]> git.proxmox.com Git - mirror_qemu.git/blob - ui/vnc.c
projects / mirror_qemu.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into staging
[mirror_qemu.git] / ui / vnc.c
1 /*
2 * QEMU VNC display driver
3 *
4 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5 * Copyright (C) 2006 Fabrice Bellard
6 * Copyright (C) 2009 Red Hat, Inc
7 *
8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to deal
10 * in the Software without restriction, including without limitation the rights
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12 * copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
14 *
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
17 *
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24 * THE SOFTWARE.
25 */
26
27 #include "qemu/osdep.h"
28 #include "vnc.h"
29 #include "vnc-jobs.h"
30 #include "trace.h"
31 #include "sysemu/sysemu.h"
32 #include "qemu/error-report.h"
33 #include "qemu/option.h"
34 #include "qemu/sockets.h"
35 #include "qemu/timer.h"
36 #include "qemu/acl.h"
37 #include "qemu/config-file.h"
38 #include "qapi/qapi-events.h"
39 #include "qapi/error.h"
40 #include "qapi/qapi-commands-ui.h"
41 #include "ui/input.h"
42 #include "crypto/hash.h"
43 #include "crypto/tlscredsanon.h"
44 #include "crypto/tlscredsx509.h"
45 #include "qom/object_interfaces.h"
46 #include "qemu/cutils.h"
47 #include "io/dns-resolver.h"
48
49 #define VNC_REFRESH_INTERVAL_BASE GUI_REFRESH_INTERVAL_DEFAULT
50 #define VNC_REFRESH_INTERVAL_INC 50
51 #define VNC_REFRESH_INTERVAL_MAX GUI_REFRESH_INTERVAL_IDLE
52 static const struct timeval VNC_REFRESH_STATS = { 0, 500000 };
53 static const struct timeval VNC_REFRESH_LOSSY = { 2, 0 };
54
55 #include "vnc_keysym.h"
56 #include "crypto/cipher.h"
57
58 static QTAILQ_HEAD(, VncDisplay) vnc_displays =
59 QTAILQ_HEAD_INITIALIZER(vnc_displays);
60
61 static int vnc_cursor_define(VncState *vs);
62 static void vnc_release_modifiers(VncState *vs);
63 static void vnc_update_throttle_offset(VncState *vs);
64
65 static void vnc_set_share_mode(VncState *vs, VncShareMode mode)
66 {
67 #ifdef _VNC_DEBUG
68 static const char *mn[] = {
69 [0] = "undefined",
70 [VNC_SHARE_MODE_CONNECTING] = "connecting",
71 [VNC_SHARE_MODE_SHARED] = "shared",
72 [VNC_SHARE_MODE_EXCLUSIVE] = "exclusive",
73 [VNC_SHARE_MODE_DISCONNECTED] = "disconnected",
74 };
75 fprintf(stderr, "%s/%p: %s -> %s\n", __func__,
76 vs->ioc, mn[vs->share_mode], mn[mode]);
77 #endif
78
79 switch (vs->share_mode) {
80 case VNC_SHARE_MODE_CONNECTING:
81 vs->vd->num_connecting--;
82 break;
83 case VNC_SHARE_MODE_SHARED:
84 vs->vd->num_shared--;
85 break;
86 case VNC_SHARE_MODE_EXCLUSIVE:
87 vs->vd->num_exclusive--;
88 break;
89 default:
90 break;
91 }
92
93 vs->share_mode = mode;
94
95 switch (vs->share_mode) {
96 case VNC_SHARE_MODE_CONNECTING:
97 vs->vd->num_connecting++;
98 break;
99 case VNC_SHARE_MODE_SHARED:
100 vs->vd->num_shared++;
101 break;
102 case VNC_SHARE_MODE_EXCLUSIVE:
103 vs->vd->num_exclusive++;
104 break;
105 default:
106 break;
107 }
108 }
109
110
111 static void vnc_init_basic_info(SocketAddress *addr,
112 VncBasicInfo *info,
113 Error **errp)
114 {
115 switch (addr->type) {
116 case SOCKET_ADDRESS_TYPE_INET:
117 info->host = g_strdup(addr->u.inet.host);
118 info->service = g_strdup(addr->u.inet.port);
119 if (addr->u.inet.ipv6) {
120 info->family = NETWORK_ADDRESS_FAMILY_IPV6;
121 } else {
122 info->family = NETWORK_ADDRESS_FAMILY_IPV4;
123 }
124 break;
125
126 case SOCKET_ADDRESS_TYPE_UNIX:
127 info->host = g_strdup("");
128 info->service = g_strdup(addr->u.q_unix.path);
129 info->family = NETWORK_ADDRESS_FAMILY_UNIX;
130 break;
131
132 case SOCKET_ADDRESS_TYPE_VSOCK:
133 case SOCKET_ADDRESS_TYPE_FD:
134 error_setg(errp, "Unsupported socket address type %s",
135 SocketAddressType_str(addr->type));
136 break;
137 default:
138 abort();
139 }
140
141 return;
142 }
143
144 static void vnc_init_basic_info_from_server_addr(QIOChannelSocket *ioc,
145 VncBasicInfo *info,
146 Error **errp)
147 {
148 SocketAddress *addr = NULL;
149
150 if (!ioc) {
151 error_setg(errp, "No listener socket available");
152 return;
153 }
154
155 addr = qio_channel_socket_get_local_address(ioc, errp);
156 if (!addr) {
157 return;
158 }
159
160 vnc_init_basic_info(addr, info, errp);
161 qapi_free_SocketAddress(addr);
162 }
163
164 static void vnc_init_basic_info_from_remote_addr(QIOChannelSocket *ioc,
165 VncBasicInfo *info,
166 Error **errp)
167 {
168 SocketAddress *addr = NULL;
169
170 addr = qio_channel_socket_get_remote_address(ioc, errp);
171 if (!addr) {
172 return;
173 }
174
175 vnc_init_basic_info(addr, info, errp);
176 qapi_free_SocketAddress(addr);
177 }
178
179 static const char *vnc_auth_name(VncDisplay *vd) {
180 switch (vd->auth) {
181 case VNC_AUTH_INVALID:
182 return "invalid";
183 case VNC_AUTH_NONE:
184 return "none";
185 case VNC_AUTH_VNC:
186 return "vnc";
187 case VNC_AUTH_RA2:
188 return "ra2";
189 case VNC_AUTH_RA2NE:
190 return "ra2ne";
191 case VNC_AUTH_TIGHT:
192 return "tight";
193 case VNC_AUTH_ULTRA:
194 return "ultra";
195 case VNC_AUTH_TLS:
196 return "tls";
197 case VNC_AUTH_VENCRYPT:
198 switch (vd->subauth) {
199 case VNC_AUTH_VENCRYPT_PLAIN:
200 return "vencrypt+plain";
201 case VNC_AUTH_VENCRYPT_TLSNONE:
202 return "vencrypt+tls+none";
203 case VNC_AUTH_VENCRYPT_TLSVNC:
204 return "vencrypt+tls+vnc";
205 case VNC_AUTH_VENCRYPT_TLSPLAIN:
206 return "vencrypt+tls+plain";
207 case VNC_AUTH_VENCRYPT_X509NONE:
208 return "vencrypt+x509+none";
209 case VNC_AUTH_VENCRYPT_X509VNC:
210 return "vencrypt+x509+vnc";
211 case VNC_AUTH_VENCRYPT_X509PLAIN:
212 return "vencrypt+x509+plain";
213 case VNC_AUTH_VENCRYPT_TLSSASL:
214 return "vencrypt+tls+sasl";
215 case VNC_AUTH_VENCRYPT_X509SASL:
216 return "vencrypt+x509+sasl";
217 default:
218 return "vencrypt";
219 }
220 case VNC_AUTH_SASL:
221 return "sasl";
222 }
223 return "unknown";
224 }
225
226 static VncServerInfo *vnc_server_info_get(VncDisplay *vd)
227 {
228 VncServerInfo *info;
229 Error *err = NULL;
230
231 if (!vd->listener || !vd->listener->nsioc) {
232 return NULL;
233 }
234
235 info = g_malloc0(sizeof(*info));
236 vnc_init_basic_info_from_server_addr(vd->listener->sioc[0],
237 qapi_VncServerInfo_base(info), &err);
238 info->has_auth = true;
239 info->auth = g_strdup(vnc_auth_name(vd));
240 if (err) {
241 qapi_free_VncServerInfo(info);
242 info = NULL;
243 error_free(err);
244 }
245 return info;
246 }
247
248 static void vnc_client_cache_auth(VncState *client)
249 {
250 if (!client->info) {
251 return;
252 }
253
254 if (client->tls) {
255 client->info->x509_dname =
256 qcrypto_tls_session_get_peer_name(client->tls);
257 client->info->has_x509_dname =
258 client->info->x509_dname != NULL;
259 }
260 #ifdef CONFIG_VNC_SASL
261 if (client->sasl.conn &&
262 client->sasl.username) {
263 client->info->has_sasl_username = true;
264 client->info->sasl_username = g_strdup(client->sasl.username);
265 }
266 #endif
267 }
268
269 static void vnc_client_cache_addr(VncState *client)
270 {
271 Error *err = NULL;
272
273 client->info = g_malloc0(sizeof(*client->info));
274 vnc_init_basic_info_from_remote_addr(client->sioc,
275 qapi_VncClientInfo_base(client->info),
276 &err);
277 if (err) {
278 qapi_free_VncClientInfo(client->info);
279 client->info = NULL;
280 error_free(err);
281 }
282 }
283
284 static void vnc_qmp_event(VncState *vs, QAPIEvent event)
285 {
286 VncServerInfo *si;
287
288 if (!vs->info) {
289 return;
290 }
291
292 si = vnc_server_info_get(vs->vd);
293 if (!si) {
294 return;
295 }
296
297 switch (event) {
298 case QAPI_EVENT_VNC_CONNECTED:
299 qapi_event_send_vnc_connected(si, qapi_VncClientInfo_base(vs->info),
300 &error_abort);
301 break;
302 case QAPI_EVENT_VNC_INITIALIZED:
303 qapi_event_send_vnc_initialized(si, vs->info, &error_abort);
304 break;
305 case QAPI_EVENT_VNC_DISCONNECTED:
306 qapi_event_send_vnc_disconnected(si, vs->info, &error_abort);
307 break;
308 default:
309 break;
310 }
311
312 qapi_free_VncServerInfo(si);
313 }
314
315 static VncClientInfo *qmp_query_vnc_client(const VncState *client)
316 {
317 VncClientInfo *info;
318 Error *err = NULL;
319
320 info = g_malloc0(sizeof(*info));
321
322 vnc_init_basic_info_from_remote_addr(client->sioc,
323 qapi_VncClientInfo_base(info),
324 &err);
325 if (err) {
326 error_free(err);
327 qapi_free_VncClientInfo(info);
328 return NULL;
329 }
330
331 info->websocket = client->websocket;
332
333 if (client->tls) {
334 info->x509_dname = qcrypto_tls_session_get_peer_name(client->tls);
335 info->has_x509_dname = info->x509_dname != NULL;
336 }
337 #ifdef CONFIG_VNC_SASL
338 if (client->sasl.conn && client->sasl.username) {
339 info->has_sasl_username = true;
340 info->sasl_username = g_strdup(client->sasl.username);
341 }
342 #endif
343
344 return info;
345 }
346
347 static VncDisplay *vnc_display_find(const char *id)
348 {
349 VncDisplay *vd;
350
351 if (id == NULL) {
352 return QTAILQ_FIRST(&vnc_displays);
353 }
354 QTAILQ_FOREACH(vd, &vnc_displays, next) {
355 if (strcmp(id, vd->id) == 0) {
356 return vd;
357 }
358 }
359 return NULL;
360 }
361
362 static VncClientInfoList *qmp_query_client_list(VncDisplay *vd)
363 {
364 VncClientInfoList *cinfo, *prev = NULL;
365 VncState *client;
366
367 QTAILQ_FOREACH(client, &vd->clients, next) {
368 cinfo = g_new0(VncClientInfoList, 1);
369 cinfo->value = qmp_query_vnc_client(client);
370 cinfo->next = prev;
371 prev = cinfo;
372 }
373 return prev;
374 }
375
376 VncInfo *qmp_query_vnc(Error **errp)
377 {
378 VncInfo *info = g_malloc0(sizeof(*info));
379 VncDisplay *vd = vnc_display_find(NULL);
380 SocketAddress *addr = NULL;
381
382 if (vd == NULL || !vd->listener || !vd->listener->nsioc) {
383 info->enabled = false;
384 } else {
385 info->enabled = true;
386
387 /* for compatibility with the original command */
388 info->has_clients = true;
389 info->clients = qmp_query_client_list(vd);
390
391 addr = qio_channel_socket_get_local_address(vd->listener->sioc[0],
392 errp);
393 if (!addr) {
394 goto out_error;
395 }
396
397 switch (addr->type) {
398 case SOCKET_ADDRESS_TYPE_INET:
399 info->host = g_strdup(addr->u.inet.host);
400 info->service = g_strdup(addr->u.inet.port);
401 if (addr->u.inet.ipv6) {
402 info->family = NETWORK_ADDRESS_FAMILY_IPV6;
403 } else {
404 info->family = NETWORK_ADDRESS_FAMILY_IPV4;
405 }
406 break;
407
408 case SOCKET_ADDRESS_TYPE_UNIX:
409 info->host = g_strdup("");
410 info->service = g_strdup(addr->u.q_unix.path);
411 info->family = NETWORK_ADDRESS_FAMILY_UNIX;
412 break;
413
414 case SOCKET_ADDRESS_TYPE_VSOCK:
415 case SOCKET_ADDRESS_TYPE_FD:
416 error_setg(errp, "Unsupported socket address type %s",
417 SocketAddressType_str(addr->type));
418 goto out_error;
419 default:
420 abort();
421 }
422
423 info->has_host = true;
424 info->has_service = true;
425 info->has_family = true;
426
427 info->has_auth = true;
428 info->auth = g_strdup(vnc_auth_name(vd));
429 }
430
431 qapi_free_SocketAddress(addr);
432 return info;
433
434 out_error:
435 qapi_free_SocketAddress(addr);
436 qapi_free_VncInfo(info);
437 return NULL;
438 }
439
440
441 static void qmp_query_auth(int auth, int subauth,
442 VncPrimaryAuth *qmp_auth,
443 VncVencryptSubAuth *qmp_vencrypt,
444 bool *qmp_has_vencrypt);
445
446 static VncServerInfo2List *qmp_query_server_entry(QIOChannelSocket *ioc,
447 bool websocket,
448 int auth,
449 int subauth,
450 VncServerInfo2List *prev)
451 {
452 VncServerInfo2List *list;
453 VncServerInfo2 *info;
454 Error *err = NULL;
455 SocketAddress *addr;
456
457 addr = qio_channel_socket_get_local_address(ioc, &err);
458 if (!addr) {
459 error_free(err);
460 return prev;
461 }
462
463 info = g_new0(VncServerInfo2, 1);
464 vnc_init_basic_info(addr, qapi_VncServerInfo2_base(info), &err);
465 qapi_free_SocketAddress(addr);
466 if (err) {
467 qapi_free_VncServerInfo2(info);
468 error_free(err);
469 return prev;
470 }
471 info->websocket = websocket;
472
473 qmp_query_auth(auth, subauth, &info->auth,
474 &info->vencrypt, &info->has_vencrypt);
475
476 list = g_new0(VncServerInfo2List, 1);
477 list->value = info;
478 list->next = prev;
479 return list;
480 }
481
482 static void qmp_query_auth(int auth, int subauth,
483 VncPrimaryAuth *qmp_auth,
484 VncVencryptSubAuth *qmp_vencrypt,
485 bool *qmp_has_vencrypt)
486 {
487 switch (auth) {
488 case VNC_AUTH_VNC:
489 *qmp_auth = VNC_PRIMARY_AUTH_VNC;
490 break;
491 case VNC_AUTH_RA2:
492 *qmp_auth = VNC_PRIMARY_AUTH_RA2;
493 break;
494 case VNC_AUTH_RA2NE:
495 *qmp_auth = VNC_PRIMARY_AUTH_RA2NE;
496 break;
497 case VNC_AUTH_TIGHT:
498 *qmp_auth = VNC_PRIMARY_AUTH_TIGHT;
499 break;
500 case VNC_AUTH_ULTRA:
501 *qmp_auth = VNC_PRIMARY_AUTH_ULTRA;
502 break;
503 case VNC_AUTH_TLS:
504 *qmp_auth = VNC_PRIMARY_AUTH_TLS;
505 break;
506 case VNC_AUTH_VENCRYPT:
507 *qmp_auth = VNC_PRIMARY_AUTH_VENCRYPT;
508 *qmp_has_vencrypt = true;
509 switch (subauth) {
510 case VNC_AUTH_VENCRYPT_PLAIN:
511 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_PLAIN;
512 break;
513 case VNC_AUTH_VENCRYPT_TLSNONE:
514 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_NONE;
515 break;
516 case VNC_AUTH_VENCRYPT_TLSVNC:
517 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_VNC;
518 break;
519 case VNC_AUTH_VENCRYPT_TLSPLAIN:
520 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_PLAIN;
521 break;
522 case VNC_AUTH_VENCRYPT_X509NONE:
523 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_NONE;
524 break;
525 case VNC_AUTH_VENCRYPT_X509VNC:
526 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_VNC;
527 break;
528 case VNC_AUTH_VENCRYPT_X509PLAIN:
529 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_PLAIN;
530 break;
531 case VNC_AUTH_VENCRYPT_TLSSASL:
532 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_SASL;
533 break;
534 case VNC_AUTH_VENCRYPT_X509SASL:
535 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_SASL;
536 break;
537 default:
538 *qmp_has_vencrypt = false;
539 break;
540 }
541 break;
542 case VNC_AUTH_SASL:
543 *qmp_auth = VNC_PRIMARY_AUTH_SASL;
544 break;
545 case VNC_AUTH_NONE:
546 default:
547 *qmp_auth = VNC_PRIMARY_AUTH_NONE;
548 break;
549 }
550 }
551
552 VncInfo2List *qmp_query_vnc_servers(Error **errp)
553 {
554 VncInfo2List *item, *prev = NULL;
555 VncInfo2 *info;
556 VncDisplay *vd;
557 DeviceState *dev;
558 size_t i;
559
560 QTAILQ_FOREACH(vd, &vnc_displays, next) {
561 info = g_new0(VncInfo2, 1);
562 info->id = g_strdup(vd->id);
563 info->clients = qmp_query_client_list(vd);
564 qmp_query_auth(vd->auth, vd->subauth, &info->auth,
565 &info->vencrypt, &info->has_vencrypt);
566 if (vd->dcl.con) {
567 dev = DEVICE(object_property_get_link(OBJECT(vd->dcl.con),
568 "device", NULL));
569 info->has_display = true;
570 info->display = g_strdup(dev->id);
571 }
572 for (i = 0; vd->listener != NULL && i < vd->listener->nsioc; i++) {
573 info->server = qmp_query_server_entry(
574 vd->listener->sioc[i], false, vd->auth, vd->subauth,
575 info->server);
576 }
577 for (i = 0; vd->wslistener != NULL && i < vd->wslistener->nsioc; i++) {
578 info->server = qmp_query_server_entry(
579 vd->wslistener->sioc[i], true, vd->ws_auth,
580 vd->ws_subauth, info->server);
581 }
582
583 item = g_new0(VncInfo2List, 1);
584 item->value = info;
585 item->next = prev;
586 prev = item;
587 }
588 return prev;
589 }
590
591 /* TODO
592 1) Get the queue working for IO.
