?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
vl: Deprecate -virtfs_synth
[qemu/ar7.git] / ui / vnc.c
blob1871422e1d4830af3be8d5b74bcccdc076110793
1 /*
2 * QEMU VNC display driver
3 *
4 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5 * Copyright (C) 2006 Fabrice Bellard
6 * Copyright (C) 2009 Red Hat, Inc
7 *
8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to deal
10 * in the Software without restriction, including without limitation the rights
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12 * copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
14 *
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
17 *
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24 * THE SOFTWARE.
25 */
26
27 #include "qemu/osdep.h"
28 #include "vnc.h"
29 #include "vnc-jobs.h"
30 #include "trace.h"
31 #include "sysemu/sysemu.h"
32 #include "qemu/error-report.h"
33 #include "qemu/option.h"
34 #include "qemu/sockets.h"
35 #include "qemu/timer.h"
36 #include "authz/list.h"
37 #include "qemu/config-file.h"
38 #include "qapi/qapi-emit-events.h"
39 #include "qapi/qapi-events-ui.h"
40 #include "qapi/error.h"
41 #include "qapi/qapi-commands-ui.h"
42 #include "ui/input.h"
43 #include "crypto/hash.h"
44 #include "crypto/tlscredsanon.h"
45 #include "crypto/tlscredsx509.h"
46 #include "qom/object_interfaces.h"
47 #include "qemu/cutils.h"
48 #include "io/dns-resolver.h"
49
50 #define VNC_REFRESH_INTERVAL_BASE GUI_REFRESH_INTERVAL_DEFAULT
51 #define VNC_REFRESH_INTERVAL_INC 50
52 #define VNC_REFRESH_INTERVAL_MAX GUI_REFRESH_INTERVAL_IDLE
53 static const struct timeval VNC_REFRESH_STATS = { 0, 500000 };
54 static const struct timeval VNC_REFRESH_LOSSY = { 2, 0 };
55
56 #include "vnc_keysym.h"
57 #include "crypto/cipher.h"
58
59 static QTAILQ_HEAD(, VncDisplay) vnc_displays =
60 QTAILQ_HEAD_INITIALIZER(vnc_displays);
61
62 static int vnc_cursor_define(VncState *vs);
63 static void vnc_update_throttle_offset(VncState *vs);
64
65 static void vnc_set_share_mode(VncState *vs, VncShareMode mode)
66 {
67 #ifdef _VNC_DEBUG
68 static const char *mn[] = {
69 [0] = "undefined",
70 [VNC_SHARE_MODE_CONNECTING] = "connecting",
71 [VNC_SHARE_MODE_SHARED] = "shared",
72 [VNC_SHARE_MODE_EXCLUSIVE] = "exclusive",
73 [VNC_SHARE_MODE_DISCONNECTED] = "disconnected",
74 };
75 fprintf(stderr, "%s/%p: %s -> %s\n", __func__,
76 vs->ioc, mn[vs->share_mode], mn[mode]);
77 #endif
78
79 switch (vs->share_mode) {
80 case VNC_SHARE_MODE_CONNECTING:
81 vs->vd->num_connecting--;
82 break;
83 case VNC_SHARE_MODE_SHARED:
84 vs->vd->num_shared--;
85 break;
86 case VNC_SHARE_MODE_EXCLUSIVE:
87 vs->vd->num_exclusive--;
88 break;
89 default:
90 break;
91 }
92
93 vs->share_mode = mode;
94
95 switch (vs->share_mode) {
96 case VNC_SHARE_MODE_CONNECTING:
97 vs->vd->num_connecting++;
98 break;
99 case VNC_SHARE_MODE_SHARED:
100 vs->vd->num_shared++;
101 break;
102 case VNC_SHARE_MODE_EXCLUSIVE:
103 vs->vd->num_exclusive++;
104 break;
105 default:
106 break;
107 }
108 }
109
110
111 static void vnc_init_basic_info(SocketAddress *addr,
112 VncBasicInfo *info,
113 Error **errp)
114 {
115 switch (addr->type) {
116 case SOCKET_ADDRESS_TYPE_INET:
117 info->host = g_strdup(addr->u.inet.host);
118 info->service = g_strdup(addr->u.inet.port);
119 if (addr->u.inet.ipv6) {
120 info->family = NETWORK_ADDRESS_FAMILY_IPV6;
121 } else {
122 info->family = NETWORK_ADDRESS_FAMILY_IPV4;
123 }
124 break;
125
126 case SOCKET_ADDRESS_TYPE_UNIX:
127 info->host = g_strdup("");
128 info->service = g_strdup(addr->u.q_unix.path);
129 info->family = NETWORK_ADDRESS_FAMILY_UNIX;
130 break;
131
132 case SOCKET_ADDRESS_TYPE_VSOCK:
133 case SOCKET_ADDRESS_TYPE_FD:
134 error_setg(errp, "Unsupported socket address type %s",
135 SocketAddressType_str(addr->type));
136 break;
137 default:
138 abort();
139 }
140
141 return;
142 }
143
144 static void vnc_init_basic_info_from_server_addr(QIOChannelSocket *ioc,
145 VncBasicInfo *info,
146 Error **errp)
147 {
148 SocketAddress *addr = NULL;
149
150 if (!ioc) {
151 error_setg(errp, "No listener socket available");
152 return;
153 }
154
155 addr = qio_channel_socket_get_local_address(ioc, errp);
156 if (!addr) {
157 return;
158 }
159
160 vnc_init_basic_info(addr, info, errp);
161 qapi_free_SocketAddress(addr);
162 }
163
164 static void vnc_init_basic_info_from_remote_addr(QIOChannelSocket *ioc,
165 VncBasicInfo *info,
166 Error **errp)
167 {
168 SocketAddress *addr = NULL;
169
170 addr = qio_channel_socket_get_remote_address(ioc, errp);
171 if (!addr) {
172 return;
173 }
174
175 vnc_init_basic_info(addr, info, errp);
176 qapi_free_SocketAddress(addr);
177 }
178
179 static const char *vnc_auth_name(VncDisplay *vd) {
180 switch (vd->auth) {
181 case VNC_AUTH_INVALID:
182 return "invalid";
183 case VNC_AUTH_NONE:
184 return "none";
185 case VNC_AUTH_VNC:
186 return "vnc";
187 case VNC_AUTH_RA2:
188 return "ra2";
189 case VNC_AUTH_RA2NE:
190 return "ra2ne";
191 case VNC_AUTH_TIGHT:
192 return "tight";
193 case VNC_AUTH_ULTRA:
194 return "ultra";
195 case VNC_AUTH_TLS:
196 return "tls";
197 case VNC_AUTH_VENCRYPT:
198 switch (vd->subauth) {
199 case VNC_AUTH_VENCRYPT_PLAIN:
200 return "vencrypt+plain";
201 case VNC_AUTH_VENCRYPT_TLSNONE:
202 return "vencrypt+tls+none";
203 case VNC_AUTH_VENCRYPT_TLSVNC:
204 return "vencrypt+tls+vnc";
205 case VNC_AUTH_VENCRYPT_TLSPLAIN:
206 return "vencrypt+tls+plain";
207 case VNC_AUTH_VENCRYPT_X509NONE:
208 return "vencrypt+x509+none";
209 case VNC_AUTH_VENCRYPT_X509VNC:
210 return "vencrypt+x509+vnc";
211 case VNC_AUTH_VENCRYPT_X509PLAIN:
212 return "vencrypt+x509+plain";
213 case VNC_AUTH_VENCRYPT_TLSSASL:
214 return "vencrypt+tls+sasl";
215 case VNC_AUTH_VENCRYPT_X509SASL:
216 return "vencrypt+x509+sasl";
217 default:
218 return "vencrypt";
219 }
220 case VNC_AUTH_SASL:
221 return "sasl";
222 }
223 return "unknown";
224 }
225
226 static VncServerInfo *vnc_server_info_get(VncDisplay *vd)
227 {
228 VncServerInfo *info;
229 Error *err = NULL;
230
231 if (!vd->listener || !vd->listener->nsioc) {
232 return NULL;
233 }
234
235 info = g_malloc0(sizeof(*info));
236 vnc_init_basic_info_from_server_addr(vd->listener->sioc[0],
237 qapi_VncServerInfo_base(info), &err);
238 info->has_auth = true;
239 info->auth = g_strdup(vnc_auth_name(vd));
240 if (err) {
241 qapi_free_VncServerInfo(info);
242 info = NULL;
243 error_free(err);
244 }
245 return info;
246 }
247
248 static void vnc_client_cache_auth(VncState *client)
249 {
250 if (!client->info) {
251 return;
252 }
253
254 if (client->tls) {
255 client->info->x509_dname =
256 qcrypto_tls_session_get_peer_name(client->tls);
257 client->info->has_x509_dname =
258 client->info->x509_dname != NULL;
259 }
260 #ifdef CONFIG_VNC_SASL
261 if (client->sasl.conn &&
262 client->sasl.username) {
263 client->info->has_sasl_username = true;
264 client->info->sasl_username = g_strdup(client->sasl.username);
265 }
266 #endif
267 }
268
269 static void vnc_client_cache_addr(VncState *client)
270 {
271 Error *err = NULL;
272
273 client->info = g_malloc0(sizeof(*client->info));
274 vnc_init_basic_info_from_remote_addr(client->sioc,
275 qapi_VncClientInfo_base(client->info),
276 &err);
277 if (err) {
278 qapi_free_VncClientInfo(client->info);
279 client->info = NULL;
280 error_free(err);
281 }
282 }
283
284 static void vnc_qmp_event(VncState *vs, QAPIEvent event)
285 {
286 VncServerInfo *si;
287
288 if (!vs->info) {
289 return;
290 }
291
292 si = vnc_server_info_get(vs->vd);
293 if (!si) {
294 return;
295 }
296
297 switch (event) {
298 case QAPI_EVENT_VNC_CONNECTED:
299 qapi_event_send_vnc_connected(si, qapi_VncClientInfo_base(vs->info));
300 break;
301 case QAPI_EVENT_VNC_INITIALIZED:
302 qapi_event_send_vnc_initialized(si, vs->info);
303 break;
304 case QAPI_EVENT_VNC_DISCONNECTED:
305 qapi_event_send_vnc_disconnected(si, vs->info);
306 break;
307 default:
308 break;
309 }
310
311 qapi_free_VncServerInfo(si);
312 }
313
314 static VncClientInfo *qmp_query_vnc_client(const VncState *client)
315 {
316 VncClientInfo *info;
317 Error *err = NULL;
318
319 info = g_malloc0(sizeof(*info));
320
321 vnc_init_basic_info_from_remote_addr(client->sioc,
322 qapi_VncClientInfo_base(info),
323 &err);
324 if (err) {
325 error_free(err);
326 qapi_free_VncClientInfo(info);
327 return NULL;
328 }
329
330 info->websocket = client->websocket;
331
332 if (client->tls) {
333 info->x509_dname = qcrypto_tls_session_get_peer_name(client->tls);
334 info->has_x509_dname = info->x509_dname != NULL;
335 }
336 #ifdef CONFIG_VNC_SASL
337 if (client->sasl.conn && client->sasl.username) {
338 info->has_sasl_username = true;
339 info->sasl_username = g_strdup(client->sasl.username);
340 }
341 #endif
342
343 return info;
344 }
345
346 static VncDisplay *vnc_display_find(const char *id)
347 {
348 VncDisplay *vd;
349
350 if (id == NULL) {
351 return QTAILQ_FIRST(&vnc_displays);
352 }
353 QTAILQ_FOREACH(vd, &vnc_displays, next) {
354 if (strcmp(id, vd->id) == 0) {
355 return vd;
356 }
357 }
358 return NULL;
359 }
360
361 static VncClientInfoList *qmp_query_client_list(VncDisplay *vd)
362 {
363 VncClientInfoList *cinfo, *prev = NULL;
364 VncState *client;
365
366 QTAILQ_FOREACH(client, &vd->clients, next) {
367 cinfo = g_new0(VncClientInfoList, 1);
368 cinfo->value = qmp_query_vnc_client(client);
369 cinfo->next = prev;
370 prev = cinfo;
371 }
372 return prev;
373 }
374
375 VncInfo *qmp_query_vnc(Error **errp)
376 {
377 VncInfo *info = g_malloc0(sizeof(*info));
378 VncDisplay *vd = vnc_display_find(NULL);
379 SocketAddress *addr = NULL;
380
381 if (vd == NULL || !vd->listener || !vd->listener->nsioc) {
382 info->enabled = false;
383 } else {
384 info->enabled = true;
385
386 /* for compatibility with the original command */
387 info->has_clients = true;
388 info->clients = qmp_query_client_list(vd);
389
390 addr = qio_channel_socket_get_local_address(vd->listener->sioc[0],
391 errp);
392 if (!addr) {
393 goto out_error;
394 }
395
396 switch (addr->type) {
397 case SOCKET_ADDRESS_TYPE_INET:
398 info->host = g_strdup(addr->u.inet.host);
399 info->service = g_strdup(addr->u.inet.port);
400 if (addr->u.inet.ipv6) {
401 info->family = NETWORK_ADDRESS_FAMILY_IPV6;
402 } else {
403 info->family = NETWORK_ADDRESS_FAMILY_IPV4;
404 }
405 break;
406
407 case SOCKET_ADDRESS_TYPE_UNIX:
408 info->host = g_strdup("");
409 info->service = g_strdup(addr->u.q_unix.path);
410 info->family = NETWORK_ADDRESS_FAMILY_UNIX;
411 break;
412
413 case SOCKET_ADDRESS_TYPE_VSOCK:
414 case SOCKET_ADDRESS_TYPE_FD:
415 error_setg(errp, "Unsupported socket address type %s",
416 SocketAddressType_str(addr->type));
417 goto out_error;
418 default:
419 abort();
420 }
421
422 info->has_host = true;
423 info->has_service = true;
424 info->has_family = true;
425
426 info->has_auth = true;
427 info->auth = g_strdup(vnc_auth_name(vd));
428 }
429
430 qapi_free_SocketAddress(addr);
431 return info;
432
433 out_error:
434 qapi_free_SocketAddress(addr);
435 qapi_free_VncInfo(info);
436 return NULL;
437 }
438
439
440 static void qmp_query_auth(int auth, int subauth,
441 VncPrimaryAuth *qmp_auth,
442 VncVencryptSubAuth *qmp_vencrypt,
443 bool *qmp_has_vencrypt);
444
445 static VncServerInfo2List *qmp_query_server_entry(QIOChannelSocket *ioc,
446 bool websocket,
447 int auth,
448 int subauth,
449 VncServerInfo2List *prev)
450 {
451 VncServerInfo2List *list;
452 VncServerInfo2 *info;
453 Error *err = NULL;
454 SocketAddress *addr;
455
456 addr = qio_channel_socket_get_local_address(ioc, &err);
457 if (!addr) {
458 error_free(err);
459 return prev;
460 }
461
462 info = g_new0(VncServerInfo2, 1);
463 vnc_init_basic_info(addr, qapi_VncServerInfo2_base(info), &err);
464 qapi_free_SocketAddress(addr);
465 if (err) {
466 qapi_free_VncServerInfo2(info);
467 error_free(err);
468 return prev;
469 }
470 info->websocket = websocket;
471
472 qmp_query_auth(auth, subauth, &info->auth,
473 &info->vencrypt, &info->has_vencrypt);
474
475 list = g_new0(VncServerInfo2List, 1);
476 list->value = info;
477 list->next = prev;
478 return list;
479 }
480
481 static void qmp_query_auth(int auth, int subauth,
482 VncPrimaryAuth *qmp_auth,
483 VncVencryptSubAuth *qmp_vencrypt,
484 bool *qmp_has_vencrypt)
485 {
486 switch (auth) {
487 case VNC_AUTH_VNC:
488 *qmp_auth = VNC_PRIMARY_AUTH_VNC;
489 break;
490 case VNC_AUTH_RA2:
491 *qmp_auth = VNC_PRIMARY_AUTH_RA2;
492 break;
493 case VNC_AUTH_RA2NE:
494 *qmp_auth = VNC_PRIMARY_AUTH_RA2NE;
495 break;
496 case VNC_AUTH_TIGHT:
497 *qmp_auth = VNC_PRIMARY_AUTH_TIGHT;
498 break;
499 case VNC_AUTH_ULTRA:
500 *qmp_auth = VNC_PRIMARY_AUTH_ULTRA;
501 break;
502 case VNC_AUTH_TLS:
503 *qmp_auth = VNC_PRIMARY_AUTH_TLS;
504 break;
505 case VNC_AUTH_VENCRYPT:
506 *qmp_auth = VNC_PRIMARY_AUTH_VENCRYPT;
507 *qmp_has_vencrypt = true;
508 switch (subauth) {
509 case VNC_AUTH_VENCRYPT_PLAIN:
510 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_PLAIN;
511 break;
512 case VNC_AUTH_VENCRYPT_TLSNONE:
513 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_NONE;
514 break;
515 case VNC_AUTH_VENCRYPT_TLSVNC:
516 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_VNC;
517 break;
518 case VNC_AUTH_VENCRYPT_TLSPLAIN:
519 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_PLAIN;
520 break;
521 case VNC_AUTH_VENCRYPT_X509NONE:
522 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_NONE;
523 break;
524 case VNC_AUTH_VENCRYPT_X509VNC:
525 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_VNC;
526 break;
527 case VNC_AUTH_VENCRYPT_X509PLAIN:
528 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_PLAIN;
529 break;
530 case VNC_AUTH_VENCRYPT_TLSSASL:
531 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_SASL;
532 break;
533 case VNC_AUTH_VENCRYPT_X509SASL:
534 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_SASL;
535 break;
536 default:
537 *qmp_has_vencrypt = false;
538 break;
539 }
540 break;
541 case VNC_AUTH_SASL:
542 *qmp_auth = VNC_PRIMARY_AUTH_SASL;
543 break;
544 case VNC_AUTH_NONE:
545 default:
546 *qmp_auth = VNC_PRIMARY_AUTH_NONE;
547 break;
548 }
549 }
550
551 VncInfo2List *qmp_query_vnc_servers(Error **errp)
552 {
553 VncInfo2List *item, *prev = NULL;
554 VncInfo2 *info;
555 VncDisplay *vd;
556 DeviceState *dev;
557 size_t i;
558
559 QTAILQ_FOREACH(vd, &vnc_displays, next) {
560 info = g_new0(VncInfo2, 1);
561 info->id = g_strdup(vd->id);
562 info->clients = qmp_query_client_list(vd);
563 qmp_query_auth(vd->auth, vd->subauth, &info->auth,
564 &info->vencrypt, &info->has_vencrypt);
565 if (vd->dcl.con) {
566 dev = DEVICE(object_property_get_link(OBJECT(vd->dcl.con),
567 "device", NULL));
568 info->has_display = true;
569 info->display = g_strdup(dev->id);
570 }
571 for (i = 0; vd->listener != NULL && i < vd->listener->nsioc; i++) {
572 info->server = qmp_query_server_entry(
573 vd->listener->sioc[i], false, vd->auth, vd->subauth,
574 info->server);
575 }
576 for (i = 0; vd->wslistener != NULL && i < vd->wslistener->nsioc; i++) {
577 info->server = qmp_query_server_entry(
578 vd->wslistener->sioc[i], true, vd->ws_auth,
579 vd->ws_subauth, info->server);
580 }
581
582 item = g_new0(VncInfo2List, 1);
583 item->value = info;
584 item->next = prev;
585 prev = item;
586 }
587 return prev;
588 }
589
590 /* TODO
591 1) Get the queue working for IO.
