[mirror_qemu.git] / ui / vnc-ws.c

/*
 * QEMU VNC display driver: Websockets support
 *
 * Copyright (C) 2010 Joel Martin
 * Copyright (C) 2012 Tim Hardeck
 *
 * This is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This software is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this software; if not, see <http://www.gnu.org/licenses/>.
 */

#include "vnc.h"
#include "qemu/main-loop.h"

#ifdef CONFIG_VNC_TLS
#include "qemu/sockets.h"

static int vncws_start_tls_handshake(struct VncState *vs)
{
    int ret = gnutls_handshake(vs->tls.session);

    if (ret < 0) {
        if (!gnutls_error_is_fatal(ret)) {
            VNC_DEBUG("Handshake interrupted (blocking)\n");
            if (!gnutls_record_get_direction(vs->tls.session)) {
                qemu_set_fd_handler(vs->csock, vncws_tls_handshake_io,
                                    NULL, vs);
            } else {
                qemu_set_fd_handler(vs->csock, NULL, vncws_tls_handshake_io,
                                    vs);
            }
            return 0;
        }
        VNC_DEBUG("Handshake failed %s\n", gnutls_strerror(ret));
        vnc_client_error(vs);
        return -1;
    }

    VNC_DEBUG("Handshake done, switching to TLS data mode\n");
    qemu_set_fd_handler2(vs->csock, NULL, vncws_handshake_read, NULL, vs);

    return 0;
}

void vncws_tls_handshake_io(void *opaque)
{
    struct VncState *vs = (struct VncState *)opaque;

    if (!vs->tls.session) {
        VNC_DEBUG("TLS Websocket setup\n");
        if (vnc_tls_client_setup(vs, vs->vd->tls.x509cert != NULL) < 0) {
            return;
        }
    }
    VNC_DEBUG("Handshake IO continue\n");
    vncws_start_tls_handshake(vs);
}
#endif /* CONFIG_VNC_TLS */

void vncws_handshake_read(void *opaque)
{
    VncState *vs = opaque;
    uint8_t *handshake_end;
    long ret;
    buffer_reserve(&vs->ws_input, 4096);
    ret = vnc_client_read_buf(vs, buffer_end(&vs->ws_input), 4096);

    if (!ret) {
        if (vs->csock == -1) {
            vnc_disconnect_finish(vs);
        }
        return;
    }
    vs->ws_input.offset += ret;

    handshake_end = (uint8_t *)g_strstr_len((char *)vs->ws_input.buffer,
            vs->ws_input.offset, WS_HANDSHAKE_END);
    if (handshake_end) {
        qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
        vncws_process_handshake(vs, vs->ws_input.buffer, vs->ws_input.offset);
        buffer_advance(&vs->ws_input, handshake_end - vs->ws_input.buffer +
                strlen(WS_HANDSHAKE_END));
    }
}


long vnc_client_read_ws(VncState *vs)
{
    int ret, err;
    uint8_t *payload;
    size_t payload_size, frame_size;
    VNC_DEBUG("Read websocket %p size %zd offset %zd\n", vs->ws_input.buffer,
            vs->ws_input.capacity, vs->ws_input.offset);
    buffer_reserve(&vs->ws_input, 4096);
    ret = vnc_client_read_buf(vs, buffer_end(&vs->ws_input), 4096);
    if (!ret) {
        return 0;
    }
    vs->ws_input.offset += ret;

    /* make sure that nothing is left in the ws_input buffer */
    do {
        err = vncws_decode_frame(&vs->ws_input, &payload,
                              &payload_size, &frame_size);
        if (err <= 0) {
            return err;
        }

        buffer_reserve(&vs->input, payload_size);
        buffer_append(&vs->input, payload, payload_size);

        buffer_advance(&vs->ws_input, frame_size);
    } while (vs->ws_input.offset > 0);

