DOWN] = 0x10,
1703 };
1704 QemuConsole *con = vs->vd->dcl.con;
1705 int width = pixman_image_get_width(vs->vd->server);
1706 int height = pixman_image_get_height(vs->vd->server);
1707
1708 if (vs->last_bmask != button_mask) {
1709 qemu_input_update_buttons(con, bmap, vs->last_bmask, button_mask);
1710 vs->last_bmask = button_mask;
1711 }
1712
1713 if (vs->absolute) {
1714 qemu_input_queue_abs(con, INPUT_AXIS_X, x, 0, width);
1715 qemu_input_queue_abs(con, INPUT_AXIS_Y, y, 0, height);
1716 } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) {
1717 qemu_input_queue_rel(con, INPUT_AXIS_X, x - 0x7FFF);
1718 qemu_input_queue_rel(con, INPUT_AXIS_Y, y - 0x7FFF);
1719 } else {
1720 if (vs->last_x != -1) {
1721 qemu_input_queue_rel(con, INPUT_AXIS_X, x - vs->last_x);
1722 qemu_input_queue_rel(con, INPUT_AXIS_Y, y - vs->last_y);
1723 }
1724 vs->last_x = x;
1725 vs->last_y = y;
1726 }
1727 qemu_input_event_sync();
1728 }
1729
1730 static void reset_keys(VncState *vs)
1731 {
1732 int i;
1733 for(i = 0; i < 256; i++) {
1734 if (vs->modifiers_state[i]) {
1735 qemu_input_event_send_key_number(vs->vd->dcl.con, i, false);
1736 qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
1737 vs->modifiers_state[i] = 0;
1738 }
1739 }
1740 }
1741
1742 static void press_key(VncState *vs, int keysym)
1743 {
1744 int keycode = keysym2scancode(vs->vd->kbd_layout, keysym) & SCANCODE_KEYMASK;
1745 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, true);
1746 qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
1747 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, false);
1748 qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
1749 }
1750
1751 static void vnc_led_state_change(VncState *vs)
1752 {
1753 if (!vnc_has_feature(vs, VNC_FEATURE_LED_STATE)) {
1754 return;
1755 }
1756
1757 vnc_lock_output(vs);
1758 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1759 vnc_write_u8(vs, 0);
1760 vnc_write_u16(vs, 1);
1761 vnc_framebuffer_update(vs, 0, 0, 1, 1, VNC_ENCODING_LED_STATE);
1762 vnc_write_u8(vs, vs->vd->ledstate);
1763 vnc_unlock_output(vs);
1764 vnc_flush(vs);
1765 }
1766
1767 static void kbd_leds(void *opaque, int ledstate)
1768 {
1769 VncDisplay *vd = opaque;
1770 VncState *client;
1771
1772 trace_vnc_key_guest_leds((ledstate & QEMU_CAPS_LOCK_LED),
1773 (ledstate & QEMU_NUM_LOCK_LED),
1774 (ledstate & QEMU_SCROLL_LOCK_LED));
1775
1776 if (ledstate == vd->ledstate) {
1777 return;
1778 }
1779
1780 vd->ledstate = ledstate;
1781
1782 QTAILQ_FOREACH(client, &vd->clients, next) {
1783 vnc_led_state_change(client);
1784 }
1785 }
1786
1787 static void do_key_event(VncState *vs, int down, int keycode, int sym)
1788 {
1789 /* QEMU console switch */
1790 switch(keycode) {
1791 case 0x2a: /* Left Shift */
1792 case 0x36: /* Right Shift */
1793 case 0x1d: /* Left CTRL */
1794 case 0x9d: /* Right CTRL */
1795 case 0x38: /* Left ALT */
1796 case 0xb8: /* Right ALT */
1797 if (down)
1798 vs->modifiers_state[keycode] = 1;
1799 else
1800 vs->modifiers_state[keycode] = 0;
1801 break;
1802 case 0x02 ... 0x0a: /* '1' to '9' keys */
1803 if (vs->vd->dcl.con == NULL &&
1804 down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) {
1805 /* Reset the modifiers sent to the current console */
1806 reset_keys(vs);
1807 console_select(keycode - 0x02);
1808 return;
1809 }
1810 break;
1811 case 0x3a: /* CapsLock */
1812 case 0x45: /* NumLock */
1813 if (down)
1814 vs->modifiers_state[keycode] ^= 1;
1815 break;
1816 }
1817
1818 /* Turn off the lock state sync logic if the client support the led
1819 state extension.
1820 */
1821 if (down && vs->vd->lock_key_sync &&
1822 !vnc_has_feature(vs, VNC_FEATURE_LED_STATE) &&
1823 keycode_is_keypad(vs->vd->kbd_layout, keycode)) {
1824 /* If the numlock state needs to change then simulate an additional
1825 keypress before sending this one. This will happen if the user
1826 toggles numlock away from the VNC window.
1827 */
1828 if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) {
1829 if (!vs->modifiers_state[0x45]) {
1830 trace_vnc_key_sync_numlock(true);
1831 vs->modifiers_state[0x45] = 1;
1832 press_key(vs, 0xff7f);
1833 }
1834 } else {
1835 if (vs->modifiers_state[0x45]) {
1836 trace_vnc_key_sync_numlock(false);
1837 vs->modifiers_state[0x45] = 0;
1838 press_key(vs, 0xff7f);
1839 }
1840 }
1841 }
1842
1843 if (down && vs->vd->lock_key_sync &&
1844 !vnc_has_feature(vs, VNC_FEATURE_LED_STATE) &&
1845 ((sym >= 'A' && sym <= 'Z') || (sym >= 'a' && sym <= 'z'))) {
1846 /* If the capslock state needs to change then simulate an additional
1847 keypress before sending this one. This will happen if the user
1848 toggles capslock away from the VNC window.
1849 */
1850 int uppercase = !!(sym >= 'A' && sym <= 'Z');
1851 int shift = !!(vs->modifiers_state[0x2a] | vs->modifiers_state[0x36]);
1852 int capslock = !!(vs->modifiers_state[0x3a]);
1853 if (capslock) {
1854 if (uppercase == shift) {
1855 trace_vnc_key_sync_capslock(false);
1856 vs->modifiers_state[0x3a] = 0;
1857 press_key(vs, 0xffe5);
1858 }
1859 } else {
1860 if (uppercase != shift) {
1861 trace_vnc_key_sync_capslock(true);
1862 vs->modifiers_state[0x3a] = 1;
1863 press_key(vs, 0xffe5);
1864 }
1865 }
1866 }
1867
1868 if (qemu_console_is_graphic(NULL)) {
1869 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, down);
1870 qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
1871 } else {
1872 bool numlock = vs->modifiers_state[0x45];
1873 bool control = (vs->modifiers_state[0x1d] ||
1874 vs->modifiers_state[0x9d]);
1875 /* QEMU console emulation */
1876 if (down) {
1877 switch (keycode) {
1878 case 0x2a: /* Left Shift */
1879 case 0x36: /* Right Shift */
1880 case 0x1d: /* Left CTRL */
1881 case 0x9d: /* Right CTRL */
1882 case 0x38: /* Left ALT */
1883 case 0xb8: /* Right ALT */
1884 break;
1885 case 0xc8:
1886 kbd_put_keysym(QEMU_KEY_UP);
1887 break;
1888 case 0xd0:
1889 kbd_put_keysym(QEMU_KEY_DOWN);
1890 break;
1891 case 0xcb:
1892 kbd_put_keysym(QEMU_KEY_LEFT);
1893 break;
1894 case 0xcd:
1895 kbd_put_keysym(QEMU_KEY_RIGHT);
1896 break;
1897 case 0xd3:
1898 kbd_put_keysym(QEMU_KEY_DELETE);
1899 break;
1900 case 0xc7:
1901 kbd_put_keysym(QEMU_KEY_HOME);
1902 break;
1903 case 0xcf:
1904 kbd_put_keysym(QEMU_KEY_END);
1905 break;
1906 case 0xc9:
1907 kbd_put_keysym(QEMU_KEY_PAGEUP);
1908 break;
1909 case 0xd1:
1910 kbd_put_keysym(QEMU_KEY_PAGEDOWN);
1911 break;
1912
1913 case 0x47:
1914 kbd_put_keysym(numlock ? '7' : QEMU_KEY_HOME);
1915 break;
1916 case 0x48:
1917 kbd_put_keysym(numlock ? '8' : QEMU_KEY_UP);
1918 break;
1919 case 0x49:
1920 kbd_put_keysym(numlock ? '9' : QEMU_KEY_PAGEUP);
1921 break;
1922 case 0x4b:
1923 kbd_put_keysym(numlock ? '4' : QEMU_KEY_LEFT);
1924 break;
1925 case 0x4c:
1926 kbd_put_keysym('5');
1927 break;
1928 case 0x4d:
1929 kbd_put_keysym(numlock ? '6' : QEMU_KEY_RIGHT);
1930 break;
1931 case 0x4f:
1932 kbd_put_keysym(numlock ? '1' : QEMU_KEY_END);
1933 break;
1934 case 0x50:
1935 kbd_put_keysym(numlock ? '2' : QEMU_KEY_DOWN);
1936 break;
1937 case 0x51:
1938 kbd_put_keysym(numlock ? '3' : QEMU_KEY_PAGEDOWN);
1939 break;
1940 case 0x52:
1941 kbd_put_keysym('0');
1942 break;
1943 case 0x53:
1944 kbd_put_keysym(numlock ? '.' : QEMU_KEY_DELETE);
1945 break;
1946
1947 case 0xb5:
1948 kbd_put_keysym('/');
1949 break;
1950 case 0x37:
1951 kbd_put_keysym('*');
1952 break;
1953 case 0x4a:
1954 kbd_put_keysym('-');
1955 break;
1956 case 0x4e:
1957 kbd_put_keysym('+');
1958 break;
1959 case 0x9c:
1960 kbd_put_keysym('\n');
1961 break;
1962
1963 default:
1964 if (control) {
1965 kbd_put_keysym(sym & 0x1f);
1966 } else {
1967 kbd_put_keysym(sym);
1968 }
1969 break;
1970 }
1971 }
1972 }
1973 }
1974
1975 static void vnc_release_modifiers(VncState *vs)
1976 {
1977 static const int keycodes[] = {
1978 /* shift, control, alt keys, both left & right */
1979 0x2a, 0x36, 0x1d, 0x9d, 0x38, 0xb8,
1980 };
1981 int i, keycode;
1982
1983 if (!qemu_console_is_graphic(NULL)) {
1984 return;
1985 }
1986 for (i = 0; i < ARRAY_SIZE(keycodes); i++) {
1987 keycode = keycodes[i];
1988 if (!vs->modifiers_state[keycode]) {
1989 continue;
1990 }
1991 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, false);
1992 qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
1993 }
1994 }
1995
1996 static const char *code2name(int keycode)
1997 {
1998 return QKeyCode_str(qemu_input_key_number_to_qcode(keycode));
1999 }
2000
2001 static void key_event(VncState *vs, int down, uint32_t sym)
2002 {
2003 int keycode;
2004 int lsym = sym;
2005
2006 if (lsym >= 'A' && lsym <= 'Z' && qemu_console_is_graphic(NULL)) {
2007 lsym = lsym - 'A' + 'a';
2008 }
2009
2010 keycode = keysym2scancode(vs->vd->kbd_layout, lsym & 0xFFFF) & SCANCODE_KEYMASK;
2011 trace_vnc_key_event_map(down, sym, keycode, code2name(keycode));
2012 do_key_event(vs, down, keycode, sym);
2013 }
2014
2015 static void ext_key_event(VncState *vs, int down,
2016 uint32_t sym, uint16_t keycode)
2017 {
2018 /* if the user specifies a keyboard layout, always use it */
2019 if (keyboard_layout) {
2020 key_event(vs, down, sym);
2021 } else {
2022 trace_vnc_key_event_ext(down, sym, keycode, code2name(keycode));
2023 do_key_event(vs, down, keycode, sym);
2024 }
2025 }
2026
2027 static void framebuffer_update_request(VncState *vs, int incremental,
2028 int x, int y, int w, int h)
2029 {
2030 if (incremental) {
2031 if (vs->update != VNC_STATE_UPDATE_FORCE) {
2032 vs->update = VNC_STATE_UPDATE_INCREMENTAL;
2033 }
2034 } else {
2035 vs->update = VNC_STATE_UPDATE_FORCE;
2036 vnc_set_area_dirty(vs->dirty, vs->vd, x, y, w, h);
2037 }
2038 }
2039
2040 static void send_ext_key_event_ack(VncState *vs)
2041 {
2042 vnc_lock_output(vs);
2043 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
2044 vnc_write_u8(vs, 0);
2045 vnc_write_u16(vs, 1);
2046 vnc_framebuffer_update(vs, 0, 0,
2047 pixman_image_get_width(vs->vd->server),
2048 pixman_image_get_height(vs->vd->server),
2049 VNC_ENCODING_EXT_KEY_EVENT);
2050 vnc_unlock_output(vs);
2051 vnc_flush(vs);
2052 }
2053
2054 static void send_ext_audio_ack(VncState *vs)
2055 {
2056 vnc_lock_output(vs);
2057 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
2058 vnc_write_u8(vs, 0);
2059 vnc_write_u16(vs, 1);
2060 vnc_framebuffer_update(vs, 0, 0,
2061 pixman_image_get_width(vs->vd->server),
2062 pixman_image_get_height(vs->vd->server),
2063 VNC_ENCODING_AUDIO);
2064 vnc_unlock_output(vs);
2065 vnc_flush(vs);
2066 }
2067
2068 static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
2069 {
2070 int i;
2071 unsigned int enc = 0;
2072
2073 vs->features = 0;
2074 vs->vnc_encoding = 0;
2075 vs->tight.compression = 9;
2076 vs->tight.quality = -1; /* Lossless by default */
2077 vs->absolute = -1;
2078
2079 /*
2080 * Start from the end because the encodings are sent in order of preference.
