?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
net: handle -netdevice options
[qemu.git] / vnc.c
blob01e8e934895a54a0a8af1acf6f2c1d2384491101
1 /*
2 * QEMU VNC display driver
3 *
4 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5 * Copyright (C) 2006 Fabrice Bellard
6 * Copyright (C) 2009 Red Hat, Inc
7 *
8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to deal
10 * in the Software without restriction, including without limitation the rights
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12 * copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
14 *
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
17 *
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24 * THE SOFTWARE.
25 */
26
27 #include "vnc.h"
28 #include "sysemu.h"
29 #include "qemu_socket.h"
30 #include "qemu-timer.h"
31 #include "acl.h"
32
33 #define VNC_REFRESH_INTERVAL_BASE 30
34 #define VNC_REFRESH_INTERVAL_INC 50
35 #define VNC_REFRESH_INTERVAL_MAX 2000
36
37 #include "vnc_keysym.h"
38 #include "d3des.h"
39
40 #define count_bits(c, v) { \
41 for (c = 0; v; v >>= 1) \
42 { \
43 c += v & 1; \
44 } \
45 }
46
47
48 static VncDisplay *vnc_display; /* needed for info vnc */
49 static DisplayChangeListener *dcl;
50
51 static char *addr_to_string(const char *format,
52 struct sockaddr_storage *sa,
53 socklen_t salen) {
54 char *addr;
55 char host[NI_MAXHOST];
56 char serv[NI_MAXSERV];
57 int err;
58 size_t addrlen;
59
60 if ((err = getnameinfo((struct sockaddr *)sa, salen,
61 host, sizeof(host),
62 serv, sizeof(serv),
63 NI_NUMERICHOST | NI_NUMERICSERV)) != 0) {
64 VNC_DEBUG("Cannot resolve address %d: %s\n",
65 err, gai_strerror(err));
66 return NULL;
67 }
68
69 /* Enough for the existing format + the 2 vars we're
70 * substituting in. */
71 addrlen = strlen(format) + strlen(host) + strlen(serv);
72 addr = qemu_malloc(addrlen + 1);
73 snprintf(addr, addrlen, format, host, serv);
74 addr[addrlen] = '\0';
75
76 return addr;
77 }
78
79
80 char *vnc_socket_local_addr(const char *format, int fd) {
81 struct sockaddr_storage sa;
82 socklen_t salen;
83
84 salen = sizeof(sa);
85 if (getsockname(fd, (struct sockaddr*)&sa, &salen) < 0)
86 return NULL;
87
88 return addr_to_string(format, &sa, salen);
89 }
90
91 char *vnc_socket_remote_addr(const char *format, int fd) {
92 struct sockaddr_storage sa;
93 socklen_t salen;
94
95 salen = sizeof(sa);
96 if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0)
97 return NULL;
98
99 return addr_to_string(format, &sa, salen);
100 }
101
102 static const char *vnc_auth_name(VncDisplay *vd) {
103 switch (vd->auth) {
104 case VNC_AUTH_INVALID:
105 return "invalid";
106 case VNC_AUTH_NONE:
107 return "none";
108 case VNC_AUTH_VNC:
109 return "vnc";
110 case VNC_AUTH_RA2:
111 return "ra2";
112 case VNC_AUTH_RA2NE:
113 return "ra2ne";
114 case VNC_AUTH_TIGHT:
115 return "tight";
116 case VNC_AUTH_ULTRA:
117 return "ultra";
118 case VNC_AUTH_TLS:
119 return "tls";
120 case VNC_AUTH_VENCRYPT:
121 #ifdef CONFIG_VNC_TLS
122 switch (vd->subauth) {
123 case VNC_AUTH_VENCRYPT_PLAIN:
124 return "vencrypt+plain";
125 case VNC_AUTH_VENCRYPT_TLSNONE:
126 return "vencrypt+tls+none";
127 case VNC_AUTH_VENCRYPT_TLSVNC:
128 return "vencrypt+tls+vnc";
129 case VNC_AUTH_VENCRYPT_TLSPLAIN:
130 return "vencrypt+tls+plain";
131 case VNC_AUTH_VENCRYPT_X509NONE:
132 return "vencrypt+x509+none";
133 case VNC_AUTH_VENCRYPT_X509VNC:
134 return "vencrypt+x509+vnc";
135 case VNC_AUTH_VENCRYPT_X509PLAIN:
136 return "vencrypt+x509+plain";
137 case VNC_AUTH_VENCRYPT_TLSSASL:
138 return "vencrypt+tls+sasl";
139 case VNC_AUTH_VENCRYPT_X509SASL:
140 return "vencrypt+x509+sasl";
141 default:
142 return "vencrypt";
143 }
144 #else
145 return "vencrypt";
146 #endif
147 case VNC_AUTH_SASL:
148 return "sasl";
149 }
150 return "unknown";
151 }
152
153 static void do_info_vnc_client(Monitor *mon, VncState *client)
154 {
155 char *clientAddr =
156 vnc_socket_remote_addr(" address: %s:%s\n",
157 client->csock);
158 if (!clientAddr)
159 return;
160
161 monitor_printf(mon, "Client:\n");
162 monitor_printf(mon, "%s", clientAddr);
163 free(clientAddr);
164
165 #ifdef CONFIG_VNC_TLS
166 if (client->tls.session &&
167 client->tls.dname)
168 monitor_printf(mon, " x509 dname: %s\n", client->tls.dname);
169 else
170 monitor_printf(mon, " x509 dname: none\n");
171 #endif
172 #ifdef CONFIG_VNC_SASL
173 if (client->sasl.conn &&
174 client->sasl.username)
175 monitor_printf(mon, " username: %s\n", client->sasl.username);
176 else
177 monitor_printf(mon, " username: none\n");
178 #endif
179 }
180
181 void do_info_vnc(Monitor *mon)
182 {
183 if (vnc_display == NULL || vnc_display->display == NULL) {
184 monitor_printf(mon, "Server: disabled\n");
185 } else {
186 char *serverAddr = vnc_socket_local_addr(" address: %s:%s\n",
187 vnc_display->lsock);
188
189 if (!serverAddr)
190 return;
191
192 monitor_printf(mon, "Server:\n");
193 monitor_printf(mon, "%s", serverAddr);
194 free(serverAddr);
195 monitor_printf(mon, " auth: %s\n", vnc_auth_name(vnc_display));
196
197 if (vnc_display->clients) {
198 VncState *client = vnc_display->clients;
199 while (client) {
200 do_info_vnc_client(mon, client);
201 client = client->next;
202 }
203 } else {
204 monitor_printf(mon, "Client: none\n");
205 }
206 }
207 }
208
209 static inline uint32_t vnc_has_feature(VncState *vs, int feature) {
210 return (vs->features & (1 << feature));
211 }
212
213 /* TODO
214 1) Get the queue working for IO.
215 2) there is some weirdness when using the -S option (the screen is grey
216 and not totally invalidated
217 3) resolutions > 1024
218 */
219
220 static int vnc_update_client(VncState *vs, int has_dirty);
221 static void vnc_disconnect_start(VncState *vs);
222 static void vnc_disconnect_finish(VncState *vs);
223 static void vnc_init_timer(VncDisplay *vd);
224 static void vnc_remove_timer(VncDisplay *vd);
225
226 static void vnc_colordepth(VncState *vs);
227 static void framebuffer_update_request(VncState *vs, int incremental,
228 int x_position, int y_position,
229 int w, int h);
230 static void vnc_refresh(void *opaque);
231 static int vnc_refresh_server_surface(VncDisplay *vd);
232
233 static inline void vnc_set_bit(uint32_t *d, int k)
234 {
235 d[k >> 5] |= 1 << (k & 0x1f);
236 }
237
238 static inline void vnc_clear_bit(uint32_t *d, int k)
239 {
240 d[k >> 5] &= ~(1 << (k & 0x1f));
241 }
242
243 static inline void vnc_set_bits(uint32_t *d, int n, int nb_words)
244 {
245 int j;
246
247 j = 0;
248 while (n >= 32) {
249 d[j++] = -1;
250 n -= 32;
251 }
252 if (n > 0)
253 d[j++] = (1 << n) - 1;
254 while (j < nb_words)
255 d[j++] = 0;
256 }
257
258 static inline int vnc_get_bit(const uint32_t *d, int k)
259 {
260 return (d[k >> 5] >> (k & 0x1f)) & 1;
261 }
262
263 static inline int vnc_and_bits(const uint32_t *d1, const uint32_t *d2,
264 int nb_words)
265 {
266 int i;
267 for(i = 0; i < nb_words; i++) {
268 if ((d1[i] & d2[i]) != 0)
269 return 1;
270 }
271 return 0;
272 }
273
274 static void vnc_dpy_update(DisplayState *ds, int x, int y, int w, int h)
275 {
276 int i;
277 VncDisplay *vd = ds->opaque;
278 struct VncSurface *s = &vd->guest;
279
280 h += y;
281
282 /* round x down to ensure the loop only spans one 16-pixel block per,
283 iteration. otherwise, if (x % 16) != 0, the last iteration may span
284 two 16-pixel blocks but we only mark the first as dirty
285 */
286 w += (x % 16);
287 x -= (x % 16);
288
289 x = MIN(x, s->ds->width);
290 y = MIN(y, s->ds->height);
291 w = MIN(x + w, s->ds->width) - x;
292 h = MIN(h, s->ds->height);
293
294 for (; y < h; y++)
295 for (i = 0; i < w; i += 16)
296 vnc_set_bit(s->dirty[y], (x + i) / 16);
297 }
298
299 static void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
300 int32_t encoding)
301 {
302 vnc_write_u16(vs, x);
303 vnc_write_u16(vs, y);
304 vnc_write_u16(vs, w);
305 vnc_write_u16(vs, h);
306
307 vnc_write_s32(vs, encoding);
308 }
