?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
use KVM_UPSTREAM for ppc.
[qemu-kvm/fedora.git] / vnc.c
blob119c98206c5559a429af6c25c742fab8e1881b6b
1 /*
2 * QEMU VNC display driver
3 *
4 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5 * Copyright (C) 2006 Fabrice Bellard
6 * Copyright (C) 2009 Red Hat, Inc
7 *
8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to deal
10 * in the Software without restriction, including without limitation the rights
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12 * copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
14 *
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
17 *
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24 * THE SOFTWARE.
25 */
26
27 #include "vnc.h"
28 #include "sysemu.h"
29 #include "qemu_socket.h"
30 #include "qemu-timer.h"
31 #include "acl.h"
32
33 #define VNC_REFRESH_INTERVAL (1000 / 30)
34
35 #include "vnc_keysym.h"
36 #include "d3des.h"
37
38 #define count_bits(c, v) { \
39 for (c = 0; v; v >>= 1) \
40 { \
41 c += v & 1; \
42 } \
43 }
44
45
46 static VncDisplay *vnc_display; /* needed for info vnc */
47 static DisplayChangeListener *dcl;
48
49 static char *addr_to_string(const char *format,
50 struct sockaddr_storage *sa,
51 socklen_t salen) {
52 char *addr;
53 char host[NI_MAXHOST];
54 char serv[NI_MAXSERV];
55 int err;
56
57 if ((err = getnameinfo((struct sockaddr *)sa, salen,
58 host, sizeof(host),
59 serv, sizeof(serv),
60 NI_NUMERICHOST | NI_NUMERICSERV)) != 0) {
61 VNC_DEBUG("Cannot resolve address %d: %s\n",
62 err, gai_strerror(err));
63 return NULL;
64 }
65
66 if (asprintf(&addr, format, host, serv) < 0)
67 return NULL;
68
69 return addr;
70 }
71
72
73 char *vnc_socket_local_addr(const char *format, int fd) {
74 struct sockaddr_storage sa;
75 socklen_t salen;
76
77 salen = sizeof(sa);
78 if (getsockname(fd, (struct sockaddr*)&sa, &salen) < 0)
79 return NULL;
80
81 return addr_to_string(format, &sa, salen);
82 }
83
84
85 char *vnc_socket_remote_addr(const char *format, int fd) {
86 struct sockaddr_storage sa;
87 socklen_t salen;
88
89 salen = sizeof(sa);
90 if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0)
91 return NULL;
92
93 return addr_to_string(format, &sa, salen);
94 }
95
96 static const char *vnc_auth_name(VncDisplay *vd) {
97 switch (vd->auth) {
98 case VNC_AUTH_INVALID:
99 return "invalid";
100 case VNC_AUTH_NONE:
101 return "none";
102 case VNC_AUTH_VNC:
103 return "vnc";
104 case VNC_AUTH_RA2:
105 return "ra2";
106 case VNC_AUTH_RA2NE:
107 return "ra2ne";
108 case VNC_AUTH_TIGHT:
109 return "tight";
110 case VNC_AUTH_ULTRA:
111 return "ultra";
112 case VNC_AUTH_TLS:
113 return "tls";
114 case VNC_AUTH_VENCRYPT:
115 #ifdef CONFIG_VNC_TLS
116 switch (vd->subauth) {
117 case VNC_AUTH_VENCRYPT_PLAIN:
118 return "vencrypt+plain";
119 case VNC_AUTH_VENCRYPT_TLSNONE:
120 return "vencrypt+tls+none";
121 case VNC_AUTH_VENCRYPT_TLSVNC:
122 return "vencrypt+tls+vnc";
123 case VNC_AUTH_VENCRYPT_TLSPLAIN:
124 return "vencrypt+tls+plain";
125 case VNC_AUTH_VENCRYPT_X509NONE:
126 return "vencrypt+x509+none";
127 case VNC_AUTH_VENCRYPT_X509VNC:
128 return "vencrypt+x509+vnc";
129 case VNC_AUTH_VENCRYPT_X509PLAIN:
130 return "vencrypt+x509+plain";
131 case VNC_AUTH_VENCRYPT_TLSSASL:
132 return "vencrypt+tls+sasl";
133 case VNC_AUTH_VENCRYPT_X509SASL:
134 return "vencrypt+x509+sasl";
135 default:
136 return "vencrypt";
137 }
138 #else
139 return "vencrypt";
140 #endif
141 case VNC_AUTH_SASL:
142 return "sasl";
143 }
144 return "unknown";
145 }
146
147 #define VNC_SOCKET_FORMAT_PRETTY "local %s:%s"
148
149 static void do_info_vnc_client(VncState *client)
150 {
151 char *clientAddr =
152 vnc_socket_remote_addr(" address: %s:%s\n",
153 client->csock);
154 if (!clientAddr)
155 return;
156
157 term_puts("Client:\n");
158 term_puts(clientAddr);
159 free(clientAddr);
160
161 #ifdef CONFIG_VNC_TLS
162 if (client->tls.session &&
163 client->tls.dname)
164 term_printf(" x509 dname: %s\n", client->tls.dname);
165 else
166 term_puts(" x509 dname: none\n");
167 #endif
168 #ifdef CONFIG_VNC_SASL
169 if (client->sasl.conn &&
170 client->sasl.username)
171 term_printf(" username: %s\n", client->sasl.username);
172 else
173 term_puts(" username: none\n");
174 #endif
175 }
176
177 void do_info_vnc(void)
178 {
179 if (vnc_display == NULL || vnc_display->display == NULL) {
180 term_printf("Server: disabled\n");
181 } else {
182 char *serverAddr = vnc_socket_local_addr(" address: %s:%s\n",
183 vnc_display->lsock);
184
185 if (!serverAddr)
186 return;
187
188 term_puts("Server:\n");
189 term_puts(serverAddr);
190 free(serverAddr);
191 term_printf(" auth: %s\n", vnc_auth_name(vnc_display));
192
193 if (vnc_display->clients) {
194 VncState *client = vnc_display->clients;
195 while (client) {
196 do_info_vnc_client(client);
197 client = client->next;
198 }
199 } else {
200 term_printf("Client: none\n");
201 }
202 }
203 }
204
205 static inline uint32_t vnc_has_feature(VncState *vs, int feature) {
206 return (vs->features & (1 << feature));
207 }
208
209 /* TODO
210 1) Get the queue working for IO.
211 2) there is some weirdness when using the -S option (the screen is grey
212 and not totally invalidated
213 3) resolutions > 1024
214 */
215
216 static void vnc_update_client(void *opaque);
217 static void vnc_disconnect_start(VncState *vs);
218 static void vnc_disconnect_finish(VncState *vs);
219
220 static void vnc_colordepth(VncState *vs);
221
222 static inline void vnc_set_bit(uint32_t *d, int k)
223 {
224 d[k >> 5] |= 1 << (k & 0x1f);
225 }
226
227 static inline void vnc_clear_bit(uint32_t *d, int k)
228 {
229 d[k >> 5] &= ~(1 << (k & 0x1f));
230 }
231
232 static inline void vnc_set_bits(uint32_t *d, int n, int nb_words)
233 {
234 int j;
235
236 j = 0;
237 while (n >= 32) {
238 d[j++] = -1;
239 n -= 32;
240 }
241 if (n > 0)
242 d[j++] = (1 << n) - 1;
243 while (j < nb_words)
244 d[j++] = 0;
245 }
246
247 static inline int vnc_get_bit(const uint32_t *d, int k)
248 {
249 return (d[k >> 5] >> (k & 0x1f)) & 1;
250 }
251
252 static inline int vnc_and_bits(const uint32_t *d1, const uint32_t *d2,
253 int nb_words)
254 {
255 int i;
256 for(i = 0; i < nb_words; i++) {
257 if ((d1[i] & d2[i]) != 0)
258 return 1;
259 }
260 return 0;
261 }
262
263 static void vnc_update(VncState *vs, int x, int y, int w, int h)
264 {
265 int i;
266
267 h += y;
268
269 /* round x down to ensure the loop only spans one 16-pixel block per,
270 iteration. otherwise, if (x % 16) != 0, the last iteration may span
271 two 16-pixel blocks but we only mark the first as dirty
272 */
273 w += (x % 16);
274 x -= (x % 16);
275
276 x = MIN(x, vs->serverds.width);
277 y = MIN(y, vs->serverds.height);
278 w = MIN(x + w, vs->serverds.width) - x;
279 h = MIN(h, vs->serverds.height);
280
281 for (; y < h; y++)
282 for (i = 0; i < w; i += 16)
283 vnc_set_bit(vs->dirty_row[y], (x + i) / 16);
284 }
285
286 static void vnc_dpy_update(DisplayState *ds, int x, int y, int w, int h)
287 {
288 VncDisplay *vd = ds->opaque;
289 VncState *vs = vd->clients;
290 while (vs != NULL) {
291 vnc_update(vs, x, y, w, h);
292 vs = vs->next;
293 }
294 }
295
296 static void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
297 int32_t encoding)
298 {
299 vnc_write_u16(vs, x);
300 vnc_write_u16(vs, y);
301 vnc_write_u16(vs, w);
302 vnc_write_u16(vs, h);
303
304 vnc_write_s32(vs, encoding);
305 }
306