592 2) there is some weirdness when using the -S option (the screen is grey
593 and not totally invalidated
594 3) resolutions > 1024
595 */
596
597 static int vnc_update_client(VncState *vs, int has_dirty);
598 static void vnc_disconnect_start(VncState *vs);
599
600 static void vnc_colordepth(VncState *vs);
601 static void framebuffer_update_request(VncState *vs, int incremental,
602 int x_position, int y_position,
603 int w, int h);
604 static void vnc_refresh(DisplayChangeListener *dcl);
605 static int vnc_refresh_server_surface(VncDisplay *vd);
606
607 static int vnc_width(VncDisplay *vd)
608 {
609 return MIN(VNC_MAX_WIDTH, ROUND_UP(surface_width(vd->ds),
610 VNC_DIRTY_PIXELS_PER_BIT));
611 }
612
613 static int vnc_height(VncDisplay *vd)
614 {
615 return MIN(VNC_MAX_HEIGHT, surface_height(vd->ds));
616 }
617
618 static void vnc_set_area_dirty(DECLARE_BITMAP(dirty[VNC_MAX_HEIGHT],
619 VNC_MAX_WIDTH / VNC_DIRTY_PIXELS_PER_BIT),
620 VncDisplay *vd,
621 int x, int y, int w, int h)
622 {
623 int width = vnc_width(vd);
624 int height = vnc_height(vd);
625
626 /* this is needed this to ensure we updated all affected
627 * blocks if x % VNC_DIRTY_PIXELS_PER_BIT != 0 */
628 w += (x % VNC_DIRTY_PIXELS_PER_BIT);
629 x -= (x % VNC_DIRTY_PIXELS_PER_BIT);
630
631 x = MIN(x, width);
632 y = MIN(y, height);
633 w = MIN(x + w, width) - x;
634 h = MIN(y + h, height);
635
636 for (; y < h; y++) {
637 bitmap_set(dirty[y], x / VNC_DIRTY_PIXELS_PER_BIT,
638 DIV_ROUND_UP(w, VNC_DIRTY_PIXELS_PER_BIT));
639 }
640 }
641
642 static void vnc_dpy_update(DisplayChangeListener *dcl,
643 int x, int y, int w, int h)
644 {
645 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
646 struct VncSurface *s = &vd->guest;
647
648 vnc_set_area_dirty(s->dirty, vd, x, y, w, h);
649 }
650
651 void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
652 int32_t encoding)
653 {
654 vnc_write_u16(vs, x);
655 vnc_write_u16(vs, y);
656 vnc_write_u16(vs, w);
657 vnc_write_u16(vs, h);
658
659 vnc_write_s32(vs, encoding);
660 }
661
662
663 static void vnc_desktop_resize(VncState *vs)
664 {
665 if (vs->ioc == NULL || !vnc_has_feature(vs, VNC_FEATURE_RESIZE)) {
666 return;
667 }
668 if (vs->client_width == pixman_image_get_width(vs->vd->server) &&
669 vs->client_height == pixman_image_get_height(vs->vd->server)) {
670 return;
671 }
672
673 assert(pixman_image_get_width(vs->vd->server) < 65536 &&
674 pixman_image_get_width(vs->vd->server) >= 0);
675 assert(pixman_image_get_height(vs->vd->server) < 65536 &&
676 pixman_image_get_height(vs->vd->server) >= 0);
677 vs->client_width = pixman_image_get_width(vs->vd->server);
678 vs->client_height = pixman_image_get_height(vs->vd->server);
679 vnc_lock_output(vs);
680 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
681 vnc_write_u8(vs, 0);
682 vnc_write_u16(vs, 1); /* number of rects */
683 vnc_framebuffer_update(vs, 0, 0, vs->client_width, vs->client_height,
684 VNC_ENCODING_DESKTOPRESIZE);
685 vnc_unlock_output(vs);
686 vnc_flush(vs);
687 }
688
689 static void vnc_abort_display_jobs(VncDisplay *vd)
690 {
691 VncState *vs;
692
693 QTAILQ_FOREACH(vs, &vd->clients, next) {
694 vnc_lock_output(vs);
695 vs->abort = true;
696 vnc_unlock_output(vs);
697 }
698 QTAILQ_FOREACH(vs, &vd->clients, next) {
699 vnc_jobs_join(vs);
700 }
701 QTAILQ_FOREACH(vs, &vd->clients, next) {
702 vnc_lock_output(vs);
703 if (vs->update == VNC_STATE_UPDATE_NONE &&
704 vs->job_update != VNC_STATE_UPDATE_NONE) {
705 /* job aborted before completion */
706 vs->update = vs->job_update;
707 vs->job_update = VNC_STATE_UPDATE_NONE;
708 }
709 vs->abort = false;
710 vnc_unlock_output(vs);
711 }
712 }
713
714 int vnc_server_fb_stride(VncDisplay *vd)
715 {
716 return pixman_image_get_stride(vd->server);
717 }
718
719 void *vnc_server_fb_ptr(VncDisplay *vd, int x, int y)
720 {
721 uint8_t *ptr;
722
723 ptr = (uint8_t *)pixman_image_get_data(vd->server);
724 ptr += y * vnc_server_fb_stride(vd);
725 ptr += x * VNC_SERVER_FB_BYTES;
726 return ptr;
727 }
728
729 static void vnc_update_server_surface(VncDisplay *vd)
730 {
731 int width, height;
732
733 qemu_pixman_image_unref(vd->server);
734 vd->server = NULL;
735
736 if (QTAILQ_EMPTY(&vd->clients)) {
737 return;
738 }
739
740 width = vnc_width(vd);
741 height = vnc_height(vd);
742 vd->server = pixman_image_create_bits(VNC_SERVER_FB_FORMAT,
743 width, height,
744 NULL, 0);
745
746 memset(vd->guest.dirty, 0x00, sizeof(vd->guest.dirty));
747 vnc_set_area_dirty(vd->guest.dirty, vd, 0, 0,
748 width, height);
749 }
750
751 static bool vnc_check_pageflip(DisplaySurface *s1,
752 DisplaySurface *s2)
753 {
754 return (s1 != NULL &&
755 s2 != NULL &&
756 surface_width(s1) == surface_width(s2) &&
757 surface_height(s1) == surface_height(s2) &&
758 surface_format(s1) == surface_format(s2));
759
760 }
761
762 static void vnc_dpy_switch(DisplayChangeListener *dcl,
763 DisplaySurface *surface)
764 {
765 static const char placeholder_msg[] =
766 "Display output is not active.";
767 static DisplaySurface *placeholder;
768 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
769 bool pageflip = vnc_check_pageflip(vd->ds, surface);
770 VncState *vs;
771
772 if (surface == NULL) {
773 if (placeholder == NULL) {
774 placeholder = qemu_create_message_surface(640, 480, placeholder_msg);
775 }
776 surface = placeholder;
777 }
778
779 vnc_abort_display_jobs(vd);
780 vd->ds = surface;
781
782 /* guest surface */
783 qemu_pixman_image_unref(vd->guest.fb);
784 vd->guest.fb = pixman_image_ref(surface->image);
785 vd->guest.format = surface->format;
786
787 if (pageflip) {
788 vnc_set_area_dirty(vd->guest.dirty, vd, 0, 0,
789 surface_width(surface),
790 surface_height(surface));
791 return;
792 }
793
794 /* server surface */
795 vnc_update_server_surface(vd);
796
797 QTAILQ_FOREACH(vs, &vd->clients, next) {
798 vnc_colordepth(vs);
799 vnc_desktop_resize(vs);
800 if (vs->vd->cursor) {
801 vnc_cursor_define(vs);
802 }
803 memset(vs->dirty, 0x00, sizeof(vs->dirty));
804 vnc_set_area_dirty(vs->dirty, vd, 0, 0,
805 vnc_width(vd),
806 vnc_height(vd));
807 vnc_update_throttle_offset(vs);
808 }
809 }
810
811 /* fastest code */
812 static void vnc_write_pixels_copy(VncState *vs,
813 void *pixels, int size)
814 {
815 vnc_write(vs, pixels, size);
816 }
817
818 /* slowest but generic code. */
819 void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
820 {
821 uint8_t r, g, b;
822
823 #if VNC_SERVER_FB_FORMAT == PIXMAN_FORMAT(32, PIXMAN_TYPE_ARGB, 0, 8, 8, 8)
824 r = (((v & 0x00ff0000) >> 16) << vs->client_pf.rbits) >> 8;
825 g = (((v & 0x0000ff00) >> 8) << vs->client_pf.gbits) >> 8;
826 b = (((v & 0x000000ff) >> 0) << vs->client_pf.bbits) >> 8;
827 #else
828 # error need some bits here if you change VNC_SERVER_FB_FORMAT
829 #endif
830 v = (r << vs->client_pf.rshift) |
831 (g << vs->client_pf.gshift) |
832 (b << vs->client_pf.bshift);
833 switch (vs->client_pf.bytes_per_pixel) {
834 case 1:
835 buf[0] = v;
836 break;
837 case 2:
838 if (vs->client_be) {
839 buf[0] = v >> 8;
840 buf[1] = v;
841 } else {
842 buf[1] = v >> 8;
843 buf[0] = v;
844 }
845 break;
846 default:
847 case 4:
848 if (vs->client_be) {
849 buf[0] = v >> 24;
850 buf[1] = v >> 16;
851 buf[2] = v >> 8;
852 buf[3] = v;
853 } else {
854 buf[3] = v >> 24;
855 buf[2] = v >> 16;
856 buf[1] = v >> 8;
857 buf[0] = v;
858 }
859 break;
860 }
861 }
862
863 static void vnc_write_pixels_generic(VncState *vs,
864 void *pixels1, int size)
865 {
866 uint8_t buf[4];
867
868 if (VNC_SERVER_FB_BYTES == 4) {
869 uint32_t *pixels = pixels1;
870 int n, i;
871 n = size >> 2;
872 for (i = 0; i < n; i++) {
873 vnc_convert_pixel(vs, buf, pixels[i]);
874 vnc_write(vs, buf, vs->client_pf.bytes_per_pixel);
875 }
876 }
877 }
878
879 int vnc_raw_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
880 {
881 int i;
882 uint8_t *row;
883 VncDisplay *vd = vs->vd;
884
885 row = vnc_server_fb_ptr(vd, x, y);
886 for (i = 0; i < h; i++) {
887 vs->write_pixels(vs, row, w * VNC_SERVER_FB_BYTES);
888 row += vnc_server_fb_stride(vd);
889 }
890 return 1;
891 }
892
893 int vnc_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
894 {
895 int n = 0;
896 bool encode_raw = false;
897 size_t saved_offs = vs->output.offset;
898
899 switch(vs->vnc_encoding) {
900 case VNC_ENCODING_ZLIB:
901 n = vnc_zlib_send_framebuffer_update(vs, x, y, w, h);
902 break;
903 case VNC_ENCODING_HEXTILE:
904 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE);
905 n = vnc_hextile_send_framebuffer_update(vs, x, y, w, h);
906 break;
907 case VNC_ENCODING_TIGHT:
908 n = vnc_tight_send_framebuffer_update(vs, x, y, w, h);
909 break;
910 case VNC_ENCODING_TIGHT_PNG:
911 n = vnc_tight_png_send_framebuffer_update(vs, x, y, w, h);
912 break;
913 case VNC_ENCODING_ZRLE:
914 n = vnc_zrle_send_framebuffer_update(vs, x, y, w, h);
915 break;
916 case VNC_ENCODING_ZYWRLE:
917 n = vnc_zywrle_send_framebuffer_update(vs, x, y, w, h);
918 break;
919 default:
920 encode_raw = true;
921 break;
922 }
923
924 /* If the client has the same pixel format as our internal buffer and
925 * a RAW encoding would need less space fall back to RAW encoding to
926 * save bandwidth and processing power in the client. */
927 if (!encode_raw && vs->write_pixels == vnc_write_pixels_copy &&
928 12 + h * w * VNC_SERVER_FB_BYTES <= (vs->output.offset - saved_offs)) {
929 vs->output.offset = saved_offs;
930 encode_raw = true;
931 }
932
933 if (encode_raw) {
934 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW);
935 n = vnc_raw_send_framebuffer_update(vs, x, y, w, h);
936 }
937
938 return n;
939 }
940
941 static void vnc_mouse_set(DisplayChangeListener *dcl,
942 int x, int y, int visible)
943 {
944 /* can we ask the client(s) to move the pointer ??? */
945 }
946
947 static int vnc_cursor_define(VncState *vs)
948 {
949 QEMUCursor *c = vs->vd->cursor;
950 int isize;
951
952 if (vnc_has_feature(vs, VNC_FEATURE_RICH_CURSOR)) {
953 vnc_lock_output(vs);
954 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
955 vnc_write_u8(vs, 0); /* padding */
956 vnc_write_u16(vs, 1); /* # of rects */
957 vnc_framebuffer_update(vs, c->hot_x, c->hot_y, c->width, c->height,
958 VNC_ENCODING_RICH_CURSOR);
959 isize = c->width * c->height * vs->client_pf.bytes_per_pixel;
960 vnc_write_pixels_generic(vs, c->data, isize);
961 vnc_write(vs, vs->vd->cursor_mask, vs->vd->cursor_msize);
962 vnc_unlock_output(vs);
963 return 0;
964 }
965 return -1;
966 }
967
968 static void vnc_dpy_cursor_define(DisplayChangeListener *dcl,
969 QEMUCursor *c)
970 {
971 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
972 VncState *vs;
973
974 cursor_put(vd->cursor);
975 g_free(vd->cursor_mask);
976
977 vd->cursor = c;
978 cursor_get(vd->cursor);
979 vd->cursor_msize = cursor_get_mono_bpl(c) * c->height;
980 vd->cursor_mask = g_malloc0(vd->cursor_msize);
981 cursor_get_mono_mask(c, 0, vd->cursor_mask);
982
983 QTAILQ_FOREACH(vs, &vd->clients, next) {
984 vnc_cursor_define(vs);
985 }
986 }
987
988 static int find_and_clear_dirty_height(VncState *vs,
989 int y, int last_x, int x, int height)
990 {
991 int h;
992
993 for (h = 1; h < (height - y); h++) {
994 if (!test_bit(last_x, vs->dirty[y + h])) {
995 break;
996 }
997 bitmap_clear(vs->dirty[y + h], last_x, x - last_x);
998 }
999
1000 return h;
1001 }
1002
1003 /*
1004 * Figure out how much pending data we should allow in the output
1005 * buffer before we throttle incremental display updates, and/or
1006 * drop audio samples.
1007 *
1008 * We allow for equiv of 1 full display's worth of FB updates,
1009 * and 1 second of audio samples. If audio backlog was larger
1010 * than that the client would already suffering awful audio
1011 * glitches, so dropping samples is no worse really).
1012 */
1013 static void vnc_update_throttle_offset(VncState *vs)
1014 {
1015 size_t offset =
1016 vs->client_width * vs->client_height * vs->client_pf.bytes_per_pixel;
1017
1018 if (vs->audio_cap) {
1019 int bps;
1020 switch (vs->as.fmt) {
1021 default:
1022 case AUDIO_FORMAT_U8:
1023 case AUDIO_FORMAT_S8:
1024 bps = 1;
1025 break;
1026 case AUDIO_FORMAT_U16:
1027 case AUDIO_FORMAT_S16:
1028 bps = 2;
1029 break;
1030 case AUDIO_FORMAT_U32:
1031 case AUDIO_FORMAT_S32:
1032 bps = 4;
1033 break;
1034 }
1035 offset += vs->as.freq * bps * vs->as.nchannels;
1036 }
1037
1038 /* Put a floor of 1MB on offset, so that if we have a large pending
1039 * buffer and the display is resized to a small size & back again
1040 * we don't suddenly apply a tiny send limit
1041 */
1042 offset = MAX(offset, 1024 * 1024);
1043
1044 if (vs->throttle_output_offset != offset) {
1045 trace_vnc_client_throttle_threshold(
1046 vs, vs->ioc, vs->throttle_output_offset, offset, vs->client_width,
1047 vs->client_height, vs->client_pf.bytes_per_pixel, vs->audio_cap);
1048 }
1049
1050 vs->throttle_output_offset = offset;
1051 }
1052
1053 static bool vnc_should_update(VncState *vs)
1054 {
1055 switch (vs->update) {
1056 case VNC_STATE_UPDATE_NONE:
1057 break;
1058 case VNC_STATE_UPDATE_INCREMENTAL:
1059 /* Only allow incremental updates if the pending send queue
1060 * is less than the permitted threshold, and the job worker
1061 * is completely idle.
1062 */
1063 if (vs->output.offset < vs->throttle_output_offset &&
1064 vs->job_update == VNC_STATE_UPDATE_NONE) {
1065 return true;
1066 }
1067 trace_vnc_client_throttle_incremental(
1068 vs, vs->ioc, vs->job_update, vs->output.offset);
1069 break;
1070 case VNC_STATE_UPDATE_FORCE:
1071 /* Only allow forced updates if the pending send queue
1072 * does not contain a previous forced update, and the
1073 * job worker is completely idle.
1074 *
1075 * Note this means we'll queue a forced update, even if
1076 * the output buffer size is otherwise over the throttle
1077 * output limit.
1078 */
1079 if (vs->force_update_offset == 0 &&
1080 vs->job_update == VNC_STATE_UPDATE_NONE) {
1081 return true;
1082 }
1083 trace_vnc_client_throttle_forced(
1084 vs, vs->ioc, vs->job_update, vs->force_update_offset);
1085 break;
1086 }
1087 return false;
1088 }
1089
1090 static int vnc_update_client(VncState *vs, int has_dirty)
1091 {
1092 VncDisplay *vd = vs->vd;
1093 VncJob *job;
1094 int y;
1095 int height, width;
1096 int n = 0;
1097
1098 if (vs->disconnecting) {
1099 vnc_disconnect_finish(vs);
1100 return 0;
1101 }
1102
1103 vs->has_dirty += has_dirty;
1104 if (!vnc_should_update(vs)) {
1105 return 0;
1106 }
1107
1108 if (!vs->has_dirty && vs->update != VNC_STATE_UPDATE_FORCE) {
1109 return 0;
1110 }
1111
1112 /*
1113 * Send screen updates to the vnc client using the server
1114 * surface and server dirty map. guest surface updates
1115 * happening in parallel don't disturb us, the next pass will
1116 * send them to the client.