309
310 void buffer_reserve(Buffer *buffer, size_t len)
311 {
312 if ((buffer->capacity - buffer->offset) < len) {
313 buffer->capacity += (len + 1024);
314 buffer->buffer = qemu_realloc(buffer->buffer, buffer->capacity);
315 if (buffer->buffer == NULL) {
316 fprintf(stderr, "vnc: out of memory\n");
317 exit(1);
318 }
319 }
320 }
321
322 int buffer_empty(Buffer *buffer)
323 {
324 return buffer->offset == 0;
325 }
326
327 uint8_t *buffer_end(Buffer *buffer)
328 {
329 return buffer->buffer + buffer->offset;
330 }
331
332 void buffer_reset(Buffer *buffer)
333 {
334 buffer->offset = 0;
335 }
336
337 void buffer_append(Buffer *buffer, const void *data, size_t len)
338 {
339 memcpy(buffer->buffer + buffer->offset, data, len);
340 buffer->offset += len;
341 }
342
343 static void vnc_dpy_resize(DisplayState *ds)
344 {
345 int size_changed;
346 VncDisplay *vd = ds->opaque;
347 VncState *vs = vd->clients;
348
349 /* server surface */
350 if (!vd->server)
351 vd->server = qemu_mallocz(sizeof(*vd->server));
352 if (vd->server->data)
353 qemu_free(vd->server->data);
354 *(vd->server) = *(ds->surface);
355 vd->server->data = qemu_mallocz(vd->server->linesize *
356 vd->server->height);
357
358 /* guest surface */
359 if (!vd->guest.ds)
360 vd->guest.ds = qemu_mallocz(sizeof(*vd->guest.ds));
361 if (ds_get_bytes_per_pixel(ds) != vd->guest.ds->pf.bytes_per_pixel)
362 console_color_init(ds);
363 size_changed = ds_get_width(ds) != vd->guest.ds->width ||
364 ds_get_height(ds) != vd->guest.ds->height;
365 *(vd->guest.ds) = *(ds->surface);
366 memset(vd->guest.dirty, 0xFF, sizeof(vd->guest.dirty));
367
368 while (vs != NULL) {
369 vnc_colordepth(vs);
370 if (size_changed) {
371 if (vs->csock != -1 && vnc_has_feature(vs, VNC_FEATURE_RESIZE)) {
372 vnc_write_u8(vs, 0); /* msg id */
373 vnc_write_u8(vs, 0);
374 vnc_write_u16(vs, 1); /* number of rects */
375 vnc_framebuffer_update(vs, 0, 0, ds_get_width(ds), ds_get_height(ds),
376 VNC_ENCODING_DESKTOPRESIZE);
377 vnc_flush(vs);
378 }
379 }
380 memset(vs->dirty, 0xFF, sizeof(vs->dirty));
381 vs = vs->next;
382 }
383 }
384
385 /* fastest code */
386 static void vnc_write_pixels_copy(VncState *vs, void *pixels, int size)
387 {
388 vnc_write(vs, pixels, size);
389 }
390
391 /* slowest but generic code. */
392 static void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
393 {
394 uint8_t r, g, b;
395 VncDisplay *vd = vs->vd;
396
397 r = ((((v & vd->server->pf.rmask) >> vd->server->pf.rshift) << vs->clientds.pf.rbits) >>
398 vd->server->pf.rbits);
399 g = ((((v & vd->server->pf.gmask) >> vd->server->pf.gshift) << vs->clientds.pf.gbits) >>
400 vd->server->pf.gbits);
401 b = ((((v & vd->server->pf.bmask) >> vd->server->pf.bshift) << vs->clientds.pf.bbits) >>
402 vd->server->pf.bbits);
403 v = (r << vs->clientds.pf.rshift) |
404 (g << vs->clientds.pf.gshift) |
405 (b << vs->clientds.pf.bshift);
406 switch(vs->clientds.pf.bytes_per_pixel) {
407 case 1:
408 buf[0] = v;
409 break;
410 case 2:
411 if (vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) {
412 buf[0] = v >> 8;
413 buf[1] = v;
414 } else {
415 buf[1] = v >> 8;
416 buf[0] = v;
417 }
418 break;
419 default:
420 case 4:
421 if (vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) {
422 buf[0] = v >> 24;
423 buf[1] = v >> 16;
424 buf[2] = v >> 8;
425 buf[3] = v;
426 } else {
427 buf[3] = v >> 24;
428 buf[2] = v >> 16;
429 buf[1] = v >> 8;
430 buf[0] = v;
431 }
432 break;
433 }
434 }
435
436 static void vnc_write_pixels_generic(VncState *vs, void *pixels1, int size)
437 {
438 uint8_t buf[4];
439 VncDisplay *vd = vs->vd;
440
441 if (vd->server->pf.bytes_per_pixel == 4) {
442 uint32_t *pixels = pixels1;
443 int n, i;
444 n = size >> 2;
445 for(i = 0; i < n; i++) {
446 vnc_convert_pixel(vs, buf, pixels[i]);
447 vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
448 }
449 } else if (vd->server->pf.bytes_per_pixel == 2) {
450 uint16_t *pixels = pixels1;
451 int n, i;
452 n = size >> 1;
453 for(i = 0; i < n; i++) {
454 vnc_convert_pixel(vs, buf, pixels[i]);
455 vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
456 }
457 } else if (vd->server->pf.bytes_per_pixel == 1) {
458 uint8_t *pixels = pixels1;
459 int n, i;
460 n = size;
461 for(i = 0; i < n; i++) {
462 vnc_convert_pixel(vs, buf, pixels[i]);
463 vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
464 }
465 } else {
466 fprintf(stderr, "vnc_write_pixels_generic: VncState color depth not supported\n");
467 }
468 }
469
470 static void send_framebuffer_update_raw(VncState *vs, int x, int y, int w, int h)
471 {
472 int i;
473 uint8_t *row;
474 VncDisplay *vd = vs->vd;
475
476 row = vd->server->data + y * ds_get_linesize(vs->ds) + x * ds_get_bytes_per_pixel(vs->ds);
477 for (i = 0; i < h; i++) {
478 vs->write_pixels(vs, row, w * ds_get_bytes_per_pixel(vs->ds));
479 row += ds_get_linesize(vs->ds);
480 }
481 }
482
483 static void hextile_enc_cord(uint8_t *ptr, int x, int y, int w, int h)
484 {
485 ptr[0] = ((x & 0x0F) << 4) | (y & 0x0F);
486 ptr[1] = (((w - 1) & 0x0F) << 4) | ((h - 1) & 0x0F);
487 }
488
489 #define BPP 8
490 #include "vnchextile.h"
491 #undef BPP
492
493 #define BPP 16
494 #include "vnchextile.h"
495 #undef BPP
496
497 #define BPP 32
498 #include "vnchextile.h"
499 #undef BPP
500
501 #define GENERIC
502 #define BPP 8
503 #include "vnchextile.h"
504 #undef BPP
505 #undef GENERIC
506
507 #define GENERIC
508 #define BPP 16
509 #include "vnchextile.h"
510 #undef BPP
511 #undef GENERIC
512
513 #define GENERIC
514 #define BPP 32
515 #include "vnchextile.h"
516 #undef BPP
517 #undef GENERIC
518
519 static void send_framebuffer_update_hextile(VncState *vs, int x, int y, int w, int h)
520 {
521 int i, j;
522 int has_fg, has_bg;
523 uint8_t *last_fg, *last_bg;
524 VncDisplay *vd = vs->vd;
525
526 last_fg = (uint8_t *) qemu_malloc(vd->server->pf.bytes_per_pixel);
527 last_bg = (uint8_t *) qemu_malloc(vd->server->pf.bytes_per_pixel);
528 has_fg = has_bg = 0;
529 for (j = y; j < (y + h); j += 16) {
530 for (i = x; i < (x + w); i += 16) {
531 vs->send_hextile_tile(vs, i, j,
532 MIN(16, x + w - i), MIN(16, y + h - j),
533 last_bg, last_fg, &has_bg, &has_fg);
534 }
535 }
536 free(last_fg);
537 free(last_bg);
538
539 }
540
541 #define ZALLOC_ALIGNMENT 16
542
543 static void *zalloc(void *x, unsigned items, unsigned size)
544 {
545 void *p;
546
547 size *= items;
548 size = (size + ZALLOC_ALIGNMENT - 1) & ~(ZALLOC_ALIGNMENT - 1);
549
550 p = qemu_mallocz(size);
551
552 return (p);
553 }
554
555 static void zfree(void *x, void *addr)
556 {
557 qemu_free(addr);
558 }
559
560 static void vnc_zlib_init(VncState *vs)
561 {
562 int i;
563 for (i=0; i<(sizeof(vs->zlib_stream) / sizeof(z_stream)); i++)
564 vs->zlib_stream[i].opaque = NULL;
565 }
566
567 static void vnc_zlib_start(VncState *vs)
568 {
569 buffer_reset(&vs->zlib);
570
571 // make the output buffer be the zlib buffer, so we can compress it later
572 vs->zlib_tmp = vs->output;
573 vs->output = vs->zlib;
574 }
575
576 static int vnc_zlib_stop(VncState *vs, int stream_id)
577 {
578 z_streamp zstream = &vs->zlib_stream[stream_id];
579 int previous_out;
580
581 // switch back to normal output/zlib buffers
582 vs->zlib = vs->output;
583 vs->output = vs->zlib_tmp;
584
585 // compress the zlib buffer
586
587 // initialize the stream
588 // XXX need one stream per session
589 if (zstream->opaque != vs) {
590 int err;
591
592 VNC_DEBUG("VNC: initializing zlib stream %d\n", stream_id);
593 VNC_DEBUG("VNC: opaque = %p | vs = %p\n", zstream->opaque, vs);
594 zstream->zalloc = zalloc;
595 zstream->zfree = zfree;
596
597 err = deflateInit2(zstream, vs->tight_compression, Z_DEFLATED, MAX_WBITS,
598 MAX_MEM_LEVEL, Z_DEFAULT_STRATEGY);
599
600 if (err != Z_OK) {
601 fprintf(stderr, "VNC: error initializing zlib\n");
602 return -1;
603 }
604
605 zstream->opaque = vs;
606 }
607
608 // XXX what to do if tight_compression changed in between?