2081 * This way the preferred encoding (first encoding defined in the array)
2082 * will be set at the end of the loop.
2083 */
2084 for (i = n_encodings - 1; i >= 0; i--) {
2085 enc = encodings[i];
2086 switch (enc) {
2087 case VNC_ENCODING_RAW:
2088 vs->vnc_encoding = enc;
2089 break;
2090 case VNC_ENCODING_COPYRECT:
2091 vs->features |= VNC_FEATURE_COPYRECT_MASK;
2092 break;
2093 case VNC_ENCODING_HEXTILE:
2094 vs->features |= VNC_FEATURE_HEXTILE_MASK;
2095 vs->vnc_encoding = enc;
2096 break;
2097 case VNC_ENCODING_TIGHT:
2098 vs->features |= VNC_FEATURE_TIGHT_MASK;
2099 vs->vnc_encoding = enc;
2100 break;
2101 #ifdef CONFIG_VNC_PNG
2102 case VNC_ENCODING_TIGHT_PNG:
2103 vs->features |= VNC_FEATURE_TIGHT_PNG_MASK;
2104 vs->vnc_encoding = enc;
2105 break;
2106 #endif
2107 case VNC_ENCODING_ZLIB:
2108 vs->features |= VNC_FEATURE_ZLIB_MASK;
2109 vs->vnc_encoding = enc;
2110 break;
2111 case VNC_ENCODING_ZRLE:
2112 vs->features |= VNC_FEATURE_ZRLE_MASK;
2113 vs->vnc_encoding = enc;
2114 break;
2115 case VNC_ENCODING_ZYWRLE:
2116 vs->features |= VNC_FEATURE_ZYWRLE_MASK;
2117 vs->vnc_encoding = enc;
2118 break;
2119 case VNC_ENCODING_DESKTOPRESIZE:
2120 vs->features |= VNC_FEATURE_RESIZE_MASK;
2121 break;
2122 case VNC_ENCODING_POINTER_TYPE_CHANGE:
2123 vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK;
2124 break;
2125 case VNC_ENCODING_RICH_CURSOR:
2126 vs->features |= VNC_FEATURE_RICH_CURSOR_MASK;
2127 if (vs->vd->cursor) {
2128 vnc_cursor_define(vs);
2129 }
2130 break;
2131 case VNC_ENCODING_EXT_KEY_EVENT:
2132 send_ext_key_event_ack(vs);
2133 break;
2134 case VNC_ENCODING_AUDIO:
2135 send_ext_audio_ack(vs);
2136 break;
2137 case VNC_ENCODING_WMVi:
2138 vs->features |= VNC_FEATURE_WMVI_MASK;
2139 break;
2140 case VNC_ENCODING_LED_STATE:
2141 vs->features |= VNC_FEATURE_LED_STATE_MASK;
2142 break;
2143 case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9:
2144 vs->tight.compression = (enc & 0x0F);
2145 break;
2146 case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9:
2147 if (vs->vd->lossy) {
2148 vs->tight.quality = (enc & 0x0F);
2149 }
2150 break;
2151 default:
2152 VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc);
2153 break;
2154 }
2155 }
2156 vnc_desktop_resize(vs);
2157 check_pointer_type_change(&vs->mouse_mode_notifier, NULL);
2158 vnc_led_state_change(vs);
2159 }
2160
2161 static void set_pixel_conversion(VncState *vs)
2162 {
2163 pixman_format_code_t fmt = qemu_pixman_get_format(&vs->client_pf);
2164
2165 if (fmt == VNC_SERVER_FB_FORMAT) {
2166 vs->write_pixels = vnc_write_pixels_copy;
2167 vnc_hextile_set_pixel_conversion(vs, 0);
2168 } else {
2169 vs->write_pixels = vnc_write_pixels_generic;
2170 vnc_hextile_set_pixel_conversion(vs, 1);
2171 }
2172 }
2173
2174 static void send_color_map(VncState *vs)
2175 {
2176 int i;
2177
2178 vnc_write_u8(vs, VNC_MSG_SERVER_SET_COLOUR_MAP_ENTRIES);
2179 vnc_write_u8(vs, 0); /* padding */
2180 vnc_write_u16(vs, 0); /* first color */
2181 vnc_write_u16(vs, 256); /* # of colors */
2182
2183 for (i = 0; i < 256; i++) {
2184 PixelFormat *pf = &vs->client_pf;
2185
2186 vnc_write_u16(vs, (((i >> pf->rshift) & pf->rmax) << (16 - pf->rbits)));
2187 vnc_write_u16(vs, (((i >> pf->gshift) & pf->gmax) << (16 - pf->gbits)));
2188 vnc_write_u16(vs, (((i >> pf->bshift) & pf->bmax) << (16 - pf->bbits)));
2189 }
2190 }
2191
2192 static void set_pixel_format(VncState *vs, int bits_per_pixel,
2193 int big_endian_flag, int true_color_flag,
2194 int red_max, int green_max, int blue_max,
2195 int red_shift, int green_shift, int blue_shift)
2196 {
2197 if (!true_color_flag) {
2198 /* Expose a reasonable default 256 color map */
2199 bits_per_pixel = 8;
2200 red_max = 7;
2201 green_max = 7;
2202 blue_max = 3;
2203 red_shift = 0;
2204 green_shift = 3;
2205 blue_shift = 6;
2206 }
2207
2208 switch (bits_per_pixel) {
2209 case 8:
2210 case 16:
2211 case 32:
2212 break;
2213 default:
2214 vnc_client_error(vs);
2215 return;
2216 }
2217
2218 vs->client_pf.rmax = red_max ? red_max : 0xFF;
2219 vs->client_pf.rbits = ctpopl(red_max);
2220 vs->client_pf.rshift = red_shift;
2221 vs->client_pf.rmask = red_max << red_shift;
2222 vs->client_pf.gmax = green_max ? green_max : 0xFF;
2223 vs->client_pf.gbits = ctpopl(green_max);
2224 vs->client_pf.gshift = green_shift;
2225 vs->client_pf.gmask = green_max << green_shift;
2226 vs->client_pf.bmax = blue_max ? blue_max : 0xFF;
2227 vs->client_pf.bbits = ctpopl(blue_max);
2228 vs->client_pf.bshift = blue_shift;
2229 vs->client_pf.bmask = blue_max << blue_shift;
2230 vs->client_pf.bits_per_pixel = bits_per_pixel;
2231 vs->client_pf.bytes_per_pixel = bits_per_pixel / 8;
2232 vs->client_pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;
2233 vs->client_be = big_endian_flag;
2234
2235 if (!true_color_flag) {
2236 send_color_map(vs);
2237 }
2238
2239 set_pixel_conversion(vs);
2240
2241 graphic_hw_invalidate(vs->vd->dcl.con);
2242 graphic_hw_update(vs->vd->dcl.con);
2243 }
2244
2245 static void pixel_format_message (VncState *vs) {
2246 char pad[3] = { 0, 0, 0 };
2247
2248 vs->client_pf = qemu_default_pixelformat(32);
2249
2250 vnc_write_u8(vs, vs->client_pf.bits_per_pixel); /* bits-per-pixel */
2251 vnc_write_u8(vs, vs->client_pf.depth); /* depth */
2252
2253 #ifdef HOST_WORDS_BIGENDIAN
2254 vnc_write_u8(vs, 1); /* big-endian-flag */
2255 #else
2256 vnc_write_u8(vs, 0); /* big-endian-flag */
2257 #endif
2258 vnc_write_u8(vs, 1); /* true-color-flag */
2259 vnc_write_u16(vs, vs->client_pf.rmax); /* red-max */
2260 vnc_write_u16(vs, vs->client_pf.gmax); /* green-max */
2261 vnc_write_u16(vs, vs->client_pf.bmax); /* blue-max */
2262 vnc_write_u8(vs, vs->client_pf.rshift); /* red-shift */
2263 vnc_write_u8(vs, vs->client_pf.gshift); /* green-shift */
2264 vnc_write_u8(vs, vs->client_pf.bshift); /* blue-shift */
2265 vnc_write(vs, pad, 3); /* padding */
2266
2267 vnc_hextile_set_pixel_conversion(vs, 0);
2268 vs->write_pixels = vnc_write_pixels_copy;
2269 }
2270
2271 static void vnc_colordepth(VncState *vs)
2272 {
2273 if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) {
2274 /* Sending a WMVi message to notify the client*/
2275 vnc_lock_output(vs);
2276 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
2277 vnc_write_u8(vs, 0);
2278 vnc_write_u16(vs, 1); /* number of rects */
2279 vnc_framebuffer_update(vs, 0, 0,
2280 pixman_image_get_width(vs->vd->server),
2281 pixman_image_get_height(vs->vd->server),
2282 VNC_ENCODING_WMVi);
2283 pixel_format_message(vs);
2284 vnc_unlock_output(vs);
2285 vnc_flush(vs);
2286 } else {
2287 set_pixel_conversion(vs);
2288 }
2289 }
2290
2291 static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
2292 {
2293 int i;
2294 uint16_t limit;
2295 VncDisplay *vd = vs->vd;
2296
2297 if (data[0] > 3) {
2298 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
2299 }
2300
2301 switch (data[0]) {
2302 case VNC_MSG_CLIENT_SET_PIXEL_FORMAT:
2303 if (len == 1)
2304 return 20;
2305
2306 set_pixel_format(vs, read_u8(data, 4),
2307 read_u8(data, 6), read_u8(data, 7),
2308 read_u16(data, 8), read_u16(data, 10),
2309 read_u16(data, 12), read_u8(data, 14),
2310 read_u8(data, 15), read_u8(data, 16));
2311 break;
2312 case VNC_MSG_CLIENT_SET_ENCODINGS:
2313 if (len == 1)
2314 return 4;
2315
2316 if (len == 4) {
2317 limit = read_u16(data, 2);
2318 if (limit > 0)
2319 return 4 + (limit * 4);
2320 } else
2321 limit = read_u16(data, 2);
2322
2323 for (i = 0; i < limit; i++) {
2324 int32_t val = read_s32(data, 4 + (i * 4));
2325 memcpy(data + 4 + (i * 4), &val, sizeof(val));
2326 }
2327
2328 set_encodings(vs, (int32_t *)(data + 4), limit);
2329 break;
2330 case VNC_MSG_CLIENT_FRAMEBUFFER_UPDATE_REQUEST:
2331 if (len == 1)
2332 return 10;
2333
2334 framebuffer_update_request(vs,
2335 read_u8(data, 1), read_u16(data, 2), read_u16(data, 4),
2336 read_u16(data, 6), read_u16(data, 8));
2337 break;
2338 case VNC_MSG_CLIENT_KEY_EVENT:
2339 if (len == 1)
2340 return 8;
2341
2342 key_event(vs, read_u8(data, 1), read_u32(data, 4));
