?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
qdev child bus support
[qemu/ar7.git] / vnc.c
blobad3c1ce151f6bedc7b2c90c5a652a6520aaeb492
1 /*
2 * QEMU VNC display driver
3 *
4 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5 * Copyright (C) 2006 Fabrice Bellard
6 * Copyright (C) 2009 Red Hat, Inc
7 *
8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to deal
10 * in the Software without restriction, including without limitation the rights
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12 * copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
14 *
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
17 *
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24 * THE SOFTWARE.
25 */
26
27 #include "vnc.h"
28 #include "sysemu.h"
29 #include "qemu_socket.h"
30 #include "qemu-timer.h"
31 #include "acl.h"
32
33 #define VNC_REFRESH_INTERVAL (1000 / 30)
34
35 #include "vnc_keysym.h"
36 #include "d3des.h"
37
38 #define count_bits(c, v) { \
39 for (c = 0; v; v >>= 1) \
40 { \
41 c += v & 1; \
42 } \
43 }
44
45
46 static VncDisplay *vnc_display; /* needed for info vnc */
47 static DisplayChangeListener *dcl;
48
49 static char *addr_to_string(const char *format,
50 struct sockaddr_storage *sa,
51 socklen_t salen) {
52 char *addr;
53 char host[NI_MAXHOST];
54 char serv[NI_MAXSERV];
55 int err;
56 size_t addrlen;
57
58 if ((err = getnameinfo((struct sockaddr *)sa, salen,
59 host, sizeof(host),
60 serv, sizeof(serv),
61 NI_NUMERICHOST | NI_NUMERICSERV)) != 0) {
62 VNC_DEBUG("Cannot resolve address %d: %s\n",
63 err, gai_strerror(err));
64 return NULL;
65 }
66
67 /* Enough for the existing format + the 2 vars we're
68 * subsituting in. */
69 addrlen = strlen(format) + strlen(host) + strlen(serv);
70 addr = qemu_malloc(addrlen + 1);
71 snprintf(addr, addrlen, format, host, serv);
72 addr[addrlen] = '\0';
73
74 return addr;
75 }
76
77
78 char *vnc_socket_local_addr(const char *format, int fd) {
79 struct sockaddr_storage sa;
80 socklen_t salen;
81
82 salen = sizeof(sa);
83 if (getsockname(fd, (struct sockaddr*)&sa, &salen) < 0)
84 return NULL;
85
86 return addr_to_string(format, &sa, salen);
87 }
88
89
90 char *vnc_socket_remote_addr(const char *format, int fd) {
91 struct sockaddr_storage sa;
92 socklen_t salen;
93
94 salen = sizeof(sa);
95 if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0)
96 return NULL;
97
98 return addr_to_string(format, &sa, salen);
99 }
100
101 static const char *vnc_auth_name(VncDisplay *vd) {
102 switch (vd->auth) {
103 case VNC_AUTH_INVALID:
104 return "invalid";
105 case VNC_AUTH_NONE:
106 return "none";
107 case VNC_AUTH_VNC:
108 return "vnc";
109 case VNC_AUTH_RA2:
110 return "ra2";
111 case VNC_AUTH_RA2NE:
112 return "ra2ne";
113 case VNC_AUTH_TIGHT:
114 return "tight";
115 case VNC_AUTH_ULTRA:
116 return "ultra";
117 case VNC_AUTH_TLS:
118 return "tls";
119 case VNC_AUTH_VENCRYPT:
120 #ifdef CONFIG_VNC_TLS
121 switch (vd->subauth) {
122 case VNC_AUTH_VENCRYPT_PLAIN:
123 return "vencrypt+plain";
124 case VNC_AUTH_VENCRYPT_TLSNONE:
125 return "vencrypt+tls+none";
126 case VNC_AUTH_VENCRYPT_TLSVNC:
127 return "vencrypt+tls+vnc";
128 case VNC_AUTH_VENCRYPT_TLSPLAIN:
129 return "vencrypt+tls+plain";
130 case VNC_AUTH_VENCRYPT_X509NONE:
131 return "vencrypt+x509+none";
132 case VNC_AUTH_VENCRYPT_X509VNC:
133 return "vencrypt+x509+vnc";
134 case VNC_AUTH_VENCRYPT_X509PLAIN:
135 return "vencrypt+x509+plain";
136 case VNC_AUTH_VENCRYPT_TLSSASL:
137 return "vencrypt+tls+sasl";
138 case VNC_AUTH_VENCRYPT_X509SASL:
139 return "vencrypt+x509+sasl";
140 default:
141 return "vencrypt";
142 }
143 #else
144 return "vencrypt";
145 #endif
146 case VNC_AUTH_SASL:
147 return "sasl";
148 }
149 return "unknown";
150 }
151
152 static void do_info_vnc_client(Monitor *mon, VncState *client)
153 {
154 char *clientAddr =
155 vnc_socket_remote_addr(" address: %s:%s\n",
156 client->csock);
157 if (!clientAddr)
158 return;
159
160 monitor_printf(mon, "Client:\n");
161 monitor_printf(mon, "%s", clientAddr);
162 free(clientAddr);
163
164 #ifdef CONFIG_VNC_TLS
165 if (client->tls.session &&
166 client->tls.dname)
167 monitor_printf(mon, " x509 dname: %s\n", client->tls.dname);
168 else
169 monitor_printf(mon, " x509 dname: none\n");
170 #endif
171 #ifdef CONFIG_VNC_SASL
172 if (client->sasl.conn &&
173 client->sasl.username)
174 monitor_printf(mon, " username: %s\n", client->sasl.username);
175 else
176 monitor_printf(mon, " username: none\n");
177 #endif
178 }
179
180 void do_info_vnc(Monitor *mon)
181 {
182 if (vnc_display == NULL || vnc_display->display == NULL) {
183 monitor_printf(mon, "Server: disabled\n");
184 } else {
185 char *serverAddr = vnc_socket_local_addr(" address: %s:%s\n",
186 vnc_display->lsock);
187
188 if (!serverAddr)
189 return;
190
191 monitor_printf(mon, "Server:\n");
192 monitor_printf(mon, "%s", serverAddr);
193 free(serverAddr);
194 monitor_printf(mon, " auth: %s\n", vnc_auth_name(vnc_display));
195
196 if (vnc_display->clients) {
197 VncState *client = vnc_display->clients;
198 while (client) {
199 do_info_vnc_client(mon, client);
200 client = client->next;
201 }
202 } else {
203 monitor_printf(mon, "Client: none\n");
204 }
205 }
206 }
207
208 static inline uint32_t vnc_has_feature(VncState *vs, int feature) {
209 return (vs->features & (1 << feature));
210 }
211
212 /* TODO
213 1) Get the queue working for IO.
214 2) there is some weirdness when using the -S option (the screen is grey
215 and not totally invalidated
216 3) resolutions > 1024
217 */
218
219 static void vnc_update_client(void *opaque);
220
221 static void vnc_colordepth(VncState *vs);
222
223 static inline void vnc_set_bit(uint32_t *d, int k)
224 {
225 d[k >> 5] |= 1 << (k & 0x1f);
226 }
227
228 static inline void vnc_clear_bit(uint32_t *d, int k)
229 {
230 d[k >> 5] &= ~(1 << (k & 0x1f));
231 }
232
233 static inline void vnc_set_bits(uint32_t *d, int n, int nb_words)
234 {
235 int j;
236
237 j = 0;
238 while (n >= 32) {
239 d[j++] = -1;
240 n -= 32;
241 }
242 if (n > 0)
243 d[j++] = (1 << n) - 1;
244 while (j < nb_words)
245 d[j++] = 0;
246 }
247
248 static inline int vnc_get_bit(const uint32_t *d, int k)
249 {
250 return (d[k >> 5] >> (k & 0x1f)) & 1;
251 }
252
253 static inline int vnc_and_bits(const uint32_t *d1, const uint32_t *d2,
254 int nb_words)
255 {
256 int i;
257 for(i = 0; i < nb_words; i++) {
258 if ((d1[i] & d2[i]) != 0)
259 return 1;
260 }
261 return 0;
262 }
263
264 static void vnc_update(VncState *vs, int x, int y, int w, int h)
265 {
266 struct VncSurface *s = &vs->guest;
267 int i;
268
269 h += y;
270
271 /* round x down to ensure the loop only spans one 16-pixel block per,
272 iteration. otherwise, if (x % 16) != 0, the last iteration may span
273 two 16-pixel blocks but we only mark the first as dirty
274 */
275 w += (x % 16);
276 x -= (x % 16);
277
278 x = MIN(x, s->ds->width);
279 y = MIN(y, s->ds->height);
280 w = MIN(x + w, s->ds->width) - x;
281 h = MIN(h, s->ds->height);
282
283 for (; y < h; y++)
284 for (i = 0; i < w; i += 16)
285 vnc_set_bit(s->dirty[y], (x + i) / 16);
286 }
287
288 static void vnc_dpy_update(DisplayState *ds, int x, int y, int w, int h)
289 {
290 VncDisplay *vd = ds->opaque;
291 VncState *vs = vd->clients;
292 while (vs != NULL) {
293 vnc_update(vs, x, y, w, h);
294 vs = vs->next;
295 }
296 }
297
298 static void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
299 int32_t encoding)
300 {
301 vnc_write_u16(vs, x);
302 vnc_write_u16(vs, y);
303 vnc_write_u16(vs, w);
304 vnc_write_u16(vs, h);
305
306 vnc_write_s32(vs, encoding);
307 }
308