593 2) there is some weirdness when using the -S option (the screen is grey
594 and not totally invalidated
595 3) resolutions > 1024
596 */
597
598 static int vnc_update_client(VncState *vs, int has_dirty);
599 static void vnc_disconnect_start(VncState *vs);
600
601 static void vnc_colordepth(VncState *vs);
602 static void framebuffer_update_request(VncState *vs, int incremental,
603 int x_position, int y_position,
604 int w, int h);
605 static void vnc_refresh(DisplayChangeListener *dcl);
606 static int vnc_refresh_server_surface(VncDisplay *vd);
607
608 static int vnc_width(VncDisplay *vd)
609 {
610 return MIN(VNC_MAX_WIDTH, ROUND_UP(surface_width(vd->ds),
611 VNC_DIRTY_PIXELS_PER_BIT));
612 }
613
614 static int vnc_height(VncDisplay *vd)
615 {
616 return MIN(VNC_MAX_HEIGHT, surface_height(vd->ds));
617 }
618
619 static void vnc_set_area_dirty(DECLARE_BITMAP(dirty[VNC_MAX_HEIGHT],
620 VNC_MAX_WIDTH / VNC_DIRTY_PIXELS_PER_BIT),
621 VncDisplay *vd,
622 int x, int y, int w, int h)
623 {
624 int width = vnc_width(vd);
625 int height = vnc_height(vd);
626
627 /* this is needed this to ensure we updated all affected
628 * blocks if x % VNC_DIRTY_PIXELS_PER_BIT != 0 */
629 w += (x % VNC_DIRTY_PIXELS_PER_BIT);
630 x -= (x % VNC_DIRTY_PIXELS_PER_BIT);
631
632 x = MIN(x, width);
633 y = MIN(y, height);
634 w = MIN(x + w, width) - x;
635 h = MIN(y + h, height);
636
637 for (; y < h; y++) {
638 bitmap_set(dirty[y], x / VNC_DIRTY_PIXELS_PER_BIT,
639 DIV_ROUND_UP(w, VNC_DIRTY_PIXELS_PER_BIT));
640 }
641 }
642
643 static void vnc_dpy_update(DisplayChangeListener *dcl,
644 int x, int y, int w, int h)
645 {
646 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
647 struct VncSurface *s = &vd->guest;
648
649 vnc_set_area_dirty(s->dirty, vd, x, y, w, h);
650 }
651
652 void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
653 int32_t encoding)
654 {
655 vnc_write_u16(vs, x);
656 vnc_write_u16(vs, y);
657 vnc_write_u16(vs, w);
658 vnc_write_u16(vs, h);
659
660 vnc_write_s32(vs, encoding);
661 }
662
663
664 static void vnc_desktop_resize(VncState *vs)
665 {
666 if (vs->ioc == NULL || !vnc_has_feature(vs, VNC_FEATURE_RESIZE)) {
667 return;
668 }
669 if (vs->client_width == pixman_image_get_width(vs->vd->server) &&
670 vs->client_height == pixman_image_get_height(vs->vd->server)) {
671 return;
672 }
673
674 assert(pixman_image_get_width(vs->vd->server) < 65536 &&
675 pixman_image_get_width(vs->vd->server) >= 0);
676 assert(pixman_image_get_height(vs->vd->server) < 65536 &&
677 pixman_image_get_height(vs->vd->server) >= 0);
678 vs->client_width = pixman_image_get_width(vs->vd->server);
679 vs->client_height = pixman_image_get_height(vs->vd->server);
680 vnc_lock_output(vs);
681 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
682 vnc_write_u8(vs, 0);
683 vnc_write_u16(vs, 1); /* number of rects */
684 vnc_framebuffer_update(vs, 0, 0, vs->client_width, vs->client_height,
685 VNC_ENCODING_DESKTOPRESIZE);
686 vnc_unlock_output(vs);
687 vnc_flush(vs);
688 }
689
690 static void vnc_abort_display_jobs(VncDisplay *vd)
691 {
692 VncState *vs;
693
694 QTAILQ_FOREACH(vs, &vd->clients, next) {
695 vnc_lock_output(vs);
696 vs->abort = true;
697 vnc_unlock_output(vs);
698 }
699 QTAILQ_FOREACH(vs, &vd->clients, next) {
700 vnc_jobs_join(vs);
701 }
702 QTAILQ_FOREACH(vs, &vd->clients, next) {
703 vnc_lock_output(vs);
704 vs->abort = false;
705 vnc_unlock_output(vs);
706 }
707 }
708
709 int vnc_server_fb_stride(VncDisplay *vd)
710 {
711 return pixman_image_get_stride(vd->server);
712 }
713
714 void *vnc_server_fb_ptr(VncDisplay *vd, int x, int y)
715 {
716 uint8_t *ptr;
717
718 ptr = (uint8_t *)pixman_image_get_data(vd->server);
719 ptr += y * vnc_server_fb_stride(vd);
720 ptr += x * VNC_SERVER_FB_BYTES;
721 return ptr;
722 }
723
724 static void vnc_update_server_surface(VncDisplay *vd)
725 {
726 int width, height;
727
728 qemu_pixman_image_unref(vd->server);
729 vd->server = NULL;
730
731 if (QTAILQ_EMPTY(&vd->clients)) {
732 return;
733 }
734
735 width = vnc_width(vd);
736 height = vnc_height(vd);
737 vd->server = pixman_image_create_bits(VNC_SERVER_FB_FORMAT,
738 width, height,
739 NULL, 0);
740
741 memset(vd->guest.dirty, 0x00, sizeof(vd->guest.dirty));
742 vnc_set_area_dirty(vd->guest.dirty, vd, 0, 0,
743 width, height);
744 }
745
746 static void vnc_dpy_switch(DisplayChangeListener *dcl,
747 DisplaySurface *surface)
748 {
749 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
750 VncState *vs;
751
752 vnc_abort_display_jobs(vd);
753 vd->ds = surface;
754
755 /* server surface */
756 vnc_update_server_surface(vd);
757
758 /* guest surface */
759 qemu_pixman_image_unref(vd->guest.fb);
760 vd->guest.fb = pixman_image_ref(surface->image);
761 vd->guest.format = surface->format;
762
763 QTAILQ_FOREACH(vs, &vd->clients, next) {
764 vnc_colordepth(vs);
765 vnc_desktop_resize(vs);
766 if (vs->vd->cursor) {
767 vnc_cursor_define(vs);
768 }
769 memset(vs->dirty, 0x00, sizeof(vs->dirty));
770 vnc_set_area_dirty(vs->dirty, vd, 0, 0,
771 vnc_width(vd),
772 vnc_height(vd));
773 vnc_update_throttle_offset(vs);
774 }
775 }
776
777 /* fastest code */
778 static void vnc_write_pixels_copy(VncState *vs,
779 void *pixels, int size)
780 {
781 vnc_write(vs, pixels, size);
782 }
783
784 /* slowest but generic code. */
785 void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
786 {
787 uint8_t r, g, b;
788
789 #if VNC_SERVER_FB_FORMAT == PIXMAN_FORMAT(32, PIXMAN_TYPE_ARGB, 0, 8, 8, 8)
790 r = (((v & 0x00ff0000) >> 16) << vs->client_pf.rbits) >> 8;
791 g = (((v & 0x0000ff00) >> 8) << vs->client_pf.gbits) >> 8;
792 b = (((v & 0x000000ff) >> 0) << vs->client_pf.bbits) >> 8;
793 #else
794 # error need some bits here if you change VNC_SERVER_FB_FORMAT
795 #endif
796 v = (r << vs->client_pf.rshift) |
797 (g << vs->client_pf.gshift) |
798 (b << vs->client_pf.bshift);
799 switch (vs->client_pf.bytes_per_pixel) {
800 case 1:
801 buf[0] = v;
802 break;
803 case 2:
804 if (vs->client_be) {
805 buf[0] = v >> 8;
806 buf[1] = v;
807 } else {
808 buf[1] = v >> 8;
809 buf[0] = v;
810 }
811 break;
812 default:
813 case 4:
814 if (vs->client_be) {
815 buf[0] = v >> 24;
816 buf[1] = v >> 16;
817 buf[2] = v >> 8;
818 buf[3] = v;
819 } else {
820 buf[3] = v >> 24;
821 buf[2] = v >> 16;
822 buf[1] = v >> 8;
823 buf[0] = v;
824 }
825 break;
826 }
827 }
828
829 static void vnc_write_pixels_generic(VncState *vs,
830 void *pixels1, int size)
831 {
832 uint8_t buf[4];
833
834 if (VNC_SERVER_FB_BYTES == 4) {
835 uint32_t *pixels = pixels1;
836 int n, i;
837 n = size >> 2;
838 for (i = 0; i < n; i++) {
839 vnc_convert_pixel(vs, buf, pixels[i]);
840 vnc_write(vs, buf, vs->client_pf.bytes_per_pixel);
841 }
842 }
843 }
844
845 int vnc_raw_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
846 {
847 int i;
848 uint8_t *row;
849 VncDisplay *vd = vs->vd;
850
851 row = vnc_server_fb_ptr(vd, x, y);
852 for (i = 0; i < h; i++) {
853 vs->write_pixels(vs, row, w * VNC_SERVER_FB_BYTES);
854 row += vnc_server_fb_stride(vd);
855 }
856 return 1;
857 }
858
859 int vnc_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
860 {
861 int n = 0;
862 bool encode_raw = false;
863 size_t saved_offs = vs->output.offset;
864
865 switch(vs->vnc_encoding) {
866 case VNC_ENCODING_ZLIB:
867 n = vnc_zlib_send_framebuffer_update(vs, x, y, w, h);
868 break;
869 case VNC_ENCODING_HEXTILE:
870 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE);
871 n = vnc_hextile_send_framebuffer_update(vs, x, y, w, h);
872 break;
873 case VNC_ENCODING_TIGHT:
874 n = vnc_tight_send_framebuffer_update(vs, x, y, w, h);
875 break;
876 case VNC_ENCODING_TIGHT_PNG:
877 n = vnc_tight_png_send_framebuffer_update(vs, x, y, w, h);
878 break;
879 case VNC_ENCODING_ZRLE:
880 n = vnc_zrle_send_framebuffer_update(vs, x, y, w, h);
881 break;
882 case VNC_ENCODING_ZYWRLE:
883 n = vnc_zywrle_send_framebuffer_update(vs, x, y, w, h);
884 break;
885 default:
886 encode_raw = true;
887 break;
888 }
889
890 /* If the client has the same pixel format as our internal buffer and
891 * a RAW encoding would need less space fall back to RAW encoding to
892 * save bandwidth and processing power in the client. */
893 if (!encode_raw && vs->write_pixels == vnc_write_pixels_copy &&
894 12 + h * w * VNC_SERVER_FB_BYTES <= (vs->output.offset - saved_offs)) {
895 vs->output.offset = saved_offs;
896 encode_raw = true;
897 }
898
899 if (encode_raw) {
900 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW);
901 n = vnc_raw_send_framebuffer_update(vs, x, y, w, h);
902 }
903
904 return n;
905 }
906
907 static void vnc_mouse_set(DisplayChangeListener *dcl,
908 int x, int y, int visible)
909 {
910 /* can we ask the client(s) to move the pointer ??? */
911 }
912
913 static int vnc_cursor_define(VncState *vs)
914 {
915 QEMUCursor *c = vs->vd->cursor;
916 int isize;
917
918 if (vnc_has_feature(vs, VNC_FEATURE_RICH_CURSOR)) {
919 vnc_lock_output(vs);
920 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
921 vnc_write_u8(vs, 0); /* padding */
922 vnc_write_u16(vs, 1); /* # of rects */
923 vnc_framebuffer_update(vs, c->hot_x, c->hot_y, c->width, c->height,
924 VNC_ENCODING_RICH_CURSOR);
925 isize = c->width * c->height * vs->client_pf.bytes_per_pixel;
926 vnc_write_pixels_generic(vs, c->data, isize);
927 vnc_write(vs, vs->vd->cursor_mask, vs->vd->cursor_msize);
928 vnc_unlock_output(vs);
929 return 0;
930 }
931 return -1;
932 }
933
934 static void vnc_dpy_cursor_define(DisplayChangeListener *dcl,
935 QEMUCursor *c)
936 {
937 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
938 VncState *vs;
939
940 cursor_put(vd->cursor);
941 g_free(vd->cursor_mask);
942
943 vd->cursor = c;
944 cursor_get(vd->cursor);
945 vd->cursor_msize = cursor_get_mono_bpl(c) * c->height;
946 vd->cursor_mask = g_malloc0(vd->cursor_msize);
947 cursor_get_mono_mask(c, 0, vd->cursor_mask);
948
949 QTAILQ_FOREACH(vs, &vd->clients, next) {
950 vnc_cursor_define(vs);
951 }
952 }
953
954 static int find_and_clear_dirty_height(VncState *vs,
955 int y, int last_x, int x, int height)
956 {
957 int h;
958
959 for (h = 1; h < (height - y); h++) {
960 if (!test_bit(last_x, vs->dirty[y + h])) {
961 break;
962 }
963 bitmap_clear(vs->dirty[y + h], last_x, x - last_x);
964 }
965
966 return h;
967 }
968
969 /*
970 * Figure out how much pending data we should allow in the output
971 * buffer before we throttle incremental display updates, and/or
972 * drop audio samples.
