]> git.proxmox.com Git - mirror_qemu.git/blob - ui/vnc.c
projects / mirror_qemu.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
vnc: remove support for deprecated tls, x509, x509verify options
[mirror_qemu.git] / ui / vnc.c
1 /*
2 * QEMU VNC display driver
3 *
4 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5 * Copyright (C) 2006 Fabrice Bellard
6 * Copyright (C) 2009 Red Hat, Inc
7 *
8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to deal
10 * in the Software without restriction, including without limitation the rights
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12 * copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
14 *
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
17 *
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24 * THE SOFTWARE.
25 */
26
27 #include "qemu/osdep.h"
28 #include "vnc.h"
29 #include "vnc-jobs.h"
30 #include "trace.h"
31 #include "sysemu/sysemu.h"
32 #include "qemu/error-report.h"
33 #include "qemu/option.h"
34 #include "qemu/sockets.h"
35 #include "qemu/timer.h"
36 #include "qemu/acl.h"
37 #include "qemu/config-file.h"
38 #include "qapi/qapi-events.h"
39 #include "qapi/error.h"
40 #include "qapi/qapi-commands-ui.h"
41 #include "ui/input.h"
42 #include "crypto/hash.h"
43 #include "crypto/tlscredsanon.h"
44 #include "crypto/tlscredsx509.h"
45 #include "qom/object_interfaces.h"
46 #include "qemu/cutils.h"
47 #include "io/dns-resolver.h"
48
49 #define VNC_REFRESH_INTERVAL_BASE GUI_REFRESH_INTERVAL_DEFAULT
50 #define VNC_REFRESH_INTERVAL_INC 50
51 #define VNC_REFRESH_INTERVAL_MAX GUI_REFRESH_INTERVAL_IDLE
52 static const struct timeval VNC_REFRESH_STATS = { 0, 500000 };
53 static const struct timeval VNC_REFRESH_LOSSY = { 2, 0 };
54
55 #include "vnc_keysym.h"
56 #include "crypto/cipher.h"
57
58 static QTAILQ_HEAD(, VncDisplay) vnc_displays =
59 QTAILQ_HEAD_INITIALIZER(vnc_displays);
60
61 static int vnc_cursor_define(VncState *vs);
62 static void vnc_release_modifiers(VncState *vs);
63 static void vnc_update_throttle_offset(VncState *vs);
64
65 static void vnc_set_share_mode(VncState *vs, VncShareMode mode)
66 {
67 #ifdef _VNC_DEBUG
68 static const char *mn[] = {
69 [0] = "undefined",
70 [VNC_SHARE_MODE_CONNECTING] = "connecting",
71 [VNC_SHARE_MODE_SHARED] = "shared",
72 [VNC_SHARE_MODE_EXCLUSIVE] = "exclusive",
73 [VNC_SHARE_MODE_DISCONNECTED] = "disconnected",
74 };
75 fprintf(stderr, "%s/%p: %s -> %s\n", __func__,
76 vs->ioc, mn[vs->share_mode], mn[mode]);
77 #endif
78
79 switch (vs->share_mode) {
80 case VNC_SHARE_MODE_CONNECTING:
81 vs->vd->num_connecting--;
82 break;
83 case VNC_SHARE_MODE_SHARED:
84 vs->vd->num_shared--;
85 break;
86 case VNC_SHARE_MODE_EXCLUSIVE:
87 vs->vd->num_exclusive--;
88 break;
89 default:
90 break;
91 }
92
93 vs->share_mode = mode;
94
95 switch (vs->share_mode) {
96 case VNC_SHARE_MODE_CONNECTING:
97 vs->vd->num_connecting++;
98 break;
99 case VNC_SHARE_MODE_SHARED:
100 vs->vd->num_shared++;
101 break;
102 case VNC_SHARE_MODE_EXCLUSIVE:
103 vs->vd->num_exclusive++;
104 break;
105 default:
106 break;
107 }
108 }
109
110
111 static void vnc_init_basic_info(SocketAddress *addr,
112 VncBasicInfo *info,
113 Error **errp)
114 {
115 switch (addr->type) {
116 case SOCKET_ADDRESS_TYPE_INET:
117 info->host = g_strdup(addr->u.inet.host);
118 info->service = g_strdup(addr->u.inet.port);
119 if (addr->u.inet.ipv6) {
120 info->family = NETWORK_ADDRESS_FAMILY_IPV6;
121 } else {
122 info->family = NETWORK_ADDRESS_FAMILY_IPV4;
123 }
124 break;
125
126 case SOCKET_ADDRESS_TYPE_UNIX:
127 info->host = g_strdup("");
128 info->service = g_strdup(addr->u.q_unix.path);
129 info->family = NETWORK_ADDRESS_FAMILY_UNIX;
130 break;
131
132 case SOCKET_ADDRESS_TYPE_VSOCK:
133 case SOCKET_ADDRESS_TYPE_FD:
134 error_setg(errp, "Unsupported socket address type %s",
135 SocketAddressType_str(addr->type));
136 break;
137 default:
138 abort();
139 }
140
141 return;
142 }
143
144 static void vnc_init_basic_info_from_server_addr(QIOChannelSocket *ioc,
145 VncBasicInfo *info,
146 Error **errp)
147 {
148 SocketAddress *addr = NULL;
149
150 if (!ioc) {
151 error_setg(errp, "No listener socket available");
152 return;
153 }
154
155 addr = qio_channel_socket_get_local_address(ioc, errp);
156 if (!addr) {
157 return;
158 }
159
160 vnc_init_basic_info(addr, info, errp);
161 qapi_free_SocketAddress(addr);
162 }
163
164 static void vnc_init_basic_info_from_remote_addr(QIOChannelSocket *ioc,
165 VncBasicInfo *info,
166 Error **errp)
167 {
168 SocketAddress *addr = NULL;
169
170 addr = qio_channel_socket_get_remote_address(ioc, errp);
171 if (!addr) {
172 return;
173 }
174
175 vnc_init_basic_info(addr, info, errp);
176 qapi_free_SocketAddress(addr);
177 }
178
179 static const char *vnc_auth_name(VncDisplay *vd) {
180 switch (vd->auth) {
181 case VNC_AUTH_INVALID:
182 return "invalid";
183 case VNC_AUTH_NONE:
184 return "none";
185 case VNC_AUTH_VNC:
186 return "vnc";
187 case VNC_AUTH_RA2:
188 return "ra2";
189 case VNC_AUTH_RA2NE:
190 return "ra2ne";
191 case VNC_AUTH_TIGHT:
192 return "tight";
193 case VNC_AUTH_ULTRA:
194 return "ultra";
195 case VNC_AUTH_TLS:
196 return "tls";
197 case VNC_AUTH_VENCRYPT:
198 switch (vd->subauth) {
199 case VNC_AUTH_VENCRYPT_PLAIN:
200 return "vencrypt+plain";
201 case VNC_AUTH_VENCRYPT_TLSNONE:
202 return "vencrypt+tls+none";
203 case VNC_AUTH_VENCRYPT_TLSVNC:
204 return "vencrypt+tls+vnc";
205 case VNC_AUTH_VENCRYPT_TLSPLAIN:
206 return "vencrypt+tls+plain";
207 case VNC_AUTH_VENCRYPT_X509NONE:
208 return "vencrypt+x509+none";
209 case VNC_AUTH_VENCRYPT_X509VNC:
210 return "vencrypt+x509+vnc";
211 case VNC_AUTH_VENCRYPT_X509PLAIN:
212 return "vencrypt+x509+plain";
213 case VNC_AUTH_VENCRYPT_TLSSASL:
214 return "vencrypt+tls+sasl";
215 case VNC_AUTH_VENCRYPT_X509SASL:
216 return "vencrypt+x509+sasl";
217 default:
218 return "vencrypt";
219 }
220 case VNC_AUTH_SASL:
221 return "sasl";
222 }
223 return "unknown";
224 }
225
226 static VncServerInfo *vnc_server_info_get(VncDisplay *vd)
227 {
228 VncServerInfo *info;
229 Error *err = NULL;
230
231 if (!vd->listener || !vd->listener->nsioc) {
232 return NULL;
233 }
234
235 info = g_malloc0(sizeof(*info));
236 vnc_init_basic_info_from_server_addr(vd->listener->sioc[0],
237 qapi_VncServerInfo_base(info), &err);
238 info->has_auth = true;
239 info->auth = g_strdup(vnc_auth_name(vd));
240 if (err) {
241 qapi_free_VncServerInfo(info);
242 info = NULL;
243 error_free(err);
244 }
245 return info;
246 }
247
248 static void vnc_client_cache_auth(VncState *client)
249 {
250 if (!client->info) {
251 return;
252 }
253
254 if (client->tls) {
255 client->info->x509_dname =
256 qcrypto_tls_session_get_peer_name(client->tls);
257 client->info->has_x509_dname =
258 client->info->x509_dname != NULL;
259 }
260 #ifdef CONFIG_VNC_SASL
261 if (client->sasl.conn &&
262 client->sasl.username) {
263 client->info->has_sasl_username = true;
264 client->info->sasl_username = g_strdup(client->sasl.username);
265 }
266 #endif
267 }
268
269 static void vnc_client_cache_addr(VncState *client)
270 {
271 Error *err = NULL;
272
273 client->info = g_malloc0(sizeof(*client->info));
274 vnc_init_basic_info_from_remote_addr(client->sioc,
275 qapi_VncClientInfo_base(client->info),
276 &err);
277 if (err) {
278 qapi_free_VncClientInfo(client->info);
279 client->info = NULL;
280 error_free(err);
281 }
282 }
283
284 static void vnc_qmp_event(VncState *vs, QAPIEvent event)
285 {
286 VncServerInfo *si;
287
288 if (!vs->info) {
289 return;
290 }
291
292 si = vnc_server_info_get(vs->vd);
293 if (!si) {
294 return;
295 }
296
297 switch (event) {
298 case QAPI_EVENT_VNC_CONNECTED:
299 qapi_event_send_vnc_connected(si, qapi_VncClientInfo_base(vs->info),
300 &error_abort);
301 break;
302 case QAPI_EVENT_VNC_INITIALIZED:
303 qapi_event_send_vnc_initialized(si, vs->info, &error_abort);
304 break;
305 case QAPI_EVENT_VNC_DISCONNECTED:
306 qapi_event_send_vnc_disconnected(si, vs->info, &error_abort);
307 break;
308 default:
309 break;
310 }
311
312 qapi_free_VncServerInfo(si);
313 }
314
315 static VncClientInfo *qmp_query_vnc_client(const VncState *client)
316 {
317 VncClientInfo *info;
318 Error *err = NULL;
319
320 info = g_malloc0(sizeof(*info));
321
322 vnc_init_basic_info_from_remote_addr(client->sioc,
323 qapi_VncClientInfo_base(info),
324 &err);
325 if (err) {
326 error_free(err);
327 qapi_free_VncClientInfo(info);
328 return NULL;
329 }
330
331 info->websocket = client->websocket;
332
333 if (client->tls) {
334 info->x509_dname = qcrypto_tls_session_get_peer_name(client->tls);
335 info->has_x509_dname = info->x509_dname != NULL;
336 }
337 #ifdef CONFIG_VNC_SASL
338 if (client->sasl.conn && client->sasl.username) {
339 info->has_sasl_username = true;
340 info->sasl_username = g_strdup(client->sasl.username);
341 }
342 #endif
343
344 return info;
345 }
346
347 static VncDisplay *vnc_display_find(const char *id)
348 {
349 VncDisplay *vd;
350
351 if (id == NULL) {
352 return QTAILQ_FIRST(&vnc_displays);
353 }
354 QTAILQ_FOREACH(vd, &vnc_displays, next) {
355 if (strcmp(id, vd->id) == 0) {
356 return vd;
357 }
358 }
359 return NULL;
360 }
361
362 static VncClientInfoList *qmp_query_client_list(VncDisplay *vd)
363 {
364 VncClientInfoList *cinfo, *prev = NULL;
365 VncState *client;
366
367 QTAILQ_FOREACH(client, &vd->clients, next) {
368 cinfo = g_new0(VncClientInfoList, 1);
369 cinfo->value = qmp_query_vnc_client(client);
370 cinfo->next = prev;
371 prev = cinfo;
372 }
373 return prev;
374 }
375
376 VncInfo *qmp_query_vnc(Error **errp)
377 {
378 VncInfo *info = g_malloc0(sizeof(*info));
379 VncDisplay *vd = vnc_display_find(NULL);
380 SocketAddress *addr = NULL;
381
382 if (vd == NULL || !vd->listener || !vd->listener->nsioc) {
383 info->enabled = false;
384 } else {
385 info->enabled = true;
386
387 /* for compatibility with the original command */
388 info->has_clients = true;
389 info->clients = qmp_query_client_list(vd);
390
391 addr = qio_channel_socket_get_local_address(vd->listener->sioc[0],
392 errp);
393 if (!addr) {
394 goto out_error;
395 }
396
397 switch (addr->type) {
398 case SOCKET_ADDRESS_TYPE_INET:
399 info->host = g_strdup(addr->u.inet.host);
400 info->service = g_strdup(addr->u.inet.port);
401 if (addr->u.inet.ipv6) {
402 info->family = NETWORK_ADDRESS_FAMILY_IPV6;
403 } else {
404 info->family = NETWORK_ADDRESS_FAMILY_IPV4;
405 }
406 break;
407
408 case SOCKET_ADDRESS_TYPE_UNIX:
409 info->host = g_strdup("");
410 info->service = g_strdup(addr->u.q_unix.path);
411 info->family = NETWORK_ADDRESS_FAMILY_UNIX;
412 break;
413
414 case SOCKET_ADDRESS_TYPE_VSOCK:
415 case SOCKET_ADDRESS_TYPE_FD:
416 error_setg(errp, "Unsupported socket address type %s",
417 SocketAddressType_str(addr->type));
418 goto out_error;
419 default:
420 abort();
421 }
422
423 info->has_host = true;
424 info->has_service = true;
425 info->has_family = true;
426
427 info->has_auth = true;
428 info->auth = g_strdup(vnc_auth_name(vd));
429 }
430
431 qapi_free_SocketAddress(addr);
432 return info;
433
434 out_error:
435 qapi_free_SocketAddress(addr);
436 qapi_free_VncInfo(info);
437 return NULL;
438 }
439
440
441 static void qmp_query_auth(int auth, int subauth,
442 VncPrimaryAuth *qmp_auth,
443 VncVencryptSubAuth *qmp_vencrypt,
444 bool *qmp_has_vencrypt);
445
446 static VncServerInfo2List *qmp_query_server_entry(QIOChannelSocket *ioc,
447 bool websocket,
448 int auth,
449 int subauth,
450 VncServerInfo2List *prev)
451 {
452 VncServerInfo2List *list;
453 VncServerInfo2 *info;
454 Error *err = NULL;
455 SocketAddress *addr;
456
457 addr = qio_channel_socket_get_local_address(ioc, &err);
458 if (!addr) {
459 error_free(err);
460 return prev;
461 }
462
463 info = g_new0(VncServerInfo2, 1);
464 vnc_init_basic_info(addr, qapi_VncServerInfo2_base(info), &err);
465 qapi_free_SocketAddress(addr);
466 if (err) {
467 qapi_free_VncServerInfo2(info);
468 error_free(err);
469 return prev;
470 }
471 info->websocket = websocket;
472
473 qmp_query_auth(auth, subauth, &info->auth,
474 &info->vencrypt, &info->has_vencrypt);
475
476 list = g_new0(VncServerInfo2List, 1);
477 list->value = info;
478 list->next = prev;
479 return list;
480 }
481
482 static void qmp_query_auth(int auth, int subauth,
483 VncPrimaryAuth *qmp_auth,
484 VncVencryptSubAuth *qmp_vencrypt,
485 bool *qmp_has_vencrypt)
486 {
487 switch (auth) {
488 case VNC_AUTH_VNC:
489 *qmp_auth = VNC_PRIMARY_AUTH_VNC;
490 break;
491 case VNC_AUTH_RA2:
492 *qmp_auth = VNC_PRIMARY_AUTH_RA2;
493 break;
494 case VNC_AUTH_RA2NE:
495 *qmp_auth = VNC_PRIMARY_AUTH_RA2NE;
496 break;
497 case VNC_AUTH_TIGHT:
498 *qmp_auth = VNC_PRIMARY_AUTH_TIGHT;
499 break;
500 case VNC_AUTH_ULTRA:
501 *qmp_auth = VNC_PRIMARY_AUTH_ULTRA;
502 break;
503 case VNC_AUTH_TLS:
504 *qmp_auth = VNC_PRIMARY_AUTH_TLS;
505 break;
506 case VNC_AUTH_VENCRYPT:
507 *qmp_auth = VNC_PRIMARY_AUTH_VENCRYPT;
508 *qmp_has_vencrypt = true;
509 switch (subauth) {
510 case VNC_AUTH_VENCRYPT_PLAIN:
511 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_PLAIN;
512 break;
513 case VNC_AUTH_VENCRYPT_TLSNONE:
514 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_NONE;
515 break;
516 case VNC_AUTH_VENCRYPT_TLSVNC:
517 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_VNC;
518 break;
519 case VNC_AUTH_VENCRYPT_TLSPLAIN:
520 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_PLAIN;
521 break;
522 case VNC_AUTH_VENCRYPT_X509NONE:
523 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_NONE;
524 break;
525 case VNC_AUTH_VENCRYPT_X509VNC:
526 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_VNC;
527 break;
528 case VNC_AUTH_VENCRYPT_X509PLAIN:
529 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_PLAIN;
530 break;
531 case VNC_AUTH_VENCRYPT_TLSSASL:
532 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_SASL;
533 break;
534 case VNC_AUTH_VENCRYPT_X509SASL:
535 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_SASL;
536 break;
537 default:
538 *qmp_has_vencrypt = false;
539 break;
540 }
541 break;
542 case VNC_AUTH_SASL:
543 *qmp_auth = VNC_PRIMARY_AUTH_SASL;
544 break;
545 case VNC_AUTH_NONE:
546 default:
547 *qmp_auth = VNC_PRIMARY_AUTH_NONE;
548 break;
549 }
550 }
551
552 VncInfo2List *qmp_query_vnc_servers(Error **errp)
553 {
554 VncInfo2List *item, *prev = NULL;
555 VncInfo2 *info;
556 VncDisplay *vd;
557 DeviceState *dev;
558 size_t i;
559
560 QTAILQ_FOREACH(vd, &vnc_displays, next) {
561 info = g_new0(VncInfo2, 1);
562 info->id = g_strdup(vd->id);
563 info->clients = qmp_query_client_list(vd);
564 qmp_query_auth(vd->auth, vd->subauth, &info->auth,
565 &info->vencrypt, &info->has_vencrypt);
566 if (vd->dcl.con) {
567 dev = DEVICE(object_property_get_link(OBJECT(vd->dcl.con),
568 "device", NULL));
569 info->has_display = true;
570 info->display = g_strdup(dev->id);
571 }
572 for (i = 0; vd->listener != NULL && i < vd->listener->nsioc; i++) {
573 info->server = qmp_query_server_entry(
574 vd->listener->sioc[i], false, vd->auth, vd->subauth,
575 info->server);
576 }
577 for (i = 0; vd->wslistener != NULL && i < vd->wslistener->nsioc; i++) {
578 info->server = qmp_query_server_entry(
579 vd->wslistener->sioc[i], true, vd->ws_auth,
580 vd->ws_subauth, info->server);
581 }
582
583 item = g_new0(VncInfo2List, 1);
584 item->value = info;
585 item->next = prev;
586 prev = item;
587 }
588 return prev;
589 }
590
591 /* TODO
592 1) Get the queue working for IO.