309 void buffer_reserve(Buffer *buffer, size_t len)
310 {
311 if ((buffer->capacity - buffer->offset) < len) {
312 buffer->capacity += (len + 1024);
313 buffer->buffer = qemu_realloc(buffer->buffer, buffer->capacity);
314 if (buffer->buffer == NULL) {
315 fprintf(stderr, "vnc: out of memory\n");
316 exit(1);
317 }
318 }
319 }
320
321 int buffer_empty(Buffer *buffer)
322 {
323 return buffer->offset == 0;
324 }
325
326 uint8_t *buffer_end(Buffer *buffer)
327 {
328 return buffer->buffer + buffer->offset;
329 }
330
331 void buffer_reset(Buffer *buffer)
332 {
333 buffer->offset = 0;
334 }
335
336 void buffer_append(Buffer *buffer, const void *data, size_t len)
337 {
338 memcpy(buffer->buffer + buffer->offset, data, len);
339 buffer->offset += len;
340 }
341
342 static void vnc_resize(VncState *vs)
343 {
344 DisplayState *ds = vs->ds;
345 int size_changed;
346
347 /* guest surface */
348 if (!vs->guest.ds)
349 vs->guest.ds = qemu_mallocz(sizeof(*vs->guest.ds));
350 if (ds_get_bytes_per_pixel(ds) != vs->guest.ds->pf.bytes_per_pixel)
351 console_color_init(ds);
352 vnc_colordepth(vs);
353 size_changed = ds_get_width(ds) != vs->guest.ds->width ||
354 ds_get_height(ds) != vs->guest.ds->height;
355 *(vs->guest.ds) = *(ds->surface);
356 if (size_changed) {
357 if (vs->csock != -1 && vnc_has_feature(vs, VNC_FEATURE_RESIZE)) {
358 vnc_write_u8(vs, 0); /* msg id */
359 vnc_write_u8(vs, 0);
360 vnc_write_u16(vs, 1); /* number of rects */
361 vnc_framebuffer_update(vs, 0, 0, ds_get_width(ds), ds_get_height(ds),
362 VNC_ENCODING_DESKTOPRESIZE);
363 vnc_flush(vs);
364 }
365 }
366 memset(vs->guest.dirty, 0xFF, sizeof(vs->guest.dirty));
367
368 /* server surface */
369 if (!vs->server.ds)
370 vs->server.ds = qemu_mallocz(sizeof(*vs->server.ds));
371 if (vs->server.ds->data)
372 qemu_free(vs->server.ds->data);
373 *(vs->server.ds) = *(ds->surface);
374 vs->server.ds->data = qemu_mallocz(vs->server.ds->linesize *
375 vs->server.ds->height);
376 memset(vs->server.dirty, 0xFF, sizeof(vs->guest.dirty));
377 }
378
379 static void vnc_dpy_resize(DisplayState *ds)
380 {
381 VncDisplay *vd = ds->opaque;
382 VncState *vs = vd->clients;
383 while (vs != NULL) {
384 vnc_resize(vs);
385 vs = vs->next;
386 }
387 }
388
389 /* fastest code */
390 static void vnc_write_pixels_copy(VncState *vs, void *pixels, int size)
391 {
392 vnc_write(vs, pixels, size);
393 }
394
395 /* slowest but generic code. */
396 static void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
397 {
398 uint8_t r, g, b;
399
400 r = ((((v & vs->server.ds->pf.rmask) >> vs->server.ds->pf.rshift) << vs->clientds.pf.rbits) >>
401 vs->server.ds->pf.rbits);
402 g = ((((v & vs->server.ds->pf.gmask) >> vs->server.ds->pf.gshift) << vs->clientds.pf.gbits) >>
403 vs->server.ds->pf.gbits);
404 b = ((((v & vs->server.ds->pf.bmask) >> vs->server.ds->pf.bshift) << vs->clientds.pf.bbits) >>
405 vs->server.ds->pf.bbits);
406 v = (r << vs->clientds.pf.rshift) |
407 (g << vs->clientds.pf.gshift) |
408 (b << vs->clientds.pf.bshift);
409 switch(vs->clientds.pf.bytes_per_pixel) {
410 case 1:
411 buf[0] = v;
412 break;
413 case 2:
414 if (vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) {
415 buf[0] = v >> 8;
416 buf[1] = v;
417 } else {
418 buf[1] = v >> 8;
419 buf[0] = v;
420 }
421 break;
422 default:
423 case 4:
424 if (vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) {
425 buf[0] = v >> 24;
426 buf[1] = v >> 16;
427 buf[2] = v >> 8;
428 buf[3] = v;
429 } else {
430 buf[3] = v >> 24;
431 buf[2] = v >> 16;
432 buf[1] = v >> 8;
433 buf[0] = v;
434 }
435 break;
436 }
437 }
438
439 static void vnc_write_pixels_generic(VncState *vs, void *pixels1, int size)
440 {
441 uint8_t buf[4];
442
443 if (vs->server.ds->pf.bytes_per_pixel == 4) {
444 uint32_t *pixels = pixels1;
445 int n, i;
446 n = size >> 2;
447 for(i = 0; i < n; i++) {
448 vnc_convert_pixel(vs, buf, pixels[i]);
449 vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
450 }
451 } else if (vs->server.ds->pf.bytes_per_pixel == 2) {
452 uint16_t *pixels = pixels1;
453 int n, i;
454 n = size >> 1;
455 for(i = 0; i < n; i++) {
456 vnc_convert_pixel(vs, buf, pixels[i]);
457 vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
458 }
459 } else if (vs->server.ds->pf.bytes_per_pixel == 1) {
460 uint8_t *pixels = pixels1;
461 int n, i;
462 n = size;
463 for(i = 0; i < n; i++) {
464 vnc_convert_pixel(vs, buf, pixels[i]);
465 vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
466 }
467 } else {
468 fprintf(stderr, "vnc_write_pixels_generic: VncState color depth not supported\n");
469 }
470 }
471
472 static void send_framebuffer_update_raw(VncState *vs, int x, int y, int w, int h)
473 {
474 int i;
475 uint8_t *row;
476
477 row = vs->server.ds->data + y * ds_get_linesize(vs->ds) + x * ds_get_bytes_per_pixel(vs->ds);
478 for (i = 0; i < h; i++) {
479 vs->write_pixels(vs, row, w * ds_get_bytes_per_pixel(vs->ds));
480 row += ds_get_linesize(vs->ds);
481 }
482 }
483
484 static void hextile_enc_cord(uint8_t *ptr, int x, int y, int w, int h)
485 {
486 ptr[0] = ((x & 0x0F) << 4) | (y & 0x0F);
487 ptr[1] = (((w - 1) & 0x0F) << 4) | ((h - 1) & 0x0F);
488 }
489
490 #define BPP 8
491 #include "vnchextile.h"
492 #undef BPP
493
494 #define BPP 16
495 #include "vnchextile.h"
496 #undef BPP
497
498 #define BPP 32
499 #include "vnchextile.h"
500 #undef BPP
501
502 #define GENERIC
503 #define BPP 8
504 #include "vnchextile.h"
505 #undef BPP
506 #undef GENERIC
507
508 #define GENERIC
509 #define BPP 16
510 #include "vnchextile.h"
511 #undef BPP
512 #undef GENERIC
513
514 #define GENERIC
515 #define BPP 32
516 #include "vnchextile.h"
517 #undef BPP
518 #undef GENERIC
519
520 static void send_framebuffer_update_hextile(VncState *vs, int x, int y, int w, int h)
521 {
522 int i, j;
523 int has_fg, has_bg;
524 uint8_t *last_fg, *last_bg;
525
526 last_fg = (uint8_t *) qemu_malloc(vs->server.ds->pf.bytes_per_pixel);
527 last_bg = (uint8_t *) qemu_malloc(vs->server.ds->pf.bytes_per_pixel);
528 has_fg = has_bg = 0;
529 for (j = y; j < (y + h); j += 16) {
530 for (i = x; i < (x + w); i += 16) {
531 vs->send_hextile_tile(vs, i, j,
532 MIN(16, x + w - i), MIN(16, y + h - j),
533 last_bg, last_fg, &has_bg, &has_fg);
534 }
535 }
536 free(last_fg);
537 free(last_bg);
538
539 }
540
541 static void vnc_zlib_init(VncState *vs)
542 {
543 int i;
544 for (i=0; i<(sizeof(vs->zlib_stream) / sizeof(z_stream)); i++)
545 vs->zlib_stream[i].opaque = NULL;
546 }
547
548 static void vnc_zlib_start(VncState *vs)
549 {
550 buffer_reset(&vs->zlib);
551
552 // make the output buffer be the zlib buffer, so we can compress it later
553 vs->zlib_tmp = vs->output;
554 vs->output = vs->zlib;
555 }
556
557 static int vnc_zlib_stop(VncState *vs, int stream_id)
558 {
559 z_streamp zstream = &vs->zlib_stream[stream_id];
560 int previous_out;
561
562 // switch back to normal output/zlib buffers
563 vs->zlib = vs->output;
564 vs->output = vs->zlib_tmp;
565
566 // compress the zlib buffer
567
568 // initialize the stream
569 // XXX need one stream per session
570 if (zstream->opaque != vs) {
571 int err;
572
573 VNC_DEBUG("VNC: initializing zlib stream %d\n", stream_id);
574 VNC_DEBUG("VNC: opaque = %p | vs = %p\n", zstream->opaque, vs);
575 zstream->zalloc = Z_NULL;
576 zstream->zfree = Z_NULL;
577
578 err = deflateInit2(zstream, vs->tight_compression, Z_DEFLATED, MAX_WBITS,
579 MAX_MEM_LEVEL, Z_DEFAULT_STRATEGY);
580
581 if (err != Z_OK) {
582 fprintf(stderr, "VNC: error initializing zlib\n");
583 return -1;
584 }
585
586 zstream->opaque = vs;
587 }
588
589 // XXX what to do if tight_compression changed in between?