973 *
974 * We allow for equiv of 1 full display's worth of FB updates,
975 * and 1 second of audio samples. If audio backlog was larger
976 * than that the client would already suffering awful audio
977 * glitches, so dropping samples is no worse really).
978 */
979 static void vnc_update_throttle_offset(VncState *vs)
980 {
981 size_t offset =
982 vs->client_width * vs->client_height * vs->client_pf.bytes_per_pixel;
983
984 if (vs->audio_cap) {
985 int bps;
986 switch (vs->as.fmt) {
987 default:
988 case AUD_FMT_U8:
989 case AUD_FMT_S8:
990 bps = 1;
991 break;
992 case AUD_FMT_U16:
993 case AUD_FMT_S16:
994 bps = 2;
995 break;
996 case AUD_FMT_U32:
997 case AUD_FMT_S32:
998 bps = 4;
999 break;
1000 }
1001 offset += vs->as.freq * bps * vs->as.nchannels;
1002 }
1003
1004 /* Put a floor of 1MB on offset, so that if we have a large pending
1005 * buffer and the display is resized to a small size & back again
1006 * we don't suddenly apply a tiny send limit
1007 */
1008 offset = MAX(offset, 1024 * 1024);
1009
1010 if (vs->throttle_output_offset != offset) {
1011 trace_vnc_client_throttle_threshold(
1012 vs, vs->ioc, vs->throttle_output_offset, offset, vs->client_width,
1013 vs->client_height, vs->client_pf.bytes_per_pixel, vs->audio_cap);
1014 }
1015
1016 vs->throttle_output_offset = offset;
1017 }
1018
1019 static bool vnc_should_update(VncState *vs)
1020 {
1021 switch (vs->update) {
1022 case VNC_STATE_UPDATE_NONE:
1023 break;
1024 case VNC_STATE_UPDATE_INCREMENTAL:
1025 /* Only allow incremental updates if the pending send queue
1026 * is less than the permitted threshold, and the job worker
1027 * is completely idle.
1028 */
1029 if (vs->output.offset < vs->throttle_output_offset &&
1030 vs->job_update == VNC_STATE_UPDATE_NONE) {
1031 return true;
1032 }
1033 trace_vnc_client_throttle_incremental(
1034 vs, vs->ioc, vs->job_update, vs->output.offset);
1035 break;
1036 case VNC_STATE_UPDATE_FORCE:
1037 /* Only allow forced updates if the pending send queue
1038 * does not contain a previous forced update, and the
1039 * job worker is completely idle.
1040 *
1041 * Note this means we'll queue a forced update, even if
1042 * the output buffer size is otherwise over the throttle
1043 * output limit.
1044 */
1045 if (vs->force_update_offset == 0 &&
1046 vs->job_update == VNC_STATE_UPDATE_NONE) {
1047 return true;
1048 }
1049 trace_vnc_client_throttle_forced(
1050 vs, vs->ioc, vs->job_update, vs->force_update_offset);
1051 break;
1052 }
1053 return false;
1054 }
1055
1056 static int vnc_update_client(VncState *vs, int has_dirty)
1057 {
1058 VncDisplay *vd = vs->vd;
1059 VncJob *job;
1060 int y;
1061 int height, width;
1062 int n = 0;
1063
1064 if (vs->disconnecting) {
1065 vnc_disconnect_finish(vs);
1066 return 0;
1067 }
1068
1069 vs->has_dirty += has_dirty;
1070 if (!vnc_should_update(vs)) {
1071 return 0;
1072 }
1073
1074 if (!vs->has_dirty && vs->update != VNC_STATE_UPDATE_FORCE) {
1075 return 0;
1076 }
1077
1078 /*
1079 * Send screen updates to the vnc client using the server
1080 * surface and server dirty map. guest surface updates
1081 * happening in parallel don't disturb us, the next pass will
1082 * send them to the client.
1083 */
1084 job = vnc_job_new(vs);
1085
1086 height = pixman_image_get_height(vd->server);
1087 width = pixman_image_get_width(vd->server);
1088
1089 y = 0;
1090 for (;;) {
1091 int x, h;
1092 unsigned long x2;
1093 unsigned long offset = find_next_bit((unsigned long *) &vs->dirty,
1094 height * VNC_DIRTY_BPL(vs),
1095 y * VNC_DIRTY_BPL(vs));
1096 if (offset == height * VNC_DIRTY_BPL(vs)) {
1097 /* no more dirty bits */
1098 break;
1099 }
1100 y = offset / VNC_DIRTY_BPL(vs);
1101 x = offset % VNC_DIRTY_BPL(vs);
1102 x2 = find_next_zero_bit((unsigned long *) &vs->dirty[y],
1103 VNC_DIRTY_BPL(vs), x);
1104 bitmap_clear(vs->dirty[y], x, x2 - x);
1105 h = find_and_clear_dirty_height(vs, y, x, x2, height);
1106 x2 = MIN(x2, width / VNC_DIRTY_PIXELS_PER_BIT);
1107 if (x2 > x) {
1108 n += vnc_job_add_rect(job, x * VNC_DIRTY_PIXELS_PER_BIT, y,
1109 (x2 - x) * VNC_DIRTY_PIXELS_PER_BIT, h);
1110 }
1111 if (!x && x2 == width / VNC_DIRTY_PIXELS_PER_BIT) {
1112 y += h;
1113 if (y == height) {
1114 break;
1115 }
1116 }
1117 }
1118
1119 vs->job_update = vs->update;
1120 vs->update = VNC_STATE_UPDATE_NONE;
1121 vnc_job_push(job);
1122 vs->has_dirty = 0;
1123 return n;
1124 }
1125
1126 /* audio */
1127 static void audio_capture_notify(void *opaque, audcnotification_e cmd)
1128 {
1129 VncState *vs = opaque;
1130
1131 switch (cmd) {
1132 case AUD_CNOTIFY_DISABLE:
1133 vnc_lock_output(vs);
1134 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
1135 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
1136 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_END);
1137 vnc_unlock_output(vs);
1138 vnc_flush(vs);
1139 break;
1140
1141 case AUD_CNOTIFY_ENABLE:
1142 vnc_lock_output(vs);
1143 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
1144 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
1145 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_BEGIN);
1146 vnc_unlock_output(vs);
1147 vnc_flush(vs);
1148 break;
1149 }
1150 }
1151
1152 static void audio_capture_destroy(void *opaque)
1153 {
1154 }
1155
1156 static void audio_capture(void *opaque, void *buf, int size)
1157 {
1158 VncState *vs = opaque;
1159
1160 vnc_lock_output(vs);
1161 if (vs->output.offset < vs->throttle_output_offset) {
1162 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU);
1163 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO);
1164 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_DATA);
1165 vnc_write_u32(vs, size);
1166 vnc_write(vs, buf, size);
1167 } else {
1168 trace_vnc_client_throttle_audio(vs, vs->ioc, vs->output.offset);
1169 }
1170 vnc_unlock_output(vs);
1171 vnc_flush(vs);
1172 }
1173
1174 static void audio_add(VncState *vs)
1175 {
1176 struct audio_capture_ops ops;
1177
1178 if (vs->audio_cap) {
1179 error_report("audio already running");
1180 return;
1181 }
1182
1183 ops.notify = audio_capture_notify;
1184 ops.destroy = audio_capture_destroy;
1185 ops.capture = audio_capture;
1186
1187 vs->audio_cap = AUD_add_capture(&vs->as, &ops, vs);
1188 if (!vs->audio_cap) {
1189 error_report("Failed to add audio capture");
1190 }
1191 }
1192
1193 static void audio_del(VncState *vs)
1194 {
1195 if (vs->audio_cap) {
1196 AUD_del_capture(vs->audio_cap, vs);
1197 vs->audio_cap = NULL;
1198 }
1199 }
1200
1201 static void vnc_disconnect_start(VncState *vs)
1202 {
1203 if (vs->disconnecting) {
1204 return;
1205 }
1206 trace_vnc_client_disconnect_start(vs, vs->ioc);
1207 vnc_set_share_mode(vs, VNC_SHARE_MODE_DISCONNECTED);
1208 if (vs->ioc_tag) {
1209 g_source_remove(vs->ioc_tag);
1210 vs->ioc_tag = 0;
1211 }
1212 qio_channel_close(vs->ioc, NULL);
1213 vs->disconnecting = TRUE;
1214 }
1215
1216 void vnc_disconnect_finish(VncState *vs)
1217 {
1218 int i;
1219
1220 trace_vnc_client_disconnect_finish(vs, vs->ioc);
1221
1222 vnc_jobs_join(vs); /* Wait encoding jobs */
1223
1224 vnc_lock_output(vs);
1225 vnc_qmp_event(vs, QAPI_EVENT_VNC_DISCONNECTED);
1226
1227 buffer_free(&vs->input);
1228 buffer_free(&vs->output);
1229
1230 qapi_free_VncClientInfo(vs->info);
1231
1232 vnc_zlib_clear(vs);
1233 vnc_tight_clear(vs);
1234 vnc_zrle_clear(vs);
1235
1236 #ifdef CONFIG_VNC_SASL
1237 vnc_sasl_client_cleanup(vs);
1238 #endif /* CONFIG_VNC_SASL */
1239 audio_del(vs);
1240 vnc_release_modifiers(vs);
1241
1242 if (vs->mouse_mode_notifier.notify != NULL) {
1243 qemu_remove_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
1244 }
1245 QTAILQ_REMOVE(&vs->vd->clients, vs, next);
1246 if (QTAILQ_EMPTY(&vs->vd->clients)) {
1247 /* last client gone */
1248 vnc_update_server_surface(vs->vd);
1249 }
1250
1251 vnc_unlock_output(vs);
1252
1253 qemu_mutex_destroy(&vs->output_mutex);
1254 if (vs->bh != NULL) {
1255 qemu_bh_delete(vs->bh);
1256 }
1257 buffer_free(&vs->jobs_buffer);
1258
1259 for (i = 0; i < VNC_STAT_ROWS; ++i) {
1260 g_free(vs->lossy_rect[i]);
1261 }
1262 g_free(vs->lossy_rect);
1263
1264 object_unref(OBJECT(vs->ioc));
1265 vs->ioc = NULL;
1266 object_unref(OBJECT(vs->sioc));
1267 vs->sioc = NULL;
1268 g_free(vs);
1269 }
1270
1271 size_t vnc_client_io_error(VncState *vs, ssize_t ret, Error **errp)
1272 {
1273 if (ret <= 0) {
1274 if (ret == 0) {
1275 trace_vnc_client_eof(vs, vs->ioc);
1276 vnc_disconnect_start(vs);
1277 } else if (ret != QIO_CHANNEL_ERR_BLOCK) {
1278 trace_vnc_client_io_error(vs, vs->ioc,
1279 errp ? error_get_pretty(*errp) :
1280 "Unknown");
1281 vnc_disconnect_start(vs);
1282 }
1283
1284 if (errp) {
1285 error_free(*errp);
1286 *errp = NULL;
1287 }
1288 return 0;
1289 }
1290 return ret;
1291 }
1292
1293
1294 void vnc_client_error(VncState *vs)
1295 {
1296 VNC_DEBUG("Closing down client sock: protocol error\n");
1297 vnc_disconnect_start(vs);
1298 }
1299
1300
1301 /*
1302 * Called to write a chunk of data to the client socket. The data may
1303 * be the raw data, or may have already been encoded by SASL.
1304 * The data will be written either straight onto the socket, or
1305 * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1306 *
1307 * NB, it is theoretically possible to have 2 layers of encryption,
1308 * both SASL, and this TLS layer. It is highly unlikely in practice
1309 * though, since SASL encryption will typically be a no-op if TLS
1310 * is active
1311 *
1312 * Returns the number of bytes written, which may be less than
1313 * the requested 'datalen' if the socket would block. Returns
1314 * 0 on I/O error, and disconnects the client socket.
1315 */
1316 size_t vnc_client_write_buf(VncState *vs, const uint8_t *data, size_t datalen)
1317 {
1318 Error *err = NULL;
1319 ssize_t ret;
1320 ret = qio_channel_write(
1321 vs->ioc, (const char *)data, datalen, &err);
1322 VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data, datalen, ret);
1323 return vnc_client_io_error(vs, ret, &err);
1324 }
1325
1326
1327 /*
1328 * Called to write buffered data to the client socket, when not
1329 * using any SASL SSF encryption layers. Will write as much data
1330 * as possible without blocking. If all buffered data is written,
1331 * will switch the FD poll() handler back to read monitoring.
1332 *
1333 * Returns the number of bytes written, which may be less than
1334 * the buffered output data if the socket would block. Returns
1335 * 0 on I/O error, and disconnects the client socket.