307 void buffer_reserve(Buffer *buffer, size_t len)
308 {
309 if ((buffer->capacity - buffer->offset) < len) {
310 buffer->capacity += (len + 1024);
311 buffer->buffer = qemu_realloc(buffer->buffer, buffer->capacity);
312 if (buffer->buffer == NULL) {
313 fprintf(stderr, "vnc: out of memory\n");
314 exit(1);
315 }
316 }
317 }
318
319 int buffer_empty(Buffer *buffer)
320 {
321 return buffer->offset == 0;
322 }
323
324 uint8_t *buffer_end(Buffer *buffer)
325 {
326 return buffer->buffer + buffer->offset;
327 }
328
329 void buffer_reset(Buffer *buffer)
330 {
331 buffer->offset = 0;
332 }
333
334 void buffer_append(Buffer *buffer, const void *data, size_t len)
335 {
336 memcpy(buffer->buffer + buffer->offset, data, len);
337 buffer->offset += len;
338 }
339
340 static void vnc_resize(VncState *vs)
341 {
342 DisplayState *ds = vs->ds;
343
344 int size_changed;
345
346 vs->old_data = qemu_realloc(vs->old_data, ds_get_linesize(ds) * ds_get_height(ds));
347
348 if (vs->old_data == NULL) {
349 fprintf(stderr, "vnc: memory allocation failed\n");
350 exit(1);
351 }
352
353 if (ds_get_bytes_per_pixel(ds) != vs->serverds.pf.bytes_per_pixel)
354 console_color_init(ds);
355 vnc_colordepth(vs);
356 size_changed = ds_get_width(ds) != vs->serverds.width ||
357 ds_get_height(ds) != vs->serverds.height;
358 vs->serverds = *(ds->surface);
359 if (size_changed) {
360 if (vs->csock != -1 && vnc_has_feature(vs, VNC_FEATURE_RESIZE)) {
361 vnc_write_u8(vs, 0); /* msg id */
362 vnc_write_u8(vs, 0);
363 vnc_write_u16(vs, 1); /* number of rects */
364 vnc_framebuffer_update(vs, 0, 0, ds_get_width(ds), ds_get_height(ds),
365 VNC_ENCODING_DESKTOPRESIZE);
366 vnc_flush(vs);
367 }
368 }
369
370 memset(vs->dirty_row, 0xFF, sizeof(vs->dirty_row));
371 memset(vs->old_data, 42, ds_get_linesize(vs->ds) * ds_get_height(vs->ds));
372 }
373
374 static void vnc_dpy_resize(DisplayState *ds)
375 {
376 VncDisplay *vd = ds->opaque;
377 VncState *vs = vd->clients;
378 while (vs != NULL) {
379 vnc_resize(vs);
380 vs = vs->next;
381 }
382 }
383
384 /* fastest code */
385 static void vnc_write_pixels_copy(VncState *vs, void *pixels, int size)
386 {
387 vnc_write(vs, pixels, size);
388 }
389
390 /* slowest but generic code. */
391 static void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
392 {
393 uint8_t r, g, b;
394
395 r = ((((v & vs->serverds.pf.rmask) >> vs->serverds.pf.rshift) << vs->clientds.pf.rbits) >>
396 vs->serverds.pf.rbits);
397 g = ((((v & vs->serverds.pf.gmask) >> vs->serverds.pf.gshift) << vs->clientds.pf.gbits) >>
398 vs->serverds.pf.gbits);
399 b = ((((v & vs->serverds.pf.bmask) >> vs->serverds.pf.bshift) << vs->clientds.pf.bbits) >>
400 vs->serverds.pf.bbits);
401 v = (r << vs->clientds.pf.rshift) |
402 (g << vs->clientds.pf.gshift) |
403 (b << vs->clientds.pf.bshift);
404 switch(vs->clientds.pf.bytes_per_pixel) {
405 case 1:
406 buf[0] = v;
407 break;
408 case 2:
409 if (vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) {
410 buf[0] = v >> 8;
411 buf[1] = v;
412 } else {
413 buf[1] = v >> 8;
414 buf[0] = v;
415 }
416 break;
417 default:
418 case 4:
419 if (vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) {
420 buf[0] = v >> 24;
421 buf[1] = v >> 16;
422 buf[2] = v >> 8;
423 buf[3] = v;
424 } else {
425 buf[3] = v >> 24;
426 buf[2] = v >> 16;
427 buf[1] = v >> 8;
428 buf[0] = v;
429 }
430 break;
431 }
432 }
433
434 static void vnc_write_pixels_generic(VncState *vs, void *pixels1, int size)
435 {
436 uint8_t buf[4];
437
438 if (vs->serverds.pf.bytes_per_pixel == 4) {
439 uint32_t *pixels = pixels1;
440 int n, i;
441 n = size >> 2;
442 for(i = 0; i < n; i++) {
443 vnc_convert_pixel(vs, buf, pixels[i]);
444 vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
445 }
446 } else if (vs->serverds.pf.bytes_per_pixel == 2) {
447 uint16_t *pixels = pixels1;
448 int n, i;
449 n = size >> 1;
450 for(i = 0; i < n; i++) {
451 vnc_convert_pixel(vs, buf, pixels[i]);
452 vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
453 }
454 } else if (vs->serverds.pf.bytes_per_pixel == 1) {
455 uint8_t *pixels = pixels1;
456 int n, i;
457 n = size;
458 for(i = 0; i < n; i++) {
459 vnc_convert_pixel(vs, buf, pixels[i]);
460 vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
461 }
462 } else {
463 fprintf(stderr, "vnc_write_pixels_generic: VncState color depth not supported\n");
464 }
465 }
466
467 static void send_framebuffer_update_raw(VncState *vs, int x, int y, int w, int h)
468 {
469 int i;
470 uint8_t *row;
471
472 row = ds_get_data(vs->ds) + y * ds_get_linesize(vs->ds) + x * ds_get_bytes_per_pixel(vs->ds);
473 for (i = 0; i < h; i++) {
474 vs->write_pixels(vs, row, w * ds_get_bytes_per_pixel(vs->ds));
475 row += ds_get_linesize(vs->ds);
476 }
477 }
478
479 static void hextile_enc_cord(uint8_t *ptr, int x, int y, int w, int h)
480 {
481 ptr[0] = ((x & 0x0F) << 4) | (y & 0x0F);
482 ptr[1] = (((w - 1) & 0x0F) << 4) | ((h - 1) & 0x0F);
483 }
484
485 #define BPP 8
486 #include "vnchextile.h"
487 #undef BPP
488
489 #define BPP 16
490 #include "vnchextile.h"
491 #undef BPP
492
493 #define BPP 32
494 #include "vnchextile.h"
495 #undef BPP
496
497 #define GENERIC
498 #define BPP 8
499 #include "vnchextile.h"
500 #undef BPP
501 #undef GENERIC
502
503 #define GENERIC
504 #define BPP 16
505 #include "vnchextile.h"
506 #undef BPP
507 #undef GENERIC
508
509 #define GENERIC
510 #define BPP 32
511 #include "vnchextile.h"
512 #undef BPP
513 #undef GENERIC
514
515 static void send_framebuffer_update_hextile(VncState *vs, int x, int y, int w, int h)
516 {
517 int i, j;
518 int has_fg, has_bg;
519 uint8_t *last_fg, *last_bg;
520
521 last_fg = (uint8_t *) qemu_malloc(vs->serverds.pf.bytes_per_pixel);
522 last_bg = (uint8_t *) qemu_malloc(vs->serverds.pf.bytes_per_pixel);
523 has_fg = has_bg = 0;
524 for (j = y; j < (y + h); j += 16) {
525 for (i = x; i < (x + w); i += 16) {
526 vs->send_hextile_tile(vs, i, j,
527 MIN(16, x + w - i), MIN(16, y + h - j),
528 last_bg, last_fg, &has_bg, &has_fg);
529 }
530 }
531 free(last_fg);
532 free(last_bg);
533
534 }
535
536 static void vnc_zlib_init(VncState *vs)
537 {
538 int i;
539 for (i=0; i<(sizeof(vs->zlib_stream) / sizeof(z_stream)); i++)
540 vs->zlib_stream[i].opaque = NULL;
541 }
542
543 static void vnc_zlib_start(VncState *vs)
544 {
545 buffer_reset(&vs->zlib);
546
547 // make the output buffer be the zlib buffer, so we can compress it later
548 vs->zlib_tmp = vs->output;
549 vs->output = vs->zlib;
550 }
551
552 static int vnc_zlib_stop(VncState *vs, int stream_id)
553 {
554 z_streamp zstream = &vs->zlib_stream[stream_id];
555 int previous_out;
556
557 // switch back to normal output/zlib buffers
558 vs->zlib = vs->output;
559 vs->output = vs->zlib_tmp;
560
561 // compress the zlib buffer
562
563 // initialize the stream
564 // XXX need one stream per session
565 if (zstream->opaque != vs) {
566 int err;
567
568 VNC_DEBUG("VNC: initializing zlib stream %d\n", stream_id);
569 VNC_DEBUG("VNC: opaque = %p | vs = %p\n", zstream->opaque, vs);
570 zstream->zalloc = Z_NULL;
571 zstream->zfree = Z_NULL;
572
573 err = deflateInit2(zstream, vs->tight_compression, Z_DEFLATED, MAX_WBITS,
574 MAX_MEM_LEVEL, Z_DEFAULT_STRATEGY);
575
576 if (err != Z_OK) {
577 fprintf(stderr, "VNC: error initializing zlib\n");
578 return -1;
579 }
580
581 zstream->opaque = vs;
582 }
583
584 // XXX what to do if tight_compression changed in between?