593 2) there is some weirdness when using the -S option (the screen is grey
594 and not totally invalidated
595 3) resolutions > 1024
596 */
597
598 static int vnc_update_client(VncState *vs, int has_dirty);
599 static void vnc_disconnect_start(VncState *vs);
600
601 static void vnc_colordepth(VncState *vs);
602 static void framebuffer_update_request(VncState *vs, int incremental,
603 int x_position, int y_position,
604 int w, int h);
605 static void vnc_refresh(DisplayChangeListener *dcl);
606 static int vnc_refresh_server_surface(VncDisplay *vd);
607
608 static int vnc_width(VncDisplay *vd)
609 {
610 return MIN(VNC_MAX_WIDTH, ROUND_UP(surface_width(vd->ds),
611 VNC_DIRTY_PIXELS_PER_BIT));
612 }
613
614 static int vnc_height(VncDisplay *vd)
615 {
616 return MIN(VNC_MAX_HEIGHT, surface_height(vd->ds));
617 }
618
619 static void vnc_set_area_dirty(DECLARE_BITMAP(dirty[VNC_MAX_HEIGHT],
620 VNC_MAX_WIDTH / VNC_DIRTY_PIXELS_PER_BIT),
621 VncDisplay *vd,
622 int x, int y, int w, int h)
623 {
624 int width = vnc_width(vd);
625 int height = vnc_height(vd);
626
627 /* this is needed this to ensure we updated all affected
628 * blocks if x % VNC_DIRTY_PIXELS_PER_BIT != 0 */
629 w += (x % VNC_DIRTY_PIXELS_PER_BIT);
630 x -= (x % VNC_DIRTY_PIXELS_PER_BIT);
631
632 x = MIN(x, width);
633 y = MIN(y, height);
634 w = MIN(x + w, width) - x;
635 h = MIN(y + h, height);
636
637 for (; y < h; y++) {
638 bitmap_set(dirty[y], x / VNC_DIRTY_PIXELS_PER_BIT,
639 DIV_ROUND_UP(w, VNC_DIRTY_PIXELS_PER_BIT));
640 }
641 }
642
643 static void vnc_dpy_update(DisplayChangeListener *dcl,
644 int x, int y, int w, int h)
645 {
646 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
647 struct VncSurface *s = &vd->guest;
648
649 vnc_set_area_dirty(s->dirty, vd, x, y, w, h);
650 }
651
652 void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
653 int32_t encoding)
654 {
655 vnc_write_u16(vs, x);
656 vnc_write_u16(vs, y);
657 vnc_write_u16(vs, w);
658 vnc_write_u16(vs, h);
659
660 vnc_write_s32(vs, encoding);
661 }
662
663
664 static void vnc_desktop_resize(VncState *vs)
665 {
666 if (vs->ioc == NULL || !vnc_has_feature(vs, VNC_FEATURE_RESIZE)) {
667 return;
668 }
669 if (vs->client_width == pixman_image_get_width(vs->vd->server) &&
670 vs->client_height == pixman_image_get_height(vs->vd->server)) {
671 return;
672 }
673
674 assert(pixman_image_get_width(vs->vd->server) < 65536 &&
675 pixman_image_get_width(vs->vd->server) >= 0);
676 assert(pixman_image_get_height(vs->vd->server) < 65536 &&
677 pixman_image_get_height(vs->vd->server) >= 0);
678 vs->client_width = pixman_image_get_width(vs->vd->server);
679 vs->client_height = pixman_image_get_height(vs->vd->server);
680 vnc_lock_output(vs);
681 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
682 vnc_write_u8(vs, 0);
683 vnc_write_u16(vs, 1); /* number of rects */
684 vnc_framebuffer_update(vs, 0, 0, vs->client_width, vs->client_height,
685 VNC_ENCODING_DESKTOPRESIZE);
686 vnc_unlock_output(vs);
687 vnc_flush(vs);
688 }
689
690 static void vnc_abort_display_jobs(VncDisplay *vd)
691 {
692 VncState *vs;
693
694 QTAILQ_FOREACH(vs, &vd->clients, next) {
695 vnc_lock_output(vs);
696 vs->abort = true;
697 vnc_unlock_output(vs);
698 }
699 QTAILQ_FOREACH(vs, &vd->clients, next) {
700 vnc_jobs_join(vs);
701 }
702 QTAILQ_FOREACH(vs, &vd->clients, next) {
703 vnc_lock_output(vs);
704 vs->abort = false;
705 vnc_unlock_output(vs);
706 }
707 }
708
709 int vnc_server_fb_stride(VncDisplay *vd)
710 {
711 return pixman_image_get_stride(vd->server);
712 }
713
714 void *vnc_server_fb_ptr(VncDisplay *vd, int x, int y)
715 {
716 uint8_t *ptr;
717
718 ptr = (uint8_t *)pixman_image_get_data(vd->server);
719 ptr += y * vnc_server_fb_stride(vd);
720 ptr += x * VNC_SERVER_FB_BYTES;
721 return ptr;
722 }
723
724 static void vnc_update_server_surface(VncDisplay *vd)
725 {
726 int width, height;
727
728 qemu_pixman_image_unref(vd->server);
729 vd->server = NULL;
730
731 if (QTAILQ_EMPTY(&vd->clients)) {
732 return;
733 }
734
735 width = vnc_width(vd);
736 height = vnc_height(vd);
737 vd->server = pixman_image_create_bits(VNC_SERVER_FB_FORMAT,
738 width, height,
739 NULL, 0);
740
741 memset(vd->guest.dirty, 0x00, sizeof(vd->guest.dirty));
742 vnc_set_area_dirty(vd->guest.dirty, vd, 0, 0,
743 width, height);
744 }
745
746 static void vnc_dpy_switch(DisplayChangeListener *dcl,
747 DisplaySurface *surface)
748 {
749 static const char placeholder_msg[] =
750 "Display output is not active.";
751 static DisplaySurface *placeholder;
752 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
753 VncState *vs;
754
755 if (surface == NULL) {
756 if (placeholder == NULL) {
757 placeholder = qemu_create_message_surface(640, 480, placeholder_msg);
758 }
759 surface = placeholder;
760 }
761
762 vnc_abort_display_jobs(vd);
763 vd->ds = surface;
764
765 /* server surface */
766 vnc_update_server_surface(vd);
767
768 /* guest surface */
769 qemu_pixman_image_unref(vd->guest.fb);
770 vd->guest.fb = pixman_image_ref(surface->image);
771 vd->guest.format = surface->format;
772
773 QTAILQ_FOREACH(vs, &vd->clients, next) {
774 vnc_colordepth(vs);
775 vnc_desktop_resize(vs);
776 if (vs->vd->cursor) {
777 vnc_cursor_define(vs);
778 }
779 memset(vs->dirty, 0x00, sizeof(vs->dirty));
780 vnc_set_area_dirty(vs->dirty, vd, 0, 0,
781 vnc_width(vd),
782 vnc_height(vd));
783 vnc_update_throttle_offset(vs);
784 }
785 }
786
787 /* fastest code */
788 static void vnc_write_pixels_copy(VncState *vs,
789 void *pixels, int size)
790 {
791 vnc_write(vs, pixels, size);
792 }
793
794 /* slowest but generic code. */
795 void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
796 {
797 uint8_t r, g, b;
798
799 #if VNC_SERVER_FB_FORMAT == PIXMAN_FORMAT(32, PIXMAN_TYPE_ARGB, 0, 8, 8, 8)
800 r = (((v & 0x00ff0000) >> 16) << vs->client_pf.rbits) >> 8;
801 g = (((v & 0x0000ff00) >> 8) << vs->client_pf.gbits) >> 8;
802 b = (((v & 0x000000ff) >> 0) << vs->client_pf.bbits) >> 8;
803 #else
804 # error need some bits here if you change VNC_SERVER_FB_FORMAT
805 #endif
806 v = (r << vs->client_pf.rshift) |
807 (g << vs->client_pf.gshift) |
808 (b << vs->client_pf.bshift);
809 switch (vs->client_pf.bytes_per_pixel) {
810 case 1:
811 buf[0] = v;
812 break;
813 case 2:
814 if (vs->client_be) {
815 buf[0] = v >> 8;
816 buf[1] = v;
817 } else {
818 buf[1] = v >> 8;
819 buf[0] = v;
820 }
821 break;
822 default:
823 case 4:
824 if (vs->client_be) {
825 buf[0] = v >> 24;
826 buf[1] = v >> 16;
827 buf[2] = v >> 8;
828 buf[3] = v;
829 } else {
830 buf[3] = v >> 24;
831 buf[2] = v >> 16;
832 buf[1] = v >> 8;
833 buf[0] = v;
834 }
835 break;
836 }
837 }
838
839 static void vnc_write_pixels_generic(VncState *vs,
840 void *pixels1, int size)
841 {
842 uint8_t buf[4];
843
844 if (VNC_SERVER_FB_BYTES == 4) {
845 uint32_t *pixels = pixels1;
846 int n, i;
847 n = size >> 2;
848 for (i = 0; i < n; i++) {
849 vnc_convert_pixel(vs, buf, pixels[i]);
850 vnc_write(vs, buf, vs->client_pf.bytes_per_pixel);
851 }
852 }
853 }
854
855 int vnc_raw_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
856 {
857 int i;
858 uint8_t *row;
859 VncDisplay *vd = vs->vd;
860
861 row = vnc_server_fb_ptr(vd, x, y);
862 for (i = 0; i < h; i++) {
863 vs->write_pixels(vs, row, w * VNC_SERVER_FB_BYTES);
864 row += vnc_server_fb_stride(vd);
865 }
866 return 1;
867 }
868
869 int vnc_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
870 {
871 int n = 0;
872 bool encode_raw = false;
873 size_t saved_offs = vs->output.offset;
874
875 switch(vs->vnc_encoding) {
876 case VNC_ENCODING_ZLIB:
877 n = vnc_zlib_send_framebuffer_update(vs, x, y, w, h);
878 break;
879 case VNC_ENCODING_HEXTILE:
880 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE);
881 n = vnc_hextile_send_framebuffer_update(vs, x, y, w, h);
882 break;
883 case VNC_ENCODING_TIGHT:
884 n = vnc_tight_send_framebuffer_update(vs, x, y, w, h);
885 break;
886 case VNC_ENCODING_TIGHT_PNG:
887 n = vnc_tight_png_send_framebuffer_update(vs, x, y, w, h);
888 break;
889 case VNC_ENCODING_ZRLE:
890 n = vnc_zrle_send_framebuffer_update(vs, x, y, w, h);
891 break;
892 case VNC_ENCODING_ZYWRLE:
893 n = vnc_zywrle_send_framebuffer_update(vs, x, y, w, h);
894 break;
895 default:
896 encode_raw = true;
897 break;
898 }
899
900 /* If the client has the same pixel format as our internal buffer and
901 * a RAW encoding would need less space fall back to RAW encoding to
902 * save bandwidth and processing power in the client. */
903 if (!encode_raw && vs->write_pixels == vnc_write_pixels_copy &&
904 12 + h * w * VNC_SERVER_FB_BYTES <= (vs->output.offset - saved_offs)) {
905 vs->output.offset = saved_offs;
906 encode_raw = true;
907 }
908
909 if (encode_raw) {
910 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW);
911 n = vnc_raw_send_framebuffer_update(vs, x, y, w, h);
912 }
913
914 return n;
915 }
916
917 static void vnc_mouse_set(DisplayChangeListener *dcl,
918 int x, int y, int visible)
919 {
920 /* can we ask the client(s) to move the pointer ??? */
921 }
922
923 static int vnc_cursor_define(VncState *vs)
924 {
925 QEMUCursor *c = vs->vd->cursor;
926 int isize;
927
928 if (vnc_has_feature(vs, VNC_FEATURE_RICH_CURSOR)) {
929 vnc_lock_output(vs);
930 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
931 vnc_write_u8(vs, 0); /* padding */
932 vnc_write_u16(vs, 1); /* # of rects */
933 vnc_framebuffer_update(vs, c->hot_x, c->hot_y, c->width, c->height,
934 VNC_ENCODING_RICH_CURSOR);
935 isize = c->width * c->height * vs->client_pf.bytes_per_pixel;
936 vnc_write_pixels_generic(vs, c->data, isize);
937 vnc_write(vs, vs->vd->cursor_mask, vs->vd->cursor_msize);
938 vnc_unlock_output(vs);
939 return 0;
940 }
941 return -1;
942 }
943
944 static void vnc_dpy_cursor_define(DisplayChangeListener *dcl,
945 QEMUCursor *c)
946 {
947 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
948 VncState *vs;
949
950 cursor_put(vd->cursor);
951 g_free(vd->cursor_mask);
952
953 vd->cursor = c;
954 cursor_get(vd->cursor);
955 vd->cursor_msize = cursor_get_mono_bpl(c) * c->height;
956 vd->cursor_mask = g_malloc0(vd->cursor_msize);
957 cursor_get_mono_mask(c, 0, vd->cursor_mask);
958
959 QTAILQ_FOREACH(vs, &vd->clients, next) {
960 vnc_cursor_define(vs);
961 }
962 }
963
964 static int find_and_clear_dirty_height(VncState *vs,
965 int y, int last_x, int x, int height)
966 {
967 int h;
968
969 for (h = 1; h < (height - y); h++) {
970 if (!test_bit(last_x, vs->dirty[y + h])) {
971 break;
972 }
973 bitmap_clear(vs->dirty[y + h], last_x, x - last_x);
974 }
975
976 return h;
977 }
978
979 /*
980 * Figure out how much pending data we should allow in the output
981 * buffer before we throttle incremental display updates, and/or
982 * drop audio samples.
983 *
984 * We allow for equiv of 1 full display's worth of FB updates,
985 * and 1 second of audio samples. If audio backlog was larger
986 * than that the client would already suffering awful audio
987 * glitches, so dropping samples is no worse really).
988 */
989 static void vnc_update_throttle_offset(VncState *vs)
990 {
991 size_t offset =
992 vs->client_width * vs->client_height * vs->client_pf.bytes_per_pixel;
993
994 if (vs->audio_cap) {
995 int bps;
996 switch (vs->as.fmt) {
997 default:
998 case AUD_FMT_U8:
999 case AUD_FMT_S8:
1000 bps = 1;
1001 break;
1002 case AUD_FMT_U16:
1003 case AUD_FMT_S16:
1004 bps = 2;
1005 break;
1006 case AUD_FMT_U32:
1007 case AUD_FMT_S32:
1008 bps = 4;
1009 break;
1010 }
1011 offset += vs->as.freq * bps * vs->as.nchannels;
1012 }
1013
1014 /* Put a floor of 1MB on offset, so that if we have a large pending
1015 * buffer and the display is resized to a small size & back again
1016 * we don't suddenly apply a tiny send limit
1017 */
1018 offset = MAX(offset, 1024 * 1024);
1019
1020 if (vs->throttle_output_offset != offset) {
1021 trace_vnc_client_throttle_threshold(
1022 vs, vs->ioc, vs->throttle_output_offset, offset, vs->client_width,
1023 vs->client_height, vs->client_pf.bytes_per_pixel, vs->audio_cap);
1024 }
1025
1026 vs->throttle_output_offset = offset;
1027 }
1028
1029 static bool vnc_should_update(VncState *vs)
1030 {
1031 switch (vs->update) {
1032 case VNC_STATE_UPDATE_NONE:
1033 break;
1034 case VNC_STATE_UPDATE_INCREMENTAL:
1035 /* Only allow incremental updates if the pending send queue
1036 * is less than the permitted threshold, and the job worker
1037 * is completely idle.
1038 */
1039 if (vs->output.offset < vs->throttle_output_offset &&
1040 vs->job_update == VNC_STATE_UPDATE_NONE) {
1041 return true;
1042 }
1043 trace_vnc_client_throttle_incremental(
1044 vs, vs->ioc, vs->job_update, vs->output.offset);
1045 break;
1046 case VNC_STATE_UPDATE_FORCE:
1047 /* Only allow forced updates if the pending send queue
1048 * does not contain a previous forced update, and the
1049 * job worker is completely idle.
1050 *
1051 * Note this means we'll queue a forced update, even if
1052 * the output buffer size is otherwise over the throttle
1053 * output limit.
1054 */
1055 if (vs->force_update_offset == 0 &&
1056 vs->job_update == VNC_STATE_UPDATE_NONE) {
1057 return true;
1058 }
1059 trace_vnc_client_throttle_forced(
1060 vs, vs->ioc, vs->job_update, vs->force_update_offset);
1061 break;
1062 }
1063 return false;
1064 }
1065
1066 static int vnc_update_client(VncState *vs, int has_dirty)
1067 {
1068 VncDisplay *vd = vs->vd;
1069 VncJob *job;
1070 int y;
1071 int height, width;
1072 int n = 0;
1073
1074 if (vs->disconnecting) {
1075 vnc_disconnect_finish(vs);
1076 return 0;
1077 }
1078
1079 vs->has_dirty += has_dirty;
1080 if (!vnc_should_update(vs)) {
1081 return 0;
1082 }
1083
1084 if (!vs->has_dirty && vs->update != VNC_STATE_UPDATE_FORCE) {
1085 return 0;
1086 }
1087
1088 /*
1089 * Send screen updates to the vnc client using the server
1090 * surface and server dirty map. guest surface updates
1091 * happening in parallel don't disturb us, the next pass will
1092 * send them to the client.