590
591 // reserve memory in output buffer
592 buffer_reserve(&vs->output, vs->zlib.offset + 64);
593
594 // set pointers
595 zstream->next_in = vs->zlib.buffer;
596 zstream->avail_in = vs->zlib.offset;
597 zstream->next_out = vs->output.buffer + vs->output.offset;
598 zstream->avail_out = vs->output.capacity - vs->output.offset;
599 zstream->data_type = Z_BINARY;
600 previous_out = zstream->total_out;
601
602 // start encoding
603 if (deflate(zstream, Z_SYNC_FLUSH) != Z_OK) {
604 fprintf(stderr, "VNC: error during zlib compression\n");
605 return -1;
606 }
607
608 vs->output.offset = vs->output.capacity - zstream->avail_out;
609 return zstream->total_out - previous_out;
610 }
611
612 static void send_framebuffer_update_zlib(VncState *vs, int x, int y, int w, int h)
613 {
614 int old_offset, new_offset, bytes_written;
615
616 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_ZLIB);
617
618 // remember where we put in the follow-up size
619 old_offset = vs->output.offset;
620 vnc_write_s32(vs, 0);
621
622 // compress the stream
623 vnc_zlib_start(vs);
624 send_framebuffer_update_raw(vs, x, y, w, h);
625 bytes_written = vnc_zlib_stop(vs, 0);
626
627 if (bytes_written == -1)
628 return;
629
630 // hack in the size
631 new_offset = vs->output.offset;
632 vs->output.offset = old_offset;
633 vnc_write_u32(vs, bytes_written);
634 vs->output.offset = new_offset;
635 }
636
637 static void send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
638 {
639 switch(vs->vnc_encoding) {
640 case VNC_ENCODING_ZLIB:
641 send_framebuffer_update_zlib(vs, x, y, w, h);
642 break;
643 case VNC_ENCODING_HEXTILE:
644 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE);
645 send_framebuffer_update_hextile(vs, x, y, w, h);
646 break;
647 default:
648 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW);
649 send_framebuffer_update_raw(vs, x, y, w, h);
650 break;
651 }
652 }
653
654 static void vnc_copy(VncState *vs, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
655 {
656 vs->force_update = 1;
657 vnc_update_client(vs);
658
659 vnc_write_u8(vs, 0); /* msg id */
660 vnc_write_u8(vs, 0);
661 vnc_write_u16(vs, 1); /* number of rects */
662 vnc_framebuffer_update(vs, dst_x, dst_y, w, h, VNC_ENCODING_COPYRECT);
663 vnc_write_u16(vs, src_x);
664 vnc_write_u16(vs, src_y);
665 vnc_flush(vs);
666 }
667
668 static void vnc_dpy_copy(DisplayState *ds, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
669 {
670 VncDisplay *vd = ds->opaque;
671 VncState *vs = vd->clients;
672 while (vs != NULL) {
673 if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT))
674 vnc_copy(vs, src_x, src_y, dst_x, dst_y, w, h);
675 else /* TODO */
676 vnc_update(vs, dst_x, dst_y, w, h);
677 vs = vs->next;
678 }
679 }
680
681 static int find_and_clear_dirty_height(struct VncSurface *s,
682 int y, int last_x, int x)
683 {
684 int h;
685
686 for (h = 1; h < (s->ds->height - y); h++) {
687 int tmp_x;
688 if (!vnc_get_bit(s->dirty[y + h], last_x))
689 break;
690 for (tmp_x = last_x; tmp_x < x; tmp_x++)
691 vnc_clear_bit(s->dirty[y + h], tmp_x);
692 }
693
694 return h;
695 }
696
697 static void vnc_update_client(void *opaque)
698 {
699 VncState *vs = opaque;
700 if (vs->need_update && vs->csock != -1) {
701 int y;
702 uint8_t *guest_row;
703 uint8_t *server_row;
704 int cmp_bytes;
705 uint32_t width_mask[VNC_DIRTY_WORDS];
706 int n_rectangles;
707 int saved_offset;
708 int has_dirty = 0;
709
710 if (vs->output.offset && !vs->audio_cap && !vs->force_update) {
711 /* kernel send buffers are full -> drop frames to throttle */
712 qemu_mod_timer(vs->timer, qemu_get_clock(rt_clock) + VNC_REFRESH_INTERVAL);
713 return;
714 }
715
716 vga_hw_update();
717
718 /*
719 * Walk through the guest dirty map.
720 * Check and copy modified bits from guest to server surface.
721 * Update server dirty map.
722 */
723 vnc_set_bits(width_mask, (ds_get_width(vs->ds) / 16), VNC_DIRTY_WORDS);
724 cmp_bytes = 16 * ds_get_bytes_per_pixel(vs->ds);
725 guest_row = vs->guest.ds->data;
726 server_row = vs->server.ds->data;
727 for (y = 0; y < vs->guest.ds->height; y++) {
728 if (vnc_and_bits(vs->guest.dirty[y], width_mask, VNC_DIRTY_WORDS)) {
729 int x;
730 uint8_t *guest_ptr;
731 uint8_t *server_ptr;
732
733 guest_ptr = guest_row;
734 server_ptr = server_row;
735
736 for (x = 0; x < vs->guest.ds->width;
737 x += 16, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) {
738 if (!vnc_get_bit(vs->guest.dirty[y], (x / 16)))
739 continue;
740 vnc_clear_bit(vs->guest.dirty[y], (x / 16));
741 if (memcmp(server_ptr, guest_ptr, cmp_bytes) == 0)
742 continue;
743 memcpy(server_ptr, guest_ptr, cmp_bytes);
744 vnc_set_bit(vs->server.dirty[y], (x / 16));
745 has_dirty++;
746 }
747 }
748 guest_row += ds_get_linesize(vs->ds);
749 server_row += ds_get_linesize(vs->ds);
750 }
751
752 if (!has_dirty && !vs->audio_cap && !vs->force_update) {
753 qemu_mod_timer(vs->timer, qemu_get_clock(rt_clock) + VNC_REFRESH_INTERVAL);
754 return;
755 }
756
757 /*
758 * Send screen updates to the vnc client using the server
759 * surface and server dirty map. guest surface updates
760 * happening in parallel don't disturb us, the next pass will
761 * send them to the client.
762 */
763 n_rectangles = 0;
764 vnc_write_u8(vs, 0); /* msg id */
765 vnc_write_u8(vs, 0);
766 saved_offset = vs->output.offset;
767 vnc_write_u16(vs, 0);
768
769 for (y = 0; y < vs->server.ds->height; y++) {
770 int x;
771 int last_x = -1;
772 for (x = 0; x < vs->server.ds->width / 16; x++) {
773 if (vnc_get_bit(vs->server.dirty[y], x)) {
774 if (last_x == -1) {
775 last_x = x;
776 }
777 vnc_clear_bit(vs->server.dirty[y], x);
778 } else {
779 if (last_x != -1) {
780 int h = find_and_clear_dirty_height(&vs->server, y, last_x, x);
781 send_framebuffer_update(vs, last_x * 16, y, (x - last_x) * 16, h);
782 n_rectangles++;
783 }
784 last_x = -1;
785 }
786 }
787 if (last_x != -1) {
788 int h = find_and_clear_dirty_height(&vs->server, y, last_x, x);
789 send_framebuffer_update(vs, last_x * 16, y, (x - last_x) * 16, h);
790 n_rectangles++;
791 }
792 }
793 vs->output.buffer[saved_offset] = (n_rectangles >> 8) & 0xFF;
794 vs->output.buffer[saved_offset + 1] = n_rectangles & 0xFF;
795 vnc_flush(vs);
796 vs->force_update = 0;
797
798 }
799
800 if (vs->csock != -1) {
801 qemu_mod_timer(vs->timer, qemu_get_clock(rt_clock) + VNC_REFRESH_INTERVAL);
802 }
803
804 }
805
806 /* audio */
807 static void audio_capture_notify(void *opaque, audcnotification_e cmd)
808 {
809 VncState *vs = opaque;
810
811 switch (cmd) {
812 case AUD_CNOTIFY_DISABLE:
813 vnc_write_u8(vs, 255);
814 vnc_write_u8(vs, 1);
815 vnc_write_u16(vs, 0);
816 vnc_flush(vs);
817 break;
818
819 case AUD_CNOTIFY_ENABLE:
820 vnc_write_u8(vs, 255);
821 vnc_write_u8(vs, 1);
822 vnc_write_u16(vs, 1);
823 vnc_flush(vs);
824 break;
825 }
826 }
827
828 static void audio_capture_destroy(void *opaque)
829 {
830 }
831
832 static void audio_capture(void *opaque, void *buf, int size)
833 {
834 VncState *vs = opaque;
835
836 vnc_write_u8(vs, 255);
837 vnc_write_u8(vs, 1);
838 vnc_write_u16(vs, 2);
839 vnc_write_u32(vs, size);
840 vnc_write(vs, buf, size);
841 vnc_flush(vs);
842 }
843
844 static void audio_add(VncState *vs)
845 {
846 Monitor *mon = cur_mon;
847 struct audio_capture_ops ops;
848
849 if (vs->audio_cap) {
850 monitor_printf(mon, "audio already running\n");
851 return;
852 }
853
854 ops.notify = audio_capture_notify;
855 ops.destroy = audio_capture_destroy;
856 ops.capture = audio_capture;
857
858 vs->audio_cap = AUD_add_capture(&vs->as, &ops, vs);
859 if (!vs->audio_cap) {
860 monitor_printf(mon, "Failed to add audio capture\n");
861 }
862 }
863
864 static void audio_del(VncState *vs)
865 {
866 if (vs->audio_cap) {
867 AUD_del_capture(vs->audio_cap, vs);
868 vs->audio_cap = NULL;
869 }
870 }
871
872
873 int vnc_client_io_error(VncState *vs, int ret, int last_errno)
874 {
875 if (ret == 0 || ret == -1) {
876 if (ret == -1) {
877 switch (last_errno) {
878 case EINTR:
879 case EAGAIN:
880 #ifdef _WIN32
881 case WSAEWOULDBLOCK:
882 #endif
883 return 0;
884 default:
885 break;
886 }
887 }
888
889 VNC_DEBUG("Closing down client sock %d %d\n", ret, ret < 0 ? last_errno : 0);
890 qemu_set_fd_handler2(vs->csock, NULL, NULL, NULL, NULL);
891 closesocket(vs->csock);
892 qemu_del_timer(vs->timer);
893 qemu_free_timer(vs->timer);
894 if (vs->input.buffer) qemu_free(vs->input.buffer);
895 if (vs->output.buffer) qemu_free(vs->output.buffer);
896 #ifdef CONFIG_VNC_TLS
897 vnc_tls_client_cleanup(vs);
898 #endif /* CONFIG_VNC_TLS */
899 #ifdef CONFIG_VNC_SASL
900 vnc_sasl_client_cleanup(vs);
901 #endif /* CONFIG_VNC_SASL */
902 audio_del(vs);
903
904 VncState *p, *parent = NULL;
905 for (p = vs->vd->clients; p != NULL; p = p->next) {
906 if (p == vs) {
907 if (parent)
908 parent->next = p->next;
909 else
910 vs->vd->clients = p->next;
911 break;
912 }
913 parent = p;
914 }
915 if (!vs->vd->clients)
916 dcl->idle = 1;
917
918 qemu_free(vs->server.ds->data);
919 qemu_free(vs->server.ds);
920 qemu_free(vs->guest.ds);
921 qemu_free(vs);
922
923 return 0;
924 }
925 return ret;
926 }
927
928
929 void vnc_client_error(VncState *vs)
930 {
931 vnc_client_io_error(vs, -1, EINVAL);
932 }
933
934
935 /*
936 * Called to write a chunk of data to the client socket. The data may
937 * be the raw data, or may have already been encoded by SASL.