2343 break;
2344 case VNC_MSG_CLIENT_POINTER_EVENT:
2345 if (len == 1)
2346 return 6;
2347
2348 pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
2349 break;
2350 case VNC_MSG_CLIENT_CUT_TEXT:
2351 if (len == 1) {
2352 return 8;
2353 }
2354 if (len == 8) {
2355 uint32_t dlen = read_u32(data, 4);
2356 if (dlen > (1 << 20)) {
2357 error_report("vnc: client_cut_text msg payload has %u bytes"
2358 " which exceeds our limit of 1MB.", dlen);
2359 vnc_client_error(vs);
2360 break;
2361 }
2362 if (dlen > 0) {
2363 return 8 + dlen;
2364 }
2365 }
2366
2367 client_cut_text(vs, read_u32(data, 4), data + 8);
2368 break;
2369 case VNC_MSG_CLIENT_QEMU:
2370 if (len == 1)
2371 return 2;
2372
2373 switch (read_u8(data, 1)) {
2374 case VNC_MSG_CLIENT_QEMU_EXT_KEY_EVENT:
2375 if (len == 2)
2376 return 12;
2377
2378 ext_key_event(vs, read_u16(data, 2),
2379 read_u32(data, 4), read_u32(data, 8));
2380 break;
2381 case VNC_MSG_CLIENT_QEMU_AUDIO:
2382 if (len == 2)
2383 return 4;
2384
2385 switch (read_u16 (data, 2)) {
2386 case VNC_MSG_CLIENT_QEMU_AUDIO_ENABLE:
2387 audio_add(vs);
2388 break;
2389 case VNC_MSG_CLIENT_QEMU_AUDIO_DISABLE:
2390 audio_del(vs);
2391 break;
2392 case VNC_MSG_CLIENT_QEMU_AUDIO_SET_FORMAT:
2393 if (len == 4)
2394 return 10;
2395 switch (read_u8(data, 4)) {
2396 case 0: vs->as.fmt = AUD_FMT_U8; break;
2397 case 1: vs->as.fmt = AUD_FMT_S8; break;
2398 case 2: vs->as.fmt = AUD_FMT_U16; break;
2399 case 3: vs->as.fmt = AUD_FMT_S16; break;
2400 case 4: vs->as.fmt = AUD_FMT_U32; break;
2401 case 5: vs->as.fmt = AUD_FMT_S32; break;
2402 default:
2403 VNC_DEBUG("Invalid audio format %d\n", read_u8(data, 4));
2404 vnc_client_error(vs);
2405 break;
2406 }
2407 vs->as.nchannels = read_u8(data, 5);
2408 if (vs->as.nchannels != 1 && vs->as.nchannels != 2) {
2409 VNC_DEBUG("Invalid audio channel count %d\n",
2410 read_u8(data, 5));
2411 vnc_client_error(vs);
2412 break;
2413 }
2414 vs->as.freq = read_u32(data, 6);
2415 break;
2416 default:
2417 VNC_DEBUG("Invalid audio message %d\n", read_u8(data, 4));
2418 vnc_client_error(vs);
2419 break;
2420 }
2421 break;
2422
2423 default:
2424 VNC_DEBUG("Msg: %d\n", read_u16(data, 0));
2425 vnc_client_error(vs);
2426 break;
2427 }
2428 break;
2429 default:
2430 VNC_DEBUG("Msg: %d\n", data[0]);
2431 vnc_client_error(vs);
2432 break;
2433 }
2434
2435 vnc_update_throttle_offset(vs);
2436 vnc_read_when(vs, protocol_client_msg, 1);
2437 return 0;
2438 }
2439
2440 static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
2441 {
2442 char buf[1024];
2443 VncShareMode mode;
2444 int size;
2445
2446 mode = data[0] ? VNC_SHARE_MODE_SHARED : VNC_SHARE_MODE_EXCLUSIVE;
2447 switch (vs->vd->share_policy) {
2448 case VNC_SHARE_POLICY_IGNORE:
2449 /*
2450 * Ignore the shared flag. Nothing to do here.
2451 *
2452 * Doesn't conform to the rfb spec but is traditional qemu
2453 * behavior, thus left here as option for compatibility
2454 * reasons.
2455 */
2456 break;
2457 case VNC_SHARE_POLICY_ALLOW_EXCLUSIVE:
2458 /*
2459 * Policy: Allow clients ask for exclusive access.
2460 *
2461 * Implementation: When a client asks for exclusive access,
2462 * disconnect all others. Shared connects are allowed as long
2463 * as no exclusive connection exists.
2464 *
2465 * This is how the rfb spec suggests to handle the shared flag.
2466 */
2467 if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2468 VncState *client;
2469 QTAILQ_FOREACH(client, &vs->vd->clients, next) {
2470 if (vs == client) {
2471 continue;
2472 }
2473 if (client->share_mode != VNC_SHARE_MODE_EXCLUSIVE &&
2474 client->share_mode != VNC_SHARE_MODE_SHARED) {
2475 continue;
2476 }
2477 vnc_disconnect_start(client);
2478 }
2479 }
2480 if (mode == VNC_SHARE_MODE_SHARED) {
2481 if (vs->vd->num_exclusive > 0) {
2482 vnc_disconnect_start(vs);
2483 return 0;
2484 }
2485 }
2486 break;
2487 case VNC_SHARE_POLICY_FORCE_SHARED:
2488 /*
2489 * Policy: Shared connects only.
2490 * Implementation: Disallow clients asking for exclusive access.
2491 *
2492 * Useful for shared desktop sessions where you don't want
2493 * someone forgetting to say -shared when running the vnc
2494 * client disconnect everybody else.
2495 */
2496 if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2497 vnc_disconnect_start(vs);
2498 return 0;
2499 }
2500 break;
2501 }
2502 vnc_set_share_mode(vs, mode);
2503
2504 if (vs->vd->num_shared > vs->vd->connections_limit) {
2505 vnc_disconnect_start(vs);
2506 return 0;
2507 }
2508
2509 assert(pixman_image_get_width(vs->vd->server) < 65536 &&
2510 pixman_image_get_width(vs->vd->server) >= 0);
2511 assert(pixman_image_get_height(vs->vd->server) < 65536 &&
2512 pixman_image_get_height(vs->vd->server) >= 0);
2513 vs->client_width = pixman_image_get_width(vs->vd->server);
2514 vs->client_height = pixman_image_get_height(vs->vd->server);
2515 vnc_write_u16(vs, vs->client_width);
2516 vnc_write_u16(vs, vs->client_height);
2517
2518 pixel_format_message(vs);
2519
2520 if (qemu_name) {
2521 size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
2522 if (size > sizeof(buf)) {
2523 size = sizeof(buf);
2524 }
2525 } else {
2526 size = snprintf(buf, sizeof(buf), "QEMU");
2527 }
2528
2529 vnc_write_u32(vs, size);
2530 vnc_write(vs, buf, size);
2531 vnc_flush(vs);
2532
2533 vnc_client_cache_auth(vs);
2534 vnc_qmp_event(vs, QAPI_EVENT_VNC_INITIALIZED);
2535
2536 vnc_read_when(vs, protocol_client_msg, 1);
2537
2538 return 0;
2539 }
2540
2541 void start_client_init(VncState *vs)
2542 {
2543 vnc_read_when(vs, protocol_client_init, 1);
2544 }
2545
2546 static void make_challenge(VncState *vs)
2547 {
2548 int i;
2549
2550 srand(time(NULL)+getpid()+getpid()*987654+rand());
2551
2552 for (i = 0 ; i < sizeof(vs->challenge) ; i++)
2553 vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
2554 }
2555
2556 static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
2557 {
2558 unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
2559 size_t i, pwlen;
2560 unsigned char key[8];
2561 time_t now = time(NULL);
2562 QCryptoCipher *cipher = NULL;
2563 Error *err = NULL;
2564
2565 if (!vs->vd->password) {
2566 trace_vnc_auth_fail(vs, vs->auth, "password is not set", "");
2567 goto reject;
2568 }
2569 if (vs->vd->expires < now) {
2570 trace_vnc_auth_fail(vs, vs->auth, "password is expired", "");
2571 goto reject;
2572 }
2573
2574 memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
2575
2576 /* Calculate the expected challenge response */
2577 pwlen = strlen(vs->vd->password);
2578 for (i=0; i<sizeof(key); i++)
2579 key[i] = i<pwlen ? vs->vd->password[i] : 0;
2580
2581 cipher = qcrypto_cipher_new(
2582 QCRYPTO_CIPHER_ALG_DES_RFB,
2583 QCRYPTO_CIPHER_MODE_ECB,
2584 key, G_N_ELEMENTS(key),
2585 &err);
2586 if (!cipher) {
2587 trace_vnc_auth_fail(vs, vs->auth, "cannot create cipher",
2588 error_get_pretty(err));
2589 error_free(err);
2590 goto reject;
2591 }
2592
2593 if (qcrypto_cipher_encrypt(cipher,
2594 vs->challenge,
2595 response,
2596 VNC_AUTH_CHALLENGE_SIZE,
2597 &err) < 0) {
2598 trace_vnc_auth_fail(vs, vs->auth, "cannot encrypt challenge response",
2599 error_get_pretty(err));
2600 error_free(err);
2601 goto reject;
2602 }
2603
2604 /* Compare expected vs actual challenge response */
2605 if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) {
2606 trace_vnc_auth_fail(vs, vs->auth, "mis-matched challenge response", "");
2607 goto reject;
2608 } else {
2609 trace_vnc_auth_pass(vs, vs->auth);
2610 vnc_write_u32(vs, 0); /* Accept auth */
2611 vnc_flush(vs);
2612
2613 start_client_init(vs);
2614 }
2615
2616 qcrypto_cipher_free(cipher);
2617 return 0;
2618
2619 reject:
2620 vnc_write_u32(vs, 1); /* Reject auth */
2621 if (vs->minor >= 8) {
2622 static const char err[] = "Authentication failed";
2623 vnc_write_u32(vs, sizeof(err));
2624 vnc_write(vs, err, sizeof(err));
2625 }
2626 vnc_flush(vs);
2627 vnc_client_error(vs);
2628 qcrypto_cipher_free(cipher);
2629 return 0;
2630 }
2631
2632 void start_auth_vnc(VncState *vs)