1336 */
1337 static size_t vnc_client_write_plain(VncState *vs)
1338 {
1339 size_t offset;
1340 size_t ret;
1341
1342 #ifdef CONFIG_VNC_SASL
1343 VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n",
1344 vs->output.buffer, vs->output.capacity, vs->output.offset,
1345 vs->sasl.waitWriteSSF);
1346
1347 if (vs->sasl.conn &&
1348 vs->sasl.runSSF &&
1349 vs->sasl.waitWriteSSF) {
1350 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF);
1351 if (ret)
1352 vs->sasl.waitWriteSSF -= ret;
1353 } else
1354 #endif /* CONFIG_VNC_SASL */
1355 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset);
1356 if (!ret)
1357 return 0;
1358
1359 if (ret >= vs->force_update_offset) {
1360 if (vs->force_update_offset != 0) {
1361 trace_vnc_client_unthrottle_forced(vs, vs->ioc);
1362 }
1363 vs->force_update_offset = 0;
1364 } else {
1365 vs->force_update_offset -= ret;
1366 }
1367 offset = vs->output.offset;
1368 buffer_advance(&vs->output, ret);
1369 if (offset >= vs->throttle_output_offset &&
1370 vs->output.offset < vs->throttle_output_offset) {
1371 trace_vnc_client_unthrottle_incremental(vs, vs->ioc, vs->output.offset);
1372 }
1373
1374 if (vs->output.offset == 0) {
1375 if (vs->ioc_tag) {
1376 g_source_remove(vs->ioc_tag);
1377 }
1378 vs->ioc_tag = qio_channel_add_watch(
1379 vs->ioc, G_IO_IN, vnc_client_io, vs, NULL);
1380 }
1381
1382 return ret;
1383 }
1384
1385
1386 /*
1387 * First function called whenever there is data to be written to
1388 * the client socket. Will delegate actual work according to whether
1389 * SASL SSF layers are enabled (thus requiring encryption calls)
1390 */
1391 static void vnc_client_write_locked(VncState *vs)
1392 {
1393 #ifdef CONFIG_VNC_SASL
1394 if (vs->sasl.conn &&
1395 vs->sasl.runSSF &&
1396 !vs->sasl.waitWriteSSF) {
1397 vnc_client_write_sasl(vs);
1398 } else
1399 #endif /* CONFIG_VNC_SASL */
1400 {
1401 vnc_client_write_plain(vs);
1402 }
1403 }
1404
1405 static void vnc_client_write(VncState *vs)
1406 {
1407
1408 vnc_lock_output(vs);
1409 if (vs->output.offset) {
1410 vnc_client_write_locked(vs);
1411 } else if (vs->ioc != NULL) {
1412 if (vs->ioc_tag) {
1413 g_source_remove(vs->ioc_tag);
1414 }
1415 vs->ioc_tag = qio_channel_add_watch(
1416 vs->ioc, G_IO_IN, vnc_client_io, vs, NULL);
1417 }
1418 vnc_unlock_output(vs);
1419 }
1420
1421 void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting)
1422 {
1423 vs->read_handler = func;
1424 vs->read_handler_expect = expecting;
1425 }
1426
1427
1428 /*
1429 * Called to read a chunk of data from the client socket. The data may
1430 * be the raw data, or may need to be further decoded by SASL.
1431 * The data will be read either straight from to the socket, or
1432 * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1433 *
1434 * NB, it is theoretically possible to have 2 layers of encryption,
1435 * both SASL, and this TLS layer. It is highly unlikely in practice
1436 * though, since SASL encryption will typically be a no-op if TLS
1437 * is active
1438 *
1439 * Returns the number of bytes read, which may be less than
1440 * the requested 'datalen' if the socket would block. Returns
1441 * 0 on I/O error or EOF, and disconnects the client socket.
1442 */
1443 size_t vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen)
1444 {
1445 ssize_t ret;
1446 Error *err = NULL;
1447 ret = qio_channel_read(
1448 vs->ioc, (char *)data, datalen, &err);
1449 VNC_DEBUG("Read wire %p %zd -> %ld\n", data, datalen, ret);
1450 return vnc_client_io_error(vs, ret, &err);
1451 }
1452
1453
1454 /*
1455 * Called to read data from the client socket to the input buffer,
1456 * when not using any SASL SSF encryption layers. Will read as much
1457 * data as possible without blocking.
1458 *
1459 * Returns the number of bytes read, which may be less than
1460 * the requested 'datalen' if the socket would block. Returns
1461 * 0 on I/O error or EOF, and disconnects the client socket.
1462 */
1463 static size_t vnc_client_read_plain(VncState *vs)
1464 {
1465 size_t ret;
1466 VNC_DEBUG("Read plain %p size %zd offset %zd\n",
1467 vs->input.buffer, vs->input.capacity, vs->input.offset);
1468 buffer_reserve(&vs->input, 4096);
1469 ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096);
1470 if (!ret)
1471 return 0;
1472 vs->input.offset += ret;
1473 return ret;
1474 }
1475
1476 static void vnc_jobs_bh(void *opaque)
1477 {
1478 VncState *vs = opaque;
1479
1480 vnc_jobs_consume_buffer(vs);
1481 }
1482
1483 /*
1484 * First function called whenever there is more data to be read from
1485 * the client socket. Will delegate actual work according to whether
1486 * SASL SSF layers are enabled (thus requiring decryption calls)
1487 * Returns 0 on success, -1 if client disconnected
1488 */
1489 static int vnc_client_read(VncState *vs)
1490 {
1491 size_t ret;
1492
1493 #ifdef CONFIG_VNC_SASL
1494 if (vs->sasl.conn && vs->sasl.runSSF)
1495 ret = vnc_client_read_sasl(vs);
1496 else
1497 #endif /* CONFIG_VNC_SASL */
1498 ret = vnc_client_read_plain(vs);
1499 if (!ret) {
1500 if (vs->disconnecting) {
1501 vnc_disconnect_finish(vs);
1502 return -1;
1503 }
1504 return 0;
1505 }
1506
1507 while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) {
1508 size_t len = vs->read_handler_expect;
1509 int ret;
1510
1511 ret = vs->read_handler(vs, vs->input.buffer, len);
1512 if (vs->disconnecting) {
1513 vnc_disconnect_finish(vs);
1514 return -1;
1515 }
1516
1517 if (!ret) {
1518 buffer_advance(&vs->input, len);
1519 } else {
1520 vs->read_handler_expect = ret;
1521 }
1522 }
1523 return 0;
1524 }
1525
1526 gboolean vnc_client_io(QIOChannel *ioc G_GNUC_UNUSED,
1527 GIOCondition condition, void *opaque)
1528 {
1529 VncState *vs = opaque;
1530 if (condition & G_IO_IN) {
1531 if (vnc_client_read(vs) < 0) {
1532 goto end;
1533 }
1534 }
1535 if (condition & G_IO_OUT) {
1536 vnc_client_write(vs);
1537 }
1538 end:
1539 if (vs->disconnecting) {
1540 if (vs->ioc_tag != 0) {
1541 g_source_remove(vs->ioc_tag);
1542 }
1543 vs->ioc_tag = 0;
1544 }
1545 return TRUE;
1546 }
1547
1548
1549 /*
1550 * Scale factor to apply to vs->throttle_output_offset when checking for
1551 * hard limit. Worst case normal usage could be x2, if we have a complete
1552 * incremental update and complete forced update in the output buffer.
1553 * So x3 should be good enough, but we pick x5 to be conservative and thus
1554 * (hopefully) never trigger incorrectly.
1555 */
1556 #define VNC_THROTTLE_OUTPUT_LIMIT_SCALE 5
1557
1558 void vnc_write(VncState *vs, const void *data, size_t len)
1559 {
1560 if (vs->disconnecting) {
1561 return;
1562 }
1563 /* Protection against malicious client/guest to prevent our output
1564 * buffer growing without bound if client stops reading data. This
1565 * should rarely trigger, because we have earlier throttling code
1566 * which stops issuing framebuffer updates and drops audio data
1567 * if the throttle_output_offset value is exceeded. So we only reach
1568 * this higher level if a huge number of pseudo-encodings get
1569 * triggered while data can't be sent on the socket.
1570 *
1571 * NB throttle_output_offset can be zero during early protocol
1572 * handshake, or from the job thread's VncState clone
1573 */
1574 if (vs->throttle_output_offset != 0 &&
1575 (vs->output.offset / VNC_THROTTLE_OUTPUT_LIMIT_SCALE) >
1576 vs->throttle_output_offset) {
1577 trace_vnc_client_output_limit(vs, vs->ioc, vs->output.offset,
1578 vs->throttle_output_offset);
1579 vnc_disconnect_start(vs);
1580 return;
1581 }
1582 buffer_reserve(&vs->output, len);
1583
1584 if (vs->ioc != NULL && buffer_empty(&vs->output)) {
1585 if (vs->ioc_tag) {
1586 g_source_remove(vs->ioc_tag);
1587 }
1588 vs->ioc_tag = qio_channel_add_watch(
1589 vs->ioc, G_IO_IN | G_IO_OUT, vnc_client_io, vs, NULL);
1590 }
1591
1592 buffer_append(&vs->output, data, len);
1593 }
1594
1595 void vnc_write_s32(VncState *vs, int32_t value)
1596 {
1597 vnc_write_u32(vs, *(uint32_t *)&value);
1598 }
1599
1600 void vnc_write_u32(VncState *vs, uint32_t value)
1601 {
1602 uint8_t buf[4];
1603
1604 buf[0] = (value >> 24) & 0xFF;
1605 buf[1] = (value >> 16) & 0xFF;
1606 buf[2] = (value >> 8) & 0xFF;
1607 buf[3] = value & 0xFF;
1608
1609 vnc_write(vs, buf, 4);
1610 }
1611
1612 void vnc_write_u16(VncState *vs, uint16_t value)
1613 {
1614 uint8_t buf[2];
1615
1616 buf[0] = (value >> 8) & 0xFF;
1617 buf[1] = value & 0xFF;
1618
1619 vnc_write(vs, buf, 2);
1620 }
1621
1622 void vnc_write_u8(VncState *vs, uint8_t value)
1623 {
1624 vnc_write(vs, (char *)&value, 1);
1625 }
1626
1627 void vnc_flush(VncState *vs)
1628 {
1629 vnc_lock_output(vs);
1630 if (vs->ioc != NULL && vs->output.offset) {
1631 vnc_client_write_locked(vs);
1632 }
1633 if (vs->disconnecting) {
1634 if (vs->ioc_tag != 0) {
1635 g_source_remove(vs->ioc_tag);
1636 }
1637 vs->ioc_tag = 0;
1638 }
1639 vnc_unlock_output(vs);
1640 }
1641
1642 static uint8_t read_u8(uint8_t *data, size_t offset)
1643 {
1644 return data[offset];
1645 }
1646
1647 static uint16_t read_u16(uint8_t *data, size_t offset)
1648 {
1649 return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF);
1650 }
1651
1652 static int32_t read_s32(uint8_t *data, size_t offset)
1653 {
1654 return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) |
1655 (data[offset + 2] << 8) | data[offset + 3]);
1656 }
1657
1658 uint32_t read_u32(uint8_t *data, size_t offset)
1659 {
1660 return ((data[offset] << 24) | (data[offset + 1] << 16) |
1661 (data[offset + 2] << 8) | data[offset + 3]);
1662 }
1663
1664 static void client_cut_text(VncState *vs, size_t len, uint8_t *text)
1665 {
1666 }
1667
1668 static void check_pointer_type_change(Notifier *notifier, void *data)
1669 {
1670 VncState *vs = container_of(notifier, VncState, mouse_mode_notifier);
1671 int absolute = qemu_input_is_absolute();
1672
1673 if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) {
1674 vnc_lock_output(vs);
1675 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1676 vnc_write_u8(vs, 0);
1677 vnc_write_u16(vs, 1);
1678 vnc_framebuffer_update(vs, absolute, 0,
1679 pixman_image_get_width(vs->vd->server),
1680 pixman_image_get_height(vs->vd->server),
1681 VNC_ENCODING_POINTER_TYPE_CHANGE);
1682 vnc_unlock_output(vs);
1683 vnc_flush(vs);
1684 }
1685 vs->absolute = absolute;
1686 }
1687
1688 static void pointer_event(VncState *vs, int button_mask, int x, int y)
1689 {
1690 static uint32_t bmap[INPUT_BUTTON__MAX] = {
1691 [INPUT_BUTTON_LEFT] = 0x01,
1692 [INPUT_BUTTON_MIDDLE] = 0x02,
1693 [INPUT_BUTTON_RIGHT] = 0x04,
1694 [INPUT_BUTTON_WHEEL_UP] = 0x08,
1695 [INPUT_BUTTON_WHEEL_DOWN] = 0x10,
1696 };
1697 QemuConsole *con = vs->vd->dcl.con;
1698 int width = pixman_image_get_width(vs->vd->server);
1699 int height = pixman_image_get_height(vs->vd->server);
1700
1701 if (vs->last_bmask != button_mask) {
1702 qemu_input_update_buttons(con, bmap, vs->last_bmask, button_mask);
1703 vs->last_bmask = button_mask;
1704 }
1705
1706 if (vs->absolute) {
1707 qemu_input_queue_abs(con, INPUT_AXIS_X, x, 0, width);
1708 qemu_input_queue_abs(con, INPUT_AXIS_Y, y, 0, height);
1709 } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) {
1710 qemu_input_queue_rel(con, INPUT_AXIS_X, x - 0x7FFF);
1711 qemu_input_queue_rel(con, INPUT_AXIS_Y, y - 0x7FFF);
1712 } else {
1713 if (vs->last_x != -1) {
1714 qemu_input_queue_rel(con, INPUT_AXIS_X, x - vs->last_x);
1715 qemu_input_queue_rel(con, INPUT_AXIS_Y, y - vs->last_y);
1716 }
1717 vs->last_x = x;
1718 vs->last_y = y;
1719 }
1720 qemu_input_event_sync();
1721 }
1722
1723 static void reset_keys(VncState *vs)
1724 {
1725 int i;
1726 for(i = 0; i < 256; i++) {
1727 if (vs->modifiers_state[i]) {
1728 qemu_input_event_send_key_number(vs->vd->dcl.con, i, false);
1729 qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
1730 vs->modifiers_state[i] = 0;
1731 }
1732 }
1733 }
1734
1735 static void press_key(VncState *vs, int keysym)
1736 {
1737 int keycode = keysym2scancode(vs->vd->kbd_layout, keysym,
1738 false, false, false) & SCANCODE_KEYMASK;
1739 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, true);
1740 qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
1741 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, false);
1742 qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
1743 }
1744
1745 static void vnc_led_state_change(VncState *vs)
1746 {
1747 if (!vnc_has_feature(vs, VNC_FEATURE_LED_STATE)) {
1748 return;
1749 }
1750
1751 vnc_lock_output(vs);
1752 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
1753 vnc_write_u8(vs, 0);
1754 vnc_write_u16(vs, 1);
1755 vnc_framebuffer_update(vs, 0, 0, 1, 1, VNC_ENCODING_LED_STATE);
1756 vnc_write_u8(vs, vs->vd->ledstate);
1757 vnc_unlock_output(vs);
1758 vnc_flush(vs);
1759 }
1760
1761 static void kbd_leds(void *opaque, int ledstate)
1762 {
1763 VncDisplay *vd = opaque;
1764 VncState *client;
1765
1766 trace_vnc_key_guest_leds((ledstate & QEMU_CAPS_LOCK_LED),
1767 (ledstate & QEMU_NUM_LOCK_LED),
1768 (ledstate & QEMU_SCROLL_LOCK_LED));
1769
1770 if (ledstate == vd->ledstate) {
1771 return;
1772 }
1773
1774 vd->ledstate = ledstate;
1775
1776 QTAILQ_FOREACH(client, &vd->clients, next) {
1777 vnc_led_state_change(client);
1778 }
1779 }
1780
1781 static void do_key_event(VncState *vs, int down, int keycode, int sym)
1782 {
1783 /* QEMU console switch */
1784 switch(keycode) {
1785 case 0x2a: /* Left Shift */
1786 case 0x36: /* Right Shift */
1787 case 0x1d: /* Left CTRL */
1788 case 0x9d: /* Right CTRL */
1789 case 0x38: /* Left ALT */
1790 case 0xb8: /* Right ALT */
1791 if (down)
1792 vs->modifiers_state[keycode] = 1;
1793 else
1794 vs->modifiers_state[keycode] = 0;
1795 break;
1796 case 0x02 ... 0x0a: /* '1' to '9' keys */
1797 if (vs->vd->dcl.con == NULL &&
1798 down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) {
1799 /* Reset the modifiers sent to the current console */
1800 reset_keys(vs);
1801 console_select(keycode - 0x02);
1802 return;
1803 }
1804 break;
1805 case 0x3a: /* CapsLock */
1806 case 0x45: /* NumLock */
1807 if (down)
1808 vs->modifiers_state[keycode] ^= 1;
1809 break;
1810 }
1811
1812 /* Turn off the lock state sync logic if the client support the led
1813 state extension.