938 * The data will be written either straight onto the socket, or
939 * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled
940 *
941 * NB, it is theoretically possible to have 2 layers of encryption,
942 * both SASL, and this TLS layer. It is highly unlikely in practice
943 * though, since SASL encryption will typically be a no-op if TLS
944 * is active
945 *
946 * Returns the number of bytes written, which may be less than
947 * the requested 'datalen' if the socket would block. Returns
948 * -1 on error, and disconnects the client socket.
949 */
950 long vnc_client_write_buf(VncState *vs, const uint8_t *data, size_t datalen)
951 {
952 long ret;
953 #ifdef CONFIG_VNC_TLS
954 if (vs->tls.session) {
955 ret = gnutls_write(vs->tls.session, data, datalen);
956 if (ret < 0) {
957 if (ret == GNUTLS_E_AGAIN)
958 errno = EAGAIN;
959 else
960 errno = EIO;
961 ret = -1;
962 }
963 } else
964 #endif /* CONFIG_VNC_TLS */
965 ret = send(vs->csock, data, datalen, 0);
966 VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data, datalen, ret);
967 return vnc_client_io_error(vs, ret, socket_error());
968 }
969
970
971 /*
972 * Called to write buffered data to the client socket, when not
973 * using any SASL SSF encryption layers. Will write as much data
974 * as possible without blocking. If all buffered data is written,
975 * will switch the FD poll() handler back to read monitoring.
976 *
977 * Returns the number of bytes written, which may be less than
978 * the buffered output data if the socket would block. Returns
979 * -1 on error, and disconnects the client socket.
980 */
981 static long vnc_client_write_plain(VncState *vs)
982 {
983 long ret;
984
985 #ifdef CONFIG_VNC_SASL
986 VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n",
987 vs->output.buffer, vs->output.capacity, vs->output.offset,
988 vs->sasl.waitWriteSSF);
989
990 if (vs->sasl.conn &&
991 vs->sasl.runSSF &&
992 vs->sasl.waitWriteSSF) {
993 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF);
994 if (ret)
995 vs->sasl.waitWriteSSF -= ret;
996 } else
997 #endif /* CONFIG_VNC_SASL */
998 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset);
999 if (!ret)
1000 return 0;
1001
1002 memmove(vs->output.buffer, vs->output.buffer + ret, (vs->output.offset - ret));
1003 vs->output.offset -= ret;
1004
1005 if (vs->output.offset == 0) {
1006 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
1007 }
1008
1009 return ret;
1010 }
1011
1012
1013 /*
1014 * First function called whenever there is data to be written to
1015 * the client socket. Will delegate actual work according to whether
1016 * SASL SSF layers are enabled (thus requiring encryption calls)
1017 */
1018 void vnc_client_write(void *opaque)
1019 {
1020 long ret;
1021 VncState *vs = opaque;
1022
1023 #ifdef CONFIG_VNC_SASL
1024 if (vs->sasl.conn &&
1025 vs->sasl.runSSF &&
1026 !vs->sasl.waitWriteSSF)
1027 ret = vnc_client_write_sasl(vs);
1028 else
1029 #endif /* CONFIG_VNC_SASL */
1030 ret = vnc_client_write_plain(vs);
1031 }
1032
1033 void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting)
1034 {
1035 vs->read_handler = func;
1036 vs->read_handler_expect = expecting;
1037 }
1038
1039
1040 /*
1041 * Called to read a chunk of data from the client socket. The data may
1042 * be the raw data, or may need to be further decoded by SASL.
1043 * The data will be read either straight from to the socket, or
1044 * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1045 *
1046 * NB, it is theoretically possible to have 2 layers of encryption,
1047 * both SASL, and this TLS layer. It is highly unlikely in practice
1048 * though, since SASL encryption will typically be a no-op if TLS
1049 * is active
1050 *
1051 * Returns the number of bytes read, which may be less than
1052 * the requested 'datalen' if the socket would block. Returns
1053 * -1 on error, and disconnects the client socket.
1054 */
1055 long vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen)
1056 {
1057 long ret;
1058 #ifdef CONFIG_VNC_TLS
1059 if (vs->tls.session) {
1060 ret = gnutls_read(vs->tls.session, data, datalen);
1061 if (ret < 0) {
1062 if (ret == GNUTLS_E_AGAIN)
1063 errno = EAGAIN;
1064 else
1065 errno = EIO;
1066 ret = -1;
1067 }
1068 } else
1069 #endif /* CONFIG_VNC_TLS */
1070 ret = recv(vs->csock, data, datalen, 0);
1071 VNC_DEBUG("Read wire %p %zd -> %ld\n", data, datalen, ret);
1072 return vnc_client_io_error(vs, ret, socket_error());
1073 }
1074
1075
1076 /*
1077 * Called to read data from the client socket to the input buffer,
1078 * when not using any SASL SSF encryption layers. Will read as much
1079 * data as possible without blocking.
1080 *
1081 * Returns the number of bytes read. Returns -1 on error, and
1082 * disconnects the client socket.
1083 */
1084 static long vnc_client_read_plain(VncState *vs)
1085 {
1086 int ret;
1087 VNC_DEBUG("Read plain %p size %zd offset %zd\n",
1088 vs->input.buffer, vs->input.capacity, vs->input.offset);
1089 buffer_reserve(&vs->input, 4096);
1090 ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096);
1091 if (!ret)
1092 return 0;
1093 vs->input.offset += ret;
1094 return ret;
1095 }
1096
1097
1098 /*
1099 * First function called whenever there is more data to be read from
1100 * the client socket. Will delegate actual work according to whether
1101 * SASL SSF layers are enabled (thus requiring decryption calls)
1102 */
1103 void vnc_client_read(void *opaque)
1104 {
1105 VncState *vs = opaque;
1106 long ret;
1107
1108 #ifdef CONFIG_VNC_SASL
1109 if (vs->sasl.conn && vs->sasl.runSSF)
1110 ret = vnc_client_read_sasl(vs);
1111 else
1112 #endif /* CONFIG_VNC_SASL */
1113 ret = vnc_client_read_plain(vs);
1114 if (!ret)
1115 return;
1116
1117 while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) {
1118 size_t len = vs->read_handler_expect;
1119 int ret;
1120
1121 ret = vs->read_handler(vs, vs->input.buffer, len);
1122 if (vs->csock == -1)
1123 return;
1124
1125 if (!ret) {
1126 memmove(vs->input.buffer, vs->input.buffer + len, (vs->input.offset - len));
1127 vs->input.offset -= len;
1128 } else {
1129 vs->read_handler_expect = ret;
1130 }
1131 }
1132 }
1133
1134 void vnc_write(VncState *vs, const void *data, size_t len)
1135 {
1136 buffer_reserve(&vs->output, len);
1137
1138 if (buffer_empty(&vs->output)) {
1139 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, vnc_client_write, vs);
1140 }
1141
1142 buffer_append(&vs->output, data, len);
1143 }
1144
1145 void vnc_write_s32(VncState *vs, int32_t value)
1146 {
1147 vnc_write_u32(vs, *(uint32_t *)&value);
1148 }
1149
1150 void vnc_write_u32(VncState *vs, uint32_t value)
1151 {
1152 uint8_t buf[4];
1153
1154 buf[0] = (value >> 24) & 0xFF;
1155 buf[1] = (value >> 16) & 0xFF;
1156 buf[2] = (value >> 8) & 0xFF;
1157 buf[3] = value & 0xFF;
1158
1159 vnc_write(vs, buf, 4);
1160 }
1161
1162 void vnc_write_u16(VncState *vs, uint16_t value)
1163 {
1164 uint8_t buf[2];
1165
1166 buf[0] = (value >> 8) & 0xFF;
1167 buf[1] = value & 0xFF;
1168
1169 vnc_write(vs, buf, 2);
1170 }
1171
1172 void vnc_write_u8(VncState *vs, uint8_t value)
1173 {
1174 vnc_write(vs, (char *)&value, 1);
1175 }
1176
1177 void vnc_flush(VncState *vs)
1178 {
1179 if (vs->output.offset)
1180 vnc_client_write(vs);
1181 }
1182
1183 uint8_t read_u8(uint8_t *data, size_t offset)
1184 {
1185 return data[offset];
1186 }
1187
1188 uint16_t read_u16(uint8_t *data, size_t offset)
1189 {
1190 return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF);
1191 }
1192
1193 int32_t read_s32(uint8_t *data, size_t offset)
1194 {
1195 return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) |
1196 (data[offset + 2] << 8) | data[offset + 3]);
1197 }
1198
1199 uint32_t read_u32(uint8_t *data, size_t offset)
1200 {
1201 return ((data[offset] << 24) | (data[offset + 1] << 16) |
1202 (data[offset + 2] << 8) | data[offset + 3]);