1117 */
1118 job = vnc_job_new(vs);
1119
1120 height = pixman_image_get_height(vd->server);
1121 width = pixman_image_get_width(vd->server);
1122
1123 y = 0;
1124 for (;;) {
1125 int x, h;
1126 unsigned long x2;
1127 unsigned long offset = find_next_bit((unsigned long *) &vs->dirty,
1128 height * VNC_DIRTY_BPL(vs),
1129 y * VNC_DIRTY_BPL(vs));
1130 if (offset == height * VNC_DIRTY_BPL(vs)) {
1131 /* no more dirty bits */
1132 break;
1133 }
1134 y = offset / VNC_DIRTY_BPL(vs);
1135 x = offset % VNC_DIRTY_BPL(vs);
1136 x2 = find_next_zero_bit((unsigned long *) &vs->dirty[y],
1137 VNC_DIRTY_BPL(vs), x);
1138 bitmap_clear(vs->dirty[y], x, x2 - x);
1139 h = find_and_clear_dirty_height(vs, y, x, x2, height);
1140 x2 = MIN(x2, width / VNC_DIRTY_PIXELS_PER_BIT);
1141 if (x2 > x) {
1142 n += vnc_job_add_rect(job, x * VNC_DIRTY_PIXELS_PER_BIT, y,
1143 (x2 - x) * VNC_DIRTY_PIXELS_PER_BIT, h);
1144 }
1145 if (!x && x2 == width / VNC_DIRTY_PIXELS_PER_BIT) {
1146 y += h;
1147 if (y == height) {
1148 break;
1149 }
1150 }
1151 }
1152
1153 vs->job_update = vs->update;
1154 vs->update = VNC_STATE_UPDATE_NONE;
1155 vnc_job_push(job);
1156 vs->has_dirty = 0;
1157 return n;
1158 }
1159
1160 /* audio */
1161 static void audio_capture_notify(void *opaque, audcnotification_e cmd)
1162 {
1163 VncState *vs = opaque;
1164
1165 assert(vs->magic == VNC_MAGIC);
1166 switch (cmd) {
1167 case AUD_CNOTIFY_DISABLE:
1168 vnc_lock_output(vs);
1169 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
1170 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
1171 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_END);
1172 vnc_unlock_output(vs);
1173 vnc_flush(vs);
1174 break;
1175
1176 case AUD_CNOTIFY_ENABLE:
1177 vnc_lock_output(vs);
1178 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
1179 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
1180 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_BEGIN);
1181 vnc_unlock_output(vs);
1182 vnc_flush(vs);
1183 break;
1184 }
1185 }
1186
1187 static void audio_capture_destroy(void *opaque)
1188 {
1189 }
1190
1191 static void audio_capture(void *opaque, void *buf, int size)
1192 {
1193 VncState *vs = opaque;
1194
1195 assert(vs->magic == VNC_MAGIC);
1196 vnc_lock_output(vs);
1197 if (vs->output.offset < vs->throttle_output_offset) {
1198 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
1199 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
1200 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_DATA);
1201 vnc_write_u32(vs, size);
1202 vnc_write(vs, buf, size);
1203 } else {
1204 trace_vnc_client_throttle_audio(vs, vs->ioc, vs->output.offset);
1205 }
1206 vnc_unlock_output(vs);
1207 vnc_flush(vs);
1208 }
1209
1210 static void audio_add(VncState *vs)
1211 {
1212 struct audio_capture_ops ops;
1213
1214 if (vs->audio_cap) {
1215 error_report("audio already running");
1216 return;
1217 }
1218
1219 ops.notify = audio_capture_notify;
1220 ops.destroy = audio_capture_destroy;
1221 ops.capture = audio_capture;
1222
1223 vs->audio_cap = AUD_add_capture(&vs->as, &ops, vs);
1224 if (!vs->audio_cap) {
1225 error_report("Failed to add audio capture");
1226 }
1227 }
1228
1229 static void audio_del(VncState *vs)
1230 {
1231 if (vs->audio_cap) {
1232 AUD_del_capture(vs->audio_cap, vs);
1233 vs->audio_cap = NULL;
1234 }
1235 }
1236
1237 static void vnc_disconnect_start(VncState *vs)
1238 {
1239 if (vs->disconnecting) {
1240 return;
1241 }
1242 trace_vnc_client_disconnect_start(vs, vs->ioc);
1243 vnc_set_share_mode(vs, VNC_SHARE_MODE_DISCONNECTED);
1244 if (vs->ioc_tag) {
1245 g_source_remove(vs->ioc_tag);
1246 vs->ioc_tag = 0;
1247 }
1248 qio_channel_close(vs->ioc, NULL);
1249 vs->disconnecting = TRUE;
1250 }
1251
1252 void vnc_disconnect_finish(VncState *vs)
1253 {
1254 int i;
1255
1256 trace_vnc_client_disconnect_finish(vs, vs->ioc);
1257
1258 vnc_jobs_join(vs); /* Wait encoding jobs */
1259
1260 vnc_lock_output(vs);
1261 vnc_qmp_event(vs, QAPI_EVENT_VNC_DISCONNECTED);
1262
1263 buffer_free(&vs->input);
1264 buffer_free(&vs->output);
1265
1266 qapi_free_VncClientInfo(vs->info);
1267
1268 vnc_zlib_clear(vs);
1269 vnc_tight_clear(vs);
1270 vnc_zrle_clear(vs);
1271
1272 #ifdef CONFIG_VNC_SASL
1273 vnc_sasl_client_cleanup(vs);
1274 #endif /* CONFIG_VNC_SASL */
1275 audio_del(vs);
1276 qkbd_state_lift_all_keys(vs->vd->kbd);
1277
1278 if (vs->mouse_mode_notifier.notify != NULL) {
1279 qemu_remove_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
1280 }
1281 QTAILQ_REMOVE(&vs->vd->clients, vs, next);
1282 if (QTAILQ_EMPTY(&vs->vd->clients)) {
1283 /* last client gone */
1284 vnc_update_server_surface(vs->vd);
1285 }
1286
1287 vnc_unlock_output(vs);
1288
1289 qemu_mutex_destroy(&vs->output_mutex);
1290 if (vs->bh != NULL) {
1291 qemu_bh_delete(vs->bh);
1292 }
1293 buffer_free(&vs->jobs_buffer);
1294
1295 for (i = 0; i < VNC_STAT_ROWS; ++i) {
1296 g_free(vs->lossy_rect[i]);
1297 }
1298 g_free(vs->lossy_rect);
1299
1300 object_unref(OBJECT(vs->ioc));
1301 vs->ioc = NULL;
1302 object_unref(OBJECT(vs->sioc));
1303 vs->sioc = NULL;
1304 vs->magic = 0;
1305 g_free(vs);
1306 }
1307
1308 size_t vnc_client_io_error(VncState *vs, ssize_t ret, Error **errp)
1309 {
1310 if (ret <= 0) {
1311 if (ret == 0) {
1312 trace_vnc_client_eof(vs, vs->ioc);
1313 vnc_disconnect_start(vs);
1314 } else if (ret != QIO_CHANNEL_ERR_BLOCK) {
1315 trace_vnc_client_io_error(vs, vs->ioc,
1316 errp ? error_get_pretty(*errp) :
1317 "Unknown");
1318 vnc_disconnect_start(vs);
1319 }
1320
1321 if (errp) {
1322 error_free(*errp);
1323 *errp = NULL;
1324 }
1325 return 0;
1326 }
1327 return ret;
1328 }
1329
1330
1331 void vnc_client_error(VncState *vs)
1332 {
1333 VNC_DEBUG("Closing down client sock: protocol error\n");
1334 vnc_disconnect_start(vs);
1335 }
1336
1337
1338 /*
1339 * Called to write a chunk of data to the client socket. The data may
1340 * be the raw data, or may have already been encoded by SASL.
1341 * The data will be written either straight onto the socket, or
1342 * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1343 *
1344 * NB, it is theoretically possible to have 2 layers of encryption,
1345 * both SASL, and this TLS layer. It is highly unlikely in practice
1346 * though, since SASL encryption will typically be a no-op if TLS
1347 * is active
1348 *
1349 * Returns the number of bytes written, which may be less than
1350 * the requested 'datalen' if the socket would block. Returns
1351 * 0 on I/O error, and disconnects the client socket.
1352 */
1353 size_t vnc_client_write_buf(VncState *vs, const uint8_t *data, size_t datalen)
1354 {
1355 Error *err = NULL;
1356 ssize_t ret;
1357 ret = qio_channel_write(
1358 vs->ioc, (const char *)data, datalen, &err);
1359 VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data, datalen, ret);
1360 return vnc_client_io_error(vs, ret, &err);
1361 }
1362
1363
1364 /*
1365 * Called to write buffered data to the client socket, when not
1366 * using any SASL SSF encryption layers. Will write as much data
1367 * as possible without blocking. If all buffered data is written,
1368 * will switch the FD poll() handler back to read monitoring.
1369 *
1370 * Returns the number of bytes written, which may be less than
1371 * the buffered output data if the socket would block. Returns
1372 * 0 on I/O error, and disconnects the client socket.
1373 */
1374 static size_t vnc_client_write_plain(VncState *vs)
1375 {
1376 size_t offset;
1377 size_t ret;
1378
1379 #ifdef CONFIG_VNC_SASL
1380 VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n",
1381 vs->output.buffer, vs->output.capacity, vs->output.offset,
1382 vs->sasl.waitWriteSSF);
1383
1384 if (vs->sasl.conn &&
1385 vs->sasl.runSSF &&
1386 vs->sasl.waitWriteSSF) {
1387 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF);
1388 if (ret)
1389 vs->sasl.waitWriteSSF -= ret;
1390 } else
1391 #endif /* CONFIG_VNC_SASL */
1392 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset);
1393 if (!ret)
1394 return 0;
1395
1396 if (ret >= vs->force_update_offset) {
1397 if (vs->force_update_offset != 0) {
1398 trace_vnc_client_unthrottle_forced(vs, vs->ioc);
1399 }
1400 vs->force_update_offset = 0;
1401 } else {
1402 vs->force_update_offset -= ret;
1403 }
1404 offset = vs->output.offset;
1405 buffer_advance(&vs->output, ret);
1406 if (offset >= vs->throttle_output_offset &&
1407 vs->output.offset < vs->throttle_output_offset) {
1408 trace_vnc_client_unthrottle_incremental(vs, vs->ioc, vs->output.offset);
1409 }
1410
1411 if (vs->output.offset == 0) {
1412 if (vs->ioc_tag) {
1413 g_source_remove(vs->ioc_tag);
1414 }
1415 vs->ioc_tag = qio_channel_add_watch(
1416 vs->ioc, G_IO_IN, vnc_client_io, vs, NULL);
1417 }
1418
1419 return ret;
1420 }
1421
1422
1423 /*
1424 * First function called whenever there is data to be written to
1425 * the client socket. Will delegate actual work according to whether
1426 * SASL SSF layers are enabled (thus requiring encryption calls)
1427 */
1428 static void vnc_client_write_locked(VncState *vs)
1429 {
1430 #ifdef CONFIG_VNC_SASL
1431 if (vs->sasl.conn &&
1432 vs->sasl.runSSF &&
1433 !vs->sasl.waitWriteSSF) {
1434 vnc_client_write_sasl(vs);
1435 } else
1436 #endif /* CONFIG_VNC_SASL */
1437 {
1438 vnc_client_write_plain(vs);
1439 }
1440 }
1441
1442 static void vnc_client_write(VncState *vs)
1443 {
1444 assert(vs->magic == VNC_MAGIC);
1445 vnc_lock_output(vs);
1446 if (vs->output.offset) {
1447 vnc_client_write_locked(vs);
1448 } else if (vs->ioc != NULL) {
1449 if (vs->ioc_tag) {
1450 g_source_remove(vs->ioc_tag);
1451 }
1452 vs->ioc_tag = qio_channel_add_watch(
1453 vs->ioc, G_IO_IN, vnc_client_io, vs, NULL);
1454 }
1455 vnc_unlock_output(vs);
1456 }
1457
1458 void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting)
1459 {
1460 vs->read_handler = func;
1461 vs->read_handler_expect = expecting;
1462 }
1463
1464
1465 /*
1466 * Called to read a chunk of data from the client socket. The data may
1467 * be the raw data, or may need to be further decoded by SASL.
1468 * The data will be read either straight from to the socket, or
1469 * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1470 *
1471 * NB, it is theoretically possible to have 2 layers of encryption,
1472 * both SASL, and this TLS layer. It is highly unlikely in practice
1473 * though, since SASL encryption will typically be a no-op if TLS
1474 * is active
1475 *
1476 * Returns the number of bytes read, which may be less than
1477 * the requested 'datalen' if the socket would block. Returns
1478 * 0 on I/O error or EOF, and disconnects the client socket.
1479 */
1480 size_t vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen)
1481 {
1482 ssize_t ret;
1483 Error *err = NULL;
1484 ret = qio_channel_read(
1485 vs->ioc, (char *)data, datalen, &err);
1486 VNC_DEBUG("Read wire %p %zd -> %ld\n", data, datalen, ret);
1487 return vnc_client_io_error(vs, ret, &err);
1488 }
1489
1490
1491 /*
1492 * Called to read data from the client socket to the input buffer,
1493 * when not using any SASL SSF encryption layers. Will read as much
1494 * data as possible without blocking.
1495 *
1496 * Returns the number of bytes read, which may be less than
1497 * the requested 'datalen' if the socket would block. Returns
1498 * 0 on I/O error or EOF, and disconnects the client socket.
1499 */
1500 static size_t vnc_client_read_plain(VncState *vs)
1501 {
1502 size_t ret;
1503 VNC_DEBUG("Read plain %p size %zd offset %zd\n",
1504 vs->input.buffer, vs->input.capacity, vs->input.offset);
1505 buffer_reserve(&vs->input, 4096);
1506 ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096);
1507 if (!ret)
1508 return 0;
1509 vs->input.offset += ret;
1510 return ret;
1511 }
1512
1513 static void vnc_jobs_bh(void *opaque)
1514 {
1515 VncState *vs = opaque;
1516
1517 assert(vs->magic == VNC_MAGIC);
1518 vnc_jobs_consume_buffer(vs);
1519 }
1520
1521 /*
1522 * First function called whenever there is more data to be read from
1523 * the client socket. Will delegate actual work according to whether
1524 * SASL SSF layers are enabled (thus requiring decryption calls)
1525 * Returns 0 on success, -1 if client disconnected
1526 */
1527 static int vnc_client_read(VncState *vs)
1528 {
1529 size_t ret;
1530
1531 #ifdef CONFIG_VNC_SASL
1532 if (vs->sasl.conn && vs->sasl.runSSF)
1533 ret = vnc_client_read_sasl(vs);
1534 else
1535 #endif /* CONFIG_VNC_SASL */
1536 ret = vnc_client_read_plain(vs);
1537 if (!ret) {
1538 if (vs->disconnecting) {
1539 vnc_disconnect_finish(vs);
1540 return -1;
1541 }
1542 return 0;
1543 }
1544
1545 while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) {
1546 size_t len = vs->read_handler_expect;
1547 int ret;
1548
1549 ret = vs->read_handler(vs, vs->input.buffer, len);
1550 if (vs->disconnecting) {
1551 vnc_disconnect_finish(vs);
1552 return -1;
1553 }
1554
1555 if (!ret) {
1556 buffer_advance(&vs->input, len);
1557 } else {
1558 vs->read_handler_expect = ret;
1559 }
1560 }
1561 return 0;
1562 }
1563
1564 gboolean vnc_client_io(QIOChannel *ioc G_GNUC_UNUSED,
1565 GIOCondition condition, void *opaque)
1566 {
1567 VncState *vs = opaque;
1568
1569 assert(vs->magic == VNC_MAGIC);
1570 if (condition & G_IO_IN) {
1571 if (vnc_client_read(vs) < 0) {
1572 /* vs is free()ed here */
1573 return TRUE;
1574 }
1575 }
1576 if (condition & G_IO_OUT) {
1577 vnc_client_write(vs);
1578 }
1579
1580 if (vs->disconnecting) {
1581 if (vs->ioc_tag != 0) {
1582 g_source_remove(vs->ioc_tag);
1583 }
1584 vs->ioc_tag = 0;
1585 }
1586 return TRUE;
1587 }
1588
1589
1590 /*
1591 * Scale factor to apply to vs->throttle_output_offset when checking for
1592 * hard limit. Worst case normal usage could be x2, if we have a complete
1593 * incremental update and complete forced update in the output buffer.
1594 * So x3 should be good enough, but we pick x5 to be conservative and thus
1595 * (hopefully) never trigger incorrectly.
1596 */
1597 #define VNC_THROTTLE_OUTPUT_LIMIT_SCALE 5
1598
1599 void vnc_write(VncState *vs, const void *data, size_t len)
1600 {
1601 assert(vs->magic == VNC_MAGIC);
1602 if (vs->disconnecting) {
1603 return;
1604 }
1605 /* Protection against malicious client/guest to prevent our output
1606 * buffer growing without bound if client stops reading data. This
1607 * should rarely trigger, because we have earlier throttling code
1608 * which stops issuing framebuffer updates and drops audio data
1609 * if the throttle_output_offset value is exceeded. So we only reach
1610 * this higher level if a huge number of pseudo-encodings get
1611 * triggered while data can't be sent on the socket.
