?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
replace qemu_kvm_cpu_env
[qemu-kvm/fedora.git] / vnc.c
blobde0ff872d42baf135be06cdc601e700c1b2b94b4
1 /*
2 * QEMU VNC display driver
3 *
4 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5 * Copyright (C) 2006 Fabrice Bellard
6 * Copyright (C) 2009 Red Hat, Inc
7 *
8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to deal
10 * in the Software without restriction, including without limitation the rights
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12 * copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
14 *
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
17 *
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24 * THE SOFTWARE.
25 */
26
27 #include "vnc.h"
28 #include "sysemu.h"
29 #include "qemu_socket.h"
30 #include "qemu-timer.h"
31 #include "acl.h"
32
33 #define VNC_REFRESH_INTERVAL (1000 / 30)
34
35 #include "vnc_keysym.h"
36 #include "d3des.h"
37
38 #define count_bits(c, v) { \
39 for (c = 0; v; v >>= 1) \
40 { \
41 c += v & 1; \
42 } \
43 }
44
45
46 static VncDisplay *vnc_display; /* needed for info vnc */
47 static DisplayChangeListener *dcl;
48
49 static char *addr_to_string(const char *format,
50 struct sockaddr_storage *sa,
51 socklen_t salen) {
52 char *addr;
53 char host[NI_MAXHOST];
54 char serv[NI_MAXSERV];
55 int err;
56 size_t addrlen;
57
58 if ((err = getnameinfo((struct sockaddr *)sa, salen,
59 host, sizeof(host),
60 serv, sizeof(serv),
61 NI_NUMERICHOST | NI_NUMERICSERV)) != 0) {
62 VNC_DEBUG("Cannot resolve address %d: %s\n",
63 err, gai_strerror(err));
64 return NULL;
65 }
66
67 /* Enough for the existing format + the 2 vars we're
68 * substituting in. */
69 addrlen = strlen(format) + strlen(host) + strlen(serv);
70 addr = qemu_malloc(addrlen + 1);
71 snprintf(addr, addrlen, format, host, serv);
72 addr[addrlen] = '\0';
73
74 return addr;
75 }
76
77
78 char *vnc_socket_local_addr(const char *format, int fd) {
79 struct sockaddr_storage sa;
80 socklen_t salen;
81
82 salen = sizeof(sa);
83 if (getsockname(fd, (struct sockaddr*)&sa, &salen) < 0)
84 return NULL;
85
86 return addr_to_string(format, &sa, salen);
87 }
88
89 char *vnc_socket_remote_addr(const char *format, int fd) {
90 struct sockaddr_storage sa;
91 socklen_t salen;
92
93 salen = sizeof(sa);
94 if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0)
95 return NULL;
96
97 return addr_to_string(format, &sa, salen);
98 }
99
100 static const char *vnc_auth_name(VncDisplay *vd) {
101 switch (vd->auth) {
102 case VNC_AUTH_INVALID:
103 return "invalid";
104 case VNC_AUTH_NONE:
105 return "none";
106 case VNC_AUTH_VNC:
107 return "vnc";
108 case VNC_AUTH_RA2:
109 return "ra2";
110 case VNC_AUTH_RA2NE:
111 return "ra2ne";
112 case VNC_AUTH_TIGHT:
113 return "tight";
114 case VNC_AUTH_ULTRA:
115 return "ultra";
116 case VNC_AUTH_TLS:
117 return "tls";
118 case VNC_AUTH_VENCRYPT:
119 #ifdef CONFIG_VNC_TLS
120 switch (vd->subauth) {
121 case VNC_AUTH_VENCRYPT_PLAIN:
122 return "vencrypt+plain";
123 case VNC_AUTH_VENCRYPT_TLSNONE:
124 return "vencrypt+tls+none";
125 case VNC_AUTH_VENCRYPT_TLSVNC:
126 return "vencrypt+tls+vnc";
127 case VNC_AUTH_VENCRYPT_TLSPLAIN:
128 return "vencrypt+tls+plain";
129 case VNC_AUTH_VENCRYPT_X509NONE:
130 return "vencrypt+x509+none";
131 case VNC_AUTH_VENCRYPT_X509VNC:
132 return "vencrypt+x509+vnc";
133 case VNC_AUTH_VENCRYPT_X509PLAIN:
134 return "vencrypt+x509+plain";
135 case VNC_AUTH_VENCRYPT_TLSSASL:
136 return "vencrypt+tls+sasl";
137 case VNC_AUTH_VENCRYPT_X509SASL:
138 return "vencrypt+x509+sasl";
139 default:
140 return "vencrypt";
141 }
142 #else
143 return "vencrypt";
144 #endif
145 case VNC_AUTH_SASL:
146 return "sasl";
147 }
148 return "unknown";
149 }
150
151 static void do_info_vnc_client(Monitor *mon, VncState *client)
152 {
153 char *clientAddr =
154 vnc_socket_remote_addr(" address: %s:%s\n",
155 client->csock);
156 if (!clientAddr)
157 return;
158
159 monitor_printf(mon, "Client:\n");
160 monitor_printf(mon, "%s", clientAddr);
161 free(clientAddr);
162
163 #ifdef CONFIG_VNC_TLS
164 if (client->tls.session &&
165 client->tls.dname)
166 monitor_printf(mon, " x509 dname: %s\n", client->tls.dname);
167 else
168 monitor_printf(mon, " x509 dname: none\n");
169 #endif
170 #ifdef CONFIG_VNC_SASL
171 if (client->sasl.conn &&
172 client->sasl.username)
173 monitor_printf(mon, " username: %s\n", client->sasl.username);
174 else
175 monitor_printf(mon, " username: none\n");
176 #endif
177 }
178
179 void do_info_vnc(Monitor *mon)
180 {
181 if (vnc_display == NULL || vnc_display->display == NULL) {
182 monitor_printf(mon, "Server: disabled\n");
183 } else {
184 char *serverAddr = vnc_socket_local_addr(" address: %s:%s\n",
185 vnc_display->lsock);
186
187 if (!serverAddr)
188 return;
189
190 monitor_printf(mon, "Server:\n");
191 monitor_printf(mon, "%s", serverAddr);
192 free(serverAddr);
193 monitor_printf(mon, " auth: %s\n", vnc_auth_name(vnc_display));
194
195 if (vnc_display->clients) {
196 VncState *client = vnc_display->clients;
197 while (client) {
198 do_info_vnc_client(mon, client);
199 client = client->next;
200 }
201 } else {
202 monitor_printf(mon, "Client: none\n");
203 }
204 }
205 }
206
207 static inline uint32_t vnc_has_feature(VncState *vs, int feature) {
208 return (vs->features & (1 << feature));
209 }
210
211 /* TODO
212 1) Get the queue working for IO.
213 2) there is some weirdness when using the -S option (the screen is grey
214 and not totally invalidated
215 3) resolutions > 1024
216 */
217
218 static void vnc_update_client(void *opaque);
219 static void vnc_disconnect_start(VncState *vs);
220 static void vnc_disconnect_finish(VncState *vs);
221
222 static void vnc_colordepth(VncState *vs);
223
224 static inline void vnc_set_bit(uint32_t *d, int k)
225 {
226 d[k >> 5] |= 1 << (k & 0x1f);
227 }
228
229 static inline void vnc_clear_bit(uint32_t *d, int k)
230 {
231 d[k >> 5] &= ~(1 << (k & 0x1f));
232 }
233
234 static inline void vnc_set_bits(uint32_t *d, int n, int nb_words)
235 {
236 int j;
237
238 j = 0;
239 while (n >= 32) {
240 d[j++] = -1;
241 n -= 32;
242 }
243 if (n > 0)
244 d[j++] = (1 << n) - 1;
245 while (j < nb_words)
246 d[j++] = 0;
247 }
248
249 static inline int vnc_get_bit(const uint32_t *d, int k)
250 {
251 return (d[k >> 5] >> (k & 0x1f)) & 1;
252 }
253
254 static inline int vnc_and_bits(const uint32_t *d1, const uint32_t *d2,
255 int nb_words)
256 {
257 int i;
258 for(i = 0; i < nb_words; i++) {
259 if ((d1[i] & d2[i]) != 0)
260 return 1;
261 }
262 return 0;
263 }
264
265 static void vnc_update(VncState *vs, int x, int y, int w, int h)
266 {
267 struct VncSurface *s = &vs->guest;
268 int i;
269
270 h += y;
271
272 /* round x down to ensure the loop only spans one 16-pixel block per,
273 iteration. otherwise, if (x % 16) != 0, the last iteration may span
274 two 16-pixel blocks but we only mark the first as dirty
275 */
276 w += (x % 16);
277 x -= (x % 16);
278
279 x = MIN(x, s->ds->width);
280 y = MIN(y, s->ds->height);
281 w = MIN(x + w, s->ds->width) - x;
282 h = MIN(h, s->ds->height);
283
284 for (; y < h; y++)
285 for (i = 0; i < w; i += 16)
286 vnc_set_bit(s->dirty[y], (x + i) / 16);
287 }
288
289 static void vnc_dpy_update(DisplayState *ds, int x, int y, int w, int h)
290 {
291 VncDisplay *vd = ds->opaque;
292 VncState *vs = vd->clients;
293 while (vs != NULL) {
294 vnc_update(vs, x, y, w, h);
295 vs = vs->next;
296 }
297 }
298
299 static void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
300 int32_t encoding)
301 {
302 vnc_write_u16(vs, x);
303 vnc_write_u16(vs, y);
304 vnc_write_u16(vs, w);
305 vnc_write_u16(vs, h);
306