1203 }
1204
1205 static void client_cut_text(VncState *vs, size_t len, uint8_t *text)
1206 {
1207 }
1208
1209 static void check_pointer_type_change(VncState *vs, int absolute)
1210 {
1211 if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) {
1212 vnc_write_u8(vs, 0);
1213 vnc_write_u8(vs, 0);
1214 vnc_write_u16(vs, 1);
1215 vnc_framebuffer_update(vs, absolute, 0,
1216 ds_get_width(vs->ds), ds_get_height(vs->ds),
1217 VNC_ENCODING_POINTER_TYPE_CHANGE);
1218 vnc_flush(vs);
1219 }
1220 vs->absolute = absolute;
1221 }
1222
1223 static void pointer_event(VncState *vs, int button_mask, int x, int y)
1224 {
1225 int buttons = 0;
1226 int dz = 0;
1227
1228 if (button_mask & 0x01)
1229 buttons |= MOUSE_EVENT_LBUTTON;
1230 if (button_mask & 0x02)
1231 buttons |= MOUSE_EVENT_MBUTTON;
1232 if (button_mask & 0x04)
1233 buttons |= MOUSE_EVENT_RBUTTON;
1234 if (button_mask & 0x08)
1235 dz = -1;
1236 if (button_mask & 0x10)
1237 dz = 1;
1238
1239 if (vs->absolute) {
1240 kbd_mouse_event(x * 0x7FFF / (ds_get_width(vs->ds) - 1),
1241 y * 0x7FFF / (ds_get_height(vs->ds) - 1),
1242 dz, buttons);
1243 } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) {
1244 x -= 0x7FFF;
1245 y -= 0x7FFF;
1246
1247 kbd_mouse_event(x, y, dz, buttons);
1248 } else {
1249 if (vs->last_x != -1)
1250 kbd_mouse_event(x - vs->last_x,
1251 y - vs->last_y,
1252 dz, buttons);
1253 vs->last_x = x;
1254 vs->last_y = y;
1255 }
1256
1257 check_pointer_type_change(vs, kbd_mouse_is_absolute());
1258 }
1259
1260 static void reset_keys(VncState *vs)
1261 {
1262 int i;
1263 for(i = 0; i < 256; i++) {
1264 if (vs->modifiers_state[i]) {
1265 if (i & 0x80)
1266 kbd_put_keycode(0xe0);
1267 kbd_put_keycode(i | 0x80);
1268 vs->modifiers_state[i] = 0;
1269 }
1270 }
1271 }
1272
1273 static void press_key(VncState *vs, int keysym)
1274 {
1275 kbd_put_keycode(keysym2scancode(vs->vd->kbd_layout, keysym) & 0x7f);
1276 kbd_put_keycode(keysym2scancode(vs->vd->kbd_layout, keysym) | 0x80);
1277 }
1278
1279 static void do_key_event(VncState *vs, int down, int keycode, int sym)
1280 {
1281 /* QEMU console switch */
1282 switch(keycode) {
1283 case 0x2a: /* Left Shift */
1284 case 0x36: /* Right Shift */
1285 case 0x1d: /* Left CTRL */
1286 case 0x9d: /* Right CTRL */
1287 case 0x38: /* Left ALT */
1288 case 0xb8: /* Right ALT */
1289 if (down)
1290 vs->modifiers_state[keycode] = 1;
1291 else
1292 vs->modifiers_state[keycode] = 0;
1293 break;
1294 case 0x02 ... 0x0a: /* '1' to '9' keys */
1295 if (down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) {
1296 /* Reset the modifiers sent to the current console */
1297 reset_keys(vs);
1298 console_select(keycode - 0x02);
1299 return;
1300 }
1301 break;
1302 case 0x3a: /* CapsLock */
1303 case 0x45: /* NumLock */
1304 if (!down)
1305 vs->modifiers_state[keycode] ^= 1;
1306 break;
1307 }
1308
1309 if (keycode_is_keypad(vs->vd->kbd_layout, keycode)) {
1310 /* If the numlock state needs to change then simulate an additional
1311 keypress before sending this one. This will happen if the user
1312 toggles numlock away from the VNC window.
1313 */
1314 if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) {
1315 if (!vs->modifiers_state[0x45]) {
1316 vs->modifiers_state[0x45] = 1;
1317 press_key(vs, 0xff7f);
1318 }
1319 } else {
1320 if (vs->modifiers_state[0x45]) {
1321 vs->modifiers_state[0x45] = 0;
1322 press_key(vs, 0xff7f);
1323 }
1324 }
1325 }
1326
1327 if (is_graphic_console()) {
1328 if (keycode & 0x80)
1329 kbd_put_keycode(0xe0);
1330 if (down)
1331 kbd_put_keycode(keycode & 0x7f);
1332 else
1333 kbd_put_keycode(keycode | 0x80);
1334 } else {
1335 /* QEMU console emulation */
1336 if (down) {
1337 switch (keycode) {
1338 case 0x2a: /* Left Shift */
1339 case 0x36: /* Right Shift */
1340 case 0x1d: /* Left CTRL */
1341 case 0x9d: /* Right CTRL */
1342 case 0x38: /* Left ALT */
1343 case 0xb8: /* Right ALT */
1344 break;
1345 case 0xc8:
1346 case 0x48:
1347 kbd_put_keysym(QEMU_KEY_UP);
1348 break;
1349 case 0xd0:
1350 case 0x50:
1351 kbd_put_keysym(QEMU_KEY_DOWN);
1352 break;
1353 case 0xcb:
1354 case 0x4b:
1355 kbd_put_keysym(QEMU_KEY_LEFT);
1356 break;
1357 case 0xcd:
1358 case 0x4d:
1359 kbd_put_keysym(QEMU_KEY_RIGHT);
1360 break;
1361 case 0xd3:
1362 case 0x53:
1363 kbd_put_keysym(QEMU_KEY_DELETE);
1364 break;
1365 case 0xc7:
1366 case 0x47:
1367 kbd_put_keysym(QEMU_KEY_HOME);
1368 break;
1369 case 0xcf:
1370 case 0x4f:
1371 kbd_put_keysym(QEMU_KEY_END);
1372 break;
1373 case 0xc9:
1374 case 0x49:
1375 kbd_put_keysym(QEMU_KEY_PAGEUP);
1376 break;
1377 case 0xd1:
1378 case 0x51:
1379 kbd_put_keysym(QEMU_KEY_PAGEDOWN);
1380 break;
1381 default:
1382 kbd_put_keysym(sym);
1383 break;
1384 }
1385 }
1386 }
1387 }
1388
1389 static void key_event(VncState *vs, int down, uint32_t sym)
1390 {
1391 int keycode;
1392
1393 if (sym >= 'A' && sym <= 'Z' && is_graphic_console())
1394 sym = sym - 'A' + 'a';
1395
1396 keycode = keysym2scancode(vs->vd->kbd_layout, sym & 0xFFFF);
1397 do_key_event(vs, down, keycode, sym);
1398 }
1399
1400 static void ext_key_event(VncState *vs, int down,
1401 uint32_t sym, uint16_t keycode)
1402 {
1403 /* if the user specifies a keyboard layout, always use it */
1404 if (keyboard_layout)
1405 key_event(vs, down, sym);
1406 else
1407 do_key_event(vs, down, keycode, sym);
1408 }
1409
1410 static void framebuffer_update_request(VncState *vs, int incremental,
1411 int x_position, int y_position,
1412 int w, int h)
1413 {
1414 if (x_position > ds_get_width(vs->ds))
1415 x_position = ds_get_width(vs->ds);
1416 if (y_position > ds_get_height(vs->ds))
1417 y_position = ds_get_height(vs->ds);
1418 if (x_position + w >= ds_get_width(vs->ds))
1419 w = ds_get_width(vs->ds) - x_position;
1420 if (y_position + h >= ds_get_height(vs->ds))
1421 h = ds_get_height(vs->ds) - y_position;
1422
1423 int i;
1424 vs->need_update = 1;
1425 if (!incremental) {
1426 vs->force_update = 1;
1427 for (i = 0; i < h; i++) {
1428 vnc_set_bits(vs->guest.dirty[y_position + i],
1429 (ds_get_width(vs->ds) / 16), VNC_DIRTY_WORDS);
1430 vnc_set_bits(vs->server.dirty[y_position + i],
1431 (ds_get_width(vs->ds) / 16), VNC_DIRTY_WORDS);
1432 }
1433 }
1434 }
1435
1436 static void send_ext_key_event_ack(VncState *vs)
1437 {
1438 vnc_write_u8(vs, 0);
1439 vnc_write_u8(vs, 0);
1440 vnc_write_u16(vs, 1);
1441 vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
1442 VNC_ENCODING_EXT_KEY_EVENT);
1443 vnc_flush(vs);
1444 }
1445
1446 static void send_ext_audio_ack(VncState *vs)
1447 {
1448 vnc_write_u8(vs, 0);
1449 vnc_write_u8(vs, 0);
1450 vnc_write_u16(vs, 1);
1451 vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
1452 VNC_ENCODING_AUDIO);
1453 vnc_flush(vs);
1454 }
1455
1456 static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
1457 {
1458 int i;
1459 unsigned int enc = 0;
1460
1461 vnc_zlib_init(vs);
1462 vs->features = 0;
1463 vs->vnc_encoding = 0;
1464 vs->tight_compression = 9;
1465 vs->tight_quality = 9;
1466 vs->absolute = -1;
1467
1468 for (i = n_encodings - 1; i >= 0; i--) {
1469 enc = encodings[i];
1470 switch (enc) {
1471 case VNC_ENCODING_RAW:
1472 vs->vnc_encoding = enc;
1473 break;
1474 case VNC_ENCODING_COPYRECT:
1475 vs->features |= VNC_FEATURE_COPYRECT_MASK;
1476 break;
1477 case VNC_ENCODING_HEXTILE:
1478 vs->features |= VNC_FEATURE_HEXTILE_MASK;
1479 vs->vnc_encoding = enc;
1480 break;
1481 case VNC_ENCODING_ZLIB:
1482 vs->features |= VNC_FEATURE_ZLIB_MASK;
1483 vs->vnc_encoding = enc;
1484 break;
1485 case VNC_ENCODING_DESKTOPRESIZE:
1486 vs->features |= VNC_FEATURE_RESIZE_MASK;
1487 break;
1488 case VNC_ENCODING_POINTER_TYPE_CHANGE:
1489 vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK;
1490 break;
1491 case VNC_ENCODING_EXT_KEY_EVENT:
1492 send_ext_key_event_ack(vs);
1493 break;
1494 case VNC_ENCODING_AUDIO:
1495 send_ext_audio_ack(vs);