1612 *
1613 * NB throttle_output_offset can be zero during early protocol
1614 * handshake, or from the job thread's VncState clone
1615 */
1616 if (vs->throttle_output_offset != 0 &&
1617 (vs->output.offset / VNC_THROTTLE_OUTPUT_LIMIT_SCALE) >
1618 vs->throttle_output_offset) {
1619 trace_vnc_client_output_limit(vs, vs->ioc, vs->output.offset,
1620 vs->throttle_output_offset);
1621 vnc_disconnect_start(vs);
1622 return;
1623 }
1624 buffer_reserve(&vs->output, len);
1625
1626 if (vs->ioc != NULL && buffer_empty(&vs->output)) {
1627 if (vs->ioc_tag) {
1628 g_source_remove(vs->ioc_tag);
1629 }
1630 vs->ioc_tag = qio_channel_add_watch(
1631 vs->ioc, G_IO_IN | G_IO_OUT, vnc_client_io, vs, NULL);
1632 }
1633
1634 buffer_append(&vs->output, data, len);
1635 }
1636
1637 void vnc_write_s32(VncState *vs, int32_t value)
1638 {
1639 vnc_write_u32(vs, *(uint32_t *)&value);
1640 }
1641
1642 void vnc_write_u32(VncState *vs, uint32_t value)
1643 {
1644 uint8_t buf[4];
1645
1646 buf[0] = (value >> 24) & 0xFF;
1647 buf[1] = (value >> 16) & 0xFF;
1648 buf[2] = (value >> 8) & 0xFF;
1649 buf[3] = value & 0xFF;
1650
1651 vnc_write(vs, buf, 4);
1652 }
1653
1654 void vnc_write_u16(VncState *vs, uint16_t value)
1655 {
1656 uint8_t buf[2];
1657
1658 buf[0] = (value >> 8) & 0xFF;
1659 buf[1] = value & 0xFF;
1660
1661 vnc_write(vs, buf, 2);
1662 }
1663
1664 void vnc_write_u8(VncState *vs, uint8_t value)
1665 {
1666 vnc_write(vs, (char *)&value, 1);
1667 }
1668
1669 void vnc_flush(VncState *vs)
1670 {
1671 vnc_lock_output(vs);
1672 if (vs->ioc != NULL && vs->output.offset) {
1673 vnc_client_write_locked(vs);
1674 }
1675 if (vs->disconnecting) {
1676 if (vs->ioc_tag != 0) {
1677 g_source_remove(vs->ioc_tag);
1678 }
1679 vs->ioc_tag = 0;
1680 }
1681 vnc_unlock_output(vs);
1682 }
1683
1684 static uint8_t read_u8(uint8_t *data, size_t offset)
1685 {
1686 return data[offset];
1687 }
1688
1689 static uint16_t read_u16(uint8_t *data, size_t offset)
1690 {
1691 return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF);
1692 }
1693
1694 static int32_t read_s32(uint8_t *data, size_t offset)
1695 {
1696 return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) |
1697 (data[offset + 2] << 8) | data[offset + 3]);
1698 }
1699
1700 uint32_t read_u32(uint8_t *data, size_t offset)
1701 {
1702 return ((data[offset] << 24) | (data[offset + 1] << 16) |
1703 (data[offset + 2] << 8) | data[offset + 3]);
1704 }
1705
1706 static void client_cut_text(VncState *vs, size_t len, uint8_t *text)
1707 {
1708 }
1709
1710 static void check_pointer_type_change(Notifier *notifier, void *data)
1711 {
1712 VncState *vs = container_of(notifier, VncState, mouse_mode_notifier);
1713 int absolute = qemu_input_is_absolute();
1714
1715 if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) {
1716 vnc_lock_output(vs);
1717 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1718 vnc_write_u8(vs, 0);
1719 vnc_write_u16(vs, 1);
1720 vnc_framebuffer_update(vs, absolute, 0,
1721 pixman_image_get_width(vs->vd->server),
1722 pixman_image_get_height(vs->vd->server),
1723 VNC_ENCODING_POINTER_TYPE_CHANGE);
1724 vnc_unlock_output(vs);
1725 vnc_flush(vs);
1726 }
1727 vs->absolute = absolute;
1728 }
1729
1730 static void pointer_event(VncState *vs, int button_mask, int x, int y)
1731 {
1732 static uint32_t bmap[INPUT_BUTTON__MAX] = {
1733 [INPUT_BUTTON_LEFT] = 0x01,
1734 [INPUT_BUTTON_MIDDLE] = 0x02,
1735 [INPUT_BUTTON_RIGHT] = 0x04,
1736 [INPUT_BUTTON_WHEEL_UP] = 0x08,
1737 [INPUT_BUTTON_WHEEL_DOWN] = 0x10,
1738 };
1739 QemuConsole *con = vs->vd->dcl.con;
1740 int width = pixman_image_get_width(vs->vd->server);
1741 int height = pixman_image_get_height(vs->vd->server);
1742
1743 if (vs->last_bmask != button_mask) {
1744 qemu_input_update_buttons(con, bmap, vs->last_bmask, button_mask);
1745 vs->last_bmask = button_mask;
1746 }
1747
1748 if (vs->absolute) {
1749 qemu_input_queue_abs(con, INPUT_AXIS_X, x, 0, width);
1750 qemu_input_queue_abs(con, INPUT_AXIS_Y, y, 0, height);
1751 } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) {
1752 qemu_input_queue_rel(con, INPUT_AXIS_X, x - 0x7FFF);
1753 qemu_input_queue_rel(con, INPUT_AXIS_Y, y - 0x7FFF);
1754 } else {
1755 if (vs->last_x != -1) {
1756 qemu_input_queue_rel(con, INPUT_AXIS_X, x - vs->last_x);
1757 qemu_input_queue_rel(con, INPUT_AXIS_Y, y - vs->last_y);
1758 }
1759 vs->last_x = x;
1760 vs->last_y = y;
1761 }
1762 qemu_input_event_sync();
1763 }
1764
1765 static void press_key(VncState *vs, QKeyCode qcode)
1766 {
1767 qkbd_state_key_event(vs->vd->kbd, qcode, true);
1768 qkbd_state_key_event(vs->vd->kbd, qcode, false);
1769 }
1770
1771 static void vnc_led_state_change(VncState *vs)
1772 {
1773 if (!vnc_has_feature(vs, VNC_FEATURE_LED_STATE)) {
1774 return;
1775 }
1776
1777 vnc_lock_output(vs);
1778 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1779 vnc_write_u8(vs, 0);
1780 vnc_write_u16(vs, 1);
1781 vnc_framebuffer_update(vs, 0, 0, 1, 1, VNC_ENCODING_LED_STATE);
1782 vnc_write_u8(vs, vs->vd->ledstate);
1783 vnc_unlock_output(vs);
1784 vnc_flush(vs);
1785 }
1786
1787 static void kbd_leds(void *opaque, int ledstate)
1788 {
1789 VncDisplay *vd = opaque;
1790 VncState *client;
1791
1792 trace_vnc_key_guest_leds((ledstate & QEMU_CAPS_LOCK_LED),
1793 (ledstate & QEMU_NUM_LOCK_LED),
1794 (ledstate & QEMU_SCROLL_LOCK_LED));
1795
1796 if (ledstate == vd->ledstate) {
1797 return;
1798 }
1799
1800 vd->ledstate = ledstate;
1801
1802 QTAILQ_FOREACH(client, &vd->clients, next) {
1803 vnc_led_state_change(client);
1804 }
1805 }
1806
1807 static void do_key_event(VncState *vs, int down, int keycode, int sym)
1808 {
1809 QKeyCode qcode = qemu_input_key_number_to_qcode(keycode);
1810
1811 /* QEMU console switch */
1812 switch (qcode) {
1813 case Q_KEY_CODE_1 ... Q_KEY_CODE_9: /* '1' to '9' keys */
1814 if (vs->vd->dcl.con == NULL && down &&
1815 qkbd_state_modifier_get(vs->vd->kbd, QKBD_MOD_CTRL) &&
1816 qkbd_state_modifier_get(vs->vd->kbd, QKBD_MOD_ALT)) {
1817 /* Reset the modifiers sent to the current console */
1818 qkbd_state_lift_all_keys(vs->vd->kbd);
1819 console_select(qcode - Q_KEY_CODE_1);
1820 return;
1821 }
1822 default:
1823 break;
1824 }
1825
1826 /* Turn off the lock state sync logic if the client support the led
1827 state extension.
1828 */
1829 if (down && vs->vd->lock_key_sync &&
1830 !vnc_has_feature(vs, VNC_FEATURE_LED_STATE) &&
1831 keycode_is_keypad(vs->vd->kbd_layout, keycode)) {
1832 /* If the numlock state needs to change then simulate an additional
1833 keypress before sending this one. This will happen if the user
1834 toggles numlock away from the VNC window.
1835 */
1836 if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) {
1837 if (!qkbd_state_modifier_get(vs->vd->kbd, QKBD_MOD_NUMLOCK)) {
1838 trace_vnc_key_sync_numlock(true);
1839 press_key(vs, Q_KEY_CODE_NUM_LOCK);
1840 }
1841 } else {
1842 if (qkbd_state_modifier_get(vs->vd->kbd, QKBD_MOD_NUMLOCK)) {
1843 trace_vnc_key_sync_numlock(false);
1844 press_key(vs, Q_KEY_CODE_NUM_LOCK);
1845 }
1846 }
1847 }
1848
1849 if (down && vs->vd->lock_key_sync &&
1850 !vnc_has_feature(vs, VNC_FEATURE_LED_STATE) &&
1851 ((sym >= 'A' && sym <= 'Z') || (sym >= 'a' && sym <= 'z'))) {
1852 /* If the capslock state needs to change then simulate an additional
1853 keypress before sending this one. This will happen if the user
1854 toggles capslock away from the VNC window.
1855 */
1856 int uppercase = !!(sym >= 'A' && sym <= 'Z');
1857 bool shift = qkbd_state_modifier_get(vs->vd->kbd, QKBD_MOD_SHIFT);
1858 bool capslock = qkbd_state_modifier_get(vs->vd->kbd, QKBD_MOD_CAPSLOCK);
1859 if (capslock) {
1860 if (uppercase == shift) {
1861 trace_vnc_key_sync_capslock(false);
1862 press_key(vs, Q_KEY_CODE_CAPS_LOCK);
1863 }
1864 } else {
1865 if (uppercase != shift) {
1866 trace_vnc_key_sync_capslock(true);
1867 press_key(vs, Q_KEY_CODE_CAPS_LOCK);
1868 }
1869 }
1870 }
1871
1872 qkbd_state_key_event(vs->vd->kbd, qcode, down);
1873 if (!qemu_console_is_graphic(NULL)) {
1874 bool numlock = qkbd_state_modifier_get(vs->vd->kbd, QKBD_MOD_NUMLOCK);
1875 bool control = qkbd_state_modifier_get(vs->vd->kbd, QKBD_MOD_CTRL);
1876 /* QEMU console emulation */
1877 if (down) {
1878 switch (keycode) {
1879 case 0x2a: /* Left Shift */
1880 case 0x36: /* Right Shift */
1881 case 0x1d: /* Left CTRL */
1882 case 0x9d: /* Right CTRL */
1883 case 0x38: /* Left ALT */
1884 case 0xb8: /* Right ALT */
1885 break;
1886 case 0xc8:
1887 kbd_put_keysym(QEMU_KEY_UP);
1888 break;
1889 case 0xd0:
1890 kbd_put_keysym(QEMU_KEY_DOWN);
1891 break;
1892 case 0xcb:
1893 kbd_put_keysym(QEMU_KEY_LEFT);
1894 break;
1895 case 0xcd:
1896 kbd_put_keysym(QEMU_KEY_RIGHT);
1897 break;
1898 case 0xd3:
1899 kbd_put_keysym(QEMU_KEY_DELETE);
1900 break;
1901 case 0xc7:
1902 kbd_put_keysym(QEMU_KEY_HOME);
1903 break;
1904 case 0xcf:
1905 kbd_put_keysym(QEMU_KEY_END);
1906 break;
1907 case 0xc9:
1908 kbd_put_keysym(QEMU_KEY_PAGEUP);
1909 break;
1910 case 0xd1:
1911 kbd_put_keysym(QEMU_KEY_PAGEDOWN);
1912 break;
1913
1914 case 0x47:
1915 kbd_put_keysym(numlock ? '7' : QEMU_KEY_HOME);
1916 break;
1917 case 0x48:
1918 kbd_put_keysym(numlock ? '8' : QEMU_KEY_UP);
1919 break;
1920 case 0x49:
1921 kbd_put_keysym(numlock ? '9' : QEMU_KEY_PAGEUP);
1922 break;
1923 case 0x4b:
1924 kbd_put_keysym(numlock ? '4' : QEMU_KEY_LEFT);
1925 break;
1926 case 0x4c:
1927 kbd_put_keysym('5');
1928 break;
1929 case 0x4d:
1930 kbd_put_keysym(numlock ? '6' : QEMU_KEY_RIGHT);
1931 break;
1932 case 0x4f:
1933 kbd_put_keysym(numlock ? '1' : QEMU_KEY_END);
1934 break;
1935 case 0x50:
1936 kbd_put_keysym(numlock ? '2' : QEMU_KEY_DOWN);
1937 break;
1938 case 0x51:
1939 kbd_put_keysym(numlock ? '3' : QEMU_KEY_PAGEDOWN);
1940 break;
1941 case 0x52:
1942 kbd_put_keysym('0');
1943 break;
1944 case 0x53:
1945 kbd_put_keysym(numlock ? '.' : QEMU_KEY_DELETE);
1946 break;
1947
1948 case 0xb5:
1949 kbd_put_keysym('/');
1950 break;
1951 case 0x37:
1952 kbd_put_keysym('*');
1953 break;
1954 case 0x4a:
1955 kbd_put_keysym('-');
1956 break;
1957 case 0x4e:
1958 kbd_put_keysym('+');
1959 break;
1960 case 0x9c:
1961 kbd_put_keysym('\n');
1962 break;
1963
1964 default:
1965 if (control) {
1966 kbd_put_keysym(sym & 0x1f);
1967 } else {
1968 kbd_put_keysym(sym);
1969 }
1970 break;
1971 }
1972 }
1973 }
1974 }
1975
1976 static const char *code2name(int keycode)
1977 {
1978 return QKeyCode_str(qemu_input_key_number_to_qcode(keycode));
1979 }
1980
1981 static void key_event(VncState *vs, int down, uint32_t sym)
1982 {
1983 int keycode;
1984 int lsym = sym;
1985
1986 if (lsym >= 'A' && lsym <= 'Z' && qemu_console_is_graphic(NULL)) {
1987 lsym = lsym - 'A' + 'a';
1988 }
1989
1990 keycode = keysym2scancode(vs->vd->kbd_layout, lsym & 0xFFFF,
1991 vs->vd->kbd, down) & SCANCODE_KEYMASK;
1992 trace_vnc_key_event_map(down, sym, keycode, code2name(keycode));
1993 do_key_event(vs, down, keycode, sym);
1994 }
1995
1996 static void ext_key_event(VncState *vs, int down,
1997 uint32_t sym, uint16_t keycode)
1998 {
1999 /* if the user specifies a keyboard layout, always use it */
2000 if (keyboard_layout) {
2001 key_event(vs, down, sym);
2002 } else {
2003 trace_vnc_key_event_ext(down, sym, keycode, code2name(keycode));
2004 do_key_event(vs, down, keycode, sym);
2005 }
2006 }
2007
2008 static void framebuffer_update_request(VncState *vs, int incremental,
2009 int x, int y, int w, int h)
2010 {
2011 if (incremental) {
2012 if (vs->update != VNC_STATE_UPDATE_FORCE) {
2013 vs->update = VNC_STATE_UPDATE_INCREMENTAL;
2014 }
2015 } else {
2016 vs->update = VNC_STATE_UPDATE_FORCE;
2017 vnc_set_area_dirty(vs->dirty, vs->vd, x, y, w, h);
2018 }
2019 }
2020
2021 static void send_ext_key_event_ack(VncState *vs)
2022 {
2023 vnc_lock_output(vs);
2024 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
2025 vnc_write_u8(vs, 0);
2026 vnc_write_u16(vs, 1);
2027 vnc_framebuffer_update(vs, 0, 0,
2028 pixman_image_get_width(vs->vd->server),
2029 pixman_image_get_height(vs->vd->server),
2030 VNC_ENCODING_EXT_KEY_EVENT);
2031 vnc_unlock_output(vs);
2032 vnc_flush(vs);
2033 }
2034
2035 static void send_ext_audio_ack(VncState *vs)
2036 {
2037 vnc_lock_output(vs);
2038 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
2039 vnc_write_u8(vs, 0);
2040 vnc_write_u16(vs, 1);
2041 vnc_framebuffer_update(vs, 0, 0,
2042 pixman_image_get_width(vs->vd->server),
2043 pixman_image_get_height(vs->vd->server),
2044 VNC_ENCODING_AUDIO);
2045 vnc_unlock_output(vs);
2046 vnc_flush(vs);
2047 }
2048
2049 static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
2050 {
2051 int i;
2052 unsigned int enc = 0;
2053
2054 vs->features = 0;
2055 vs->vnc_encoding = 0;
2056 vs->tight.compression = 9;
2057 vs->tight.quality = -1; /* Lossless by default */
2058 vs->absolute = -1;
2059
2060 /*
2061 * Start from the end because the encodings are sent in order of preference.
2062 * This way the preferred encoding (first encoding defined in the array)
2063 * will be set at the end of the loop.