1814 */
1815 if (down && vs->vd->lock_key_sync &&
1816 !vnc_has_feature(vs, VNC_FEATURE_LED_STATE) &&
1817 keycode_is_keypad(vs->vd->kbd_layout, keycode)) {
1818 /* If the numlock state needs to change then simulate an additional
1819 keypress before sending this one. This will happen if the user
1820 toggles numlock away from the VNC window.
1821 */
1822 if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) {
1823 if (!vs->modifiers_state[0x45]) {
1824 trace_vnc_key_sync_numlock(true);
1825 vs->modifiers_state[0x45] = 1;
1826 press_key(vs, 0xff7f);
1827 }
1828 } else {
1829 if (vs->modifiers_state[0x45]) {
1830 trace_vnc_key_sync_numlock(false);
1831 vs->modifiers_state[0x45] = 0;
1832 press_key(vs, 0xff7f);
1833 }
1834 }
1835 }
1836
1837 if (down && vs->vd->lock_key_sync &&
1838 !vnc_has_feature(vs, VNC_FEATURE_LED_STATE) &&
1839 ((sym >= 'A' && sym <= 'Z') || (sym >= 'a' && sym <= 'z'))) {
1840 /* If the capslock state needs to change then simulate an additional
1841 keypress before sending this one. This will happen if the user
1842 toggles capslock away from the VNC window.
1843 */
1844 int uppercase = !!(sym >= 'A' && sym <= 'Z');
1845 int shift = !!(vs->modifiers_state[0x2a] | vs->modifiers_state[0x36]);
1846 int capslock = !!(vs->modifiers_state[0x3a]);
1847 if (capslock) {
1848 if (uppercase == shift) {
1849 trace_vnc_key_sync_capslock(false);
1850 vs->modifiers_state[0x3a] = 0;
1851 press_key(vs, 0xffe5);
1852 }
1853 } else {
1854 if (uppercase != shift) {
1855 trace_vnc_key_sync_capslock(true);
1856 vs->modifiers_state[0x3a] = 1;
1857 press_key(vs, 0xffe5);
1858 }
1859 }
1860 }
1861
1862 if (qemu_console_is_graphic(NULL)) {
1863 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, down);
1864 qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
1865 } else {
1866 bool numlock = vs->modifiers_state[0x45];
1867 bool control = (vs->modifiers_state[0x1d] ||
1868 vs->modifiers_state[0x9d]);
1869 /* QEMU console emulation */
1870 if (down) {
1871 switch (keycode) {
1872 case 0x2a: /* Left Shift */
1873 case 0x36: /* Right Shift */
1874 case 0x1d: /* Left CTRL */
1875 case 0x9d: /* Right CTRL */
1876 case 0x38: /* Left ALT */
1877 case 0xb8: /* Right ALT */
1878 break;
1879 case 0xc8:
1880 kbd_put_keysym(QEMU_KEY_UP);
1881 break;
1882 case 0xd0:
1883 kbd_put_keysym(QEMU_KEY_DOWN);
1884 break;
1885 case 0xcb:
1886 kbd_put_keysym(QEMU_KEY_LEFT);
1887 break;
1888 case 0xcd:
1889 kbd_put_keysym(QEMU_KEY_RIGHT);
1890 break;
1891 case 0xd3:
1892 kbd_put_keysym(QEMU_KEY_DELETE);
1893 break;
1894 case 0xc7:
1895 kbd_put_keysym(QEMU_KEY_HOME);
1896 break;
1897 case 0xcf:
1898 kbd_put_keysym(QEMU_KEY_END);
1899 break;
1900 case 0xc9:
1901 kbd_put_keysym(QEMU_KEY_PAGEUP);
1902 break;
1903 case 0xd1:
1904 kbd_put_keysym(QEMU_KEY_PAGEDOWN);
1905 break;
1906
1907 case 0x47:
1908 kbd_put_keysym(numlock ? '7' : QEMU_KEY_HOME);
1909 break;
1910 case 0x48:
1911 kbd_put_keysym(numlock ? '8' : QEMU_KEY_UP);
1912 break;
1913 case 0x49:
1914 kbd_put_keysym(numlock ? '9' : QEMU_KEY_PAGEUP);
1915 break;
1916 case 0x4b:
1917 kbd_put_keysym(numlock ? '4' : QEMU_KEY_LEFT);
1918 break;
1919 case 0x4c:
1920 kbd_put_keysym('5');
1921 break;
1922 case 0x4d:
1923 kbd_put_keysym(numlock ? '6' : QEMU_KEY_RIGHT);
1924 break;
1925 case 0x4f:
1926 kbd_put_keysym(numlock ? '1' : QEMU_KEY_END);
1927 break;
1928 case 0x50:
1929 kbd_put_keysym(numlock ? '2' : QEMU_KEY_DOWN);
1930 break;
1931 case 0x51:
1932 kbd_put_keysym(numlock ? '3' : QEMU_KEY_PAGEDOWN);
1933 break;
1934 case 0x52:
1935 kbd_put_keysym('0');
1936 break;
1937 case 0x53:
1938 kbd_put_keysym(numlock ? '.' : QEMU_KEY_DELETE);
1939 break;
1940
1941 case 0xb5:
1942 kbd_put_keysym('/');
1943 break;
1944 case 0x37:
1945 kbd_put_keysym('*');
1946 break;
1947 case 0x4a:
1948 kbd_put_keysym('-');
1949 break;
1950 case 0x4e:
1951 kbd_put_keysym('+');
1952 break;
1953 case 0x9c:
1954 kbd_put_keysym('\n');
1955 break;
1956
1957 default:
1958 if (control) {
1959 kbd_put_keysym(sym & 0x1f);
1960 } else {
1961 kbd_put_keysym(sym);
1962 }
1963 break;
1964 }
1965 }
1966 }
1967 }
1968
1969 static void vnc_release_modifiers(VncState *vs)
1970 {
1971 static const int keycodes[] = {
1972 /* shift, control, alt keys, both left & right */
1973 0x2a, 0x36, 0x1d, 0x9d, 0x38, 0xb8,
1974 };
1975 int i, keycode;
1976
1977 if (!qemu_console_is_graphic(NULL)) {
1978 return;
1979 }
1980 for (i = 0; i < ARRAY_SIZE(keycodes); i++) {
1981 keycode = keycodes[i];
1982 if (!vs->modifiers_state[keycode]) {
1983 continue;
1984 }
1985 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, false);
1986 qemu_input_event_send_key_delay(vs->vd->key_delay_ms);
1987 }
1988 }
1989
1990 static const char *code2name(int keycode)
1991 {
1992 return QKeyCode_str(qemu_input_key_number_to_qcode(keycode));
1993 }
1994
1995 static void key_event(VncState *vs, int down, uint32_t sym)
1996 {
1997 bool shift = vs->modifiers_state[0x2a] || vs->modifiers_state[0x36];
1998 bool altgr = vs->modifiers_state[0xb8];
1999 bool ctrl = vs->modifiers_state[0x1d] || vs->modifiers_state[0x9d];
2000 int keycode;
2001 int lsym = sym;
2002
2003 if (lsym >= 'A' && lsym <= 'Z' && qemu_console_is_graphic(NULL)) {
2004 lsym = lsym - 'A' + 'a';
2005 }
2006
2007 keycode = keysym2scancode(vs->vd->kbd_layout, lsym & 0xFFFF,
2008 shift, altgr, ctrl) & SCANCODE_KEYMASK;
2009 trace_vnc_key_event_map(down, sym, keycode, code2name(keycode));
2010 do_key_event(vs, down, keycode, sym);
2011 }
2012
2013 static void ext_key_event(VncState *vs, int down,
2014 uint32_t sym, uint16_t keycode)
2015 {
2016 /* if the user specifies a keyboard layout, always use it */
2017 if (keyboard_layout) {
2018 key_event(vs, down, sym);
2019 } else {
2020 trace_vnc_key_event_ext(down, sym, keycode, code2name(keycode));
2021 do_key_event(vs, down, keycode, sym);
2022 }
2023 }
2024
2025 static void framebuffer_update_request(VncState *vs, int incremental,
2026 int x, int y, int w, int h)
2027 {
2028 if (incremental) {
2029 if (vs->update != VNC_STATE_UPDATE_FORCE) {
2030 vs->update = VNC_STATE_UPDATE_INCREMENTAL;
2031 }
2032 } else {
2033 vs->update = VNC_STATE_UPDATE_FORCE;
2034 vnc_set_area_dirty(vs->dirty, vs->vd, x, y, w, h);
2035 }
2036 }
2037
2038 static void send_ext_key_event_ack(VncState *vs)
2039 {
2040 vnc_lock_output(vs);
2041 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
2042 vnc_write_u8(vs, 0);
2043 vnc_write_u16(vs, 1);
2044 vnc_framebuffer_update(vs, 0, 0,
2045 pixman_image_get_width(vs->vd->server),
2046 pixman_image_get_height(vs->vd->server),
2047 VNC_ENCODING_EXT_KEY_EVENT);
2048 vnc_unlock_output(vs);
2049 vnc_flush(vs);
2050 }
2051
2052 static void send_ext_audio_ack(VncState *vs)
2053 {
2054 vnc_lock_output(vs);
2055 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
2056 vnc_write_u8(vs, 0);
2057 vnc_write_u16(vs, 1);
2058 vnc_framebuffer_update(vs, 0, 0,
2059 pixman_image_get_width(vs->vd->server),
2060 pixman_image_get_height(vs->vd->server),
2061 VNC_ENCODING_AUDIO);
2062 vnc_unlock_output(vs);
2063 vnc_flush(vs);
2064 }
2065
2066 static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
2067 {
2068 int i;
2069 unsigned int enc = 0;
2070
2071 vs->features = 0;
2072 vs->vnc_encoding = 0;
2073 vs->tight.compression = 9;
2074 vs->tight.quality = -1; /* Lossless by default */
2075 vs->absolute = -1;
2076
2077 /*
2078 * Start from the end because the encodings are sent in order of preference.
2079 * This way the preferred encoding (first encoding defined in the array)
2080 * will be set at the end of the loop.
2081 */
2082 for (i = n_encodings - 1; i >= 0; i--) {
2083 enc = encodings[i];
2084 switch (enc) {
2085 case VNC_ENCODING_RAW:
2086 vs->vnc_encoding = enc;
2087 break;
2088 case VNC_ENCODING_COPYRECT:
2089 vs->features |= VNC_FEATURE_COPYRECT_MASK;
2090 break;
2091 case VNC_ENCODING_HEXTILE:
2092 vs->features |= VNC_FEATURE_HEXTILE_MASK;
2093 vs->vnc_encoding = enc;
2094 break;
2095 case VNC_ENCODING_TIGHT:
2096 vs->features |= VNC_FEATURE_TIGHT_MASK;
2097 vs->vnc_encoding = enc;
2098 break;
2099 #ifdef CONFIG_VNC_PNG
2100 case VNC_ENCODING_TIGHT_PNG:
2101 vs->features |= VNC_FEATURE_TIGHT_PNG_MASK;
2102 vs->vnc_encoding = enc;
2103 break;
2104 #endif
2105 case VNC_ENCODING_ZLIB:
2106 vs->features |= VNC_FEATURE_ZLIB_MASK;
2107 vs->vnc_encoding = enc;
2108 break;
2109 case VNC_ENCODING_ZRLE:
2110 vs->features |= VNC_FEATURE_ZRLE_MASK;
2111 vs->vnc_encoding = enc;
2112 break;
2113 case VNC_ENCODING_ZYWRLE:
2114 vs->features |= VNC_FEATURE_ZYWRLE_MASK;
2115 vs->vnc_encoding = enc;
2116 break;
2117 case VNC_ENCODING_DESKTOPRESIZE:
2118 vs->features |= VNC_FEATURE_RESIZE_MASK;
2119 break;
2120 case VNC_ENCODING_POINTER_TYPE_CHANGE:
2121 vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK;
2122 break;
2123 case VNC_ENCODING_RICH_CURSOR:
2124 vs->features |= VNC_FEATURE_RICH_CURSOR_MASK;
2125 if (vs->vd->cursor) {
2126 vnc_cursor_define(vs);
2127 }
2128 break;
2129 case VNC_ENCODING_EXT_KEY_EVENT:
2130 send_ext_key_event_ack(vs);
2131 break;
2132 case VNC_ENCODING_AUDIO:
2133 send_ext_audio_ack(vs);
2134 break;
2135 case VNC_ENCODING_WMVi:
2136 vs->features |= VNC_FEATURE_WMVI_MASK;
2137 break;
2138 case VNC_ENCODING_LED_STATE:
2139 vs->features |= VNC_FEATURE_LED_STATE_MASK;
2140 break;
2141 case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9:
2142 vs->tight.compression = (enc & 0x0F);
2143 break;
2144 case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9:
2145 if (vs->vd->lossy) {
2146 vs->tight.quality = (enc & 0x0F);
2147 }
2148 break;
2149 default:
2150 VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc);
2151 break;
2152 }
2153 }
2154 vnc_desktop_resize(vs);
2155 check_pointer_type_change(&vs->mouse_mode_notifier, NULL);
2156 vnc_led_state_change(vs);
2157 }
2158
2159 static void set_pixel_conversion(VncState *vs)
2160 {
2161 pixman_format_code_t fmt = qemu_pixman_get_format(&vs->client_pf);
2162
2163 if (fmt == VNC_SERVER_FB_FORMAT) {
2164 vs->write_pixels = vnc_write_pixels_copy;
2165 vnc_hextile_set_pixel_conversion(vs, 0);
2166 } else {
2167 vs->write_pixels = vnc_write_pixels_generic;
2168 vnc_hextile_set_pixel_conversion(vs, 1);
2169 }
2170 }
2171
2172 static void send_color_map(VncState *vs)
2173 {
2174 int i;
2175
2176 vnc_write_u8(vs, VNC_MSG_SERVER_SET_COLOUR_MAP_ENTRIES);
2177 vnc_write_u8(vs, 0); /* padding */
2178 vnc_write_u16(vs, 0); /* first color */
2179 vnc_write_u16(vs, 256); /* # of colors */
2180
2181 for (i = 0; i < 256; i++) {
2182 PixelFormat *pf = &vs->client_pf;
2183
2184 vnc_write_u16(vs, (((i >> pf->rshift) & pf->rmax) << (16 - pf->rbits)));
2185 vnc_write_u16(vs, (((i >> pf->gshift) & pf->gmax) << (16 - pf->gbits)));
2186 vnc_write_u16(vs, (((i >> pf->bshift) & pf->bmax) << (16 - pf->bbits)));
2187 }
2188 }
2189
2190 static void set_pixel_format(VncState *vs, int bits_per_pixel,
2191 int big_endian_flag, int true_color_flag,
2192 int red_max, int green_max, int blue_max,
2193 int red_shift, int green_shift, int blue_shift)
2194 {
2195 if (!true_color_flag) {
2196 /* Expose a reasonable default 256 color map */
2197 bits_per_pixel = 8;
2198 red_max = 7;
2199 green_max = 7;
2200 blue_max = 3;
2201 red_shift = 0;
2202 green_shift = 3;
2203 blue_shift = 6;
2204 }
2205
2206 switch (bits_per_pixel) {
2207 case 8:
2208 case 16:
2209 case 32:
2210 break;
2211 default:
2212 vnc_client_error(vs);
2213 return;
2214 }
2215
2216 vs->client_pf.rmax = red_max ? red_max : 0xFF;
2217 vs->client_pf.rbits = ctpopl(red_max);
2218 vs->client_pf.rshift = red_shift;
2219 vs->client_pf.rmask = red_max << red_shift;
2220 vs->client_pf.gmax = green_max ? green_max : 0xFF;
2221 vs->client_pf.gbits = ctpopl(green_max);
2222 vs->client_pf.gshift = green_shift;