1496 break;
1497 case VNC_ENCODING_WMVi:
1498 vs->features |= VNC_FEATURE_WMVI_MASK;
1499 break;
1500 case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9:
1501 vs->tight_compression = (enc & 0x0F);
1502 break;
1503 case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9:
1504 vs->tight_quality = (enc & 0x0F);
1505 break;
1506 default:
1507 VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc);
1508 break;
1509 }
1510 }
1511
1512 check_pointer_type_change(vs, kbd_mouse_is_absolute());
1513 }
1514
1515 static void set_pixel_conversion(VncState *vs)
1516 {
1517 if ((vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) ==
1518 (vs->ds->surface->flags & QEMU_BIG_ENDIAN_FLAG) &&
1519 !memcmp(&(vs->clientds.pf), &(vs->ds->surface->pf), sizeof(PixelFormat))) {
1520 vs->write_pixels = vnc_write_pixels_copy;
1521 switch (vs->ds->surface->pf.bits_per_pixel) {
1522 case 8:
1523 vs->send_hextile_tile = send_hextile_tile_8;
1524 break;
1525 case 16:
1526 vs->send_hextile_tile = send_hextile_tile_16;
1527 break;
1528 case 32:
1529 vs->send_hextile_tile = send_hextile_tile_32;
1530 break;
1531 }
1532 } else {
1533 vs->write_pixels = vnc_write_pixels_generic;
1534 switch (vs->ds->surface->pf.bits_per_pixel) {
1535 case 8:
1536 vs->send_hextile_tile = send_hextile_tile_generic_8;
1537 break;
1538 case 16:
1539 vs->send_hextile_tile = send_hextile_tile_generic_16;
1540 break;
1541 case 32:
1542 vs->send_hextile_tile = send_hextile_tile_generic_32;
1543 break;
1544 }
1545 }
1546 }
1547
1548 static void set_pixel_format(VncState *vs,
1549 int bits_per_pixel, int depth,
1550 int big_endian_flag, int true_color_flag,
1551 int red_max, int green_max, int blue_max,
1552 int red_shift, int green_shift, int blue_shift)
1553 {
1554 if (!true_color_flag) {
1555 vnc_client_error(vs);
1556 return;
1557 }
1558
1559 vs->clientds = *(vs->guest.ds);
1560 vs->clientds.pf.rmax = red_max;
1561 count_bits(vs->clientds.pf.rbits, red_max);
1562 vs->clientds.pf.rshift = red_shift;
1563 vs->clientds.pf.rmask = red_max << red_shift;
1564 vs->clientds.pf.gmax = green_max;
1565 count_bits(vs->clientds.pf.gbits, green_max);
1566 vs->clientds.pf.gshift = green_shift;
1567 vs->clientds.pf.gmask = green_max << green_shift;
1568 vs->clientds.pf.bmax = blue_max;
1569 count_bits(vs->clientds.pf.bbits, blue_max);
1570 vs->clientds.pf.bshift = blue_shift;
1571 vs->clientds.pf.bmask = blue_max << blue_shift;
1572 vs->clientds.pf.bits_per_pixel = bits_per_pixel;
1573 vs->clientds.pf.bytes_per_pixel = bits_per_pixel / 8;
1574 vs->clientds.pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;
1575 vs->clientds.flags = big_endian_flag ? QEMU_BIG_ENDIAN_FLAG : 0x00;
1576
1577 set_pixel_conversion(vs);
1578
1579 vga_hw_invalidate();
1580 vga_hw_update();
1581 }
1582
1583 static void pixel_format_message (VncState *vs) {
1584 char pad[3] = { 0, 0, 0 };
1585
1586 vnc_write_u8(vs, vs->ds->surface->pf.bits_per_pixel); /* bits-per-pixel */
1587 vnc_write_u8(vs, vs->ds->surface->pf.depth); /* depth */
1588
1589 #ifdef WORDS_BIGENDIAN
1590 vnc_write_u8(vs, 1); /* big-endian-flag */
1591 #else
1592 vnc_write_u8(vs, 0); /* big-endian-flag */
1593 #endif
1594 vnc_write_u8(vs, 1); /* true-color-flag */
1595 vnc_write_u16(vs, vs->ds->surface->pf.rmax); /* red-max */
1596 vnc_write_u16(vs, vs->ds->surface->pf.gmax); /* green-max */
1597 vnc_write_u16(vs, vs->ds->surface->pf.bmax); /* blue-max */
1598 vnc_write_u8(vs, vs->ds->surface->pf.rshift); /* red-shift */
1599 vnc_write_u8(vs, vs->ds->surface->pf.gshift); /* green-shift */
1600 vnc_write_u8(vs, vs->ds->surface->pf.bshift); /* blue-shift */
1601 if (vs->ds->surface->pf.bits_per_pixel == 32)
1602 vs->send_hextile_tile = send_hextile_tile_32;
1603 else if (vs->ds->surface->pf.bits_per_pixel == 16)
1604 vs->send_hextile_tile = send_hextile_tile_16;
1605 else if (vs->ds->surface->pf.bits_per_pixel == 8)
1606 vs->send_hextile_tile = send_hextile_tile_8;
1607 vs->clientds = *(vs->ds->surface);
1608 vs->clientds.flags &= ~QEMU_ALLOCATED_FLAG;
1609 vs->write_pixels = vnc_write_pixels_copy;
1610
1611 vnc_write(vs, pad, 3); /* padding */
1612 }
1613
1614 static void vnc_dpy_setdata(DisplayState *ds)
1615 {
1616 /* We don't have to do anything */
1617 }
1618
1619 static void vnc_colordepth(VncState *vs)
1620 {
1621 if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) {
1622 /* Sending a WMVi message to notify the client*/
1623 vnc_write_u8(vs, 0); /* msg id */
1624 vnc_write_u8(vs, 0);
1625 vnc_write_u16(vs, 1); /* number of rects */
1626 vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds),
1627 ds_get_height(vs->ds), VNC_ENCODING_WMVi);
1628 pixel_format_message(vs);
1629 vnc_flush(vs);
1630 } else {
1631 set_pixel_conversion(vs);
1632 }
1633 }
1634
1635 static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
1636 {
1637 int i;
1638 uint16_t limit;
1639
1640 switch (data[0]) {
1641 case 0:
1642 if (len == 1)
1643 return 20;
1644
1645 set_pixel_format(vs, read_u8(data, 4), read_u8(data, 5),
1646 read_u8(data, 6), read_u8(data, 7),
1647 read_u16(data, 8), read_u16(data, 10),
1648 read_u16(data, 12), read_u8(data, 14),
1649 read_u8(data, 15), read_u8(data, 16));
1650 break;
1651 case 2:
1652 if (len == 1)
1653 return 4;
1654
1655 if (len == 4) {
1656 limit = read_u16(data, 2);
1657 if (limit > 0)
1658 return 4 + (limit * 4);
1659 } else
1660 limit = read_u16(data, 2);
1661
1662 for (i = 0; i < limit; i++) {
1663 int32_t val = read_s32(data, 4 + (i * 4));
1664 memcpy(data + 4 + (i * 4), &val, sizeof(val));
1665 }
1666
1667 set_encodings(vs, (int32_t *)(data + 4), limit);
1668 break;
1669 case 3:
1670 if (len == 1)
1671 return 10;
1672
1673 framebuffer_update_request(vs,
1674 read_u8(data, 1), read_u16(data, 2), read_u16(data, 4),
1675 read_u16(data, 6), read_u16(data, 8));
1676 break;
1677 case 4:
1678 if (len == 1)
1679 return 8;
1680
1681 key_event(vs, read_u8(data, 1), read_u32(data, 4));
1682 break;
1683 case 5:
1684 if (len == 1)
1685 return 6;
1686
1687 pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
1688 break;
1689 case 6:
1690 if (len == 1)
1691 return 8;
1692
1693 if (len == 8) {
1694 uint32_t dlen = read_u32(data, 4);
1695 if (dlen > 0)
1696 return 8 + dlen;
1697 }
1698
1699 client_cut_text(vs, read_u32(data, 4), data + 8);
1700 break;
1701 case 255:
1702 if (len == 1)
1703 return 2;
1704
1705 switch (read_u8(data, 1)) {
1706 case 0:
1707 if (len == 2)
1708 return 12;
1709
1710 ext_key_event(vs, read_u16(data, 2),
1711 read_u32(data, 4), read_u32(data, 8));
1712 break;
1713 case 1:
1714 if (len == 2)
1715 return 4;
1716
1717 switch (read_u16 (data, 2)) {
1718 case 0:
1719 audio_add(vs);
1720 break;
1721 case 1:
1722 audio_del(vs);
1723 break;
1724 case 2:
1725 if (len == 4)
1726 return 10;
1727 switch (read_u8(data, 4)) {
1728 case 0: vs->as.fmt = AUD_FMT_U8; break;
1729 case 1: vs->as.fmt = AUD_FMT_S8; break;
1730 case 2: vs->as.fmt = AUD_FMT_U16; break;
1731 case 3: vs->as.fmt = AUD_FMT_S16; break;
1732 case 4: vs->as.fmt = AUD_FMT_U32; break;
1733 case 5: vs->as.fmt = AUD_FMT_S32; break;
1734 default:
1735 printf("Invalid audio format %d\n", read_u8(data, 4));
1736 vnc_client_error(vs);
1737 break;
1738 }
1739 vs->as.nchannels = read_u8(data, 5);
1740 if (vs->as.nchannels != 1 && vs->as.nchannels != 2) {
1741 printf("Invalid audio channel coount %d\n",
1742 read_u8(data, 5));
1743 vnc_client_error(vs);
1744 break;
1745 }
1746 vs->as.freq = read_u32(data, 6);
1747 break;
1748 default:
1749 printf ("Invalid audio message %d\n", read_u8(data, 4));
1750 vnc_client_error(vs);
1751 break;
1752 }
1753 break;
1754
1755 default:
1756 printf("Msg: %d\n", read_u16(data, 0));
1757 vnc_client_error(vs);
1758 break;
1759 }
1760 break;
1761 default:
1762 printf("Msg: %d\n", data[0]);
1763 vnc_client_error(vs);
1764 break;
1765 }
1766