2064 */
2065 for (i = n_encodings - 1; i >= 0; i--) {
2066 enc = encodings[i];
2067 switch (enc) {
2068 case VNC_ENCODING_RAW:
2069 vs->vnc_encoding = enc;
2070 break;
2071 case VNC_ENCODING_COPYRECT:
2072 vs->features |= VNC_FEATURE_COPYRECT_MASK;
2073 break;
2074 case VNC_ENCODING_HEXTILE:
2075 vs->features |= VNC_FEATURE_HEXTILE_MASK;
2076 vs->vnc_encoding = enc;
2077 break;
2078 case VNC_ENCODING_TIGHT:
2079 vs->features |= VNC_FEATURE_TIGHT_MASK;
2080 vs->vnc_encoding = enc;
2081 break;
2082 #ifdef CONFIG_VNC_PNG
2083 case VNC_ENCODING_TIGHT_PNG:
2084 vs->features |= VNC_FEATURE_TIGHT_PNG_MASK;
2085 vs->vnc_encoding = enc;
2086 break;
2087 #endif
2088 case VNC_ENCODING_ZLIB:
2089 vs->features |= VNC_FEATURE_ZLIB_MASK;
2090 vs->vnc_encoding = enc;
2091 break;
2092 case VNC_ENCODING_ZRLE:
2093 vs->features |= VNC_FEATURE_ZRLE_MASK;
2094 vs->vnc_encoding = enc;
2095 break;
2096 case VNC_ENCODING_ZYWRLE:
2097 vs->features |= VNC_FEATURE_ZYWRLE_MASK;
2098 vs->vnc_encoding = enc;
2099 break;
2100 case VNC_ENCODING_DESKTOPRESIZE:
2101 vs->features |= VNC_FEATURE_RESIZE_MASK;
2102 break;
2103 case VNC_ENCODING_POINTER_TYPE_CHANGE:
2104 vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK;
2105 break;
2106 case VNC_ENCODING_RICH_CURSOR:
2107 vs->features |= VNC_FEATURE_RICH_CURSOR_MASK;
2108 if (vs->vd->cursor) {
2109 vnc_cursor_define(vs);
2110 }
2111 break;
2112 case VNC_ENCODING_EXT_KEY_EVENT:
2113 send_ext_key_event_ack(vs);
2114 break;
2115 case VNC_ENCODING_AUDIO:
2116 send_ext_audio_ack(vs);
2117 break;
2118 case VNC_ENCODING_WMVi:
2119 vs->features |= VNC_FEATURE_WMVI_MASK;
2120 break;
2121 case VNC_ENCODING_LED_STATE:
2122 vs->features |= VNC_FEATURE_LED_STATE_MASK;
2123 break;
2124 case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9:
2125 vs->tight.compression = (enc & 0x0F);
2126 break;
2127 case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9:
2128 if (vs->vd->lossy) {
2129 vs->tight.quality = (enc & 0x0F);
2130 }
2131 break;
2132 default:
2133 VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc);
2134 break;
2135 }
2136 }
2137 vnc_desktop_resize(vs);
2138 check_pointer_type_change(&vs->mouse_mode_notifier, NULL);
2139 vnc_led_state_change(vs);
2140 }
2141
2142 static void set_pixel_conversion(VncState *vs)
2143 {
2144 pixman_format_code_t fmt = qemu_pixman_get_format(&vs->client_pf);
2145
2146 if (fmt == VNC_SERVER_FB_FORMAT) {
2147 vs->write_pixels = vnc_write_pixels_copy;
2148 vnc_hextile_set_pixel_conversion(vs, 0);
2149 } else {
2150 vs->write_pixels = vnc_write_pixels_generic;
2151 vnc_hextile_set_pixel_conversion(vs, 1);
2152 }
2153 }
2154
2155 static void send_color_map(VncState *vs)
2156 {
2157 int i;
2158
2159 vnc_write_u8(vs, VNC_MSG_SERVER_SET_COLOUR_MAP_ENTRIES);
2160 vnc_write_u8(vs, 0); /* padding */
2161 vnc_write_u16(vs, 0); /* first color */
2162 vnc_write_u16(vs, 256); /* # of colors */
2163
2164 for (i = 0; i < 256; i++) {
2165 PixelFormat *pf = &vs->client_pf;
2166
2167 vnc_write_u16(vs, (((i >> pf->rshift) & pf->rmax) << (16 - pf->rbits)));
2168 vnc_write_u16(vs, (((i >> pf->gshift) & pf->gmax) << (16 - pf->gbits)));
2169 vnc_write_u16(vs, (((i >> pf->bshift) & pf->bmax) << (16 - pf->bbits)));
2170 }
2171 }
2172
2173 static void set_pixel_format(VncState *vs, int bits_per_pixel,
2174 int big_endian_flag, int true_color_flag,
2175 int red_max, int green_max, int blue_max,
2176 int red_shift, int green_shift, int blue_shift)
2177 {
2178 if (!true_color_flag) {
2179 /* Expose a reasonable default 256 color map */
2180 bits_per_pixel = 8;
2181 red_max = 7;
2182 green_max = 7;
2183 blue_max = 3;
2184 red_shift = 0;
2185 green_shift = 3;
2186 blue_shift = 6;
2187 }
2188
2189 switch (bits_per_pixel) {
2190 case 8:
2191 case 16:
2192 case 32:
2193 break;
2194 default:
2195 vnc_client_error(vs);
2196 return;
2197 }
2198
2199 vs->client_pf.rmax = red_max ? red_max : 0xFF;
2200 vs->client_pf.rbits = ctpopl(red_max);
2201 vs->client_pf.rshift = red_shift;
2202 vs->client_pf.rmask = red_max << red_shift;
2203 vs->client_pf.gmax = green_max ? green_max : 0xFF;
2204 vs->client_pf.gbits = ctpopl(green_max);
2205 vs->client_pf.gshift = green_shift;
2206 vs->client_pf.gmask = green_max << green_shift;
2207 vs->client_pf.bmax = blue_max ? blue_max : 0xFF;
2208 vs->client_pf.bbits = ctpopl(blue_max);
2209 vs->client_pf.bshift = blue_shift;
2210 vs->client_pf.bmask = blue_max << blue_shift;
2211 vs->client_pf.bits_per_pixel = bits_per_pixel;
2212 vs->client_pf.bytes_per_pixel = bits_per_pixel / 8;
2213 vs->client_pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;
2214 vs->client_be = big_endian_flag;
2215
2216 if (!true_color_flag) {
2217 send_color_map(vs);
2218 }
2219
2220 set_pixel_conversion(vs);
2221
2222 graphic_hw_invalidate(vs->vd->dcl.con);
2223 graphic_hw_update(vs->vd->dcl.con);
2224 }
2225
2226 static void pixel_format_message (VncState *vs) {
2227 char pad[3] = { 0, 0, 0 };
2228
2229 vs->client_pf = qemu_default_pixelformat(32);
2230
2231 vnc_write_u8(vs, vs->client_pf.bits_per_pixel); /* bits-per-pixel */
2232 vnc_write_u8(vs, vs->client_pf.depth); /* depth */
2233
2234 #ifdef HOST_WORDS_BIGENDIAN
2235 vnc_write_u8(vs, 1); /* big-endian-flag */
2236 #else
2237 vnc_write_u8(vs, 0); /* big-endian-flag */
2238 #endif
2239 vnc_write_u8(vs, 1); /* true-color-flag */
2240 vnc_write_u16(vs, vs->client_pf.rmax); /* red-max */
2241 vnc_write_u16(vs, vs->client_pf.gmax); /* green-max */
2242 vnc_write_u16(vs, vs->client_pf.bmax); /* blue-max */
2243 vnc_write_u8(vs, vs->client_pf.rshift); /* red-shift */
2244 vnc_write_u8(vs, vs->client_pf.gshift); /* green-shift */
2245 vnc_write_u8(vs, vs->client_pf.bshift); /* blue-shift */
2246 vnc_write(vs, pad, 3); /* padding */
2247
2248 vnc_hextile_set_pixel_conversion(vs, 0);
2249 vs->write_pixels = vnc_write_pixels_copy;
2250 }
2251
2252 static void vnc_colordepth(VncState *vs)
2253 {
2254 if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) {
2255 /* Sending a WMVi message to notify the client*/
2256 vnc_lock_output(vs);
2257 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
2258 vnc_write_u8(vs, 0);
2259 vnc_write_u16(vs, 1); /* number of rects */
2260 vnc_framebuffer_update(vs, 0, 0,
2261 pixman_image_get_width(vs->vd->server),
2262 pixman_image_get_height(vs->vd->server),
2263 VNC_ENCODING_WMVi);
2264 pixel_format_message(vs);
2265 vnc_unlock_output(vs);
2266 vnc_flush(vs);
2267 } else {
2268 set_pixel_conversion(vs);
2269 }
2270 }
2271
2272 static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
2273 {
2274 int i;
2275 uint16_t limit;
2276 uint32_t freq;
2277 VncDisplay *vd = vs->vd;
2278
2279 if (data[0] > 3) {
2280 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
2281 }
2282
2283 switch (data[0]) {
2284 case VNC_MSG_CLIENT_SET_PIXEL_FORMAT:
2285 if (len == 1)
2286 return 20;
2287
2288 set_pixel_format(vs, read_u8(data, 4),
2289 read_u8(data, 6), read_u8(data, 7),
2290 read_u16(data, 8), read_u16(data, 10),
2291 read_u16(data, 12), read_u8(data, 14),
2292 read_u8(data, 15), read_u8(data, 16));
2293 break;
2294 case VNC_MSG_CLIENT_SET_ENCODINGS:
2295 if (len == 1)
2296 return 4;
2297
2298 if (len == 4) {
2299 limit = read_u16(data, 2);
2300 if (limit > 0)
2301 return 4 + (limit * 4);
2302 } else
2303 limit = read_u16(data, 2);
2304
2305 for (i = 0; i < limit; i++) {
2306 int32_t val = read_s32(data, 4 + (i * 4));
2307 memcpy(data + 4 + (i * 4), &val, sizeof(val));
2308 }
2309
2310 set_encodings(vs, (int32_t *)(data + 4), limit);
2311 break;
2312 case VNC_MSG_CLIENT_FRAMEBUFFER_UPDATE_REQUEST:
2313 if (len == 1)
2314 return 10;
2315
2316 framebuffer_update_request(vs,
2317 read_u8(data, 1), read_u16(data, 2), read_u16(data, 4),
2318 read_u16(data, 6), read_u16(data, 8));
2319 break;
2320 case VNC_MSG_CLIENT_KEY_EVENT:
2321 if (len == 1)
2322 return 8;
2323
2324 key_event(vs, read_u8(data, 1), read_u32(data, 4));
2325 break;
2326 case VNC_MSG_CLIENT_POINTER_EVENT:
2327 if (len == 1)
2328 return 6;
2329
2330 pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
2331 break;
2332 case VNC_MSG_CLIENT_CUT_TEXT:
2333 if (len == 1) {
2334 return 8;
2335 }
2336 if (len == 8) {
2337 uint32_t dlen = read_u32(data, 4);
2338 if (dlen > (1 << 20)) {
2339 error_report("vnc: client_cut_text msg payload has %u bytes"
2340 " which exceeds our limit of 1MB.", dlen);
2341 vnc_client_error(vs);
2342 break;
2343 }
2344 if (dlen > 0) {
2345 return 8 + dlen;
2346 }
2347 }
2348
2349 client_cut_text(vs, read_u32(data, 4), data + 8);
2350 break;
2351 case VNC_MSG_CLIENT_QEMU:
2352 if (len == 1)
2353 return 2;
2354
2355 switch (read_u8(data, 1)) {
2356 case VNC_MSG_CLIENT_QEMU_EXT_KEY_EVENT:
2357 if (len == 2)
2358 return 12;
2359
2360 ext_key_event(vs, read_u16(data, 2),
2361 read_u32(data, 4), read_u32(data, 8));
2362 break;
2363 case VNC_MSG_CLIENT_QEMU_AUDIO:
2364 if (len == 2)
2365 return 4;
2366
2367 switch (read_u16 (data, 2)) {
2368 case VNC_MSG_CLIENT_QEMU_AUDIO_ENABLE:
2369 audio_add(vs);
2370 break;
2371 case VNC_MSG_CLIENT_QEMU_AUDIO_DISABLE:
2372 audio_del(vs);
2373 break;
2374 case VNC_MSG_CLIENT_QEMU_AUDIO_SET_FORMAT:
2375 if (len == 4)
2376 return 10;
2377 switch (read_u8(data, 4)) {
2378 case 0: vs->as.fmt = AUDIO_FORMAT_U8; break;
2379 case 1: vs->as.fmt = AUDIO_FORMAT_S8; break;
2380 case 2: vs->as.fmt = AUDIO_FORMAT_U16; break;
2381 case 3: vs->as.fmt = AUDIO_FORMAT_S16; break;
2382 case 4: vs->as.fmt = AUDIO_FORMAT_U32; break;
2383 case 5: vs->as.fmt = AUDIO_FORMAT_S32; break;
2384 default:
2385 VNC_DEBUG("Invalid audio format %d\n", read_u8(data, 4));
2386 vnc_client_error(vs);
2387 break;
2388 }
2389 vs->as.nchannels = read_u8(data, 5);
2390 if (vs->as.nchannels != 1 && vs->as.nchannels != 2) {
2391 VNC_DEBUG("Invalid audio channel count %d\n",
2392 read_u8(data, 5));
2393 vnc_client_error(vs);
2394 break;
2395 }
2396 freq = read_u32(data, 6);
2397 /* No official limit for protocol, but 48khz is a sensible
2398 * upper bound for trustworthy clients, and this limit
2399 * protects calculations involving 'vs->as.freq' later.
2400 */
2401 if (freq > 48000) {
2402 VNC_DEBUG("Invalid audio frequency %u > 48000", freq);
2403 vnc_client_error(vs);
2404 break;
2405 }
2406 vs->as.freq = freq;
2407 break;
2408 default:
2409 VNC_DEBUG("Invalid audio message %d\n", read_u8(data, 4));
2410 vnc_client_error(vs);
2411 break;
2412 }
2413 break;
2414
2415 default:
2416 VNC_DEBUG("Msg: %d\n", read_u16(data, 0));
2417 vnc_client_error(vs);
2418 break;
2419 }
2420 break;
2421 default:
2422 VNC_DEBUG("Msg: %d\n", data[0]);
2423 vnc_client_error(vs);
2424 break;
2425 }
2426
2427 vnc_update_throttle_offset(vs);
2428 vnc_read_when(vs, protocol_client_msg, 1);
2429 return 0;
2430 }
2431
2432 static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
2433 {
2434 char buf[1024];
2435 VncShareMode mode;
2436 int size;
2437
2438 mode = data[0] ? VNC_SHARE_MODE_SHARED : VNC_SHARE_MODE_EXCLUSIVE;
2439 switch (vs->vd->share_policy) {
2440 case VNC_SHARE_POLICY_IGNORE:
2441 /*
2442 * Ignore the shared flag. Nothing to do here.
2443 *
2444 * Doesn't conform to the rfb spec but is traditional qemu
2445 * behavior, thus left here as option for compatibility
2446 * reasons.
2447 */
2448 break;
2449 case VNC_SHARE_POLICY_ALLOW_EXCLUSIVE:
2450 /*
2451 * Policy: Allow clients ask for exclusive access.
2452 *
2453 * Implementation: When a client asks for exclusive access,
2454 * disconnect all others. Shared connects are allowed as long
2455 * as no exclusive connection exists.
2456 *
2457 * This is how the rfb spec suggests to handle the shared flag.
2458 */
2459 if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2460 VncState *client;
2461 QTAILQ_FOREACH(client, &vs->vd->clients, next) {
2462 if (vs == client) {
2463 continue;
2464 }
2465 if (client->share_mode != VNC_SHARE_MODE_EXCLUSIVE &&
2466 client->share_mode != VNC_SHARE_MODE_SHARED) {
2467 continue;
2468 }
2469 vnc_disconnect_start(client);
2470 }
2471 }
2472 if (mode == VNC_SHARE_MODE_SHARED) {
2473 if (vs->vd->num_exclusive > 0) {
2474 vnc_disconnect_start(vs);
2475 return 0;
2476 }
2477 }
2478 break;
2479 case VNC_SHARE_POLICY_FORCE_SHARED:
2480 /*
2481 * Policy: Shared connects only.
2482 * Implementation: Disallow clients asking for exclusive access.
2483 *
2484 * Useful for shared desktop sessions where you don't want
2485 * someone forgetting to say -shared when running the vnc
2486 * client disconnect everybody else.