307 vnc_write_s32(vs, encoding);
308 }
309
310 void buffer_reserve(Buffer *buffer, size_t len)
311 {
312 if ((buffer->capacity - buffer->offset) < len) {
313 buffer->capacity += (len + 1024);
314 buffer->buffer = qemu_realloc(buffer->buffer, buffer->capacity);
315 if (buffer->buffer == NULL) {
316 fprintf(stderr, "vnc: out of memory\n");
317 exit(1);
318 }
319 }
320 }
321
322 int buffer_empty(Buffer *buffer)
323 {
324 return buffer->offset == 0;
325 }
326
327 uint8_t *buffer_end(Buffer *buffer)
328 {
329 return buffer->buffer + buffer->offset;
330 }
331
332 void buffer_reset(Buffer *buffer)
333 {
334 buffer->offset = 0;
335 }
336
337 void buffer_append(Buffer *buffer, const void *data, size_t len)
338 {
339 memcpy(buffer->buffer + buffer->offset, data, len);
340 buffer->offset += len;
341 }
342
343 static void vnc_resize(VncState *vs)
344 {
345 DisplayState *ds = vs->ds;
346 int size_changed;
347
348 /* guest surface */
349 if (!vs->guest.ds)
350 vs->guest.ds = qemu_mallocz(sizeof(*vs->guest.ds));
351 if (ds_get_bytes_per_pixel(ds) != vs->guest.ds->pf.bytes_per_pixel)
352 console_color_init(ds);
353 vnc_colordepth(vs);
354 size_changed = ds_get_width(ds) != vs->guest.ds->width ||
355 ds_get_height(ds) != vs->guest.ds->height;
356 *(vs->guest.ds) = *(ds->surface);
357 if (size_changed) {
358 if (vs->csock != -1 && vnc_has_feature(vs, VNC_FEATURE_RESIZE)) {
359 vnc_write_u8(vs, 0); /* msg id */
360 vnc_write_u8(vs, 0);
361 vnc_write_u16(vs, 1); /* number of rects */
362 vnc_framebuffer_update(vs, 0, 0, ds_get_width(ds), ds_get_height(ds),
363 VNC_ENCODING_DESKTOPRESIZE);
364 vnc_flush(vs);
365 }
366 }
367 memset(vs->guest.dirty, 0xFF, sizeof(vs->guest.dirty));
368
369 /* server surface */
370 if (!vs->server.ds)
371 vs->server.ds = qemu_mallocz(sizeof(*vs->server.ds));
372 if (vs->server.ds->data)
373 qemu_free(vs->server.ds->data);
374 *(vs->server.ds) = *(ds->surface);
375 vs->server.ds->data = qemu_mallocz(vs->server.ds->linesize *
376 vs->server.ds->height);
377 memset(vs->server.dirty, 0xFF, sizeof(vs->guest.dirty));
378 }
379
380 static void vnc_dpy_resize(DisplayState *ds)
381 {
382 VncDisplay *vd = ds->opaque;
383 VncState *vs = vd->clients;
384 while (vs != NULL) {
385 vnc_resize(vs);
386 vs = vs->next;
387 }
388 }
389
390 /* fastest code */
391 static void vnc_write_pixels_copy(VncState *vs, void *pixels, int size)
392 {
393 vnc_write(vs, pixels, size);
394 }
395
396 /* slowest but generic code. */
397 static void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
398 {
399 uint8_t r, g, b;
400
401 r = ((((v & vs->server.ds->pf.rmask) >> vs->server.ds->pf.rshift) << vs->clientds.pf.rbits) >>
402 vs->server.ds->pf.rbits);
403 g = ((((v & vs->server.ds->pf.gmask) >> vs->server.ds->pf.gshift) << vs->clientds.pf.gbits) >>
404 vs->server.ds->pf.gbits);
405 b = ((((v & vs->server.ds->pf.bmask) >> vs->server.ds->pf.bshift) << vs->clientds.pf.bbits) >>
406 vs->server.ds->pf.bbits);
407 v = (r << vs->clientds.pf.rshift) |
408 (g << vs->clientds.pf.gshift) |
409 (b << vs->clientds.pf.bshift);
410 switch(vs->clientds.pf.bytes_per_pixel) {
411 case 1:
412 buf[0] = v;
413 break;
414 case 2:
415 if (vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) {
416 buf[0] = v >> 8;
417 buf[1] = v;
418 } else {
419 buf[1] = v >> 8;
420 buf[0] = v;
421 }
422 break;
423 default:
424 case 4:
425 if (vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) {
426 buf[0] = v >> 24;
427 buf[1] = v >> 16;
428 buf[2] = v >> 8;
429 buf[3] = v;
430 } else {
431 buf[3] = v >> 24;
432 buf[2] = v >> 16;
433 buf[1] = v >> 8;
434 buf[0] = v;
435 }
436 break;
437 }
438 }
439
440 static void vnc_write_pixels_generic(VncState *vs, void *pixels1, int size)
441 {
442 uint8_t buf[4];
443
444 if (vs->server.ds->pf.bytes_per_pixel == 4) {
445 uint32_t *pixels = pixels1;
446 int n, i;
447 n = size >> 2;
448 for(i = 0; i < n; i++) {
449 vnc_convert_pixel(vs, buf, pixels[i]);
450 vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
451 }
452 } else if (vs->server.ds->pf.bytes_per_pixel == 2) {
453 uint16_t *pixels = pixels1;
454 int n, i;
455 n = size >> 1;
456 for(i = 0; i < n; i++) {
457 vnc_convert_pixel(vs, buf, pixels[i]);
458 vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
459 }
460 } else if (vs->server.ds->pf.bytes_per_pixel == 1) {
461 uint8_t *pixels = pixels1;
462 int n, i;
463 n = size;
464 for(i = 0; i < n; i++) {
465 vnc_convert_pixel(vs, buf, pixels[i]);
466 vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
467 }
468 } else {
469 fprintf(stderr, "vnc_write_pixels_generic: VncState color depth not supported\n");
470 }
471 }
472
473 static void send_framebuffer_update_raw(VncState *vs, int x, int y, int w, int h)
474 {
475 int i;
476 uint8_t *row;
477
478 row = vs->server.ds->data + y * ds_get_linesize(vs->ds) + x * ds_get_bytes_per_pixel(vs->ds);
479 for (i = 0; i < h; i++) {
480 vs->write_pixels(vs, row, w * ds_get_bytes_per_pixel(vs->ds));
481 row += ds_get_linesize(vs->ds);
482 }
483 }
484
485 static void hextile_enc_cord(uint8_t *ptr, int x, int y, int w, int h)
486 {
487 ptr[0] = ((x & 0x0F) << 4) | (y & 0x0F);
488 ptr[1] = (((w - 1) & 0x0F) << 4) | ((h - 1) & 0x0F);
489 }
490
491 #define BPP 8
492 #include "vnchextile.h"
493 #undef BPP
494
495 #define BPP 16
496 #include "vnchextile.h"
497 #undef BPP
498
499 #define BPP 32
500 #include "vnchextile.h"
501 #undef BPP
502
503 #define GENERIC
504 #define BPP 8
505 #include "vnchextile.h"
506 #undef BPP
507 #undef GENERIC
508
509 #define GENERIC
510 #define BPP 16
511 #include "vnchextile.h"
512 #undef BPP
513 #undef GENERIC
514
515 #define GENERIC
516 #define BPP 32
517 #include "vnchextile.h"
518 #undef BPP
519 #undef GENERIC
520
521 static void send_framebuffer_update_hextile(VncState *vs, int x, int y, int w, int h)
522 {
523 int i, j;
524 int has_fg, has_bg;
525 uint8_t *last_fg, *last_bg;
526
527 last_fg = (uint8_t *) qemu_malloc(vs->server.ds->pf.bytes_per_pixel);
528 last_bg = (uint8_t *) qemu_malloc(vs->server.ds->pf.bytes_per_pixel);
529 has_fg = has_bg = 0;
530 for (j = y; j < (y + h); j += 16) {
531 for (i = x; i < (x + w); i += 16) {
532 vs->send_hextile_tile(vs, i, j,
533 MIN(16, x + w - i), MIN(16, y + h - j),
534 last_bg, last_fg, &has_bg, &has_fg);
535 }
536 }
537 free(last_fg);
538 free(last_bg);
539
540 }
541
542 static void vnc_zlib_init(VncState *vs)
543 {
544 int i;
545 for (i=0; i<(sizeof(vs->zlib_stream) / sizeof(z_stream)); i++)
546 vs->zlib_stream[i].opaque = NULL;
547 }
548
549 static void vnc_zlib_start(VncState *vs)
550 {
551 buffer_reset(&vs->zlib);
552
553 // make the output buffer be the zlib buffer, so we can compress it later
554 vs->zlib_tmp = vs->output;
555 vs->output = vs->zlib;
556 }
557
558 static int vnc_zlib_stop(VncState *vs, int stream_id)
559 {
560 z_streamp zstream = &vs->zlib_stream[stream_id];
561 int previous_out;
562
563 // switch back to normal output/zlib buffers
564 vs->zlib = vs->output;
565 vs->output = vs->zlib_tmp;
566
567 // compress the zlib buffer
568
569 // initialize the stream
570 // XXX need one stream per session
571 if (zstream->opaque != vs) {
572 int err;
573
574 VNC_DEBUG("VNC: initializing zlib stream %d\n", stream_id);
575 VNC_DEBUG("VNC: opaque = %p | vs = %p\n", zstream->opaque, vs);
576 zstream->zalloc = Z_NULL;
577 zstream->zfree = Z_NULL;
578
579 err = deflateInit2(zstream, vs->tight_compression, Z_DEFLATED, MAX_WBITS,
580 MAX_MEM_LEVEL, Z_DEFAULT_STRATEGY);
581
582 if (err != Z_OK) {
583 fprintf(stderr, "VNC: error initializing zlib\n");
584 return -1;
585 }
586
587 zstream->opaque = vs;
588 }
589
590 // XXX what to do if tight_compression changed in between?