1767 vnc_read_when(vs, protocol_client_msg, 1);
1768 return 0;
1769 }
1770
1771 static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
1772 {
1773 char buf[1024];
1774 int size;
1775
1776 vnc_write_u16(vs, ds_get_width(vs->ds));
1777 vnc_write_u16(vs, ds_get_height(vs->ds));
1778
1779 pixel_format_message(vs);
1780
1781 if (qemu_name)
1782 size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
1783 else
1784 size = snprintf(buf, sizeof(buf), "QEMU");
1785
1786 vnc_write_u32(vs, size);
1787 vnc_write(vs, buf, size);
1788 vnc_flush(vs);
1789
1790 vnc_read_when(vs, protocol_client_msg, 1);
1791
1792 return 0;
1793 }
1794
1795 void start_client_init(VncState *vs)
1796 {
1797 vnc_read_when(vs, protocol_client_init, 1);
1798 }
1799
1800 static void make_challenge(VncState *vs)
1801 {
1802 int i;
1803
1804 srand(time(NULL)+getpid()+getpid()*987654+rand());
1805
1806 for (i = 0 ; i < sizeof(vs->challenge) ; i++)
1807 vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
1808 }
1809
1810 static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
1811 {
1812 unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
1813 int i, j, pwlen;
1814 unsigned char key[8];
1815
1816 if (!vs->vd->password || !vs->vd->password[0]) {
1817 VNC_DEBUG("No password configured on server");
1818 vnc_write_u32(vs, 1); /* Reject auth */
1819 if (vs->minor >= 8) {
1820 static const char err[] = "Authentication failed";
1821 vnc_write_u32(vs, sizeof(err));
1822 vnc_write(vs, err, sizeof(err));
1823 }
1824 vnc_flush(vs);
1825 vnc_client_error(vs);
1826 return 0;
1827 }
1828
1829 memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
1830
1831 /* Calculate the expected challenge response */
1832 pwlen = strlen(vs->vd->password);
1833 for (i=0; i<sizeof(key); i++)
1834 key[i] = i<pwlen ? vs->vd->password[i] : 0;
1835 deskey(key, EN0);
1836 for (j = 0; j < VNC_AUTH_CHALLENGE_SIZE; j += 8)
1837 des(response+j, response+j);
1838
1839 /* Compare expected vs actual challenge response */
1840 if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) {
1841 VNC_DEBUG("Client challenge reponse did not match\n");
1842 vnc_write_u32(vs, 1); /* Reject auth */
1843 if (vs->minor >= 8) {
1844 static const char err[] = "Authentication failed";
1845 vnc_write_u32(vs, sizeof(err));
1846 vnc_write(vs, err, sizeof(err));
1847 }
1848 vnc_flush(vs);
1849 vnc_client_error(vs);
1850 } else {
1851 VNC_DEBUG("Accepting VNC challenge response\n");
1852 vnc_write_u32(vs, 0); /* Accept auth */
1853 vnc_flush(vs);
1854
1855 start_client_init(vs);
1856 }
1857 return 0;
1858 }
1859
1860 void start_auth_vnc(VncState *vs)
1861 {
1862 make_challenge(vs);
1863 /* Send client a 'random' challenge */
1864 vnc_write(vs, vs->challenge, sizeof(vs->challenge));
1865 vnc_flush(vs);
1866
1867 vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge));
1868 }
1869
1870
1871 static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
1872 {
1873 /* We only advertise 1 auth scheme at a time, so client
1874 * must pick the one we sent. Verify this */
1875 if (data[0] != vs->vd->auth) { /* Reject auth */
1876 VNC_DEBUG("Reject auth %d because it didn't match advertized\n", (int)data[0]);
1877 vnc_write_u32(vs, 1);
1878 if (vs->minor >= 8) {
1879 static const char err[] = "Authentication failed";
1880 vnc_write_u32(vs, sizeof(err));
1881 vnc_write(vs, err, sizeof(err));
1882 }
1883 vnc_client_error(vs);
1884 } else { /* Accept requested auth */
1885 VNC_DEBUG("Client requested auth %d\n", (int)data[0]);
1886 switch (vs->vd->auth) {
1887 case VNC_AUTH_NONE:
1888 VNC_DEBUG("Accept auth none\n");
1889 if (vs->minor >= 8) {
1890 vnc_write_u32(vs, 0); /* Accept auth completion */
1891 vnc_flush(vs);
1892 }
1893 start_client_init(vs);
1894 break;
1895
1896 case VNC_AUTH_VNC:
1897 VNC_DEBUG("Start VNC auth\n");
1898 start_auth_vnc(vs);
1899 break;
1900
1901 #ifdef CONFIG_VNC_TLS
1902 case VNC_AUTH_VENCRYPT:
1903 VNC_DEBUG("Accept VeNCrypt auth\n");;
1904 start_auth_vencrypt(vs);
1905 break;
1906 #endif /* CONFIG_VNC_TLS */
1907
1908 #ifdef CONFIG_VNC_SASL
1909 case VNC_AUTH_SASL:
1910 VNC_DEBUG("Accept SASL auth\n");
1911 start_auth_sasl(vs);
1912 break;
1913 #endif /* CONFIG_VNC_SASL */
1914
1915 default: /* Should not be possible, but just in case */
1916 VNC_DEBUG("Reject auth %d server code bug\n", vs->vd->auth);
1917 vnc_write_u8(vs, 1);
1918 if (vs->minor >= 8) {
1919 static const char err[] = "Authentication failed";
1920 vnc_write_u32(vs, sizeof(err));
1921 vnc_write(vs, err, sizeof(err));
1922 }
1923 vnc_client_error(vs);
1924 }
1925 }
1926 return 0;
1927 }
1928
1929 static int protocol_version(VncState *vs, uint8_t *version, size_t len)
1930 {
1931 char local[13];
1932
1933 memcpy(local, version, 12);
1934 local[12] = 0;
1935
1936 if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) {
1937 VNC_DEBUG("Malformed protocol version %s\n", local);
1938 vnc_client_error(vs);
1939 return 0;
1940 }
1941 VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor);
1942 if (vs->major != 3 ||
1943 (vs->minor != 3 &&
1944 vs->minor != 4 &&
1945 vs->minor != 5 &&
1946 vs->minor != 7 &&
1947 vs->minor != 8)) {
1948 VNC_DEBUG("Unsupported client version\n");
1949 vnc_write_u32(vs, VNC_AUTH_INVALID);
1950 vnc_flush(vs);
1951 vnc_client_error(vs);
1952 return 0;
1953 }
1954 /* Some broken clients report v3.4 or v3.5, which spec requires to be treated
1955 * as equivalent to v3.3 by servers
1956 */
1957 if (vs->minor == 4 || vs->minor == 5)
1958 vs->minor = 3;
1959
1960 if (vs->minor == 3) {
1961 if (vs->vd->auth == VNC_AUTH_NONE) {
1962 VNC_DEBUG("Tell client auth none\n");
1963 vnc_write_u32(vs, vs->vd->auth);
1964 vnc_flush(vs);
1965 start_client_init(vs);
1966 } else if (vs->vd->auth == VNC_AUTH_VNC) {
1967 VNC_DEBUG("Tell client VNC auth\n");
1968 vnc_write_u32(vs, vs->vd->auth);
1969 vnc_flush(vs);
1970 start_auth_vnc(vs);
1971 } else {
1972 VNC_DEBUG("Unsupported auth %d for protocol 3.3\n", vs->vd->auth);
1973 vnc_write_u32(vs, VNC_AUTH_INVALID);
1974 vnc_flush(vs);
1975 vnc_client_error(vs);
1976 }
1977 } else {
1978 VNC_DEBUG("Telling client we support auth %d\n", vs->vd->auth);
1979 vnc_write_u8(vs, 1); /* num auth */
1980 vnc_write_u8(vs, vs->vd->auth);
1981 vnc_read_when(vs, protocol_client_auth, 1);
1982 vnc_flush(vs);
1983 }
1984
1985 return 0;
1986 }
1987
1988 static void vnc_connect(VncDisplay *vd, int csock)
1989 {
1990 VncState *vs = qemu_mallocz(sizeof(VncState));
1991 vs->csock = csock;
1992
1993 VNC_DEBUG("New client on socket %d\n", csock);
1994 dcl->idle = 0;
1995 socket_set_nonblock(vs->csock);
1996 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
1997
1998 vs->vd = vd;
1999 vs->ds = vd->ds;
2000 vs->timer = qemu_new_timer(rt_clock, vnc_update_client, vs);
2001 vs->last_x = -1;
2002 vs->last_y = -1;
2003
2004 vs->as.freq = 44100;
2005 vs->as.nchannels = 2;
2006 vs->as.fmt = AUD_FMT_S16;
2007 vs->as.endianness = 0;
2008
2009 vnc_resize(vs);
2010 vnc_write(vs, "RFB 003.008\n", 12);
2011 vnc_flush(vs);
2012 vnc_read_when(vs, protocol_version, 12);
2013 vnc_update_client(vs);
2014 reset_keys(vs);
2015
2016 vs->next = vd->clients;
2017 vd->clients = vs;
2018 }
2019
2020 static void vnc_listen_read(void *opaque)
2021 {
2022 VncDisplay *vs = opaque;
2023 struct sockaddr_in addr;
2024 socklen_t addrlen = sizeof(addr);
2025
2026 /* Catch-up */
2027 vga_hw_update();
2028
2029 int csock = accept(vs->lsock, (struct sockaddr *)&addr, &addrlen);
2030 if (csock != -1) {
2031 vnc_connect(vs, csock);
2032 }
2033 }
2034
2035 void vnc_display_init(DisplayState *ds)
2036 {
2037 VncDisplay *vs;
2038
2039 vs = qemu_mallocz(sizeof(VncState));
2040 dcl = qemu_mallocz(sizeof(DisplayChangeListener));
2041
2042 ds->opaque = vs;
2043 dcl->idle = 1;
2044 vnc_display = vs;
2045
2046 vs->lsock = -1;
2047
2048 vs->ds = ds;
2049
2050 if (keyboard_layout)