2223 vs->client_pf.gmask = green_max << green_shift;
2224 vs->client_pf.bmax = blue_max ? blue_max : 0xFF;
2225 vs->client_pf.bbits = ctpopl(blue_max);
2226 vs->client_pf.bshift = blue_shift;
2227 vs->client_pf.bmask = blue_max << blue_shift;
2228 vs->client_pf.bits_per_pixel = bits_per_pixel;
2229 vs->client_pf.bytes_per_pixel = bits_per_pixel / 8;
2230 vs->client_pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;
2231 vs->client_be = big_endian_flag;
2232
2233 if (!true_color_flag) {
2234 send_color_map(vs);
2235 }
2236
2237 set_pixel_conversion(vs);
2238
2239 graphic_hw_invalidate(vs->vd->dcl.con);
2240 graphic_hw_update(vs->vd->dcl.con);
2241 }
2242
2243 static void pixel_format_message (VncState *vs) {
2244 char pad[3] = { 0, 0, 0 };
2245
2246 vs->client_pf = qemu_default_pixelformat(32);
2247
2248 vnc_write_u8(vs, vs->client_pf.bits_per_pixel); /* bits-per-pixel */
2249 vnc_write_u8(vs, vs->client_pf.depth); /* depth */
2250
2251 #ifdef HOST_WORDS_BIGENDIAN
2252 vnc_write_u8(vs, 1); /* big-endian-flag */
2253 #else
2254 vnc_write_u8(vs, 0); /* big-endian-flag */
2255 #endif
2256 vnc_write_u8(vs, 1); /* true-color-flag */
2257 vnc_write_u16(vs, vs->client_pf.rmax); /* red-max */
2258 vnc_write_u16(vs, vs->client_pf.gmax); /* green-max */
2259 vnc_write_u16(vs, vs->client_pf.bmax); /* blue-max */
2260 vnc_write_u8(vs, vs->client_pf.rshift); /* red-shift */
2261 vnc_write_u8(vs, vs->client_pf.gshift); /* green-shift */
2262 vnc_write_u8(vs, vs->client_pf.bshift); /* blue-shift */
2263 vnc_write(vs, pad, 3); /* padding */
2264
2265 vnc_hextile_set_pixel_conversion(vs, 0);
2266 vs->write_pixels = vnc_write_pixels_copy;
2267 }
2268
2269 static void vnc_colordepth(VncState *vs)
2270 {
2271 if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) {
2272 /* Sending a WMVi message to notify the client*/
2273 vnc_lock_output(vs);
2274 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
2275 vnc_write_u8(vs, 0);
2276 vnc_write_u16(vs, 1); /* number of rects */
2277 vnc_framebuffer_update(vs, 0, 0,
2278 pixman_image_get_width(vs->vd->server),
2279 pixman_image_get_height(vs->vd->server),
2280 VNC_ENCODING_WMVi);
2281 pixel_format_message(vs);
2282 vnc_unlock_output(vs);
2283 vnc_flush(vs);
2284 } else {
2285 set_pixel_conversion(vs);
2286 }
2287 }
2288
2289 static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
2290 {
2291 int i;
2292 uint16_t limit;
2293 uint32_t freq;
2294 VncDisplay *vd = vs->vd;
2295
2296 if (data[0] > 3) {
2297 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
2298 }
2299
2300 switch (data[0]) {
2301 case VNC_MSG_CLIENT_SET_PIXEL_FORMAT:
2302 if (len == 1)
2303 return 20;
2304
2305 set_pixel_format(vs, read_u8(data, 4),
2306 read_u8(data, 6), read_u8(data, 7),
2307 read_u16(data, 8), read_u16(data, 10),
2308 read_u16(data, 12), read_u8(data, 14),
2309 read_u8(data, 15), read_u8(data, 16));
2310 break;
2311 case VNC_MSG_CLIENT_SET_ENCODINGS:
2312 if (len == 1)
2313 return 4;
2314
2315 if (len == 4) {
2316 limit = read_u16(data, 2);
2317 if (limit > 0)
2318 return 4 + (limit * 4);
2319 } else
2320 limit = read_u16(data, 2);
2321
2322 for (i = 0; i < limit; i++) {
2323 int32_t val = read_s32(data, 4 + (i * 4));
2324 memcpy(data + 4 + (i * 4), &val, sizeof(val));
2325 }
2326
2327 set_encodings(vs, (int32_t *)(data + 4), limit);
2328 break;
2329 case VNC_MSG_CLIENT_FRAMEBUFFER_UPDATE_REQUEST:
2330 if (len == 1)
2331 return 10;
2332
2333 framebuffer_update_request(vs,
2334 read_u8(data, 1), read_u16(data, 2), read_u16(data, 4),
2335 read_u16(data, 6), read_u16(data, 8));
2336 break;
2337 case VNC_MSG_CLIENT_KEY_EVENT:
2338 if (len == 1)
2339 return 8;
2340
2341 key_event(vs, read_u8(data, 1), read_u32(data, 4));
2342 break;
2343 case VNC_MSG_CLIENT_POINTER_EVENT:
2344 if (len == 1)
2345 return 6;
2346
2347 pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
2348 break;
2349 case VNC_MSG_CLIENT_CUT_TEXT:
2350 if (len == 1) {
2351 return 8;
2352 }
2353 if (len == 8) {
2354 uint32_t dlen = read_u32(data, 4);
2355 if (dlen > (1 << 20)) {
2356 error_report("vnc: client_cut_text msg payload has %u bytes"
2357 " which exceeds our limit of 1MB.", dlen);
2358 vnc_client_error(vs);
2359 break;
2360 }
2361 if (dlen > 0) {
2362 return 8 + dlen;
2363 }
2364 }
2365
2366 client_cut_text(vs, read_u32(data, 4), data + 8);
2367 break;
2368 case VNC_MSG_CLIENT_QEMU:
2369 if (len == 1)
2370 return 2;
2371
2372 switch (read_u8(data, 1)) {
2373 case VNC_MSG_CLIENT_QEMU_EXT_KEY_EVENT:
2374 if (len == 2)
2375 return 12;
2376
2377 ext_key_event(vs, read_u16(data, 2),
2378 read_u32(data, 4), read_u32(data, 8));
2379 break;
2380 case VNC_MSG_CLIENT_QEMU_AUDIO:
2381 if (len == 2)
2382 return 4;
2383
2384 switch (read_u16 (data, 2)) {
2385 case VNC_MSG_CLIENT_QEMU_AUDIO_ENABLE:
2386 audio_add(vs);
2387 break;
2388 case VNC_MSG_CLIENT_QEMU_AUDIO_DISABLE:
2389 audio_del(vs);
2390 break;
2391 case VNC_MSG_CLIENT_QEMU_AUDIO_SET_FORMAT:
2392 if (len == 4)
2393 return 10;
2394 switch (read_u8(data, 4)) {
2395 case 0: vs->as.fmt = AUD_FMT_U8; break;
2396 case 1: vs->as.fmt = AUD_FMT_S8; break;
2397 case 2: vs->as.fmt = AUD_FMT_U16; break;
2398 case 3: vs->as.fmt = AUD_FMT_S16; break;
2399 case 4: vs->as.fmt = AUD_FMT_U32; break;
2400 case 5: vs->as.fmt = AUD_FMT_S32; break;
2401 default:
2402 VNC_DEBUG("Invalid audio format %d\n", read_u8(data, 4));
2403 vnc_client_error(vs);
2404 break;
2405 }
2406 vs->as.nchannels = read_u8(data, 5);
2407 if (vs->as.nchannels != 1 && vs->as.nchannels != 2) {
2408 VNC_DEBUG("Invalid audio channel count %d\n",
2409 read_u8(data, 5));
2410 vnc_client_error(vs);
2411 break;
2412 }
2413 freq = read_u32(data, 6);
2414 /* No official limit for protocol, but 48khz is a sensible
2415 * upper bound for trustworthy clients, and this limit
2416 * protects calculations involving 'vs->as.freq' later.
2417 */
2418 if (freq > 48000) {
2419 VNC_DEBUG("Invalid audio frequency %u > 48000", freq);
2420 vnc_client_error(vs);
2421 break;
2422 }
2423 vs->as.freq = freq;
2424 break;
2425 default:
2426 VNC_DEBUG("Invalid audio message %d\n", read_u8(data, 4));
2427 vnc_client_error(vs);
2428 break;
2429 }
2430 break;
2431
2432 default:
2433 VNC_DEBUG("Msg: %d\n", read_u16(data, 0));
2434 vnc_client_error(vs);
2435 break;
2436 }
2437 break;
2438 default:
2439 VNC_DEBUG("Msg: %d\n", data[0]);
2440 vnc_client_error(vs);
2441 break;
2442 }
2443
2444 vnc_update_throttle_offset(vs);
2445 vnc_read_when(vs, protocol_client_msg, 1);
2446 return 0;
2447 }
2448
2449 static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
2450 {
2451 char buf[1024];
2452 VncShareMode mode;
2453 int size;
2454
2455 mode = data[0] ? VNC_SHARE_MODE_SHARED : VNC_SHARE_MODE_EXCLUSIVE;
2456 switch (vs->vd->share_policy) {
2457 case VNC_SHARE_POLICY_IGNORE:
2458 /*
2459 * Ignore the shared flag. Nothing to do here.
2460 *
2461 * Doesn't conform to the rfb spec but is traditional qemu
2462 * behavior, thus left here as option for compatibility
2463 * reasons.
2464 */
2465 break;
2466 case VNC_SHARE_POLICY_ALLOW_EXCLUSIVE:
2467 /*
2468 * Policy: Allow clients ask for exclusive access.
2469 *
2470 * Implementation: When a client asks for exclusive access,
2471 * disconnect all others. Shared connects are allowed as long
2472 * as no exclusive connection exists.
2473 *
2474 * This is how the rfb spec suggests to handle the shared flag.
2475 */
2476 if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2477 VncState *client;
2478 QTAILQ_FOREACH(client, &vs->vd->clients, next) {
2479 if (vs == client) {
2480 continue;
2481 }
2482 if (client->share_mode != VNC_SHARE_MODE_EXCLUSIVE &&
2483 client->share_mode != VNC_SHARE_MODE_SHARED) {
2484 continue;
2485 }
2486 vnc_disconnect_start(client);
2487 }
2488 }
2489 if (mode == VNC_SHARE_MODE_SHARED) {
2490 if (vs->vd->num_exclusive > 0) {
2491 vnc_disconnect_start(vs);
2492 return 0;
2493 }
2494 }
2495 break;
2496 case VNC_SHARE_POLICY_FORCE_SHARED:
2497 /*
2498 * Policy: Shared connects only.
2499 * Implementation: Disallow clients asking for exclusive access.
2500 *
2501 * Useful for shared desktop sessions where you don't want
2502 * someone forgetting to say -shared when running the vnc
2503 * client disconnect everybody else.
2504 */
2505 if (mode == VNC_SHARE_MODE_EXCLUSIVE) {
2506 vnc_disconnect_start(vs);
2507 return 0;
2508 }
2509 break;
2510 }
2511 vnc_set_share_mode(vs, mode);
2512
2513 if (vs->vd->num_shared > vs->vd->connections_limit) {
2514 vnc_disconnect_start(vs);
2515 return 0;
2516 }
2517
2518 assert(pixman_image_get_width(vs->vd->server) < 65536 &&
2519 pixman_image_get_width(vs->vd->server) >= 0);
2520 assert(pixman_image_get_height(vs->vd->server) < 65536 &&
2521 pixman_image_get_height(vs->vd->server) >= 0);
2522 vs->client_width = pixman_image_get_width(vs->vd->server);
2523 vs->client_height = pixman_image_get_height(vs->vd->server);
2524 vnc_write_u16(vs, vs->client_width);
2525 vnc_write_u16(vs, vs->client_height);
2526
2527 pixel_format_message(vs);
2528
2529 if (qemu_name) {
2530 size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
2531 if (size > sizeof(buf)) {
2532 size = sizeof(buf);
2533 }
2534 } else {
2535 size = snprintf(buf, sizeof(buf), "QEMU");
2536 }
2537
2538 vnc_write_u32(vs, size);
2539 vnc_write(vs, buf, size);
2540 vnc_flush(vs);
2541
2542 vnc_client_cache_auth(vs);
2543 vnc_qmp_event(vs, QAPI_EVENT_VNC_INITIALIZED);
2544
2545 vnc_read_when(vs, protocol_client_msg, 1);
2546
2547 return 0;
2548 }
2549
2550 void start_client_init(VncState *vs)
2551 {
2552 vnc_read_when(vs, protocol_client_init, 1);
2553 }
2554
2555 static void make_challenge(VncState *vs)
2556 {
2557 int i;
2558
2559 srand(time(NULL)+getpid()+getpid()*987654+rand());
2560
2561 for (i = 0 ; i < sizeof(vs->challenge) ; i++)
2562 vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
2563 }
2564
2565 static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
2566 {
2567 unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
2568 size_t i, pwlen;
2569 unsigned char key[8];
2570 time_t now = time(NULL);
2571 QCryptoCipher *cipher = NULL;
2572 Error *err = NULL;
2573
2574 if (!vs->vd->password) {
2575 trace_vnc_auth_fail(vs, vs->auth, "password is not set", "");
2576 goto reject;
2577 }
2578 if (vs->vd->expires < now) {
2579 trace_vnc_auth_fail(vs, vs->auth, "password is expired", "");
2580 goto reject;
2581 }
2582
2583 memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
2584
2585 /* Calculate the expected challenge response */
2586 pwlen = strlen(vs->vd->password);
2587 for (i=0; i<sizeof(key); i++)
2588 key[i] = i<pwlen ? vs->vd->password[i] : 0;
2589
2590 cipher = qcrypto_cipher_new(
2591 QCRYPTO_CIPHER_ALG_DES_RFB,
2592 QCRYPTO_CIPHER_MODE_ECB,
2593 key, G_N_ELEMENTS(key),
2594 &err);
2595 if (!cipher) {
2596 trace_vnc_auth_fail(vs, vs->auth, "cannot create cipher",
2597 error_get_pretty(err));
2598 error_free(err);
2599 goto reject;
2600 }
2601
2602 if (qcrypto_cipher_encrypt(cipher,
2603 vs->challenge,
2604 response,
2605 VNC_AUTH_CHALLENGE_SIZE,
2606 &err) < 0) {
2607 trace_vnc_auth_fail(vs, vs->auth, "cannot encrypt challenge response",
2608 error_get_pretty(err));
2609 error_free(err);
2610 goto reject;
2611 }
2612
2613 /* Compare expected vs actual challenge response */
2614 if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) {
2615 trace_vnc_auth_fail(vs, vs->auth, "mis-matched challenge response", "");
2616 goto reject;
2617 } else {
2618 trace_vnc_auth_pass(vs, vs->auth);
2619 vnc_write_u32(vs, 0); /* Accept auth */
2620 vnc_flush(vs);
2621
2622 start_client_init(vs);
2623 }
2624
2625 qcrypto_cipher_free(cipher);
2626 return 0;
2627
2628 reject:
2629 vnc_write_u32(vs, 1); /* Reject auth */