1093 */
1094 job = vnc_job_new(vs);
1095
1096 height = pixman_image_get_height(vd->server);
1097 width = pixman_image_get_width(vd->server);
1098
1099 y = 0;
1100 for (;;) {
1101 int x, h;
1102 unsigned long x2;
1103 unsigned long offset = find_next_bit((unsigned long *) &vs->dirty,
1104 height * VNC_DIRTY_BPL(vs),
1105 y * VNC_DIRTY_BPL(vs));
1106 if (offset == height * VNC_DIRTY_BPL(vs)) {
1107 /* no more dirty bits */
1108 break;
1109 }
1110 y = offset / VNC_DIRTY_BPL(vs);
1111 x = offset % VNC_DIRTY_BPL(vs);
1112 x2 = find_next_zero_bit((unsigned long *) &vs->dirty[y],
1113 VNC_DIRTY_BPL(vs), x);
1114 bitmap_clear(vs->dirty[y], x, x2 - x);
1115 h = find_and_clear_dirty_height(vs, y, x, x2, height);
1116 x2 = MIN(x2, width / VNC_DIRTY_PIXELS_PER_BIT);
1117 if (x2 > x) {
1118 n += vnc_job_add_rect(job, x * VNC_DIRTY_PIXELS_PER_BIT, y,
1119 (x2 - x) * VNC_DIRTY_PIXELS_PER_BIT, h);
1120 }
1121 if (!x && x2 == width / VNC_DIRTY_PIXELS_PER_BIT) {
1122 y += h;
1123 if (y == height) {
1124 break;
1125 }
1126 }
1127 }
1128
1129 vs->job_update = vs->update;
1130 vs->update = VNC_STATE_UPDATE_NONE;
1131 vnc_job_push(job);
1132 vs->has_dirty = 0;
1133 return n;
1134 }
1135
1136 /* audio */
1137 static void audio_capture_notify(void *opaque, audcnotification_e cmd)
1138 {
1139 VncState *vs = opaque;
1140
1141 assert(vs->magic == VNC_MAGIC);
1142 switch (cmd) {
1143 case AUD_CNOTIFY_DISABLE:
1144 vnc_lock_output(vs);
1145 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
1146 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
1147 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_END);
1148 vnc_unlock_output(vs);
1149 vnc_flush(vs);
1150 break;
1151
1152 case AUD_CNOTIFY_ENABLE:
1153 vnc_lock_output(vs);
1154 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
1155 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
1156 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_BEGIN);
1157 vnc_unlock_output(vs);
1158 vnc_flush(vs);
1159 break;
1160 }
1161 }
1162
1163 static void audio_capture_destroy(void *opaque)
1164 {
1165 }
1166
1167 static void audio_capture(void *opaque, void *buf, int size)
1168 {
1169 VncState *vs = opaque;
1170
1171 assert(vs->magic == VNC_MAGIC);
1172 vnc_lock_output(vs);
1173 if (vs->output.offset < vs->throttle_output_offset) {
1174 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
1175 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
1176 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_DATA);
1177 vnc_write_u32(vs, size);
1178 vnc_write(vs, buf, size);
1179 } else {
1180 trace_vnc_client_throttle_audio(vs, vs->ioc, vs->output.offset);
1181 }
1182 vnc_unlock_output(vs);
1183 vnc_flush(vs);
1184 }
1185
1186 static void audio_add(VncState *vs)
1187 {
1188 struct audio_capture_ops ops;
1189
1190 if (vs->audio_cap) {
1191 error_report("audio already running");
1192 return;
1193 }
1194
1195 ops.notify = audio_capture_notify;
1196 ops.destroy = audio_capture_destroy;
1197 ops.capture = audio_capture;
1198
1199 vs->audio_cap = AUD_add_capture(&vs->as, &ops, vs);
1200 if (!vs->audio_cap) {
1201 error_report("Failed to add audio capture");
1202 }
1203 }
1204
1205 static void audio_del(VncState *vs)
1206 {
1207 if (vs->audio_cap) {
1208 AUD_del_capture(vs->audio_cap, vs);
1209 vs->audio_cap = NULL;
1210 }
1211 }
1212
1213 static void vnc_disconnect_start(VncState *vs)
1214 {
1215 if (vs->disconnecting) {
1216 return;
1217 }
1218 trace_vnc_client_disconnect_start(vs, vs->ioc);
1219 vnc_set_share_mode(vs, VNC_SHARE_MODE_DISCONNECTED);
1220 if (vs->ioc_tag) {
1221 g_source_remove(vs->ioc_tag);
1222 vs->ioc_tag = 0;
1223 }
1224 qio_channel_close(vs->ioc, NULL);
1225 vs->disconnecting = TRUE;
1226 }
1227
1228 void vnc_disconnect_finish(VncState *vs)
1229 {
1230 int i;
1231
1232 trace_vnc_client_disconnect_finish(vs, vs->ioc);
1233
1234 vnc_jobs_join(vs); /* Wait encoding jobs */
1235
1236 vnc_lock_output(vs);
1237 vnc_qmp_event(vs, QAPI_EVENT_VNC_DISCONNECTED);
1238
1239 buffer_free(&vs->input);
1240 buffer_free(&vs->output);
1241
1242 qapi_free_VncClientInfo(vs->info);
1243
1244 vnc_zlib_clear(vs);
1245 vnc_tight_clear(vs);
1246 vnc_zrle_clear(vs);
1247
1248 #ifdef CONFIG_VNC_SASL
1249 vnc_sasl_client_cleanup(vs);
1250 #endif /* CONFIG_VNC_SASL */
1251 audio_del(vs);
1252 vnc_release_modifiers(vs);
1253
1254 if (vs->mouse_mode_notifier.notify != NULL) {
1255 qemu_remove_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
1256 }
1257 QTAILQ_REMOVE(&vs->vd->clients, vs, next);
1258 if (QTAILQ_EMPTY(&vs->vd->clients)) {
1259 /* last client gone */
1260 vnc_update_server_surface(vs->vd);
1261 }
1262
1263 vnc_unlock_output(vs);
1264
1265 qemu_mutex_destroy(&vs->output_mutex);
1266 if (vs->bh != NULL) {
1267 qemu_bh_delete(vs->bh);
1268 }
1269 buffer_free(&vs->jobs_buffer);
1270
1271 for (i = 0; i < VNC_STAT_ROWS; ++i) {
1272 g_free(vs->lossy_rect[i]);
1273 }
1274 g_free(vs->lossy_rect);
1275
1276 object_unref(OBJECT(vs->ioc));
1277 vs->ioc = NULL;
1278 object_unref(OBJECT(vs->sioc));
1279 vs->sioc = NULL;
1280 vs->magic = 0;
1281 g_free(vs);
1282 }
1283
1284 size_t vnc_client_io_error(VncState *vs, ssize_t ret, Error **errp)
1285 {
1286 if (ret <= 0) {
1287 if (ret == 0) {
1288 trace_vnc_client_eof(vs, vs->ioc);
1289 vnc_disconnect_start(vs);
1290 } else if (ret != QIO_CHANNEL_ERR_BLOCK) {
1291 trace_vnc_client_io_error(vs, vs->ioc,
1292 errp ? error_get_pretty(*errp) :
1293 "Unknown");
1294 vnc_disconnect_start(vs);
1295 }
1296
1297 if (errp) {
1298 error_free(*errp);
1299 *errp = NULL;
1300 }
1301 return 0;
1302 }
1303 return ret;
1304 }
1305
1306
1307 void vnc_client_error(VncState *vs)
1308 {
1309 VNC_DEBUG("Closing down client sock: protocol error\n");
1310 vnc_disconnect_start(vs);
1311 }
1312
1313
1314 /*
1315 * Called to write a chunk of data to the client socket. The data may
1316 * be the raw data, or may have already been encoded by SASL.
1317 * The data will be written either straight onto the socket, or
1318 * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1319 *
1320 * NB, it is theoretically possible to have 2 layers of encryption,
1321 * both SASL, and this TLS layer. It is highly unlikely in practice
1322 * though, since SASL encryption will typically be a no-op if TLS
1323 * is active
1324 *
1325 * Returns the number of bytes written, which may be less than
1326 * the requested 'datalen' if the socket would block. Returns
1327 * 0 on I/O error, and disconnects the client socket.
1328 */
1329 size_t vnc_client_write_buf(VncState *vs, const uint8_t *data, size_t datalen)
1330 {
1331 Error *err = NULL;
1332 ssize_t ret;
1333 ret = qio_channel_write(
1334 vs->ioc, (const char *)data, datalen, &err);
1335 VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data, datalen, ret);
1336 return vnc_client_io_error(vs, ret, &err);
1337 }
1338
1339
1340 /*
1341 * Called to write buffered data to the client socket, when not
1342 * using any SASL SSF encryption layers. Will write as much data
1343 * as possible without blocking. If all buffered data is written,
1344 * will switch the FD poll() handler back to read monitoring.
1345 *
1346 * Returns the number of bytes written, which may be less than
1347 * the buffered output data if the socket would block. Returns
1348 * 0 on I/O error, and disconnects the client socket.
1349 */
1350 static size_t vnc_client_write_plain(VncState *vs)
1351 {
1352 size_t offset;
1353 size_t ret;
1354
1355 #ifdef CONFIG_VNC_SASL
1356 VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n",
1357 vs->output.buffer, vs->output.capacity, vs->output.offset,
1358 vs->sasl.waitWriteSSF);
1359
1360 if (vs->sasl.conn &&
1361 vs->sasl.runSSF &&
1362 vs->sasl.waitWriteSSF) {
1363 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF);
1364 if (ret)
1365 vs->sasl.waitWriteSSF -= ret;
1366 } else
1367 #endif /* CONFIG_VNC_SASL */
1368 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset);
1369 if (!ret)
1370 return 0;
1371
1372 if (ret >= vs->force_update_offset) {
1373 if (vs->force_update_offset != 0) {
1374 trace_vnc_client_unthrottle_forced(vs, vs->ioc);
1375 }
1376 vs->force_update_offset = 0;
1377 } else {
1378 vs->force_update_offset -= ret;
1379 }
1380 offset = vs->output.offset;
1381 buffer_advance(&vs->output, ret);
1382 if (offset >= vs->throttle_output_offset &&
1383 vs->output.offset < vs->throttle_output_offset) {
1384 trace_vnc_client_unthrottle_incremental(vs, vs->ioc, vs->output.offset);
1385 }
1386
1387 if (vs->output.offset == 0) {
1388 if (vs->ioc_tag) {
1389 g_source_remove(vs->ioc_tag);
1390 }
1391 vs->ioc_tag = qio_channel_add_watch(
1392 vs->ioc, G_IO_IN, vnc_client_io, vs, NULL);
1393 }
1394
1395 return ret;
1396 }
1397
1398
1399 /*
1400 * First function called whenever there is data to be written to
1401 * the client socket. Will delegate actual work according to whether
1402 * SASL SSF layers are enabled (thus requiring encryption calls)
1403 */
1404 static void vnc_client_write_locked(VncState *vs)
1405 {
1406 #ifdef CONFIG_VNC_SASL
1407 if (vs->sasl.conn &&
1408 vs->sasl.runSSF &&
1409 !vs->sasl.waitWriteSSF) {
1410 vnc_client_write_sasl(vs);
1411 } else
1412 #endif /* CONFIG_VNC_SASL */
1413 {
1414 vnc_client_write_plain(vs);
1415 }
1416 }
1417
1418 static void vnc_client_write(VncState *vs)
1419 {
1420 assert(vs->magic == VNC_MAGIC);
1421 vnc_lock_output(vs);
1422 if (vs->output.offset) {
1423 vnc_client_write_locked(vs);
1424 } else if (vs->ioc != NULL) {
1425 if (vs->ioc_tag) {
1426 g_source_remove(vs->ioc_tag);
1427 }
1428 vs->ioc_tag = qio_channel_add_watch(
1429 vs->ioc, G_IO_IN, vnc_client_io, vs, NULL);
1430 }
1431 vnc_unlock_output(vs);
1432 }
1433
1434 void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting)
1435 {
1436 vs->read_handler = func;
1437 vs->read_handler_expect = expecting;
1438 }
1439
1440
1441 /*
1442 * Called to read a chunk of data from the client socket. The data may
1443 * be the raw data, or may need to be further decoded by SASL.
1444 * The data will be read either straight from to the socket, or
1445 * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1446 *
1447 * NB, it is theoretically possible to have 2 layers of encryption,
1448 * both SASL, and this TLS layer. It is highly unlikely in practice
1449 * though, since SASL encryption will typically be a no-op if TLS
1450 * is active
1451 *
1452 * Returns the number of bytes read, which may be less than
1453 * the requested 'datalen' if the socket would block. Returns
1454 * 0 on I/O error or EOF, and disconnects the client socket.
1455 */
1456 size_t vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen)
1457 {
1458 ssize_t ret;
1459 Error *err = NULL;
1460 ret = qio_channel_read(
1461 vs->ioc, (char *)data, datalen, &err);
1462 VNC_DEBUG("Read wire %p %zd -> %ld\n", data, datalen, ret);
1463 return vnc_client_io_error(vs, ret, &err);
1464 }
1465
1466
1467 /*
1468 * Called to read data from the client socket to the input buffer,
1469 * when not using any SASL SSF encryption layers. Will read as much
1470 * data as possible without blocking.
1471 *
1472 * Returns the number of bytes read, which may be less than
1473 * the requested 'datalen' if the socket would block. Returns
1474 * 0 on I/O error or EOF, and disconnects the client socket.
1475 */
1476 static size_t vnc_client_read_plain(VncState *vs)
1477 {
1478 size_t ret;
1479 VNC_DEBUG("Read plain %p size %zd offset %zd\n",
1480 vs->input.buffer, vs->input.capacity, vs->input.offset);
1481 buffer_reserve(&vs->input, 4096);
1482 ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096);
1483 if (!ret)
1484 return 0;
1485 vs->input.offset += ret;
1486 return ret;
1487 }
1488
1489 static void vnc_jobs_bh(void *opaque)
1490 {
1491 VncState *vs = opaque;
1492
1493 assert(vs->magic == VNC_MAGIC);
1494 vnc_jobs_consume_buffer(vs);
1495 }
1496
1497 /*
1498 * First function called whenever there is more data to be read from
1499 * the client socket. Will delegate actual work according to whether
1500 * SASL SSF layers are enabled (thus requiring decryption calls)
1501 * Returns 0 on success, -1 if client disconnected
1502 */
1503 static int vnc_client_read(VncState *vs)
1504 {
1505 size_t ret;
1506
1507 #ifdef CONFIG_VNC_SASL
1508 if (vs->sasl.conn && vs->sasl.runSSF)
1509 ret = vnc_client_read_sasl(vs);
1510 else
1511 #endif /* CONFIG_VNC_SASL */
1512 ret = vnc_client_read_plain(vs);
1513 if (!ret) {
1514 if (vs->disconnecting) {
1515 vnc_disconnect_finish(vs);
1516 return -1;
1517 }
1518 return 0;
1519 }
1520
1521 while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) {
1522 size_t len = vs->read_handler_expect;
1523 int ret;
1524
1525 ret = vs->read_handler(vs, vs->input.buffer, len);
1526 if (vs->disconnecting) {
1527 vnc_disconnect_finish(vs);
1528 return -1;
1529 }
1530
1531 if (!ret) {
1532 buffer_advance(&vs->input, len);
1533 } else {
1534 vs->read_handler_expect = ret;
1535 }
1536 }
1537 return 0;
1538 }
1539
1540 gboolean vnc_client_io(QIOChannel *ioc G_GNUC_UNUSED,
1541 GIOCondition condition, void *opaque)
1542 {
1543 VncState *vs = opaque;
1544
1545 assert(vs->magic == VNC_MAGIC);
1546 if (condition & G_IO_IN) {
1547 if (vnc_client_read(vs) < 0) {
1548 /* vs is free()ed here */
1549 return TRUE;
1550 }
1551 }
1552 if (condition & G_IO_OUT) {
1553 vnc_client_write(vs);
1554 }
1555
1556 if (vs->disconnecting) {
1557 if (vs->ioc_tag != 0) {
1558 g_source_remove(vs->ioc_tag);
1559 }
1560 vs->ioc_tag = 0;
1561 }
1562 return TRUE;
1563 }
1564
1565
1566 /*
1567 * Scale factor to apply to vs->throttle_output_offset when checking for
1568 * hard limit. Worst case normal usage could be x2, if we have a complete
1569 * incremental update and complete forced update in the output buffer.
1570 * So x3 should be good enough, but we pick x5 to be conservative and thus
1571 * (hopefully) never trigger incorrectly.
1572 */
1573 #define VNC_THROTTLE_OUTPUT_LIMIT_SCALE 5
1574
1575 void vnc_write(VncState *vs, const void *data, size_t len)
1576 {
1577 assert(vs->magic == VNC_MAGIC);
1578 if (vs->disconnecting) {
1579 return;
1580 }
1581 /* Protection against malicious client/guest to prevent our output
1582 * buffer growing without bound if client stops reading data. This
1583 * should rarely trigger, because we have earlier throttling code
1584 * which stops issuing framebuffer updates and drops audio data
1585 * if the throttle_output_offset value is exceeded. So we only reach
1586 * this higher level if a huge number of pseudo-encodings get
1587 * triggered while data can't be sent on the socket.