591
592 // reserve memory in output buffer
593 buffer_reserve(&vs->output, vs->zlib.offset + 64);
594
595 // set pointers
596 zstream->next_in = vs->zlib.buffer;
597 zstream->avail_in = vs->zlib.offset;
598 zstream->next_out = vs->output.buffer + vs->output.offset;
599 zstream->avail_out = vs->output.capacity - vs->output.offset;
600 zstream->data_type = Z_BINARY;
601 previous_out = zstream->total_out;
602
603 // start encoding
604 if (deflate(zstream, Z_SYNC_FLUSH) != Z_OK) {
605 fprintf(stderr, "VNC: error during zlib compression\n");
606 return -1;
607 }
608
609 vs->output.offset = vs->output.capacity - zstream->avail_out;
610 return zstream->total_out - previous_out;
611 }
612
613 static void send_framebuffer_update_zlib(VncState *vs, int x, int y, int w, int h)
614 {
615 int old_offset, new_offset, bytes_written;
616
617 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_ZLIB);
618
619 // remember where we put in the follow-up size
620 old_offset = vs->output.offset;
621 vnc_write_s32(vs, 0);
622
623 // compress the stream
624 vnc_zlib_start(vs);
625 send_framebuffer_update_raw(vs, x, y, w, h);
626 bytes_written = vnc_zlib_stop(vs, 0);
627
628 if (bytes_written == -1)
629 return;
630
631 // hack in the size
632 new_offset = vs->output.offset;
633 vs->output.offset = old_offset;
634 vnc_write_u32(vs, bytes_written);
635 vs->output.offset = new_offset;
636 }
637
638 static void send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
639 {
640 switch(vs->vnc_encoding) {
641 case VNC_ENCODING_ZLIB:
642 send_framebuffer_update_zlib(vs, x, y, w, h);
643 break;
644 case VNC_ENCODING_HEXTILE:
645 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE);
646 send_framebuffer_update_hextile(vs, x, y, w, h);
647 break;
648 default:
649 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW);
650 send_framebuffer_update_raw(vs, x, y, w, h);
651 break;
652 }
653 }
654
655 static void vnc_copy(VncState *vs, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
656 {
657 vnc_write_u8(vs, 0); /* msg id */
658 vnc_write_u8(vs, 0);
659 vnc_write_u16(vs, 1); /* number of rects */
660 vnc_framebuffer_update(vs, dst_x, dst_y, w, h, VNC_ENCODING_COPYRECT);
661 vnc_write_u16(vs, src_x);
662 vnc_write_u16(vs, src_y);
663 vnc_flush(vs);
664 }
665
666 static void vnc_dpy_copy(DisplayState *ds, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
667 {
668 VncDisplay *vd = ds->opaque;
669 VncState *vs, *vn;
670
671 for (vs = vd->clients; vs != NULL; vs = vn) {
672 vn = vs->next;
673 if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
674 vs->force_update = 1;
675 vnc_update_client(vs);
676 /* vs might be free()ed here */
677 }
678 }
679
680 for (vs = vd->clients; vs != NULL; vs = vs->next) {
681 if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT))
682 vnc_copy(vs, src_x, src_y, dst_x, dst_y, w, h);
683 else /* TODO */
684 vnc_update(vs, dst_x, dst_y, w, h);
685 }
686 }
687
688 static int find_and_clear_dirty_height(struct VncSurface *s,
689 int y, int last_x, int x)
690 {
691 int h;
692
693 for (h = 1; h < (s->ds->height - y); h++) {
694 int tmp_x;
695 if (!vnc_get_bit(s->dirty[y + h], last_x))
696 break;
697 for (tmp_x = last_x; tmp_x < x; tmp_x++)
698 vnc_clear_bit(s->dirty[y + h], tmp_x);
699 }
700
701 return h;
702 }
703
704 static void vnc_update_client(void *opaque)
705 {
706 VncState *vs = opaque;
707 if (vs->need_update && vs->csock != -1) {
708 int y;
709 uint8_t *guest_row;
710 uint8_t *server_row;
711 int cmp_bytes;
712 uint32_t width_mask[VNC_DIRTY_WORDS];
713 int n_rectangles;
714 int saved_offset;
715 int has_dirty = 0;
716
717 if (vs->output.offset && !vs->audio_cap && !vs->force_update) {
718 /* kernel send buffers are full -> drop frames to throttle */
719 qemu_mod_timer(vs->timer, qemu_get_clock(rt_clock) + VNC_REFRESH_INTERVAL);
720 return;
721 }
722
723 vga_hw_update();
724
725 /*
726 * Walk through the guest dirty map.
727 * Check and copy modified bits from guest to server surface.
728 * Update server dirty map.
729 */
730 vnc_set_bits(width_mask, (ds_get_width(vs->ds) / 16), VNC_DIRTY_WORDS);
731 cmp_bytes = 16 * ds_get_bytes_per_pixel(vs->ds);
732 guest_row = vs->guest.ds->data;
733 server_row = vs->server.ds->data;
734 for (y = 0; y < vs->guest.ds->height; y++) {
735 if (vnc_and_bits(vs->guest.dirty[y], width_mask, VNC_DIRTY_WORDS)) {
736 int x;
737 uint8_t *guest_ptr;
738 uint8_t *server_ptr;
739
740 guest_ptr = guest_row;
741 server_ptr = server_row;
742
743 for (x = 0; x < vs->guest.ds->width;
744 x += 16, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) {
745 if (!vnc_get_bit(vs->guest.dirty[y], (x / 16)))
746 continue;
747 vnc_clear_bit(vs->guest.dirty[y], (x / 16));
748 if (memcmp(server_ptr, guest_ptr, cmp_bytes) == 0)
749 continue;
750 memcpy(server_ptr, guest_ptr, cmp_bytes);
751 vnc_set_bit(vs->server.dirty[y], (x / 16));
752 has_dirty++;
753 }
754 }
755 guest_row += ds_get_linesize(vs->ds);
756 server_row += ds_get_linesize(vs->ds);
757 }
758
759 if (!has_dirty && !vs->audio_cap && !vs->force_update) {
760 qemu_mod_timer(vs->timer, qemu_get_clock(rt_clock) + VNC_REFRESH_INTERVAL);
761 return;
762 }
763
764 /*
765 * Send screen updates to the vnc client using the server
766 * surface and server dirty map. guest surface updates
767 * happening in parallel don't disturb us, the next pass will
768 * send them to the client.
769 */
770 n_rectangles = 0;
771 vnc_write_u8(vs, 0); /* msg id */
772 vnc_write_u8(vs, 0);
773 saved_offset = vs->output.offset;
774 vnc_write_u16(vs, 0);
775
776 for (y = 0; y < vs->server.ds->height; y++) {
777 int x;
778 int last_x = -1;
779 for (x = 0; x < vs->server.ds->width / 16; x++) {
780 if (vnc_get_bit(vs->server.dirty[y], x)) {
781 if (last_x == -1) {
782 last_x = x;
783 }
784 vnc_clear_bit(vs->server.dirty[y], x);
785 } else {
786 if (last_x != -1) {
787 int h = find_and_clear_dirty_height(&vs->server, y, last_x, x);
788 send_framebuffer_update(vs, last_x * 16, y, (x - last_x) * 16, h);
789 n_rectangles++;
790 }
791 last_x = -1;
792 }
793 }
794 if (last_x != -1) {
795 int h = find_and_clear_dirty_height(&vs->server, y, last_x, x);
796 send_framebuffer_update(vs, last_x * 16, y, (x - last_x) * 16, h);
797 n_rectangles++;
798 }
799 }
800 vs->output.buffer[saved_offset] = (n_rectangles >> 8) & 0xFF;
801 vs->output.buffer[saved_offset + 1] = n_rectangles & 0xFF;
802 vnc_flush(vs);
803 vs->force_update = 0;
804
805 }
806
807 if (vs->csock != -1) {
808 qemu_mod_timer(vs->timer, qemu_get_clock(rt_clock) + VNC_REFRESH_INTERVAL);
809 } else {
810 vnc_disconnect_finish(vs);
811 }
812
813 }
814
815 /* audio */
816 static void audio_capture_notify(void *opaque, audcnotification_e cmd)
817 {
818 VncState *vs = opaque;
819
820 switch (cmd) {
821 case AUD_CNOTIFY_DISABLE:
822 vnc_write_u8(vs, 255);
823 vnc_write_u8(vs, 1);
824 vnc_write_u16(vs, 0);
825 vnc_flush(vs);
826 break;
827
828 case AUD_CNOTIFY_ENABLE:
829 vnc_write_u8(vs, 255);
830 vnc_write_u8(vs, 1);
831 vnc_write_u16(vs, 1);
832 vnc_flush(vs);
833 break;
834 }
835 }
836
837 static void audio_capture_destroy(void *opaque)
838 {
839 }
840
841 static void audio_capture(void *opaque, void *buf, int size)
842 {
843 VncState *vs = opaque;
844
845 vnc_write_u8(vs, 255);
846 vnc_write_u8(vs, 1);
847 vnc_write_u16(vs, 2);
848 vnc_write_u32(vs, size);
849 vnc_write(vs, buf, size);
850 vnc_flush(vs);
851 }
852
853 static void audio_add(VncState *vs)
854 {
855 Monitor *mon = cur_mon;
856 struct audio_capture_ops ops;
857
858 if (vs->audio_cap) {
859 monitor_printf(mon, "audio already running\n");
860 return;
861 }
862
863 ops.notify = audio_capture_notify;
864 ops.destroy = audio_capture_destroy;
865 ops.capture = audio_capture;
866
867 vs->audio_cap = AUD_add_capture(&vs->as, &ops, vs);
868 if (!vs->audio_cap) {
869 monitor_printf(mon, "Failed to add audio capture\n");
870 }
871 }
872
873 static void audio_del(VncState *vs)
874 {
875 if (vs->audio_cap) {
876 AUD_del_capture(vs->audio_cap, vs);
877 vs->audio_cap = NULL;
878 }
879 }
880
881 static void vnc_disconnect_start(VncState *vs)
882 {
883 if (vs->csock == -1)
884 return;
885 qemu_set_fd_handler2(vs->csock, NULL, NULL, NULL, NULL);
886 closesocket(vs->csock);
887 vs->csock = -1;
888 }
889
890 static void vnc_disconnect_finish(VncState *vs)
891 {
892 qemu_del_timer(vs->timer);
893 qemu_free_timer(vs->timer);
894 if (vs->input.buffer) qemu_free(vs->input.buffer);
895 if (vs->output.buffer) qemu_free(vs->output.buffer);
896 #ifdef CONFIG_VNC_TLS
897 vnc_tls_client_cleanup(vs);
898 #endif /* CONFIG_VNC_TLS */
899 #ifdef CONFIG_VNC_SASL
900 vnc_sasl_client_cleanup(vs);
901 #endif /* CONFIG_VNC_SASL */
902 audio_del(vs);
903
904 VncState *p, *parent = NULL;
905 for (p = vs->vd->clients; p != NULL; p = p->next) {
906 if (p == vs) {
907 if (parent)
908 parent->next = p->next;
909 else
910 vs->vd->clients = p->next;
911 break;
912 }
913 parent = p;
914 }
915 if (!vs->vd->clients)
916 dcl->idle = 1;
917
918 qemu_free(vs->server.ds->data);
919 qemu_free(vs->server.ds);
920 qemu_free(vs->guest.ds);
921 qemu_free(vs);
922 }
923
924 int vnc_client_io_error(VncState *vs, int ret, int last_errno)
925 {
926 if (ret == 0 || ret == -1) {
927 if (ret == -1) {
928 switch (last_errno) {
929 case EINTR:
930 case EAGAIN:
931 #ifdef _WIN32
932 case WSAEWOULDBLOCK:
933 #endif
934 return 0;
935 default:
936 break;
937 }
938 }
939
940 VNC_DEBUG("Closing down client sock: ret %d, errno %d\n",
941 ret, ret < 0 ? last_errno : 0);
942 vnc_disconnect_start(vs);
943
944 return 0;
945 }
946 return ret;
947 }
948
949
950 void vnc_client_error(VncState *vs)
951 {
952 VNC_DEBUG("Closing down client sock: protocol error\n");
953 vnc_disconnect_start(vs);
954 }
955
956
957 /*
958 * Called to write a chunk of data to the client socket. The data may
959 * be the raw data, or may have already been encoded by SASL.