2630 if (vs->minor >= 8) {
2631 static const char err[] = "Authentication failed";
2632 vnc_write_u32(vs, sizeof(err));
2633 vnc_write(vs, err, sizeof(err));
2634 }
2635 vnc_flush(vs);
2636 vnc_client_error(vs);
2637 qcrypto_cipher_free(cipher);
2638 return 0;
2639 }
2640
2641 void start_auth_vnc(VncState *vs)
2642 {
2643 make_challenge(vs);
2644 /* Send client a 'random' challenge */
2645 vnc_write(vs, vs->challenge, sizeof(vs->challenge));
2646 vnc_flush(vs);
2647
2648 vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge));
2649 }
2650
2651
2652 static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
2653 {
2654 /* We only advertise 1 auth scheme at a time, so client
2655 * must pick the one we sent. Verify this */
2656 if (data[0] != vs->auth) { /* Reject auth */
2657 trace_vnc_auth_reject(vs, vs->auth, (int)data[0]);
2658 vnc_write_u32(vs, 1);
2659 if (vs->minor >= 8) {
2660 static const char err[] = "Authentication failed";
2661 vnc_write_u32(vs, sizeof(err));
2662 vnc_write(vs, err, sizeof(err));
2663 }
2664 vnc_client_error(vs);
2665 } else { /* Accept requested auth */
2666 trace_vnc_auth_start(vs, vs->auth);
2667 switch (vs->auth) {
2668 case VNC_AUTH_NONE:
2669 if (vs->minor >= 8) {
2670 vnc_write_u32(vs, 0); /* Accept auth completion */
2671 vnc_flush(vs);
2672 }
2673 trace_vnc_auth_pass(vs, vs->auth);
2674 start_client_init(vs);
2675 break;
2676
2677 case VNC_AUTH_VNC:
2678 start_auth_vnc(vs);
2679 break;
2680
2681 case VNC_AUTH_VENCRYPT:
2682 start_auth_vencrypt(vs);
2683 break;
2684
2685 #ifdef CONFIG_VNC_SASL
2686 case VNC_AUTH_SASL:
2687 start_auth_sasl(vs);
2688 break;
2689 #endif /* CONFIG_VNC_SASL */
2690
2691 default: /* Should not be possible, but just in case */
2692 trace_vnc_auth_fail(vs, vs->auth, "Unhandled auth method", "");
2693 vnc_write_u8(vs, 1);
2694 if (vs->minor >= 8) {
2695 static const char err[] = "Authentication failed";
2696 vnc_write_u32(vs, sizeof(err));
2697 vnc_write(vs, err, sizeof(err));
2698 }
2699 vnc_client_error(vs);
2700 }
2701 }
2702 return 0;
2703 }
2704
2705 static int protocol_version(VncState *vs, uint8_t *version, size_t len)
2706 {
2707 char local[13];
2708
2709 memcpy(local, version, 12);
2710 local[12] = 0;
2711
2712 if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) {
2713 VNC_DEBUG("Malformed protocol version %s\n", local);
2714 vnc_client_error(vs);
2715 return 0;
2716 }
2717 VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor);
2718 if (vs->major != 3 ||
2719 (vs->minor != 3 &&
2720 vs->minor != 4 &&
2721 vs->minor != 5 &&
2722 vs->minor != 7 &&
2723 vs->minor != 8)) {
2724 VNC_DEBUG("Unsupported client version\n");
2725 vnc_write_u32(vs, VNC_AUTH_INVALID);
2726 vnc_flush(vs);
2727 vnc_client_error(vs);
2728 return 0;
2729 }
2730 /* Some broken clients report v3.4 or v3.5, which spec requires to be treated
2731 * as equivalent to v3.3 by servers
2732 */
2733 if (vs->minor == 4 || vs->minor == 5)
2734 vs->minor = 3;
2735
2736 if (vs->minor == 3) {
2737 trace_vnc_auth_start(vs, vs->auth);
2738 if (vs->auth == VNC_AUTH_NONE) {
2739 vnc_write_u32(vs, vs->auth);
2740 vnc_flush(vs);
2741 trace_vnc_auth_pass(vs, vs->auth);
2742 start_client_init(vs);
2743 } else if (vs->auth == VNC_AUTH_VNC) {
2744 VNC_DEBUG("Tell client VNC auth\n");
2745 vnc_write_u32(vs, vs->auth);
2746 vnc_flush(vs);
2747 start_auth_vnc(vs);
2748 } else {
2749 trace_vnc_auth_fail(vs, vs->auth,
2750 "Unsupported auth method for v3.3", "");
2751 vnc_write_u32(vs, VNC_AUTH_INVALID);
2752 vnc_flush(vs);
2753 vnc_client_error(vs);
2754 }
2755 } else {
2756 vnc_write_u8(vs, 1); /* num auth */
2757 vnc_write_u8(vs, vs->auth);
2758 vnc_read_when(vs, protocol_client_auth, 1);
2759 vnc_flush(vs);
2760 }
2761
2762 return 0;
2763 }
2764
2765 static VncRectStat *vnc_stat_rect(VncDisplay *vd, int x, int y)
2766 {
2767 struct VncSurface *vs = &vd->guest;
2768
2769 return &vs->stats[y / VNC_STAT_RECT][x / VNC_STAT_RECT];
2770 }
2771
2772 void vnc_sent_lossy_rect(VncState *vs, int x, int y, int w, int h)
2773 {
2774 int i, j;
2775
2776 w = (x + w) / VNC_STAT_RECT;
2777 h = (y + h) / VNC_STAT_RECT;
2778 x /= VNC_STAT_RECT;
2779 y /= VNC_STAT_RECT;
2780
2781 for (j = y; j <= h; j++) {
2782 for (i = x; i <= w; i++) {
2783 vs->lossy_rect[j][i] = 1;
2784 }
2785 }
2786 }
2787
2788 static int vnc_refresh_lossy_rect(VncDisplay *vd, int x, int y)
2789 {
2790 VncState *vs;
2791 int sty = y / VNC_STAT_RECT;
2792 int stx = x / VNC_STAT_RECT;
2793 int has_dirty = 0;
2794
2795 y = QEMU_ALIGN_DOWN(y, VNC_STAT_RECT);
2796 x = QEMU_ALIGN_DOWN(x, VNC_STAT_RECT);
2797
2798 QTAILQ_FOREACH(vs, &vd->clients, next) {
2799 int j;
2800
2801 /* kernel send buffers are full -> refresh later */
2802 if (vs->output.offset) {
2803 continue;
2804 }
2805
2806 if (!vs->lossy_rect[sty][stx]) {
2807 continue;
2808 }
2809
2810 vs->lossy_rect[sty][stx] = 0;
2811 for (j = 0; j < VNC_STAT_RECT; ++j) {
2812 bitmap_set(vs->dirty[y + j],
2813 x / VNC_DIRTY_PIXELS_PER_BIT,
2814 VNC_STAT_RECT / VNC_DIRTY_PIXELS_PER_BIT);
2815 }
2816 has_dirty++;
2817 }
2818
2819 return has_dirty;
2820 }
2821
2822 static int vnc_update_stats(VncDisplay *vd, struct timeval * tv)
2823 {
2824 int width = MIN(pixman_image_get_width(vd->guest.fb),
2825 pixman_image_get_width(vd->server));
2826 int height = MIN(pixman_image_get_height(vd->guest.fb),
2827 pixman_image_get_height(vd->server));
2828 int x, y;
2829 struct timeval res;
2830 int has_dirty = 0;
2831
2832 for (y = 0; y < height; y += VNC_STAT_RECT) {
2833 for (x = 0; x < width; x += VNC_STAT_RECT) {
2834 VncRectStat *rect = vnc_stat_rect(vd, x, y);
2835
2836 rect->updated = false;
2837 }
2838 }
2839
2840 qemu_timersub(tv, &VNC_REFRESH_STATS, &res);
2841
2842 if (timercmp(&vd->guest.last_freq_check, &res, >)) {
2843 return has_dirty;
2844 }
2845 vd->guest.last_freq_check = *tv;
2846
2847 for (y = 0; y < height; y += VNC_STAT_RECT) {
2848 for (x = 0; x < width; x += VNC_STAT_RECT) {
2849 VncRectStat *rect= vnc_stat_rect(vd, x, y);
2850 int count = ARRAY_SIZE(rect->times);
2851 struct timeval min, max;
2852
2853 if (!timerisset(&rect->times[count - 1])) {
2854 continue ;
2855 }
2856
2857 max = rect->times[(rect->idx + count - 1) % count];
2858 qemu_timersub(tv, &max, &res);
2859
2860 if (timercmp(&res, &VNC_REFRESH_LOSSY, >)) {
2861 rect->freq = 0;
2862 has_dirty += vnc_refresh_lossy_rect(vd, x, y);
2863 memset(rect->times, 0, sizeof (rect->times));
2864 continue ;
2865 }
2866
2867 min = rect->times[rect->idx];
2868 max = rect->times[(rect->idx + count - 1) % count];
2869 qemu_timersub(&max, &min, &res);
2870
2871 rect->freq = res.tv_sec + res.tv_usec / 1000000.;
2872 rect->freq /= count;
2873 rect->freq = 1. / rect->freq;
2874 }
2875 }
2876 return has_dirty;
2877 }
2878
2879 double vnc_update_freq(VncState *vs, int x, int y, int w, int h)
2880 {
2881 int i, j;
2882 double total = 0;
2883 int num = 0;
2884
2885 x = QEMU_ALIGN_DOWN(x, VNC_STAT_RECT);
2886 y = QEMU_ALIGN_DOWN(y, VNC_STAT_RECT);
2887
2888 for (j = y; j <= y + h; j += VNC_STAT_RECT) {
2889 for (i = x; i <= x + w; i += VNC_STAT_RECT) {
2890 total += vnc_stat_rect(vs->vd, i, j)->freq;
2891 num++;
2892 }
2893 }
2894
2895 if (num) {
2896 return total / num;
2897 } else {
2898 return 0;
2899 }
2900 }
2901
2902 static void vnc_rect_updated(VncDisplay *vd, int x, int y, struct timeval * tv)
2903 {
2904 VncRectStat *rect;
2905
2906 rect = vnc_stat_rect(vd, x, y);
2907 if (rect->updated) {
2908 return ;
2909 }
2910 rect->times[rect->idx] = *tv;
2911 rect->idx = (rect->idx + 1) % ARRAY_SIZE(rect->times);
2912 rect->updated = true;
2913 }
2914
2915 static int vnc_refresh_server_surface(VncDisplay *vd)
2916 {
2917 int width = MIN(pixman_image_get_width(vd->guest.fb),
2918 pixman_image_get_width(vd->server));
2919 int height = MIN(pixman_image_get_height(vd->guest.fb),
2920 pixman_image_get_height(vd->server));
2921 int cmp_bytes, server_stride, line_bytes, guest_ll, guest_stride, y = 0;
2922 uint8_t *guest_row0 = NULL, *server_row0;
2923 VncState *vs;
2924 int has_dirty = 0;
2925 pixman_image_t *tmpbuf = NULL;
2926
2927 struct timeval tv = { 0, 0 };
2928
2929 if (!vd->non_adaptive) {
2930 gettimeofday(&tv, NULL);
2931 has_dirty = vnc_update_stats(vd, &tv);
2932 }
2933
2934 /*
2935 * Walk through the guest dirty map.
2936 * Check and copy modified bits from guest to server surface.
2937 * Update server dirty map.
2938 */
2939 server_row0 = (uint8_t *)pixman_image_get_data(vd->server);
2940 server_stride = guest_stride = guest_ll =
2941 pixman_image_get_stride(vd->server);
2942 cmp_bytes = MIN(VNC_DIRTY_PIXELS_PER_BIT * VNC_SERVER_FB_BYTES,
2943 server_stride);
2944 if (vd->guest.format != VNC_SERVER_FB_FORMAT) {
2945 int width = pixman_image_get_width(vd->server);
2946 tmpbuf = qemu_pixman_linebuf_create(VNC_SERVER_FB_FORMAT, width);
2947 } else {
2948 int guest_bpp =
2949 PIXMAN_FORMAT_BPP(pixman_image_get_format(vd->guest.fb));
2950 guest_row0 = (uint8_t *)pixman_image_get_data(vd->guest.fb);
2951 guest_stride = pixman_image_get_stride(vd->guest.fb);
2952 guest_ll = pixman_image_get_width(vd->guest.fb) * (DIV_ROUND_UP(guest_bpp, 8));
2953 }
2954 line_bytes = MIN(server_stride, guest_ll);
2955
2956 for (;;) {
2957 int x;
2958 uint8_t *guest_ptr, *server_ptr;
2959 unsigned long offset = find_next_bit((unsigned long *) &vd->guest.dirty,
2960 height * VNC_DIRTY_BPL(&vd->guest),
2961 y * VNC_DIRTY_BPL(&vd->guest));
2962 if (offset == height * VNC_DIRTY_BPL(&vd->guest)) {
2963 /* no more dirty bits */
2964 break;
2965 }
2966 y = offset / VNC_DIRTY_BPL(&vd->guest);
2967 x = offset % VNC_DIRTY_BPL(&vd->guest);
2968
2969 server_ptr = server_row0 + y * server_stride + x * cmp_bytes;
2970
2971 if (vd->guest.format != VNC_SERVER_FB_FORMAT) {
2972 qemu_pixman_linebuf_fill(tmpbuf, vd->guest.fb, width, 0, y);
2973 guest_ptr = (uint8_t *)pixman_image_get_data(tmpbuf);
2974 } else {
2975 guest_ptr = guest_row0 + y * guest_stride;
2976 }
2977 guest_ptr += x * cmp_bytes;
2978
2979 for (; x < DIV_ROUND_UP(width, VNC_DIRTY_PIXELS_PER_BIT);
2980 x++, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) {
2981 int _cmp_bytes = cmp_bytes;
2982 if (!test_and_clear_bit(x, vd->guest.dirty[y])) {
2983 continue;
2984 }
2985 if ((x + 1) * cmp_bytes > line_bytes) {
2986 _cmp_bytes = line_bytes - x * cmp_bytes;
2987 }
2988 assert(_cmp_bytes >= 0);
2989 if (memcmp(server_ptr, guest_ptr, _cmp_bytes) == 0) {
2990 continue;
2991 }
2992 memcpy(server_ptr, guest_ptr, _cmp_bytes);
2993 if (!vd->non_adaptive) {
2994 vnc_rect_updated(vd, x * VNC_DIRTY_PIXELS_PER_BIT,
2995 y, &tv);
2996 }
2997 QTAILQ_FOREACH(vs, &vd->clients, next) {
2998 set_bit(x, vs->dirty[y]);
2999 }
3000 has_dirty++;
3001 }
3002
3003 y++;
3004 }
3005 qemu_pixman_image_unref(tmpbuf);
3006 return has_dirty;
3007 }
3008
3009 static void vnc_refresh(DisplayChangeListener *dcl)
3010 {
3011 VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
3012 VncState *vs, *vn;
3013 int has_dirty, rects = 0;
3014
3015 if (QTAILQ_EMPTY(&vd->clients)) {
3016 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_MAX);
3017 return;
3018 }
3019
3020 graphic_hw_update(vd->dcl.con);
3021
3022 if (vnc_trylock_display(vd)) {
3023 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
3024 return;
3025 }
3026
3027 has_dirty = vnc_refresh_server_surface(vd);
3028 vnc_unlock_display(vd);
3029
3030 QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {
3031 rects += vnc_update_client(vs, has_dirty);
3032 /* vs might be free()ed here */
3033 }
3034
3035 if (has_dirty && rects) {
3036 vd->dcl.update_interval /= 2;
3037 if (vd->dcl.update_interval < VNC_REFRESH_INTERVAL_BASE) {
3038 vd->dcl.update_interval = VNC_REFRESH_INTERVAL_BASE;
3039 }