1588 *
1589 * NB throttle_output_offset can be zero during early protocol
1590 * handshake, or from the job thread's VncState clone
1591 */
1592 if (vs->throttle_output_offset != 0 &&
1593 (vs->output.offset / VNC_THROTTLE_OUTPUT_LIMIT_SCALE) >
1594 vs->throttle_output_offset) {
1595 trace_vnc_client_output_limit(vs, vs->ioc, vs->output.offset,
1596 vs->throttle_output_offset);
1597 vnc_disconnect_start(vs);
1598 return;
1599 }
1600 buffer_reserve(&vs->output, len);
1601
1602 if (vs->ioc != NULL && buffer_empty(&vs->output)) {
1603 if (vs->ioc_tag) {
1604 g_source_remove(vs->ioc_tag);
1605 }
1606 vs->ioc_tag = qio_channel_add_watch(
1607 vs->ioc, G_IO_IN | G_IO_OUT, vnc_client_io, vs, NULL);
1608 }
1609
1610 buffer_append(&vs->output, data, len);
1611 }
1612
1613 void vnc_write_s32(VncState *vs, int32_t value)
1614 {
1615 vnc_write_u32(vs, *(uint32_t *)&value);
1616 }
1617
1618 void vnc_write_u32(VncState *vs, uint32_t value)
1619 {
1620 uint8_t buf[4];
1621
1622 buf[0] = (value >> 24) & 0xFF;
1623 buf[1] = (value >> 16) & 0xFF;
1624 buf[2] = (value >> 8) & 0xFF;
1625 buf[3] = value & 0xFF;
1626
1627 vnc_write(vs, buf, 4);
1628 }
1629
1630 void vnc_write_u16(VncState *vs, uint16_t value)
1631 {
1632 uint8_t buf[2];
1633
1634 buf[0] = (value >> 8) & 0xFF;
1635 buf[1] = value & 0xFF;
1636
1637 vnc_write(vs, buf, 2);
1638 }
1639
1640 void vnc_write_u8(VncState *vs, uint8_t value)
1641 {
1642 vnc_write(vs, (char *)&value, 1);
1643 }
1644
1645 void vnc_flush(VncState *vs)
1646 {
1647 vnc_lock_output(vs);
1648 if (vs->ioc != NULL && vs->output.offset) {
1649 vnc_client_write_locked(vs);
1650 }
1651 if (vs->disconnecting) {
1652 if (vs->ioc_tag != 0) {
1653 g_source_remove(vs->ioc_tag);
1654 }
1655 vs->ioc_tag = 0;
1656 }
1657 vnc_unlock_output(vs);
1658 }
1659
1660 static uint8_t read_u8(uint8_t *data, size_t offset)
1661 {
1662 return data[offset];
1663 }
1664
1665 static uint16_t read_u16(uint8_t *data, size_t offset)
1666 {
1667 return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF);
1668 }
1669
1670 static int32_t read_s32(uint8_t *data, size_t offset)
1671 {
1672 return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) |
1673 (data[offset + 2] << 8) | data[offset + 3]);
1674 }
1675
1676 uint32_t read_u32(uint8_t *data, size_t offset)
1677 {
1678 return ((data[offset] << 24) | (data[offset + 1] << 16) |
1679 (data[offset + 2] << 8) | data[offset + 3]);
1680 }
1681
1682 static void client_cut_text(VncState *vs, size_t len, uint8_t *text)
1683 {
1684 }
1685
1686 static void check_pointer_type_change(Notifier *notifier, void *data)
1687 {
1688 VncState *vs = container_of(notifier, VncState, mouse_mode_notifier);
1689 int absolute = qemu_input_is_absolute();
1690
1691 if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) {
1692 vnc_lock_output(vs);
1693 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1694 vnc_write_u8(vs, 0);
1695 vnc_write_u16(vs, 1);
1696 vnc_framebuffer_update(vs, absolute, 0,
1697 pixman_image_get_width(vs->vd->server),
1698 pixman_image_get_height(vs->vd->server),
1699 VNC_ENCODING_POINTER_TYPE_CHANGE);
1700 vnc_unlock_output(vs);
1701 vnc_flush(vs);
1702 }
1703 vs->absolute = absolute;
1704 }
1705
1706 static void pointer_event(VncState *vs, int button_mask, int x, int y)
1707 {
1708 static uint32_t bmap[INPUT_BUTTON__MAX] = {
1709 [INPUT_BUTTON_LEFT] = 0x01,
1710 [INPUT_BUTTON_MIDDLE] = 0x02,
1711 [INPUT_BUTTON_RIGHT] = 0x04,
1712 [INPUT_BUTTON_WHEEL_UP] = 0x08,
1713 [INPUT_BUTTON_WHEEL_DOWN] = 0x10,
1714 };
1715 QemuConsole *con = vs->vd->dcl.con;
1716 int width = pixman_image_get_width(vs->vd->server);
1717 int height = pixman_image_get_height(vs->vd->server);
1718
1719 if (vs->last_bmask != button_mask) {
1720 qemu_input_update_buttons(con, bmap, vs->last_bmask, button_mask);
1721 vs->last_bmask = button_mask;
1722 }
1723
1724 if (vs->absolute) {
1725 qemu_input_queue_abs(con, INPUT_AXIS_X, x, 0, width);
1726 qemu_input_queue_abs(con, INPUT_AXIS_Y, y, 0, height);
1727 } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) {
1728 qemu_input_queue_rel(con, INPUT_AXIS_X, x - 0x7FFF);
1729 qemu_input_queue_rel(con, INPUT_AXIS_Y, y - 0x7FFF);
1730 } else {
1731 if (vs->last_x != -1) {
1732 qemu_input_queue_rel(con, INPUT_AXIS_X, x - vs->last_x);
1733 qemu_input_queue_rel(con, INPUT_AXIS_Y, y - vs->last_y);
1734 }
1735 vs->last_x = x;
1736 vs->last_y = y;
1737 }
1738 qemu_input_event_sync();
1739 }
1740
1741 static void reset_keys(VncState *vs)
1742 {
1743 int i;
1744 for(i = 0; i < 256; i++) {
1745 if (vs->modifiers_state[i]) {
1746 qemu_input_event_send_key_number(vs->vd->dcl.con, i, false);
1747 qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
1748 vs->modifiers_state[i] = 0;
1749 }
1750 }
1751 }
1752
1753 static void press_key(VncState *vs, int keysym)
1754 {
1755 int keycode = keysym2scancode(vs->vd->kbd_layout, keysym,
1756 false, false, false) & SCANCODE_KEYMASK;
1757 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, true);
1758 qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
1759 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, false);
1760 qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
1761 }
1762
1763 static void vnc_led_state_change(VncState *vs)
1764 {
1765 if (!vnc_has_feature(vs, VNC_FEATURE_LED_STATE)) {
1766 return;
1767 }
1768
1769 vnc_lock_output(vs);
1770 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1771 vnc_write_u8(vs, 0);
1772 vnc_write_u16(vs, 1);
1773 vnc_framebuffer_update(vs, 0, 0, 1, 1, VNC_ENCODING_LED_STATE);
1774 vnc_write_u8(vs, vs->vd->ledstate);
1775 vnc_unlock_output(vs);
1776 vnc_flush(vs);
1777 }
1778
1779 static void kbd_leds(void *opaque, int ledstate)
1780 {
1781 VncDisplay *vd = opaque;
1782 VncState *client;
1783
1784 trace_vnc_key_guest_leds((ledstate & QEMU_CAPS_LOCK_LED),
1785 (ledstate & QEMU_NUM_LOCK_LED),
1786 (ledstate & QEMU_SCROLL_LOCK_LED));
1787
1788 if (ledstate == vd->ledstate) {
1789 return;
1790 }
1791
1792 vd->ledstate = ledstate;
1793
1794 QTAILQ_FOREACH(client, &vd->clients, next) {
1795 vnc_led_state_change(client);
1796 }
1797 }
1798
1799 static void do_key_event(VncState *vs, int down, int keycode, int sym)
1800 {
1801 /* QEMU console switch */
1802 switch(keycode) {
1803 case 0x2a: /* Left Shift */
1804 case 0x36: /* Right Shift */
1805 case 0x1d: /* Left CTRL */
1806 case 0x9d: /* Right CTRL */
1807 case 0x38: /* Left ALT */
1808 case 0xb8: /* Right ALT */
1809 if (down)
1810 vs->modifiers_state[keycode] = 1;
1811 else
1812 vs->modifiers_state[keycode] = 0;
1813 break;
1814 case 0x02 ... 0x0a: /* '1' to '9' keys */
1815 if (vs->vd->dcl.con == NULL &&
1816 down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) {
1817 /* Reset the modifiers sent to the current console */
1818 reset_keys(vs);
1819 console_select(keycode - 0x02);
1820 return;
1821 }
1822 break;
1823 case 0x3a: /* CapsLock */
1824 case 0x45: /* NumLock */
1825 if (down)
1826 vs->modifiers_state[keycode] ^= 1;
1827 break;
1828 }
1829
1830 /* Turn off the lock state sync logic if the client support the led
1831 state extension.
1832 */
1833 if (down && vs->vd->lock_key_sync &&
1834 !vnc_has_feature(vs, VNC_FEATURE_LED_STATE) &&
1835 keycode_is_keypad(vs->vd->kbd_layout, keycode)) {
1836 /* If the numlock state needs to change then simulate an additional
1837 keypress before sending this one. This will happen if the user
1838 toggles numlock away from the VNC window.
1839 */
1840 if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) {
1841 if (!vs->modifiers_state[0x45]) {
1842 trace_vnc_key_sync_numlock(true);
1843 vs->modifiers_state[0x45] = 1;
1844 press_key(vs, 0xff7f);
1845 }
1846 } else {
1847 if (vs->modifiers_state[0x45]) {
1848 trace_vnc_key_sync_numlock(false);
1849 vs->modifiers_state[0x45] = 0;
1850 press_key(vs, 0xff7f);
1851 }
1852 }
1853 }
1854
1855 if (down && vs->vd->lock_key_sync &&
1856 !vnc_has_feature(vs, VNC_FEATURE_LED_STATE) &&
1857 ((sym >= 'A' && sym <= 'Z') || (sym >= 'a' && sym <= 'z'))) {
1858 /* If the capslock state needs to change then simulate an additional
1859 keypress before sending this one. This will happen if the user
1860 toggles capslock away from the VNC window.
1861 */
1862 int uppercase = !!(sym >= 'A' && sym <= 'Z');
1863 int shift = !!(vs->modifiers_state[0x2a] | vs->modifiers_state[0x36]);
1864 int capslock = !!(vs->modifiers_state[0x3a]);
1865 if (capslock) {
1866 if (uppercase == shift) {
1867 trace_vnc_key_sync_capslock(false);
1868 vs->modifiers_state[0x3a] = 0;
1869 press_key(vs, 0xffe5);
1870 }
1871 } else {
1872 if (uppercase != shift) {
1873 trace_vnc_key_sync_capslock(true);
1874 vs->modifiers_state[0x3a] = 1;
1875 press_key(vs, 0xffe5);
1876 }
1877 }
1878 }
1879
1880 if (qemu_console_is_graphic(NULL)) {
1881 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, down);
1882 qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
1883 } else {
1884 bool numlock = vs->modifiers_state[0x45];
1885 bool control = (vs->modifiers_state[0x1d] ||
1886 vs->modifiers_state[0x9d]);
1887 /* QEMU console emulation */
1888 if (down) {
1889 switch (keycode) {
1890 case 0x2a: /* Left Shift */
1891 case 0x36: /* Right Shift */
1892 case 0x1d: /* Left CTRL */
1893 case 0x9d: /* Right CTRL */
1894 case 0x38: /* Left ALT */
1895 case 0xb8: /* Right ALT */
1896 break;
1897 case 0xc8:
1898 kbd_put_keysym(QEMU_KEY_UP);
1899 break;
1900 case 0xd0:
1901 kbd_put_keysym(QEMU_KEY_DOWN);
1902 break;
1903 case 0xcb:
1904 kbd_put_keysym(QEMU_KEY_LEFT);
1905 break;
1906 case 0xcd:
1907 kbd_put_keysym(QEMU_KEY_RIGHT);
1908 break;
1909 case 0xd3:
1910 kbd_put_keysym(QEMU_KEY_DELETE);
1911 break;
1912 case 0xc7:
1913 kbd_put_keysym(QEMU_KEY_HOME);
1914 break;
1915 case 0xcf:
1916 kbd_put_keysym(QEMU_KEY_END);
1917 break;
1918 case 0xc9:
1919 kbd_put_keysym(QEMU_KEY_PAGEUP);
1920 break;
1921 case 0xd1:
1922 kbd_put_keysym(QEMU_KEY_PAGEDOWN);
1923 break;
1924
1925 case 0x47:
1926 kbd_put_keysym(numlock ? '7' : QEMU_KEY_HOME);
1927 break;
1928 case 0x48:
1929 kbd_put_keysym(numlock ? '8' : QEMU_KEY_UP);
1930 break;
1931 case 0x49:
1932 kbd_put_keysym(numlock ? '9' : QEMU_KEY_PAGEUP);
1933 break;
1934 case 0x4b:
1935 kbd_put_keysym(numlock ? '4' : QEMU_KEY_LEFT);
1936 break;
1937 case 0x4c:
1938 kbd_put_keysym('5');
1939 break;
1940 case 0x4d:
1941 kbd_put_keysym(numlock ? '6' : QEMU_KEY_RIGHT);
1942 break;
1943 case 0x4f:
1944 kbd_put_keysym(numlock ? '1' : QEMU_KEY_END);
1945 break;
1946 case 0x50:
1947 kbd_put_keysym(numlock ? '2' : QEMU_KEY_DOWN);
1948 break;
1949 case 0x51:
1950 kbd_put_keysym(numlock ? '3' : QEMU_KEY_PAGEDOWN);
1951 break;
1952 case 0x52:
1953 kbd_put_keysym('0');
1954 break;
1955 case 0x53:
1956 kbd_put_keysym(numlock ? '.' : QEMU_KEY_DELETE);
1957 break;
1958
1959 case 0xb5:
1960 kbd_put_keysym('/');
1961 break;
1962 case 0x37:
1963 kbd_put_keysym('*');
1964 break;
1965 case 0x4a:
1966 kbd_put_keysym('-');
1967 break;
1968 case 0x4e:
1969 kbd_put_keysym('+');
1970 break;
1971 case 0x9c:
1972 kbd_put_keysym('\n');
1973 break;
1974
1975 default:
1976 if (control) {
1977 kbd_put_keysym(sym & 0x1f);
1978 } else {
1979 kbd_put_keysym(sym);
1980 }
1981 break;
1982 }
1983 }
1984 }
1985 }
1986
1987 static void vnc_release_modifiers(VncState *vs)
1988 {
1989 static const int keycodes[] = {
1990 /* shift, control, alt keys, both left & right */
1991 0x2a, 0x36, 0x1d, 0x9d, 0x38, 0xb8,
1992 };
1993 int i, keycode;
1994
1995 if (!qemu_console_is_graphic(NULL)) {
1996 return;
1997 }
1998 for (i = 0; i < ARRAY_SIZE(keycodes); i++) {
1999 keycode = keycodes[i];
2000 if (!vs->modifiers_state[keycode]) {
2001 continue;
2002 }
2003 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, false);
2004 qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
2005 }
2006 }
2007
2008 static const char *code2name(int keycode)
2009 {
2010 return QKeyCode_str(qemu_input_key_number_to_qcode(keycode));
2011 }
2012
2013 static void key_event(VncState *vs, int down, uint32_t sym)
2014 {
2015 bool shift = vs->modifiers_state[0x2a] || vs->modifiers_state[0x36];
2016 bool altgr = vs->modifiers_state[0xb8];
2017 bool ctrl = vs->modifiers_state[0x1d] || vs->modifiers_state[0x9d];
2018 int keycode;
2019 int lsym = sym;
2020
2021 if (lsym >= 'A' && lsym <= 'Z' && qemu_console_is_graphic(NULL)) {
2022 lsym = lsym - 'A' + 'a';
2023 }
2024
2025 keycode = keysym2scancode(vs->vd->kbd_layout, lsym & 0xFFFF,
2026 shift, altgr, ctrl) & SCANCODE_KEYMASK;
2027 trace_vnc_key_event_map(down, sym, keycode, code2name(keycode));
2028 do_key_event(vs, down, keycode, sym);
2029 }
2030
2031 static void ext_key_event(VncState *vs, int down,
2032 uint32_t sym, uint16_t keycode)
2033 {
2034 /* if the user specifies a keyboard layout, always use it */
2035 if (keyboard_layout) {
2036 key_event(vs, down, sym);
2037 } else {
2038 trace_vnc_key_event_ext(down, sym, keycode, code2name(keycode));
2039 do_key_event(vs, down, keycode, sym);
2040 }
2041 }
2042
2043 static void framebuffer_update_request(VncState *vs, int incremental,
2044 int x, int y, int w, int h)
2045 {
2046 if (incremental) {
2047 if (vs->update != VNC_STATE_UPDATE_FORCE) {
2048 vs->update = VNC_STATE_UPDATE_INCREMENTAL;
2049 }
2050 } else {
2051 vs->update = VNC_STATE_UPDATE_FORCE;
2052 vnc_set_area_dirty(vs->dirty, vs->vd, x, y, w, h);
2053 }
2054 }
2055
2056 static void send_ext_key_event_ack(VncState *vs)
2057 {
2058 vnc_lock_output(vs);
2059 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
2060 vnc_write_u8(vs, 0);
2061 vnc_write_u16(vs, 1);
2062 vnc_framebuffer_update(vs, 0, 0,
2063 pixman_image_get_width(vs->vd->server),
2064 pixman_image_get_height(vs->vd->server),
2065 VNC_ENCODING_EXT_KEY_EVENT);
2066 vnc_unlock_output(vs);
2067 vnc_flush(vs);
2068 }
2069
2070 static void send_ext_audio_ack(VncState *vs)
2071 {
2072 vnc_lock_output(vs);
2073 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
2074 vnc_write_u8(vs, 0);
2075 vnc_write_u16(vs, 1);
2076 vnc_framebuffer_update(vs, 0, 0,
2077 pixman_image_get_width(vs->vd->server),
2078 pixman_image_get_height(vs->vd->server),
2079 VNC_ENCODING_AUDIO);
2080 vnc_unlock_output(vs);
2081 vnc_flush(vs);
2082 }
2083
2084 static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
2085 {
2086 int i;
2087 unsigned int enc = 0;
2088
2089 vs->features = 0;
2090 vs->vnc_encoding = 0;
2091 vs->tight.compression = 9;
2092 vs->tight.quality = -1; /* Lossless by default */
2093 vs->absolute = -1;
2094
2095 /*
2096 * Start from the end because the encodings are sent in order of preference.
2097 * This way the preferred encoding (first encoding defined in the array)
2098 * will be set at the end of the loop.