960 * The data will be written either straight onto the socket, or
961 * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled
962 *
963 * NB, it is theoretically possible to have 2 layers of encryption,
964 * both SASL, and this TLS layer. It is highly unlikely in practice
965 * though, since SASL encryption will typically be a no-op if TLS
966 * is active
967 *
968 * Returns the number of bytes written, which may be less than
969 * the requested 'datalen' if the socket would block. Returns
970 * -1 on error, and disconnects the client socket.
971 */
972 long vnc_client_write_buf(VncState *vs, const uint8_t *data, size_t datalen)
973 {
974 long ret;
975 #ifdef CONFIG_VNC_TLS
976 if (vs->tls.session) {
977 ret = gnutls_write(vs->tls.session, data, datalen);
978 if (ret < 0) {
979 if (ret == GNUTLS_E_AGAIN)
980 errno = EAGAIN;
981 else
982 errno = EIO;
983 ret = -1;
984 }
985 } else
986 #endif /* CONFIG_VNC_TLS */
987 ret = send(vs->csock, (const void *)data, datalen, 0);
988 VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data, datalen, ret);
989 return vnc_client_io_error(vs, ret, socket_error());
990 }
991
992
993 /*
994 * Called to write buffered data to the client socket, when not
995 * using any SASL SSF encryption layers. Will write as much data
996 * as possible without blocking. If all buffered data is written,
997 * will switch the FD poll() handler back to read monitoring.
998 *
999 * Returns the number of bytes written, which may be less than
1000 * the buffered output data if the socket would block. Returns
1001 * -1 on error, and disconnects the client socket.
1002 */
1003 static long vnc_client_write_plain(VncState *vs)
1004 {
1005 long ret;
1006
1007 #ifdef CONFIG_VNC_SASL
1008 VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n",
1009 vs->output.buffer, vs->output.capacity, vs->output.offset,
1010 vs->sasl.waitWriteSSF);
1011
1012 if (vs->sasl.conn &&
1013 vs->sasl.runSSF &&
1014 vs->sasl.waitWriteSSF) {
1015 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF);
1016 if (ret)
1017 vs->sasl.waitWriteSSF -= ret;
1018 } else
1019 #endif /* CONFIG_VNC_SASL */
1020 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset);
1021 if (!ret)
1022 return 0;
1023
1024 memmove(vs->output.buffer, vs->output.buffer + ret, (vs->output.offset - ret));
1025 vs->output.offset -= ret;
1026
1027 if (vs->output.offset == 0) {
1028 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
1029 }
1030
1031 return ret;
1032 }
1033
1034
1035 /*
1036 * First function called whenever there is data to be written to
1037 * the client socket. Will delegate actual work according to whether
1038 * SASL SSF layers are enabled (thus requiring encryption calls)
1039 */
1040 void vnc_client_write(void *opaque)
1041 {
1042 long ret;
1043 VncState *vs = opaque;
1044
1045 #ifdef CONFIG_VNC_SASL
1046 if (vs->sasl.conn &&
1047 vs->sasl.runSSF &&
1048 !vs->sasl.waitWriteSSF)
1049 ret = vnc_client_write_sasl(vs);
1050 else
1051 #endif /* CONFIG_VNC_SASL */
1052 ret = vnc_client_write_plain(vs);
1053 }
1054
1055 void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting)
1056 {
1057 vs->read_handler = func;
1058 vs->read_handler_expect = expecting;
1059 }
1060
1061
1062 /*
1063 * Called to read a chunk of data from the client socket. The data may
1064 * be the raw data, or may need to be further decoded by SASL.
1065 * The data will be read either straight from to the socket, or
1066 * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1067 *
1068 * NB, it is theoretically possible to have 2 layers of encryption,
1069 * both SASL, and this TLS layer. It is highly unlikely in practice
1070 * though, since SASL encryption will typically be a no-op if TLS
1071 * is active
1072 *
1073 * Returns the number of bytes read, which may be less than
1074 * the requested 'datalen' if the socket would block. Returns
1075 * -1 on error, and disconnects the client socket.
1076 */
1077 long vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen)
1078 {
1079 long ret;
1080 #ifdef CONFIG_VNC_TLS
1081 if (vs->tls.session) {
1082 ret = gnutls_read(vs->tls.session, data, datalen);
1083 if (ret < 0) {
1084 if (ret == GNUTLS_E_AGAIN)
1085 errno = EAGAIN;
1086 else
1087 errno = EIO;
1088 ret = -1;
1089 }
1090 } else
1091 #endif /* CONFIG_VNC_TLS */
1092 ret = recv(vs->csock, (void *)data, datalen, 0);
1093 VNC_DEBUG("Read wire %p %zd -> %ld\n", data, datalen, ret);
1094 return vnc_client_io_error(vs, ret, socket_error());
1095 }
1096
1097
1098 /*
1099 * Called to read data from the client socket to the input buffer,
1100 * when not using any SASL SSF encryption layers. Will read as much
1101 * data as possible without blocking.
1102 *
1103 * Returns the number of bytes read. Returns -1 on error, and
1104 * disconnects the client socket.
1105 */
1106 static long vnc_client_read_plain(VncState *vs)
1107 {
1108 int ret;
1109 VNC_DEBUG("Read plain %p size %zd offset %zd\n",
1110 vs->input.buffer, vs->input.capacity, vs->input.offset);
1111 buffer_reserve(&vs->input, 4096);
1112 ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096);
1113 if (!ret)
1114 return 0;
1115 vs->input.offset += ret;
1116 return ret;
1117 }
1118
1119
1120 /*
1121 * First function called whenever there is more data to be read from
1122 * the client socket. Will delegate actual work according to whether
1123 * SASL SSF layers are enabled (thus requiring decryption calls)
1124 */
1125 void vnc_client_read(void *opaque)
1126 {
1127 VncState *vs = opaque;
1128 long ret;
1129
1130 #ifdef CONFIG_VNC_SASL
1131 if (vs->sasl.conn && vs->sasl.runSSF)
1132 ret = vnc_client_read_sasl(vs);
1133 else
1134 #endif /* CONFIG_VNC_SASL */
1135 ret = vnc_client_read_plain(vs);
1136 if (!ret) {
1137 if (vs->csock == -1)
1138 vnc_disconnect_finish(vs);
1139 return;
1140 }
1141
1142 while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) {
1143 size_t len = vs->read_handler_expect;
1144 int ret;
1145
1146 ret = vs->read_handler(vs, vs->input.buffer, len);
1147 if (vs->csock == -1) {
1148 vnc_disconnect_finish(vs);
1149 return;
1150 }
1151
1152 if (!ret) {
1153 memmove(vs->input.buffer, vs->input.buffer + len, (vs->input.offset - len));
1154 vs->input.offset -= len;
1155 } else {
1156 vs->read_handler_expect = ret;
1157 }
1158 }
1159 }
1160
1161 void vnc_write(VncState *vs, const void *data, size_t len)
1162 {
1163 buffer_reserve(&vs->output, len);
1164
1165 if (vs->csock != -1 && buffer_empty(&vs->output)) {
1166 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, vnc_client_write, vs);
1167 }
1168
1169 buffer_append(&vs->output, data, len);
1170 }
1171
1172 void vnc_write_s32(VncState *vs, int32_t value)
1173 {
1174 vnc_write_u32(vs, *(uint32_t *)&value);
1175 }
1176
1177 void vnc_write_u32(VncState *vs, uint32_t value)
1178 {
1179 uint8_t buf[4];
1180
1181 buf[0] = (value >> 24) & 0xFF;
1182 buf[1] = (value >> 16) & 0xFF;
1183 buf[2] = (value >> 8) & 0xFF;
1184 buf[3] = value & 0xFF;
1185
1186 vnc_write(vs, buf, 4);
1187 }
1188
1189 void vnc_write_u16(VncState *vs, uint16_t value)
1190 {
1191 uint8_t buf[2];
1192
1193 buf[0] = (value >> 8) & 0xFF;
1194 buf[1] = value & 0xFF;
1195
1196 vnc_write(vs, buf, 2);
1197 }
1198
1199 void vnc_write_u8(VncState *vs, uint8_t value)
1200 {
1201 vnc_write(vs, (char *)&value, 1);
1202 }
1203
1204 void vnc_flush(VncState *vs)
1205 {
1206 if (vs->csock != -1 && vs->output.offset)
1207 vnc_client_write(vs);
1208 }
1209
1210 uint8_t read_u8(uint8_t *data, size_t offset)
1211 {
1212 return data[offset];
1213 }
1214
1215 uint16_t read_u16(uint8_t *data, size_t offset)
1216 {
1217 return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF);
1218 }
1219
1220 int32_t read_s32(uint8_t *data, size_t offset)
1221 {
1222 return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) |
1223 (data[offset + 2] << 8) | data[offset + 3]);
1224 }
1225
1226 uint32_t read_u32(uint8_t *data, size_t offset)
1227 {
1228 return ((data[offset] << 24) | (data[offset + 1] << 16) |
1229 (data[offset + 2] << 8) | data[offset + 3]);
1230 }
1231
1232 static void client_cut_text(VncState *vs, size_t len, uint8_t *text)
1233 {
1234 }
1235
1236 static void check_pointer_type_change(VncState *vs, int absolute)
1237 {
1238 if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) {
1239 vnc_write_u8(vs, 0);
1240 vnc_write_u8(vs, 0);
1241 vnc_write_u16(vs, 1);
1242 vnc_framebuffer_update(vs, absolute, 0,
1243 ds_get_width(vs->ds), ds_get_height(vs->ds),
1244 VNC_ENCODING_POINTER_TYPE_CHANGE);
1245 vnc_flush(vs);
1246 }
1247 vs->absolute = absolute;
1248 }
1249
1250 static void pointer_event(VncState *vs, int button_mask, int x, int y)
1251 {
1252 int buttons = 0;
1253 int dz = 0;
1254
1255 if (button_mask & 0x01)
1256 buttons |= MOUSE_EVENT_LBUTTON;
1257 if (button_mask & 0x02)
1258 buttons |= MOUSE_EVENT_MBUTTON;
1259 if (button_mask & 0x04)
1260 buttons |= MOUSE_EVENT_RBUTTON;
1261 if (button_mask & 0x08)
1262 dz = -1;
1263 if (button_mask & 0x10)
1264 dz = 1;
1265
1266 if (vs->absolute) {
1267 kbd_mouse_event(x * 0x7FFF / (ds_get_width(vs->ds) - 1),
1268 y * 0x7FFF / (ds_get_height(vs->ds) - 1),
1269 dz, buttons);
1270 } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) {
1271 x -= 0x7FFF;
1272 y -= 0x7FFF;
1273
1274 kbd_mouse_event(x, y, dz, buttons);
1275 } else {
1276 if (vs->last_x != -1)
1277 kbd_mouse_event(x - vs->last_x,
1278 y - vs->last_y,
1279 dz, buttons);
1280 vs->last_x = x;
1281 vs->last_y = y;
1282 }
1283
1284 check_pointer_type_change(vs, kbd_mouse_is_absolute());
1285 }
1286
1287 static void reset_keys(VncState *vs)
1288 {
1289 int i;
1290 for(i = 0; i < 256; i++) {
1291 if (vs->modifiers_state[i]) {
1292 if (i & 0x80)
1293 kbd_put_keycode(0xe0);
1294 kbd_put_keycode(i | 0x80);
1295 vs->modifiers_state[i] = 0;
1296 }
1297 }
1298 }
1299
1300 static void press_key(VncState *vs, int keysym)
1301 {
1302 kbd_put_keycode(keysym2scancode(vs->vd->kbd_layout, keysym) & 0x7f);
1303 kbd_put_keycode(keysym2scancode(vs->vd->kbd_layout, keysym) | 0x80);
1304 }
1305
1306 static void do_key_event(VncState *vs, int down, int keycode, int sym)
1307 {
1308 /* QEMU console switch */
1309 switch(keycode) {
1310 case 0x2a: /* Left Shift */
1311 case 0x36: /* Right Shift */
1312 case 0x1d: /* Left CTRL */
1313 case 0x9d: /* Right CTRL */
1314 case 0x38: /* Left ALT */
1315 case 0xb8: /* Right ALT */
1316 if (down)
1317 vs->modifiers_state[keycode] = 1;
1318 else
1319 vs->modifiers_state[keycode] = 0;
1320 break;
1321 case 0x02 ... 0x0a: /* '1' to '9' keys */
1322 if (down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) {
1323 /* Reset the modifiers sent to the current console */
1324 reset_keys(vs);
1325 console_select(keycode - 0x02);
1326 return;
1327 }
1328 break;
1329 case 0x3a: /* CapsLock */
1330 case 0x45: /* NumLock */
1331 if (!down)
1332 vs->modifiers_state[keycode] ^= 1;
1333 break;
1334 }
1335
1336 if (keycode_is_keypad(vs->vd->kbd_layout, keycode)) {
1337 /* If the numlock state needs to change then simulate an additional
1338 keypress before sending this one. This will happen if the user
1339 toggles numlock away from the VNC window.