609
610 // reserve memory in output buffer
611 buffer_reserve(&vs->output, vs->zlib.offset + 64);
612
613 // set pointers
614 zstream->next_in = vs->zlib.buffer;
615 zstream->avail_in = vs->zlib.offset;
616 zstream->next_out = vs->output.buffer + vs->output.offset;
617 zstream->avail_out = vs->output.capacity - vs->output.offset;
618 zstream->data_type = Z_BINARY;
619 previous_out = zstream->total_out;
620
621 // start encoding
622 if (deflate(zstream, Z_SYNC_FLUSH) != Z_OK) {
623 fprintf(stderr, "VNC: error during zlib compression\n");
624 return -1;
625 }
626
627 vs->output.offset = vs->output.capacity - zstream->avail_out;
628 return zstream->total_out - previous_out;
629 }
630
631 static void send_framebuffer_update_zlib(VncState *vs, int x, int y, int w, int h)
632 {
633 int old_offset, new_offset, bytes_written;
634
635 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_ZLIB);
636
637 // remember where we put in the follow-up size
638 old_offset = vs->output.offset;
639 vnc_write_s32(vs, 0);
640
641 // compress the stream
642 vnc_zlib_start(vs);
643 send_framebuffer_update_raw(vs, x, y, w, h);
644 bytes_written = vnc_zlib_stop(vs, 0);
645
646 if (bytes_written == -1)
647 return;
648
649 // hack in the size
650 new_offset = vs->output.offset;
651 vs->output.offset = old_offset;
652 vnc_write_u32(vs, bytes_written);
653 vs->output.offset = new_offset;
654 }
655
656 static void send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
657 {
658 switch(vs->vnc_encoding) {
659 case VNC_ENCODING_ZLIB:
660 send_framebuffer_update_zlib(vs, x, y, w, h);
661 break;
662 case VNC_ENCODING_HEXTILE:
663 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE);
664 send_framebuffer_update_hextile(vs, x, y, w, h);
665 break;
666 default:
667 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW);
668 send_framebuffer_update_raw(vs, x, y, w, h);
669 break;
670 }
671 }
672
673 static void vnc_copy(VncState *vs, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
674 {
675 /* send bitblit op to the vnc client */
676 vnc_write_u8(vs, 0); /* msg id */
677 vnc_write_u8(vs, 0);
678 vnc_write_u16(vs, 1); /* number of rects */
679 vnc_framebuffer_update(vs, dst_x, dst_y, w, h, VNC_ENCODING_COPYRECT);
680 vnc_write_u16(vs, src_x);
681 vnc_write_u16(vs, src_y);
682 vnc_flush(vs);
683 }
684
685 static void vnc_dpy_copy(DisplayState *ds, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
686 {
687 VncDisplay *vd = ds->opaque;
688 VncState *vs, *vn;
689 uint8_t *src_row;
690 uint8_t *dst_row;
691 int i,x,y,pitch,depth,inc,w_lim,s;
692 int cmp_bytes;
693
694 vnc_refresh_server_surface(vd);
695 for (vs = vd->clients; vs != NULL; vs = vn) {
696 vn = vs->next;
697 if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
698 vs->force_update = 1;
699 vnc_update_client(vs, 1);
700 /* vs might be free()ed here */
701 }
702 }
703
704 /* do bitblit op on the local surface too */
705 pitch = ds_get_linesize(vd->ds);
706 depth = ds_get_bytes_per_pixel(vd->ds);
707 src_row = vd->server->data + pitch * src_y + depth * src_x;
708 dst_row = vd->server->data + pitch * dst_y + depth * dst_x;
709 y = dst_y;
710 inc = 1;
711 if (dst_y > src_y) {
712 /* copy backwards */
713 src_row += pitch * (h-1);
714 dst_row += pitch * (h-1);
715 pitch = -pitch;
716 y = dst_y + h - 1;
717 inc = -1;
718 }
719 w_lim = w - (16 - (dst_x % 16));
720 if (w_lim < 0)
721 w_lim = w;
722 else
723 w_lim = w - (w_lim % 16);
724 for (i = 0; i < h; i++) {
725 for (x = 0; x <= w_lim;
726 x += s, src_row += cmp_bytes, dst_row += cmp_bytes) {
727 if (x == w_lim) {
728 if ((s = w - w_lim) == 0)
729 break;
730 } else if (!x) {
731 s = (16 - (dst_x % 16));
732 s = MIN(s, w_lim);
733 } else {
734 s = 16;
735 }
736 cmp_bytes = s * depth;
737 if (memcmp(src_row, dst_row, cmp_bytes) == 0)
738 continue;
739 memmove(dst_row, src_row, cmp_bytes);
740 vs = vd->clients;
741 while (vs != NULL) {
742 if (!vnc_has_feature(vs, VNC_FEATURE_COPYRECT))
743 vnc_set_bit(vs->dirty[y], ((x + dst_x) / 16));
744 vs = vs->next;
745 }
746 }
747 src_row += pitch - w * depth;
748 dst_row += pitch - w * depth;
749 y += inc;
750 }
751
752 for (vs = vd->clients; vs != NULL; vs = vs->next) {
753 if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT))
754 vnc_copy(vs, src_x, src_y, dst_x, dst_y, w, h);
755 }
756 }
757
758 static int find_and_clear_dirty_height(struct VncState *vs,
759 int y, int last_x, int x)
760 {
761 int h;
762 VncDisplay *vd = vs->vd;
763
764 for (h = 1; h < (vd->server->height - y); h++) {
765 int tmp_x;
766 if (!vnc_get_bit(vs->dirty[y + h], last_x))
767 break;
768 for (tmp_x = last_x; tmp_x < x; tmp_x++)
769 vnc_clear_bit(vs->dirty[y + h], tmp_x);
770 }
771
772 return h;
773 }
774
775 static int vnc_update_client(VncState *vs, int has_dirty)
776 {
777 if (vs->need_update && vs->csock != -1) {
778 VncDisplay *vd = vs->vd;
779 int y;
780 int n_rectangles;
781 int saved_offset;
782
783 if (vs->output.offset && !vs->audio_cap && !vs->force_update)
784 /* kernel send buffers are full -> drop frames to throttle */
785 return 0;
786
787 if (!has_dirty && !vs->audio_cap && !vs->force_update)
788 return 0;
789
790 /*
791 * Send screen updates to the vnc client using the server
792 * surface and server dirty map. guest surface updates
793 * happening in parallel don't disturb us, the next pass will
794 * send them to the client.
795 */
796 n_rectangles = 0;
797 vnc_write_u8(vs, 0); /* msg id */
798 vnc_write_u8(vs, 0);
799 saved_offset = vs->output.offset;
800 vnc_write_u16(vs, 0);
801
802 for (y = 0; y < vd->server->height; y++) {
803 int x;
804 int last_x = -1;
805 for (x = 0; x < vd->server->width / 16; x++) {
806 if (vnc_get_bit(vs->dirty[y], x)) {
807 if (last_x == -1) {
808 last_x = x;
809 }
810 vnc_clear_bit(vs->dirty[y], x);
811 } else {
812 if (last_x != -1) {
813 int h = find_and_clear_dirty_height(vs, y, last_x, x);
814 send_framebuffer_update(vs, last_x * 16, y, (x - last_x) * 16, h);
815 n_rectangles++;
816 }
817 last_x = -1;
818 }
819 }
820 if (last_x != -1) {
821 int h = find_and_clear_dirty_height(vs, y, last_x, x);
822 send_framebuffer_update(vs, last_x * 16, y, (x - last_x) * 16, h);
823 n_rectangles++;
824 }
825 }
826 vs->output.buffer[saved_offset] = (n_rectangles >> 8) & 0xFF;
827 vs->output.buffer[saved_offset + 1] = n_rectangles & 0xFF;
828 vnc_flush(vs);
829 vs->force_update = 0;
830 return n_rectangles;
831 }
832
833 if (vs->csock == -1)
834 vnc_disconnect_finish(vs);
835
836 return 0;
837 }
838
839 /* audio */
840 static void audio_capture_notify(void *opaque, audcnotification_e cmd)
841 {
842 VncState *vs = opaque;
843
844 switch (cmd) {
845 case AUD_CNOTIFY_DISABLE:
846 vnc_write_u8(vs, 255);
847 vnc_write_u8(vs, 1);
848 vnc_write_u16(vs, 0);
849 vnc_flush(vs);
850 break;
851
852 case AUD_CNOTIFY_ENABLE:
853 vnc_write_u8(vs, 255);
854 vnc_write_u8(vs, 1);
855 vnc_write_u16(vs, 1);
856 vnc_flush(vs);
857 break;
858 }
859 }
860
861 static void audio_capture_destroy(void *opaque)
862 {
863 }
864
865 static void audio_capture(void *opaque, void *buf, int size)
866 {
867 VncState *vs = opaque;
868
869 vnc_write_u8(vs, 255);
870 vnc_write_u8(vs, 1);
871 vnc_write_u16(vs, 2);
872 vnc_write_u32(vs, size);
873 vnc_write(vs, buf, size);
874 vnc_flush(vs);
875 }
876
877 static void audio_add(VncState *vs)
878 {
879 Monitor *mon = cur_mon;
880 struct audio_capture_ops ops;
881
882 if (vs->audio_cap) {
883 monitor_printf(mon, "audio already running\n");
884 return;
885 }
886
887 ops.notify = audio_capture_notify;
888 ops.destroy = audio_capture_destroy;
889 ops.capture = audio_capture;
890
891 vs->audio_cap = AUD_add_capture(&vs->as, &ops, vs);
892 if (!vs->audio_cap) {
893 monitor_printf(mon, "Failed to add audio capture\n");
894 }
895 }
896
897 static void audio_del(VncState *vs)
898 {
899 if (vs->audio_cap) {
900 AUD_del_capture(vs->audio_cap, vs);
901 vs->audio_cap = NULL;
902 }
903 }
904
905 static void vnc_disconnect_start(VncState *vs)
906 {
907 if (vs->csock == -1)
908 return;
909 qemu_set_fd_handler2(vs->csock, NULL, NULL, NULL, NULL);
910 closesocket(vs->csock);
911 vs->csock = -1;
912 }
913
914 static void vnc_disconnect_finish(VncState *vs)
915 {
916 if (vs->input.buffer) {
917 qemu_free(vs->input.buffer);
918 vs->input.buffer = NULL;
919 }
920 if (vs->output.buffer) {
921 qemu_free(vs->output.buffer);
922 vs->output.buffer = NULL;
923 }
924 #ifdef CONFIG_VNC_TLS
925 vnc_tls_client_cleanup(vs);
926 #endif /* CONFIG_VNC_TLS */
927 #ifdef CONFIG_VNC_SASL
928 vnc_sasl_client_cleanup(vs);
929 #endif /* CONFIG_VNC_SASL */
930 audio_del(vs);
931
932 VncState *p, *parent = NULL;
933 for (p = vs->vd->clients; p != NULL; p = p->next) {
934 if (p == vs) {
935 if (parent)
936 parent->next = p->next;
937 else
938 vs->vd->clients = p->next;
939 break;
940 }
941 parent = p;
942 }
943 if (!vs->vd->clients)
944 dcl->idle = 1;
945
946 vnc_remove_timer(vs->vd);
947 qemu_free(vs);
948 }
949
950 int vnc_client_io_error(VncState *vs, int ret, int last_errno)
951 {
952 if (ret == 0 || ret == -1) {
953 if (ret == -1) {
954 switch (last_errno) {
955 case EINTR:
956 case EAGAIN:
957 #ifdef _WIN32
958 case WSAEWOULDBLOCK:
959 #endif
960 return 0;
961 default:
962 break;
963 }
964 }
965
966 VNC_DEBUG("Closing down client sock: ret %d, errno %d\n",
967 ret, ret < 0 ? last_errno : 0);
968 vnc_disconnect_start(vs);
969
970 return 0;
971 }
972 return ret;
973 }
974
975
976 void vnc_client_error(VncState *vs)
977 {
978 VNC_DEBUG("Closing down client sock: protocol error\n");
979 vnc_disconnect_start(vs);
980 }
981
982
983 /*
984 * Called to write a chunk of data to the client socket. The data may
985 * be the raw data, or may have already been encoded by SASL.
986 * The data will be written either straight onto the socket, or
987 * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled
988 *
989 * NB, it is theoretically possible to have 2 layers of encryption,
990 * both SASL, and this TLS layer. It is highly unlikely in practice
991 * though, since SASL encryption will typically be a no-op if TLS
992 * is active
993 *
994 * Returns the number of bytes written, which may be less than
995 * the requested 'datalen' if the socket would block. Returns
996 * -1 on error, and disconnects the client socket.
997 */
998 long vnc_client_write_buf(VncState *vs, const uint8_t *data, size_t datalen)
999 {
1000 long ret;
1001 #ifdef CONFIG_VNC_TLS
1002 if (vs->tls.session) {
1003 ret = gnutls_write(vs->tls.session, data, datalen);
1004 if (ret < 0) {
1005 if (ret == GNUTLS_E_AGAIN)
1006 errno = EAGAIN;
1007 else
1008 errno = EIO;
1009 ret = -1;
1010 }
1011 } else
1012 #endif /* CONFIG_VNC_TLS */
1013 ret = send(vs->csock, (const void *)data, datalen, 0);
1014 VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data, datalen, ret);
1015 return vnc_client_io_error(vs, ret, socket_error());
1016 }
1017
1018
1019 /*
1020 * Called to write buffered data to the client socket, when not
1021 * using any SASL SSF encryption layers. Will write as much data
1022 * as possible without blocking. If all buffered data is written,
1023 * will switch the FD poll() handler back to read monitoring.