    return ret;
}

long vnc_client_write_ws(VncState *vs)
{
    long ret;
    VNC_DEBUG("Write WS: Pending output %p size %zd offset %zd\n",
              vs->output.buffer, vs->output.capacity, vs->output.offset);
    vncws_encode_frame(&vs->ws_output, vs->output.buffer, vs->output.offset);
    buffer_reset(&vs->output);
    ret = vnc_client_write_buf(vs, vs->ws_output.buffer, vs->ws_output.offset);
    if (!ret) {
        return 0;
    }

    buffer_advance(&vs->ws_output, ret);

    if (vs->ws_output.offset == 0) {
        qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
    }

    return ret;
}

static char *vncws_extract_handshake_entry(const char *handshake,
        size_t handshake_len, const char *name)
{
    char *begin, *end, *ret = NULL;
    char *line = g_strdup_printf("%s%s: ", WS_HANDSHAKE_DELIM, name);
    begin = g_strstr_len(handshake, handshake_len, line);
    if (begin != NULL) {
        begin += strlen(line);
        end = g_strstr_len(begin, handshake_len - (begin - handshake),
                WS_HANDSHAKE_DELIM);
        if (end != NULL) {
            ret = g_strndup(begin, end - begin);
        }
    }
    g_free(line);
    return ret;
}

static void vncws_send_handshake_response(VncState *vs, const char* key)
{
    char combined_key[WS_CLIENT_KEY_LEN + WS_GUID_LEN + 1];
    unsigned char hash[SHA1_DIGEST_LEN];
    size_t hash_size = sizeof(hash);
    char *accept = NULL, *response = NULL;
    gnutls_datum_t in;
    int ret;

    g_strlcpy(combined_key, key, WS_CLIENT_KEY_LEN + 1);
    g_strlcat(combined_key, WS_GUID, WS_CLIENT_KEY_LEN + WS_GUID_LEN + 1);

    /* hash and encode it */
    in.data = (void *)combined_key;
    in.size = WS_CLIENT_KEY_LEN + WS_GUID_LEN;
    ret = gnutls_fingerprint(GNUTLS_DIG_SHA1, &in, hash, &hash_size);
    if (ret == GNUTLS_E_SUCCESS && hash_size <= SHA1_DIGEST_LEN) {
        accept = g_base64_encode(hash, hash_size);
    }
    if (accept == NULL) {
        VNC_DEBUG("Hashing Websocket combined key failed\n");
        vnc_client_error(vs);
        return;
    }

    response = g_strdup_printf(WS_HANDSHAKE, accept);
    vnc_client_write_buf(vs, (const uint8_t *)response, strlen(response));

    g_free(accept);
    g_free(response);

    vs->encode_ws = 1;
    vnc_init_state(vs);
}

void vncws_process_handshake(VncState *vs, uint8_t *line, size_t size)
{
    char *protocols = vncws_extract_handshake_entry((const char *)line, size,
            "Sec-WebSocket-Protocol");
    char *version = vncws_extract_handshake_entry((const char *)line, size,
            "Sec-WebSocket-Version");
    char *key = vncws_extract_handshake_entry((const char *)line, size,
            "Sec-WebSocket-Key");

    if (protocols && version && key
            && g_strrstr(protocols, "binary")
            && !strcmp(version, WS_SUPPORTED_VERSION)
            && strlen(key) == WS_CLIENT_KEY_LEN) {
        vncws_send_handshake_response(vs, key);
    } else {
        VNC_DEBUG("Defective Websockets header or unsupported protocol\n");
        vnc_client_error(vs);
    }

    g_free(protocols);
    g_free(version);
    g_free(key);
}

void vncws_encode_frame(Buffer *output, const void *payload,
        const size_t payload_size)
{
    size_t header_size = 0;
    unsigned char opcode = WS_OPCODE_BINARY_FRAME;
    union {
        char buf[WS_HEAD_MAX_LEN];
        WsHeader ws;
    } header;