2487 */
2488 if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2489 vnc_disconnect_start(vs);
2490 return 0;
2491 }
2492 break;
2493 }
2494 vnc_set_share_mode(vs, mode);
2495
2496 if (vs->vd->num_shared > vs->vd->connections_limit) {
2497 vnc_disconnect_start(vs);
2498 return 0;
2499 }
2500
2501 assert(pixman_image_get_width(vs->vd->server) < 65536 &&
2502 pixman_image_get_width(vs->vd->server) >= 0);
2503 assert(pixman_image_get_height(vs->vd->server) < 65536 &&
2504 pixman_image_get_height(vs->vd->server) >= 0);
2505 vs->client_width = pixman_image_get_width(vs->vd->server);
2506 vs->client_height = pixman_image_get_height(vs->vd->server);
2507 vnc_write_u16(vs, vs->client_width);
2508 vnc_write_u16(vs, vs->client_height);
2509
2510 pixel_format_message(vs);
2511
2512 if (qemu_name) {
2513 size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
2514 if (size > sizeof(buf)) {
2515 size = sizeof(buf);
2516 }
2517 } else {
2518 size = snprintf(buf, sizeof(buf), "QEMU");
2519 }
2520
2521 vnc_write_u32(vs, size);
2522 vnc_write(vs, buf, size);
2523 vnc_flush(vs);
2524
2525 vnc_client_cache_auth(vs);
2526 vnc_qmp_event(vs, QAPI_EVENT_VNC_INITIALIZED);
2527
2528 vnc_read_when(vs, protocol_client_msg, 1);
2529
2530 return 0;
2531 }
2532
2533 void start_client_init(VncState *vs)
2534 {
2535 vnc_read_when(vs, protocol_client_init, 1);
2536 }
2537
2538 static void make_challenge(VncState *vs)
2539 {
2540 int i;
2541
2542 srand(time(NULL)+getpid()+getpid()*987654+rand());
2543
2544 for (i = 0 ; i < sizeof(vs->challenge) ; i++)
2545 vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
2546 }
2547
2548 static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
2549 {
2550 unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
2551 size_t i, pwlen;
2552 unsigned char key[8];
2553 time_t now = time(NULL);
2554 QCryptoCipher *cipher = NULL;
2555 Error *err = NULL;
2556
2557 if (!vs->vd->password) {
2558 trace_vnc_auth_fail(vs, vs->auth, "password is not set", "");
2559 goto reject;
2560 }
2561 if (vs->vd->expires < now) {
2562 trace_vnc_auth_fail(vs, vs->auth, "password is expired", "");
2563 goto reject;
2564 }
2565
2566 memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
2567
2568 /* Calculate the expected challenge response */
2569 pwlen = strlen(vs->vd->password);
2570 for (i=0; i<sizeof(key); i++)
2571 key[i] = i<pwlen ? vs->vd->password[i] : 0;
2572
2573 cipher = qcrypto_cipher_new(
2574 QCRYPTO_CIPHER_ALG_DES_RFB,
2575 QCRYPTO_CIPHER_MODE_ECB,
2576 key, G_N_ELEMENTS(key),
2577 &err);
2578 if (!cipher) {
2579 trace_vnc_auth_fail(vs, vs->auth, "cannot create cipher",
2580 error_get_pretty(err));
2581 error_free(err);
2582 goto reject;
2583 }
2584
2585 if (qcrypto_cipher_encrypt(cipher,
2586 vs->challenge,
2587 response,
2588 VNC_AUTH_CHALLENGE_SIZE,
2589 &err) < 0) {
2590 trace_vnc_auth_fail(vs, vs->auth, "cannot encrypt challenge response",
2591 error_get_pretty(err));
2592 error_free(err);
2593 goto reject;
2594 }
2595
2596 /* Compare expected vs actual challenge response */
2597 if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) {
2598 trace_vnc_auth_fail(vs, vs->auth, "mis-matched challenge response", "");
2599 goto reject;
2600 } else {
2601 trace_vnc_auth_pass(vs, vs->auth);
2602 vnc_write_u32(vs, 0); /* Accept auth */
2603 vnc_flush(vs);
2604
2605 start_client_init(vs);
2606 }
2607
2608 qcrypto_cipher_free(cipher);
2609 return 0;
2610
2611 reject:
2612 vnc_write_u32(vs, 1); /* Reject auth */
2613 if (vs->minor >= 8) {
2614 static const char err[] = "Authentication failed";
2615 vnc_write_u32(vs, sizeof(err));
2616 vnc_write(vs, err, sizeof(err));
2617 }
2618 vnc_flush(vs);
2619 vnc_client_error(vs);
2620 qcrypto_cipher_free(cipher);
2621 return 0;
2622 }
2623
2624 void start_auth_vnc(VncState *vs)
2625 {
2626 make_challenge(vs);
2627 /* Send client a 'random' challenge */
2628 vnc_write(vs, vs->challenge, sizeof(vs->challenge));
2629 vnc_flush(vs);
2630
2631 vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge));
2632 }
2633
2634
2635 static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
2636 {
2637 /* We only advertise 1 auth scheme at a time, so client
2638 * must pick the one we sent. Verify this */
2639 if (data[0] != vs->auth) { /* Reject auth */
2640 trace_vnc_auth_reject(vs, vs->auth, (int)data[0]);
2641 vnc_write_u32(vs, 1);
2642 if (vs->minor >= 8) {
2643 static const char err[] = "Authentication failed";
2644 vnc_write_u32(vs, sizeof(err));
2645 vnc_write(vs, err, sizeof(err));
2646 }
2647 vnc_client_error(vs);
2648 } else { /* Accept requested auth */
2649 trace_vnc_auth_start(vs, vs->auth);
2650 switch (vs->auth) {
2651 case VNC_AUTH_NONE:
2652 if (vs->minor >= 8) {
2653 vnc_write_u32(vs, 0); /* Accept auth completion */
2654 vnc_flush(vs);
2655 }
2656 trace_vnc_auth_pass(vs, vs->auth);
2657 start_client_init(vs);
2658 break;
2659
2660 case VNC_AUTH_VNC:
2661 start_auth_vnc(vs);
2662 break;
2663
2664 case VNC_AUTH_VENCRYPT:
2665 start_auth_vencrypt(vs);
2666 break;
2667
2668 #ifdef CONFIG_VNC_SASL
2669 case VNC_AUTH_SASL:
2670 start_auth_sasl(vs);
2671 break;
2672 #endif /* CONFIG_VNC_SASL */
2673
2674 default: /* Should not be possible, but just in case */
2675 trace_vnc_auth_fail(vs, vs->auth, "Unhandled auth method", "");
2676 vnc_write_u8(vs, 1);
2677 if (vs->minor >= 8) {
2678 static const char err[] = "Authentication failed";
2679 vnc_write_u32(vs, sizeof(err));
2680 vnc_write(vs, err, sizeof(err));
2681 }
2682 vnc_client_error(vs);
2683 }
2684 }
2685 return 0;
2686 }
2687
2688 static int protocol_version(VncState *vs, uint8_t *version, size_t len)
2689 {
2690 char local[13];
2691
2692 memcpy(local, version, 12);
2693 local[12] = 0;
2694
2695 if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) {
2696 VNC_DEBUG("Malformed protocol version %s\n", local);
2697 vnc_client_error(vs);
2698 return 0;
2699 }
2700 VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor);
2701 if (vs->major != 3 ||
2702 (vs->minor != 3 &&
2703 vs->minor != 4 &&
2704 vs->minor != 5 &&
2705 vs->minor != 7 &&
2706 vs->minor != 8)) {
2707 VNC_DEBUG("Unsupported client version\n");
2708 vnc_write_u32(vs, VNC_AUTH_INVALID);
2709 vnc_flush(vs);
2710 vnc_client_error(vs);
2711 return 0;
2712 }
2713 /* Some broken clients report v3.4 or v3.5, which spec requires to be treated
2714 * as equivalent to v3.3 by servers
2715 */
2716 if (vs->minor == 4 || vs->minor == 5)
2717 vs->minor = 3;
2718
2719 if (vs->minor == 3) {
2720 trace_vnc_auth_start(vs, vs->auth);
2721 if (vs->auth == VNC_AUTH_NONE) {
2722 vnc_write_u32(vs, vs->auth);
2723 vnc_flush(vs);
2724 trace_vnc_auth_pass(vs, vs->auth);
2725 start_client_init(vs);
2726 } else if (vs->auth == VNC_AUTH_VNC) {
2727 VNC_DEBUG("Tell client VNC auth\n");
2728 vnc_write_u32(vs, vs->auth);
2729 vnc_flush(vs);
2730 start_auth_vnc(vs);
2731 } else {
2732 trace_vnc_auth_fail(vs, vs->auth,
2733 "Unsupported auth method for v3.3", "");
2734 vnc_write_u32(vs, VNC_AUTH_INVALID);
2735 vnc_flush(vs);
2736 vnc_client_error(vs);
2737 }
2738 } else {
2739 vnc_write_u8(vs, 1); /* num auth */
2740 vnc_write_u8(vs, vs->auth);
2741 vnc_read_when(vs, protocol_client_auth, 1);
2742 vnc_flush(vs);
2743 }
2744
2745 return 0;
2746 }
2747
2748 static VncRectStat *vnc_stat_rect(VncDisplay *vd, int x, int y)
2749 {
2750 struct VncSurface *vs = &vd->guest;
2751
2752 return &vs->stats[y / VNC_STAT_RECT][x / VNC_STAT_RECT];
2753 }
2754
2755 void vnc_sent_lossy_rect(VncState *vs, int x, int y, int w, int h)
2756 {
2757 int i, j;
2758
2759 w = (x + w) / VNC_STAT_RECT;
2760 h = (y + h) / VNC_STAT_RECT;
2761 x /= VNC_STAT_RECT;
2762 y /= VNC_STAT_RECT;
2763
2764 for (j = y; j <= h; j++) {
2765 for (i = x; i <= w; i++) {
2766 vs->lossy_rect[j][i] = 1;
2767 }
2768 }
2769 }
2770
2771 static int vnc_refresh_lossy_rect(VncDisplay *vd, int x, int y)
2772 {
2773 VncState *vs;
2774 int sty = y / VNC_STAT_RECT;
2775 int stx = x / VNC_STAT_RECT;
2776 int has_dirty = 0;
2777
2778 y = QEMU_ALIGN_DOWN(y, VNC_STAT_RECT);
2779 x = QEMU_ALIGN_DOWN(x, VNC_STAT_RECT);
2780
2781 QTAILQ_FOREACH(vs, &vd->clients, next) {
2782 int j;
2783
2784 /* kernel send buffers are full -> refresh later */
2785 if (vs->output.offset) {
2786 continue;
2787 }
2788
2789 if (!vs->lossy_rect[sty][stx]) {
2790 continue;
2791 }
2792
2793 vs->lossy_rect[sty][stx] = 0;
2794 for (j = 0; j < VNC_STAT_RECT; ++j) {
2795 bitmap_set(vs->dirty[y + j],
2796 x / VNC_DIRTY_PIXELS_PER_BIT,
2797 VNC_STAT_RECT / VNC_DIRTY_PIXELS_PER_BIT);
2798 }
2799 has_dirty++;
2800 }
2801
2802 return has_dirty;
2803 }
2804
2805 static int vnc_update_stats(VncDisplay *vd, struct timeval * tv)
2806 {
2807 int width = MIN(pixman_image_get_width(vd->guest.fb),
2808 pixman_image_get_width(vd->server));
2809 int height = MIN(pixman_image_get_height(vd->guest.fb),
2810 pixman_image_get_height(vd->server));
2811 int x, y;
2812 struct timeval res;
2813 int has_dirty = 0;
2814
2815 for (y = 0; y < height; y += VNC_STAT_RECT) {
2816 for (x = 0; x < width; x += VNC_STAT_RECT) {
2817 VncRectStat *rect = vnc_stat_rect(vd, x, y);
2818
2819 rect->updated = false;
2820 }
2821 }
2822
2823 qemu_timersub(tv, &VNC_REFRESH_STATS, &res);
2824
2825 if (timercmp(&vd->guest.last_freq_check, &res, >)) {
2826 return has_dirty;
2827 }
2828 vd->guest.last_freq_check = *tv;
2829
2830 for (y = 0; y < height; y += VNC_STAT_RECT) {
2831 for (x = 0; x < width; x += VNC_STAT_RECT) {
2832 VncRectStat *rect= vnc_stat_rect(vd, x, y);
2833 int count = ARRAY_SIZE(rect->times);
2834 struct timeval min, max;
2835
2836 if (!timerisset(&rect->times[count - 1])) {
2837 continue ;
2838 }
2839
2840 max = rect->times[(rect->idx + count - 1) % count];
2841 qemu_timersub(tv, &max, &res);
2842
2843 if (timercmp(&res, &VNC_REFRESH_LOSSY, >)) {
2844 rect->freq = 0;
2845 has_dirty += vnc_refresh_lossy_rect(vd, x, y);
2846 memset(rect->times, 0, sizeof (rect->times));
2847 continue ;
2848 }
2849
2850 min = rect->times[rect->idx];
2851 max = rect->times[(rect->idx + count - 1) % count];
2852 qemu_timersub(&max, &min, &res);
2853
2854 rect->freq = res.tv_sec + res.tv_usec / 1000000.;
2855 rect->freq /= count;
2856 rect->freq = 1. / rect->freq;
2857 }
2858 }
2859 return has_dirty;
2860 }
2861
2862 double vnc_update_freq(VncState *vs, int x, int y, int w, int h)
2863 {
2864 int i, j;
2865 double total = 0;
2866 int num = 0;
2867
2868 x = QEMU_ALIGN_DOWN(x, VNC_STAT_RECT);
2869 y = QEMU_ALIGN_DOWN(y, VNC_STAT_RECT);
2870
2871 for (j = y; j <= y + h; j += VNC_STAT_RECT) {
2872 for (i = x; i <= x + w; i += VNC_STAT_RECT) {
2873 total += vnc_stat_rect(vs->vd, i, j)->freq;
2874 num++;
2875 }
2876 }
2877
2878 if (num) {
2879 return total / num;
2880 } else {
2881 return 0;
2882 }
2883 }
2884
2885 static void vnc_rect_updated(VncDisplay *vd, int x, int y, struct timeval * tv)
2886 {
2887 VncRectStat *rect;
2888
2889 rect = vnc_stat_rect(vd, x, y);
2890 if (rect->updated) {
2891 return ;
2892 }
2893 rect->times[rect->idx] = *tv;
2894 rect->idx = (rect->idx + 1) % ARRAY_SIZE(rect->times);
2895 rect->updated = true;
2896 }
2897
2898 static int vnc_refresh_server_surface(VncDisplay *vd)
2899 {
2900 int width = MIN(pixman_image_get_width(vd->guest.fb),
2901 pixman_image_get_width(vd->server));
2902 int height = MIN(pixman_image_get_height(vd->guest.fb),
2903 pixman_image_get_height(vd->server));
2904 int cmp_bytes, server_stride, line_bytes, guest_ll, guest_stride, y = 0;
2905 uint8_t *guest_row0 = NULL, *server_row0;
2906 VncState *vs;
2907 int has_dirty = 0;
2908 pixman_image_t *tmpbuf = NULL;
2909
2910 struct timeval tv = { 0, 0 };
2911
2912 if (!vd->non_adaptive) {
2913 gettimeofday(&tv, NULL);
2914 has_dirty = vnc_update_stats(vd, &tv);
2915 }
2916
2917 /*
2918 * Walk through the guest dirty map.
2919 * Check and copy modified bits from guest to server surface.
2920 * Update server dirty map.
2921 */
2922 server_row0 = (uint8_t *)pixman_image_get_data(vd->server);
2923 server_stride = guest_stride = guest_ll =
2924 pixman_image_get_stride(vd->server);
2925 cmp_bytes = MIN(VNC_DIRTY_PIXELS_PER_BIT * VNC_SERVER_FB_BYTES,
2926 server_stride);
2927 if (vd->guest.format != VNC_SERVER_FB_FORMAT) {
2928 int width = pixman_image_get_width(vd->server);
2929 tmpbuf = qemu_pixman_linebuf_create(VNC_SERVER_FB_FORMAT, width);
2930 } else {
2931 int guest_bpp =
2932 PIXMAN_FORMAT_BPP(pixman_image_get_format(vd->guest.fb));
2933 guest_row0 = (uint8_t *)pixman_image_get_data(vd->guest.fb);
2934 guest_stride = pixman_image_get_stride(vd->guest.fb);
2935 guest_ll = pixman_image_get_width(vd->guest.fb)
2936 * DIV_ROUND_UP(guest_bpp, 8);
2937 }
2938 line_bytes = MIN(server_stride, guest_ll);
2939
2940 for (;;) {
2941 int x;
2942 uint8_t *guest_ptr, *server_ptr;
2943 unsigned long offset = find_next_bit((unsigned long *) &vd->guest.dirty,
2944 height * VNC_DIRTY_BPL(&vd->guest),
2945 y * VNC_DIRTY_BPL(&vd->guest));
2946 if (offset == height * VNC_DIRTY_BPL(&vd->guest)) {
2947 /* no more dirty bits */
2948 break;
2949 }
2950 y = offset / VNC_DIRTY_BPL(&vd->guest);
2951 x = offset % VNC_DIRTY_BPL(&vd->guest);
2952
2953 server_ptr = server_row0 + y * server_stride + x * cmp_bytes;
2954
2955 if (vd->guest.format != VNC_SERVER_FB_FORMAT) {
2956 qemu_pixman_linebuf_fill(tmpbuf, vd->guest.fb, width, 0, y);
2957 guest_ptr = (uint8_t *)pixman_image_get_data(tmpbuf);
2958 } else {
2959 guest_ptr = guest_row0 + y * guest_stride;
2960 }
2961 guest_ptr += x * cmp_bytes;
2962
2963 for (; x < DIV_ROUND_UP(width, VNC_DIRTY_PIXELS_PER_BIT);
2964 x++, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) {
2965 int _cmp_bytes = cmp_bytes;
2966 if (!test_and_clear_bit(x, vd->guest.dirty[y])) {
2967 continue;
2968 }
2969 if ((x + 1) * cmp_bytes > line_bytes) {
2970 _cmp_bytes = line_bytes - x * cmp_bytes;
2971 }
2972 assert(_cmp_bytes >= 0);
2973 if (memcmp(server_ptr, guest_ptr, _cmp_bytes) == 0) {
2974 continue;
2975 }
2976 memcpy(server_ptr, guest_ptr, _cmp_bytes);
2977 if (!vd->non_adaptive) {
2978 vnc_rect_updated(vd, x * VNC_DIRTY_PIXELS_PER_BIT,
2979 y, &tv);
2980 }
2981 QTAILQ_FOREACH(vs, &vd->clients, next) {
2982 set_bit(x, vs->dirty[y]);
2983 }
2984 has_dirty++;
2985 }
2986
2987 y++;
2988 }
2989 qemu_pixman_image_unref(tmpbuf);
2990 return has_dirty;
2991 }
2992
2993 static void vnc_refresh(DisplayChangeListener *dcl)
2994 {
2995 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
2996 VncState *vs, *vn;
2997 int has_dirty, rects = 0;
2998
2999 if (QTAILQ_EMPTY(&vd->clients)) {
3000 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_MAX);
3001 return;
3002 }
3003
3004 graphic_hw_update(vd->dcl.con);
3005
3006 if (vnc_trylock_display(vd)) {
3007 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
3008 return;
3009 }
3010
3011 has_dirty = vnc_refresh_server_surface(vd);
3012 vnc_unlock_display(vd);
3013
3014 QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {
3015 rects += vnc_update_client(vs, has_dirty);
3016 /* vs might be free()ed here */
3017 }
3018
3019 if (has_dirty && rects) {