585
586 // reserve memory in output buffer
587 buffer_reserve(&vs->output, vs->zlib.offset + 64);
588
589 // set pointers
590 zstream->next_in = vs->zlib.buffer;
591 zstream->avail_in = vs->zlib.offset;
592 zstream->next_out = vs->output.buffer + vs->output.offset;
593 zstream->avail_out = vs->output.capacity - vs->output.offset;
594 zstream->data_type = Z_BINARY;
595 previous_out = zstream->total_out;
596
597 // start encoding
598 if (deflate(zstream, Z_SYNC_FLUSH) != Z_OK) {
599 fprintf(stderr, "VNC: error during zlib compression\n");
600 return -1;
601 }
602
603 vs->output.offset = vs->output.capacity - zstream->avail_out;
604 return zstream->total_out - previous_out;
605 }
606
607 static void send_framebuffer_update_zlib(VncState *vs, int x, int y, int w, int h)
608 {
609 int old_offset, new_offset, bytes_written;
610
611 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_ZLIB);
612
613 // remember where we put in the follow-up size
614 old_offset = vs->output.offset;
615 vnc_write_s32(vs, 0);
616
617 // compress the stream
618 vnc_zlib_start(vs);
619 send_framebuffer_update_raw(vs, x, y, w, h);
620 bytes_written = vnc_zlib_stop(vs, 0);
621
622 if (bytes_written == -1)
623 return;
624
625 // hack in the size
626 new_offset = vs->output.offset;
627 vs->output.offset = old_offset;
628 vnc_write_u32(vs, bytes_written);
629 vs->output.offset = new_offset;
630 }
631
632 static void send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
633 {
634 switch(vs->vnc_encoding) {
635 case VNC_ENCODING_ZLIB:
636 send_framebuffer_update_zlib(vs, x, y, w, h);
637 break;
638 case VNC_ENCODING_HEXTILE:
639 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE);
640 send_framebuffer_update_hextile(vs, x, y, w, h);
641 break;
642 default:
643 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW);
644 send_framebuffer_update_raw(vs, x, y, w, h);
645 break;
646 }
647 }
648
649 static void vnc_copy(VncState *vs, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
650 {
651
652 uint8_t *src_row;
653 uint8_t *dst_row;
654 int y,pitch,depth;
655
656 vnc_update_client(vs);
657
658 /* send bitblit op to the vnc client */
659 vnc_write_u8(vs, 0); /* msg id */
660 vnc_write_u8(vs, 0);
661 vnc_write_u16(vs, 1); /* number of rects */
662 vnc_framebuffer_update(vs, dst_x, dst_y, w, h, VNC_ENCODING_COPYRECT);
663 vnc_write_u16(vs, src_x);
664 vnc_write_u16(vs, src_y);
665 vnc_flush(vs);
666
667 /* do bitblit op on the local surface too */
668 pitch = ds_get_linesize(vs->ds);
669 depth = ds_get_bytes_per_pixel(vs->ds);
670 src_row = ds_get_data(vs->ds) + pitch * src_y + depth * src_x;
671 dst_row = ds_get_data(vs->ds) + pitch * dst_y + depth * dst_x;
672 if (dst_y > src_y) {
673 /* copy backwards */
674 src_row += pitch * (h-1);
675 dst_row += pitch * (h-1);
676 pitch = -pitch;
677 }
678 for (y = 0; y < h; y++) {
679 memmove(dst_row, src_row, w * depth);
680 src_row += pitch;
681 dst_row += pitch;
682 }
683 }
684
685 static void vnc_dpy_copy(DisplayState *ds, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
686 {
687 VncDisplay *vd = ds->opaque;
688 VncState *vs, *vn;
689
690 for (vs = vd->clients; vs != NULL; vs = vn) {
691 vn = vs->next;
692 if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
693 vnc_update_client(vs);
694 /* vs might be free()ed here */
695 }
696 }
697
698 for (vs = vd->clients; vs != NULL; vs = vs->next) {
699 if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT))
700 vnc_copy(vs, src_x, src_y, dst_x, dst_y, w, h);
701 else /* TODO */
702 vnc_update(vs, dst_x, dst_y, w, h);
703 }
704 }
705
706 static int find_dirty_height(VncState *vs, int y, int last_x, int x)
707 {
708 int h;
709
710 for (h = 1; h < (vs->serverds.height - y); h++) {
711 int tmp_x;
712 if (!vnc_get_bit(vs->dirty_row[y + h], last_x))
713 break;
714 for (tmp_x = last_x; tmp_x < x; tmp_x++)
715 vnc_clear_bit(vs->dirty_row[y + h], tmp_x);
716 }
717
718 return h;
719 }
720
721 static void vnc_update_client(void *opaque)
722 {
723 VncState *vs = opaque;
724 if (vs->need_update && vs->csock != -1) {
725 int y;
726 uint8_t *row;
727 char *old_row;
728 uint32_t width_mask[VNC_DIRTY_WORDS];
729 int n_rectangles;
730 int saved_offset;
731 int has_dirty = 0;
732
733 vga_hw_update();
734
735 vnc_set_bits(width_mask, (ds_get_width(vs->ds) / 16), VNC_DIRTY_WORDS);
736
737 /* Walk through the dirty map and eliminate tiles that
738 really aren't dirty */
739 row = ds_get_data(vs->ds);
740 old_row = vs->old_data;
741
742 for (y = 0; y < ds_get_height(vs->ds); y++) {
743 if (vnc_and_bits(vs->dirty_row[y], width_mask, VNC_DIRTY_WORDS)) {
744 int x;
745 uint8_t *ptr;
746 char *old_ptr;
747
748 ptr = row;
749 old_ptr = (char*)old_row;
750
751 for (x = 0; x < ds_get_width(vs->ds); x += 16) {
752 if (memcmp(old_ptr, ptr, 16 * ds_get_bytes_per_pixel(vs->ds)) == 0) {
753 vnc_clear_bit(vs->dirty_row[y], (x / 16));
754 } else {
755 has_dirty = 1;
756 memcpy(old_ptr, ptr, 16 * ds_get_bytes_per_pixel(vs->ds));
757 }
758
759 ptr += 16 * ds_get_bytes_per_pixel(vs->ds);
760 old_ptr += 16 * ds_get_bytes_per_pixel(vs->ds);
761 }
762 }
763
764 row += ds_get_linesize(vs->ds);
765 old_row += ds_get_linesize(vs->ds);
766 }
767
768 if (!has_dirty && !vs->audio_cap) {
769 qemu_mod_timer(vs->timer, qemu_get_clock(rt_clock) + VNC_REFRESH_INTERVAL);
770 return;
771 }
772
773 /* Count rectangles */
774 n_rectangles = 0;
775 vnc_write_u8(vs, 0); /* msg id */
776 vnc_write_u8(vs, 0);
777 saved_offset = vs->output.offset;
778 vnc_write_u16(vs, 0);
779
780 for (y = 0; y < vs->serverds.height; y++) {
781 int x;
782 int last_x = -1;
783 for (x = 0; x < vs->serverds.width / 16; x++) {
784 if (vnc_get_bit(vs->dirty_row[y], x)) {
785 if (last_x == -1) {
786 last_x = x;
787 }
788 vnc_clear_bit(vs->dirty_row[y], x);
789 } else {
790 if (last_x != -1) {
791 int h = find_dirty_height(vs, y, last_x, x);
792 send_framebuffer_update(vs, last_x * 16, y, (x - last_x) * 16, h);
793 n_rectangles++;
794 }
795 last_x = -1;
796 }
797 }
798 if (last_x != -1) {
799 int h = find_dirty_height(vs, y, last_x, x);
800 send_framebuffer_update(vs, last_x * 16, y, (x - last_x) * 16, h);
801 n_rectangles++;
802 }
803 }
804 vs->output.buffer[saved_offset] = (n_rectangles >> 8) & 0xFF;
805 vs->output.buffer[saved_offset + 1] = n_rectangles & 0xFF;
806 vnc_flush(vs);
807
808 }
809
810 if (vs->csock != -1) {
811 qemu_mod_timer(vs->timer, qemu_get_clock(rt_clock) + VNC_REFRESH_INTERVAL);
812 } else {
813 vnc_disconnect_finish(vs);
814 }
815
816 }
817
818 /* audio */
819 static void audio_capture_notify(void *opaque, audcnotification_e cmd)
820 {
821 VncState *vs = opaque;
822
823 switch (cmd) {
824 case AUD_CNOTIFY_DISABLE:
825 vnc_write_u8(vs, 255);
826 vnc_write_u8(vs, 1);
827 vnc_write_u16(vs, 0);
828 vnc_flush(vs);
829 break;
830
831 case AUD_CNOTIFY_ENABLE:
832 vnc_write_u8(vs, 255);
833 vnc_write_u8(vs, 1);
834 vnc_write_u16(vs, 1);
835 vnc_flush(vs);
836 break;
837 }
838 }
839
840 static void audio_capture_destroy(void *opaque)
841 {
842 }
843
844 static void audio_capture(void *opaque, void *buf, int size)
845 {
846 VncState *vs = opaque;
847
848 vnc_write_u8(vs, 255);
849 vnc_write_u8(vs, 1);
850 vnc_write_u16(vs, 2);
851 vnc_write_u32(vs, size);
852 vnc_write(vs, buf, size);
853 vnc_flush(vs);
854 }
855
856 static void audio_add(VncState *vs)
857 {
858 struct audio_capture_ops ops;
859
860 if (vs->audio_cap) {
861 term_printf ("audio already running\n");
862 return;
863 }
864
865 ops.notify = audio_capture_notify;
866 ops.destroy = audio_capture_destroy;
867 ops.capture = audio_capture;
868
869 vs->audio_cap = AUD_add_capture(NULL, &vs->as, &ops, vs);
870 if (!vs->audio_cap) {
871 term_printf ("Failed to add audio capture\n");
872 }
873 }
874
875 static void audio_del(VncState *vs)
876 {
877 if (vs->audio_cap) {
878 AUD_del_capture(vs->audio_cap, vs);
879 vs->audio_cap = NULL;
880 }
881 }
882
883 static void vnc_disconnect_start(VncState *vs)
884 {
885 if (vs->csock == -1)
886 return;
887 qemu_set_fd_handler2(vs->csock, NULL, NULL, NULL, NULL);
888 closesocket(vs->csock);
889 vs->csock = -1;
890 }
891
892 static void vnc_disconnect_finish(VncState *vs)
893 {
894 qemu_del_timer(vs->timer);
895 qemu_free_timer(vs->timer);
896 if (vs->input.buffer) qemu_free(vs->input.buffer);
897 if (vs->output.buffer) qemu_free(vs->output.buffer);
898 #ifdef CONFIG_VNC_TLS
899 vnc_tls_client_cleanup(vs);
900 #endif /* CONFIG_VNC_TLS */
901 #ifdef CONFIG_VNC_SASL
902 vnc_sasl_client_cleanup(vs);
903 #endif /* CONFIG_VNC_SASL */
904 audio_del(vs);
905
906 VncState *p, *parent = NULL;
907 for (p = vs->vd->clients; p != NULL; p = p->next) {
908 if (p == vs) {
909 if (parent)
910 parent->next = p->next;
911 else
912 vs->vd->clients = p->next;
913 break;
914 }
915 parent = p;
916 }
917 if (!vs->vd->clients)
918 dcl->idle = 1;
919
920 qemu_free(vs->old_data);
921 qemu_free(vs);
922 }
923
924 int vnc_client_io_error(VncState *vs, int ret, int last_errno)
925 {
926 if (ret == 0 || ret == -1) {
927 if (ret == -1) {
928 switch (last_errno) {
929 case EINTR:
930 case EAGAIN:
931 #ifdef _WIN32
932 case WSAEWOULDBLOCK:
933 #endif
934 return 0;
935 default:
936 break;
937 }
938 }
939
940 VNC_DEBUG("Closing down client sock %d %d\n", ret, ret < 0 ? last_errno : 0);
941 vnc_disconnect_start(vs);
942
943 return 0;
944 }
945 return ret;
946 }
947
948
949 void vnc_client_error(VncState *vs)
950 {
951 VNC_DEBUG("Closing down client sock: protocol error\n");
952 vnc_disconnect_start(vs);
953 }
954
955
956 /*
957 * Called to write a chunk of data to the client socket. The data may
958 * be the raw data, or may have already been encoded by SASL.