    if (!payload_size) {
        return;
    }

    header.ws.b0 = 0x80 | (opcode & 0x0f);
    if (payload_size <= 125) {
        header.ws.b1 = (uint8_t)payload_size;
        header_size = 2;
    } else if (payload_size < 65536) {
        header.ws.b1 = 0x7e;
        header.ws.u.s16.l16 = cpu_to_be16((uint16_t)payload_size);
        header_size = 4;
    } else {
        header.ws.b1 = 0x7f;
        header.ws.u.s64.l64 = cpu_to_be64(payload_size);
        header_size = 10;
    }

    buffer_reserve(output, header_size + payload_size);
    buffer_append(output, header.buf, header_size);
    buffer_append(output, payload, payload_size);
}

int vncws_decode_frame(Buffer *input, uint8_t **payload,
                           size_t *payload_size, size_t *frame_size)
{
    unsigned char opcode = 0, fin = 0, has_mask = 0;
    size_t header_size = 0;
    uint32_t *payload32;
    WsHeader *header = (WsHeader *)input->buffer;
    WsMask mask;
    int i;

    if (input->offset < WS_HEAD_MIN_LEN + 4) {
        /* header not complete */
        return 0;
    }

    fin = (header->b0 & 0x80) >> 7;
    opcode = header->b0 & 0x0f;
    has_mask = (header->b1 & 0x80) >> 7;
    *payload_size = header->b1 & 0x7f;

    if (opcode == WS_OPCODE_CLOSE) {
        /* disconnect */
        return -1;
    }

    /* Websocket frame sanity check:
     * * Websocket fragmentation is not supported.
     * * All  websockets frames sent by a client have to be masked.
     * * Only binary encoding is supported.
     */
    if (!fin || !has_mask || opcode != WS_OPCODE_BINARY_FRAME) {
        VNC_DEBUG("Received faulty/unsupported Websocket frame\n");
        return -2;
    }

    if (*payload_size < 126) {
        header_size = 6;
        mask = header->u.m;
    } else if (*payload_size == 126 && input->offset >= 8) {
        *payload_size = be16_to_cpu(header->u.s16.l16);
        header_size = 8;
        mask = header->u.s16.m16;
    } else if (*payload_size == 127 && input->offset >= 14) {
        *payload_size = be64_to_cpu(header->u.s64.l64);
        header_size = 14;
        mask = header->u.s64.m64;
    } else {
        /* header not complete */
        return 0;
    }

    *frame_size = header_size + *payload_size;

    if (input->offset < *frame_size) {
        /* frame not complete */
        return 0;
    }

    *payload = input->buffer + header_size;

    /* unmask frame */
    /* process 1 frame (32 bit op) */
    payload32 = (uint32_t *)(*payload);
    for (i = 0; i < *payload_size / 4; i++) {
        payload32[i] ^= mask.u;
    }
    /* process the remaining bytes (if any) */
    for (i *= 4; i < *payload_size; i++) {
        (*payload)[i] ^= mask.c[i % 4];
    }