1024 *
1025 * Returns the number of bytes written, which may be less than
1026 * the buffered output data if the socket would block. Returns
1027 * -1 on error, and disconnects the client socket.
1028 */
1029 static long vnc_client_write_plain(VncState *vs)
1030 {
1031 long ret;
1032
1033 #ifdef CONFIG_VNC_SASL
1034 VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n",
1035 vs->output.buffer, vs->output.capacity, vs->output.offset,
1036 vs->sasl.waitWriteSSF);
1037
1038 if (vs->sasl.conn &&
1039 vs->sasl.runSSF &&
1040 vs->sasl.waitWriteSSF) {
1041 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF);
1042 if (ret)
1043 vs->sasl.waitWriteSSF -= ret;
1044 } else
1045 #endif /* CONFIG_VNC_SASL */
1046 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset);
1047 if (!ret)
1048 return 0;
1049
1050 memmove(vs->output.buffer, vs->output.buffer + ret, (vs->output.offset - ret));
1051 vs->output.offset -= ret;
1052
1053 if (vs->output.offset == 0) {
1054 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
1055 }
1056
1057 return ret;
1058 }
1059
1060
1061 /*
1062 * First function called whenever there is data to be written to
1063 * the client socket. Will delegate actual work according to whether
1064 * SASL SSF layers are enabled (thus requiring encryption calls)
1065 */
1066 void vnc_client_write(void *opaque)
1067 {
1068 long ret;
1069 VncState *vs = opaque;
1070
1071 #ifdef CONFIG_VNC_SASL
1072 if (vs->sasl.conn &&
1073 vs->sasl.runSSF &&
1074 !vs->sasl.waitWriteSSF)
1075 ret = vnc_client_write_sasl(vs);
1076 else
1077 #endif /* CONFIG_VNC_SASL */
1078 ret = vnc_client_write_plain(vs);
1079 }
1080
1081 void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting)
1082 {
1083 vs->read_handler = func;
1084 vs->read_handler_expect = expecting;
1085 }
1086
1087
1088 /*
1089 * Called to read a chunk of data from the client socket. The data may
1090 * be the raw data, or may need to be further decoded by SASL.
1091 * The data will be read either straight from to the socket, or
1092 * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1093 *
1094 * NB, it is theoretically possible to have 2 layers of encryption,
1095 * both SASL, and this TLS layer. It is highly unlikely in practice
1096 * though, since SASL encryption will typically be a no-op if TLS
1097 * is active
1098 *
1099 * Returns the number of bytes read, which may be less than
1100 * the requested 'datalen' if the socket would block. Returns
1101 * -1 on error, and disconnects the client socket.
1102 */
1103 long vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen)
1104 {
1105 long ret;
1106 #ifdef CONFIG_VNC_TLS
1107 if (vs->tls.session) {
1108 ret = gnutls_read(vs->tls.session, data, datalen);
1109 if (ret < 0) {
1110 if (ret == GNUTLS_E_AGAIN)
1111 errno = EAGAIN;
1112 else
1113 errno = EIO;
1114 ret = -1;
1115 }
1116 } else
1117 #endif /* CONFIG_VNC_TLS */
1118 ret = recv(vs->csock, (void *)data, datalen, 0);
1119 VNC_DEBUG("Read wire %p %zd -> %ld\n", data, datalen, ret);
1120 return vnc_client_io_error(vs, ret, socket_error());
1121 }
1122
1123
1124 /*
1125 * Called to read data from the client socket to the input buffer,
1126 * when not using any SASL SSF encryption layers. Will read as much
1127 * data as possible without blocking.
1128 *
1129 * Returns the number of bytes read. Returns -1 on error, and
1130 * disconnects the client socket.
1131 */
1132 static long vnc_client_read_plain(VncState *vs)
1133 {
1134 int ret;
1135 VNC_DEBUG("Read plain %p size %zd offset %zd\n",
1136 vs->input.buffer, vs->input.capacity, vs->input.offset);
1137 buffer_reserve(&vs->input, 4096);
1138 ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096);
1139 if (!ret)
1140 return 0;
1141 vs->input.offset += ret;
1142 return ret;
1143 }
1144
1145
1146 /*
1147 * First function called whenever there is more data to be read from
1148 * the client socket. Will delegate actual work according to whether
1149 * SASL SSF layers are enabled (thus requiring decryption calls)
1150 */
1151 void vnc_client_read(void *opaque)
1152 {
1153 VncState *vs = opaque;
1154 long ret;
1155
1156 #ifdef CONFIG_VNC_SASL
1157 if (vs->sasl.conn && vs->sasl.runSSF)
1158 ret = vnc_client_read_sasl(vs);
1159 else
1160 #endif /* CONFIG_VNC_SASL */
1161 ret = vnc_client_read_plain(vs);
1162 if (!ret) {
1163 if (vs->csock == -1)
1164 vnc_disconnect_finish(vs);
1165 return;
1166 }
1167
1168 while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) {
1169 size_t len = vs->read_handler_expect;
1170 int ret;
1171
1172 ret = vs->read_handler(vs, vs->input.buffer, len);
1173 if (vs->csock == -1) {
1174 vnc_disconnect_finish(vs);
1175 return;
1176 }
1177
1178 if (!ret) {
1179 memmove(vs->input.buffer, vs->input.buffer + len, (vs->input.offset - len));
1180 vs->input.offset -= len;
1181 } else {
1182 vs->read_handler_expect = ret;
1183 }
1184 }
1185 }
1186
1187 void vnc_write(VncState *vs, const void *data, size_t len)
1188 {
1189 buffer_reserve(&vs->output, len);
1190
1191 if (vs->csock != -1 && buffer_empty(&vs->output)) {
1192 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, vnc_client_write, vs);
1193 }
1194
1195 buffer_append(&vs->output, data, len);
1196 }
1197
1198 void vnc_write_s32(VncState *vs, int32_t value)
1199 {
1200 vnc_write_u32(vs, *(uint32_t *)&value);
1201 }
1202
1203 void vnc_write_u32(VncState *vs, uint32_t value)
1204 {
1205 uint8_t buf[4];
1206
1207 buf[0] = (value >> 24) & 0xFF;
1208 buf[1] = (value >> 16) & 0xFF;
1209 buf[2] = (value >> 8) & 0xFF;
1210 buf[3] = value & 0xFF;
1211
1212 vnc_write(vs, buf, 4);
1213 }
1214
1215 void vnc_write_u16(VncState *vs, uint16_t value)
1216 {
1217 uint8_t buf[2];
1218
1219 buf[0] = (value >> 8) & 0xFF;
1220 buf[1] = value & 0xFF;
1221
1222 vnc_write(vs, buf, 2);
1223 }
1224
1225 void vnc_write_u8(VncState *vs, uint8_t value)
1226 {
1227 vnc_write(vs, (char *)&value, 1);
1228 }
1229
1230 void vnc_flush(VncState *vs)
1231 {
1232 if (vs->csock != -1 && vs->output.offset)
1233 vnc_client_write(vs);
1234 }
1235
1236 uint8_t read_u8(uint8_t *data, size_t offset)
1237 {
1238 return data[offset];
1239 }
1240
1241 uint16_t read_u16(uint8_t *data, size_t offset)
1242 {
1243 return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF);
1244 }
1245
1246 int32_t read_s32(uint8_t *data, size_t offset)
1247 {
1248 return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) |
1249 (data[offset + 2] << 8) | data[offset + 3]);
1250 }
1251
1252 uint32_t read_u32(uint8_t *data, size_t offset)
1253 {
1254 return ((data[offset] << 24) | (data[offset + 1] << 16) |
1255 (data[offset + 2] << 8) | data[offset + 3]);
1256 }
1257
1258 static void client_cut_text(VncState *vs, size_t len, uint8_t *text)
1259 {
1260 }
1261
1262 static void check_pointer_type_change(VncState *vs, int absolute)
1263 {
1264 if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) {
1265 vnc_write_u8(vs, 0);
1266 vnc_write_u8(vs, 0);
1267 vnc_write_u16(vs, 1);
1268 vnc_framebuffer_update(vs, absolute, 0,
1269 ds_get_width(vs->ds), ds_get_height(vs->ds),
1270 VNC_ENCODING_POINTER_TYPE_CHANGE);
1271 vnc_flush(vs);
1272 }
1273 vs->absolute = absolute;
1274 }
1275
1276 static void pointer_event(VncState *vs, int button_mask, int x, int y)
1277 {
1278 int buttons = 0;
1279 int dz = 0;
1280
1281 if (button_mask & 0x01)
1282 buttons |= MOUSE_EVENT_LBUTTON;
1283 if (button_mask & 0x02)
1284 buttons |= MOUSE_EVENT_MBUTTON;
1285 if (button_mask & 0x04)
1286 buttons |= MOUSE_EVENT_RBUTTON;
1287 if (button_mask & 0x08)
1288 dz = -1;
1289 if (button_mask & 0x10)
1290 dz = 1;
1291
1292 if (vs->absolute) {
1293 kbd_mouse_event(x * 0x7FFF / (ds_get_width(vs->ds) - 1),
1294 y * 0x7FFF / (ds_get_height(vs->ds) - 1),
1295 dz, buttons);
1296 } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) {
1297 x -= 0x7FFF;
1298 y -= 0x7FFF;
1299
1300 kbd_mouse_event(x, y, dz, buttons);
1301 } else {
1302 if (vs->last_x != -1)
1303 kbd_mouse_event(x - vs->last_x,
1304 y - vs->last_y,
1305 dz, buttons);
1306 vs->last_x = x;
1307 vs->last_y = y;
1308 }
1309
1310 check_pointer_type_change(vs, kbd_mouse_is_absolute());
1311 }
1312
1313 static void reset_keys(VncState *vs)
1314 {
1315 int i;
1316 for(i = 0; i < 256; i++) {
1317 if (vs->modifiers_state[i]) {
1318 if (i & 0x80)
1319 kbd_put_keycode(0xe0);
1320 kbd_put_keycode(i | 0x80);
1321 vs->modifiers_state[i] = 0;
1322 }
1323 }
1324 }
1325
1326 static void press_key(VncState *vs, int keysym)
1327 {
1328 kbd_put_keycode(keysym2scancode(vs->vd->kbd_layout, keysym) & 0x7f);
1329 kbd_put_keycode(keysym2scancode(vs->vd->kbd_layout, keysym) | 0x80);
1330 }
1331
1332 static void do_key_event(VncState *vs, int down, int keycode, int sym)
1333 {
1334 /* QEMU console switch */
1335 switch(keycode) {
1336 case 0x2a: /* Left Shift */
1337 case 0x36: /* Right Shift */
1338 case 0x1d: /* Left CTRL */
1339 case 0x9d: /* Right CTRL */
1340 case 0x38: /* Left ALT */
1341 case 0xb8: /* Right ALT */
1342 if (down)
1343 vs->modifiers_state[keycode] = 1;
1344 else
1345 vs->modifiers_state[keycode] = 0;
1346 break;
1347 case 0x02 ... 0x0a: /* '1' to '9' keys */
1348 if (down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) {
1349 /* Reset the modifiers sent to the current console */
1350 reset_keys(vs);
1351 console_select(keycode - 0x02);
1352 return;
1353 }
1354 break;
1355 case 0x3a: /* CapsLock */
1356 case 0x45: /* NumLock */
1357 if (!down)
1358 vs->modifiers_state[keycode] ^= 1;
1359 break;
1360 }
1361
1362 if (keycode_is_keypad(vs->vd->kbd_layout, keycode)) {
1363 /* If the numlock state needs to change then simulate an additional
1364 keypress before sending this one. This will happen if the user
1365 toggles numlock away from the VNC window.