959 * The data will be written either straight onto the socket, or
960 * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled
961 *
962 * NB, it is theoretically possible to have 2 layers of encryption,
963 * both SASL, and this TLS layer. It is highly unlikely in practice
964 * though, since SASL encryption will typically be a no-op if TLS
965 * is active
966 *
967 * Returns the number of bytes written, which may be less than
968 * the requested 'datalen' if the socket would block. Returns
969 * -1 on error, and disconnects the client socket.
970 */
971 long vnc_client_write_buf(VncState *vs, const uint8_t *data, size_t datalen)
972 {
973 long ret;
974 #ifdef CONFIG_VNC_TLS
975 if (vs->tls.session) {
976 ret = gnutls_write(vs->tls.session, data, datalen);
977 if (ret < 0) {
978 if (ret == GNUTLS_E_AGAIN)
979 errno = EAGAIN;
980 else
981 errno = EIO;
982 ret = -1;
983 }
984 } else
985 #endif /* CONFIG_VNC_TLS */
986 ret = send(vs->csock, data, datalen, 0);
987 VNC_DEBUG("Wrote wire %p %d -> %ld\n", data, datalen, ret);
988 return vnc_client_io_error(vs, ret, socket_error());
989 }
990
991
992 /*
993 * Called to write buffered data to the client socket, when not
994 * using any SASL SSF encryption layers. Will write as much data
995 * as possible without blocking. If all buffered data is written,
996 * will switch the FD poll() handler back to read monitoring.
997 *
998 * Returns the number of bytes written, which may be less than
999 * the buffered output data if the socket would block. Returns
1000 * -1 on error, and disconnects the client socket.
1001 */
1002 static long vnc_client_write_plain(VncState *vs)
1003 {
1004 long ret;
1005
1006 #ifdef CONFIG_VNC_SASL
1007 VNC_DEBUG("Write Plain: Pending output %p size %d offset %d. Wait SSF %d\n",
1008 vs->output.buffer, vs->output.capacity, vs->output.offset,
1009 vs->sasl.waitWriteSSF);
1010
1011 if (vs->sasl.conn &&
1012 vs->sasl.runSSF &&
1013 vs->sasl.waitWriteSSF) {
1014 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF);
1015 if (ret)
1016 vs->sasl.waitWriteSSF -= ret;
1017 } else
1018 #endif /* CONFIG_VNC_SASL */
1019 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset);
1020 if (!ret)
1021 return 0;
1022
1023 memmove(vs->output.buffer, vs->output.buffer + ret, (vs->output.offset - ret));
1024 vs->output.offset -= ret;
1025
1026 if (vs->output.offset == 0) {
1027 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
1028 }
1029
1030 return ret;
1031 }
1032
1033
1034 /*
1035 * First function called whenever there is data to be written to
1036 * the client socket. Will delegate actual work according to whether
1037 * SASL SSF layers are enabled (thus requiring encryption calls)
1038 */
1039 void vnc_client_write(void *opaque)
1040 {
1041 long ret;
1042 VncState *vs = opaque;
1043
1044 #ifdef CONFIG_VNC_SASL
1045 if (vs->sasl.conn &&
1046 vs->sasl.runSSF &&
1047 !vs->sasl.waitWriteSSF)
1048 ret = vnc_client_write_sasl(vs);
1049 else
1050 #endif /* CONFIG_VNC_SASL */
1051 ret = vnc_client_write_plain(vs);
1052 }
1053
1054 void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting)
1055 {
1056 vs->read_handler = func;
1057 vs->read_handler_expect = expecting;
1058 }
1059
1060
1061 /*
1062 * Called to read a chunk of data from the client socket. The data may
1063 * be the raw data, or may need to be further decoded by SASL.
1064 * The data will be read either straight from to the socket, or
1065 * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1066 *
1067 * NB, it is theoretically possible to have 2 layers of encryption,
1068 * both SASL, and this TLS layer. It is highly unlikely in practice
1069 * though, since SASL encryption will typically be a no-op if TLS
1070 * is active
1071 *
1072 * Returns the number of bytes read, which may be less than
1073 * the requested 'datalen' if the socket would block. Returns
1074 * -1 on error, and disconnects the client socket.
1075 */
1076 long vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen)
1077 {
1078 long ret;
1079 #ifdef CONFIG_VNC_TLS
1080 if (vs->tls.session) {
1081 ret = gnutls_read(vs->tls.session, data, datalen);
1082 if (ret < 0) {
1083 if (ret == GNUTLS_E_AGAIN)
1084 errno = EAGAIN;
1085 else
1086 errno = EIO;
1087 ret = -1;
1088 }
1089 } else
1090 #endif /* CONFIG_VNC_TLS */
1091 ret = recv(vs->csock, data, datalen, 0);
1092 VNC_DEBUG("Read wire %p %d -> %ld\n", data, datalen, ret);
1093 return vnc_client_io_error(vs, ret, socket_error());
1094 }
1095
1096
1097 /*
1098 * Called to read data from the client socket to the input buffer,
1099 * when not using any SASL SSF encryption layers. Will read as much
1100 * data as possible without blocking.
1101 *
1102 * Returns the number of bytes read. Returns -1 on error, and
1103 * disconnects the client socket.
1104 */
1105 static long vnc_client_read_plain(VncState *vs)
1106 {
1107 int ret;
1108 VNC_DEBUG("Read plain %p size %d offset %d\n",
1109 vs->input.buffer, vs->input.capacity, vs->input.offset);
1110 buffer_reserve(&vs->input, 4096);
1111 ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096);
1112 if (!ret)
1113 return 0;
1114 vs->input.offset += ret;
1115 return ret;
1116 }
1117
1118
1119 /*
1120 * First function called whenever there is more data to be read from
1121 * the client socket. Will delegate actual work according to whether
1122 * SASL SSF layers are enabled (thus requiring decryption calls)
1123 */
1124 void vnc_client_read(void *opaque)
1125 {
1126 VncState *vs = opaque;
1127 long ret;
1128
1129 #ifdef CONFIG_VNC_SASL
1130 if (vs->sasl.conn && vs->sasl.runSSF)
1131 ret = vnc_client_read_sasl(vs);
1132 else
1133 #endif /* CONFIG_VNC_SASL */
1134 ret = vnc_client_read_plain(vs);
1135 if (!ret) {
1136 if (vs->csock == -1)
1137 vnc_disconnect_finish(vs);
1138 return;
1139 }
1140
1141 while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) {
1142 size_t len = vs->read_handler_expect;
1143 int ret;
1144
1145 ret = vs->read_handler(vs, vs->input.buffer, len);
1146 if (vs->csock == -1) {
1147 vnc_disconnect_finish(vs);
1148 return;
1149 }
1150
1151 if (!ret) {
1152 memmove(vs->input.buffer, vs->input.buffer + len, (vs->input.offset - len));
1153 vs->input.offset -= len;
1154 } else {
1155 vs->read_handler_expect = ret;
1156 }
1157 }
1158 }
1159
1160 void vnc_write(VncState *vs, const void *data, size_t len)
1161 {
1162 buffer_reserve(&vs->output, len);
1163
1164 if (vs->csock != -1 && buffer_empty(&vs->output)) {
1165 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, vnc_client_write, vs);
1166 }
1167
1168 buffer_append(&vs->output, data, len);
1169 }
1170
1171 void vnc_write_s32(VncState *vs, int32_t value)
1172 {
1173 vnc_write_u32(vs, *(uint32_t *)&value);
1174 }
1175
1176 void vnc_write_u32(VncState *vs, uint32_t value)
1177 {
1178 uint8_t buf[4];
1179
1180 buf[0] = (value >> 24) & 0xFF;
1181 buf[1] = (value >> 16) & 0xFF;
1182 buf[2] = (value >> 8) & 0xFF;
1183 buf[3] = value & 0xFF;
1184
1185 vnc_write(vs, buf, 4);
1186 }
1187
1188 void vnc_write_u16(VncState *vs, uint16_t value)
1189 {
1190 uint8_t buf[2];
1191
1192 buf[0] = (value >> 8) & 0xFF;
1193 buf[1] = value & 0xFF;
1194
1195 vnc_write(vs, buf, 2);
1196 }
1197
1198 void vnc_write_u8(VncState *vs, uint8_t value)
1199 {
1200 vnc_write(vs, (char *)&value, 1);
1201 }
1202
1203 void vnc_flush(VncState *vs)
1204 {
1205 if (vs->csock != -1 && vs->output.offset)
1206 vnc_client_write(vs);
1207 }
1208
1209 uint8_t read_u8(uint8_t *data, size_t offset)
1210 {
1211 return data[offset];
1212 }
1213
1214 uint16_t read_u16(uint8_t *data, size_t offset)
1215 {
1216 return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF);
1217 }
1218
1219 int32_t read_s32(uint8_t *data, size_t offset)
1220 {
1221 return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) |
1222 (data[offset + 2] << 8) | data[offset + 3]);
1223 }
1224
1225 uint32_t read_u32(uint8_t *data, size_t offset)
1226 {