1340 */
1341 if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) {
1342 if (!vs->modifiers_state[0x45]) {
1343 vs->modifiers_state[0x45] = 1;
1344 press_key(vs, 0xff7f);
1345 }
1346 } else {
1347 if (vs->modifiers_state[0x45]) {
1348 vs->modifiers_state[0x45] = 0;
1349 press_key(vs, 0xff7f);
1350 }
1351 }
1352 }
1353
1354 if (is_graphic_console()) {
1355 if (keycode & 0x80)
1356 kbd_put_keycode(0xe0);
1357 if (down)
1358 kbd_put_keycode(keycode & 0x7f);
1359 else
1360 kbd_put_keycode(keycode | 0x80);
1361 } else {
1362 /* QEMU console emulation */
1363 if (down) {
1364 int numlock = vs->modifiers_state[0x45];
1365 switch (keycode) {
1366 case 0x2a: /* Left Shift */
1367 case 0x36: /* Right Shift */
1368 case 0x1d: /* Left CTRL */
1369 case 0x9d: /* Right CTRL */
1370 case 0x38: /* Left ALT */
1371 case 0xb8: /* Right ALT */
1372 break;
1373 case 0xc8:
1374 kbd_put_keysym(QEMU_KEY_UP);
1375 break;
1376 case 0xd0:
1377 kbd_put_keysym(QEMU_KEY_DOWN);
1378 break;
1379 case 0xcb:
1380 kbd_put_keysym(QEMU_KEY_LEFT);
1381 break;
1382 case 0xcd:
1383 kbd_put_keysym(QEMU_KEY_RIGHT);
1384 break;
1385 case 0xd3:
1386 kbd_put_keysym(QEMU_KEY_DELETE);
1387 break;
1388 case 0xc7:
1389 kbd_put_keysym(QEMU_KEY_HOME);
1390 break;
1391 case 0xcf:
1392 kbd_put_keysym(QEMU_KEY_END);
1393 break;
1394 case 0xc9:
1395 kbd_put_keysym(QEMU_KEY_PAGEUP);
1396 break;
1397 case 0xd1:
1398 kbd_put_keysym(QEMU_KEY_PAGEDOWN);
1399 break;
1400
1401 case 0x47:
1402 kbd_put_keysym(numlock ? '7' : QEMU_KEY_HOME);
1403 break;
1404 case 0x48:
1405 kbd_put_keysym(numlock ? '8' : QEMU_KEY_UP);
1406 break;
1407 case 0x49:
1408 kbd_put_keysym(numlock ? '9' : QEMU_KEY_PAGEUP);
1409 break;
1410 case 0x4b:
1411 kbd_put_keysym(numlock ? '4' : QEMU_KEY_LEFT);
1412 break;
1413 case 0x4c:
1414 kbd_put_keysym('5');
1415 break;
1416 case 0x4d:
1417 kbd_put_keysym(numlock ? '6' : QEMU_KEY_RIGHT);
1418 break;
1419 case 0x4f:
1420 kbd_put_keysym(numlock ? '1' : QEMU_KEY_END);
1421 break;
1422 case 0x50:
1423 kbd_put_keysym(numlock ? '2' : QEMU_KEY_DOWN);
1424 break;
1425 case 0x51:
1426 kbd_put_keysym(numlock ? '3' : QEMU_KEY_PAGEDOWN);
1427 break;
1428 case 0x52:
1429 kbd_put_keysym('0');
1430 break;
1431 case 0x53:
1432 kbd_put_keysym(numlock ? '.' : QEMU_KEY_DELETE);
1433 break;
1434
1435 case 0xb5:
1436 kbd_put_keysym('/');
1437 break;
1438 case 0x37:
1439 kbd_put_keysym('*');
1440 break;
1441 case 0x4a:
1442 kbd_put_keysym('-');
1443 break;
1444 case 0x4e:
1445 kbd_put_keysym('+');
1446 break;
1447 case 0x9c:
1448 kbd_put_keysym('\n');
1449 break;
1450
1451 default:
1452 kbd_put_keysym(sym);
1453 break;
1454 }
1455 }
1456 }
1457 }
1458
1459 static void key_event(VncState *vs, int down, uint32_t sym)
1460 {
1461 int keycode;
1462
1463 if (sym >= 'A' && sym <= 'Z' && is_graphic_console())
1464 sym = sym - 'A' + 'a';
1465
1466 keycode = keysym2scancode(vs->vd->kbd_layout, sym & 0xFFFF);
1467 do_key_event(vs, down, keycode, sym);
1468 }
1469
1470 static void ext_key_event(VncState *vs, int down,
1471 uint32_t sym, uint16_t keycode)
1472 {
1473 /* if the user specifies a keyboard layout, always use it */
1474 if (keyboard_layout)
1475 key_event(vs, down, sym);
1476 else
1477 do_key_event(vs, down, keycode, sym);
1478 }
1479
1480 static void framebuffer_update_request(VncState *vs, int incremental,
1481 int x_position, int y_position,
1482 int w, int h)
1483 {
1484 if (x_position > ds_get_width(vs->ds))
1485 x_position = ds_get_width(vs->ds);
1486 if (y_position > ds_get_height(vs->ds))
1487 y_position = ds_get_height(vs->ds);
1488 if (x_position + w >= ds_get_width(vs->ds))
1489 w = ds_get_width(vs->ds) - x_position;
1490 if (y_position + h >= ds_get_height(vs->ds))
1491 h = ds_get_height(vs->ds) - y_position;
1492
1493 int i;
1494 vs->need_update = 1;
1495 if (!incremental) {
1496 vs->force_update = 1;
1497 for (i = 0; i < h; i++) {
1498 vnc_set_bits(vs->guest.dirty[y_position + i],
1499 (ds_get_width(vs->ds) / 16), VNC_DIRTY_WORDS);
1500 vnc_set_bits(vs->server.dirty[y_position + i],
1501 (ds_get_width(vs->ds) / 16), VNC_DIRTY_WORDS);
1502 }
1503 }
1504 }
1505
1506 static void send_ext_key_event_ack(VncState *vs)
1507 {
1508 vnc_write_u8(vs, 0);
1509 vnc_write_u8(vs, 0);
1510 vnc_write_u16(vs, 1);
1511 vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
1512 VNC_ENCODING_EXT_KEY_EVENT);
1513 vnc_flush(vs);
1514 }
1515
1516 static void send_ext_audio_ack(VncState *vs)
1517 {
1518 vnc_write_u8(vs, 0);
1519 vnc_write_u8(vs, 0);
1520 vnc_write_u16(vs, 1);
1521 vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
1522 VNC_ENCODING_AUDIO);
1523 vnc_flush(vs);
1524 }
1525
1526 static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
1527 {
1528 int i;
1529 unsigned int enc = 0;
1530
1531 vnc_zlib_init(vs);
1532 vs->features = 0;
1533 vs->vnc_encoding = 0;
1534 vs->tight_compression = 9;
1535 vs->tight_quality = 9;
1536 vs->absolute = -1;
1537
1538 for (i = n_encodings - 1; i >= 0; i--) {
1539 enc = encodings[i];
1540 switch (enc) {
1541 case VNC_ENCODING_RAW:
1542 vs->vnc_encoding = enc;
1543 break;
1544 case VNC_ENCODING_COPYRECT:
1545 vs->features |= VNC_FEATURE_COPYRECT_MASK;
1546 break;
1547 case VNC_ENCODING_HEXTILE:
1548 vs->features |= VNC_FEATURE_HEXTILE_MASK;
1549 vs->vnc_encoding = enc;
1550 break;
1551 case VNC_ENCODING_ZLIB:
1552 vs->features |= VNC_FEATURE_ZLIB_MASK;
1553 vs->vnc_encoding = enc;
1554 break;
1555 case VNC_ENCODING_DESKTOPRESIZE:
1556 vs->features |= VNC_FEATURE_RESIZE_MASK;
1557 break;
1558 case VNC_ENCODING_POINTER_TYPE_CHANGE:
1559 vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK;
1560 break;
1561 case VNC_ENCODING_EXT_KEY_EVENT:
1562 send_ext_key_event_ack(vs);
1563 break;
1564 case VNC_ENCODING_AUDIO:
1565 send_ext_audio_ack(vs);
1566 break;
1567 case VNC_ENCODING_WMVi:
1568 vs->features |= VNC_FEATURE_WMVI_MASK;
1569 break;
1570 case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9:
1571 vs->tight_compression = (enc & 0x0F);
1572 break;
1573 case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9:
1574 vs->tight_quality = (enc & 0x0F);
1575 break;
1576 default:
1577 VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc);
1578 break;
1579 }
1580 }
1581
1582 check_pointer_type_change(vs, kbd_mouse_is_absolute());
1583 }
1584
1585 static void set_pixel_conversion(VncState *vs)
1586 {
1587 if ((vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) ==
1588 (vs->ds->surface->flags & QEMU_BIG_ENDIAN_FLAG) &&
1589 !memcmp(&(vs->clientds.pf), &(vs->ds->surface->pf), sizeof(PixelFormat))) {
1590 vs->write_pixels = vnc_write_pixels_copy;
1591 switch (vs->ds->surface->pf.bits_per_pixel) {
1592 case 8:
1593 vs->send_hextile_tile = send_hextile_tile_8;
1594 break;
1595 case 16:
1596 vs->send_hextile_tile = send_hextile_tile_16;
1597 break;
1598 case 32:
1599 vs->send_hextile_tile = send_hextile_tile_32;
1600 break;
1601 }
1602 } else {
1603 vs->write_pixels = vnc_write_pixels_generic;
1604 switch (vs->ds->surface->pf.bits_per_pixel) {
1605 case 8:
1606 vs->send_hextile_tile = send_hextile_tile_generic_8;
1607 break;
1608 case 16:
1609 vs->send_hextile_tile = send_hextile_tile_generic_16;
1610 break;
1611 case 32:
1612 vs->send_hextile_tile = send_hextile_tile_generic_32;
1613 break;
1614 }
1615 }
1616 }
1617
1618 static void set_pixel_format(VncState *vs,
1619 int bits_per_pixel, int depth,