1366 */
1367 if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) {
1368 if (!vs->modifiers_state[0x45]) {
1369 vs->modifiers_state[0x45] = 1;
1370 press_key(vs, 0xff7f);
1371 }
1372 } else {
1373 if (vs->modifiers_state[0x45]) {
1374 vs->modifiers_state[0x45] = 0;
1375 press_key(vs, 0xff7f);
1376 }
1377 }
1378 }
1379
1380 if (is_graphic_console()) {
1381 if (keycode & 0x80)
1382 kbd_put_keycode(0xe0);
1383 if (down)
1384 kbd_put_keycode(keycode & 0x7f);
1385 else
1386 kbd_put_keycode(keycode | 0x80);
1387 } else {
1388 /* QEMU console emulation */
1389 if (down) {
1390 int numlock = vs->modifiers_state[0x45];
1391 switch (keycode) {
1392 case 0x2a: /* Left Shift */
1393 case 0x36: /* Right Shift */
1394 case 0x1d: /* Left CTRL */
1395 case 0x9d: /* Right CTRL */
1396 case 0x38: /* Left ALT */
1397 case 0xb8: /* Right ALT */
1398 break;
1399 case 0xc8:
1400 kbd_put_keysym(QEMU_KEY_UP);
1401 break;
1402 case 0xd0:
1403 kbd_put_keysym(QEMU_KEY_DOWN);
1404 break;
1405 case 0xcb:
1406 kbd_put_keysym(QEMU_KEY_LEFT);
1407 break;
1408 case 0xcd:
1409 kbd_put_keysym(QEMU_KEY_RIGHT);
1410 break;
1411 case 0xd3:
1412 kbd_put_keysym(QEMU_KEY_DELETE);
1413 break;
1414 case 0xc7:
1415 kbd_put_keysym(QEMU_KEY_HOME);
1416 break;
1417 case 0xcf:
1418 kbd_put_keysym(QEMU_KEY_END);
1419 break;
1420 case 0xc9:
1421 kbd_put_keysym(QEMU_KEY_PAGEUP);
1422 break;
1423 case 0xd1:
1424 kbd_put_keysym(QEMU_KEY_PAGEDOWN);
1425 break;
1426
1427 case 0x47:
1428 kbd_put_keysym(numlock ? '7' : QEMU_KEY_HOME);
1429 break;
1430 case 0x48:
1431 kbd_put_keysym(numlock ? '8' : QEMU_KEY_UP);
1432 break;
1433 case 0x49:
1434 kbd_put_keysym(numlock ? '9' : QEMU_KEY_PAGEUP);
1435 break;
1436 case 0x4b:
1437 kbd_put_keysym(numlock ? '4' : QEMU_KEY_LEFT);
1438 break;
1439 case 0x4c:
1440 kbd_put_keysym('5');
1441 break;
1442 case 0x4d:
1443 kbd_put_keysym(numlock ? '6' : QEMU_KEY_RIGHT);
1444 break;
1445 case 0x4f:
1446 kbd_put_keysym(numlock ? '1' : QEMU_KEY_END);
1447 break;
1448 case 0x50:
1449 kbd_put_keysym(numlock ? '2' : QEMU_KEY_DOWN);
1450 break;
1451 case 0x51:
1452 kbd_put_keysym(numlock ? '3' : QEMU_KEY_PAGEDOWN);
1453 break;
1454 case 0x52:
1455 kbd_put_keysym('0');
1456 break;
1457 case 0x53:
1458 kbd_put_keysym(numlock ? '.' : QEMU_KEY_DELETE);
1459 break;
1460
1461 case 0xb5:
1462 kbd_put_keysym('/');
1463 break;
1464 case 0x37:
1465 kbd_put_keysym('*');
1466 break;
1467 case 0x4a:
1468 kbd_put_keysym('-');
1469 break;
1470 case 0x4e:
1471 kbd_put_keysym('+');
1472 break;
1473 case 0x9c:
1474 kbd_put_keysym('\n');
1475 break;
1476
1477 default:
1478 kbd_put_keysym(sym);
1479 break;
1480 }
1481 }
1482 }
1483 }
1484
1485 static void key_event(VncState *vs, int down, uint32_t sym)
1486 {
1487 int keycode;
1488
1489 if (sym >= 'A' && sym <= 'Z' && is_graphic_console())
1490 sym = sym - 'A' + 'a';
1491
1492 keycode = keysym2scancode(vs->vd->kbd_layout, sym & 0xFFFF);
1493 do_key_event(vs, down, keycode, sym);
1494 }
1495
1496 static void ext_key_event(VncState *vs, int down,
1497 uint32_t sym, uint16_t keycode)
1498 {
1499 /* if the user specifies a keyboard layout, always use it */
1500 if (keyboard_layout)
1501 key_event(vs, down, sym);
1502 else
1503 do_key_event(vs, down, keycode, sym);
1504 }
1505
1506 static void framebuffer_update_request(VncState *vs, int incremental,
1507 int x_position, int y_position,
1508 int w, int h)
1509 {
1510 if (x_position > ds_get_width(vs->ds))
1511 x_position = ds_get_width(vs->ds);
1512 if (y_position > ds_get_height(vs->ds))
1513 y_position = ds_get_height(vs->ds);
1514 if (x_position + w >= ds_get_width(vs->ds))
1515 w = ds_get_width(vs->ds) - x_position;
1516 if (y_position + h >= ds_get_height(vs->ds))
1517 h = ds_get_height(vs->ds) - y_position;
1518
1519 int i;
1520 vs->need_update = 1;
1521 if (!incremental) {
1522 vs->force_update = 1;
1523 for (i = 0; i < h; i++) {
1524 vnc_set_bits(vs->dirty[y_position + i],
1525 (ds_get_width(vs->ds) / 16), VNC_DIRTY_WORDS);
1526 }
1527 }
1528 }
1529
1530 static void send_ext_key_event_ack(VncState *vs)
1531 {
1532 vnc_write_u8(vs, 0);
1533 vnc_write_u8(vs, 0);
1534 vnc_write_u16(vs, 1);
1535 vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
1536 VNC_ENCODING_EXT_KEY_EVENT);
1537 vnc_flush(vs);
1538 }
1539
1540 static void send_ext_audio_ack(VncState *vs)
1541 {
1542 vnc_write_u8(vs, 0);
1543 vnc_write_u8(vs, 0);
1544 vnc_write_u16(vs, 1);
1545 vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
1546 VNC_ENCODING_AUDIO);
1547 vnc_flush(vs);
1548 }
1549
1550 static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
1551 {
1552 int i;
1553 unsigned int enc = 0;
1554
1555 vnc_zlib_init(vs);
1556 vs->features = 0;
1557 vs->vnc_encoding = 0;
1558 vs->tight_compression = 9;
1559 vs->tight_quality = 9;
1560 vs->absolute = -1;
1561
1562 for (i = n_encodings - 1; i >= 0; i--) {
1563 enc = encodings[i];
1564 switch (enc) {
1565 case VNC_ENCODING_RAW:
1566 vs->vnc_encoding = enc;
1567 break;
1568 case VNC_ENCODING_COPYRECT:
1569 vs->features |= VNC_FEATURE_COPYRECT_MASK;
1570 break;
1571 case VNC_ENCODING_HEXTILE:
1572 vs->features |= VNC_FEATURE_HEXTILE_MASK;
1573 vs->vnc_encoding = enc;
1574 break;
1575 case VNC_ENCODING_ZLIB:
1576 vs->features |= VNC_FEATURE_ZLIB_MASK;
1577 vs->vnc_encoding = enc;
1578 break;
1579 case VNC_ENCODING_DESKTOPRESIZE:
1580 vs->features |= VNC_FEATURE_RESIZE_MASK;
1581 break;
1582 case VNC_ENCODING_POINTER_TYPE_CHANGE:
1583 vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK;
1584 break;
1585 case VNC_ENCODING_EXT_KEY_EVENT:
1586 send_ext_key_event_ack(vs);
1587 break;
1588 case VNC_ENCODING_AUDIO:
1589 send_ext_audio_ack(vs);
1590 break;
1591 case VNC_ENCODING_WMVi:
1592 vs->features |= VNC_FEATURE_WMVI_MASK;
1593 break;
1594 case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9:
1595 vs->tight_compression = (enc & 0x0F);
1596 break;
1597 case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9:
1598 vs->tight_quality = (enc & 0x0F);
1599 break;
1600 default:
1601 VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc);
1602 break;
1603 }
1604 }
1605
1606 check_pointer_type_change(vs, kbd_mouse_is_absolute());
1607 }
1608
1609 static void set_pixel_conversion(VncState *vs)
1610 {
1611 if ((vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) ==
1612 (vs->ds->surface->flags & QEMU_BIG_ENDIAN_FLAG) &&
1613 !memcmp(&(vs->clientds.pf), &(vs->ds->surface->pf), sizeof(PixelFormat))) {
1614 vs->write_pixels = vnc_write_pixels_copy;
1615 switch (vs->ds->surface->pf.bits_per_pixel) {
1616 case 8:
1617 vs->send_hextile_tile = send_hextile_tile_8;
1618 break;
1619 case 16:
1620 vs->send_hextile_tile = send_hextile_tile_16;
1621 break;
1622 case 32:
1623 vs->send_hextile_tile = send_hextile_tile_32;
1624 break;
1625 }
1626 } else {
1627 vs->write_pixels = vnc_write_pixels_generic;
1628 switch (vs->ds->surface->pf.bits_per_pixel) {
1629 case 8:
1630 vs->send_hextile_tile = send_hextile_tile_generic_8;
1631 break;
1632 case 16:
1633 vs->send_hextile_tile = send_hextile_tile_generic_16;
1634 break;
1635 case 32:
1636 vs->send_hextile_tile = send_hextile_tile_generic_32;
1637 break;
1638 }
1639 }
1640 }
1641
1642 static void set_pixel_format(VncState *vs,
1643 int bits_per_pixel, int depth,
1644 int big_endian_flag, int true_color_flag,
1645 int red_max, int green_max, int blue_max,
1646 int red_shift, int green_shift, int blue_shift)
1647 {
1648 if (!true_color_flag) {
1649 vnc_client_error(vs);
1650 return;
1651 }
1652
1653 vs->clientds = *(vs->vd->guest.ds);
1654 vs->clientds.pf.rmax = red_max;
1655 count_bits(vs->clientds.pf.rbits, red_max);
1656 vs->clientds.pf.rshift = red_shift;
1657 vs->clientds.pf.rmask = red_max << red_shift;
1658 vs->clientds.pf.gmax = green_max;
1659 count_bits(vs->clientds.pf.gbits, green_max);
1660 vs->clientds.pf.gshift = green_shift;
1661 vs->clientds.pf.gmask = green_max << green_shift;
1662 vs->clientds.pf.bmax = blue_max;
1663 count_bits(vs->clientds.pf.bbits, blue_max);
1664 vs->clientds.pf.bshift = blue_shift;
1665 vs->clientds.pf.bmask = blue_max << blue_shift;
1666 vs->clientds.pf.bits_per_pixel = bits_per_pixel;