1227 return ((data[offset] << 24) | (data[offset + 1] << 16) |
1228 (data[offset + 2] << 8) | data[offset + 3]);
1229 }
1230
1231 static void client_cut_text(VncState *vs, size_t len, uint8_t *text)
1232 {
1233 }
1234
1235 static void check_pointer_type_change(VncState *vs, int absolute)
1236 {
1237 if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) {
1238 vnc_write_u8(vs, 0);
1239 vnc_write_u8(vs, 0);
1240 vnc_write_u16(vs, 1);
1241 vnc_framebuffer_update(vs, absolute, 0,
1242 ds_get_width(vs->ds), ds_get_height(vs->ds),
1243 VNC_ENCODING_POINTER_TYPE_CHANGE);
1244 vnc_flush(vs);
1245 }
1246 vs->absolute = absolute;
1247 }
1248
1249 static void pointer_event(VncState *vs, int button_mask, int x, int y)
1250 {
1251 int buttons = 0;
1252 int dz = 0;
1253
1254 if (button_mask & 0x01)
1255 buttons |= MOUSE_EVENT_LBUTTON;
1256 if (button_mask & 0x02)
1257 buttons |= MOUSE_EVENT_MBUTTON;
1258 if (button_mask & 0x04)
1259 buttons |= MOUSE_EVENT_RBUTTON;
1260 if (button_mask & 0x08)
1261 dz = -1;
1262 if (button_mask & 0x10)
1263 dz = 1;
1264
1265 if (vs->absolute) {
1266 kbd_mouse_event(x * 0x7FFF / (ds_get_width(vs->ds) - 1),
1267 y * 0x7FFF / (ds_get_height(vs->ds) - 1),
1268 dz, buttons);
1269 } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) {
1270 x -= 0x7FFF;
1271 y -= 0x7FFF;
1272
1273 kbd_mouse_event(x, y, dz, buttons);
1274 } else {
1275 if (vs->last_x != -1)
1276 kbd_mouse_event(x - vs->last_x,
1277 y - vs->last_y,
1278 dz, buttons);
1279 vs->last_x = x;
1280 vs->last_y = y;
1281 }
1282
1283 check_pointer_type_change(vs, kbd_mouse_is_absolute());
1284 }
1285
1286 static void reset_keys(VncState *vs)
1287 {
1288 int i;
1289 for(i = 0; i < 256; i++) {
1290 if (vs->modifiers_state[i]) {
1291 if (i & 0x80)
1292 kbd_put_keycode(0xe0);
1293 kbd_put_keycode(i | 0x80);
1294 vs->modifiers_state[i] = 0;
1295 }
1296 }
1297 }
1298
1299 static void press_key(VncState *vs, int keysym)
1300 {
1301 kbd_put_keycode(keysym2scancode(vs->vd->kbd_layout, keysym) & 0x7f);
1302 kbd_put_keycode(keysym2scancode(vs->vd->kbd_layout, keysym) | 0x80);
1303 }
1304
1305 static void do_key_event(VncState *vs, int down, int keycode, int sym)
1306 {
1307 /* QEMU console switch */
1308 switch(keycode) {
1309 case 0x2a: /* Left Shift */
1310 case 0x36: /* Right Shift */
1311 case 0x1d: /* Left CTRL */
1312 case 0x9d: /* Right CTRL */
1313 case 0x38: /* Left ALT */
1314 case 0xb8: /* Right ALT */
1315 if (down)
1316 vs->modifiers_state[keycode] = 1;
1317 else
1318 vs->modifiers_state[keycode] = 0;
1319 break;
1320 case 0x02 ... 0x0a: /* '1' to '9' keys */
1321 if (down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) {
1322 /* Reset the modifiers sent to the current console */
1323 reset_keys(vs);
1324 console_select(keycode - 0x02);
1325 return;
1326 }
1327 break;
1328 case 0x3a: /* CapsLock */
1329 case 0x45: /* NumLock */
1330 if (!down)
1331 vs->modifiers_state[keycode] ^= 1;
1332 break;
1333 }
1334
1335 if (keycode_is_keypad(vs->vd->kbd_layout, keycode)) {
1336 /* If the numlock state needs to change then simulate an additional
1337 keypress before sending this one. This will happen if the user
1338 toggles numlock away from the VNC window.
1339 */
1340 if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) {
1341 if (!vs->modifiers_state[0x45]) {
1342 vs->modifiers_state[0x45] = 1;
1343 press_key(vs, 0xff7f);
1344 }
1345 } else {
1346 if (vs->modifiers_state[0x45]) {
1347 vs->modifiers_state[0x45] = 0;
1348 press_key(vs, 0xff7f);
1349 }
1350 }
1351 }
1352
1353 if (is_graphic_console()) {
1354 if (keycode & 0x80)
1355 kbd_put_keycode(0xe0);
1356 if (down)
1357 kbd_put_keycode(keycode & 0x7f);
1358 else
1359 kbd_put_keycode(keycode | 0x80);
1360 } else {
1361 /* QEMU console emulation */
1362 if (down) {
1363 switch (keycode) {
1364 case 0x2a: /* Left Shift */
1365 case 0x36: /* Right Shift */
1366 case 0x1d: /* Left CTRL */
1367 case 0x9d: /* Right CTRL */
1368 case 0x38: /* Left ALT */
1369 case 0xb8: /* Right ALT */
1370 break;
1371 case 0xc8:
1372 case 0x48:
1373 kbd_put_keysym(QEMU_KEY_UP);
1374 break;
1375 case 0xd0:
1376 case 0x50:
1377 kbd_put_keysym(QEMU_KEY_DOWN);
1378 break;
1379 case 0xcb:
1380 case 0x4b:
1381 kbd_put_keysym(QEMU_KEY_LEFT);
1382 break;
1383 case 0xcd:
1384 case 0x4d:
1385 kbd_put_keysym(QEMU_KEY_RIGHT);
1386 break;
1387 case 0xd3:
1388 case 0x53:
1389 kbd_put_keysym(QEMU_KEY_DELETE);
1390 break;
1391 case 0xc7:
1392 case 0x47:
1393 kbd_put_keysym(QEMU_KEY_HOME);
1394 break;
1395 case 0xcf:
1396 case 0x4f:
1397 kbd_put_keysym(QEMU_KEY_END);
1398 break;
1399 case 0xc9:
1400 case 0x49:
1401 kbd_put_keysym(QEMU_KEY_PAGEUP);
1402 break;
1403 case 0xd1:
1404 case 0x51:
1405 kbd_put_keysym(QEMU_KEY_PAGEDOWN);
1406 break;
1407 default:
1408 kbd_put_keysym(sym);
1409 break;
1410 }
1411 }
1412 }
1413 }
1414
1415 static void key_event(VncState *vs, int down, uint32_t sym)
1416 {
1417 int keycode;
1418
1419 if (sym >= 'A' && sym <= 'Z' && is_graphic_console())
1420 sym = sym - 'A' + 'a';
1421
1422 keycode = keysym2scancode(vs->vd->kbd_layout, sym & 0xFFFF);
1423 do_key_event(vs, down, keycode, sym);
1424 }
1425
1426 static void ext_key_event(VncState *vs, int down,
1427 uint32_t sym, uint16_t keycode)
1428 {
1429 /* if the user specifies a keyboard layout, always use it */
1430 if (keyboard_layout)
1431 key_event(vs, down, sym);
1432 else
1433 do_key_event(vs, down, keycode, sym);
1434 }
1435
1436 static void framebuffer_update_request(VncState *vs, int incremental,
1437 int x_position, int y_position,
1438 int w, int h)
1439 {
1440 if (x_position > ds_get_width(vs->ds))
1441 x_position = ds_get_width(vs->ds);
1442 if (y_position > ds_get_height(vs->ds))
1443 y_position = ds_get_height(vs->ds);
1444 if (x_position + w >= ds_get_width(vs->ds))
1445 w = ds_get_width(vs->ds) - x_position;
1446 if (y_position + h >= ds_get_height(vs->ds))
1447 h = ds_get_height(vs->ds) - y_position;
1448
1449 int i;
1450 vs->need_update = 1;
1451 if (!incremental) {
1452 char *old_row = vs->old_data + y_position * ds_get_linesize(vs->ds);
1453
1454 for (i = 0; i < h; i++) {
1455 vnc_set_bits(vs->dirty_row[y_position + i],
1456 (ds_get_width(vs->ds) / 16), VNC_DIRTY_WORDS);
1457 memset(old_row, 42, ds_get_width(vs->ds) * ds_get_bytes_per_pixel(vs->ds));
1458 old_row += ds_get_linesize(vs->ds);
1459 }
1460 }
1461 }
1462
1463 static void send_ext_key_event_ack(VncState *vs)
1464 {
1465 vnc_write_u8(vs, 0);
1466 vnc_write_u8(vs, 0);
1467 vnc_write_u16(vs, 1);
1468 vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
1469 VNC_ENCODING_EXT_KEY_EVENT);
1470 vnc_flush(vs);
1471 }
1472
1473 static void send_ext_audio_ack(VncState *vs)
1474 {
1475 vnc_write_u8(vs, 0);
1476 vnc_write_u8(vs, 0);
1477 vnc_write_u16(vs, 1);
1478 vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
1479 VNC_ENCODING_AUDIO);
1480 vnc_flush(vs);
1481 }
1482
1483 static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
1484 {
1485 int i;
1486 unsigned int enc = 0;
1487
1488 vnc_zlib_init(vs);
1489 vs->features = 0;
1490 vs->vnc_encoding = 0;
1491 vs->tight_compression = 9;
1492 vs->tight_quality = 9;
1493 vs->absolute = -1;
1494
1495 for (i = n_encodings - 1; i >= 0; i--) {
1496 enc = encodings[i];
1497 switch (enc) {
1498 case VNC_ENCODING_RAW:
1499 vs->vnc_encoding = enc;
1500 break;
1501 case VNC_ENCODING_COPYRECT:
1502 vs->features |= VNC_FEATURE_COPYRECT_MASK;
1503 break;
1504 case VNC_ENCODING_HEXTILE:
1505 vs->features |= VNC_FEATURE_HEXTILE_MASK;
1506 vs->vnc_encoding = enc;
1507 break;
1508 case VNC_ENCODING_ZLIB:
1509 vs->features |= VNC_FEATURE_ZLIB_MASK;
1510 vs->vnc_encoding = enc;
1511 break;
1512 case VNC_ENCODING_DESKTOPRESIZE:
1513 vs->features |= VNC_FEATURE_RESIZE_MASK;
1514 break;
1515 case VNC_ENCODING_POINTER_TYPE_CHANGE:
1516 vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK;
1517 break;
1518 case VNC_ENCODING_EXT_KEY_EVENT:
1519 send_ext_key_event_ack(vs);