1620 int big_endian_flag, int true_color_flag,
1621 int red_max, int green_max, int blue_max,
1622 int red_shift, int green_shift, int blue_shift)
1623 {
1624 if (!true_color_flag) {
1625 vnc_client_error(vs);
1626 return;
1627 }
1628
1629 vs->clientds = *(vs->guest.ds);
1630 vs->clientds.pf.rmax = red_max;
1631 count_bits(vs->clientds.pf.rbits, red_max);
1632 vs->clientds.pf.rshift = red_shift;
1633 vs->clientds.pf.rmask = red_max << red_shift;
1634 vs->clientds.pf.gmax = green_max;
1635 count_bits(vs->clientds.pf.gbits, green_max);
1636 vs->clientds.pf.gshift = green_shift;
1637 vs->clientds.pf.gmask = green_max << green_shift;
1638 vs->clientds.pf.bmax = blue_max;
1639 count_bits(vs->clientds.pf.bbits, blue_max);
1640 vs->clientds.pf.bshift = blue_shift;
1641 vs->clientds.pf.bmask = blue_max << blue_shift;
1642 vs->clientds.pf.bits_per_pixel = bits_per_pixel;
1643 vs->clientds.pf.bytes_per_pixel = bits_per_pixel / 8;
1644 vs->clientds.pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;
1645 vs->clientds.flags = big_endian_flag ? QEMU_BIG_ENDIAN_FLAG : 0x00;
1646
1647 set_pixel_conversion(vs);
1648
1649 vga_hw_invalidate();
1650 vga_hw_update();
1651 }
1652
1653 static void pixel_format_message (VncState *vs) {
1654 char pad[3] = { 0, 0, 0 };
1655
1656 vnc_write_u8(vs, vs->ds->surface->pf.bits_per_pixel); /* bits-per-pixel */
1657 vnc_write_u8(vs, vs->ds->surface->pf.depth); /* depth */
1658
1659 #ifdef WORDS_BIGENDIAN
1660 vnc_write_u8(vs, 1); /* big-endian-flag */
1661 #else
1662 vnc_write_u8(vs, 0); /* big-endian-flag */
1663 #endif
1664 vnc_write_u8(vs, 1); /* true-color-flag */
1665 vnc_write_u16(vs, vs->ds->surface->pf.rmax); /* red-max */
1666 vnc_write_u16(vs, vs->ds->surface->pf.gmax); /* green-max */
1667 vnc_write_u16(vs, vs->ds->surface->pf.bmax); /* blue-max */
1668 vnc_write_u8(vs, vs->ds->surface->pf.rshift); /* red-shift */
1669 vnc_write_u8(vs, vs->ds->surface->pf.gshift); /* green-shift */
1670 vnc_write_u8(vs, vs->ds->surface->pf.bshift); /* blue-shift */
1671 if (vs->ds->surface->pf.bits_per_pixel == 32)
1672 vs->send_hextile_tile = send_hextile_tile_32;
1673 else if (vs->ds->surface->pf.bits_per_pixel == 16)
1674 vs->send_hextile_tile = send_hextile_tile_16;
1675 else if (vs->ds->surface->pf.bits_per_pixel == 8)
1676 vs->send_hextile_tile = send_hextile_tile_8;
1677 vs->clientds = *(vs->ds->surface);
1678 vs->clientds.flags &= ~QEMU_ALLOCATED_FLAG;
1679 vs->write_pixels = vnc_write_pixels_copy;
1680
1681 vnc_write(vs, pad, 3); /* padding */
1682 }
1683
1684 static void vnc_dpy_setdata(DisplayState *ds)
1685 {
1686 /* We don't have to do anything */
1687 }
1688
1689 static void vnc_colordepth(VncState *vs)
1690 {
1691 if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) {
1692 /* Sending a WMVi message to notify the client*/
1693 vnc_write_u8(vs, 0); /* msg id */
1694 vnc_write_u8(vs, 0);
1695 vnc_write_u16(vs, 1); /* number of rects */
1696 vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds),
1697 ds_get_height(vs->ds), VNC_ENCODING_WMVi);
1698 pixel_format_message(vs);
1699 vnc_flush(vs);
1700 } else {
1701 set_pixel_conversion(vs);
1702 }
1703 }
1704
1705 static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
1706 {
1707 int i;
1708 uint16_t limit;
1709
1710 switch (data[0]) {
1711 case 0:
1712 if (len == 1)
1713 return 20;
1714
1715 set_pixel_format(vs, read_u8(data, 4), read_u8(data, 5),
1716 read_u8(data, 6), read_u8(data, 7),
1717 read_u16(data, 8), read_u16(data, 10),
1718 read_u16(data, 12), read_u8(data, 14),
1719 read_u8(data, 15), read_u8(data, 16));
1720 break;
1721 case 2:
1722 if (len == 1)
1723 return 4;
1724
1725 if (len == 4) {
1726 limit = read_u16(data, 2);
1727 if (limit > 0)
1728 return 4 + (limit * 4);
1729 } else
1730 limit = read_u16(data, 2);
1731
1732 for (i = 0; i < limit; i++) {
1733 int32_t val = read_s32(data, 4 + (i * 4));
1734 memcpy(data + 4 + (i * 4), &val, sizeof(val));
1735 }
1736
1737 set_encodings(vs, (int32_t *)(data + 4), limit);
1738 break;
1739 case 3:
1740 if (len == 1)
1741 return 10;
1742
1743 framebuffer_update_request(vs,
1744 read_u8(data, 1), read_u16(data, 2), read_u16(data, 4),
1745 read_u16(data, 6), read_u16(data, 8));
1746 break;
1747 case 4:
1748 if (len == 1)
1749 return 8;
1750
1751 key_event(vs, read_u8(data, 1), read_u32(data, 4));
1752 break;
1753 case 5:
1754 if (len == 1)
1755 return 6;
1756
1757 pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
1758 break;
1759 case 6:
1760 if (len == 1)
1761 return 8;
1762
1763 if (len == 8) {
1764 uint32_t dlen = read_u32(data, 4);
1765 if (dlen > 0)
1766 return 8 + dlen;
1767 }
1768
1769 client_cut_text(vs, read_u32(data, 4), data + 8);
1770 break;
1771 case 255:
1772 if (len == 1)
1773 return 2;
1774
1775 switch (read_u8(data, 1)) {
1776 case 0:
1777 if (len == 2)
1778 return 12;
1779
1780 ext_key_event(vs, read_u16(data, 2),
1781 read_u32(data, 4), read_u32(data, 8));
1782 break;
1783 case 1:
1784 if (len == 2)
1785 return 4;
1786
1787 switch (read_u16 (data, 2)) {
1788 case 0:
1789 audio_add(vs);
1790 break;
1791 case 1:
1792 audio_del(vs);
1793 break;
1794 case 2:
1795 if (len == 4)
1796 return 10;
1797 switch (read_u8(data, 4)) {
1798 case 0: vs->as.fmt = AUD_FMT_U8; break;
1799 case 1: vs->as.fmt = AUD_FMT_S8; break;
1800 case 2: vs->as.fmt = AUD_FMT_U16; break;
1801 case 3: vs->as.fmt = AUD_FMT_S16; break;
1802 case 4: vs->as.fmt = AUD_FMT_U32; break;
1803 case 5: vs->as.fmt = AUD_FMT_S32; break;
1804 default:
1805 printf("Invalid audio format %d\n", read_u8(data, 4));
1806 vnc_client_error(vs);
1807 break;
1808 }
1809 vs->as.nchannels = read_u8(data, 5);
1810 if (vs->as.nchannels != 1 && vs->as.nchannels != 2) {
1811 printf("Invalid audio channel coount %d\n",
1812 read_u8(data, 5));
1813 vnc_client_error(vs);
1814 break;
1815 }
1816 vs->as.freq = read_u32(data, 6);
1817 break;
1818 default:
1819 printf ("Invalid audio message %d\n", read_u8(data, 4));
1820 vnc_client_error(vs);
1821 break;
1822 }
1823 break;
1824
1825 default:
1826 printf("Msg: %d\n", read_u16(data, 0));
1827 vnc_client_error(vs);
1828 break;
1829 }
1830 break;
1831 default:
1832 printf("Msg: %d\n", data[0]);
1833 vnc_client_error(vs);
1834 break;
1835 }
1836
1837 vnc_read_when(vs, protocol_client_msg, 1);
1838 return 0;
1839 }
1840
1841 static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
1842 {
1843 char buf[1024];
1844 int size;
1845
1846 vnc_write_u16(vs, ds_get_width(vs->ds));
1847 vnc_write_u16(vs, ds_get_height(vs->ds));
1848
1849 pixel_format_message(vs);
1850
1851 if (qemu_name)
1852 size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
1853 else
1854 size = snprintf(buf, sizeof(buf), "QEMU");
1855
1856 vnc_write_u32(vs, size);
1857 vnc_write(vs, buf, size);
1858 vnc_flush(vs);
1859
1860 vnc_read_when(vs, protocol_client_msg, 1);
1861
1862 return 0;
1863 }
1864
1865 void start_client_init(VncState *vs)
1866 {
1867 vnc_read_when(vs, protocol_client_init, 1);
1868 }
1869
1870 static void make_challenge(VncState *vs)
1871 {
1872 int i;
1873
1874 srand(time(NULL)+getpid()+getpid()*987654+rand());
1875
1876 for (i = 0 ; i < sizeof(vs->challenge) ; i++)
1877 vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
1878 }
1879
1880 static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
1881 {
1882 unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
1883 int i, j, pwlen;
1884 unsigned char key[8];