1667 vs->clientds.pf.bytes_per_pixel = bits_per_pixel / 8;
1668 vs->clientds.pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;
1669 vs->clientds.flags = big_endian_flag ? QEMU_BIG_ENDIAN_FLAG : 0x00;
1670
1671 set_pixel_conversion(vs);
1672
1673 vga_hw_invalidate();
1674 vga_hw_update();
1675 }
1676
1677 static void pixel_format_message (VncState *vs) {
1678 char pad[3] = { 0, 0, 0 };
1679
1680 vnc_write_u8(vs, vs->ds->surface->pf.bits_per_pixel); /* bits-per-pixel */
1681 vnc_write_u8(vs, vs->ds->surface->pf.depth); /* depth */
1682
1683 #ifdef HOST_WORDS_BIGENDIAN
1684 vnc_write_u8(vs, 1); /* big-endian-flag */
1685 #else
1686 vnc_write_u8(vs, 0); /* big-endian-flag */
1687 #endif
1688 vnc_write_u8(vs, 1); /* true-color-flag */
1689 vnc_write_u16(vs, vs->ds->surface->pf.rmax); /* red-max */
1690 vnc_write_u16(vs, vs->ds->surface->pf.gmax); /* green-max */
1691 vnc_write_u16(vs, vs->ds->surface->pf.bmax); /* blue-max */
1692 vnc_write_u8(vs, vs->ds->surface->pf.rshift); /* red-shift */
1693 vnc_write_u8(vs, vs->ds->surface->pf.gshift); /* green-shift */
1694 vnc_write_u8(vs, vs->ds->surface->pf.bshift); /* blue-shift */
1695 if (vs->ds->surface->pf.bits_per_pixel == 32)
1696 vs->send_hextile_tile = send_hextile_tile_32;
1697 else if (vs->ds->surface->pf.bits_per_pixel == 16)
1698 vs->send_hextile_tile = send_hextile_tile_16;
1699 else if (vs->ds->surface->pf.bits_per_pixel == 8)
1700 vs->send_hextile_tile = send_hextile_tile_8;
1701 vs->clientds = *(vs->ds->surface);
1702 vs->clientds.flags &= ~QEMU_ALLOCATED_FLAG;
1703 vs->write_pixels = vnc_write_pixels_copy;
1704
1705 vnc_write(vs, pad, 3); /* padding */
1706 }
1707
1708 static void vnc_dpy_setdata(DisplayState *ds)
1709 {
1710 /* We don't have to do anything */
1711 }
1712
1713 static void vnc_colordepth(VncState *vs)
1714 {
1715 if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) {
1716 /* Sending a WMVi message to notify the client*/
1717 vnc_write_u8(vs, 0); /* msg id */
1718 vnc_write_u8(vs, 0);
1719 vnc_write_u16(vs, 1); /* number of rects */
1720 vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds),
1721 ds_get_height(vs->ds), VNC_ENCODING_WMVi);
1722 pixel_format_message(vs);
1723 vnc_flush(vs);
1724 } else {
1725 set_pixel_conversion(vs);
1726 }
1727 }
1728
1729 static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
1730 {
1731 int i;
1732 uint16_t limit;
1733 VncDisplay *vd = vs->vd;
1734
1735 if (data[0] > 3) {
1736 vd->timer_interval = VNC_REFRESH_INTERVAL_BASE;
1737 if (!qemu_timer_expired(vd->timer, qemu_get_clock(rt_clock) + vd->timer_interval))
1738 qemu_mod_timer(vd->timer, qemu_get_clock(rt_clock) + vd->timer_interval);
1739 }
1740
1741 switch (data[0]) {
1742 case 0:
1743 if (len == 1)
1744 return 20;
1745
1746 set_pixel_format(vs, read_u8(data, 4), read_u8(data, 5),
1747 read_u8(data, 6), read_u8(data, 7),
1748 read_u16(data, 8), read_u16(data, 10),
1749 read_u16(data, 12), read_u8(data, 14),
1750 read_u8(data, 15), read_u8(data, 16));
1751 break;
1752 case 2:
1753 if (len == 1)
1754 return 4;
1755
1756 if (len == 4) {
1757 limit = read_u16(data, 2);
1758 if (limit > 0)
1759 return 4 + (limit * 4);
1760 } else
1761 limit = read_u16(data, 2);
1762
1763 for (i = 0; i < limit; i++) {
1764 int32_t val = read_s32(data, 4 + (i * 4));
1765 memcpy(data + 4 + (i * 4), &val, sizeof(val));
1766 }
1767
1768 set_encodings(vs, (int32_t *)(data + 4), limit);
1769 break;
1770 case 3:
1771 if (len == 1)
1772 return 10;
1773
1774 framebuffer_update_request(vs,
1775 read_u8(data, 1), read_u16(data, 2), read_u16(data, 4),
1776 read_u16(data, 6), read_u16(data, 8));
1777 break;
1778 case 4:
1779 if (len == 1)
1780 return 8;
1781
1782 key_event(vs, read_u8(data, 1), read_u32(data, 4));
1783 break;
1784 case 5:
1785 if (len == 1)
1786 return 6;
1787
1788 pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
1789 break;
1790 case 6:
1791 if (len == 1)
1792 return 8;
1793
1794 if (len == 8) {
1795 uint32_t dlen = read_u32(data, 4);
1796 if (dlen > 0)
1797 return 8 + dlen;
1798 }
1799
1800 client_cut_text(vs, read_u32(data, 4), data + 8);
1801 break;
1802 case 255:
1803 if (len == 1)
1804 return 2;
1805
1806 switch (read_u8(data, 1)) {
1807 case 0:
1808 if (len == 2)
1809 return 12;
1810
1811 ext_key_event(vs, read_u16(data, 2),
1812 read_u32(data, 4), read_u32(data, 8));
1813 break;
1814 case 1:
1815 if (len == 2)
1816 return 4;
1817
1818 switch (read_u16 (data, 2)) {
1819 case 0:
1820 audio_add(vs);
1821 break;
1822 case 1:
1823 audio_del(vs);
1824 break;
1825 case 2:
1826 if (len == 4)
1827 return 10;
1828 switch (read_u8(data, 4)) {
1829 case 0: vs->as.fmt = AUD_FMT_U8; break;
1830 case 1: vs->as.fmt = AUD_FMT_S8; break;
1831 case 2: vs->as.fmt = AUD_FMT_U16; break;
1832 case 3: vs->as.fmt = AUD_FMT_S16; break;
1833 case 4: vs->as.fmt = AUD_FMT_U32; break;
1834 case 5: vs->as.fmt = AUD_FMT_S32; break;
1835 default:
1836 printf("Invalid audio format %d\n", read_u8(data, 4));
1837 vnc_client_error(vs);
1838 break;
1839 }
1840 vs->as.nchannels = read_u8(data, 5);
1841 if (vs->as.nchannels != 1 && vs->as.nchannels != 2) {
1842 printf("Invalid audio channel coount %d\n",
1843 read_u8(data, 5));
1844 vnc_client_error(vs);
1845 break;
1846 }
1847 vs->as.freq = read_u32(data, 6);
1848 break;
1849 default:
1850 printf ("Invalid audio message %d\n", read_u8(data, 4));
1851 vnc_client_error(vs);
1852 break;
1853 }
1854 break;
1855
1856 default:
1857 printf("Msg: %d\n", read_u16(data, 0));
1858 vnc_client_error(vs);
1859 break;
1860 }
1861 break;
1862 default:
1863 printf("Msg: %d\n", data[0]);
1864 vnc_client_error(vs);
1865 break;
1866 }
1867
1868 vnc_read_when(vs, protocol_client_msg, 1);
1869 return 0;
1870 }
1871
1872 static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
1873 {
1874 char buf[1024];
1875 int size;
1876
1877 vnc_write_u16(vs, ds_get_width(vs->ds));
1878 vnc_write_u16(vs, ds_get_height(vs->ds));
1879
1880 pixel_format_message(vs);
1881
1882 if (qemu_name)
1883 size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
1884 else
1885 size = snprintf(buf, sizeof(buf), "QEMU");
1886
1887 vnc_write_u32(vs, size);
1888 vnc_write(vs, buf, size);
1889 vnc_flush(vs);
1890
1891 vnc_read_when(vs, protocol_client_msg, 1);
1892
1893 return 0;
1894 }
1895
1896 void start_client_init(VncState *vs)
1897 {
1898 vnc_read_when(vs, protocol_client_init, 1);
1899 }
1900
1901 static void make_challenge(VncState *vs)
1902 {
1903 int i;
1904
1905 srand(time(NULL)+getpid()+getpid()*987654+rand());
1906
1907 for (i = 0 ; i < sizeof(vs->challenge) ; i++)
1908 vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
1909 }
1910
1911 static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
1912 {
1913 unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
1914 int i, j, pwlen;
1915 unsigned char key[8];
1916
1917 if (!vs->vd->password || !vs->vd->password[0]) {
1918 VNC_DEBUG("No password configured on server");
1919 vnc_write_u32(vs, 1); /* Reject auth */
1920 if (vs->minor >= 8) {
1921 static const char err[] = "Authentication failed";
1922 vnc_write_u32(vs, sizeof(err));
1923 vnc_write(vs, err, sizeof(err));
1924 }
1925 vnc_flush(vs);
1926 vnc_client_error(vs);
1927 return 0;
1928 }
1929
1930 memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
1931
1932 /* Calculate the expected challenge response */
1933 pwlen = strlen(vs->vd->password);
1934 for (i=0; i<sizeof(key); i++)
1935 key[i] = i<pwlen ? vs->vd->password[i] : 0;
1936 deskey(key, EN0);
1937 for (j = 0; j < VNC_AUTH_CHALLENGE_SIZE; j += 8)
1938 des(response+j, response+j);
1939
1940 /* Compare expected vs actual challenge response */
1941 if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) {
1942 VNC_DEBUG("Client challenge reponse did not match\n");
1943 vnc_write_u32(vs, 1); /* Reject auth */
1944 if (vs->minor >= 8) {
1945 static const char err[] = "Authentication failed";
1946 vnc_write_u32(vs, sizeof(err));
1947 vnc_write(vs, err, sizeof(err));
1948 }
1949 vnc_flush(vs);
1950 vnc_client_error(vs);
1951 } else {
1952 VNC_DEBUG("Accepting VNC challenge response\n");
1953 vnc_write_u32(vs, 0); /* Accept auth */
1954 vnc_flush(vs);