2099 */
2100 for (i = n_encodings - 1; i >= 0; i--) {
2101 enc = encodings[i];
2102 switch (enc) {
2103 case VNC_ENCODING_RAW:
2104 vs->vnc_encoding = enc;
2105 break;
2106 case VNC_ENCODING_COPYRECT:
2107 vs->features |= VNC_FEATURE_COPYRECT_MASK;
2108 break;
2109 case VNC_ENCODING_HEXTILE:
2110 vs->features |= VNC_FEATURE_HEXTILE_MASK;
2111 vs->vnc_encoding = enc;
2112 break;
2113 case VNC_ENCODING_TIGHT:
2114 vs->features |= VNC_FEATURE_TIGHT_MASK;
2115 vs->vnc_encoding = enc;
2116 break;
2117 #ifdef CONFIG_VNC_PNG
2118 case VNC_ENCODING_TIGHT_PNG:
2119 vs->features |= VNC_FEATURE_TIGHT_PNG_MASK;
2120 vs->vnc_encoding = enc;
2121 break;
2122 #endif
2123 case VNC_ENCODING_ZLIB:
2124 vs->features |= VNC_FEATURE_ZLIB_MASK;
2125 vs->vnc_encoding = enc;
2126 break;
2127 case VNC_ENCODING_ZRLE:
2128 vs->features |= VNC_FEATURE_ZRLE_MASK;
2129 vs->vnc_encoding = enc;
2130 break;
2131 case VNC_ENCODING_ZYWRLE:
2132 vs->features |= VNC_FEATURE_ZYWRLE_MASK;
2133 vs->vnc_encoding = enc;
2134 break;
2135 case VNC_ENCODING_DESKTOPRESIZE:
2136 vs->features |= VNC_FEATURE_RESIZE_MASK;
2137 break;
2138 case VNC_ENCODING_POINTER_TYPE_CHANGE:
2139 vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK;
2140 break;
2141 case VNC_ENCODING_RICH_CURSOR:
2142 vs->features |= VNC_FEATURE_RICH_CURSOR_MASK;
2143 if (vs->vd->cursor) {
2144 vnc_cursor_define(vs);
2145 }
2146 break;
2147 case VNC_ENCODING_EXT_KEY_EVENT:
2148 send_ext_key_event_ack(vs);
2149 break;
2150 case VNC_ENCODING_AUDIO:
2151 send_ext_audio_ack(vs);
2152 break;
2153 case VNC_ENCODING_WMVi:
2154 vs->features |= VNC_FEATURE_WMVI_MASK;
2155 break;
2156 case VNC_ENCODING_LED_STATE:
2157 vs->features |= VNC_FEATURE_LED_STATE_MASK;
2158 break;
2159 case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9:
2160 vs->tight.compression = (enc & 0x0F);
2161 break;
2162 case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9:
2163 if (vs->vd->lossy) {
2164 vs->tight.quality = (enc & 0x0F);
2165 }
2166 break;
2167 default:
2168 VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc);
2169 break;
2170 }
2171 }
2172 vnc_desktop_resize(vs);
2173 check_pointer_type_change(&vs->mouse_mode_notifier, NULL);
2174 vnc_led_state_change(vs);
2175 }
2176
2177 static void set_pixel_conversion(VncState *vs)
2178 {
2179 pixman_format_code_t fmt = qemu_pixman_get_format(&vs->client_pf);
2180
2181 if (fmt == VNC_SERVER_FB_FORMAT) {
2182 vs->write_pixels = vnc_write_pixels_copy;
2183 vnc_hextile_set_pixel_conversion(vs, 0);
2184 } else {
2185 vs->write_pixels = vnc_write_pixels_generic;
2186 vnc_hextile_set_pixel_conversion(vs, 1);
2187 }
2188 }
2189
2190 static void send_color_map(VncState *vs)
2191 {
2192 int i;
2193
2194 vnc_write_u8(vs, VNC_MSG_SERVER_SET_COLOUR_MAP_ENTRIES);
2195 vnc_write_u8(vs, 0); /* padding */
2196 vnc_write_u16(vs, 0); /* first color */
2197 vnc_write_u16(vs, 256); /* # of colors */
2198
2199 for (i = 0; i < 256; i++) {
2200 PixelFormat *pf = &vs->client_pf;
2201
2202 vnc_write_u16(vs, (((i >> pf->rshift) & pf->rmax) << (16 - pf->rbits)));
2203 vnc_write_u16(vs, (((i >> pf->gshift) & pf->gmax) << (16 - pf->gbits)));
2204 vnc_write_u16(vs, (((i >> pf->bshift) & pf->bmax) << (16 - pf->bbits)));
2205 }
2206 }
2207
2208 static void set_pixel_format(VncState *vs, int bits_per_pixel,
2209 int big_endian_flag, int true_color_flag,
2210 int red_max, int green_max, int blue_max,
2211 int red_shift, int green_shift, int blue_shift)
2212 {
2213 if (!true_color_flag) {
2214 /* Expose a reasonable default 256 color map */
2215 bits_per_pixel = 8;
2216 red_max = 7;
2217 green_max = 7;
2218 blue_max = 3;
2219 red_shift = 0;
2220 green_shift = 3;
2221 blue_shift = 6;
2222 }
2223
2224 switch (bits_per_pixel) {
2225 case 8:
2226 case 16:
2227 case 32:
2228 break;
2229 default:
2230 vnc_client_error(vs);
2231 return;
2232 }
2233
2234 vs->client_pf.rmax = red_max ? red_max : 0xFF;
2235 vs->client_pf.rbits = ctpopl(red_max);
2236 vs->client_pf.rshift = red_shift;
2237 vs->client_pf.rmask = red_max << red_shift;
2238 vs->client_pf.gmax = green_max ? green_max : 0xFF;
2239 vs->client_pf.gbits = ctpopl(green_max);
2240 vs->client_pf.gshift = green_shift;
2241 vs->client_pf.gmask = green_max << green_shift;
2242 vs->client_pf.bmax = blue_max ? blue_max : 0xFF;
2243 vs->client_pf.bbits = ctpopl(blue_max);
2244 vs->client_pf.bshift = blue_shift;
2245 vs->client_pf.bmask = blue_max << blue_shift;
2246 vs->client_pf.bits_per_pixel = bits_per_pixel;
2247 vs->client_pf.bytes_per_pixel = bits_per_pixel / 8;
2248 vs->client_pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;
2249 vs->client_be = big_endian_flag;
2250
2251 if (!true_color_flag) {
2252 send_color_map(vs);
2253 }
2254
2255 set_pixel_conversion(vs);
2256
2257 graphic_hw_invalidate(vs->vd->dcl.con);
2258 graphic_hw_update(vs->vd->dcl.con);
2259 }
2260
2261 static void pixel_format_message (VncState *vs) {
2262 char pad[3] = { 0, 0, 0 };
2263
2264 vs->client_pf = qemu_default_pixelformat(32);
2265
2266 vnc_write_u8(vs, vs->client_pf.bits_per_pixel); /* bits-per-pixel */
2267 vnc_write_u8(vs, vs->client_pf.depth); /* depth */
2268
2269 #ifdef HOST_WORDS_BIGENDIAN
2270 vnc_write_u8(vs, 1); /* big-endian-flag */
2271 #else
2272 vnc_write_u8(vs, 0); /* big-endian-flag */
2273 #endif
2274 vnc_write_u8(vs, 1); /* true-color-flag */
2275 vnc_write_u16(vs, vs->client_pf.rmax); /* red-max */
2276 vnc_write_u16(vs, vs->client_pf.gmax); /* green-max */
2277 vnc_write_u16(vs, vs->client_pf.bmax); /* blue-max */
2278 vnc_write_u8(vs, vs->client_pf.rshift); /* red-shift */
2279 vnc_write_u8(vs, vs->client_pf.gshift); /* green-shift */
2280 vnc_write_u8(vs, vs->client_pf.bshift); /* blue-shift */
2281 vnc_write(vs, pad, 3); /* padding */
2282
2283 vnc_hextile_set_pixel_conversion(vs, 0);
2284 vs->write_pixels = vnc_write_pixels_copy;
2285 }
2286
2287 static void vnc_colordepth(VncState *vs)
2288 {
2289 if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) {
2290 /* Sending a WMVi message to notify the client*/
2291 vnc_lock_output(vs);
2292 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
2293 vnc_write_u8(vs, 0);
2294 vnc_write_u16(vs, 1); /* number of rects */
2295 vnc_framebuffer_update(vs, 0, 0,
2296 pixman_image_get_width(vs->vd->server),
2297 pixman_image_get_height(vs->vd->server),
2298 VNC_ENCODING_WMVi);
2299 pixel_format_message(vs);
2300 vnc_unlock_output(vs);
2301 vnc_flush(vs);
2302 } else {
2303 set_pixel_conversion(vs);
2304 }
2305 }
2306
2307 static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
2308 {
2309 int i;
2310 uint16_t limit;
2311 uint32_t freq;
2312 VncDisplay *vd = vs->vd;
2313
2314 if (data[0] > 3) {
2315 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
2316 }
2317
2318 switch (data[0]) {
2319 case VNC_MSG_CLIENT_SET_PIXEL_FORMAT:
2320 if (len == 1)
2321 return 20;
2322
2323 set_pixel_format(vs, read_u8(data, 4),
2324 read_u8(data, 6), read_u8(data, 7),
2325 read_u16(data, 8), read_u16(data, 10),
2326 read_u16(data, 12), read_u8(data, 14),
2327 read_u8(data, 15), read_u8(data, 16));
2328 break;
2329 case VNC_MSG_CLIENT_SET_ENCODINGS:
2330 if (len == 1)
2331 return 4;
2332
2333 if (len == 4) {
2334 limit = read_u16(data, 2);
2335 if (limit > 0)
2336 return 4 + (limit * 4);
2337 } else
2338 limit = read_u16(data, 2);
2339
2340 for (i = 0; i < limit; i++) {
2341 int32_t val = read_s32(data, 4 + (i * 4));
2342 memcpy(data + 4 + (i * 4), &val, sizeof(val));
2343 }
2344
2345 set_encodings(vs, (int32_t *)(data + 4), limit);
2346 break;
2347 case VNC_MSG_CLIENT_FRAMEBUFFER_UPDATE_REQUEST:
2348 if (len == 1)
2349 return 10;
2350
2351 framebuffer_update_request(vs,
2352 read_u8(data, 1), read_u16(data, 2), read_u16(data, 4),
2353 read_u16(data, 6), read_u16(data, 8));
2354 break;
2355 case VNC_MSG_CLIENT_KEY_EVENT:
2356 if (len == 1)
2357 return 8;
2358
2359 key_event(vs, read_u8(data, 1), read_u32(data, 4));
2360 break;
2361 case VNC_MSG_CLIENT_POINTER_EVENT:
2362 if (len == 1)
2363 return 6;
2364
2365 pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
2366 break;
2367 case VNC_MSG_CLIENT_CUT_TEXT:
2368 if (len == 1) {
2369 return 8;
2370 }
2371 if (len == 8) {
2372 uint32_t dlen = read_u32(data, 4);
2373 if (dlen > (1 << 20)) {
2374 error_report("vnc: client_cut_text msg payload has %u bytes"
2375 " which exceeds our limit of 1MB.", dlen);
2376 vnc_client_error(vs);
2377 break;
2378 }
2379 if (dlen > 0) {
2380 return 8 + dlen;
2381 }
2382 }
2383
2384 client_cut_text(vs, read_u32(data, 4), data + 8);
2385 break;
2386 case VNC_MSG_CLIENT_QEMU:
2387 if (len == 1)
2388 return 2;
2389
2390 switch (read_u8(data, 1)) {
2391 case VNC_MSG_CLIENT_QEMU_EXT_KEY_EVENT:
2392 if (len == 2)
2393 return 12;
2394
2395 ext_key_event(vs, read_u16(data, 2),
2396 read_u32(data, 4), read_u32(data, 8));
2397 break;
2398 case VNC_MSG_CLIENT_QEMU_AUDIO:
2399 if (len == 2)
2400 return 4;
2401
2402 switch (read_u16 (data, 2)) {
2403 case VNC_MSG_CLIENT_QEMU_AUDIO_ENABLE:
2404 audio_add(vs);
2405 break;
2406 case VNC_MSG_CLIENT_QEMU_AUDIO_DISABLE:
2407 audio_del(vs);
2408 break;
2409 case VNC_MSG_CLIENT_QEMU_AUDIO_SET_FORMAT:
2410 if (len == 4)
2411 return 10;
2412 switch (read_u8(data, 4)) {
2413 case 0: vs->as.fmt = AUD_FMT_U8; break;
2414 case 1: vs->as.fmt = AUD_FMT_S8; break;
2415 case 2: vs->as.fmt = AUD_FMT_U16; break;
2416 case 3: vs->as.fmt = AUD_FMT_S16; break;
2417 case 4: vs->as.fmt = AUD_FMT_U32; break;
2418 case 5: vs->as.fmt = AUD_FMT_S32; break;
2419 default:
2420 VNC_DEBUG("Invalid audio format %d\n", read_u8(data, 4));
2421 vnc_client_error(vs);
2422 break;
2423 }
2424 vs->as.nchannels = read_u8(data, 5);
2425 if (vs->as.nchannels != 1 && vs->as.nchannels != 2) {
2426 VNC_DEBUG("Invalid audio channel count %d\n",
2427 read_u8(data, 5));
2428 vnc_client_error(vs);
2429 break;
2430 }
2431 freq = read_u32(data, 6);
2432 /* No official limit for protocol, but 48khz is a sensible
2433 * upper bound for trustworthy clients, and this limit
2434 * protects calculations involving 'vs->as.freq' later.
2435 */
2436 if (freq > 48000) {
2437 VNC_DEBUG("Invalid audio frequency %u > 48000", freq);
2438 vnc_client_error(vs);
2439 break;
2440 }
2441 vs->as.freq = freq;
2442 break;
2443 default:
2444 VNC_DEBUG("Invalid audio message %d\n", read_u8(data, 4));
2445 vnc_client_error(vs);
2446 break;
2447 }
2448 break;
2449
2450 default:
2451 VNC_DEBUG("Msg: %d\n", read_u16(data, 0));
2452 vnc_client_error(vs);
2453 break;
2454 }
2455 break;
2456 default:
2457 VNC_DEBUG("Msg: %d\n", data[0]);
2458 vnc_client_error(vs);
2459 break;
2460 }
2461
2462 vnc_update_throttle_offset(vs);
2463 vnc_read_when(vs, protocol_client_msg, 1);
2464 return 0;
2465 }
2466
2467 static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
2468 {
2469 char buf[1024];
2470 VncShareMode mode;
2471 int size;
2472
2473 mode = data[0] ? VNC_SHARE_MODE_SHARED : VNC_SHARE_MODE_EXCLUSIVE;
2474 switch (vs->vd->share_policy) {
2475 case VNC_SHARE_POLICY_IGNORE:
2476 /*
2477 * Ignore the shared flag. Nothing to do here.
2478 *
2479 * Doesn't conform to the rfb spec but is traditional qemu
2480 * behavior, thus left here as option for compatibility
2481 * reasons.
2482 */
2483 break;
2484 case VNC_SHARE_POLICY_ALLOW_EXCLUSIVE:
2485 /*
2486 * Policy: Allow clients ask for exclusive access.
2487 *
2488 * Implementation: When a client asks for exclusive access,
2489 * disconnect all others. Shared connects are allowed as long
2490 * as no exclusive connection exists.
2491 *
2492 * This is how the rfb spec suggests to handle the shared flag.
2493 */
2494 if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2495 VncState *client;
2496 QTAILQ_FOREACH(client, &vs->vd->clients, next) {
2497 if (vs == client) {
2498 continue;
2499 }
2500 if (client->share_mode != VNC_SHARE_MODE_EXCLUSIVE &&
2501 client->share_mode != VNC_SHARE_MODE_SHARED) {
2502 continue;
2503 }
2504 vnc_disconnect_start(client);
2505 }
2506 }
2507 if (mode == VNC_SHARE_MODE_SHARED) {
2508 if (vs->vd->num_exclusive > 0) {
2509 vnc_disconnect_start(vs);
2510 return 0;
2511 }
2512 }
2513 break;
2514 case VNC_SHARE_POLICY_FORCE_SHARED:
2515 /*
2516 * Policy: Shared connects only.
2517 * Implementation: Disallow clients asking for exclusive access.
2518 *
2519 * Useful for shared desktop sessions where you don't want
2520 * someone forgetting to say -shared when running the vnc
2521 * client disconnect everybody else.