1885
1886 if (!vs->vd->password || !vs->vd->password[0]) {
1887 VNC_DEBUG("No password configured on server");
1888 vnc_write_u32(vs, 1); /* Reject auth */
1889 if (vs->minor >= 8) {
1890 static const char err[] = "Authentication failed";
1891 vnc_write_u32(vs, sizeof(err));
1892 vnc_write(vs, err, sizeof(err));
1893 }
1894 vnc_flush(vs);
1895 vnc_client_error(vs);
1896 return 0;
1897 }
1898
1899 memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
1900
1901 /* Calculate the expected challenge response */
1902 pwlen = strlen(vs->vd->password);
1903 for (i=0; i<sizeof(key); i++)
1904 key[i] = i<pwlen ? vs->vd->password[i] : 0;
1905 deskey(key, EN0);
1906 for (j = 0; j < VNC_AUTH_CHALLENGE_SIZE; j += 8)
1907 des(response+j, response+j);
1908
1909 /* Compare expected vs actual challenge response */
1910 if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) {
1911 VNC_DEBUG("Client challenge reponse did not match\n");
1912 vnc_write_u32(vs, 1); /* Reject auth */
1913 if (vs->minor >= 8) {
1914 static const char err[] = "Authentication failed";
1915 vnc_write_u32(vs, sizeof(err));
1916 vnc_write(vs, err, sizeof(err));
1917 }
1918 vnc_flush(vs);
1919 vnc_client_error(vs);
1920 } else {
1921 VNC_DEBUG("Accepting VNC challenge response\n");
1922 vnc_write_u32(vs, 0); /* Accept auth */
1923 vnc_flush(vs);
1924
1925 start_client_init(vs);
1926 }
1927 return 0;
1928 }
1929
1930 void start_auth_vnc(VncState *vs)
1931 {
1932 make_challenge(vs);
1933 /* Send client a 'random' challenge */
1934 vnc_write(vs, vs->challenge, sizeof(vs->challenge));
1935 vnc_flush(vs);
1936
1937 vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge));
1938 }
1939
1940
1941 static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
1942 {
1943 /* We only advertise 1 auth scheme at a time, so client
1944 * must pick the one we sent. Verify this */
1945 if (data[0] != vs->vd->auth) { /* Reject auth */
1946 VNC_DEBUG("Reject auth %d because it didn't match advertized\n", (int)data[0]);
1947 vnc_write_u32(vs, 1);
1948 if (vs->minor >= 8) {
1949 static const char err[] = "Authentication failed";
1950 vnc_write_u32(vs, sizeof(err));
1951 vnc_write(vs, err, sizeof(err));
1952 }
1953 vnc_client_error(vs);
1954 } else { /* Accept requested auth */
1955 VNC_DEBUG("Client requested auth %d\n", (int)data[0]);
1956 switch (vs->vd->auth) {
1957 case VNC_AUTH_NONE:
1958 VNC_DEBUG("Accept auth none\n");
1959 if (vs->minor >= 8) {
1960 vnc_write_u32(vs, 0); /* Accept auth completion */
1961 vnc_flush(vs);
1962 }
1963 start_client_init(vs);
1964 break;
1965
1966 case VNC_AUTH_VNC:
1967 VNC_DEBUG("Start VNC auth\n");
1968 start_auth_vnc(vs);
1969 break;
1970
1971 #ifdef CONFIG_VNC_TLS
1972 case VNC_AUTH_VENCRYPT:
1973 VNC_DEBUG("Accept VeNCrypt auth\n");;
1974 start_auth_vencrypt(vs);
1975 break;
1976 #endif /* CONFIG_VNC_TLS */
1977
1978 #ifdef CONFIG_VNC_SASL
1979 case VNC_AUTH_SASL:
1980 VNC_DEBUG("Accept SASL auth\n");
1981 start_auth_sasl(vs);
1982 break;
1983 #endif /* CONFIG_VNC_SASL */
1984
1985 default: /* Should not be possible, but just in case */
1986 VNC_DEBUG("Reject auth %d server code bug\n", vs->vd->auth);
1987 vnc_write_u8(vs, 1);
1988 if (vs->minor >= 8) {
1989 static const char err[] = "Authentication failed";
1990 vnc_write_u32(vs, sizeof(err));
1991 vnc_write(vs, err, sizeof(err));
1992 }
1993 vnc_client_error(vs);
1994 }
1995 }
1996 return 0;
1997 }
1998
1999 static int protocol_version(VncState *vs, uint8_t *version, size_t len)
2000 {
2001 char local[13];
2002
2003 memcpy(local, version, 12);
2004 local[12] = 0;
2005
2006 if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) {
2007 VNC_DEBUG("Malformed protocol version %s\n", local);
2008 vnc_client_error(vs);
2009 return 0;
2010 }
2011 VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor);
2012 if (vs->major != 3 ||
2013 (vs->minor != 3 &&
2014 vs->minor != 4 &&
2015 vs->minor != 5 &&
2016 vs->minor != 7 &&
2017 vs->minor != 8)) {
2018 VNC_DEBUG("Unsupported client version\n");
2019 vnc_write_u32(vs, VNC_AUTH_INVALID);
2020 vnc_flush(vs);
2021 vnc_client_error(vs);
2022 return 0;
2023 }
2024 /* Some broken clients report v3.4 or v3.5, which spec requires to be treated
2025 * as equivalent to v3.3 by servers
2026 */
2027 if (vs->minor == 4 || vs->minor == 5)
2028 vs->minor = 3;
2029
2030 if (vs->minor == 3) {
2031 if (vs->vd->auth == VNC_AUTH_NONE) {
2032 VNC_DEBUG("Tell client auth none\n");
2033 vnc_write_u32(vs, vs->vd->auth);
2034 vnc_flush(vs);
2035 start_client_init(vs);
2036 } else if (vs->vd->auth == VNC_AUTH_VNC) {
2037 VNC_DEBUG("Tell client VNC auth\n");
2038 vnc_write_u32(vs, vs->vd->auth);
2039 vnc_flush(vs);
2040 start_auth_vnc(vs);
2041 } else {
2042 VNC_DEBUG("Unsupported auth %d for protocol 3.3\n", vs->vd->auth);
2043 vnc_write_u32(vs, VNC_AUTH_INVALID);
2044 vnc_flush(vs);
2045 vnc_client_error(vs);
2046 }
2047 } else {
2048 VNC_DEBUG("Telling client we support auth %d\n", vs->vd->auth);
2049 vnc_write_u8(vs, 1); /* num auth */
2050 vnc_write_u8(vs, vs->vd->auth);
2051 vnc_read_when(vs, protocol_client_auth, 1);
2052 vnc_flush(vs);
2053 }
2054
2055 return 0;
2056 }
2057
2058 static void vnc_connect(VncDisplay *vd, int csock)
2059 {
2060 VncState *vs = qemu_mallocz(sizeof(VncState));
2061 vs->csock = csock;
2062
2063 VNC_DEBUG("New client on socket %d\n", csock);
2064 dcl->idle = 0;
2065 socket_set_nonblock(vs->csock);
2066 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
2067
2068 vs->vd = vd;
2069 vs->ds = vd->ds;
2070 vs->timer = qemu_new_timer(rt_clock, vnc_update_client, vs);
2071 vs->last_x = -1;
2072 vs->last_y = -1;
2073
2074 vs->as.freq = 44100;
2075 vs->as.nchannels = 2;
2076 vs->as.fmt = AUD_FMT_S16;
2077 vs->as.endianness = 0;
2078
2079 vnc_resize(vs);
2080 vnc_write(vs, "RFB 003.008\n", 12);
2081 vnc_flush(vs);
2082 vnc_read_when(vs, protocol_version, 12);
2083 reset_keys(vs);
2084
2085 vs->next = vd->clients;
2086 vd->clients = vs;
2087
2088 vnc_update_client(vs);
2089 /* vs might be free()ed here */
2090 }
2091
2092 static void vnc_listen_read(void *opaque)
2093 {
2094 VncDisplay *vs = opaque;
2095 struct sockaddr_in addr;
2096 socklen_t addrlen = sizeof(addr);
2097
2098 /* Catch-up */
2099 vga_hw_update();
2100
2101 int csock = accept(vs->lsock, (struct sockaddr *)&addr, &addrlen);
2102 if (csock != -1) {
2103 vnc_connect(vs, csock);
2104 }
2105 }
2106
2107 void vnc_display_init(DisplayState *ds)
2108 {
2109 VncDisplay *vs = qemu_mallocz(sizeof(*vs));
2110
2111 dcl = qemu_mallocz(sizeof(DisplayChangeListener));
2112
2113 ds->opaque = vs;
2114 dcl->idle = 1;
2115 vnc_display = vs;
2116
2117 vs->lsock = -1;
2118
2119 vs->ds = ds;
2120
2121 if (keyboard_layout)
2122 vs->kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout);
2123 else
2124 vs->kbd_layout = init_keyboard_layout(name2keysym, "en-us");
2125
2126 if (!vs->kbd_layout)
2127 exit(1);
2128
2129 dcl->dpy_copy = vnc_dpy_copy;
2130 dcl->dpy_update = vnc_dpy_update;
2131 dcl->dpy_resize = vnc_dpy_resize;
2132 dcl->dpy_setdata = vnc_dpy_setdata;
2133 register_displaychangelistener(ds, dcl);
2134 }
2135
2136
2137 void vnc_display_close(DisplayState *ds)
2138 {
2139 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2140
2141 if (!vs)
2142 return;
2143 if (vs->display) {
2144 qemu_free(vs->display);
2145 vs->display = NULL;
2146 }
2147 if (vs->lsock != -1) {