2633 {
2634 make_challenge(vs);
2635 /* Send client a 'random' challenge */
2636 vnc_write(vs, vs->challenge, sizeof(vs->challenge));
2637 vnc_flush(vs);
2638
2639 vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge));
2640 }
2641
2642
2643 static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
2644 {
2645 /* We only advertise 1 auth scheme at a time, so client
2646 * must pick the one we sent. Verify this */
2647 if (data[0] != vs->auth) { /* Reject auth */
2648 trace_vnc_auth_reject(vs, vs->auth, (int)data[0]);
2649 vnc_write_u32(vs, 1);
2650 if (vs->minor >= 8) {
2651 static const char err[] = "Authentication failed";
2652 vnc_write_u32(vs, sizeof(err));
2653 vnc_write(vs, err, sizeof(err));
2654 }
2655 vnc_client_error(vs);
2656 } else { /* Accept requested auth */
2657 trace_vnc_auth_start(vs, vs->auth);
2658 switch (vs->auth) {
2659 case VNC_AUTH_NONE:
2660 if (vs->minor >= 8) {
2661 vnc_write_u32(vs, 0); /* Accept auth completion */
2662 vnc_flush(vs);
2663 }
2664 trace_vnc_auth_pass(vs, vs->auth);
2665 start_client_init(vs);
2666 break;
2667
2668 case VNC_AUTH_VNC:
2669 start_auth_vnc(vs);
2670 break;
2671
2672 case VNC_AUTH_VENCRYPT:
2673 start_auth_vencrypt(vs);
2674 break;
2675
2676 #ifdef CONFIG_VNC_SASL
2677 case VNC_AUTH_SASL:
2678 start_auth_sasl(vs);
2679 break;
2680 #endif /* CONFIG_VNC_SASL */
2681
2682 default: /* Should not be possible, but just in case */
2683 trace_vnc_auth_fail(vs, vs->auth, "Unhandled auth method", "");
2684 vnc_write_u8(vs, 1);
2685 if (vs->minor >= 8) {
2686 static const char err[] = "Authentication failed";
2687 vnc_write_u32(vs, sizeof(err));
2688 vnc_write(vs, err, sizeof(err));
2689 }
2690 vnc_client_error(vs);
2691 }
2692 }
2693 return 0;
2694 }
2695
2696 static int protocol_version(VncState *vs, uint8_t *version, size_t len)
2697 {
2698 char local[13];
2699
2700 memcpy(local, version, 12);
2701 local[12] = 0;
2702
2703 if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) {
2704 VNC_DEBUG("Malformed protocol version %s\n", local);
2705 vnc_client_error(vs);
2706 return 0;
2707 }
2708 VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor);
2709 if (vs->major != 3 ||
2710 (vs->minor != 3 &&
2711 vs->minor != 4 &&
2712 vs->minor != 5 &&
2713 vs->minor != 7 &&
2714 vs->minor != 8)) {
2715 VNC_DEBUG("Unsupported client version\n");
2716 vnc_write_u32(vs, VNC_AUTH_INVALID);
2717 vnc_flush(vs);
2718 vnc_client_error(vs);
2719 return 0;
2720 }
2721 /* Some broken clients report v3.4 or v3.5, which spec requires to be treated
2722 * as equivalent to v3.3 by servers
2723 */
2724 if (vs->minor == 4 || vs->minor == 5)
2725 vs->minor = 3;
2726
2727 if (vs->minor == 3) {
2728 trace_vnc_auth_start(vs, vs->auth);
2729 if (vs->auth == VNC_AUTH_NONE) {
2730 vnc_write_u32(vs, vs->auth);
2731 vnc_flush(vs);
2732 trace_vnc_auth_pass(vs, vs->auth);
2733 start_client_init(vs);
2734 } else if (vs->auth == VNC_AUTH_VNC) {
2735 VNC_DEBUG("Tell client VNC auth\n");
2736 vnc_write_u32(vs, vs->auth);
2737 vnc_flush(vs);
2738 start_auth_vnc(vs);
2739 } else {
2740 trace_vnc_auth_fail(vs, vs->auth,
2741 "Unsupported auth method for v3.3", "");
2742 vnc_write_u32(vs, VNC_AUTH_INVALID);
2743 vnc_flush(vs);
2744 vnc_client_error(vs);
2745 }
2746 } else {
2747 vnc_write_u8(vs, 1); /* num auth */
2748 vnc_write_u8(vs, vs->auth);
2749 vnc_read_when(vs, protocol_client_auth, 1);
2750 vnc_flush(vs);
2751 }
2752
2753 return 0;
2754 }
2755
2756 static VncRectStat *vnc_stat_rect(VncDisplay *vd, int x, int y)
2757 {
2758 struct VncSurface *vs = &vd->guest;
2759
2760 return &vs->stats[y / VNC_STAT_RECT][x / VNC_STAT_RECT];
2761 }
2762
2763 void vnc_sent_lossy_rect(VncState *vs, int x, int y, int w, int h)
2764 {
2765 int i, j;
2766
2767 w = (x + w) / VNC_STAT_RECT;
2768 h = (y + h) / VNC_STAT_RECT;
2769 x /= VNC_STAT_RECT;
2770 y /= VNC_STAT_RECT;
2771
2772 for (j = y; j <= h; j++) {
2773 for (i = x; i <= w; i++) {
2774 vs->lossy_rect[j][i] = 1;
2775 }
2776 }
2777 }
2778
2779 static int vnc_refresh_lossy_rect(VncDisplay *vd, int x, int y)
2780 {
2781 VncState *vs;
2782 int sty = y / VNC_STAT_RECT;
2783 int stx = x / VNC_STAT_RECT;
2784 int has_dirty = 0;
2785
2786 y = QEMU_ALIGN_DOWN(y, VNC_STAT_RECT);
2787 x = QEMU_ALIGN_DOWN(x, VNC_STAT_RECT);
2788
2789 QTAILQ_FOREACH(vs, &vd->clients, next) {
2790 int j;
2791
2792 /* kernel send buffers are full -> refresh later */
2793 if (vs->output.offset) {
2794 continue;
2795 }
2796
2797 if (!vs->lossy_rect[sty][stx]) {
2798 continue;
2799 }
2800
2801 vs->lossy_rect[sty][stx] = 0;
2802 for (j = 0; j < VNC_STAT_RECT; ++j) {
2803 bitmap_set(vs->dirty[y + j],
2804 x / VNC_DIRTY_PIXELS_PER_BIT,
2805 VNC_STAT_RECT / VNC_DIRTY_PIXELS_PER_BIT);
2806 }
2807 has_dirty++;
2808 }
2809
2810 return has_dirty;
2811 }
2812
2813 static int vnc_update_stats(VncDisplay *vd, struct timeval * tv)
2814 {
2815 int width = MIN(pixman_image_get_width(vd->guest.fb),
2816 pixman_image_get_width(vd->server));
2817 int height = MIN(pixman_image_get_height(vd->guest.fb),
2818 pixman_image_get_height(vd->server));
2819 int x, y;
2820 struct timeval res;
2821 int has_dirty = 0;
2822
2823 for (y = 0; y < height; y += VNC_STAT_RECT) {
2824 for (x = 0; x < width; x += VNC_STAT_RECT) {
2825 VncRectStat *rect = vnc_stat_rect(vd, x, y);
2826
2827 rect->updated = false;
2828 }
2829 }
2830
2831 qemu_timersub(tv, &VNC_REFRESH_STATS, &res);
2832
2833 if (timercmp(&vd->guest.last_freq_check, &res, >)) {
2834 return has_dirty;
2835 }
2836 vd->guest.last_freq_check = *tv;
2837
2838 for (y = 0; y < height; y += VNC_STAT_RECT) {
2839 for (x = 0; x < width; x += VNC_STAT_RECT) {
2840 VncRectStat *rect= vnc_stat_rect(vd, x, y);
2841 int count = ARRAY_SIZE(rect->times);
2842 struct timeval min, max;
2843
2844 if (!timerisset(&rect->times[count - 1])) {
2845 continue ;
2846 }
2847
2848 max = rect->times[(rect->idx + count - 1) % count];
2849 qemu_timersub(tv, &max, &res);
2850
2851 if (timercmp(&res, &VNC_REFRESH_LOSSY, >)) {
2852 rect->freq = 0;
2853 has_dirty += vnc_refresh_lossy_rect(vd, x, y);
2854 memset(rect->times, 0, sizeof (rect->times));
2855 continue ;
2856 }
2857
2858 min = rect->times[rect->idx];
2859 max = rect->times[(rect->idx + count - 1) % count];
2860 qemu_timersub(&max, &min, &res);
2861
2862 rect->freq = res.tv_sec + res.tv_usec / 1000000.;
2863 rect->freq /= count;
2864 rect->freq = 1. / rect->freq;
2865 }
2866 }
2867 return has_dirty;
2868 }
2869
2870 double vnc_update_freq(VncState *vs, int x, int y, int w, int h)
2871 {
2872 int i, j;
2873 double total = 0;
2874 int num = 0;
2875
2876 x = QEMU_ALIGN_DOWN(x, VNC_STAT_RECT);
2877 y = QEMU_ALIGN_DOWN(y, VNC_STAT_RECT);
2878
2879 for (j = y; j <= y + h; j += VNC_STAT_RECT) {
2880 for (i = x; i <= x + w; i += VNC_STAT_RECT) {
2881 total += vnc_stat_rect(vs->vd, i, j)->freq;
2882 num++;
2883 }
2884 }
2885
2886 if (num) {
2887 return total / num;
2888 } else {
2889 return 0;
2890 }
2891 }
2892
2893 static void vnc_rect_updated(VncDisplay *vd, int x, int y, struct timeval * tv)
2894 {
2895 VncRectStat *rect;
2896
2897 rect = vnc_stat_rect(vd, x, y);
2898 if (rect->updated) {
2899 return ;
2900 }
2901 rect->times[rect->idx] = *tv;
2902 rect->idx = (rect->idx + 1) % ARRAY_SIZE(rect->times);
2903 rect->updated = true;
2904 }
2905
2906 static int vnc_refresh_server_surface(VncDisplay *vd)
2907 {
2908 int width = MIN(pixman_image_get_width(vd->guest.fb),
2909 pixman_image_get_width(vd->server));
2910 int height = MIN(pixman_image_get_height(vd->guest.fb),
2911 pixman_image_get_height(vd->server));
2912 int cmp_bytes, server_stride, line_bytes, guest_ll, guest_stride, y = 0;
2913 uint8_t *guest_row0 = NULL, *server_row0;
2914 VncState *vs;
2915 int has_dirty = 0;
2916 pixman_image_t *tmpbuf = NULL;
2917
2918 struct timeval tv = { 0, 0 };
2919
2920 if (!vd->non_adaptive) {
2921 gettimeofday(&tv, NULL);
2922 has_dirty = vnc_update_stats(vd, &tv);
2923 }
2924
2925 /*
2926 * Walk through the guest dirty map.