2051 vs->kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout);
2052 else
2053 vs->kbd_layout = init_keyboard_layout(name2keysym, "en-us");
2054
2055 if (!vs->kbd_layout)
2056 exit(1);
2057
2058 dcl->dpy_copy = vnc_dpy_copy;
2059 dcl->dpy_update = vnc_dpy_update;
2060 dcl->dpy_resize = vnc_dpy_resize;
2061 dcl->dpy_setdata = vnc_dpy_setdata;
2062 register_displaychangelistener(ds, dcl);
2063 }
2064
2065
2066 void vnc_display_close(DisplayState *ds)
2067 {
2068 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2069
2070 if (!vs)
2071 return;
2072 if (vs->display) {
2073 qemu_free(vs->display);
2074 vs->display = NULL;
2075 }
2076 if (vs->lsock != -1) {
2077 qemu_set_fd_handler2(vs->lsock, NULL, NULL, NULL, NULL);
2078 close(vs->lsock);
2079 vs->lsock = -1;
2080 }
2081 vs->auth = VNC_AUTH_INVALID;
2082 #ifdef CONFIG_VNC_TLS
2083 vs->subauth = VNC_AUTH_INVALID;
2084 vs->tls.x509verify = 0;
2085 #endif
2086 }
2087
2088 int vnc_display_password(DisplayState *ds, const char *password)
2089 {
2090 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2091
2092 if (vs->password) {
2093 qemu_free(vs->password);
2094 vs->password = NULL;
2095 }
2096 if (password && password[0]) {
2097 if (!(vs->password = qemu_strdup(password)))
2098 return -1;
2099 }
2100
2101 return 0;
2102 }
2103
2104 int vnc_display_open(DisplayState *ds, const char *display)
2105 {
2106 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2107 const char *options;
2108 int password = 0;
2109 int reverse = 0;
2110 int to_port = 0;
2111 #ifdef CONFIG_VNC_TLS
2112 int tls = 0, x509 = 0;
2113 #endif
2114 #ifdef CONFIG_VNC_SASL
2115 int sasl = 0;
2116 int saslErr;
2117 #endif
2118 int acl = 0;
2119
2120 if (!vnc_display)
2121 return -1;
2122 vnc_display_close(ds);
2123 if (strcmp(display, "none") == 0)
2124 return 0;
2125
2126 if (!(vs->display = strdup(display)))
2127 return -1;
2128
2129 options = display;
2130 while ((options = strchr(options, ','))) {
2131 options++;
2132 if (strncmp(options, "password", 8) == 0) {
2133 password = 1; /* Require password auth */
2134 } else if (strncmp(options, "reverse", 7) == 0) {
2135 reverse = 1;
2136 } else if (strncmp(options, "to=", 3) == 0) {
2137 to_port = atoi(options+3) + 5900;
2138 #ifdef CONFIG_VNC_SASL
2139 } else if (strncmp(options, "sasl", 4) == 0) {
2140 sasl = 1; /* Require SASL auth */
2141 #endif
2142 #ifdef CONFIG_VNC_TLS
2143 } else if (strncmp(options, "tls", 3) == 0) {
2144 tls = 1; /* Require TLS */
2145 } else if (strncmp(options, "x509", 4) == 0) {
2146 char *start, *end;
2147 x509 = 1; /* Require x509 certificates */
2148 if (strncmp(options, "x509verify", 10) == 0)
2149 vs->tls.x509verify = 1; /* ...and verify client certs */
2150
2151 /* Now check for 'x509=/some/path' postfix
2152 * and use that to setup x509 certificate/key paths */
2153 start = strchr(options, '=');
2154 end = strchr(options, ',');
2155 if (start && (!end || (start < end))) {
2156 int len = end ? end-(start+1) : strlen(start+1);
2157 char *path = qemu_strndup(start + 1, len);
2158
2159 VNC_DEBUG("Trying certificate path '%s'\n", path);
2160 if (vnc_tls_set_x509_creds_dir(vs, path) < 0) {
2161 fprintf(stderr, "Failed to find x509 certificates/keys in %s\n", path);
2162 qemu_free(path);
2163 qemu_free(vs->display);
2164 vs->display = NULL;
2165 return -1;
2166 }
2167 qemu_free(path);
2168 } else {
2169 fprintf(stderr, "No certificate path provided\n");
2170 qemu_free(vs->display);
2171 vs->display = NULL;
2172 return -1;
2173 }
2174 #endif
2175 } else if (strncmp(options, "acl", 3) == 0) {
2176 acl = 1;
2177 }
2178 }
2179
2180 #ifdef CONFIG_VNC_TLS
2181 if (acl && x509 && vs->tls.x509verify) {
2182 if (!(vs->tls.acl = qemu_acl_init("vnc.x509dname"))) {
2183 fprintf(stderr, "Failed to create x509 dname ACL\n");
2184 exit(1);
2185 }
2186 }
2187 #endif
2188 #ifdef CONFIG_VNC_SASL
2189 if (acl && sasl) {
2190 if (!(vs->sasl.acl = qemu_acl_init("vnc.username"))) {
2191 fprintf(stderr, "Failed to create username ACL\n");
2192 exit(1);
2193 }
2194 }
2195 #endif
2196
2197 /*
2198 * Combinations we support here:
2199 *
2200 * - no-auth (clear text, no auth)
2201 * - password (clear text, weak auth)
2202 * - sasl (encrypt, good auth *IF* using Kerberos via GSSAPI)
2203 * - tls (encrypt, weak anonymous creds, no auth)
2204 * - tls + password (encrypt, weak anonymous creds, weak auth)
2205 * - tls + sasl (encrypt, weak anonymous creds, good auth)
2206 * - tls + x509 (encrypt, good x509 creds, no auth)
2207 * - tls + x509 + password (encrypt, good x509 creds, weak auth)
2208 * - tls + x509 + sasl (encrypt, good x509 creds, good auth)
2209 *
2210 * NB1. TLS is a stackable auth scheme.
2211 * NB2. the x509 schemes have option to validate a client cert dname
2212 */
2213 if (password) {
2214 #ifdef CONFIG_VNC_TLS
2215 if (tls) {
2216 vs->auth = VNC_AUTH_VENCRYPT;
2217 if (x509) {
2218 VNC_DEBUG("Initializing VNC server with x509 password auth\n");
2219 vs->subauth = VNC_AUTH_VENCRYPT_X509VNC;
2220 } else {
2221 VNC_DEBUG("Initializing VNC server with TLS password auth\n");
2222 vs->subauth = VNC_AUTH_VENCRYPT_TLSVNC;
2223 }
2224 } else {
2225 #endif /* CONFIG_VNC_TLS */
2226 VNC_DEBUG("Initializing VNC server with password auth\n");
2227 vs->auth = VNC_AUTH_VNC;
2228 #ifdef CONFIG_VNC_TLS
2229 vs->subauth = VNC_AUTH_INVALID;
2230 }
2231 #endif /* CONFIG_VNC_TLS */
2232 #ifdef CONFIG_VNC_SASL
2233 } else if (sasl) {
2234 #ifdef CONFIG_VNC_TLS
2235 if (tls) {
2236 vs->auth = VNC_AUTH_VENCRYPT;
2237 if (x509) {
2238 VNC_DEBUG("Initializing VNC server with x509 SASL auth\n");
2239 vs->subauth = VNC_AUTH_VENCRYPT_X509SASL;
2240 } else {
2241 VNC_DEBUG("Initializing VNC server with TLS SASL auth\n");
2242 vs->subauth = VNC_AUTH_VENCRYPT_TLSSASL;
2243 }
2244 } else {
2245 #endif /* CONFIG_VNC_TLS */
2246 VNC_DEBUG("Initializing VNC server with SASL auth\n");
2247 vs->auth = VNC_AUTH_SASL;
2248 #ifdef CONFIG_VNC_TLS
2249 vs->subauth = VNC_AUTH_INVALID;
2250 }
2251 #endif /* CONFIG_VNC_TLS */
2252 #endif /* CONFIG_VNC_SASL */
2253 } else {
2254 #ifdef CONFIG_VNC_TLS
2255 if (tls) {
2256 vs->auth = VNC_AUTH_VENCRYPT;
2257 if (x509) {
2258 VNC_DEBUG("Initializing VNC server with x509 no auth\n");
2259 vs->subauth = VNC_AUTH_VENCRYPT_X509NONE;
2260 } else {
2261 VNC_DEBUG("Initializing VNC server with TLS no auth\n");
2262 vs->subauth = VNC_AUTH_VENCRYPT_TLSNONE;
2263 }
2264 } else {
2265 #endif
2266 VNC_DEBUG("Initializing VNC server with no auth\n");
2267 vs->auth = VNC_AUTH_NONE;
2268 #ifdef CONFIG_VNC_TLS
2269 vs->subauth = VNC_AUTH_INVALID;
2270 }
2271 #endif
2272 }
2273
2274 #ifdef CONFIG_VNC_SASL
2275 if ((saslErr = sasl_server_init(NULL, "qemu")) != SASL_OK) {
2276 fprintf(stderr, "Failed to initialize SASL auth %s",
2277 sasl_errstring(saslErr, NULL, NULL));
2278 free(vs->display);
2279 vs->display = NULL;
2280 return -1;
2281 }
2282 #endif
2283
2284 if (reverse) {
2285 /* connect to viewer */
2286 if (strncmp(display, "unix:", 5) == 0)
2287 vs->lsock = unix_connect(display+5);
2288 else
2289 vs->lsock = inet_connect(display, SOCK_STREAM);
2290 if (-1 == vs->lsock) {
2291 free(vs->display);
2292 vs->display = NULL;
2293 return -1;
2294 } else {
2295 int csock = vs->lsock;
2296 vs->lsock = -1;
2297 vnc_connect(vs, csock);
2298 }
2299 return 0;
2300
2301 } else {
2302 /* listen for connects */
2303 char *dpy;
2304 dpy = qemu_malloc(256);
2305 if (strncmp(display, "unix:", 5) == 0) {
2306 pstrcpy(dpy, 256, "unix:");
2307 vs->lsock = unix_listen(display+5, dpy+5, 256-5);
2308 } else {
2309 vs->lsock = inet_listen(display, dpy, 256, SOCK_STREAM, 5900);
2310 }
2311 if (-1 == vs->lsock) {
2312 free(dpy);
2313 return -1;
2314 } else {
2315 free(vs->display);
2316 vs->display = dpy;
2317 }
2318 }
2319 return qemu_set_fd_handler2(vs->lsock, NULL, vnc_listen_read, NULL, vs);
2320 }
AR7 emulation for QEMU