3020 vd->dcl.update_interval /= 2;
3021 if (vd->dcl.update_interval < VNC_REFRESH_INTERVAL_BASE) {
3022 vd->dcl.update_interval = VNC_REFRESH_INTERVAL_BASE;
3023 }
3024 } else {
3025 vd->dcl.update_interval += VNC_REFRESH_INTERVAL_INC;
3026 if (vd->dcl.update_interval > VNC_REFRESH_INTERVAL_MAX) {
3027 vd->dcl.update_interval = VNC_REFRESH_INTERVAL_MAX;
3028 }
3029 }
3030 }
3031
3032 static void vnc_connect(VncDisplay *vd, QIOChannelSocket *sioc,
3033 bool skipauth, bool websocket)
3034 {
3035 VncState *vs = g_new0(VncState, 1);
3036 bool first_client = QTAILQ_EMPTY(&vd->clients);
3037 int i;
3038
3039 trace_vnc_client_connect(vs, sioc);
3040 vs->magic = VNC_MAGIC;
3041 vs->sioc = sioc;
3042 object_ref(OBJECT(vs->sioc));
3043 vs->ioc = QIO_CHANNEL(sioc);
3044 object_ref(OBJECT(vs->ioc));
3045 vs->vd = vd;
3046
3047 buffer_init(&vs->input, "vnc-input/%p", sioc);
3048 buffer_init(&vs->output, "vnc-output/%p", sioc);
3049 buffer_init(&vs->jobs_buffer, "vnc-jobs_buffer/%p", sioc);
3050
3051 buffer_init(&vs->tight.tight, "vnc-tight/%p", sioc);
3052 buffer_init(&vs->tight.zlib, "vnc-tight-zlib/%p", sioc);
3053 buffer_init(&vs->tight.gradient, "vnc-tight-gradient/%p", sioc);
3054 #ifdef CONFIG_VNC_JPEG
3055 buffer_init(&vs->tight.jpeg, "vnc-tight-jpeg/%p", sioc);
3056 #endif
3057 #ifdef CONFIG_VNC_PNG
3058 buffer_init(&vs->tight.png, "vnc-tight-png/%p", sioc);
3059 #endif
3060 buffer_init(&vs->zlib.zlib, "vnc-zlib/%p", sioc);
3061 buffer_init(&vs->zrle.zrle, "vnc-zrle/%p", sioc);
3062 buffer_init(&vs->zrle.fb, "vnc-zrle-fb/%p", sioc);
3063 buffer_init(&vs->zrle.zlib, "vnc-zrle-zlib/%p", sioc);
3064
3065 if (skipauth) {
3066 vs->auth = VNC_AUTH_NONE;
3067 vs->subauth = VNC_AUTH_INVALID;
3068 } else {
3069 if (websocket) {
3070 vs->auth = vd->ws_auth;
3071 vs->subauth = VNC_AUTH_INVALID;
3072 } else {
3073 vs->auth = vd->auth;
3074 vs->subauth = vd->subauth;
3075 }
3076 }
3077 VNC_DEBUG("Client sioc=%p ws=%d auth=%d subauth=%d\n",
3078 sioc, websocket, vs->auth, vs->subauth);
3079
3080 vs->lossy_rect = g_malloc0(VNC_STAT_ROWS * sizeof (*vs->lossy_rect));
3081 for (i = 0; i < VNC_STAT_ROWS; ++i) {
3082 vs->lossy_rect[i] = g_new0(uint8_t, VNC_STAT_COLS);
3083 }
3084
3085 VNC_DEBUG("New client on socket %p\n", vs->sioc);
3086 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
3087 qio_channel_set_blocking(vs->ioc, false, NULL);
3088 if (vs->ioc_tag) {
3089 g_source_remove(vs->ioc_tag);
3090 }
3091 if (websocket) {
3092 vs->websocket = 1;
3093 if (vd->tlscreds) {
3094 vs->ioc_tag = qio_channel_add_watch(
3095 vs->ioc, G_IO_IN, vncws_tls_handshake_io, vs, NULL);
3096 } else {
3097 vs->ioc_tag = qio_channel_add_watch(
3098 vs->ioc, G_IO_IN, vncws_handshake_io, vs, NULL);
3099 }
3100 } else {
3101 vs->ioc_tag = qio_channel_add_watch(
3102 vs->ioc, G_IO_IN, vnc_client_io, vs, NULL);
3103 }
3104
3105 vnc_client_cache_addr(vs);
3106 vnc_qmp_event(vs, QAPI_EVENT_VNC_CONNECTED);
3107 vnc_set_share_mode(vs, VNC_SHARE_MODE_CONNECTING);
3108
3109 vs->last_x = -1;
3110 vs->last_y = -1;
3111
3112 vs->as.freq = 44100;
3113 vs->as.nchannels = 2;
3114 vs->as.fmt = AUDIO_FORMAT_S16;
3115 vs->as.endianness = 0;
3116
3117 qemu_mutex_init(&vs->output_mutex);
3118 vs->bh = qemu_bh_new(vnc_jobs_bh, vs);
3119
3120 QTAILQ_INSERT_TAIL(&vd->clients, vs, next);
3121 if (first_client) {
3122 vnc_update_server_surface(vd);
3123 }
3124
3125 graphic_hw_update(vd->dcl.con);
3126
3127 if (!vs->websocket) {
3128 vnc_start_protocol(vs);
3129 }
3130
3131 if (vd->num_connecting > vd->connections_limit) {
3132 QTAILQ_FOREACH(vs, &vd->clients, next) {
3133 if (vs->share_mode == VNC_SHARE_MODE_CONNECTING) {
3134 vnc_disconnect_start(vs);
3135 return;
3136 }
3137 }
3138 }
3139 }
3140
3141 void vnc_start_protocol(VncState *vs)
3142 {
3143 vnc_write(vs, "RFB 003.008\n", 12);
3144 vnc_flush(vs);
3145 vnc_read_when(vs, protocol_version, 12);
3146
3147 vs->mouse_mode_notifier.notify = check_pointer_type_change;
3148 qemu_add_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
3149 }
3150
3151 static void vnc_listen_io(QIONetListener *listener,
3152 QIOChannelSocket *cioc,
3153 void *opaque)
3154 {
3155 VncDisplay *vd = opaque;
3156 bool isWebsock = listener == vd->wslistener;
3157
3158 qio_channel_set_name(QIO_CHANNEL(cioc),
3159 isWebsock ? "vnc-ws-server" : "vnc-server");
3160 qio_channel_set_delay(QIO_CHANNEL(cioc), false);
3161 vnc_connect(vd, cioc, false, isWebsock);
3162 }
3163
3164 static const DisplayChangeListenerOps dcl_ops = {
3165 .dpy_name = "vnc",
3166 .dpy_refresh = vnc_refresh,
3167 .dpy_gfx_update = vnc_dpy_update,
3168 .dpy_gfx_switch = vnc_dpy_switch,
3169 .dpy_gfx_check_format = qemu_pixman_check_format,
3170 .dpy_mouse_set = vnc_mouse_set,
3171 .dpy_cursor_define = vnc_dpy_cursor_define,
3172 };
3173
3174 void vnc_display_init(const char *id, Error **errp)
3175 {
3176 VncDisplay *vd;
3177
3178 if (vnc_display_find(id) != NULL) {
3179 return;
3180 }
3181 vd = g_malloc0(sizeof(*vd));
3182
3183 vd->id = strdup(id);
3184 QTAILQ_INSERT_TAIL(&vnc_displays, vd, next);
3185
3186 QTAILQ_INIT(&vd->clients);
3187 vd->expires = TIME_MAX;
3188
3189 if (keyboard_layout) {
3190 trace_vnc_key_map_init(keyboard_layout);
3191 vd->kbd_layout = init_keyboard_layout(name2keysym,
3192 keyboard_layout, errp);
3193 } else {
3194 vd->kbd_layout = init_keyboard_layout(name2keysym, "en-us", errp);
3195 }
3196
3197 if (!vd->kbd_layout) {
3198 return;
3199 }
3200
3201 vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
3202 vd->connections_limit = 32;
3203
3204 qemu_mutex_init(&vd->mutex);
3205 vnc_start_worker_thread();
3206
3207 vd->dcl.ops = &dcl_ops;
3208 register_displaychangelistener(&vd->dcl);
3209 vd->kbd = qkbd_state_init(vd->dcl.con);
3210 }
3211
3212
3213 static void vnc_display_close(VncDisplay *vd)
3214 {
3215 if (!vd) {
3216 return;
3217 }
3218 vd->is_unix = false;
3219
3220 if (vd->listener) {
3221 qio_net_listener_disconnect(vd->listener);
3222 object_unref(OBJECT(vd->listener));
3223 }
3224 vd->listener = NULL;
3225
3226 if (vd->wslistener) {
3227 qio_net_listener_disconnect(vd->wslistener);
3228 object_unref(OBJECT(vd->wslistener));
3229 }
3230 vd->wslistener = NULL;
3231
3232 vd->auth = VNC_AUTH_INVALID;
3233 vd->subauth = VNC_AUTH_INVALID;
3234 if (vd->tlscreds) {
3235 object_unparent(OBJECT(vd->tlscreds));
3236 vd->tlscreds = NULL;
3237 }
3238 if (vd->tlsauthz) {
3239 object_unparent(OBJECT(vd->tlsauthz));
3240 vd->tlsauthz = NULL;
3241 }
3242 g_free(vd->tlsauthzid);
3243 vd->tlsauthzid = NULL;
3244 if (vd->lock_key_sync) {
3245 qemu_remove_led_event_handler(vd->led);
3246 vd->led = NULL;
3247 }
3248 #ifdef CONFIG_VNC_SASL
3249 if (vd->sasl.authz) {
3250 object_unparent(OBJECT(vd->sasl.authz));
3251 vd->sasl.authz = NULL;
3252 }
3253 g_free(vd->sasl.authzid);
3254 vd->sasl.authzid = NULL;
3255 #endif
3256 }
3257
3258 int vnc_display_password(const char *id, const char *password)
3259 {
3260 VncDisplay *vd = vnc_display_find(id);
3261
3262 if (!vd) {
3263 return -EINVAL;
3264 }
3265 if (vd->auth == VNC_AUTH_NONE) {
3266 error_printf_unless_qmp("If you want use passwords please enable "
3267 "password auth using '-vnc ${dpy},password'.\n");
3268 return -EINVAL;
3269 }
3270
3271 g_free(vd->password);
3272 vd->password = g_strdup(password);
3273
3274 return 0;
3275 }
3276
3277 int vnc_display_pw_expire(const char *id, time_t expires)
3278 {
3279 VncDisplay *vd = vnc_display_find(id);
3280
3281 if (!vd) {
3282 return -EINVAL;
3283 }
3284
3285 vd->expires = expires;
3286 return 0;
3287 }
3288
3289 static void vnc_display_print_local_addr(VncDisplay *vd)
3290 {
3291 SocketAddress *addr;
3292 Error *err = NULL;
3293
3294 if (!vd->listener || !vd->listener->nsioc) {
3295 return;
3296 }
3297
3298 addr = qio_channel_socket_get_local_address(vd->listener->sioc[0], &err);
3299 if (!addr) {
3300 return;
3301 }
3302
3303 if (addr->type != SOCKET_ADDRESS_TYPE_INET) {
3304 qapi_free_SocketAddress(addr);
3305 return;
3306 }
3307 error_printf_unless_qmp("VNC server running on %s:%s\n",
3308 addr->u.inet.host,
3309 addr->u.inet.port);
3310 qapi_free_SocketAddress(addr);
3311 }
3312
3313 static QemuOptsList qemu_vnc_opts = {
3314 .name = "vnc",
3315 .head = QTAILQ_HEAD_INITIALIZER(qemu_vnc_opts.head),
3316 .implied_opt_name = "vnc",
3317 .desc = {
3318 {
3319 .name = "vnc",
3320 .type = QEMU_OPT_STRING,
3321 },{
3322 .name = "websocket",
3323 .type = QEMU_OPT_STRING,
3324 },{
3325 .name = "tls-creds",
3326 .type = QEMU_OPT_STRING,
3327 },{
3328 .name = "share",
3329 .type = QEMU_OPT_STRING,
3330 },{
3331 .name = "display",
3332 .type = QEMU_OPT_STRING,
3333 },{
3334 .name = "head",
3335 .type = QEMU_OPT_NUMBER,
3336 },{
3337 .name = "connections",
3338 .type = QEMU_OPT_NUMBER,
3339 },{
3340 .name = "to",
3341 .type = QEMU_OPT_NUMBER,
3342 },{
3343 .name = "ipv4",
3344 .type = QEMU_OPT_BOOL,
3345 },{
3346 .name = "ipv6",
3347 .type = QEMU_OPT_BOOL,
3348 },{
3349 .name = "password",
3350 .type = QEMU_OPT_BOOL,
3351 },{
3352 .name = "reverse",
3353 .type = QEMU_OPT_BOOL,
3354 },{
3355 .name = "lock-key-sync",
3356 .type = QEMU_OPT_BOOL,
3357 },{
3358 .name = "key-delay-ms",
3359 .type = QEMU_OPT_NUMBER,
3360 },{
3361 .name = "sasl",
3362 .type = QEMU_OPT_BOOL,
3363 },{
3364 .name = "acl",
3365 .type = QEMU_OPT_BOOL,
3366 },{
3367 .name = "tls-authz",
3368 .type = QEMU_OPT_STRING,
3369 },{
3370 .name = "sasl-authz",
3371 .type = QEMU_OPT_STRING,
3372 },{
3373 .name = "lossy",
3374 .type = QEMU_OPT_BOOL,
3375 },{
3376 .name = "non-adaptive",
3377 .type = QEMU_OPT_BOOL,
3378 },
3379 { /* end of list */ }
3380 },
3381 };
3382
3383
3384 static int
3385 vnc_display_setup_auth(int *auth,
3386 int *subauth,
3387 QCryptoTLSCreds *tlscreds,
3388 bool password,
3389 bool sasl,
3390 bool websocket,
3391 Error **errp)
3392 {
3393 /*
3394 * We have a choice of 3 authentication options
3395 *
3396 * 1. none
3397 * 2. vnc
3398 * 3. sasl
3399 *
3400 * The channel can be run in 2 modes
3401 *
3402 * 1. clear
3403 * 2. tls
3404 *
3405 * And TLS can use 2 types of credentials
3406 *
3407 * 1. anon
3408 * 2. x509
3409 *
3410 * We thus have 9 possible logical combinations
3411 *
3412 * 1. clear + none
3413 * 2. clear + vnc
3414 * 3. clear + sasl
3415 * 4. tls + anon + none
3416 * 5. tls + anon + vnc
3417 * 6. tls + anon + sasl
3418 * 7. tls + x509 + none
3419 * 8. tls + x509 + vnc
3420 * 9. tls + x509 + sasl
3421 *
3422 * These need to be mapped into the VNC auth schemes
3423 * in an appropriate manner. In regular VNC, all the
3424 * TLS options get mapped into VNC_AUTH_VENCRYPT
3425 * sub-auth types.
3426 *
3427 * In websockets, the https:// protocol already provides
3428 * TLS support, so there is no need to make use of the
3429 * VeNCrypt extension. Furthermore, websockets browser
3430 * clients could not use VeNCrypt even if they wanted to,
3431 * as they cannot control when the TLS handshake takes
3432 * place. Thus there is no option but to rely on https://,
3433 * meaning combinations 4->6 and 7->9 will be mapped to
3434 * VNC auth schemes in the same way as combos 1->3.
3435 *
3436 * Regardless of fact that we have a different mapping to
3437 * VNC auth mechs for plain VNC vs websockets VNC, the end
3438 * result has the same security characteristics.
3439 */
3440 if (websocket || !tlscreds) {
3441 if (password) {
3442 VNC_DEBUG("Initializing VNC server with password auth\n");
3443 *auth = VNC_AUTH_VNC;
3444 } else if (sasl) {
3445 VNC_DEBUG("Initializing VNC server with SASL auth\n");
3446 *auth = VNC_AUTH_SASL;
3447 } else {
3448 VNC_DEBUG("Initializing VNC server with no auth\n");
3449 *auth = VNC_AUTH_NONE;
3450 }
3451 *subauth = VNC_AUTH_INVALID;
3452 } else {
3453 bool is_x509 = object_dynamic_cast(OBJECT(tlscreds),
3454 TYPE_QCRYPTO_TLS_CREDS_X509) != NULL;
3455 bool is_anon = object_dynamic_cast(OBJECT(tlscreds),
3456 TYPE_QCRYPTO_TLS_CREDS_ANON) != NULL;
3457
3458 if (!is_x509 && !is_anon) {
3459 error_setg(errp,
3460 "Unsupported TLS cred type %s",
3461 object_get_typename(OBJECT(tlscreds)));
3462 return -1;
3463 }
3464 *auth = VNC_AUTH_VENCRYPT;
3465 if (password) {
3466 if (is_x509) {
3467 VNC_DEBUG("Initializing VNC server with x509 password auth\n");
3468 *subauth = VNC_AUTH_VENCRYPT_X509VNC;
3469 } else {
3470 VNC_DEBUG("Initializing VNC server with TLS password auth\n");
3471 *subauth = VNC_AUTH_VENCRYPT_TLSVNC;
3472 }
3473
3474 } else if (sasl) {
3475 if (is_x509) {
3476 VNC_DEBUG("Initializing VNC server with x509 SASL auth\n");
3477 *subauth = VNC_AUTH_VENCRYPT_X509SASL;
3478 } else {
3479 VNC_DEBUG("Initializing VNC server with TLS SASL auth\n");
3480 *subauth = VNC_AUTH_VENCRYPT_TLSSASL;
3481 }
3482 } else {
3483 if (is_x509) {
3484 VNC_DEBUG("Initializing VNC server with x509 no auth\n");
3485 *subauth = VNC_AUTH_VENCRYPT_X509NONE;
3486 } else {
3487 VNC_DEBUG("Initializing VNC server with TLS no auth\n");
3488 *subauth = VNC_AUTH_VENCRYPT_TLSNONE;
3489 }
3490 }
3491 }
3492 return 0;
3493 }
3494
3495
3496 static int vnc_display_get_address(const char *addrstr,
3497 bool websocket,
3498 bool reverse,
3499 int displaynum,
3500 int to,
3501 bool has_ipv4,
3502 bool has_ipv6,
3503 bool ipv4,
3504 bool ipv6,
3505 SocketAddress **retaddr,
3506 Error **errp)
3507 {
3508 int ret = -1;
3509 SocketAddress *addr = NULL;
3510
3511 addr = g_new0(SocketAddress, 1);
3512
3513 if (strncmp(addrstr, "unix:", 5) == 0) {
3514 addr->type = SOCKET_ADDRESS_TYPE_UNIX;
3515 addr->u.q_unix.path = g_strdup(addrstr + 5);
3516
3517 if (websocket) {
3518 error_setg(errp, "UNIX sockets not supported with websock");
3519 goto cleanup;
3520 }
3521
3522 if (to) {
3523 error_setg(errp, "Port range not support with UNIX socket");
3524 goto cleanup;
3525 }
3526 ret = 0;
3527 } else {
3528 const char *port;
3529 size_t hostlen;
3530 unsigned long long baseport = 0;
3531 InetSocketAddress *inet;
3532
3533 port = strrchr(addrstr, ':');
3534 if (!port) {
3535 if (websocket) {
3536 hostlen = 0;
3537 port = addrstr;
3538 } else {
3539 error_setg(errp, "no vnc port specified");
3540 goto cleanup;
3541 }
3542 } else {
3543 hostlen = port - addrstr;
3544 port++;
3545 if (*port == '\0') {
3546 error_setg(errp, "vnc port cannot be empty");
3547 goto cleanup;
3548 }
3549 }
3550
3551 addr->type = SOCKET_ADDRESS_TYPE_INET;
3552 inet = &addr->u.inet;
3553 if (addrstr[0] == '[' && addrstr[hostlen - 1] == ']') {
3554 inet->host = g_strndup(addrstr + 1, hostlen - 2);
3555 } else {
3556 inet->host = g_strndup(addrstr, hostlen);
3557 }
3558 /* plain VNC port is just an offset, for websocket
3559 * port is absolute */
3560 if (websocket) {
3561 if (g_str_equal(addrstr, "") ||
3562 g_str_equal(addrstr, "on")) {
3563 if (displaynum == -1) {
3564 error_setg(errp, "explicit websocket port is required");
3565 goto cleanup;
3566 }
3567 inet->port = g_strdup_printf(
3568 "%d", displaynum + 5700);
3569 if (to) {
3570 inet->has_to = true;
3571 inet->to = to + 5700;
3572 }
3573 } else {
3574 inet->port = g_strdup(port);
3575 }
3576 } else {
3577 int offset = reverse ? 0 : 5900;