2927 * Check and copy modified bits from guest to server surface.
2928 * Update server dirty map.
2929 */
2930 server_row0 = (uint8_t *)pixman_image_get_data(vd->server);
2931 server_stride = guest_stride = guest_ll =
2932 pixman_image_get_stride(vd->server);
2933 cmp_bytes = MIN(VNC_DIRTY_PIXELS_PER_BIT * VNC_SERVER_FB_BYTES,
2934 server_stride);
2935 if (vd->guest.format != VNC_SERVER_FB_FORMAT) {
2936 int width = pixman_image_get_width(vd->server);
2937 tmpbuf = qemu_pixman_linebuf_create(VNC_SERVER_FB_FORMAT, width);
2938 } else {
2939 int guest_bpp =
2940 PIXMAN_FORMAT_BPP(pixman_image_get_format(vd->guest.fb));
2941 guest_row0 = (uint8_t *)pixman_image_get_data(vd->guest.fb);
2942 guest_stride = pixman_image_get_stride(vd->guest.fb);
2943 guest_ll = pixman_image_get_width(vd->guest.fb) * (DIV_ROUND_UP(guest_bpp, 8));
2944 }
2945 line_bytes = MIN(server_stride, guest_ll);
2946
2947 for (;;) {
2948 int x;
2949 uint8_t *guest_ptr, *server_ptr;
2950 unsigned long offset = find_next_bit((unsigned long *) &vd->guest.dirty,
2951 height * VNC_DIRTY_BPL(&vd->guest),
2952 y * VNC_DIRTY_BPL(&vd->guest));
2953 if (offset == height * VNC_DIRTY_BPL(&vd->guest)) {
2954 /* no more dirty bits */
2955 break;
2956 }
2957 y = offset / VNC_DIRTY_BPL(&vd->guest);
2958 x = offset % VNC_DIRTY_BPL(&vd->guest);
2959
2960 server_ptr = server_row0 + y * server_stride + x * cmp_bytes;
2961
2962 if (vd->guest.format != VNC_SERVER_FB_FORMAT) {
2963 qemu_pixman_linebuf_fill(tmpbuf, vd->guest.fb, width, 0, y);
2964 guest_ptr = (uint8_t *)pixman_image_get_data(tmpbuf);
2965 } else {
2966 guest_ptr = guest_row0 + y * guest_stride;
2967 }
2968 guest_ptr += x * cmp_bytes;
2969
2970 for (; x < DIV_ROUND_UP(width, VNC_DIRTY_PIXELS_PER_BIT);
2971 x++, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) {
2972 int _cmp_bytes = cmp_bytes;
2973 if (!test_and_clear_bit(x, vd->guest.dirty[y])) {
2974 continue;
2975 }
2976 if ((x + 1) * cmp_bytes > line_bytes) {
2977 _cmp_bytes = line_bytes - x * cmp_bytes;
2978 }
2979 assert(_cmp_bytes >= 0);
2980 if (memcmp(server_ptr, guest_ptr, _cmp_bytes) == 0) {
2981 continue;
2982 }
2983 memcpy(server_ptr, guest_ptr, _cmp_bytes);
2984 if (!vd->non_adaptive) {
2985 vnc_rect_updated(vd, x * VNC_DIRTY_PIXELS_PER_BIT,
2986 y, &tv);
2987 }
2988 QTAILQ_FOREACH(vs, &vd->clients, next) {
2989 set_bit(x, vs->dirty[y]);
2990 }
2991 has_dirty++;
2992 }
2993
2994 y++;
2995 }
2996 qemu_pixman_image_unref(tmpbuf);
2997 return has_dirty;
2998 }
2999
3000 static void vnc_refresh(DisplayChangeListener *dcl)
3001 {
3002 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
3003 VncState *vs, *vn;
3004 int has_dirty, rects = 0;
3005
3006 if (QTAILQ_EMPTY(&vd->clients)) {
3007 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_MAX);
3008 return;
3009 }
3010
3011 graphic_hw_update(vd->dcl.con);
3012
3013 if (vnc_trylock_display(vd)) {
3014 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
3015 return;
3016 }
3017
3018 has_dirty = vnc_refresh_server_surface(vd);
3019 vnc_unlock_display(vd);
3020
3021 QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {
3022 rects += vnc_update_client(vs, has_dirty);
3023 /* vs might be free()ed here */
3024 }
3025
3026 if (has_dirty && rects) {
3027 vd->dcl.update_interval /= 2;
3028 if (vd->dcl.update_interval < VNC_REFRESH_INTERVAL_BASE) {
3029 vd->dcl.update_interval = VNC_REFRESH_INTERVAL_BASE;
3030 }
3031 } else {
3032 vd->dcl.update_interval += VNC_REFRESH_INTERVAL_INC;
3033 if (vd->dcl.update_interval > VNC_REFRESH_INTERVAL_MAX) {
3034 vd->dcl.update_interval = VNC_REFRESH_INTERVAL_MAX;
3035 }
3036 }
3037 }
3038
3039 static void vnc_connect(VncDisplay *vd, QIOChannelSocket *sioc,
3040 bool skipauth, bool websocket)
3041 {
3042 VncState *vs = g_new0(VncState, 1);
3043 bool first_client = QTAILQ_EMPTY(&vd->clients);
3044 int i;
3045
3046 trace_vnc_client_connect(vs, sioc);
3047 vs->sioc = sioc;
3048 object_ref(OBJECT(vs->sioc));
3049 vs->ioc = QIO_CHANNEL(sioc);
3050 object_ref(OBJECT(vs->ioc));
3051 vs->vd = vd;
3052
3053 buffer_init(&vs->input, "vnc-input/%p", sioc);
3054 buffer_init(&vs->output, "vnc-output/%p", sioc);
3055 buffer_init(&vs->jobs_buffer, "vnc-jobs_buffer/%p", sioc);
3056
3057 buffer_init(&vs->tight.tight, "vnc-tight/%p", sioc);
3058 buffer_init(&vs->tight.zlib, "vnc-tight-zlib/%p", sioc);
3059 buffer_init(&vs->tight.gradient, "vnc-tight-gradient/%p", sioc);
3060 #ifdef CONFIG_VNC_JPEG
3061 buffer_init(&vs->tight.jpeg, "vnc-tight-jpeg/%p", sioc);
3062 #endif
3063 #ifdef CONFIG_VNC_PNG
3064 buffer_init(&vs->tight.png, "vnc-tight-png/%p", sioc);
3065 #endif
3066 buffer_init(&vs->zlib.zlib, "vnc-zlib/%p", sioc);
3067 buffer_init(&vs->zrle.zrle, "vnc-zrle/%p", sioc);
3068 buffer_init(&vs->zrle.fb, "vnc-zrle-fb/%p", sioc);
3069 buffer_init(&vs->zrle.zlib, "vnc-zrle-zlib/%p", sioc);
3070
3071 if (skipauth) {
3072 vs->auth = VNC_AUTH_NONE;
3073 vs->subauth = VNC_AUTH_INVALID;
3074 } else {
3075 if (websocket) {
3076 vs->auth = vd->ws_auth;
3077 vs->subauth = VNC_AUTH_INVALID;
3078 } else {
3079 vs->auth = vd->auth;
3080 vs->subauth = vd->subauth;
3081 }
3082 }
3083 VNC_DEBUG("Client sioc=%p ws=%d auth=%d subauth=%d\n",
3084 sioc, websocket, vs->auth, vs->subauth);
3085
3086 vs->lossy_rect = g_malloc0(VNC_STAT_ROWS * sizeof (*vs->lossy_rect));
3087 for (i = 0; i < VNC_STAT_ROWS; ++i) {
3088 vs->lossy_rect[i] = g_new0(uint8_t, VNC_STAT_COLS);
3089 }
3090
3091 VNC_DEBUG("New client on socket %p\n", vs->sioc);
3092 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
3093 qio_channel_set_blocking(vs->ioc, false, NULL);
3094 if (vs->ioc_tag) {
3095 g_source_remove(vs->ioc_tag);
3096 }
3097 if (websocket) {
3098 vs->websocket = 1;
3099 if (vd->tlscreds) {
3100 vs->ioc_tag = qio_channel_add_watch(
3101 vs->ioc, G_IO_IN, vncws_tls_handshake_io, vs, NULL);
3102 } else {
3103 vs->ioc_tag = qio_channel_add_watch(
3104 vs->ioc, G_IO_IN, vncws_handshake_io, vs, NULL);
3105 }
3106 } else {
3107 vs->ioc_tag = qio_channel_add_watch(
3108 vs->ioc, G_IO_IN, vnc_client_io, vs, NULL);
3109 }
3110
3111 vnc_client_cache_addr(vs);
3112 vnc_qmp_event(vs, QAPI_EVENT_VNC_CONNECTED);
3113 vnc_set_share_mode(vs, VNC_SHARE_MODE_CONNECTING);
3114
3115 vs->last_x = -1;
3116 vs->last_y = -1;
3117
3118 vs->as.freq = 44100;
3119 vs->as.nchannels = 2;
3120 vs->as.fmt = AUD_FMT_S16;
3121 vs->as.endianness = 0;
3122
3123 qemu_mutex_init(&vs->output_mutex);
3124 vs->bh = qemu_bh_new(vnc_jobs_bh, vs);
3125
3126 QTAILQ_INSERT_TAIL(&vd->clients, vs, next);
3127 if (first_client) {
3128 vnc_update_server_surface(vd);
3129 }
3130
3131 graphic_hw_update(vd->dcl.con);
3132
3133 if (!vs->websocket) {
3134 vnc_start_protocol(vs);
3135 }
3136
3137 if (vd->num_connecting > vd->connections_limit) {
3138 QTAILQ_FOREACH(vs, &vd->clients, next) {
3139 if (vs->share_mode == VNC_SHARE_MODE_CONNECTING) {
3140 vnc_disconnect_start(vs);
3141 return;
3142 }
3143 }
3144 }
3145 }
3146
3147 void vnc_start_protocol(VncState *vs)
3148 {
3149 vnc_write(vs, "RFB 003.008\n", 12);
3150 vnc_flush(vs);
3151 vnc_read_when(vs, protocol_version, 12);
3152