2522 */
2523 if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2524 vnc_disconnect_start(vs);
2525 return 0;
2526 }
2527 break;
2528 }
2529 vnc_set_share_mode(vs, mode);
2530
2531 if (vs->vd->num_shared > vs->vd->connections_limit) {
2532 vnc_disconnect_start(vs);
2533 return 0;
2534 }
2535
2536 assert(pixman_image_get_width(vs->vd->server) < 65536 &&
2537 pixman_image_get_width(vs->vd->server) >= 0);
2538 assert(pixman_image_get_height(vs->vd->server) < 65536 &&
2539 pixman_image_get_height(vs->vd->server) >= 0);
2540 vs->client_width = pixman_image_get_width(vs->vd->server);
2541 vs->client_height = pixman_image_get_height(vs->vd->server);
2542 vnc_write_u16(vs, vs->client_width);
2543 vnc_write_u16(vs, vs->client_height);
2544
2545 pixel_format_message(vs);
2546
2547 if (qemu_name) {
2548 size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
2549 if (size > sizeof(buf)) {
2550 size = sizeof(buf);
2551 }
2552 } else {
2553 size = snprintf(buf, sizeof(buf), "QEMU");
2554 }
2555
2556 vnc_write_u32(vs, size);
2557 vnc_write(vs, buf, size);
2558 vnc_flush(vs);
2559
2560 vnc_client_cache_auth(vs);
2561 vnc_qmp_event(vs, QAPI_EVENT_VNC_INITIALIZED);
2562
2563 vnc_read_when(vs, protocol_client_msg, 1);
2564
2565 return 0;
2566 }
2567
2568 void start_client_init(VncState *vs)
2569 {
2570 vnc_read_when(vs, protocol_client_init, 1);
2571 }
2572
2573 static void make_challenge(VncState *vs)
2574 {
2575 int i;
2576
2577 srand(time(NULL)+getpid()+getpid()*987654+rand());
2578
2579 for (i = 0 ; i < sizeof(vs->challenge) ; i++)
2580 vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
2581 }
2582
2583 static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
2584 {
2585 unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
2586 size_t i, pwlen;
2587 unsigned char key[8];
2588 time_t now = time(NULL);
2589 QCryptoCipher *cipher = NULL;
2590 Error *err = NULL;
2591
2592 if (!vs->vd->password) {
2593 trace_vnc_auth_fail(vs, vs->auth, "password is not set", "");
2594 goto reject;
2595 }
2596 if (vs->vd->expires < now) {
2597 trace_vnc_auth_fail(vs, vs->auth, "password is expired", "");
2598 goto reject;
2599 }
2600
2601 memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
2602
2603 /* Calculate the expected challenge response */
2604 pwlen = strlen(vs->vd->password);
2605 for (i=0; i<sizeof(key); i++)
2606 key[i] = i<pwlen ? vs->vd->password[i] : 0;
2607
2608 cipher = qcrypto_cipher_new(
2609 QCRYPTO_CIPHER_ALG_DES_RFB,
2610 QCRYPTO_CIPHER_MODE_ECB,
2611 key, G_N_ELEMENTS(key),
2612 &err);
2613 if (!cipher) {
2614 trace_vnc_auth_fail(vs, vs->auth, "cannot create cipher",
2615 error_get_pretty(err));
2616 error_free(err);
2617 goto reject;
2618 }
2619
2620 if (qcrypto_cipher_encrypt(cipher,
2621 vs->challenge,
2622 response,
2623 VNC_AUTH_CHALLENGE_SIZE,
2624 &err) < 0) {
2625 trace_vnc_auth_fail(vs, vs->auth, "cannot encrypt challenge response",
2626 error_get_pretty(err));
2627 error_free(err);
2628 goto reject;
2629 }
2630
2631 /* Compare expected vs actual challenge response */
2632 if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) {
2633 trace_vnc_auth_fail(vs, vs->auth, "mis-matched challenge response", "");
2634 goto reject;
2635 } else {
2636 trace_vnc_auth_pass(vs, vs->auth);
2637 vnc_write_u32(vs, 0); /* Accept auth */
2638 vnc_flush(vs);
2639
2640 start_client_init(vs);
2641 }
2642
2643 qcrypto_cipher_free(cipher);
2644 return 0;
2645
2646 reject:
2647 vnc_write_u32(vs, 1); /* Reject auth */
2648 if (vs->minor >= 8) {
2649 static const char err[] = "Authentication failed";
2650 vnc_write_u32(vs, sizeof(err));
2651 vnc_write(vs, err, sizeof(err));
2652 }
2653 vnc_flush(vs);
2654 vnc_client_error(vs);
2655 qcrypto_cipher_free(cipher);
2656 return 0;
2657 }
2658
2659 void start_auth_vnc(VncState *vs)
2660 {
2661 make_challenge(vs);
2662 /* Send client a 'random' challenge */
2663 vnc_write(vs, vs->challenge, sizeof(vs->challenge));
2664 vnc_flush(vs);
2665
2666 vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge));
2667 }
2668
2669
2670 static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
2671 {
2672 /* We only advertise 1 auth scheme at a time, so client
2673 * must pick the one we sent. Verify this */
2674 if (data[0] != vs->auth) { /* Reject auth */
2675 trace_vnc_auth_reject(vs, vs->auth, (int)data[0]);
2676 vnc_write_u32(vs, 1);
2677 if (vs->minor >= 8) {
2678 static const char err[] = "Authentication failed";
2679 vnc_write_u32(vs, sizeof(err));
2680 vnc_write(vs, err, sizeof(err));
2681 }
2682 vnc_client_error(vs);
2683 } else { /* Accept requested auth */
2684 trace_vnc_auth_start(vs, vs->auth);
2685 switch (vs->auth) {
2686 case VNC_AUTH_NONE:
2687 if (vs->minor >= 8) {
2688 vnc_write_u32(vs, 0); /* Accept auth completion */
2689 vnc_flush(vs);
2690 }
2691 trace_vnc_auth_pass(vs, vs->auth);
2692 start_client_init(vs);
2693 break;
2694
2695 case VNC_AUTH_VNC:
2696 start_auth_vnc(vs);
2697 break;
2698
2699 case VNC_AUTH_VENCRYPT:
2700 start_auth_vencrypt(vs);
2701 break;
2702
2703 #ifdef CONFIG_VNC_SASL
2704 case VNC_AUTH_SASL:
2705 start_auth_sasl(vs);
2706 break;
2707 #endif /* CONFIG_VNC_SASL */
2708
2709 default: /* Should not be possible, but just in case */
2710 trace_vnc_auth_fail(vs, vs->auth, "Unhandled auth method", "");
2711 vnc_write_u8(vs, 1);
2712 if (vs->minor >= 8) {
2713 static const char err[] = "Authentication failed";
2714 vnc_write_u32(vs, sizeof(err));
2715 vnc_write(vs, err, sizeof(err));
2716 }
2717 vnc_client_error(vs);
2718 }
2719 }
2720 return 0;
2721 }
2722
2723 static int protocol_version(VncState *vs, uint8_t *version, size_t len)
2724 {
2725 char local[13];
2726
2727 memcpy(local, version, 12);
2728 local[12] = 0;
2729
2730 if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) {
2731 VNC_DEBUG("Malformed protocol version %s\n", local);
2732 vnc_client_error(vs);
2733 return 0;
2734 }
2735 VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor);
2736 if (vs->major != 3 ||
2737 (vs->minor != 3 &&
2738 vs->minor != 4 &&
2739 vs->minor != 5 &&
2740 vs->minor != 7 &&
2741 vs->minor != 8)) {
2742 VNC_DEBUG("Unsupported client version\n");
2743 vnc_write_u32(vs, VNC_AUTH_INVALID);
2744 vnc_flush(vs);
2745 vnc_client_error(vs);
2746 return 0;
2747 }
2748 /* Some broken clients report v3.4 or v3.5, which spec requires to be treated
2749 * as equivalent to v3.3 by servers
2750 */
2751 if (vs->minor == 4 || vs->minor == 5)
2752 vs->minor = 3;
2753
2754 if (vs->minor == 3) {
2755 trace_vnc_auth_start(vs, vs->auth);
2756 if (vs->auth == VNC_AUTH_NONE) {
2757 vnc_write_u32(vs, vs->auth);
2758 vnc_flush(vs);
2759 trace_vnc_auth_pass(vs, vs->auth);
2760 start_client_init(vs);
2761 } else if (vs->auth == VNC_AUTH_VNC) {
2762 VNC_DEBUG("Tell client VNC auth\n");
2763 vnc_write_u32(vs, vs->auth);
2764 vnc_flush(vs);
2765 start_auth_vnc(vs);
2766 } else {
2767 trace_vnc_auth_fail(vs, vs->auth,
2768 "Unsupported auth method for v3.3", "");
2769 vnc_write_u32(vs, VNC_AUTH_INVALID);
2770 vnc_flush(vs);
2771 vnc_client_error(vs);
2772 }
2773 } else {
2774 vnc_write_u8(vs, 1); /* num auth */
2775 vnc_write_u8(vs, vs->auth);
2776 vnc_read_when(vs, protocol_client_auth, 1);
2777 vnc_flush(vs);
2778 }
2779
2780 return 0;
2781 }
2782
2783 static VncRectStat *vnc_stat_rect(VncDisplay *vd, int x, int y)
2784 {
2785 struct VncSurface *vs = &vd->guest;
2786
2787 return &vs->stats[y / VNC_STAT_RECT][x / VNC_STAT_RECT];
2788 }
2789
2790 void vnc_sent_lossy_rect(VncState *vs, int x, int y, int w, int h)
2791 {
2792 int i, j;
2793
2794 w = (x + w) / VNC_STAT_RECT;
2795 h = (y + h) / VNC_STAT_RECT;
2796 x /= VNC_STAT_RECT;
2797 y /= VNC_STAT_RECT;
2798
2799 for (j = y; j <= h; j++) {
2800 for (i = x; i <= w; i++) {
2801 vs->lossy_rect[j][i] = 1;
2802 }
2803 }
2804 }
2805
2806 static int vnc_refresh_lossy_rect(VncDisplay *vd, int x, int y)
2807 {
2808 VncState *vs;
2809 int sty = y / VNC_STAT_RECT;
2810 int stx = x / VNC_STAT_RECT;
2811 int has_dirty = 0;
2812
2813 y = QEMU_ALIGN_DOWN(y, VNC_STAT_RECT);
2814 x = QEMU_ALIGN_DOWN(x, VNC_STAT_RECT);
2815
2816 QTAILQ_FOREACH(vs, &vd->clients, next) {
2817 int j;
2818
2819 /* kernel send buffers are full -> refresh later */
2820 if (vs->output.offset) {
2821 continue;
2822 }
2823
2824 if (!vs->lossy_rect[sty][stx]) {
2825 continue;
2826 }
2827
2828 vs->lossy_rect[sty][stx] = 0;
2829 for (j = 0; j < VNC_STAT_RECT; ++j) {
2830 bitmap_set(vs->dirty[y + j],
2831 x / VNC_DIRTY_PIXELS_PER_BIT,
2832 VNC_STAT_RECT / VNC_DIRTY_PIXELS_PER_BIT);
2833 }
2834 has_dirty++;
2835 }
2836
2837 return has_dirty;
2838 }
2839
2840 static int vnc_update_stats(VncDisplay *vd, struct timeval * tv)
2841 {
2842 int width = MIN(pixman_image_get_width(vd->guest.fb),
2843 pixman_image_get_width(vd->server));
2844 int height = MIN(pixman_image_get_height(vd->guest.fb),
2845 pixman_image_get_height(vd->server));
2846 int x, y;
2847 struct timeval res;
2848 int has_dirty = 0;
2849
2850 for (y = 0; y < height; y += VNC_STAT_RECT) {
2851 for (x = 0; x < width; x += VNC_STAT_RECT) {
2852 VncRectStat *rect = vnc_stat_rect(vd, x, y);
2853
2854 rect->updated = false;
2855 }
2856 }
2857
2858 qemu_timersub(tv, &VNC_REFRESH_STATS, &res);
2859
2860 if (timercmp(&vd->guest.last_freq_check, &res, >)) {
2861 return has_dirty;
2862 }
2863 vd->guest.last_freq_check = *tv;
2864
2865 for (y = 0; y < height; y += VNC_STAT_RECT) {
2866 for (x = 0; x < width; x += VNC_STAT_RECT) {
2867 VncRectStat *rect= vnc_stat_rect(vd, x, y);
2868 int count = ARRAY_SIZE(rect->times);
2869 struct timeval min, max;
2870
2871 if (!timerisset(&rect->times[count - 1])) {
2872 continue ;
2873 }
2874
2875 max = rect->times[(rect->idx + count - 1) % count];
2876 qemu_timersub(tv, &max, &res);
2877
2878 if (timercmp(&res, &VNC_REFRESH_LOSSY, >)) {
2879 rect->freq = 0;
2880 has_dirty += vnc_refresh_lossy_rect(vd, x, y);
2881 memset(rect->times, 0, sizeof (rect->times));
2882 continue ;
2883 }
2884
2885 min = rect->times[rect->idx];
2886 max = rect->times[(rect->idx + count - 1) % count];
2887 qemu_timersub(&max, &min, &res);
2888
2889 rect->freq = res.tv_sec + res.tv_usec / 1000000.;
2890 rect->freq /= count;
2891 rect->freq = 1. / rect->freq;
2892 }
2893 }
2894 return has_dirty;
2895 }
2896
2897 double vnc_update_freq(VncState *vs, int x, int y, int w, int h)
2898 {
2899 int i, j;
2900 double total = 0;
2901 int num = 0;
2902
2903 x = QEMU_ALIGN_DOWN(x, VNC_STAT_RECT);
2904 y = QEMU_ALIGN_DOWN(y, VNC_STAT_RECT);
2905
2906 for (j = y; j <= y + h; j += VNC_STAT_RECT) {
2907 for (i = x; i <= x + w; i += VNC_STAT_RECT) {
2908 total += vnc_stat_rect(vs->vd, i, j)->freq;
2909 num++;
2910 }
2911 }
2912
2913 if (num) {
2914 return total / num;
2915 } else {
2916 return 0;
2917 }
2918 }
2919
2920 static void vnc_rect_updated(VncDisplay *vd, int x, int y, struct timeval * tv)
2921 {
2922 VncRectStat *rect;
2923
2924 rect = vnc_stat_rect(vd, x, y);
2925 if (rect->updated) {
2926 return ;
2927 }
2928 rect->times[rect->idx] = *tv;
2929 rect->idx = (rect->idx + 1) % ARRAY_SIZE(rect->times);
2930 rect->updated = true;
2931 }
2932
2933 static int vnc_refresh_server_surface(VncDisplay *vd)
2934 {
2935 int width = MIN(pixman_image_get_width(vd->guest.fb),
2936 pixman_image_get_width(vd->server));
2937 int height = MIN(pixman_image_get_height(vd->guest.fb),
2938 pixman_image_get_height(vd->server));
2939 int cmp_bytes, server_stride, line_bytes, guest_ll, guest_stride, y = 0;
2940 uint8_t *guest_row0 = NULL, *server_row0;
2941 VncState *vs;
2942 int has_dirty = 0;
2943 pixman_image_t *tmpbuf = NULL;
2944
2945 struct timeval tv = { 0, 0 };
2946
2947 if (!vd->non_adaptive) {
2948 gettimeofday(&tv, NULL);
2949 has_dirty = vnc_update_stats(vd, &tv);
2950 }
2951
2952 /*
2953 * Walk through the guest dirty map.
2954 * Check and copy modified bits from guest to server surface.
2955 * Update server dirty map.