    return 1;
}
Commit	Line	Data
7536ee4b TH	1	/*
	2	* QEMU VNC display driver: Websockets support
	3	*
	4	* Copyright (C) 2010 Joel Martin
	5	* Copyright (C) 2012 Tim Hardeck
	6	*
	7	* This is free software; you can redistribute it and/or modify
	8	* it under the terms of the GNU General Public License as published by
	9	* the Free Software Foundation; either version 2 of the License, or
	10	* (at your option) any later version.
	11	*
	12	* This software is distributed in the hope that it will be useful,
	13	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	14	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	15	* GNU General Public License for more details.
	16	*
	17	* You should have received a copy of the GNU General Public License
	18	* along with this software; if not, see <http://www.gnu.org/licenses/>.
	19	*/
	20
	21	#include "vnc.h"
6a1751b7	22	#include "qemu/main-loop.h"
7536ee4b	23
0057a0d5 TH	24	#ifdef CONFIG_VNC_TLS
	25	#include "qemu/sockets.h"
	26
0057a0d5 TH	27	static int vncws_start_tls_handshake(struct VncState *vs)
0057a0d5 TH	28	{
7b45a00d	29	int ret = gnutls_handshake(vs->tls.session);
0057a0d5 TH	30
	31	if (ret < 0) {
	32	if (!gnutls_error_is_fatal(ret)) {
	33	VNC_DEBUG("Handshake interrupted (blocking)\n");
7b45a00d	34	if (!gnutls_record_get_direction(vs->tls.session)) {
0057a0d5 TH	35	qemu_set_fd_handler(vs->csock, vncws_tls_handshake_io,
	36	NULL, vs);
	37	} else {
	38	qemu_set_fd_handler(vs->csock, NULL, vncws_tls_handshake_io,
	39	vs);
	40	}
	41	return 0;
	42	}
	43	VNC_DEBUG("Handshake failed %s\n", gnutls_strerror(ret));
	44	vnc_client_error(vs);
	45	return -1;
	46	}
	47
	48	VNC_DEBUG("Handshake done, switching to TLS data mode\n");
0057a0d5 TH	49	qemu_set_fd_handler2(vs->csock, NULL, vncws_handshake_read, NULL, vs);
	50
	51	return 0;
	52	}
	53
51941e46	54	void vncws_tls_handshake_io(void *opaque)
0057a0d5 TH	55	{
	56	struct VncState vs = (struct VncState )opaque;
	57
51941e46 DB	58	if (!vs->tls.session) {
	59	VNC_DEBUG("TLS Websocket setup\n");
	60	if (vnc_tls_client_setup(vs, vs->vd->tls.x509cert != NULL) < 0) {
	61	return;
0057a0d5	62	}
0057a0d5	63	}
51941e46 DB	64	VNC_DEBUG("Handshake IO continue\n");
51941e46 DB	65	vncws_start_tls_handshake(vs);
0057a0d5 TH	66	}
	67	#endif /* CONFIG_VNC_TLS */
	68
7536ee4b TH	69	void vncws_handshake_read(void *opaque)
	70	{
	71	VncState *vs = opaque;
	72	uint8_t *handshake_end;
	73	long ret;
	74	buffer_reserve(&vs->ws_input, 4096);
	75	ret = vnc_client_read_buf(vs, buffer_end(&vs->ws_input), 4096);
	76
	77	if (!ret) {
	78	if (vs->csock == -1) {
	79	vnc_disconnect_finish(vs);
	80	}
	81	return;
	82	}
	83	vs->ws_input.offset += ret;
	84
	85	handshake_end = (uint8_t )g_strstr_len((char )vs->ws_input.buffer,
	86	vs->ws_input.offset, WS_HANDSHAKE_END);
	87	if (handshake_end) {
	88	qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
	89	vncws_process_handshake(vs, vs->ws_input.buffer, vs->ws_input.offset);
	90	buffer_advance(&vs->ws_input, handshake_end - vs->ws_input.buffer +
	91	strlen(WS_HANDSHAKE_END));
	92	}
	93	}
	94
	95
	96	long vnc_client_read_ws(VncState *vs)
	97	{
	98	int ret, err;
	99	uint8_t *payload;
	100	size_t payload_size, frame_size;
	101	VNC_DEBUG("Read websocket %p size %zd offset %zd\n", vs->ws_input.buffer,
	102	vs->ws_input.capacity, vs->ws_input.offset);
	103	buffer_reserve(&vs->ws_input, 4096);