1520 break;
1521 case VNC_ENCODING_AUDIO:
1522 send_ext_audio_ack(vs);
1523 break;
1524 case VNC_ENCODING_WMVi:
1525 vs->features |= VNC_FEATURE_WMVI_MASK;
1526 break;
1527 case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9:
1528 vs->tight_compression = (enc & 0x0F);
1529 break;
1530 case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9:
1531 vs->tight_quality = (enc & 0x0F);
1532 break;
1533 default:
1534 VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc);
1535 break;
1536 }
1537 }
1538
1539 check_pointer_type_change(vs, kbd_mouse_is_absolute());
1540 }
1541
1542 static void set_pixel_conversion(VncState *vs)
1543 {
1544 if ((vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) ==
1545 (vs->ds->surface->flags & QEMU_BIG_ENDIAN_FLAG) &&
1546 !memcmp(&(vs->clientds.pf), &(vs->ds->surface->pf), sizeof(PixelFormat))) {
1547 vs->write_pixels = vnc_write_pixels_copy;
1548 switch (vs->ds->surface->pf.bits_per_pixel) {
1549 case 8:
1550 vs->send_hextile_tile = send_hextile_tile_8;
1551 break;
1552 case 16:
1553 vs->send_hextile_tile = send_hextile_tile_16;
1554 break;
1555 case 32:
1556 vs->send_hextile_tile = send_hextile_tile_32;
1557 break;
1558 }
1559 } else {
1560 vs->write_pixels = vnc_write_pixels_generic;
1561 switch (vs->ds->surface->pf.bits_per_pixel) {
1562 case 8:
1563 vs->send_hextile_tile = send_hextile_tile_generic_8;
1564 break;
1565 case 16:
1566 vs->send_hextile_tile = send_hextile_tile_generic_16;
1567 break;
1568 case 32:
1569 vs->send_hextile_tile = send_hextile_tile_generic_32;
1570 break;
1571 }
1572 }
1573 }
1574
1575 static void set_pixel_format(VncState *vs,
1576 int bits_per_pixel, int depth,
1577 int big_endian_flag, int true_color_flag,
1578 int red_max, int green_max, int blue_max,
1579 int red_shift, int green_shift, int blue_shift)
1580 {
1581 if (!true_color_flag) {
1582 vnc_client_error(vs);
1583 return;
1584 }
1585
1586 vs->clientds = vs->serverds;
1587 vs->clientds.pf.rmax = red_max;
1588 count_bits(vs->clientds.pf.rbits, red_max);
1589 vs->clientds.pf.rshift = red_shift;
1590 vs->clientds.pf.rmask = red_max << red_shift;
1591 vs->clientds.pf.gmax = green_max;
1592 count_bits(vs->clientds.pf.gbits, green_max);
1593 vs->clientds.pf.gshift = green_shift;
1594 vs->clientds.pf.gmask = green_max << green_shift;
1595 vs->clientds.pf.bmax = blue_max;
1596 count_bits(vs->clientds.pf.bbits, blue_max);
1597 vs->clientds.pf.bshift = blue_shift;
1598 vs->clientds.pf.bmask = blue_max << blue_shift;
1599 vs->clientds.pf.bits_per_pixel = bits_per_pixel;
1600 vs->clientds.pf.bytes_per_pixel = bits_per_pixel / 8;
1601 vs->clientds.pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;
1602 vs->clientds.flags = big_endian_flag ? QEMU_BIG_ENDIAN_FLAG : 0x00;
1603
1604 set_pixel_conversion(vs);
1605
1606 vga_hw_invalidate();
1607 vga_hw_update();
1608 }
1609
1610 static void pixel_format_message (VncState *vs) {
1611 char pad[3] = { 0, 0, 0 };
1612
1613 vnc_write_u8(vs, vs->ds->surface->pf.bits_per_pixel); /* bits-per-pixel */
1614 vnc_write_u8(vs, vs->ds->surface->pf.depth); /* depth */
1615
1616 #ifdef WORDS_BIGENDIAN
1617 vnc_write_u8(vs, 1); /* big-endian-flag */
1618 #else
1619 vnc_write_u8(vs, 0); /* big-endian-flag */
1620 #endif
1621 vnc_write_u8(vs, 1); /* true-color-flag */
1622 vnc_write_u16(vs, vs->ds->surface->pf.rmax); /* red-max */
1623 vnc_write_u16(vs, vs->ds->surface->pf.gmax); /* green-max */
1624 vnc_write_u16(vs, vs->ds->surface->pf.bmax); /* blue-max */
1625 vnc_write_u8(vs, vs->ds->surface->pf.rshift); /* red-shift */
1626 vnc_write_u8(vs, vs->ds->surface->pf.gshift); /* green-shift */
1627 vnc_write_u8(vs, vs->ds->surface->pf.bshift); /* blue-shift */
1628 if (vs->ds->surface->pf.bits_per_pixel == 32)
1629 vs->send_hextile_tile = send_hextile_tile_32;
1630 else if (vs->ds->surface->pf.bits_per_pixel == 16)
1631 vs->send_hextile_tile = send_hextile_tile_16;
1632 else if (vs->ds->surface->pf.bits_per_pixel == 8)
1633 vs->send_hextile_tile = send_hextile_tile_8;
1634 vs->clientds = *(vs->ds->surface);
1635 vs->clientds.flags |= ~QEMU_ALLOCATED_FLAG;
1636 vs->write_pixels = vnc_write_pixels_copy;
1637
1638 vnc_write(vs, pad, 3); /* padding */
1639 }
1640
1641 static void vnc_dpy_setdata(DisplayState *ds)
1642 {
1643 /* We don't have to do anything */
1644 }
1645
1646 static void vnc_colordepth(VncState *vs)
1647 {
1648 if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) {
1649 /* Sending a WMVi message to notify the client*/
1650 vnc_write_u8(vs, 0); /* msg id */
1651 vnc_write_u8(vs, 0);
1652 vnc_write_u16(vs, 1); /* number of rects */
1653 vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds),
1654 ds_get_height(vs->ds), VNC_ENCODING_WMVi);
1655 pixel_format_message(vs);
1656 vnc_flush(vs);
1657 } else {
1658 set_pixel_conversion(vs);
1659 }
1660 }
1661
1662 static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
1663 {
1664 int i;
1665 uint16_t limit;
1666
1667 switch (data[0]) {
1668 case 0:
1669 if (len == 1)
1670 return 20;
1671
1672 set_pixel_format(vs, read_u8(data, 4), read_u8(data, 5),
1673 read_u8(data, 6), read_u8(data, 7),
1674 read_u16(data, 8), read_u16(data, 10),
1675 read_u16(data, 12), read_u8(data, 14),
1676 read_u8(data, 15), read_u8(data, 16));
1677 break;
1678 case 2:
1679 if (len == 1)
1680 return 4;
1681
1682 if (len == 4) {
1683 limit = read_u16(data, 2);
1684 if (limit > 0)
1685 return 4 + (limit * 4);
1686 } else
1687 limit = read_u16(data, 2);
1688
1689 for (i = 0; i < limit; i++) {
1690 int32_t val = read_s32(data, 4 + (i * 4));
1691 memcpy(data + 4 + (i * 4), &val, sizeof(val));
1692 }
1693
1694 set_encodings(vs, (int32_t *)(data + 4), limit);
1695 break;
1696 case 3:
1697 if (len == 1)
1698 return 10;
1699
1700 framebuffer_update_request(vs,
1701 read_u8(data, 1), read_u16(data, 2), read_u16(data, 4),
1702 read_u16(data, 6), read_u16(data, 8));
1703 break;
1704 case 4:
1705 if (len == 1)
1706 return 8;
1707
1708 key_event(vs, read_u8(data, 1), read_u32(data, 4));
1709 break;
1710 case 5:
1711 if (len == 1)
1712 return 6;
1713
1714 pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
1715 break;
1716 case 6:
1717 if (len == 1)
1718 return 8;
1719
1720 if (len == 8) {
1721 uint32_t dlen = read_u32(data, 4);
1722 if (dlen > 0)
1723 return 8 + dlen;
1724 }
1725
1726 client_cut_text(vs, read_u32(data, 4), data + 8);
1727 break;
1728 case 255:
1729 if (len == 1)
1730 return 2;
1731
1732 switch (read_u8(data, 1)) {
1733 case 0:
1734 if (len == 2)
1735 return 12;
1736
1737 ext_key_event(vs, read_u16(data, 2),
1738 read_u32(data, 4), read_u32(data, 8));
1739 break;
1740 case 1:
1741 if (len == 2)
1742 return 4;
1743
1744 switch (read_u16 (data, 2)) {
1745 case 0:
1746 audio_add(vs);
1747 break;
1748 case 1:
1749 audio_del(vs);
1750 break;
1751 case 2:
1752 if (len == 4)
1753 return 10;
1754 switch (read_u8(data, 4)) {
1755 case 0: vs->as.fmt = AUD_FMT_U8; break;
1756 case 1: vs->as.fmt = AUD_FMT_S8; break;
1757 case 2: vs->as.fmt = AUD_FMT_U16; break;
1758 case 3: vs->as.fmt = AUD_FMT_S16; break;
1759 case 4: vs->as.fmt = AUD_FMT_U32; break;
1760 case 5: vs->as.fmt = AUD_FMT_S32; break;
1761 default:
1762 printf("Invalid audio format %d\n", read_u8(data, 4));
1763 vnc_client_error(vs);
1764 break;
1765 }
1766 vs->as.nchannels = read_u8(data, 5);
1767 if (vs->as.nchannels != 1 && vs->as.nchannels != 2) {
1768 printf("Invalid audio channel coount %d\n",
1769 read_u8(data, 5));
1770 vnc_client_error(vs);
1771 break;
1772 }
1773 vs->as.freq = read_u32(data, 6);
1774 break;
1775 default:
1776 printf ("Invalid audio message %d\n", read_u8(data, 4));
1777 vnc_client_error(vs);
1778 break;
1779 }
1780 break;
1781
1782 default:
1783 printf("Msg: %d\n", read_u16(data, 0));
1784 vnc_client_error(vs);
1785 break;
1786 }
1787 break;
1788 default:
1789 printf("Msg: %d\n", data[0]);
1790 vnc_client_error(vs);
1791 break;
1792 }
1793
1794 vnc_read_when(vs, protocol_client_msg, 1);