3578 if (parse_uint_full(port, &baseport, 10) < 0) {
3579 error_setg(errp, "can't convert to a number: %s", port);
3580 goto cleanup;
3581 }
3582 if (baseport > 65535 ||
3583 baseport + offset > 65535) {
3584 error_setg(errp, "port %s out of range", port);
3585 goto cleanup;
3586 }
3587 inet->port = g_strdup_printf(
3588 "%d", (int)baseport + offset);
3589
3590 if (to) {
3591 inet->has_to = true;
3592 inet->to = to + offset;
3593 }
3594 }
3595
3596 inet->ipv4 = ipv4;
3597 inet->has_ipv4 = has_ipv4;
3598 inet->ipv6 = ipv6;
3599 inet->has_ipv6 = has_ipv6;
3600
3601 ret = baseport;
3602 }
3603
3604 *retaddr = addr;
3605
3606 cleanup:
3607 if (ret < 0) {
3608 qapi_free_SocketAddress(addr);
3609 }
3610 return ret;
3611 }
3612
3613 static void vnc_free_addresses(SocketAddress ***retsaddr,
3614 size_t *retnsaddr)
3615 {
3616 size_t i;
3617
3618 for (i = 0; i < *retnsaddr; i++) {
3619 qapi_free_SocketAddress((*retsaddr)[i]);
3620 }
3621 g_free(*retsaddr);
3622
3623 *retsaddr = NULL;
3624 *retnsaddr = 0;
3625 }
3626
3627 static int vnc_display_get_addresses(QemuOpts *opts,
3628 bool reverse,
3629 SocketAddress ***retsaddr,
3630 size_t *retnsaddr,
3631 SocketAddress ***retwsaddr,
3632 size_t *retnwsaddr,
3633 Error **errp)
3634 {
3635 SocketAddress *saddr = NULL;
3636 SocketAddress *wsaddr = NULL;
3637 QemuOptsIter addriter;
3638 const char *addr;
3639 int to = qemu_opt_get_number(opts, "to", 0);
3640 bool has_ipv4 = qemu_opt_get(opts, "ipv4");
3641 bool has_ipv6 = qemu_opt_get(opts, "ipv6");
3642 bool ipv4 = qemu_opt_get_bool(opts, "ipv4", false);
3643 bool ipv6 = qemu_opt_get_bool(opts, "ipv6", false);
3644 int displaynum = -1;
3645 int ret = -1;
3646
3647 *retsaddr = NULL;
3648 *retnsaddr = 0;
3649 *retwsaddr = NULL;
3650 *retnwsaddr = 0;
3651
3652 addr = qemu_opt_get(opts, "vnc");
3653 if (addr == NULL || g_str_equal(addr, "none")) {
3654 ret = 0;
3655 goto cleanup;
3656 }
3657 if (qemu_opt_get(opts, "websocket") &&
3658 !qcrypto_hash_supports(QCRYPTO_HASH_ALG_SHA1)) {
3659 error_setg(errp,
3660 "SHA1 hash support is required for websockets");
3661 goto cleanup;
3662 }
3663
3664 qemu_opt_iter_init(&addriter, opts, "vnc");
3665 while ((addr = qemu_opt_iter_next(&addriter)) != NULL) {
3666 int rv;
3667 rv = vnc_display_get_address(addr, false, reverse, 0, to,
3668 has_ipv4, has_ipv6,
3669 ipv4, ipv6,
3670 &saddr, errp);
3671 if (rv < 0) {
3672 goto cleanup;
3673 }
3674 /* Historical compat - first listen address can be used
3675 * to set the default websocket port
3676 */
3677 if (displaynum == -1) {
3678 displaynum = rv;
3679 }
3680 *retsaddr = g_renew(SocketAddress *, *retsaddr, *retnsaddr + 1);
3681 (*retsaddr)[(*retnsaddr)++] = saddr;
3682 }
3683
3684 /* If we had multiple primary displays, we don't do defaults
3685 * for websocket, and require explicit config instead. */
3686 if (*retnsaddr > 1) {
3687 displaynum = -1;
3688 }
3689
3690 qemu_opt_iter_init(&addriter, opts, "websocket");
3691 while ((addr = qemu_opt_iter_next(&addriter)) != NULL) {
3692 if (vnc_display_get_address(addr, true, reverse, displaynum, to,
3693 has_ipv4, has_ipv6,
3694 ipv4, ipv6,
3695 &wsaddr, errp) < 0) {
3696 goto cleanup;
3697 }
3698
3699 /* Historical compat - if only a single listen address was
3700 * provided, then this is used to set the default listen
3701 * address for websocket too
3702 */
3703 if (*retnsaddr == 1 &&
3704 (*retsaddr)[0]->type == SOCKET_ADDRESS_TYPE_INET &&
3705 wsaddr->type == SOCKET_ADDRESS_TYPE_INET &&
3706 g_str_equal(wsaddr->u.inet.host, "") &&
3707 !g_str_equal((*retsaddr)[0]->u.inet.host, "")) {
3708 g_free(wsaddr->u.inet.host);
3709 wsaddr->u.inet.host = g_strdup((*retsaddr)[0]->u.inet.host);
3710 }
3711
3712 *retwsaddr = g_renew(SocketAddress *, *retwsaddr, *retnwsaddr + 1);
3713 (*retwsaddr)[(*retnwsaddr)++] = wsaddr;
3714 }
3715
3716 ret = 0;
3717 cleanup:
3718 if (ret < 0) {
3719 vnc_free_addresses(retsaddr, retnsaddr);
3720 vnc_free_addresses(retwsaddr, retnwsaddr);
3721 }
3722 return ret;
3723 }
3724
3725 static int vnc_display_connect(VncDisplay *vd,
3726 SocketAddress **saddr,
3727 size_t nsaddr,
3728 SocketAddress **wsaddr,
3729 size_t nwsaddr,
3730 Error **errp)
3731 {
3732 /* connect to viewer */
3733 QIOChannelSocket *sioc = NULL;
3734 if (nwsaddr != 0) {
3735 error_setg(errp, "Cannot use websockets in reverse mode");
3736 return -1;
3737 }
3738 if (nsaddr != 1) {
3739 error_setg(errp, "Expected a single address in reverse mode");
3740 return -1;
3741 }
3742 /* TODO SOCKET_ADDRESS_TYPE_FD when fd has AF_UNIX */
3743 vd->is_unix = saddr[0]->type == SOCKET_ADDRESS_TYPE_UNIX;
3744 sioc = qio_channel_socket_new();
3745 qio_channel_set_name(QIO_CHANNEL(sioc), "vnc-reverse");
3746 if (qio_channel_socket_connect_sync(sioc, saddr[0], errp) < 0) {
3747 return -1;
3748 }
3749 vnc_connect(vd, sioc, false, false);
3750 object_unref(OBJECT(sioc));
3751 return 0;
3752 }
3753
3754
3755 static int vnc_display_listen(VncDisplay *vd,
3756 SocketAddress **saddr,
3757 size_t nsaddr,
3758 SocketAddress **wsaddr,
3759 size_t nwsaddr,
3760 Error **errp)
3761 {
3762 size_t i;
3763
3764 if (nsaddr) {
3765 vd->listener = qio_net_listener_new();
3766 qio_net_listener_set_name(vd->listener, "vnc-listen");
3767 for (i = 0; i < nsaddr; i++) {
3768 if (qio_net_listener_open_sync(vd->listener,
3769 saddr[i],
3770 errp) < 0) {
3771 return -1;
3772 }
3773 }
3774
3775 qio_net_listener_set_client_func(vd->listener,
3776 vnc_listen_io, vd, NULL);
3777 }
3778
3779 if (nwsaddr) {
3780 vd->wslistener = qio_net_listener_new();
3781 qio_net_listener_set_name(vd->wslistener, "vnc-ws-listen");
3782 for (i = 0; i < nwsaddr; i++) {
3783 if (qio_net_listener_open_sync(vd->wslistener,
3784 wsaddr[i],
3785 errp) < 0) {
3786 return -1;
3787 }
3788 }
3789
3790 qio_net_listener_set_client_func(vd->wslistener,
3791 vnc_listen_io, vd, NULL);
3792 }
3793
3794 return 0;
3795 }
3796
3797
3798 void vnc_display_open(const char *id, Error **errp)
3799 {
3800 VncDisplay *vd = vnc_display_find(id);
3801 QemuOpts *opts = qemu_opts_find(&qemu_vnc_opts, id);
3802 SocketAddress **saddr = NULL, **wsaddr = NULL;
3803 size_t nsaddr, nwsaddr;
3804 const char *share, *device_id;
3805 QemuConsole *con;
3806 bool password = false;
3807 bool reverse = false;
3808 const char *credid;
3809 bool sasl = false;
3810 int acl = 0;
3811 const char *tlsauthz;
3812 const char *saslauthz;
3813 int lock_key_sync = 1;
3814 int key_delay_ms;
3815
3816 if (!vd) {
3817 error_setg(errp, "VNC display not active");
3818 return;
3819 }
3820 vnc_display_close(vd);
3821
3822 if (!opts) {
3823 return;
3824 }
3825
3826 reverse = qemu_opt_get_bool(opts, "reverse", false);
3827 if (vnc_display_get_addresses(opts, reverse, &saddr, &nsaddr,
3828 &wsaddr, &nwsaddr, errp) < 0) {
3829 goto fail;
3830 }
3831
3832 password = qemu_opt_get_bool(opts, "password", false);
3833 if (password) {
3834 if (fips_get_state()) {
3835 error_setg(errp,
3836 "VNC password auth disabled due to FIPS mode, "
3837 "consider using the VeNCrypt or SASL authentication "
3838 "methods as an alternative");
3839 goto fail;
3840 }
3841 if (!qcrypto_cipher_supports(
3842 QCRYPTO_CIPHER_ALG_DES_RFB, QCRYPTO_CIPHER_MODE_ECB)) {
3843 error_setg(errp,
3844 "Cipher backend does not support DES RFB algorithm");
3845 goto fail;
3846 }
3847 }
3848
3849 lock_key_sync = qemu_opt_get_bool(opts, "lock-key-sync", true);
3850 key_delay_ms = qemu_opt_get_number(opts, "key-delay-ms", 10);
3851 sasl = qemu_opt_get_bool(opts, "sasl", false);
3852 #ifndef CONFIG_VNC_SASL
3853 if (sasl) {
3854 error_setg(errp, "VNC SASL auth requires cyrus-sasl support");
3855 goto fail;
3856 }
3857 #endif /* CONFIG_VNC_SASL */
3858 credid = qemu_opt_get(opts, "tls-creds");
3859 if (credid) {
3860 Object *creds;
3861 creds = object_resolve_path_component(
3862 object_get_objects_root(), credid);
3863 if (!creds) {
3864 error_setg(errp, "No TLS credentials with id '%s'",
3865 credid);
3866 goto fail;
3867 }
3868 vd->tlscreds = (QCryptoTLSCreds *)
3869 object_dynamic_cast(creds,
3870 TYPE_QCRYPTO_TLS_CREDS);
3871 if (!vd->tlscreds) {
3872 error_setg(errp, "Object with id '%s' is not TLS credentials",
3873 credid);
3874 goto fail;
3875 }
3876 object_ref(OBJECT(vd->tlscreds));
3877
3878 if (vd->tlscreds->endpoint != QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
3879 error_setg(errp,
3880 "Expecting TLS credentials with a server endpoint");
3881 goto fail;
3882 }
3883 }
3884 if (qemu_opt_get(opts, "acl")) {
3885 error_report("The 'acl' option to -vnc is deprecated. "
3886 "Please use the 'tls-authz' and 'sasl-authz' "
3887 "options instead");
3888 }
3889 acl = qemu_opt_get_bool(opts, "acl", false);
3890 tlsauthz = qemu_opt_get(opts, "tls-authz");
3891 if (acl && tlsauthz) {
3892 error_setg(errp, "'acl' option is mutually exclusive with the "
3893 "'tls-authz' option");
3894 goto fail;
3895 }
3896 if (tlsauthz && !vd->tlscreds) {
3897 error_setg(errp, "'tls-authz' provided but TLS is not enabled");
3898 goto fail;
3899 }
3900
3901 saslauthz = qemu_opt_get(opts, "sasl-authz");
3902 if (acl && saslauthz) {
3903 error_setg(errp, "'acl' option is mutually exclusive with the "
3904 "'sasl-authz' option");
3905 goto fail;
3906 }
3907 if (saslauthz && !sasl) {
3908 error_setg(errp, "'sasl-authz' provided but SASL auth is not enabled");
3909 goto fail;
3910 }
3911
3912 share = qemu_opt_get(opts, "share");
3913 if (share) {
3914 if (strcmp(share, "ignore") == 0) {
3915 vd->share_policy = VNC_SHARE_POLICY_IGNORE;
3916 } else if (strcmp(share, "allow-exclusive") == 0) {
3917 vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
3918 } else if (strcmp(share, "force-shared") == 0) {
3919 vd->share_policy = VNC_SHARE_POLICY_FORCE_SHARED;
3920 } else {
3921 error_setg(errp, "unknown vnc share= option");
3922 goto fail;
3923 }
3924 } else {
3925 vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
3926 }
3927 vd->connections_limit = qemu_opt_get_number(opts, "connections", 32);
3928
3929 #ifdef CONFIG_VNC_JPEG
3930 vd->lossy = qemu_opt_get_bool(opts, "lossy", false);
3931 #endif
3932 vd->non_adaptive = qemu_opt_get_bool(opts, "non-adaptive", false);
3933 /* adaptive updates are only used with tight encoding and
3934 * if lossy updates are enabled so we can disable all the
3935 * calculations otherwise */
3936 if (!vd->lossy) {
3937 vd->non_adaptive = true;
3938 }
3939
3940 if (tlsauthz) {
3941 vd->tlsauthzid = g_strdup(tlsauthz);
3942 } else if (acl) {
3943 if (strcmp(vd->id, "default") == 0) {
3944 vd->tlsauthzid = g_strdup("vnc.x509dname");
3945 } else {
3946 vd->tlsauthzid = g_strdup_printf("vnc.%s.x509dname", vd->id);
3947 }
3948 vd->tlsauthz = QAUTHZ(qauthz_list_new(vd->tlsauthzid,
3949 QAUTHZ_LIST_POLICY_DENY,
3950 &error_abort));
3951 }
3952 #ifdef CONFIG_VNC_SASL
3953 if (sasl) {
3954 if (saslauthz) {
3955 vd->sasl.authzid = g_strdup(saslauthz);
3956 } else if (acl) {
3957 if (strcmp(vd->id, "default") == 0) {
3958 vd->sasl.authzid = g_strdup("vnc.username");
3959 } else {
3960 vd->sasl.authzid = g_strdup_printf("vnc.%s.username", vd->id);
3961 }
3962 vd->sasl.authz = QAUTHZ(qauthz_list_new(vd->sasl.authzid,
3963 QAUTHZ_LIST_POLICY_DENY,
3964 &error_abort));
3965 }
3966 }
3967 #endif
3968
3969 if (vnc_display_setup_auth(&vd->auth, &vd->subauth,
3970 vd->tlscreds, password,
3971 sasl, false, errp) < 0) {
3972 goto fail;
3973 }
3974 trace_vnc_auth_init(vd, 0, vd->auth, vd->subauth);
3975
3976 if (vnc_display_setup_auth(&vd->ws_auth, &vd->ws_subauth,
3977 vd->tlscreds, password,
3978 sasl, true, errp) < 0) {
3979 goto fail;
3980 }
3981 trace_vnc_auth_init(vd, 1, vd->ws_auth, vd->ws_subauth);
3982
3983 #ifdef CONFIG_VNC_SASL
3984 if (sasl) {
3985 int saslErr = sasl_server_init(NULL, "qemu");
3986
3987 if (saslErr != SASL_OK) {
3988 error_setg(errp, "Failed to initialize SASL auth: %s",
3989 sasl_errstring(saslErr, NULL, NULL));
3990 goto fail;
3991 }
3992 }
3993 #endif
3994 vd->lock_key_sync = lock_key_sync;
3995 if (lock_key_sync) {
3996 vd->led = qemu_add_led_event_handler(kbd_leds, vd);
3997 }
3998 vd->ledstate = 0;
3999
4000 device_id = qemu_opt_get(opts, "display");
4001 if (device_id) {
4002 int head = qemu_opt_get_number(opts, "head", 0);
4003 Error *err = NULL;
4004
4005 con = qemu_console_lookup_by_device_name(device_id, head, &err);
4006 if (err) {
4007 error_propagate(errp, err);
4008 goto fail;
4009 }
4010 } else {
4011 con = NULL;
4012 }
4013
4014 if (con != vd->dcl.con) {
4015 qkbd_state_free(vd->kbd);
4016 unregister_displaychangelistener(&vd->dcl);
4017 vd->dcl.con = con;
4018 register_displaychangelistener(&vd->dcl);
4019 vd->kbd = qkbd_state_init(vd->dcl.con);
4020 }
4021 qkbd_state_set_delay(vd->kbd, key_delay_ms);
4022
4023 if (saddr == NULL) {
4024 goto cleanup;
4025 }
4026
4027 if (reverse) {
4028 if (vnc_display_connect(vd, saddr, nsaddr, wsaddr, nwsaddr, errp) < 0) {
4029 goto fail;
4030 }
4031 } else {
4032 if (vnc_display_listen(vd, saddr, nsaddr, wsaddr, nwsaddr, errp) < 0) {
4033 goto fail;
4034 }
4035 }
4036
4037 if (qemu_opt_get(opts, "to")) {
4038 vnc_display_print_local_addr(vd);
4039 }
4040
4041 cleanup:
4042 vnc_free_addresses(&saddr, &nsaddr);
4043 vnc_free_addresses(&wsaddr, &nwsaddr);
4044 return;
4045
4046 fail:
4047 vnc_display_close(vd);
4048 goto cleanup;
4049 }
4050
4051 void vnc_display_add_client(const char *id, int csock, bool skipauth)
4052 {
4053 VncDisplay *vd = vnc_display_find(id);
4054 QIOChannelSocket *sioc;
4055
4056 if (!vd) {
4057 return;
4058 }
4059
4060 sioc = qio_channel_socket_new_fd(csock, NULL);
4061 if (sioc) {
4062 qio_channel_set_name(QIO_CHANNEL(sioc), "vnc-server");
4063 vnc_connect(vd, sioc, skipauth, false);
4064 object_unref(OBJECT(sioc));
4065 }
4066 }
4067
4068 static void vnc_auto_assign_id(QemuOptsList *olist, QemuOpts *opts)
4069 {
4070 int i = 2;
4071 char *id;
4072
4073 id = g_strdup("default");
4074 while (qemu_opts_find(olist, id)) {
4075 g_free(id);
4076 id = g_strdup_printf("vnc%d", i++);
4077 }
4078 qemu_opts_set_id(opts, id);
4079 }
4080
4081 QemuOpts *vnc_parse(const char *str, Error **errp)
4082 {
4083 QemuOptsList *olist = qemu_find_opts("vnc");
4084 QemuOpts *opts = qemu_opts_parse(olist, str, true, errp);
4085 const char *id;
4086
4087 if (!opts) {
4088 return NULL;
4089 }
4090
4091 id = qemu_opts_id(opts);
4092 if (!id) {
4093 /* auto-assign id if not present */
4094 vnc_auto_assign_id(olist, opts);
4095 }
4096 return opts;
4097 }
4098
4099 int vnc_init_func(void *opaque, QemuOpts *opts, Error **errp)
4100 {
4101 Error *local_err = NULL;
4102 char *id = (char *)qemu_opts_id(opts);
4103
4104 assert(id);
4105 vnc_display_init(id, &local_err);
4106 if (local_err) {
4107 error_propagate(errp, local_err);
4108 return -1;
4109 }
4110 vnc_display_open(id, &local_err);
4111 if (local_err != NULL) {
4112 error_propagate(errp, local_err);
4113 return -1;
4114 }
4115 return 0;
4116 }
4117
4118 static void vnc_register_config(void)
4119 {
4120 qemu_add_opts(&qemu_vnc_opts);
4121 }
4122 opts_init(vnc_register_config);
AR7 emulation for QEMU