3153 vs->mouse_mode_notifier.notify = check_pointer_type_change;
3154 qemu_add_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
3155 }
3156
3157 static void vnc_listen_io(QIONetListener *listener,
3158 QIOChannelSocket *cioc,
3159 void *opaque)
3160 {
3161 VncDisplay *vd = opaque;
3162 bool isWebsock = listener == vd->wslistener;
3163
3164 qio_channel_set_name(QIO_CHANNEL(cioc),
3165 isWebsock ? "vnc-ws-server" : "vnc-server");
3166 qio_channel_set_delay(QIO_CHANNEL(cioc), false);
3167 vnc_connect(vd, cioc, false, isWebsock);
3168 }
3169
3170 static const DisplayChangeListenerOps dcl_ops = {
3171 .dpy_name = "vnc",
3172 .dpy_refresh = vnc_refresh,
3173 .dpy_gfx_update = vnc_dpy_update,
3174 .dpy_gfx_switch = vnc_dpy_switch,
3175 .dpy_gfx_check_format = qemu_pixman_check_format,
3176 .dpy_mouse_set = vnc_mouse_set,
3177 .dpy_cursor_define = vnc_dpy_cursor_define,
3178 };
3179
3180 void vnc_display_init(const char *id)
3181 {
3182 VncDisplay *vd;
3183
3184 if (vnc_display_find(id) != NULL) {
3185 return;
3186 }
3187 vd = g_malloc0(sizeof(*vd));
3188
3189 vd->id = strdup(id);
3190 QTAILQ_INSERT_TAIL(&vnc_displays, vd, next);
3191
3192 QTAILQ_INIT(&vd->clients);
3193 vd->expires = TIME_MAX;
3194
3195 if (keyboard_layout) {
3196 trace_vnc_key_map_init(keyboard_layout);
3197 vd->kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout);
3198 } else {
3199 vd->kbd_layout = init_keyboard_layout(name2keysym, "en-us");
3200 }
3201
3202 if (!vd->kbd_layout) {
3203 exit(1);
3204 }
3205
3206 vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
3207 vd->connections_limit = 32;
3208
3209 qemu_mutex_init(&vd->mutex);
3210 vnc_start_worker_thread();
3211
3212 vd->dcl.ops = &dcl_ops;
3213 register_displaychangelistener(&vd->dcl);
3214 }
3215
3216
3217 static void vnc_display_close(VncDisplay *vd)
3218 {
3219 if (!vd) {
3220 return;
3221 }
3222 vd->is_unix = false;
3223
3224 if (vd->listener) {
3225 qio_net_listener_disconnect(vd->listener);
3226 object_unref(OBJECT(vd->listener));
3227 }
3228 vd->listener = NULL;
3229
3230 if (vd->wslistener) {
3231 qio_net_listener_disconnect(vd->wslistener);
3232 object_unref(OBJECT(vd->wslistener));
3233 }
3234 vd->wslistener = NULL;
3235
3236 vd->auth = VNC_AUTH_INVALID;
3237 vd->subauth = VNC_AUTH_INVALID;
3238 if (vd->tlscreds) {
3239 object_unparent(OBJECT(vd->tlscreds));
3240 vd->tlscreds = NULL;
3241 }
3242 g_free(vd->tlsaclname);
3243 vd->tlsaclname = NULL;
3244 if (vd->lock_key_sync) {
3245 qemu_remove_led_event_handler(vd->led);
3246 vd->led = NULL;
3247 }
3248 }
3249
3250 int vnc_display_password(const char *id, const char *password)
3251 {
3252 VncDisplay *vd = vnc_display_find(id);
3253
3254 if (!vd) {
3255 return -EINVAL;
3256 }
3257 if (vd->auth == VNC_AUTH_NONE) {
3258 error_printf_unless_qmp("If you want use passwords please enable "
3259 "password auth using '-vnc ${dpy},password'.\n");
3260 return -EINVAL;
3261 }
3262
3263 g_free(vd->password);
3264 vd->password = g_strdup(password);
3265
3266 return 0;
3267 }
3268
3269 int vnc_display_pw_expire(const char *id, time_t expires)
3270 {
3271 VncDisplay *vd = vnc_display_find(id);
3272
3273 if (!vd) {
3274 return -EINVAL;
3275 }
3276
3277 vd->expires = expires;
3278 return 0;
3279 }
3280
3281 static void vnc_display_print_local_addr(VncDisplay *vd)
3282 {
3283 SocketAddress *addr;
3284 Error *err = NULL;
3285
3286 if (!vd->listener || !vd->listener->nsioc) {
3287 return;
3288 }
3289
3290 addr = qio_channel_socket_get_local_address(vd->listener->sioc[0], &err);
3291 if (!addr) {
3292 return;
3293 }
3294
3295 if (addr->type != SOCKET_ADDRESS_TYPE_INET) {
3296 qapi_free_SocketAddress(addr);
3297 return;
3298 }
3299 error_printf_unless_qmp("VNC server running on %s:%s\n",
3300 addr->u.inet.host,
3301 addr->u.inet.port);
3302 qapi_free_SocketAddress(addr);
3303 }
3304
3305 static QemuOptsList qemu_vnc_opts = {
3306 .name = "vnc",
3307 .head = QTAILQ_HEAD_INITIALIZER(qemu_vnc_opts.head),
3308 .implied_opt_name = "vnc",
3309 .desc = {
3310 {
3311 .name = "vnc",
3312 .type = QEMU_OPT_STRING,
3313 },{
3314 .name = "websocket",
3315 .type = QEMU_OPT_STRING,
3316 },{
3317 .name = "tls-creds",
3318 .type = QEMU_OPT_STRING,
3319 },{
3320 /* Deprecated in favour of tls-creds */
3321 .name = "x509",
3322 .type = QEMU_OPT_STRING,
3323 },{
3324 .name = "share",
3325 .type = QEMU_OPT_STRING,
3326 },{
3327 .name = "display",
3328 .type = QEMU_OPT_STRING,
3329 },{
3330 .name = "head",
3331 .type = QEMU_OPT_NUMBER,
3332 },{
3333 .name = "connections",
3334 .type = QEMU_OPT_NUMBER,
3335 },{
3336 .name = "to",
3337 .type = QEMU_OPT_NUMBER,
3338 },{
3339 .name = "ipv4",
3340 .type = QEMU_OPT_BOOL,
3341 },{
3342 .name = "ipv6",
3343 .type = QEMU_OPT_BOOL,
3344 },{
3345 .name = "password",
3346 .type = QEMU_OPT_BOOL,
3347 },{
3348 .name = "reverse",
3349 .type = QEMU_OPT_BOOL,
3350 },{
3351 .name = "lock-key-sync",
3352 .type = QEMU_OPT_BOOL,
3353 },{
3354 .name = "key-delay-ms",
3355 .type = QEMU_OPT_NUMBER,
3356 },{
3357 .name = "sasl",
3358 .type = QEMU_OPT_BOOL,
3359 },{
3360 /* Deprecated in favour of tls-creds */
3361 .name = "tls",
3362 .type = QEMU_OPT_BOOL,
3363 },{
3364 /* Deprecated in favour of tls-creds */
3365 .name = "x509verify",
3366 .type = QEMU_OPT_STRING,
3367 },{
3368 .name = "acl",
3369 .type = QEMU_OPT_BOOL,
3370 },{
3371 .name = "lossy",
3372 .type = QEMU_OPT_BOOL,
3373 },{
3374 .name = "non-adaptive",
3375 .type = QEMU_OPT_BOOL,
3376 },
3377 { /* end of list */ }
3378 },
3379 };
3380
3381
3382 static int
3383 vnc_display_setup_auth(int *auth,
3384 int *subauth,
3385 QCryptoTLSCreds *tlscreds,
3386 bool password,
3387 bool sasl,
3388 bool websocket,
3389 Error **errp)
3390 {
3391 /*
3392 * We have a choice of 3 authentication options
3393 *
3394 * 1. none
3395 * 2. vnc
3396 * 3. sasl
3397 *
3398 * The channel can be run in 2 modes
3399 *
3400 * 1. clear
3401 * 2. tls
3402 *
3403 * And TLS can use 2 types of credentials
3404 *
3405 * 1. anon
3406 * 2. x509
3407 *
3408 * We thus have 9 possible logical combinations
3409 *
3410 * 1. clear + none
3411 * 2. clear + vnc
3412 * 3. clear + sasl
3413 * 4. tls + anon + none
3414 * 5. tls + anon + vnc
3415 * 6. tls + anon + sasl
3416 * 7. tls + x509 + none
3417 * 8. tls + x509 + vnc
3418 * 9. tls + x509 + sasl
3419 *
3420 * These need to be mapped into the VNC auth schemes
3421 * in an appropriate manner. In regular VNC, all the
3422 * TLS options get mapped into VNC_AUTH_VENCRYPT
3423 * sub-auth types.
3424 *
3425 * In websockets, the https:// protocol already provides
3426 * TLS support, so there is no need to make use of the
3427 * VeNCrypt extension. Furthermore, websockets browser
3428 * clients could not use VeNCrypt even if they wanted to,
3429 * as they cannot control when the TLS handshake takes
3430 * place. Thus there is no option but to rely on https://,
3431 * meaning combinations 4->6 and 7->9 will be mapped to
3432 * VNC auth schemes in the same way as combos 1->3.
3433 *
3434 * Regardless of fact that we have a different mapping to
3435 * VNC auth mechs for plain VNC vs websockets VNC, the end
3436 * result has the same security characteristics.