1955
1956 start_client_init(vs);
1957 }
1958 return 0;
1959 }
1960
1961 void start_auth_vnc(VncState *vs)
1962 {
1963 make_challenge(vs);
1964 /* Send client a 'random' challenge */
1965 vnc_write(vs, vs->challenge, sizeof(vs->challenge));
1966 vnc_flush(vs);
1967
1968 vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge));
1969 }
1970
1971
1972 static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
1973 {
1974 /* We only advertise 1 auth scheme at a time, so client
1975 * must pick the one we sent. Verify this */
1976 if (data[0] != vs->vd->auth) { /* Reject auth */
1977 VNC_DEBUG("Reject auth %d because it didn't match advertized\n", (int)data[0]);
1978 vnc_write_u32(vs, 1);
1979 if (vs->minor >= 8) {
1980 static const char err[] = "Authentication failed";
1981 vnc_write_u32(vs, sizeof(err));
1982 vnc_write(vs, err, sizeof(err));
1983 }
1984 vnc_client_error(vs);
1985 } else { /* Accept requested auth */
1986 VNC_DEBUG("Client requested auth %d\n", (int)data[0]);
1987 switch (vs->vd->auth) {
1988 case VNC_AUTH_NONE:
1989 VNC_DEBUG("Accept auth none\n");
1990 if (vs->minor >= 8) {
1991 vnc_write_u32(vs, 0); /* Accept auth completion */
1992 vnc_flush(vs);
1993 }
1994 start_client_init(vs);
1995 break;
1996
1997 case VNC_AUTH_VNC:
1998 VNC_DEBUG("Start VNC auth\n");
1999 start_auth_vnc(vs);
2000 break;
2001
2002 #ifdef CONFIG_VNC_TLS
2003 case VNC_AUTH_VENCRYPT:
2004 VNC_DEBUG("Accept VeNCrypt auth\n");;
2005 start_auth_vencrypt(vs);
2006 break;
2007 #endif /* CONFIG_VNC_TLS */
2008
2009 #ifdef CONFIG_VNC_SASL
2010 case VNC_AUTH_SASL:
2011 VNC_DEBUG("Accept SASL auth\n");
2012 start_auth_sasl(vs);
2013 break;
2014 #endif /* CONFIG_VNC_SASL */
2015
2016 default: /* Should not be possible, but just in case */
2017 VNC_DEBUG("Reject auth %d server code bug\n", vs->vd->auth);
2018 vnc_write_u8(vs, 1);
2019 if (vs->minor >= 8) {
2020 static const char err[] = "Authentication failed";
2021 vnc_write_u32(vs, sizeof(err));
2022 vnc_write(vs, err, sizeof(err));
2023 }
2024 vnc_client_error(vs);
2025 }
2026 }
2027 return 0;
2028 }
2029
2030 static int protocol_version(VncState *vs, uint8_t *version, size_t len)
2031 {
2032 char local[13];
2033
2034 memcpy(local, version, 12);
2035 local[12] = 0;
2036
2037 if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) {
2038 VNC_DEBUG("Malformed protocol version %s\n", local);
2039 vnc_client_error(vs);
2040 return 0;
2041 }
2042 VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor);
2043 if (vs->major != 3 ||
2044 (vs->minor != 3 &&
2045 vs->minor != 4 &&
2046 vs->minor != 5 &&
2047 vs->minor != 7 &&
2048 vs->minor != 8)) {
2049 VNC_DEBUG("Unsupported client version\n");
2050 vnc_write_u32(vs, VNC_AUTH_INVALID);
2051 vnc_flush(vs);
2052 vnc_client_error(vs);
2053 return 0;
2054 }
2055 /* Some broken clients report v3.4 or v3.5, which spec requires to be treated
2056 * as equivalent to v3.3 by servers
2057 */
2058 if (vs->minor == 4 || vs->minor == 5)
2059 vs->minor = 3;
2060
2061 if (vs->minor == 3) {
2062 if (vs->vd->auth == VNC_AUTH_NONE) {
2063 VNC_DEBUG("Tell client auth none\n");
2064 vnc_write_u32(vs, vs->vd->auth);
2065 vnc_flush(vs);
2066 start_client_init(vs);
2067 } else if (vs->vd->auth == VNC_AUTH_VNC) {
2068 VNC_DEBUG("Tell client VNC auth\n");
2069 vnc_write_u32(vs, vs->vd->auth);
2070 vnc_flush(vs);
2071 start_auth_vnc(vs);
2072 } else {
2073 VNC_DEBUG("Unsupported auth %d for protocol 3.3\n", vs->vd->auth);
2074 vnc_write_u32(vs, VNC_AUTH_INVALID);
2075 vnc_flush(vs);
2076 vnc_client_error(vs);
2077 }
2078 } else {
2079 VNC_DEBUG("Telling client we support auth %d\n", vs->vd->auth);
2080 vnc_write_u8(vs, 1); /* num auth */
2081 vnc_write_u8(vs, vs->vd->auth);
2082 vnc_read_when(vs, protocol_client_auth, 1);
2083 vnc_flush(vs);
2084 }
2085
2086 return 0;
2087 }
2088
2089 static int vnc_refresh_server_surface(VncDisplay *vd)
2090 {
2091 int y;
2092 uint8_t *guest_row;
2093 uint8_t *server_row;
2094 int cmp_bytes;
2095 uint32_t width_mask[VNC_DIRTY_WORDS];
2096 VncState *vs = NULL;
2097 int has_dirty = 0;
2098
2099 /*
2100 * Walk through the guest dirty map.
2101 * Check and copy modified bits from guest to server surface.
2102 * Update server dirty map.
2103 */
2104 vnc_set_bits(width_mask, (ds_get_width(vd->ds) / 16), VNC_DIRTY_WORDS);
2105 cmp_bytes = 16 * ds_get_bytes_per_pixel(vd->ds);
2106 guest_row = vd->guest.ds->data;
2107 server_row = vd->server->data;
2108 for (y = 0; y < vd->guest.ds->height; y++) {
2109 if (vnc_and_bits(vd->guest.dirty[y], width_mask, VNC_DIRTY_WORDS)) {
2110 int x;
2111 uint8_t *guest_ptr;
2112 uint8_t *server_ptr;
2113
2114 guest_ptr = guest_row;
2115 server_ptr = server_row;
2116
2117 for (x = 0; x < vd->guest.ds->width;
2118 x += 16, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) {
2119 if (!vnc_get_bit(vd->guest.dirty[y], (x / 16)))
2120 continue;
2121 vnc_clear_bit(vd->guest.dirty[y], (x / 16));
2122 if (memcmp(server_ptr, guest_ptr, cmp_bytes) == 0)
2123 continue;
2124 memcpy(server_ptr, guest_ptr, cmp_bytes);
2125 vs = vd->clients;
2126 while (vs != NULL) {
2127 vnc_set_bit(vs->dirty[y], (x / 16));
2128 vs = vs->next;
2129 }
2130 has_dirty++;
2131 }
2132 }
2133 guest_row += ds_get_linesize(vd->ds);
2134 server_row += ds_get_linesize(vd->ds);
2135 }
2136 return has_dirty;
2137 }
2138
2139 static void vnc_refresh(void *opaque)
2140 {
2141 VncDisplay *vd = opaque;
2142 VncState *vs = NULL;
2143 int has_dirty = 0, rects = 0;
2144
2145 vga_hw_update();
2146
2147 has_dirty = vnc_refresh_server_surface(vd);
2148
2149 vs = vd->clients;
2150 while (vs != NULL) {
2151 rects += vnc_update_client(vs, has_dirty);
2152 vs = vs->next;
2153 }
2154
2155 if (has_dirty && rects) {
2156 vd->timer_interval /= 2;
2157 if (vd->timer_interval < VNC_REFRESH_INTERVAL_BASE)
2158 vd->timer_interval = VNC_REFRESH_INTERVAL_BASE;
2159 } else {
2160 vd->timer_interval += VNC_REFRESH_INTERVAL_INC;
2161 if (vd->timer_interval > VNC_REFRESH_INTERVAL_MAX)
2162 vd->timer_interval = VNC_REFRESH_INTERVAL_MAX;
2163 }
2164 qemu_mod_timer(vd->timer, qemu_get_clock(rt_clock) + vd->timer_interval);
2165 }
2166
2167 static void vnc_init_timer(VncDisplay *vd)
2168 {
2169 vd->timer_interval = VNC_REFRESH_INTERVAL_BASE;
2170 if (vd->timer == NULL && vd->clients != NULL) {
2171 vd->timer = qemu_new_timer(rt_clock, vnc_refresh, vd);
2172 vnc_refresh(vd);
2173 }
2174 }
2175
2176 static void vnc_remove_timer(VncDisplay *vd)
2177 {
2178 if (vd->timer != NULL && vd->clients == NULL) {
2179 qemu_del_timer(vd->timer);
2180 qemu_free_timer(vd->timer);
2181 vd->timer = NULL;
2182 }
2183 }
2184
2185 static void vnc_connect(VncDisplay *vd, int csock)
2186 {
2187 VncState *vs = qemu_mallocz(sizeof(VncState));
2188 vs->csock = csock;
2189
2190 VNC_DEBUG("New client on socket %d\n", csock);
2191 dcl->idle = 0;
2192 socket_set_nonblock(vs->csock);
2193 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
2194
2195 vs->vd = vd;
2196 vs->ds = vd->ds;
2197 vs->last_x = -1;
2198 vs->last_y = -1;
2199
2200 vs->as.freq = 44100;
2201 vs->as.nchannels = 2;
2202 vs->as.fmt = AUD_FMT_S16;
2203 vs->as.endianness = 0;
2204
2205 vs->next = vd->clients;
2206 vd->clients = vs;
2207
2208 vga_hw_update();
2209
2210 vnc_write(vs, "RFB 003.008\n", 12);
2211 vnc_flush(vs);
2212 vnc_read_when(vs, protocol_version, 12);
2213 reset_keys(vs);
2214
2215 vnc_init_timer(vd);
2216
2217 /* vs might be free()ed here */
2218 }
2219
2220 static void vnc_listen_read(void *opaque)
2221 {
2222 VncDisplay *vs = opaque;
2223 struct sockaddr_in addr;
2224 socklen_t addrlen = sizeof(addr);
2225
2226 /* Catch-up */
2227 vga_hw_update();
2228
2229 int csock = accept(vs->lsock, (struct sockaddr *)&addr, &addrlen);
2230 if (csock != -1) {
2231 vnc_connect(vs, csock);
2232 }
2233 }
2234
2235 void vnc_display_init(DisplayState *ds)
2236 {
2237 VncDisplay *vs = qemu_mallocz(sizeof(*vs));
2238
2239 dcl = qemu_mallocz(sizeof(DisplayChangeListener));
2240
2241 ds->opaque = vs;
2242 dcl->idle = 1;
2243 vnc_display = vs;
2244
2245 vs->lsock = -1;
2246
2247 vs->ds = ds;
2248
2249 if (keyboard_layout)
2250 vs->kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout);