1795 return 0;
1796 }
1797
1798 static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
1799 {
1800 char buf[1024];
1801 int size;
1802
1803 vnc_write_u16(vs, ds_get_width(vs->ds));
1804 vnc_write_u16(vs, ds_get_height(vs->ds));
1805
1806 pixel_format_message(vs);
1807
1808 if (qemu_name)
1809 size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
1810 else
1811 size = snprintf(buf, sizeof(buf), "QEMU");
1812
1813 vnc_write_u32(vs, size);
1814 vnc_write(vs, buf, size);
1815 vnc_flush(vs);
1816
1817 vnc_read_when(vs, protocol_client_msg, 1);
1818
1819 return 0;
1820 }
1821
1822 void start_client_init(VncState *vs)
1823 {
1824 vnc_read_when(vs, protocol_client_init, 1);
1825 }
1826
1827 static void make_challenge(VncState *vs)
1828 {
1829 int i;
1830
1831 srand(time(NULL)+getpid()+getpid()*987654+rand());
1832
1833 for (i = 0 ; i < sizeof(vs->challenge) ; i++)
1834 vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
1835 }
1836
1837 static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
1838 {
1839 unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
1840 int i, j, pwlen;
1841 unsigned char key[8];
1842
1843 if (!vs->vd->password || !vs->vd->password[0]) {
1844 VNC_DEBUG("No password configured on server");
1845 vnc_write_u32(vs, 1); /* Reject auth */
1846 if (vs->minor >= 8) {
1847 static const char err[] = "Authentication failed";
1848 vnc_write_u32(vs, sizeof(err));
1849 vnc_write(vs, err, sizeof(err));
1850 }
1851 vnc_flush(vs);
1852 vnc_client_error(vs);
1853 return 0;
1854 }
1855
1856 memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
1857
1858 /* Calculate the expected challenge response */
1859 pwlen = strlen(vs->vd->password);
1860 for (i=0; i<sizeof(key); i++)
1861 key[i] = i<pwlen ? vs->vd->password[i] : 0;
1862 deskey(key, EN0);
1863 for (j = 0; j < VNC_AUTH_CHALLENGE_SIZE; j += 8)
1864 des(response+j, response+j);
1865
1866 /* Compare expected vs actual challenge response */
1867 if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) {
1868 VNC_DEBUG("Client challenge reponse did not match\n");
1869 vnc_write_u32(vs, 1); /* Reject auth */
1870 if (vs->minor >= 8) {
1871 static const char err[] = "Authentication failed";
1872 vnc_write_u32(vs, sizeof(err));
1873 vnc_write(vs, err, sizeof(err));
1874 }
1875 vnc_flush(vs);
1876 vnc_client_error(vs);
1877 } else {
1878 VNC_DEBUG("Accepting VNC challenge response\n");
1879 vnc_write_u32(vs, 0); /* Accept auth */
1880 vnc_flush(vs);
1881
1882 start_client_init(vs);
1883 }
1884 return 0;
1885 }
1886
1887 void start_auth_vnc(VncState *vs)
1888 {
1889 make_challenge(vs);
1890 /* Send client a 'random' challenge */
1891 vnc_write(vs, vs->challenge, sizeof(vs->challenge));
1892 vnc_flush(vs);
1893
1894 vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge));
1895 }
1896
1897
1898 static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
1899 {
1900 /* We only advertise 1 auth scheme at a time, so client
1901 * must pick the one we sent. Verify this */
1902 if (data[0] != vs->vd->auth) { /* Reject auth */
1903 VNC_DEBUG("Reject auth %d because it didn't match advertized\n", (int)data[0]);
1904 vnc_write_u32(vs, 1);
1905 if (vs->minor >= 8) {
1906 static const char err[] = "Authentication failed";
1907 vnc_write_u32(vs, sizeof(err));
1908 vnc_write(vs, err, sizeof(err));
1909 }
1910 vnc_client_error(vs);
1911 } else { /* Accept requested auth */
1912 VNC_DEBUG("Client requested auth %d\n", (int)data[0]);
1913 switch (vs->vd->auth) {
1914 case VNC_AUTH_NONE:
1915 VNC_DEBUG("Accept auth none\n");
1916 if (vs->minor >= 8) {
1917 vnc_write_u32(vs, 0); /* Accept auth completion */
1918 vnc_flush(vs);
1919 }
1920 start_client_init(vs);
1921 break;
1922
1923 case VNC_AUTH_VNC:
1924 VNC_DEBUG("Start VNC auth\n");
1925 start_auth_vnc(vs);
1926 break;
1927
1928 #ifdef CONFIG_VNC_TLS
1929 case VNC_AUTH_VENCRYPT:
1930 VNC_DEBUG("Accept VeNCrypt auth\n");;
1931 start_auth_vencrypt(vs);
1932 break;
1933 #endif /* CONFIG_VNC_TLS */
1934
1935 #ifdef CONFIG_VNC_SASL
1936 case VNC_AUTH_SASL:
1937 VNC_DEBUG("Accept SASL auth\n");
1938 start_auth_sasl(vs);
1939 break;
1940 #endif /* CONFIG_VNC_SASL */
1941
1942 default: /* Should not be possible, but just in case */
1943 VNC_DEBUG("Reject auth %d server code bug\n", vs->vd->auth);
1944 vnc_write_u8(vs, 1);
1945 if (vs->minor >= 8) {
1946 static const char err[] = "Authentication failed";
1947 vnc_write_u32(vs, sizeof(err));
1948 vnc_write(vs, err, sizeof(err));
1949 }
1950 vnc_client_error(vs);
1951 }
1952 }
1953 return 0;
1954 }
1955
1956 static int protocol_version(VncState *vs, uint8_t *version, size_t len)
1957 {
1958 char local[13];
1959
1960 memcpy(local, version, 12);
1961 local[12] = 0;
1962
1963 if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) {
1964 VNC_DEBUG("Malformed protocol version %s\n", local);
1965 vnc_client_error(vs);
1966 return 0;
1967 }
1968 VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor);
1969 if (vs->major != 3 ||
1970 (vs->minor != 3 &&
1971 vs->minor != 4 &&
1972 vs->minor != 5 &&
1973 vs->minor != 7 &&
1974 vs->minor != 8)) {
1975 VNC_DEBUG("Unsupported client version\n");
1976 vnc_write_u32(vs, VNC_AUTH_INVALID);
1977 vnc_flush(vs);
1978 vnc_client_error(vs);
1979 return 0;
1980 }
1981 /* Some broken clients report v3.4 or v3.5, which spec requires to be treated
1982 * as equivalent to v3.3 by servers
1983 */
1984 if (vs->minor == 4 || vs->minor == 5)
1985 vs->minor = 3;
1986
1987 if (vs->minor == 3) {
1988 if (vs->vd->auth == VNC_AUTH_NONE) {
1989 VNC_DEBUG("Tell client auth none\n");
1990 vnc_write_u32(vs, vs->vd->auth);
1991 vnc_flush(vs);
1992 start_client_init(vs);
1993 } else if (vs->vd->auth == VNC_AUTH_VNC) {
1994 VNC_DEBUG("Tell client VNC auth\n");
1995 vnc_write_u32(vs, vs->vd->auth);
1996 vnc_flush(vs);
1997 start_auth_vnc(vs);
1998 } else {
1999 VNC_DEBUG("Unsupported auth %d for protocol 3.3\n", vs->vd->auth);
2000 vnc_write_u32(vs, VNC_AUTH_INVALID);
2001 vnc_flush(vs);
2002 vnc_client_error(vs);
2003 }
2004 } else {
2005 VNC_DEBUG("Telling client we support auth %d\n", vs->vd->auth);
2006 vnc_write_u8(vs, 1); /* num auth */
2007 vnc_write_u8(vs, vs->vd->auth);
2008 vnc_read_when(vs, protocol_client_auth, 1);
2009 vnc_flush(vs);
2010 }
2011
2012 return 0;
2013 }
2014
2015 static void vnc_connect(VncDisplay *vd, int csock)
2016 {
2017 VncState *vs = qemu_mallocz(sizeof(VncState));
2018 vs->csock = csock;
2019
2020 VNC_DEBUG("New client on socket %d\n", csock);
2021 dcl->idle = 0;
2022 socket_set_nonblock(vs->csock);
2023 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
2024
2025 vs->vd = vd;
2026 vs->ds = vd->ds;
2027 vs->timer = qemu_new_timer(rt_clock, vnc_update_client, vs);
2028 vs->last_x = -1;
2029 vs->last_y = -1;
2030
2031 vs->as.freq = 44100;
2032 vs->as.nchannels = 2;
2033 vs->as.fmt = AUD_FMT_S16;
2034 vs->as.endianness = 0;
2035
2036 vnc_resize(vs);
2037 vnc_write(vs, "RFB 003.008\n", 12);
2038 vnc_flush(vs);
2039 vnc_read_when(vs, protocol_version, 12);
2040 memset(vs->old_data, 0, ds_get_linesize(vs->ds) * ds_get_height(vs->ds));
2041 memset(vs->dirty_row, 0xFF, sizeof(vs->dirty_row));
2042 reset_keys(vs);
2043
2044 vs->next = vd->clients;
2045 vd->clients = vs;
2046
2047 vnc_update_client(vs);
2048 /* vs might be free()ed here */
2049 }
2050
2051 static void vnc_listen_read(void *opaque)
2052 {
2053 VncDisplay *vs = opaque;
2054 struct sockaddr_in addr;
2055 socklen_t addrlen = sizeof(addr);
2056
2057 /* Catch-up */
2058 vga_hw_update();
2059
2060 int csock = accept(vs->lsock, (struct sockaddr *)&addr, &addrlen);
2061 if (csock != -1) {
2062 vnc_connect(vs, csock);
2063 }
2064 }
2065
2066 void vnc_display_init(DisplayState *ds)
2067 {
2068 VncDisplay *vs = qemu_mallocz(sizeof(*vs));
2069
2070 dcl = qemu_mallocz(sizeof(DisplayChangeListener));
2071
2072 ds->opaque = vs;
2073 dcl->idle = 1;
2074 vnc_display = vs;
2075
2076 vs->lsock = -1;