3437 */
3438 if (websocket || !tlscreds) {
3439 if (password) {
3440 VNC_DEBUG("Initializing VNC server with password auth\n");
3441 *auth = VNC_AUTH_VNC;
3442 } else if (sasl) {
3443 VNC_DEBUG("Initializing VNC server with SASL auth\n");
3444 *auth = VNC_AUTH_SASL;
3445 } else {
3446 VNC_DEBUG("Initializing VNC server with no auth\n");
3447 *auth = VNC_AUTH_NONE;
3448 }
3449 *subauth = VNC_AUTH_INVALID;
3450 } else {
3451 bool is_x509 = object_dynamic_cast(OBJECT(tlscreds),
3452 TYPE_QCRYPTO_TLS_CREDS_X509) != NULL;
3453 bool is_anon = object_dynamic_cast(OBJECT(tlscreds),
3454 TYPE_QCRYPTO_TLS_CREDS_ANON) != NULL;
3455
3456 if (!is_x509 && !is_anon) {
3457 error_setg(errp,
3458 "Unsupported TLS cred type %s",
3459 object_get_typename(OBJECT(tlscreds)));
3460 return -1;
3461 }
3462 *auth = VNC_AUTH_VENCRYPT;
3463 if (password) {
3464 if (is_x509) {
3465 VNC_DEBUG("Initializing VNC server with x509 password auth\n");
3466 *subauth = VNC_AUTH_VENCRYPT_X509VNC;
3467 } else {
3468 VNC_DEBUG("Initializing VNC server with TLS password auth\n");
3469 *subauth = VNC_AUTH_VENCRYPT_TLSVNC;
3470 }
3471
3472 } else if (sasl) {
3473 if (is_x509) {
3474 VNC_DEBUG("Initializing VNC server with x509 SASL auth\n");
3475 *subauth = VNC_AUTH_VENCRYPT_X509SASL;
3476 } else {
3477 VNC_DEBUG("Initializing VNC server with TLS SASL auth\n");
3478 *subauth = VNC_AUTH_VENCRYPT_TLSSASL;
3479 }
3480 } else {
3481 if (is_x509) {
3482 VNC_DEBUG("Initializing VNC server with x509 no auth\n");
3483 *subauth = VNC_AUTH_VENCRYPT_X509NONE;
3484 } else {
3485 VNC_DEBUG("Initializing VNC server with TLS no auth\n");
3486 *subauth = VNC_AUTH_VENCRYPT_TLSNONE;
3487 }
3488 }
3489 }
3490 return 0;
3491 }
3492
3493
3494 /*
3495 * Handle back compat with old CLI syntax by creating some
3496 * suitable QCryptoTLSCreds objects
3497 */
3498 static QCryptoTLSCreds *
3499 vnc_display_create_creds(bool x509,
3500 bool x509verify,
3501 const char *dir,
3502 const char *id,
3503 Error **errp)
3504 {
3505 gchar *credsid = g_strdup_printf("tlsvnc%s", id);
3506 Object *parent = object_get_objects_root();
3507 Object *creds;
3508 Error *err = NULL;
3509
3510 if (x509) {
3511 creds = object_new_with_props(TYPE_QCRYPTO_TLS_CREDS_X509,
3512 parent,
3513 credsid,
3514 &err,
3515 "endpoint", "server",
3516 "dir", dir,
3517 "verify-peer", x509verify ? "yes" : "no",
3518 NULL);
3519 } else {
3520 creds = object_new_with_props(TYPE_QCRYPTO_TLS_CREDS_ANON,
3521 parent,
3522 credsid,
3523 &err,
3524 "endpoint", "server",
3525 NULL);
3526 }
3527
3528 g_free(credsid);
3529
3530 if (err) {
3531 error_propagate(errp, err);
3532 return NULL;
3533 }
3534
3535 return QCRYPTO_TLS_CREDS(creds);
3536 }
3537
3538
3539 static int vnc_display_get_address(const char *addrstr,
3540 bool websocket,
3541 bool reverse,
3542 int displaynum,
3543 int to,
3544 bool has_ipv4,
3545 bool has_ipv6,
3546 bool ipv4,
3547 bool ipv6,
3548 SocketAddress **retaddr,
3549 Error **errp)
3550 {
3551 int ret = -1;
3552 SocketAddress *addr = NULL;
3553
3554 addr = g_new0(SocketAddress, 1);
3555
3556 if (strncmp(addrstr, "unix:", 5) == 0) {
3557 addr->type = SOCKET_ADDRESS_TYPE_UNIX;
3558 addr->u.q_unix.path = g_strdup(addrstr + 5);
3559
3560 if (websocket) {
3561 error_setg(errp, "UNIX sockets not supported with websock");
3562 goto cleanup;
3563 }
3564
3565 if (to) {
3566 error_setg(errp, "Port range not support with UNIX socket");
3567 goto cleanup;
3568 }
3569 ret = 0;
3570 } else {
3571 const char *port;
3572 size_t hostlen;
3573 unsigned long long baseport = 0;
3574 InetSocketAddress *inet;
3575
3576 port = strrchr(addrstr, ':');
3577 if (!port) {
3578 if (websocket) {
3579 hostlen = 0;
3580 port = addrstr;
3581 } else {
3582 error_setg(errp, "no vnc port specified");
3583 goto cleanup;
3584 }
3585 } else {
3586 hostlen = port - addrstr;
3587 port++;
3588 if (*port == '\0') {
3589 error_setg(errp, "vnc port cannot be empty");
3590 goto cleanup;
3591 }
3592 }
3593
3594 addr->type = SOCKET_ADDRESS_TYPE_INET;
3595 inet = &addr->u.inet;
3596 if (addrstr[0] == '[' && addrstr[hostlen - 1] == ']') {
3597 inet->host = g_strndup(addrstr + 1, hostlen - 2);
3598 } else {
3599 inet->host = g_strndup(addrstr, hostlen);
3600 }
3601 /* plain VNC port is just an offset, for websocket
3602 * port is absolute */
3603 if (websocket) {
3604 if (g_str_equal(addrstr, "") ||
3605 g_str_equal(addrstr, "on")) {
3606 if (displaynum == -1) {
3607 error_setg(errp, "explicit websocket port is required");
3608 goto cleanup;
3609 }
3610 inet->port = g_strdup_printf(
3611 "%d", displaynum + 5700);
3612 if (to) {
3613 inet->has_to = true;
3614 inet->to = to + 5700;
3615 }
3616 } else {
3617 inet->port = g_strdup(port);
3618 }
3619 } else {
3620 int offset = reverse ? 0 : 5900;
3621 if (parse_uint_full(port, &baseport, 10) < 0) {
3622 error_setg(errp, "can't convert to a number: %s", port);
3623 goto cleanup;
3624 }
3625 if (baseport > 65535 ||
3626 baseport + offset > 65535) {
3627 error_setg(errp, "port %s out of range", port);
3628 goto cleanup;
3629 }
3630 inet->port = g_strdup_printf(
3631 "%d", (int)baseport + offset);
3632
3633 if (to) {
3634 inet->has_to = true;
3635 inet->to = to + offset;
3636 }
3637 }
3638
3639 inet->ipv4 = ipv4;
3640 inet->has_ipv4 = has_ipv4;
3641 inet->ipv6 = ipv6;
3642 inet->has_ipv6 = has_ipv6;
3643
3644 ret = baseport;
3645 }
3646
3647 *retaddr = addr;
3648
3649 cleanup:
3650 if (ret < 0) {
3651 qapi_free_SocketAddress(addr);
3652 }
3653 return ret;
3654 }
3655
3656 static void vnc_free_addresses(SocketAddress ***retsaddr,
3657 size_t *retnsaddr)
3658 {
3659 size_t i;
3660
3661 for (i = 0; i < *retnsaddr; i++) {
3662 qapi_free_SocketAddress((*retsaddr)[i]);
3663 }
3664 g_free(*retsaddr);
3665
3666 *retsaddr = NULL;
3667 *retnsaddr = 0;
3668 }
3669
3670 static int vnc_display_get_addresses(QemuOpts *opts,
3671 bool reverse,
3672 SocketAddress ***retsaddr,
3673 size_t *retnsaddr,
3674 SocketAddress ***retwsaddr,
3675 size_t *retnwsaddr,
3676 Error **errp)
3677 {
3678 SocketAddress *saddr = NULL;
3679 SocketAddress *wsaddr = NULL;
3680 QemuOptsIter addriter;
3681 const char *addr;
3682 int to = qemu_opt_get_number(opts, "to", 0);
3683 bool has_ipv4 = qemu_opt_get(opts, "ipv4");
3684 bool has_ipv6 = qemu_opt_get(opts, "ipv6");
3685 bool ipv4 = qemu_opt_get_bool(opts, "ipv4", false);
3686 bool ipv6 = qemu_opt_get_bool(opts, "ipv6", false);
3687 int displaynum = -1;
3688 int ret = -1;
3689
3690 *retsaddr = NULL;
3691 *retnsaddr = 0;
3692 *retwsaddr = NULL;
3693 *retnwsaddr = 0;
3694
3695 addr = qemu_opt_get(opts, "vnc");
3696 if (addr == NULL || g_str_equal(addr, "none")) {
3697 ret = 0;
3698 goto cleanup;
3699 }
3700 if (qemu_opt_get(opts, "websocket") &&
3701 !qcrypto_hash_supports(QCRYPTO_HASH_ALG_SHA1)) {
3702 error_setg(errp,
3703 "SHA1 hash support is required for websockets");
3704 goto cleanup;
3705 }
3706
3707 qemu_opt_iter_init(&addriter, opts, "vnc");
3708 while ((addr = qemu_opt_iter_next(&addriter)) != NULL) {
3709 int rv;
3710 rv = vnc_display_get_address(addr, false, reverse, 0, to,
3711 has_ipv4, has_ipv6,
3712 ipv4, ipv6,
3713 &saddr, errp);
3714 if (rv < 0) {
3715 goto cleanup;
3716 }
3717 /* Historical compat - first listen address can be used
3718 * to set the default websocket port
3719 */
3720 if (displaynum == -1) {
3721 displaynum = rv;
3722 }
3723 *retsaddr = g_renew(SocketAddress *, *retsaddr, *retnsaddr + 1);
3724 (*retsaddr)[(*retnsaddr)++] = saddr;
3725 }
3726
3727 /* If we had multiple primary displays, we don't do defaults
3728 * for websocket, and require explicit config instead. */
3729 if (*retnsaddr > 1) {
3730 displaynum = -1;
3731 }
3732
3733 qemu_opt_iter_init(&addriter, opts, "websocket");
3734 while ((addr = qemu_opt_iter_next(&addriter)) != NULL) {
3735 if (vnc_display_get_address(addr, true, reverse, displaynum, to,
3736 has_ipv4, has_ipv6,
3737 ipv4, ipv6,
3738 &wsaddr, errp) < 0) {
3739 goto cleanup;
3740 }
3741
3742 /* Historical compat - if only a single listen address was
3743 * provided, then this is used to set the default listen
3744 * address for websocket too
3745 */
3746 if (*retnsaddr == 1 &&
3747 (*retsaddr)[0]->type == SOCKET_ADDRESS_TYPE_INET &&
3748 wsaddr->type == SOCKET_ADDRESS_TYPE_INET &&
3749 g_str_equal(wsaddr->u.inet.host, "") &&
3750 !g_str_equal((*retsaddr)[0]->u.inet.host, "")) {
3751 g_free(wsaddr->u.inet.host);
3752 wsaddr->u.inet.host = g_strdup((*retsaddr)[0]->u.inet.host);
3753 }
3754
3755 *retwsaddr = g_renew(SocketAddress *, *retwsaddr, *retnwsaddr + 1);
3756 (*retwsaddr)[(*retnwsaddr)++] = wsaddr;
3757 }
3758
3759 ret = 0;
3760 cleanup:
3761 if (ret < 0) {
3762 vnc_free_addresses(retsaddr, retnsaddr);
3763 vnc_free_addresses(retwsaddr, retnwsaddr);
3764 }
3765 return ret;
3766 }
3767
3768 static int vnc_display_connect(VncDisplay *vd,
3769 SocketAddress **saddr,
3770 size_t nsaddr,
3771 SocketAddress **wsaddr,
3772 size_t nwsaddr,
3773 Error **errp)
3774 {
3775 /* connect to viewer */
3776 QIOChannelSocket *sioc = NULL;
3777 if (nwsaddr != 0) {
3778 error_setg(errp, "Cannot use websockets in reverse mode");
3779 return -1;
3780 }
3781 if (nsaddr != 1) {
3782 error_setg(errp, "Expected a single address in reverse mode");
3783 return -1;
3784 }
3785 /* TODO SOCKET_ADDRESS_TYPE_FD when fd has AF_UNIX */
3786 vd->is_unix = saddr[0]->type == SOCKET_ADDRESS_TYPE_UNIX;
3787 sioc = qio_channel_socket_new();
3788 qio_channel_set_name(QIO_CHANNEL(sioc), "vnc-reverse");
3789 if (qio_channel_socket_connect_sync(sioc, saddr[0], errp) < 0) {
3790 return -1;
3791 }
3792 vnc_connect(vd, sioc, false, false);
3793 object_unref(OBJECT(sioc));