2956 */
2957 server_row0 = (uint8_t *)pixman_image_get_data(vd->server);
2958 server_stride = guest_stride = guest_ll =
2959 pixman_image_get_stride(vd->server);
2960 cmp_bytes = MIN(VNC_DIRTY_PIXELS_PER_BIT * VNC_SERVER_FB_BYTES,
2961 server_stride);
2962 if (vd->guest.format != VNC_SERVER_FB_FORMAT) {
2963 int width = pixman_image_get_width(vd->server);
2964 tmpbuf = qemu_pixman_linebuf_create(VNC_SERVER_FB_FORMAT, width);
2965 } else {
2966 int guest_bpp =
2967 PIXMAN_FORMAT_BPP(pixman_image_get_format(vd->guest.fb));
2968 guest_row0 = (uint8_t *)pixman_image_get_data(vd->guest.fb);
2969 guest_stride = pixman_image_get_stride(vd->guest.fb);
2970 guest_ll = pixman_image_get_width(vd->guest.fb) * (DIV_ROUND_UP(guest_bpp, 8));
2971 }
2972 line_bytes = MIN(server_stride, guest_ll);
2973
2974 for (;;) {
2975 int x;
2976 uint8_t *guest_ptr, *server_ptr;
2977 unsigned long offset = find_next_bit((unsigned long *) &vd->guest.dirty,
2978 height * VNC_DIRTY_BPL(&vd->guest),
2979 y * VNC_DIRTY_BPL(&vd->guest));
2980 if (offset == height * VNC_DIRTY_BPL(&vd->guest)) {
2981 /* no more dirty bits */
2982 break;
2983 }
2984 y = offset / VNC_DIRTY_BPL(&vd->guest);
2985 x = offset % VNC_DIRTY_BPL(&vd->guest);
2986
2987 server_ptr = server_row0 + y * server_stride + x * cmp_bytes;
2988
2989 if (vd->guest.format != VNC_SERVER_FB_FORMAT) {
2990 qemu_pixman_linebuf_fill(tmpbuf, vd->guest.fb, width, 0, y);
2991 guest_ptr = (uint8_t *)pixman_image_get_data(tmpbuf);
2992 } else {
2993 guest_ptr = guest_row0 + y * guest_stride;
2994 }
2995 guest_ptr += x * cmp_bytes;
2996
2997 for (; x < DIV_ROUND_UP(width, VNC_DIRTY_PIXELS_PER_BIT);
2998 x++, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) {
2999 int _cmp_bytes = cmp_bytes;
3000 if (!test_and_clear_bit(x, vd->guest.dirty[y])) {
3001 continue;
3002 }
3003 if ((x + 1) * cmp_bytes > line_bytes) {
3004 _cmp_bytes = line_bytes - x * cmp_bytes;
3005 }
3006 assert(_cmp_bytes >= 0);
3007 if (memcmp(server_ptr, guest_ptr, _cmp_bytes) == 0) {
3008 continue;
3009 }
3010 memcpy(server_ptr, guest_ptr, _cmp_bytes);
3011 if (!vd->non_adaptive) {
3012 vnc_rect_updated(vd, x * VNC_DIRTY_PIXELS_PER_BIT,
3013 y, &tv);
3014 }
3015 QTAILQ_FOREACH(vs, &vd->clients, next) {
3016 set_bit(x, vs->dirty[y]);
3017 }
3018 has_dirty++;
3019 }
3020
3021 y++;
3022 }
3023 qemu_pixman_image_unref(tmpbuf);
3024 return has_dirty;
3025 }
3026
3027 static void vnc_refresh(DisplayChangeListener *dcl)
3028 {
3029 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
3030 VncState *vs, *vn;
3031 int has_dirty, rects = 0;
3032
3033 if (QTAILQ_EMPTY(&vd->clients)) {
3034 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_MAX);
3035 return;
3036 }
3037
3038 graphic_hw_update(vd->dcl.con);
3039
3040 if (vnc_trylock_display(vd)) {
3041 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
3042 return;
3043 }
3044
3045 has_dirty = vnc_refresh_server_surface(vd);
3046 vnc_unlock_display(vd);
3047
3048 QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {
3049 rects += vnc_update_client(vs, has_dirty);
3050 /* vs might be free()ed here */
3051 }
3052
3053 if (has_dirty && rects) {
3054 vd->dcl.update_interval /= 2;
3055 if (vd->dcl.update_interval < VNC_REFRESH_INTERVAL_BASE) {
3056 vd->dcl.update_interval = VNC_REFRESH_INTERVAL_BASE;
3057 }
3058 } else {
3059 vd->dcl.update_interval += VNC_REFRESH_INTERVAL_INC;
3060 if (vd->dcl.update_interval > VNC_REFRESH_INTERVAL_MAX) {
3061 vd->dcl.update_interval = VNC_REFRESH_INTERVAL_MAX;
3062 }
3063 }
3064 }
3065
3066 static void vnc_connect(VncDisplay *vd, QIOChannelSocket *sioc,
3067 bool skipauth, bool websocket)
3068 {
3069 VncState *vs = g_new0(VncState, 1);
3070 bool first_client = QTAILQ_EMPTY(&vd->clients);
3071 int i;
3072
3073 trace_vnc_client_connect(vs, sioc);
3074 vs->magic = VNC_MAGIC;
3075 vs->sioc = sioc;
3076 object_ref(OBJECT(vs->sioc));
3077 vs->ioc = QIO_CHANNEL(sioc);
3078 object_ref(OBJECT(vs->ioc));
3079 vs->vd = vd;
3080
3081 buffer_init(&vs->input, "vnc-input/%p", sioc);
3082 buffer_init(&vs->output, "vnc-output/%p", sioc);
3083 buffer_init(&vs->jobs_buffer, "vnc-jobs_buffer/%p", sioc);
3084
3085 buffer_init(&vs->tight.tight, "vnc-tight/%p", sioc);
3086 buffer_init(&vs->tight.zlib, "vnc-tight-zlib/%p", sioc);
3087 buffer_init(&vs->tight.gradient, "vnc-tight-gradient/%p", sioc);
3088 #ifdef CONFIG_VNC_JPEG
3089 buffer_init(&vs->tight.jpeg, "vnc-tight-jpeg/%p", sioc);
3090 #endif
3091 #ifdef CONFIG_VNC_PNG
3092 buffer_init(&vs->tight.png, "vnc-tight-png/%p", sioc);
3093 #endif
3094 buffer_init(&vs->zlib.zlib, "vnc-zlib/%p", sioc);
3095 buffer_init(&vs->zrle.zrle, "vnc-zrle/%p", sioc);
3096 buffer_init(&vs->zrle.fb, "vnc-zrle-fb/%p", sioc);
3097 buffer_init(&vs->zrle.zlib, "vnc-zrle-zlib/%p", sioc);
3098
3099 if (skipauth) {
3100 vs->auth = VNC_AUTH_NONE;
3101 vs->subauth = VNC_AUTH_INVALID;
3102 } else {
3103 if (websocket) {
3104 vs->auth = vd->ws_auth;
3105 vs->subauth = VNC_AUTH_INVALID;
3106 } else {
3107 vs->auth = vd->auth;
3108 vs->subauth = vd->subauth;
3109 }
3110 }
3111 VNC_DEBUG("Client sioc=%p ws=%d auth=%d subauth=%d\n",
3112 sioc, websocket, vs->auth, vs->subauth);
3113
3114 vs->lossy_rect = g_malloc0(VNC_STAT_ROWS * sizeof (*vs->lossy_rect));
3115 for (i = 0; i < VNC_STAT_ROWS; ++i) {
3116 vs->lossy_rect[i] = g_new0(uint8_t, VNC_STAT_COLS);
3117 }
3118
3119 VNC_DEBUG("New client on socket %p\n", vs->sioc);
3120 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
3121 qio_channel_set_blocking(vs->ioc, false, NULL);
3122 if (vs->ioc_tag) {
3123 g_source_remove(vs->ioc_tag);
3124 }
3125 if (websocket) {
3126 vs->websocket = 1;
3127 if (vd->tlscreds) {
3128 vs->ioc_tag = qio_channel_add_watch(
3129 vs->ioc, G_IO_IN, vncws_tls_handshake_io, vs, NULL);
3130 } else {
3131 vs->ioc_tag = qio_channel_add_watch(
3132 vs->ioc, G_IO_IN, vncws_handshake_io, vs, NULL);
3133 }
3134 } else {
3135 vs->ioc_tag = qio_channel_add_watch(
3136 vs->ioc, G_IO_IN, vnc_client_io, vs, NULL);
3137 }
3138
3139 vnc_client_cache_addr(vs);
3140 vnc_qmp_event(vs, QAPI_EVENT_VNC_CONNECTED);
3141 vnc_set_share_mode(vs, VNC_SHARE_MODE_CONNECTING);
3142
3143 vs->last_x = -1;
3144 vs->last_y = -1;
3145
3146 vs->as.freq = 44100;
3147 vs->as.nchannels = 2;
3148 vs->as.fmt = AUD_FMT_S16;
3149 vs->as.endianness = 0;
3150
3151 qemu_mutex_init(&vs->output_mutex);
3152 vs->bh = qemu_bh_new(vnc_jobs_bh, vs);
3153
3154 QTAILQ_INSERT_TAIL(&vd->clients, vs, next);
3155 if (first_client) {
3156 vnc_update_server_surface(vd);
3157 }
3158
3159 graphic_hw_update(vd->dcl.con);
3160
3161 if (!vs->websocket) {
3162 vnc_start_protocol(vs);
3163 }
3164
3165 if (vd->num_connecting > vd->connections_limit) {
3166 QTAILQ_FOREACH(vs, &vd->clients, next) {
3167 if (vs->share_mode == VNC_SHARE_MODE_CONNECTING) {
3168 vnc_disconnect_start(vs);
3169 return;
3170 }
3171 }
3172 }
3173 }
3174
3175 void vnc_start_protocol(VncState *vs)
3176 {
3177 vnc_write(vs, "RFB 003.008\n", 12);
3178 vnc_flush(vs);
3179 vnc_read_when(vs, protocol_version, 12);
3180
3181 vs->mouse_mode_notifier.notify = check_pointer_type_change;
3182 qemu_add_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
3183 }
3184
3185 static void vnc_listen_io(QIONetListener *listener,
3186 QIOChannelSocket *cioc,
3187 void *opaque)
3188 {
3189 VncDisplay *vd = opaque;
3190 bool isWebsock = listener == vd->wslistener;
3191
3192 qio_channel_set_name(QIO_CHANNEL(cioc),
3193 isWebsock ? "vnc-ws-server" : "vnc-server");
3194 qio_channel_set_delay(QIO_CHANNEL(cioc), false);
3195 vnc_connect(vd, cioc, false, isWebsock);
3196 }
3197
3198 static const DisplayChangeListenerOps dcl_ops = {
3199 .dpy_name = "vnc",
3200 .dpy_refresh = vnc_refresh,
3201 .dpy_gfx_update = vnc_dpy_update,
3202 .dpy_gfx_switch = vnc_dpy_switch,
3203 .dpy_gfx_check_format = qemu_pixman_check_format,
3204 .dpy_mouse_set = vnc_mouse_set,
3205 .dpy_cursor_define = vnc_dpy_cursor_define,
3206 };
3207
3208 void vnc_display_init(const char *id)
3209 {
3210 VncDisplay *vd;
3211
3212 if (vnc_display_find(id) != NULL) {
3213 return;
3214 }
3215 vd = g_malloc0(sizeof(*vd));
3216
3217 vd->id = strdup(id);
3218 QTAILQ_INSERT_TAIL(&vnc_displays, vd, next);
3219
3220 QTAILQ_INIT(&vd->clients);
3221 vd->expires = TIME_MAX;
3222
3223 if (keyboard_layout) {
3224 trace_vnc_key_map_init(keyboard_layout);
3225 vd->kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout);
3226 } else {
3227 vd->kbd_layout = init_keyboard_layout(name2keysym, "en-us");
3228 }
3229
3230 if (!vd->kbd_layout) {
3231 exit(1);
3232 }
3233
3234 vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
3235 vd->connections_limit = 32;
3236
3237 qemu_mutex_init(&vd->mutex);
3238 vnc_start_worker_thread();
3239
3240 vd->dcl.ops = &dcl_ops;
3241 register_displaychangelistener(&vd->dcl);
3242 }
3243
3244
3245 static void vnc_display_close(VncDisplay *vd)
3246 {
3247 if (!vd) {
3248 return;
3249 }
3250 vd->is_unix = false;
3251
3252 if (vd->listener) {
3253 qio_net_listener_disconnect(vd->listener);
3254 object_unref(OBJECT(vd->listener));
3255 }
3256 vd->listener = NULL;
3257
3258 if (vd->wslistener) {
3259 qio_net_listener_disconnect(vd->wslistener);
3260 object_unref(OBJECT(vd->wslistener));
3261 }
3262 vd->wslistener = NULL;
3263
3264 vd->auth = VNC_AUTH_INVALID;
3265 vd->subauth = VNC_AUTH_INVALID;
3266 if (vd->tlscreds) {
3267 object_unparent(OBJECT(vd->tlscreds));
3268 vd->tlscreds = NULL;
3269 }
3270 g_free(vd->tlsaclname);
3271 vd->tlsaclname = NULL;
3272 if (vd->lock_key_sync) {
3273 qemu_remove_led_event_handler(vd->led);
3274 vd->led = NULL;
3275 }
3276 }
3277
3278 int vnc_display_password(const char *id, const char *password)
3279 {
3280 VncDisplay *vd = vnc_display_find(id);
3281
3282 if (!vd) {
3283 return -EINVAL;
3284 }
3285 if (vd->auth == VNC_AUTH_NONE) {
3286 error_printf_unless_qmp("If you want use passwords please enable "
3287 "password auth using '-vnc ${dpy},password'.\n");
3288 return -EINVAL;
3289 }
3290
3291 g_free(vd->password);
3292 vd->password = g_strdup(password);
3293
3294 return 0;
3295 }
3296
3297 int vnc_display_pw_expire(const char *id, time_t expires)
3298 {
3299 VncDisplay *vd = vnc_display_find(id);
3300
3301 if (!vd) {
3302 return -EINVAL;
3303 }
3304
3305 vd->expires = expires;
3306 return 0;
3307 }
3308
3309 static void vnc_display_print_local_addr(VncDisplay *vd)
3310 {
3311 SocketAddress *addr;
3312 Error *err = NULL;
3313
3314 if (!vd->listener || !vd->listener->nsioc) {
3315 return;
3316 }
3317
3318 addr = qio_channel_socket_get_local_address(vd->listener->sioc[0], &err);
3319 if (!addr) {
3320 return;
3321 }
3322
3323 if (addr->type != SOCKET_ADDRESS_TYPE_INET) {
3324 qapi_free_SocketAddress(addr);
3325 return;
3326 }
3327 error_printf_unless_qmp("VNC server running on %s:%s\n",
3328 addr->u.inet.host,
3329 addr->u.inet.port);
3330 qapi_free_SocketAddress(addr);
3331 }
3332
3333 static QemuOptsList qemu_vnc_opts = {
3334 .name = "vnc",
3335 .head = QTAILQ_HEAD_INITIALIZER(qemu_vnc_opts.head),
3336 .implied_opt_name = "vnc",
3337 .desc = {
3338 {
3339 .name = "vnc",
3340 .type = QEMU_OPT_STRING,
3341 },{
3342 .name = "websocket",
3343 .type = QEMU_OPT_STRING,
3344 },{
3345 .name = "tls-creds",
3346 .type = QEMU_OPT_STRING,
3347 },{
3348 .name = "share",
3349 .type = QEMU_OPT_STRING,
3350 },{
3351 .name = "display",
3352 .type = QEMU_OPT_STRING,
3353 },{
3354 .name = "head",
3355 .type = QEMU_OPT_NUMBER,
3356 },{
3357 .name = "connections",
3358 .type = QEMU_OPT_NUMBER,
3359 },{
3360 .name = "to",
3361 .type = QEMU_OPT_NUMBER,
3362 },{
3363 .name = "ipv4",
3364 .type = QEMU_OPT_BOOL,
3365 },{
3366 .name = "ipv6",
3367 .type = QEMU_OPT_BOOL,
3368 },{
3369 .name = "password",
3370 .type = QEMU_OPT_BOOL,
3371 },{
3372 .name = "reverse",
3373 .type = QEMU_OPT_BOOL,
3374 },{
3375 .name = "lock-key-sync",
3376 .type = QEMU_OPT_BOOL,
3377 },{
3378 .name = "key-delay-ms",
3379 .type = QEMU_OPT_NUMBER,
3380 },{
3381 .name = "sasl",
3382 .type = QEMU_OPT_BOOL,
3383 },{
3384 .name = "acl",
3385 .type = QEMU_OPT_BOOL,
3386 },{
3387 .name = "lossy",
3388 .type = QEMU_OPT_BOOL,
3389 },{
3390 .name = "non-adaptive",
3391 .type = QEMU_OPT_BOOL,
3392 },
3393 { /* end of list */ }
3394 },
3395 };
3396
3397
3398 static int
3399 vnc_display_setup_auth(int *auth,
3400 int *subauth,
3401 QCryptoTLSCreds *tlscreds,
3402 bool password,
3403 bool sasl,
3404 bool websocket,
3405 Error **errp)
3406 {
3407 /*
3408 * We have a choice of 3 authentication options
3409 *
3410 * 1. none
3411 * 2. vnc
3412 * 3. sasl
3413 *
3414 * The channel can be run in 2 modes
3415 *
3416 * 1. clear
3417 * 2. tls
3418 *
3419 * And TLS can use 2 types of credentials
3420 *
3421 * 1. anon
3422 * 2. x509
3423 *
3424 * We thus have 9 possible logical combinations
3425 *
3426 * 1. clear + none
3427 * 2. clear + vnc
3428 * 3. clear + sasl
3429 * 4. tls + anon + none
3430 * 5. tls + anon + vnc
3431 * 6. tls + anon + sasl
3432 * 7. tls + x509 + none
3433 * 8. tls + x509 + vnc
3434 * 9. tls + x509 + sasl
3435 *
3436 * These need to be mapped into the VNC auth schemes
3437 * in an appropriate manner. In regular VNC, all the
3438 * TLS options get mapped into VNC_AUTH_VENCRYPT
3439 * sub-auth types.
3440 *
3441 * In websockets, the https:// protocol already provides
3442 * TLS support, so there is no need to make use of the
3443 * VeNCrypt extension. Furthermore, websockets browser
3444 * clients could not use VeNCrypt even if they wanted to,
3445 * as they cannot control when the TLS handshake takes
3446 * place. Thus there is no option but to rely on https://,
3447 * meaning combinations 4->6 and 7->9 will be mapped to
3448 * VNC auth schemes in the same way as combos 1->3.
3449 *
3450 * Regardless of fact that we have a different mapping to
3451 * VNC auth mechs for plain VNC vs websockets VNC, the end
3452 * result has the same security characteristics.