2148 qemu_set_fd_handler2(vs->lsock, NULL, NULL, NULL, NULL);
2149 close(vs->lsock);
2150 vs->lsock = -1;
2151 }
2152 vs->auth = VNC_AUTH_INVALID;
2153 #ifdef CONFIG_VNC_TLS
2154 vs->subauth = VNC_AUTH_INVALID;
2155 vs->tls.x509verify = 0;
2156 #endif
2157 }
2158
2159 int vnc_display_password(DisplayState *ds, const char *password)
2160 {
2161 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2162
2163 if (vs->password) {
2164 qemu_free(vs->password);
2165 vs->password = NULL;
2166 }
2167 if (password && password[0]) {
2168 if (!(vs->password = qemu_strdup(password)))
2169 return -1;
2170 }
2171
2172 return 0;
2173 }
2174
2175 char *vnc_display_local_addr(DisplayState *ds)
2176 {
2177 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2178
2179 return vnc_socket_local_addr("%s:%s", vs->lsock);
2180 }
2181
2182 int vnc_display_open(DisplayState *ds, const char *display)
2183 {
2184 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2185 const char *options;
2186 int password = 0;
2187 int reverse = 0;
2188 int to_port = 0;
2189 #ifdef CONFIG_VNC_TLS
2190 int tls = 0, x509 = 0;
2191 #endif
2192 #ifdef CONFIG_VNC_SASL
2193 int sasl = 0;
2194 int saslErr;
2195 #endif
2196 int acl = 0;
2197
2198 if (!vnc_display)
2199 return -1;
2200 vnc_display_close(ds);
2201 if (strcmp(display, "none") == 0)
2202 return 0;
2203
2204 if (!(vs->display = strdup(display)))
2205 return -1;
2206
2207 options = display;
2208 while ((options = strchr(options, ','))) {
2209 options++;
2210 if (strncmp(options, "password", 8) == 0) {
2211 password = 1; /* Require password auth */
2212 } else if (strncmp(options, "reverse", 7) == 0) {
2213 reverse = 1;
2214 } else if (strncmp(options, "to=", 3) == 0) {
2215 to_port = atoi(options+3) + 5900;
2216 #ifdef CONFIG_VNC_SASL
2217 } else if (strncmp(options, "sasl", 4) == 0) {
2218 sasl = 1; /* Require SASL auth */
2219 #endif
2220 #ifdef CONFIG_VNC_TLS
2221 } else if (strncmp(options, "tls", 3) == 0) {
2222 tls = 1; /* Require TLS */
2223 } else if (strncmp(options, "x509", 4) == 0) {
2224 char *start, *end;
2225 x509 = 1; /* Require x509 certificates */
2226 if (strncmp(options, "x509verify", 10) == 0)
2227 vs->tls.x509verify = 1; /* ...and verify client certs */
2228
2229 /* Now check for 'x509=/some/path' postfix
2230 * and use that to setup x509 certificate/key paths */
2231 start = strchr(options, '=');
2232 end = strchr(options, ',');
2233 if (start && (!end || (start < end))) {
2234 int len = end ? end-(start+1) : strlen(start+1);
2235 char *path = qemu_strndup(start + 1, len);
2236
2237 VNC_DEBUG("Trying certificate path '%s'\n", path);
2238 if (vnc_tls_set_x509_creds_dir(vs, path) < 0) {
2239 fprintf(stderr, "Failed to find x509 certificates/keys in %s\n", path);
2240 qemu_free(path);
2241 qemu_free(vs->display);
2242 vs->display = NULL;
2243 return -1;
2244 }
2245 qemu_free(path);
2246 } else {
2247 fprintf(stderr, "No certificate path provided\n");
2248 qemu_free(vs->display);
2249 vs->display = NULL;
2250 return -1;
2251 }
2252 #endif
2253 } else if (strncmp(options, "acl", 3) == 0) {
2254 acl = 1;
2255 }
2256 }
2257
2258 #ifdef CONFIG_VNC_TLS
2259 if (acl && x509 && vs->tls.x509verify) {
2260 if (!(vs->tls.acl = qemu_acl_init("vnc.x509dname"))) {
2261 fprintf(stderr, "Failed to create x509 dname ACL\n");
2262 exit(1);
2263 }
2264 }
2265 #endif
2266 #ifdef CONFIG_VNC_SASL
2267 if (acl && sasl) {
2268 if (!(vs->sasl.acl = qemu_acl_init("vnc.username"))) {
2269 fprintf(stderr, "Failed to create username ACL\n");
2270 exit(1);
2271 }
2272 }
2273 #endif
2274
2275 /*
2276 * Combinations we support here:
2277 *
2278 * - no-auth (clear text, no auth)
2279 * - password (clear text, weak auth)
2280 * - sasl (encrypt, good auth *IF* using Kerberos via GSSAPI)
2281 * - tls (encrypt, weak anonymous creds, no auth)
2282 * - tls + password (encrypt, weak anonymous creds, weak auth)
2283 * - tls + sasl (encrypt, weak anonymous creds, good auth)
2284 * - tls + x509 (encrypt, good x509 creds, no auth)
2285 * - tls + x509 + password (encrypt, good x509 creds, weak auth)
2286 * - tls + x509 + sasl (encrypt, good x509 creds, good auth)
2287 *
2288 * NB1. TLS is a stackable auth scheme.
2289 * NB2. the x509 schemes have option to validate a client cert dname
2290 */
2291 if (password) {
2292 #ifdef CONFIG_VNC_TLS
2293 if (tls) {
2294 vs->auth = VNC_AUTH_VENCRYPT;
2295 if (x509) {
2296 VNC_DEBUG("Initializing VNC server with x509 password auth\n");
2297 vs->subauth = VNC_AUTH_VENCRYPT_X509VNC;
2298 } else {
2299 VNC_DEBUG("Initializing VNC server with TLS password auth\n");
2300 vs->subauth = VNC_AUTH_VENCRYPT_TLSVNC;
2301 }
2302 } else {
2303 #endif /* CONFIG_VNC_TLS */
2304 VNC_DEBUG("Initializing VNC server with password auth\n");
2305 vs->auth = VNC_AUTH_VNC;
2306 #ifdef CONFIG_VNC_TLS
2307 vs->subauth = VNC_AUTH_INVALID;
2308 }
2309 #endif /* CONFIG_VNC_TLS */
2310 #ifdef CONFIG_VNC_SASL
2311 } else if (sasl) {
2312 #ifdef CONFIG_VNC_TLS
2313 if (tls) {
2314 vs->auth = VNC_AUTH_VENCRYPT;
2315 if (x509) {
2316 VNC_DEBUG("Initializing VNC server with x509 SASL auth\n");
2317 vs->subauth = VNC_AUTH_VENCRYPT_X509SASL;
2318 } else {
2319 VNC_DEBUG("Initializing VNC server with TLS SASL auth\n");
2320 vs->subauth = VNC_AUTH_VENCRYPT_TLSSASL;
2321 }
2322 } else {
2323 #endif /* CONFIG_VNC_TLS */
2324 VNC_DEBUG("Initializing VNC server with SASL auth\n");
2325 vs->auth = VNC_AUTH_SASL;
2326 #ifdef CONFIG_VNC_TLS
2327 vs->subauth = VNC_AUTH_INVALID;
2328 }
2329 #endif /* CONFIG_VNC_TLS */
2330 #endif /* CONFIG_VNC_SASL */
2331 } else {
2332 #ifdef CONFIG_VNC_TLS
2333 if (tls) {
2334 vs->auth = VNC_AUTH_VENCRYPT;
2335 if (x509) {
2336 VNC_DEBUG("Initializing VNC server with x509 no auth\n");
2337 vs->subauth = VNC_AUTH_VENCRYPT_X509NONE;
2338 } else {
2339 VNC_DEBUG("Initializing VNC server with TLS no auth\n");
2340 vs->subauth = VNC_AUTH_VENCRYPT_TLSNONE;
2341 }
2342 } else {
2343 #endif
2344 VNC_DEBUG("Initializing VNC server with no auth\n");
2345 vs->auth = VNC_AUTH_NONE;
2346 #ifdef CONFIG_VNC_TLS
2347 vs->subauth = VNC_AUTH_INVALID;
2348 }
2349 #endif
2350 }
2351
2352 #ifdef CONFIG_VNC_SASL
2353 if ((saslErr = sasl_server_init(NULL, "qemu")) != SASL_OK) {
2354 fprintf(stderr, "Failed to initialize SASL auth %s",
2355 sasl_errstring(saslErr, NULL, NULL));
2356 free(vs->display);
2357 vs->display = NULL;
2358 return -1;
2359 }
2360 #endif
2361
2362 if (reverse) {
2363 /* connect to viewer */
2364 if (strncmp(display, "unix:", 5) == 0)
2365 vs->lsock = unix_connect(display+5);
2366 else
2367 vs->lsock = inet_connect(display, SOCK_STREAM);
2368 if (-1 == vs->lsock) {
2369 free(vs->display);
2370 vs->display = NULL;
2371 return -1;
2372 } else {
2373 int csock = vs->lsock;
2374 vs->lsock = -1;
2375 vnc_connect(vs, csock);
2376 }
2377 return 0;
2378
2379 } else {
2380 /* listen for connects */
2381 char *dpy;
2382 dpy = qemu_malloc(256);
2383 if (strncmp(display, "unix:", 5) == 0) {
2384 pstrcpy(dpy, 256, "unix:");
2385 vs->lsock = unix_listen(display+5, dpy+5, 256-5);
2386 } else {
2387 vs->lsock = inet_listen(display, dpy, 256, SOCK_STREAM, 5900);
2388 }
2389 if (-1 == vs->lsock) {
2390 free(dpy);
2391 return -1;
2392 } else {
2393 free(vs->display);
2394 vs->display = dpy;
2395 }
2396 }
2397 return qemu_set_fd_handler2(vs->lsock, NULL, vnc_listen_read, NULL, vs);
2398 }
Patches shipped by Fedora