	104	ret = vnc_client_read_buf(vs, buffer_end(&vs->ws_input), 4096);
	105	if (!ret) {
	106	return 0;
	107	}
	108	vs->ws_input.offset += ret;
	109
	110	/* make sure that nothing is left in the ws_input buffer */
	111	do {
	112	err = vncws_decode_frame(&vs->ws_input, &payload,
	113	&payload_size, &frame_size);
	114	if (err <= 0) {
	115	return err;
	116	}
	117
	118	buffer_reserve(&vs->input, payload_size);
	119	buffer_append(&vs->input, payload, payload_size);
	120
	121	buffer_advance(&vs->ws_input, frame_size);
	122	} while (vs->ws_input.offset > 0);
	123
	124	return ret;
	125	}
	126
	127	long vnc_client_write_ws(VncState *vs)
	128	{
	129	long ret;
	130	VNC_DEBUG("Write WS: Pending output %p size %zd offset %zd\n",
	131	vs->output.buffer, vs->output.capacity, vs->output.offset);
	132	vncws_encode_frame(&vs->ws_output, vs->output.buffer, vs->output.offset);
133	buffer_reset(&vs->output);
134	ret = vnc_client_write_buf(vs, vs->ws_output.buffer, vs->ws_output.offset);
135	if (!ret) {
136	return 0;
137	}
138
139	buffer_advance(&vs->ws_output, ret);
140
141	if (vs->ws_output.offset == 0) {
142	qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
143	}
144
145	return ret;
146	}
147
148	static char vncws_extract_handshake_entry(const char handshake,
149	size_t handshake_len, const char *name)
150	{
151	char begin, end, *ret = NULL;
152	char *line = g_strdup_printf("%s%s: ", WS_HANDSHAKE_DELIM, name);
153	begin = g_strstr_len(handshake, handshake_len, line);
154	if (begin != NULL) {
155	begin += strlen(line);
156	end = g_strstr_len(begin, handshake_len - (begin - handshake),
157	WS_HANDSHAKE_DELIM);
158	if (end != NULL) {
159	ret = g_strndup(begin, end - begin);
160	}
161	}
162	g_free(line);
163	return ret;
164	}
165
166	static void vncws_send_handshake_response(VncState vs, const char key)
167	{
168	char combined_key[WS_CLIENT_KEY_LEN + WS_GUID_LEN + 1];
cfba8e6f MA	169	unsigned char hash[SHA1_DIGEST_LEN];
cfba8e6f MA	170	size_t hash_size = sizeof(hash);
7536ee4b TH	171	char accept = NULL, response = NULL;
7536ee4b TH	172	gnutls_datum_t in;
cfba8e6f	173	int ret;
7536ee4b TH	174
	175	g_strlcpy(combined_key, key, WS_CLIENT_KEY_LEN + 1);
	176	g_strlcat(combined_key, WS_GUID, WS_CLIENT_KEY_LEN + WS_GUID_LEN + 1);
	177
	178	/* hash and encode it */
	179	in.data = (void *)combined_key;
	180	in.size = WS_CLIENT_KEY_LEN + WS_GUID_LEN;
cfba8e6f MA	181	ret = gnutls_fingerprint(GNUTLS_DIG_SHA1, &in, hash, &hash_size);
	182	if (ret == GNUTLS_E_SUCCESS && hash_size <= SHA1_DIGEST_LEN) {
	183	accept = g_base64_encode(hash, hash_size);
7536ee4b TH	184	}
	185	if (accept == NULL) {
	186	VNC_DEBUG("Hashing Websocket combined key failed\n");
	187	vnc_client_error(vs);
	188	return;
	189	}
	190
	191	response = g_strdup_printf(WS_HANDSHAKE, accept);
b57489cf	192	vnc_client_write_buf(vs, (const uint8_t *)response, strlen(response));
7536ee4b TH	193
	194	g_free(accept);
	195	g_free(response);
	196
	197	vs->encode_ws = 1;
	198	vnc_init_state(vs);
	199	}
	200
	201	void vncws_process_handshake(VncState vs, uint8_t line, size_t size)
	202	{
	203	char protocols = vncws_extract_handshake_entry((const char )line, size,
	204	"Sec-WebSocket-Protocol");
	205	char version = vncws_extract_handshake_entry((const char )line, size,
	206	"Sec-WebSocket-Version");
	207	char key = vncws_extract_handshake_entry((const char )line, size,