2077
2078 vs->ds = ds;
2079
2080 if (keyboard_layout)
2081 vs->kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout);
2082 else
2083 vs->kbd_layout = init_keyboard_layout(name2keysym, "en-us");
2084
2085 if (!vs->kbd_layout)
2086 exit(1);
2087
2088 dcl->dpy_copy = vnc_dpy_copy;
2089 dcl->dpy_update = vnc_dpy_update;
2090 dcl->dpy_resize = vnc_dpy_resize;
2091 dcl->dpy_setdata = vnc_dpy_setdata;
2092 register_displaychangelistener(ds, dcl);
2093 }
2094
2095
2096 void vnc_display_close(DisplayState *ds)
2097 {
2098 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2099
2100 if (!vs)
2101 return;
2102 if (vs->display) {
2103 qemu_free(vs->display);
2104 vs->display = NULL;
2105 }
2106 if (vs->lsock != -1) {
2107 qemu_set_fd_handler2(vs->lsock, NULL, NULL, NULL, NULL);
2108 close(vs->lsock);
2109 vs->lsock = -1;
2110 }
2111 vs->auth = VNC_AUTH_INVALID;
2112 #ifdef CONFIG_VNC_TLS
2113 vs->subauth = VNC_AUTH_INVALID;
2114 vs->tls.x509verify = 0;
2115 #endif
2116 }
2117
2118 int vnc_display_password(DisplayState *ds, const char *password)
2119 {
2120 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2121
2122 if (vs->password) {
2123 qemu_free(vs->password);
2124 vs->password = NULL;
2125 }
2126 if (password && password[0]) {
2127 if (!(vs->password = qemu_strdup(password)))
2128 return -1;
2129 }
2130
2131 return 0;
2132 }
2133
2134 int vnc_display_open(DisplayState *ds, const char *display)
2135 {
2136 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2137 const char *options;
2138 int password = 0;
2139 int reverse = 0;
2140 int to_port = 0;
2141 #ifdef CONFIG_VNC_TLS
2142 int tls = 0, x509 = 0;
2143 #endif
2144 #ifdef CONFIG_VNC_SASL
2145 int sasl = 0;
2146 int saslErr;
2147 #endif
2148 int acl = 0;
2149
2150 if (!vnc_display)
2151 return -1;
2152 vnc_display_close(ds);
2153 if (strcmp(display, "none") == 0)
2154 return 0;
2155
2156 if (!(vs->display = strdup(display)))
2157 return -1;
2158
2159 options = display;
2160 while ((options = strchr(options, ','))) {
2161 options++;
2162 if (strncmp(options, "password", 8) == 0) {
2163 password = 1; /* Require password auth */
2164 } else if (strncmp(options, "reverse", 7) == 0) {
2165 reverse = 1;
2166 } else if (strncmp(options, "to=", 3) == 0) {
2167 to_port = atoi(options+3) + 5900;
2168 #ifdef CONFIG_VNC_SASL
2169 } else if (strncmp(options, "sasl", 4) == 0) {
2170 sasl = 1; /* Require SASL auth */
2171 #endif
2172 #ifdef CONFIG_VNC_TLS
2173 } else if (strncmp(options, "tls", 3) == 0) {
2174 tls = 1; /* Require TLS */
2175 } else if (strncmp(options, "x509", 4) == 0) {
2176 char *start, *end;
2177 x509 = 1; /* Require x509 certificates */
2178 if (strncmp(options, "x509verify", 10) == 0)
2179 vs->tls.x509verify = 1; /* ...and verify client certs */
2180
2181 /* Now check for 'x509=/some/path' postfix
2182 * and use that to setup x509 certificate/key paths */
2183 start = strchr(options, '=');
2184 end = strchr(options, ',');
2185 if (start && (!end || (start < end))) {
2186 int len = end ? end-(start+1) : strlen(start+1);
2187 char *path = qemu_strndup(start + 1, len);
2188
2189 VNC_DEBUG("Trying certificate path '%s'\n", path);
2190 if (vnc_tls_set_x509_creds_dir(vs, path) < 0) {
2191 fprintf(stderr, "Failed to find x509 certificates/keys in %s\n", path);
2192 qemu_free(path);
2193 qemu_free(vs->display);
2194 vs->display = NULL;
2195 return -1;
2196 }
2197 qemu_free(path);
2198 } else {
2199 fprintf(stderr, "No certificate path provided\n");
2200 qemu_free(vs->display);
2201 vs->display = NULL;
2202 return -1;
2203 }
2204 #endif
2205 } else if (strncmp(options, "acl", 3) == 0) {
2206 acl = 1;
2207 }
2208 }
2209
2210 #ifdef CONFIG_VNC_TLS
2211 if (acl && x509 && vs->tls.x509verify) {
2212 if (!(vs->tls.acl = qemu_acl_init("vnc.x509dname"))) {
2213 fprintf(stderr, "Failed to create x509 dname ACL\n");
2214 exit(1);
2215 }
2216 }
2217 #endif
2218 #ifdef CONFIG_VNC_SASL
2219 if (acl && sasl) {
2220 if (!(vs->sasl.acl = qemu_acl_init("vnc.username"))) {
2221 fprintf(stderr, "Failed to create username ACL\n");
2222 exit(1);
2223 }
2224 }
2225 #endif
2226
2227 /*
2228 * Combinations we support here:
2229 *
2230 * - no-auth (clear text, no auth)
2231 * - password (clear text, weak auth)
2232 * - sasl (encrypt, good auth *IF* using Kerberos via GSSAPI)
2233 * - tls (encrypt, weak anonymous creds, no auth)
2234 * - tls + password (encrypt, weak anonymous creds, weak auth)
2235 * - tls + sasl (encrypt, weak anonymous creds, good auth)
2236 * - tls + x509 (encrypt, good x509 creds, no auth)
2237 * - tls + x509 + password (encrypt, good x509 creds, weak auth)
2238 * - tls + x509 + sasl (encrypt, good x509 creds, good auth)
2239 *
2240 * NB1. TLS is a stackable auth scheme.
2241 * NB2. the x509 schemes have option to validate a client cert dname
2242 */
2243 if (password) {
2244 #ifdef CONFIG_VNC_TLS
2245 if (tls) {
2246 vs->auth = VNC_AUTH_VENCRYPT;
2247 if (x509) {
2248 VNC_DEBUG("Initializing VNC server with x509 password auth\n");
2249 vs->subauth = VNC_AUTH_VENCRYPT_X509VNC;
2250 } else {
2251 VNC_DEBUG("Initializing VNC server with TLS password auth\n");
2252 vs->subauth = VNC_AUTH_VENCRYPT_TLSVNC;
2253 }
2254 } else {
2255 #endif /* CONFIG_VNC_TLS */
2256 VNC_DEBUG("Initializing VNC server with password auth\n");
2257 vs->auth = VNC_AUTH_VNC;
2258 #ifdef CONFIG_VNC_TLS
2259 vs->subauth = VNC_AUTH_INVALID;
2260 }
2261 #endif /* CONFIG_VNC_TLS */
2262 #ifdef CONFIG_VNC_SASL
2263 } else if (sasl) {
2264 #ifdef CONFIG_VNC_TLS
2265 if (tls) {
2266 vs->auth = VNC_AUTH_VENCRYPT;
2267 if (x509) {
2268 VNC_DEBUG("Initializing VNC server with x509 SASL auth\n");
2269 vs->subauth = VNC_AUTH_VENCRYPT_X509SASL;
2270 } else {
2271 VNC_DEBUG("Initializing VNC server with TLS SASL auth\n");
2272 vs->subauth = VNC_AUTH_VENCRYPT_TLSSASL;
2273 }
2274 } else {
2275 #endif /* CONFIG_VNC_TLS */
2276 VNC_DEBUG("Initializing VNC server with SASL auth\n");
2277 vs->auth = VNC_AUTH_SASL;
2278 #ifdef CONFIG_VNC_TLS
2279 vs->subauth = VNC_AUTH_INVALID;
2280 }
2281 #endif /* CONFIG_VNC_TLS */
2282 #endif /* CONFIG_VNC_SASL */
2283 } else {
2284 #ifdef CONFIG_VNC_TLS
2285 if (tls) {
2286 vs->auth = VNC_AUTH_VENCRYPT;
2287 if (x509) {
2288 VNC_DEBUG("Initializing VNC server with x509 no auth\n");
2289 vs->subauth = VNC_AUTH_VENCRYPT_X509NONE;
2290 } else {
2291 VNC_DEBUG("Initializing VNC server with TLS no auth\n");
2292 vs->subauth = VNC_AUTH_VENCRYPT_TLSNONE;
2293 }
2294 } else {
2295 #endif
2296 VNC_DEBUG("Initializing VNC server with no auth\n");
2297 vs->auth = VNC_AUTH_NONE;
2298 #ifdef CONFIG_VNC_TLS
2299 vs->subauth = VNC_AUTH_INVALID;
2300 }
2301 #endif
2302 }
2303
2304 #ifdef CONFIG_VNC_SASL
2305 if ((saslErr = sasl_server_init(NULL, "qemu")) != SASL_OK) {
2306 fprintf(stderr, "Failed to initialize SASL auth %s",
2307 sasl_errstring(saslErr, NULL, NULL));
2308 free(vs->display);
2309 vs->display = NULL;
2310 return -1;
2311 }
2312 #endif
2313
2314 if (reverse) {
2315 /* connect to viewer */
2316 if (strncmp(display, "unix:", 5) == 0)
2317 vs->lsock = unix_connect(display+5);
2318 else
2319 vs->lsock = inet_connect(display, SOCK_STREAM);
2320 if (-1 == vs->lsock) {
2321 free(vs->display);
2322 vs->display = NULL;
2323 return -1;
2324 } else {
2325 int csock = vs->lsock;
2326 vs->lsock = -1;
2327 vnc_connect(vs, csock);
2328 }
2329 return 0;
2330
2331 } else {
2332 /* listen for connects */
2333 char *dpy;
2334 dpy = qemu_malloc(256);
2335 if (strncmp(display, "unix:", 5) == 0) {
2336 pstrcpy(dpy, 256, "unix:");
2337 vs->lsock = unix_listen(display+5, dpy+5, 256-5);
2338 } else {
2339 vs->lsock = inet_listen(display, dpy, 256, SOCK_STREAM, 5900);
2340 }
2341 if (-1 == vs->lsock) {
2342 free(dpy);
2343 return -1;
2344 } else {
2345 free(vs->display);
2346 vs->display = dpy;
2347 }
2348 }
2349 return qemu_set_fd_handler2(vs->lsock, NULL, vnc_listen_read, NULL, vs);
2350 }
Patches shipped by Fedora