2251 else
2252 vs->kbd_layout = init_keyboard_layout(name2keysym, "en-us");
2253
2254 if (!vs->kbd_layout)
2255 exit(1);
2256
2257 dcl->dpy_copy = vnc_dpy_copy;
2258 dcl->dpy_update = vnc_dpy_update;
2259 dcl->dpy_resize = vnc_dpy_resize;
2260 dcl->dpy_setdata = vnc_dpy_setdata;
2261 register_displaychangelistener(ds, dcl);
2262 }
2263
2264
2265 void vnc_display_close(DisplayState *ds)
2266 {
2267 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2268
2269 if (!vs)
2270 return;
2271 if (vs->display) {
2272 qemu_free(vs->display);
2273 vs->display = NULL;
2274 }
2275 if (vs->lsock != -1) {
2276 qemu_set_fd_handler2(vs->lsock, NULL, NULL, NULL, NULL);
2277 close(vs->lsock);
2278 vs->lsock = -1;
2279 }
2280 vs->auth = VNC_AUTH_INVALID;
2281 #ifdef CONFIG_VNC_TLS
2282 vs->subauth = VNC_AUTH_INVALID;
2283 vs->tls.x509verify = 0;
2284 #endif
2285 }
2286
2287 int vnc_display_password(DisplayState *ds, const char *password)
2288 {
2289 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2290
2291 if (!vs) {
2292 return -1;
2293 }
2294
2295 if (vs->password) {
2296 qemu_free(vs->password);
2297 vs->password = NULL;
2298 }
2299 if (password && password[0]) {
2300 if (!(vs->password = qemu_strdup(password)))
2301 return -1;
2302 if (vs->auth == VNC_AUTH_NONE) {
2303 vs->auth = VNC_AUTH_VNC;
2304 }
2305 } else {
2306 vs->auth = VNC_AUTH_NONE;
2307 }
2308
2309 return 0;
2310 }
2311
2312 char *vnc_display_local_addr(DisplayState *ds)
2313 {
2314 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2315
2316 return vnc_socket_local_addr("%s:%s", vs->lsock);
2317 }
2318
2319 int vnc_display_open(DisplayState *ds, const char *display)
2320 {
2321 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2322 const char *options;
2323 int password = 0;
2324 int reverse = 0;
2325 int to_port = 0;
2326 #ifdef CONFIG_VNC_TLS
2327 int tls = 0, x509 = 0;
2328 #endif
2329 #ifdef CONFIG_VNC_SASL
2330 int sasl = 0;
2331 int saslErr;
2332 #endif
2333 int acl = 0;
2334
2335 if (!vnc_display)
2336 return -1;
2337 vnc_display_close(ds);
2338 if (strcmp(display, "none") == 0)
2339 return 0;
2340
2341 if (!(vs->display = strdup(display)))
2342 return -1;
2343
2344 options = display;
2345 while ((options = strchr(options, ','))) {
2346 options++;
2347 if (strncmp(options, "password", 8) == 0) {
2348 password = 1; /* Require password auth */
2349 } else if (strncmp(options, "reverse", 7) == 0) {
2350 reverse = 1;
2351 } else if (strncmp(options, "to=", 3) == 0) {
2352 to_port = atoi(options+3) + 5900;
2353 #ifdef CONFIG_VNC_SASL
2354 } else if (strncmp(options, "sasl", 4) == 0) {
2355 sasl = 1; /* Require SASL auth */
2356 #endif
2357 #ifdef CONFIG_VNC_TLS
2358 } else if (strncmp(options, "tls", 3) == 0) {
2359 tls = 1; /* Require TLS */
2360 } else if (strncmp(options, "x509", 4) == 0) {
2361 char *start, *end;
2362 x509 = 1; /* Require x509 certificates */
2363 if (strncmp(options, "x509verify", 10) == 0)
2364 vs->tls.x509verify = 1; /* ...and verify client certs */
2365
2366 /* Now check for 'x509=/some/path' postfix
2367 * and use that to setup x509 certificate/key paths */
2368 start = strchr(options, '=');
2369 end = strchr(options, ',');
2370 if (start && (!end || (start < end))) {
2371 int len = end ? end-(start+1) : strlen(start+1);
2372 char *path = qemu_strndup(start + 1, len);
2373
2374 VNC_DEBUG("Trying certificate path '%s'\n", path);
2375 if (vnc_tls_set_x509_creds_dir(vs, path) < 0) {
2376 fprintf(stderr, "Failed to find x509 certificates/keys in %s\n", path);
2377 qemu_free(path);
2378 qemu_free(vs->display);
2379 vs->display = NULL;
2380 return -1;
2381 }
2382 qemu_free(path);
2383 } else {
2384 fprintf(stderr, "No certificate path provided\n");
2385 qemu_free(vs->display);
2386 vs->display = NULL;
2387 return -1;
2388 }
2389 #endif
2390 } else if (strncmp(options, "acl", 3) == 0) {
2391 acl = 1;
2392 }
2393 }
2394
2395 #ifdef CONFIG_VNC_TLS
2396 if (acl && x509 && vs->tls.x509verify) {
2397 if (!(vs->tls.acl = qemu_acl_init("vnc.x509dname"))) {
2398 fprintf(stderr, "Failed to create x509 dname ACL\n");
2399 exit(1);
2400 }
2401 }
2402 #endif
2403 #ifdef CONFIG_VNC_SASL
2404 if (acl && sasl) {
2405 if (!(vs->sasl.acl = qemu_acl_init("vnc.username"))) {
2406 fprintf(stderr, "Failed to create username ACL\n");
2407 exit(1);
2408 }
2409 }
2410 #endif
2411
2412 /*
2413 * Combinations we support here:
2414 *
2415 * - no-auth (clear text, no auth)
2416 * - password (clear text, weak auth)
2417 * - sasl (encrypt, good auth *IF* using Kerberos via GSSAPI)
2418 * - tls (encrypt, weak anonymous creds, no auth)
2419 * - tls + password (encrypt, weak anonymous creds, weak auth)
2420 * - tls + sasl (encrypt, weak anonymous creds, good auth)
2421 * - tls + x509 (encrypt, good x509 creds, no auth)
2422 * - tls + x509 + password (encrypt, good x509 creds, weak auth)
2423 * - tls + x509 + sasl (encrypt, good x509 creds, good auth)
2424 *
2425 * NB1. TLS is a stackable auth scheme.
2426 * NB2. the x509 schemes have option to validate a client cert dname
2427 */
2428 if (password) {
2429 #ifdef CONFIG_VNC_TLS
2430 if (tls) {
2431 vs->auth = VNC_AUTH_VENCRYPT;
2432 if (x509) {
2433 VNC_DEBUG("Initializing VNC server with x509 password auth\n");
2434 vs->subauth = VNC_AUTH_VENCRYPT_X509VNC;
2435 } else {
2436 VNC_DEBUG("Initializing VNC server with TLS password auth\n");
2437 vs->subauth = VNC_AUTH_VENCRYPT_TLSVNC;
2438 }
2439 } else {
2440 #endif /* CONFIG_VNC_TLS */
2441 VNC_DEBUG("Initializing VNC server with password auth\n");
2442 vs->auth = VNC_AUTH_VNC;
2443 #ifdef CONFIG_VNC_TLS
2444 vs->subauth = VNC_AUTH_INVALID;
2445 }
2446 #endif /* CONFIG_VNC_TLS */
2447 #ifdef CONFIG_VNC_SASL
2448 } else if (sasl) {
2449 #ifdef CONFIG_VNC_TLS
2450 if (tls) {
2451 vs->auth = VNC_AUTH_VENCRYPT;
2452 if (x509) {
2453 VNC_DEBUG("Initializing VNC server with x509 SASL auth\n");
2454 vs->subauth = VNC_AUTH_VENCRYPT_X509SASL;
2455 } else {
2456 VNC_DEBUG("Initializing VNC server with TLS SASL auth\n");
2457 vs->subauth = VNC_AUTH_VENCRYPT_TLSSASL;
2458 }
2459 } else {
2460 #endif /* CONFIG_VNC_TLS */
2461 VNC_DEBUG("Initializing VNC server with SASL auth\n");
2462 vs->auth = VNC_AUTH_SASL;
2463 #ifdef CONFIG_VNC_TLS
2464 vs->subauth = VNC_AUTH_INVALID;
2465 }
2466 #endif /* CONFIG_VNC_TLS */
2467 #endif /* CONFIG_VNC_SASL */
2468 } else {
2469 #ifdef CONFIG_VNC_TLS
2470 if (tls) {
2471 vs->auth = VNC_AUTH_VENCRYPT;
2472 if (x509) {
2473 VNC_DEBUG("Initializing VNC server with x509 no auth\n");
2474 vs->subauth = VNC_AUTH_VENCRYPT_X509NONE;
2475 } else {
2476 VNC_DEBUG("Initializing VNC server with TLS no auth\n");
2477 vs->subauth = VNC_AUTH_VENCRYPT_TLSNONE;
2478 }
2479 } else {
2480 #endif
2481 VNC_DEBUG("Initializing VNC server with no auth\n");
2482 vs->auth = VNC_AUTH_NONE;
2483 #ifdef CONFIG_VNC_TLS
2484 vs->subauth = VNC_AUTH_INVALID;
2485 }
2486 #endif
2487 }
2488
2489 #ifdef CONFIG_VNC_SASL
2490 if ((saslErr = sasl_server_init(NULL, "qemu")) != SASL_OK) {
2491 fprintf(stderr, "Failed to initialize SASL auth %s",
2492 sasl_errstring(saslErr, NULL, NULL));
2493 free(vs->display);
2494 vs->display = NULL;
2495 return -1;
2496 }
2497 #endif
2498
2499 if (reverse) {
2500 /* connect to viewer */
2501 if (strncmp(display, "unix:", 5) == 0)
2502 vs->lsock = unix_connect(display+5);
2503 else
2504 vs->lsock = inet_connect(display, SOCK_STREAM);
2505 if (-1 == vs->lsock) {
2506 free(vs->display);
2507 vs->display = NULL;
2508 return -1;
2509 } else {
2510 int csock = vs->lsock;
2511 vs->lsock = -1;
2512 vnc_connect(vs, csock);
2513 }
2514 return 0;
2515
2516 } else {
2517 /* listen for connects */
2518 char *dpy;
2519 dpy = qemu_malloc(256);
2520 if (strncmp(display, "unix:", 5) == 0) {
2521 pstrcpy(dpy, 256, "unix:");
2522 vs->lsock = unix_listen(display+5, dpy+5, 256-5);
2523 } else {
2524 vs->lsock = inet_listen(display, dpy, 256, SOCK_STREAM, 5900);
2525 }
2526 if (-1 == vs->lsock) {
2527 free(dpy);
2528 return -1;
2529 } else {
2530 free(vs->display);
2531 vs->display = dpy;
2532 }
2533 }
2534 return qemu_set_fd_handler2(vs->lsock, NULL, vnc_listen_read, NULL, vs);
2535 }
QEmu