3453 */
3454 if (websocket || !tlscreds) {
3455 if (password) {
3456 VNC_DEBUG("Initializing VNC server with password auth\n");
3457 *auth = VNC_AUTH_VNC;
3458 } else if (sasl) {
3459 VNC_DEBUG("Initializing VNC server with SASL auth\n");
3460 *auth = VNC_AUTH_SASL;
3461 } else {
3462 VNC_DEBUG("Initializing VNC server with no auth\n");
3463 *auth = VNC_AUTH_NONE;
3464 }
3465 *subauth = VNC_AUTH_INVALID;
3466 } else {
3467 bool is_x509 = object_dynamic_cast(OBJECT(tlscreds),
3468 TYPE_QCRYPTO_TLS_CREDS_X509) != NULL;
3469 bool is_anon = object_dynamic_cast(OBJECT(tlscreds),
3470 TYPE_QCRYPTO_TLS_CREDS_ANON) != NULL;
3471
3472 if (!is_x509 && !is_anon) {
3473 error_setg(errp,
3474 "Unsupported TLS cred type %s",
3475 object_get_typename(OBJECT(tlscreds)));
3476 return -1;
3477 }
3478 *auth = VNC_AUTH_VENCRYPT;
3479 if (password) {
3480 if (is_x509) {
3481 VNC_DEBUG("Initializing VNC server with x509 password auth\n");
3482 *subauth = VNC_AUTH_VENCRYPT_X509VNC;
3483 } else {
3484 VNC_DEBUG("Initializing VNC server with TLS password auth\n");
3485 *subauth = VNC_AUTH_VENCRYPT_TLSVNC;
3486 }
3487
3488 } else if (sasl) {
3489 if (is_x509) {
3490 VNC_DEBUG("Initializing VNC server with x509 SASL auth\n");
3491 *subauth = VNC_AUTH_VENCRYPT_X509SASL;
3492 } else {
3493 VNC_DEBUG("Initializing VNC server with TLS SASL auth\n");
3494 *subauth = VNC_AUTH_VENCRYPT_TLSSASL;
3495 }
3496 } else {
3497 if (is_x509) {
3498 VNC_DEBUG("Initializing VNC server with x509 no auth\n");
3499 *subauth = VNC_AUTH_VENCRYPT_X509NONE;
3500 } else {
3501 VNC_DEBUG("Initializing VNC server with TLS no auth\n");
3502 *subauth = VNC_AUTH_VENCRYPT_TLSNONE;
3503 }
3504 }
3505 }
3506 return 0;
3507 }
3508
3509
3510 static int vnc_display_get_address(const char *addrstr,
3511 bool websocket,
3512 bool reverse,
3513 int displaynum,
3514 int to,
3515 bool has_ipv4,
3516 bool has_ipv6,
3517 bool ipv4,
3518 bool ipv6,
3519 SocketAddress **retaddr,
3520 Error **errp)
3521 {
3522 int ret = -1;
3523 SocketAddress *addr = NULL;
3524
3525 addr = g_new0(SocketAddress, 1);
3526
3527 if (strncmp(addrstr, "unix:", 5) == 0) {
3528 addr->type = SOCKET_ADDRESS_TYPE_UNIX;
3529 addr->u.q_unix.path = g_strdup(addrstr + 5);
3530
3531 if (websocket) {
3532 error_setg(errp, "UNIX sockets not supported with websock");
3533 goto cleanup;
3534 }
3535
3536 if (to) {
3537 error_setg(errp, "Port range not support with UNIX socket");
3538 goto cleanup;
3539 }
3540 ret = 0;
3541 } else {
3542 const char *port;
3543 size_t hostlen;
3544 unsigned long long baseport = 0;
3545 InetSocketAddress *inet;
3546
3547 port = strrchr(addrstr, ':');
3548 if (!port) {
3549 if (websocket) {
3550 hostlen = 0;
3551 port = addrstr;
3552 } else {
3553 error_setg(errp, "no vnc port specified");
3554 goto cleanup;
3555 }
3556 } else {
3557 hostlen = port - addrstr;
3558 port++;
3559 if (*port == '\0') {
3560 error_setg(errp, "vnc port cannot be empty");
3561 goto cleanup;
3562 }
3563 }
3564
3565 addr->type = SOCKET_ADDRESS_TYPE_INET;
3566 inet = &addr->u.inet;
3567 if (addrstr[0] == '[' && addrstr[hostlen - 1] == ']') {
3568 inet->host = g_strndup(addrstr + 1, hostlen - 2);
3569 } else {
3570 inet->host = g_strndup(addrstr, hostlen);
3571 }
3572 /* plain VNC port is just an offset, for websocket
3573 * port is absolute */
3574 if (websocket) {
3575 if (g_str_equal(addrstr, "") ||
3576 g_str_equal(addrstr, "on")) {
3577 if (displaynum == -1) {
3578 error_setg(errp, "explicit websocket port is required");
3579 goto cleanup;
3580 }
3581 inet->port = g_strdup_printf(
3582 "%d", displaynum + 5700);
3583 if (to) {
3584 inet->has_to = true;
3585 inet->to = to + 5700;
3586 }
3587 } else {
3588 inet->port = g_strdup(port);
3589 }
3590 } else {
3591 int offset = reverse ? 0 : 5900;
3592 if (parse_uint_full(port, &baseport, 10) < 0) {
3593 error_setg(errp, "can't convert to a number: %s", port);
3594 goto cleanup;
3595 }
3596 if (baseport > 65535 ||
3597 baseport + offset > 65535) {
3598 error_setg(errp, "port %s out of range", port);
3599 goto cleanup;
3600 }
3601 inet->port = g_strdup_printf(
3602 "%d", (int)baseport + offset);
3603
3604 if (to) {
3605 inet->has_to = true;
3606 inet->to = to + offset;
3607 }
3608 }
3609
3610 inet->ipv4 = ipv4;
3611 inet->has_ipv4 = has_ipv4;
3612 inet->ipv6 = ipv6;
3613 inet->has_ipv6 = has_ipv6;
3614
3615 ret = baseport;
3616 }
3617
3618 *retaddr = addr;
3619
3620 cleanup:
3621 if (ret < 0) {
3622 qapi_free_SocketAddress(addr);
3623 }
3624 return ret;
3625 }
3626
3627 static void vnc_free_addresses(SocketAddress ***retsaddr,
3628 size_t *retnsaddr)
3629 {
3630 size_t i;
3631
3632 for (i = 0; i < *retnsaddr; i++) {
3633 qapi_free_SocketAddress((*retsaddr)[i]);
3634 }
3635 g_free(*retsaddr);
3636
3637 *retsaddr = NULL;
3638 *retnsaddr = 0;
3639 }
3640
3641 static int vnc_display_get_addresses(QemuOpts *opts,
3642 bool reverse,
3643 SocketAddress ***retsaddr,
3644 size_t *retnsaddr,
3645 SocketAddress ***retwsaddr,
3646 size_t *retnwsaddr,
3647 Error **errp)
3648 {
3649 SocketAddress *saddr = NULL;
3650 SocketAddress *wsaddr = NULL;
3651 QemuOptsIter addriter;
3652 const char *addr;
3653 int to = qemu_opt_get_number(opts, "to", 0);
3654 bool has_ipv4 = qemu_opt_get(opts, "ipv4");
3655 bool has_ipv6 = qemu_opt_get(opts, "ipv6");
3656 bool ipv4 = qemu_opt_get_bool(opts, "ipv4", false);
3657 bool ipv6 = qemu_opt_get_bool(opts, "ipv6", false);
3658 int displaynum = -1;
3659 int ret = -1;
3660
3661 *retsaddr = NULL;
3662 *retnsaddr = 0;
3663 *retwsaddr = NULL;
3664 *retnwsaddr = 0;
3665
3666 addr = qemu_opt_get(opts, "vnc");
3667 if (addr == NULL || g_str_equal(addr, "none")) {
3668 ret = 0;
3669 goto cleanup;
3670 }
3671 if (qemu_opt_get(opts, "websocket") &&
3672 !qcrypto_hash_supports(QCRYPTO_HASH_ALG_SHA1)) {
3673 error_setg(errp,
3674 "SHA1 hash support is required for websockets");
3675 goto cleanup;
3676 }
3677
3678 qemu_opt_iter_init(&addriter, opts, "vnc");
3679 while ((addr = qemu_opt_iter_next(&addriter)) != NULL) {
3680 int rv;
3681 rv = vnc_display_get_address(addr, false, reverse, 0, to,
3682 has_ipv4, has_ipv6,
3683 ipv4, ipv6,
3684 &saddr, errp);
3685 if (rv < 0) {
3686 goto cleanup;
3687 }
3688 /* Historical compat - first listen address can be used
3689 * to set the default websocket port
3690 */
3691 if (displaynum == -1) {
3692 displaynum = rv;
3693 }
3694 *retsaddr = g_renew(SocketAddress *, *retsaddr, *retnsaddr + 1);
3695 (*retsaddr)[(*retnsaddr)++] = saddr;
3696 }
3697
3698 /* If we had multiple primary displays, we don't do defaults
3699 * for websocket, and require explicit config instead. */
3700 if (*retnsaddr > 1) {
3701 displaynum = -1;
3702 }
3703
3704 qemu_opt_iter_init(&addriter, opts, "websocket");
3705 while ((addr = qemu_opt_iter_next(&addriter)) != NULL) {
3706 if (vnc_display_get_address(addr, true, reverse, displaynum, to,
3707 has_ipv4, has_ipv6,
3708 ipv4, ipv6,
3709 &wsaddr, errp) < 0) {
3710 goto cleanup;
3711 }
3712
3713 /* Historical compat - if only a single listen address was
3714 * provided, then this is used to set the default listen
3715 * address for websocket too
3716 */
3717 if (*retnsaddr == 1 &&
3718 (*retsaddr)[0]->type == SOCKET_ADDRESS_TYPE_INET &&
3719 wsaddr->type == SOCKET_ADDRESS_TYPE_INET &&
3720 g_str_equal(wsaddr->u.inet.host, "") &&
3721 !g_str_equal((*retsaddr)[0]->u.inet.host, "")) {
3722 g_free(wsaddr->u.inet.host);
3723 wsaddr->u.inet.host = g_strdup((*retsaddr)[0]->u.inet.host);
3724 }
3725
3726 *retwsaddr = g_renew(SocketAddress *, *retwsaddr, *retnwsaddr + 1);
3727 (*retwsaddr)[(*retnwsaddr)++] = wsaddr;
3728 }
3729
3730 ret = 0;
3731 cleanup:
3732 if (ret < 0) {
3733 vnc_free_addresses(retsaddr, retnsaddr);
3734 vnc_free_addresses(retwsaddr, retnwsaddr);
3735 }
3736 return ret;
3737 }
3738
3739 static int vnc_display_connect(VncDisplay *vd,
3740 SocketAddress **saddr,
3741 size_t nsaddr,
3742 SocketAddress **wsaddr,
3743 size_t nwsaddr,
3744 Error **errp)
3745 {
3746 /* connect to viewer */
3747 QIOChannelSocket *sioc = NULL;
3748 if (nwsaddr != 0) {
3749 error_setg(errp, "Cannot use websockets in reverse mode");
3750 return -1;
3751 }
3752 if (nsaddr != 1) {
3753 error_setg(errp, "Expected a single address in reverse mode");
3754 return -1;
3755 }
3756 /* TODO SOCKET_ADDRESS_TYPE_FD when fd has AF_UNIX */
3757 vd->is_unix = saddr[0]->type == SOCKET_ADDRESS_TYPE_UNIX;
3758 sioc = qio_channel_socket_new();
3759 qio_channel_set_name(QIO_CHANNEL(sioc), "vnc-reverse");
3760 if (qio_channel_socket_connect_sync(sioc, saddr[0], errp) < 0) {
3761 return -1;
3762 }
3763 vnc_connect(vd, sioc, false, false);
3764 object_unref(OBJECT(sioc));
3765 return 0;
3766 }
3767
3768
3769 static int vnc_display_listen(VncDisplay *vd,
3770 SocketAddress **saddr,
3771 size_t nsaddr,
3772 SocketAddress **wsaddr,
3773 size_t nwsaddr,
3774 Error **errp)
3775 {
3776 size_t i;
3777
3778 if (nsaddr) {
3779 vd->listener = qio_net_listener_new();
3780 qio_net_listener_set_name(vd->listener, "vnc-listen");
3781 for (i = 0; i < nsaddr; i++) {
3782 if (qio_net_listener_open_sync(vd->listener,
3783 saddr[i],
3784 errp) < 0) {
3785 return -1;
3786 }
3787 }
3788
3789 qio_net_listener_set_client_func(vd->listener,
3790 vnc_listen_io, vd, NULL);
3791 }
3792
3793 if (nwsaddr) {
3794 vd->wslistener = qio_net_listener_new();
3795 qio_net_listener_set_name(vd->wslistener, "vnc-ws-listen");
3796 for (i = 0; i < nwsaddr; i++) {
3797 if (qio_net_listener_open_sync(vd->wslistener,
3798 wsaddr[i],
3799 errp) < 0) {
3800 return -1;
3801 }
3802 }
3803
3804 qio_net_listener_set_client_func(vd->wslistener,
3805 vnc_listen_io, vd, NULL);
3806 }
3807
3808 return 0;
3809 }
3810
3811
3812 void vnc_display_open(const char *id, Error **errp)
3813 {
3814 VncDisplay *vd = vnc_display_find(id);
3815 QemuOpts *opts = qemu_opts_find(&qemu_vnc_opts, id);
3816 SocketAddress **saddr = NULL, **wsaddr = NULL;
3817 size_t nsaddr, nwsaddr;
3818 const char *share, *device_id;
3819 QemuConsole *con;
3820 bool password = false;
3821 bool reverse = false;
3822 const char *credid;
3823 bool sasl = false;
3824 #ifdef CONFIG_VNC_SASL
3825 int saslErr;
3826 #endif
3827 int acl = 0;
3828 int lock_key_sync = 1;
3829 int key_delay_ms;
3830
3831 if (!vd) {
3832 error_setg(errp, "VNC display not active");
3833 return;
3834 }
3835 vnc_display_close(vd);
3836
3837 if (!opts) {
3838 return;
3839 }
3840
3841 reverse = qemu_opt_get_bool(opts, "reverse", false);
3842 if (vnc_display_get_addresses(opts, reverse, &saddr, &nsaddr,
3843 &wsaddr, &nwsaddr, errp) < 0) {
3844 goto fail;
3845 }
3846
3847 password = qemu_opt_get_bool(opts, "password", false);
3848 if (password) {
3849 if (fips_get_state()) {
3850 error_setg(errp,
3851 "VNC password auth disabled due to FIPS mode, "
3852 "consider using the VeNCrypt or SASL authentication "
3853 "methods as an alternative");
3854 goto fail;
3855 }
3856 if (!qcrypto_cipher_supports(
3857 QCRYPTO_CIPHER_ALG_DES_RFB, QCRYPTO_CIPHER_MODE_ECB)) {
3858 error_setg(errp,
3859 "Cipher backend does not support DES RFB algorithm");
3860 goto fail;
3861 }
3862 }
3863
3864 lock_key_sync = qemu_opt_get_bool(opts, "lock-key-sync", true);
3865 key_delay_ms = qemu_opt_get_number(opts, "key-delay-ms", 10);
3866 sasl = qemu_opt_get_bool(opts, "sasl", false);
3867 #ifndef CONFIG_VNC_SASL
3868 if (sasl) {
3869 error_setg(errp, "VNC SASL auth requires cyrus-sasl support");
3870 goto fail;
3871 }
3872 #endif /* CONFIG_VNC_SASL */
3873 credid = qemu_opt_get(opts, "tls-creds");
3874 if (credid) {
3875 Object *creds;
3876 creds = object_resolve_path_component(
3877 object_get_objects_root(), credid);
3878 if (!creds) {
3879 error_setg(errp, "No TLS credentials with id '%s'",
3880 credid);
3881 goto fail;
3882 }
3883 vd->tlscreds = (QCryptoTLSCreds *)
3884 object_dynamic_cast(creds,
3885 TYPE_QCRYPTO_TLS_CREDS);
3886 if (!vd->tlscreds) {
3887 error_setg(errp, "Object with id '%s' is not TLS credentials",
3888 credid);
3889 goto fail;
3890 }
3891 object_ref(OBJECT(vd->tlscreds));
3892
3893 if (vd->tlscreds->endpoint != QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
3894 error_setg(errp,
3895 "Expecting TLS credentials with a server endpoint");
3896 goto fail;
3897 }
3898 }
3899 acl = qemu_opt_get_bool(opts, "acl", false);
3900
3901 share = qemu_opt_get(opts, "share");
3902 if (share) {
3903 if (strcmp(share, "ignore") == 0) {
3904 vd->share_policy = VNC_SHARE_POLICY_IGNORE;
3905 } else if (strcmp(share, "allow-exclusive") == 0) {
3906 vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
3907 } else if (strcmp(share, "force-shared") == 0) {
3908 vd->share_policy = VNC_SHARE_POLICY_FORCE_SHARED;
3909 } else {
3910 error_setg(errp, "unknown vnc share= option");
3911 goto fail;
3912 }
3913 } else {
3914 vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
3915 }
3916 vd->connections_limit = qemu_opt_get_number(opts, "connections", 32);
3917
3918 #ifdef CONFIG_VNC_JPEG
3919 vd->lossy = qemu_opt_get_bool(opts, "lossy", false);
3920 #endif
3921 vd->non_adaptive = qemu_opt_get_bool(opts, "non-adaptive", false);
3922 /* adaptive updates are only used with tight encoding and
3923 * if lossy updates are enabled so we can disable all the
3924 * calculations otherwise */
3925 if (!vd->lossy) {
3926 vd->non_adaptive = true;
3927 }
3928
3929 if (acl) {
3930 if (strcmp(vd->id, "default") == 0) {
3931 vd->tlsaclname = g_strdup("vnc.x509dname");
3932 } else {
3933 vd->tlsaclname = g_strdup_printf("vnc.%s.x509dname", vd->id);
3934 }
3935 qemu_acl_init(vd->tlsaclname);
3936 }
3937 #ifdef CONFIG_VNC_SASL
3938 if (acl && sasl) {
3939 char *aclname;
3940
3941 if (strcmp(vd->id, "default") == 0) {
3942 aclname = g_strdup("vnc.username");
3943 } else {
3944 aclname = g_strdup_printf("vnc.%s.username", vd->id);
3945 }
3946 vd->sasl.acl = qemu_acl_init(aclname);
3947 g_free(aclname);
3948 }
3949 #endif
3950
3951 if (vnc_display_setup_auth(&vd->auth, &vd->subauth,
3952 vd->tlscreds, password,
3953 sasl, false, errp) < 0) {
3954 goto fail;
3955 }
3956 trace_vnc_auth_init(vd, 0, vd->auth, vd->subauth);
3957
3958 if (vnc_display_setup_auth(&vd->ws_auth, &vd->ws_subauth,
3959 vd->tlscreds, password,
3960 sasl, true, errp) < 0) {
3961 goto fail;
3962 }
3963 trace_vnc_auth_init(vd, 1, vd->ws_auth, vd->ws_subauth);
3964
3965 #ifdef CONFIG_VNC_SASL
3966 if ((saslErr = sasl_server_init(NULL, "qemu")) != SASL_OK) {
3967 error_setg(errp, "Failed to initialize SASL auth: %s",
3968 sasl_errstring(saslErr, NULL, NULL));
3969 goto fail;
3970 }
3971 #endif
3972 vd->lock_key_sync = lock_key_sync;
3973 if (lock_key_sync) {
3974 vd->led = qemu_add_led_event_handler(kbd_leds, vd);
3975 }
3976 vd->ledstate = 0;
3977 vd->key_delay_ms = key_delay_ms;
3978
3979 device_id = qemu_opt_get(opts, "display");
3980 if (device_id) {
3981 int head = qemu_opt_get_number(opts, "head", 0);
3982 Error *err = NULL;
3983
3984 con = qemu_console_lookup_by_device_name(device_id, head, &err);
3985 if (err) {
3986 error_propagate(errp, err);
3987 goto fail;
3988 }
3989 } else {
3990 con = NULL;
3991 }
3992
3993 if (con != vd->dcl.con) {
3994 unregister_displaychangelistener(&vd->dcl);
3995 vd->dcl.con = con;
3996 register_displaychangelistener(&vd->dcl);
3997 }
3998
3999 if (saddr == NULL) {
4000 goto cleanup;
4001 }
4002
4003 if (reverse) {
4004 if (vnc_display_connect(vd, saddr, nsaddr, wsaddr, nwsaddr, errp) < 0) {
4005 goto fail;
4006 }
4007 } else {
4008 if (vnc_display_listen(vd, saddr, nsaddr, wsaddr, nwsaddr, errp) < 0) {
4009 goto fail;
4010 }
4011 }
4012
4013 if (qemu_opt_get(opts, "to")) {
4014 vnc_display_print_local_addr(vd);
4015 }
4016
4017 cleanup:
4018 vnc_free_addresses(&saddr, &nsaddr);
4019 vnc_free_addresses(&wsaddr, &nwsaddr);
4020 return;
4021
4022 fail:
4023 vnc_display_close(vd);
4024 goto cleanup;
4025 }
4026
4027 void vnc_display_add_client(const char *id, int csock, bool skipauth)
4028 {
4029 VncDisplay *vd = vnc_display_find(id);
4030 QIOChannelSocket *sioc;
4031
4032 if (!vd) {
4033 return;
4034 }
4035
4036 sioc = qio_channel_socket_new_fd(csock, NULL);
4037 if (sioc) {
4038 qio_channel_set_name(QIO_CHANNEL(sioc), "vnc-server");
4039 vnc_connect(vd, sioc, skipauth, false);
4040 object_unref(OBJECT(sioc));
4041 }
4042 }
4043
4044 static void vnc_auto_assign_id(QemuOptsList *olist, QemuOpts *opts)
4045 {
4046 int i = 2;
4047 char *id;
4048
4049 id = g_strdup("default");
4050 while (qemu_opts_find(olist, id)) {
4051 g_free(id);
4052 id = g_strdup_printf("vnc%d", i++);
4053 }
4054 qemu_opts_set_id(opts, id);
4055 }
4056
4057 QemuOpts *vnc_parse(const char *str, Error **errp)
4058 {
4059 QemuOptsList *olist = qemu_find_opts("vnc");
4060 QemuOpts *opts = qemu_opts_parse(olist, str, true, errp);
4061 const char *id;
4062
4063 if (!opts) {
4064 return NULL;
4065 }
4066
4067 id = qemu_opts_id(opts);
4068 if (!id) {
4069 /* auto-assign id if not present */
4070 vnc_auto_assign_id(olist, opts);
4071 }
4072 return opts;
4073 }
4074
4075 int vnc_init_func(void *opaque, QemuOpts *opts, Error **errp)
4076 {
4077 Error *local_err = NULL;
4078 char *id = (char *)qemu_opts_id(opts);
4079
4080 assert(id);
4081 vnc_display_init(id);
4082 vnc_display_open(id, &local_err);
4083 if (local_err != NULL) {
4084 error_reportf_err(local_err, "Failed to start VNC server: ");
4085 exit(1);
4086 }
4087 return 0;
4088 }
4089
4090 static void vnc_register_config(void)
4091 {
4092 qemu_add_opts(&qemu_vnc_opts);
4093 }
4094 opts_init(vnc_register_config);
QEMU mirror