3794 return 0;
3795 }
3796
3797
3798 static int vnc_display_listen(VncDisplay *vd,
3799 SocketAddress **saddr,
3800 size_t nsaddr,
3801 SocketAddress **wsaddr,
3802 size_t nwsaddr,
3803 Error **errp)
3804 {
3805 size_t i;
3806
3807 if (nsaddr) {
3808 vd->listener = qio_net_listener_new();
3809 qio_net_listener_set_name(vd->listener, "vnc-listen");
3810 for (i = 0; i < nsaddr; i++) {
3811 if (qio_net_listener_open_sync(vd->listener,
3812 saddr[i],
3813 errp) < 0) {
3814 return -1;
3815 }
3816 }
3817
3818 qio_net_listener_set_client_func(vd->listener,
3819 vnc_listen_io, vd, NULL);
3820 }
3821
3822 if (nwsaddr) {
3823 vd->wslistener = qio_net_listener_new();
3824 qio_net_listener_set_name(vd->wslistener, "vnc-ws-listen");
3825 for (i = 0; i < nwsaddr; i++) {
3826 if (qio_net_listener_open_sync(vd->wslistener,
3827 wsaddr[i],
3828 errp) < 0) {
3829 return -1;
3830 }
3831 }
3832
3833 qio_net_listener_set_client_func(vd->wslistener,
3834 vnc_listen_io, vd, NULL);
3835 }
3836
3837 return 0;
3838 }
3839
3840
3841 void vnc_display_open(const char *id, Error **errp)
3842 {
3843 VncDisplay *vd = vnc_display_find(id);
3844 QemuOpts *opts = qemu_opts_find(&qemu_vnc_opts, id);
3845 SocketAddress **saddr = NULL, **wsaddr = NULL;
3846 size_t nsaddr, nwsaddr;
3847 const char *share, *device_id;
3848 QemuConsole *con;
3849 bool password = false;
3850 bool reverse = false;
3851 const char *credid;
3852 bool sasl = false;
3853 #ifdef CONFIG_VNC_SASL
3854 int saslErr;
3855 #endif
3856 int acl = 0;
3857 int lock_key_sync = 1;
3858 int key_delay_ms;
3859
3860 if (!vd) {
3861 error_setg(errp, "VNC display not active");
3862 return;
3863 }
3864 vnc_display_close(vd);
3865
3866 if (!opts) {
3867 return;
3868 }
3869
3870 reverse = qemu_opt_get_bool(opts, "reverse", false);
3871 if (vnc_display_get_addresses(opts, reverse, &saddr, &nsaddr,
3872 &wsaddr, &nwsaddr, errp) < 0) {
3873 goto fail;
3874 }
3875
3876 password = qemu_opt_get_bool(opts, "password", false);
3877 if (password) {
3878 if (fips_get_state()) {
3879 error_setg(errp,
3880 "VNC password auth disabled due to FIPS mode, "
3881 "consider using the VeNCrypt or SASL authentication "
3882 "methods as an alternative");
3883 goto fail;
3884 }
3885 if (!qcrypto_cipher_supports(
3886 QCRYPTO_CIPHER_ALG_DES_RFB, QCRYPTO_CIPHER_MODE_ECB)) {
3887 error_setg(errp,
3888 "Cipher backend does not support DES RFB algorithm");
3889 goto fail;
3890 }
3891 }
3892
3893 lock_key_sync = qemu_opt_get_bool(opts, "lock-key-sync", true);
3894 key_delay_ms = qemu_opt_get_number(opts, "key-delay-ms", 10);
3895 sasl = qemu_opt_get_bool(opts, "sasl", false);
3896 #ifndef CONFIG_VNC_SASL
3897 if (sasl) {
3898 error_setg(errp, "VNC SASL auth requires cyrus-sasl support");
3899 goto fail;
3900 }
3901 #endif /* CONFIG_VNC_SASL */
3902 credid = qemu_opt_get(opts, "tls-creds");
3903 if (credid) {
3904 Object *creds;
3905 if (qemu_opt_get(opts, "tls") ||
3906 qemu_opt_get(opts, "x509") ||
3907 qemu_opt_get(opts, "x509verify")) {
3908 error_setg(errp,
3909 "'tls-creds' parameter is mutually exclusive with "
3910 "'tls', 'x509' and 'x509verify' parameters");
3911 goto fail;
3912 }
3913
3914 creds = object_resolve_path_component(
3915 object_get_objects_root(), credid);
3916 if (!creds) {
3917 error_setg(errp, "No TLS credentials with id '%s'",
3918 credid);
3919 goto fail;
3920 }
3921 vd->tlscreds = (QCryptoTLSCreds *)
3922 object_dynamic_cast(creds,
3923 TYPE_QCRYPTO_TLS_CREDS);
3924 if (!vd->tlscreds) {
3925 error_setg(errp, "Object with id '%s' is not TLS credentials",
3926 credid);
3927 goto fail;
3928 }
3929 object_ref(OBJECT(vd->tlscreds));
3930
3931 if (vd->tlscreds->endpoint != QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
3932 error_setg(errp,
3933 "Expecting TLS credentials with a server endpoint");
3934 goto fail;
3935 }
3936 } else {
3937 const char *path;
3938 bool tls = false, x509 = false, x509verify = false;
3939 tls = qemu_opt_get_bool(opts, "tls", false);
3940 if (tls) {
3941 path = qemu_opt_get(opts, "x509");
3942
3943 if (path) {
3944 x509 = true;
3945 } else {
3946 path = qemu_opt_get(opts, "x509verify");
3947 if (path) {
3948 x509 = true;
3949 x509verify = true;
3950 }
3951 }
3952 vd->tlscreds = vnc_display_create_creds(x509,
3953 x509verify,
3954 path,
3955 vd->id,
3956 errp);
3957 if (!vd->tlscreds) {
3958 goto fail;
3959 }
3960 }
3961 }
3962 acl = qemu_opt_get_bool(opts, "acl", false);
3963
3964 share = qemu_opt_get(opts, "share");
3965 if (share) {
3966 if (strcmp(share, "ignore") == 0) {
3967 vd->share_policy = VNC_SHARE_POLICY_IGNORE;
3968 } else if (strcmp(share, "allow-exclusive") == 0) {
3969 vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
3970 } else if (strcmp(share, "force-shared") == 0) {
3971 vd->share_policy = VNC_SHARE_POLICY_FORCE_SHARED;
3972 } else {
3973 error_setg(errp, "unknown vnc share= option");
3974 goto fail;
3975 }
3976 } else {
3977 vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
3978 }
3979 vd->connections_limit = qemu_opt_get_number(opts, "connections", 32);
3980
3981 #ifdef CONFIG_VNC_JPEG
3982 vd->lossy = qemu_opt_get_bool(opts, "lossy", false);
3983 #endif
3984 vd->non_adaptive = qemu_opt_get_bool(opts, "non-adaptive", false);
3985 /* adaptive updates are only used with tight encoding and
3986 * if lossy updates are enabled so we can disable all the
3987 * calculations otherwise */
3988 if (!vd->lossy) {
3989 vd->non_adaptive = true;
3990 }
3991
3992 if (acl) {
3993 if (strcmp(vd->id, "default") == 0) {
3994 vd->tlsaclname = g_strdup("vnc.x509dname");
3995 } else {
3996 vd->tlsaclname = g_strdup_printf("vnc.%s.x509dname", vd->id);
3997 }
3998 qemu_acl_init(vd->tlsaclname);
3999 }
4000 #ifdef CONFIG_VNC_SASL
4001 if (acl && sasl) {
4002 char *aclname;
4003
4004 if (strcmp(vd->id, "default") == 0) {
4005 aclname = g_strdup("vnc.username");
4006 } else {
4007 aclname = g_strdup_printf("vnc.%s.username", vd->id);
4008 }
4009 vd->sasl.acl = qemu_acl_init(aclname);
4010 g_free(aclname);
4011 }
4012 #endif
4013
4014 if (vnc_display_setup_auth(&vd->auth, &vd->subauth,
4015 vd->tlscreds, password,
4016 sasl, false, errp) < 0) {
4017 goto fail;
4018 }
4019 trace_vnc_auth_init(vd, 0, vd->auth, vd->subauth);
4020
4021 if (vnc_display_setup_auth(&vd->ws_auth, &vd->ws_subauth,
4022 vd->tlscreds, password,
4023 sasl, true, errp) < 0) {
4024 goto fail;
4025 }
4026 trace_vnc_auth_init(vd, 1, vd->ws_auth, vd->ws_subauth);
4027
4028 #ifdef CONFIG_VNC_SASL
4029 if ((saslErr = sasl_server_init(NULL, "qemu")) != SASL_OK) {
4030 error_setg(errp, "Failed to initialize SASL auth: %s",
4031 sasl_errstring(saslErr, NULL, NULL));
4032 goto fail;
4033 }
4034 #endif
4035 vd->lock_key_sync = lock_key_sync;
4036 if (lock_key_sync) {
4037 vd->led = qemu_add_led_event_handler(kbd_leds, vd);
4038 }
4039 vd->ledstate = 0;
4040 vd->key_delay_ms = key_delay_ms;
4041
4042 device_id = qemu_opt_get(opts, "display");
4043 if (device_id) {
4044 int head = qemu_opt_get_number(opts, "head", 0);
4045 Error *err = NULL;
4046
4047 con = qemu_console_lookup_by_device_name(device_id, head, &err);
4048 if (err) {
4049 error_propagate(errp, err);
4050 goto fail;
4051 }
4052 } else {
4053 con = NULL;
4054 }
4055
4056 if (con != vd->dcl.con) {
4057 unregister_displaychangelistener(&vd->dcl);
4058 vd->dcl.con = con;
4059 register_displaychangelistener(&vd->dcl);
4060 }
4061
4062 if (saddr == NULL) {
4063 goto cleanup;
4064 }
4065
4066 if (reverse) {
4067 if (vnc_display_connect(vd, saddr, nsaddr, wsaddr, nwsaddr, errp) < 0) {
4068 goto fail;
4069 }
4070 } else {
4071 if (vnc_display_listen(vd, saddr, nsaddr, wsaddr, nwsaddr, errp) < 0) {
4072 goto fail;
4073 }
4074 }
4075
4076 if (qemu_opt_get(opts, "to")) {
4077 vnc_display_print_local_addr(vd);
4078 }
4079
4080 cleanup:
4081 vnc_free_addresses(&saddr, &nsaddr);
4082 vnc_free_addresses(&wsaddr, &nwsaddr);
4083 return;
4084
4085 fail:
4086 vnc_display_close(vd);
4087 goto cleanup;
4088 }
4089
4090 void vnc_display_add_client(const char *id, int csock, bool skipauth)
4091 {
4092 VncDisplay *vd = vnc_display_find(id);
4093 QIOChannelSocket *sioc;
4094
4095 if (!vd) {
4096 return;
4097 }
4098
4099 sioc = qio_channel_socket_new_fd(csock, NULL);
4100 if (sioc) {
4101 qio_channel_set_name(QIO_CHANNEL(sioc), "vnc-server");
4102 vnc_connect(vd, sioc, skipauth, false);
4103 object_unref(OBJECT(sioc));
4104 }
4105 }
4106
4107 static void vnc_auto_assign_id(QemuOptsList *olist, QemuOpts *opts)
4108 {
4109 int i = 2;
4110 char *id;
4111
4112 id = g_strdup("default");
4113 while (qemu_opts_find(olist, id)) {
4114 g_free(id);
4115 id = g_strdup_printf("vnc%d", i++);
4116 }
4117 qemu_opts_set_id(opts, id);
4118 }
4119
4120 QemuOpts *vnc_parse(const char *str, Error **errp)
4121 {
4122 QemuOptsList *olist = qemu_find_opts("vnc");
4123 QemuOpts *opts = qemu_opts_parse(olist, str, true, errp);
4124 const char *id;
4125
4126 if (!opts) {
4127 return NULL;
4128 }
4129
4130 id = qemu_opts_id(opts);
4131 if (!id) {
4132 /* auto-assign id if not present */
4133 vnc_auto_assign_id(olist, opts);
4134 }
4135 return opts;
4136 }
4137
4138 int vnc_init_func(void *opaque, QemuOpts *opts, Error **errp)
4139 {
4140 Error *local_err = NULL;
4141 char *id = (char *)qemu_opts_id(opts);
4142
4143 assert(id);
4144 vnc_display_init(id);
4145 vnc_display_open(id, &local_err);
4146 if (local_err != NULL) {
4147 error_reportf_err(local_err, "Failed to start VNC server: ");
4148 exit(1);
4149 }
4150 return 0;
4151 }
4152
4153 static void vnc_register_config(void)
4154 {
4155 qemu_add_opts(&qemu_vnc_opts);
4156 }
4157 opts_init(vnc_register_config);
QEmu