	208	"Sec-WebSocket-Key");
	209
	210	if (protocols && version && key
	211	&& g_strrstr(protocols, "binary")
	212	&& !strcmp(version, WS_SUPPORTED_VERSION)
	213	&& strlen(key) == WS_CLIENT_KEY_LEN) {
	214	vncws_send_handshake_response(vs, key);
	215	} else {
	216	VNC_DEBUG("Defective Websockets header or unsupported protocol\n");
	217	vnc_client_error(vs);
	218	}
	219
	220	g_free(protocols);
	221	g_free(version);
	222	g_free(key);
	223	}
	224
	225	void vncws_encode_frame(Buffer output, const void payload,
	226	const size_t payload_size)
	227	{
	228	size_t header_size = 0;
	229	unsigned char opcode = WS_OPCODE_BINARY_FRAME;
	230	union {
	231	char buf[WS_HEAD_MAX_LEN];
	232	WsHeader ws;
	233	} header;
	234
	235	if (!payload_size) {
	236	return;
	237	}
	238
	239	header.ws.b0 = 0x80 \| (opcode & 0x0f);
	240	if (payload_size <= 125) {
	241	header.ws.b1 = (uint8_t)payload_size;
	242	header_size = 2;
	243	} else if (payload_size < 65536) {
	244	header.ws.b1 = 0x7e;
	245	header.ws.u.s16.l16 = cpu_to_be16((uint16_t)payload_size);
	246	header_size = 4;
	247	} else {
	248	header.ws.b1 = 0x7f;
	249	header.ws.u.s64.l64 = cpu_to_be64(payload_size);
	250	header_size = 10;
	251	}
	252
	253	buffer_reserve(output, header_size + payload_size);
	254	buffer_append(output, header.buf, header_size);
	255	buffer_append(output, payload, payload_size);
	256	}
257
258	int vncws_decode_frame(Buffer input, uint8_t *payload,
259	size_t payload_size, size_t frame_size)
260	{
261	unsigned char opcode = 0, fin = 0, has_mask = 0;
262	size_t header_size = 0;
263	uint32_t *payload32;
264	WsHeader header = (WsHeader )input->buffer;
265	WsMask mask;
266	int i;
267
268	if (input->offset < WS_HEAD_MIN_LEN + 4) {
269	/* header not complete */
270	return 0;
271	}
272
273	fin = (header->b0 & 0x80) >> 7;
274	opcode = header->b0 & 0x0f;
275	has_mask = (header->b1 & 0x80) >> 7;
276	*payload_size = header->b1 & 0x7f;
277
278	if (opcode == WS_OPCODE_CLOSE) {
279	/* disconnect */
280	return -1;
281	}
282
283	/* Websocket frame sanity check:
284	* * Websocket fragmentation is not supported.
285	* * All websockets frames sent by a client have to be masked.
286	* * Only binary encoding is supported.
287	*/
288	if (!fin \|\| !has_mask \|\| opcode != WS_OPCODE_BINARY_FRAME) {
289	VNC_DEBUG("Received faulty/unsupported Websocket frame\n");
290	return -2;
291	}
292
293	if (*payload_size < 126) {
294	header_size = 6;
295	mask = header->u.m;
296	} else if (*payload_size == 126 && input->offset >= 8) {
297	*payload_size = be16_to_cpu(header->u.s16.l16);
298	header_size = 8;
299	mask = header->u.s16.m16;
300	} else if (*payload_size == 127 && input->offset >= 14) {
301	*payload_size = be64_to_cpu(header->u.s64.l64);
302	header_size = 14;
303	mask = header->u.s64.m64;
304	} else {
305	/* header not complete */
306	return 0;
307	}
308
309	frame_size = header_size + payload_size;
310
311	if (input->offset < *frame_size) {
312	/* frame not complete */
313	return 0;
314	}
315
316	*payload = input->buffer + header_size;
317
318	/* unmask frame */
319	/* process 1 frame (32 bit op) */
320	payload32 = (uint32_t )(payload);
321	for (i = 0; i < *payload_size / 4; i++) {
322	payload32[i] ^= mask.u;
323	}
324	/* process the remaining bytes (if any) */
325	for (i = 4; i < payload_size; i++) {
326	(*payload)[i] ^= mask.c[i % 4];
327	}
328
329	return 1;
330	}