3040 } else {
3041 vd->dcl.update_interval += VNC_REFRESH_INTERVAL_INC;
3042 if (vd->dcl.update_interval > VNC_REFRESH_INTERVAL_MAX) {
3043 vd->dcl.update_interval = VNC_REFRESH_INTERVAL_MAX;
3044 }
3045 }
3046 }
3047
3048 static void vnc_connect(VncDisplay *vd, QIOChannelSocket *sioc,
3049 bool skipauth, bool websocket)
3050 {
3051 VncState *vs = g_new0(VncState, 1);
3052 bool first_client = QTAILQ_EMPTY(&vd->clients);
3053 int i;
3054
3055 trace_vnc_client_connect(vs, sioc);
3056 vs->sioc = sioc;
3057 object_ref(OBJECT(vs->sioc));
3058 vs->ioc = QIO_CHANNEL(sioc);
3059 object_ref(OBJECT(vs->ioc));
3060 vs->vd = vd;
3061
3062 buffer_init(&vs->input, "vnc-input/%p", sioc);
3063 buffer_init(&vs->output, "vnc-output/%p", sioc);
3064 buffer_init(&vs->jobs_buffer, "vnc-jobs_buffer/%p", sioc);
3065
3066 buffer_init(&vs->tight.tight, "vnc-tight/%p", sioc);
3067 buffer_init(&vs->tight.zlib, "vnc-tight-zlib/%p", sioc);
3068 buffer_init(&vs->tight.gradient, "vnc-tight-gradient/%p", sioc);
3069 #ifdef CONFIG_VNC_JPEG
3070 buffer_init(&vs->tight.jpeg, "vnc-tight-jpeg/%p", sioc);
3071 #endif
3072 #ifdef CONFIG_VNC_PNG
3073 buffer_init(&vs->tight.png, "vnc-tight-png/%p", sioc);
3074 #endif
3075 buffer_init(&vs->zlib.zlib, "vnc-zlib/%p", sioc);
3076 buffer_init(&vs->zrle.zrle, "vnc-zrle/%p", sioc);
3077 buffer_init(&vs->zrle.fb, "vnc-zrle-fb/%p", sioc);
3078 buffer_init(&vs->zrle.zlib, "vnc-zrle-zlib/%p", sioc);
3079
3080 if (skipauth) {
3081 vs->auth = VNC_AUTH_NONE;
3082 vs->subauth = VNC_AUTH_INVALID;
3083 } else {
3084 if (websocket) {
3085 vs->auth = vd->ws_auth;
3086 vs->subauth = VNC_AUTH_INVALID;
3087 } else {
3088 vs->auth = vd->auth;
3089 vs->subauth = vd->subauth;
3090 }
3091 }
3092 VNC_DEBUG("Client sioc=%p ws=%d auth=%d subauth=%d\n",
3093 sioc, websocket, vs->auth, vs->subauth);
3094
3095 vs->lossy_rect = g_malloc0(VNC_STAT_ROWS * sizeof (*vs->lossy_rect));
3096 for (i = 0; i < VNC_STAT_ROWS; ++i) {
3097 vs->lossy_rect[i] = g_new0(uint8_t, VNC_STAT_COLS);
3098 }
3099
3100 VNC_DEBUG("New client on socket %p\n", vs->sioc);
3101 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
3102 qio_channel_set_blocking(vs->ioc, false, NULL);
3103 if (vs->ioc_tag) {
3104 g_source_remove(vs->ioc_tag);
3105 }
3106 if (websocket) {
3107 vs->websocket = 1;
3108 if (vd->tlscreds) {
3109 vs->ioc_tag = qio_channel_add_watch(
3110 vs->ioc, G_IO_IN, vncws_tls_handshake_io, vs, NULL);
3111 } else {
3112 vs->ioc_tag = qio_channel_add_watch(
3113 vs->ioc, G_IO_IN, vncws_handshake_io, vs, NULL);
3114 }
3115 } else {
3116 vs->ioc_tag = qio_channel_add_watch(
3117 vs->ioc, G_IO_IN, vnc_client_io, vs, NULL);
3118 }
3119
3120 vnc_client_cache_addr(vs);
3121 vnc_qmp_event(vs, QAPI_EVENT_VNC_CONNECTED);
3122 vnc_set_share_mode(vs, VNC_SHARE_MODE_CONNECTING);
3123
3124 vs->last_x = -1;
3125 vs->last_y = -1;
3126
3127 vs->as.freq = 44100;
3128 vs->as.nchannels = 2;
3129 vs->as.fmt = AUD_FMT_S16;
3130 vs->as.endianness = 0;
3131
3132 qemu_mutex_init(&vs->output_mutex);
3133 vs->bh = qemu_bh_new(vnc_jobs_bh, vs);
3134
3135 QTAILQ_INSERT_TAIL(&vd->clients, vs, next);
3136 if (first_client) {
3137 vnc_update_server_surface(vd);
3138 }
3139
3140 graphic_hw_update(vd->dcl.con);
3141
3142 if (!vs->websocket) {
3143 vnc_start_protocol(vs);
3144 }
3145
3146 if (vd->num_connecting > vd->connections_limit) {
3147 QTAILQ_FOREACH(vs, &vd->clients, next) {
3148 if (vs->share_mode == VNC_SHARE_MODE_CONNECTING) {
3149 vnc_disconnect_start(vs);
3150 return;
3151 }
3152 }
3153 }
3154 }
3155
3156 void vnc_start_protocol(VncState *vs)
3157 {
3158 vnc_write(vs, "RFB 003.008\n", 12);
3159 vnc_flush(vs);
3160 vnc_read_when(vs, protocol_version, 12);
3161
3162 vs->mouse_mode_notifier.notify = check_pointer_type_change;
3163 qemu_add_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
3164 }
3165
3166 static void vnc_listen_io(QIONetListener *listener,
3167 QIOChannelSocket *cioc,
3168 void *opaque)
3169 {
3170 VncDisplay *vd = opaque;
3171 bool isWebsock = listener == vd->wslistener;
3172
3173 qio_channel_set_name(QIO_CHANNEL(cioc),
3174 isWebsock ? "vnc-ws-server" : "vnc-server");
3175 qio_channel_set_delay(QIO_CHANNEL(cioc), false);
3176 vnc_connect(vd, cioc, false, isWebsock);
3177 }
3178
3179 static const DisplayChangeListenerOps dcl_ops = {
3180 .dpy_name = "vnc",
3181 .dpy_refresh = vnc_refresh,
3182 .dpy_gfx_update = vnc_dpy_update,
3183 .dpy_gfx_switch = vnc_dpy_switch,
3184 .dpy_gfx_check_format = qemu_pixman_check_format,
3185 .dpy_mouse_set = vnc_mouse_set,
3186 .dpy_cursor_define = vnc_dpy_cursor_define,
3187 };
3188
3189 void vnc_display_init(const char *id)
3190 {
3191 VncDisplay *vd;
3192
3193 if (vnc_display_find(id) != NULL) {
3194 return;
3195 }
3196 vd = g_malloc0(sizeof(*vd));
3197
3198 vd->id = strdup(id);
3199 QTAILQ_INSERT_TAIL(&vnc_displays, vd, next);
3200
3201 QTAILQ_INIT(&vd->clients);
3202 vd->expires = TIME_MAX;
3203
3204 if (keyboard_layout) {
3205 trace_vnc_key_map_init(keyboard_layout);
3206 vd->kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout);
3207 } else {
3208 vd->kbd_layout = init_keyboard_layout(name2keysym, "en-us");
3209 }
3210
3211 if (!vd->kbd_layout) {
3212 exit(1);
3213 }
3214
3215 vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
3216 vd->connections_limit = 32;
3217
3218 qemu_mutex_init(&vd->mutex);
3219 vnc_start_worker_thread();
3220
3221 vd->dcl.ops = &dcl_ops;
3222 register_displaychangelistener(&vd->dcl);
3223 }
3224
3225
3226 static void vnc_display_close(VncDisplay *vd)
3227 {
3228 if (!vd) {
3229 return;
3230 }
3231 vd->is_unix = false;
3232
3233 if (vd->listener) {
3234 qio_net_listener_disconnect(vd->listener);
3235 object_unref(OBJECT(vd->listener));
3236 }
3237 vd->listener = NULL;
3238
3239 if (vd->wslistener) {
3240 qio_net_listener_disconnect(vd->wslistener);
3241 object_unref(OBJECT(vd->wslistener));
3242 }
3243 vd->wslistener = NULL;
3244
3245 vd->auth = VNC_AUTH_INVALID;
3246 vd->subauth = VNC_AUTH_INVALID;
3247 if (vd->tlscreds) {
3248 object_unparent(OBJECT(vd->tlscreds));
3249 vd->tlscreds = NULL;
3250 }
3251 g_free(vd->tlsaclname);
3252 vd->tlsaclname = NULL;
3253 if (vd->lock_key_sync) {
3254 qemu_remove_led_event_handler(vd->led);
3255 vd->led = NULL;
3256 }
3257 }
3258
3259 int vnc_display_password(const char *id, const char *password)
3260 {
3261 VncDisplay *vd = vnc_display_find(id);
3262
3263 if (!vd) {
3264 return -EINVAL;
3265 }
3266 if (vd->auth == VNC_AUTH_NONE) {
3267 error_printf_unless_qmp("If you want use passwords please enable "
3268 "password auth using '-vnc ${dpy},password'.\n");
3269 return -EINVAL;
3270 }
3271
3272 g_free(vd->password);
3273 vd->password = g_strdup(password);
3274
3275 return 0;
3276 }
3277
3278 int vnc_display_pw_expire(const char *id, time_t expires)
3279 {
3280 VncDisplay *vd = vnc_display_find(id);
3281
3282 if (!vd) {
3283 return -EINVAL;
3284 }
3285
3286 vd->expires = expires;
3287 return 0;
3288 }
3289
3290 static void vnc_display_print_local_addr(VncDisplay *vd)
3291 {
3292 SocketAddress *addr;
3293 Error *err = NULL;
3294
3295 if (!vd->listener || !vd->listener->nsioc) {
3296 return;
3297 }
3298
3299 addr = qio_channel_socket_get_local_address(vd->listener->sioc[0], &err);
3300 if (!addr) {
3301 return;
3302 }
3303
3304 if (addr->type != SOCKET_ADDRESS_TYPE_INET) {
3305 qapi_free_SocketAddress(addr);
3306 return;
3307 }
3308 error_printf_unless_qmp("VNC server running on %s:%s\n",
3309 addr->u.inet.host,
3310 addr->u.inet.port);
3311 qapi_free_SocketAddress(addr);
3312 }
3313
3314 static QemuOptsList qemu_vnc_opts = {
3315 .name = "vnc",
3316 .head = QTAILQ_HEAD_INITIALIZER(qemu_vnc_opts.head),
3317 .implied_opt_name = "vnc",
3318 .desc = {
3319 {
3320 .name = "vnc",
3321 .type = QEMU_OPT_STRING,
3322 },{
3323 .name = "websocket",
3324 .type = QEMU_OPT_STRING,
3325 },{
3326 .name = "tls-creds",
3327 .type = QEMU_OPT_STRING,
3328 },{
3329 /* Deprecated in favour of tls-creds */
3330 .name = "x509",
3331 .type = QEMU_OPT_STRING,
3332 },{
3333 .name = "share",
3334 .type = QEMU_OPT_STRING,
3335 },{
3336 .name = "display",
3337 .type = QEMU_OPT_STRING,
3338 },{
3339 .name = "head",
3340 .type = QEMU_OPT_NUMBER,
3341 },{
3342 .name = "connections",
3343 .type = QEMU_OPT_NUMBER,
3344 },{
3345 .name = "to",
3346 .type = QEMU_OPT_NUMBER,
3347 },{
3348 .name = "ipv4",
3349 .type = QEMU_OPT_BOOL,
3350 },{
3351 .name = "ipv6",
3352 .type = QEMU_OPT_BOOL,
3353 },{
3354 .name = "password",
3355 .type = QEMU_OPT_BOOL,
3356 },{
3357 .name = "reverse",
3358 .type = QEMU_OPT_BOOL,
3359 },{
3360 .name = "lock-key-sync",
3361 .type = QEMU_OPT_BOOL,
3362 },{
3363 .name = "key-delay-ms",
3364 .type = QEMU_OPT_NUMBER,
3365 },{
3366 .name = "sasl",
3367 .type = QEMU_OPT_BOOL,
3368 },{
3369 /* Deprecated in favour of tls-creds */
3370 .name = "tls",
3371 .type = QEMU_OPT_BOOL,
3372 },{
3373 /* Deprecated in favour of tls-creds */
3374 .name = "x509verify",
3375 .type = QEMU_OPT_STRING,
3376 },{
3377 .name = "acl",
3378 .type = QEMU_OPT_BOOL,
3379 },{
3380 .name = "lossy",
3381 .type = QEMU_OPT_BOOL,
3382 },{
3383 .name = "non-adaptive",
3384 .type = QEMU_OPT_BOOL,
3385 },
3386 { /* end of list */ }
3387 },
3388 };
3389
3390
3391 static int
3392 vnc_display_setup_auth(int *auth,
3393 int *subauth,
3394 QCryptoTLSCreds *tlscreds,
3395 bool password,
3396 bool sasl,
3397 bool websocket,
3398 Error **errp)
3399 {
3400 /*
3401 * We have a choice of 3 authentication options
3402 *
3403 * 1. none
3404 * 2. vnc
3405 * 3. sasl
3406 *
3407 * The channel can be run in 2 modes
3408 *
3409 * 1. clear
3410 * 2. tls
3411 *
3412 * And TLS can use 2 types of credentials
3413 *
3414 * 1. anon
3415 * 2. x509
3416 *
3417 * We thus have 9 possible logical combinations
3418 *
3419 * 1. clear + none
3420 * 2. clear + vnc
3421 * 3. clear + sasl
3422 * 4. tls + anon + none
3423 * 5. tls + anon + vnc
3424 * 6. tls + anon + sasl
3425 * 7. tls + x509 + none
3426 * 8. tls + x509 + vnc
3427 * 9. tls + x509 + sasl
3428 *
3429 * These need to be mapped into the VNC auth schemes
3430 * in an appropriate manner. In regular VNC, all the
3431 * TLS options get mapped into VNC_AUTH_VENCRYPT
3432 * sub-auth types.
3433 *
3434 * In websockets, the https:// protocol already provides
3435 * TLS support, so there is no need to make use of the
3436 * VeNCrypt extension. Furthermore, websockets browser
3437 * clients could not use VeNCrypt even if they wanted to,
3438 * as they cannot control when the TLS handshake takes
3439 * place. Thus there is no option but to rely on https://,
3440 * meaning combinations 4->6 and 7->9 will be mapped to
3441 * VNC auth schemes in the same way as combos 1->3.
3442 *
3443 * Regardless of fact that we have a different mapping to
3444 * VNC auth mechs for plain VNC vs websockets VNC, the end
3445 * result has the same security characteristics.
3446 */
3447 if (websocket || !tlscreds) {
3448 if (password) {
3449 VNC_DEBUG("Initializing VNC server with password auth\n");
3450 *auth = VNC_AUTH_VNC;
3451 } else if (sasl) {
3452 VNC_DEBUG("Initializing VNC server with SASL auth\n");
3453 *auth = VNC_AUTH_SASL;
3454 } else {
3455 VNC_DEBUG("Initializing VNC server with no auth\n");
3456 *auth = VNC_AUTH_NONE;
3457 }
3458 *subauth = VNC_AUTH_INVALID;
3459 } else {
3460 bool is_x509 = object_dynamic_cast(OBJECT(tlscreds),
3461 TYPE_QCRYPTO_TLS_CREDS_X509) != NULL;
3462 bool is_anon = object_dynamic_cast(OBJECT(tlscreds),
3463 TYPE_QCRYPTO_TLS_CREDS_ANON) != NULL;
3464
3465 if (!is_x509 && !is_anon) {
3466 error_setg(errp,
3467 "Unsupported TLS cred type %s",
3468 object_get_typename(OBJECT(tlscreds)));
3469 return -1;
3470 }
3471 *auth = VNC_AUTH_VENCRYPT;
3472 if (password) {
3473 if (is_x509) {
3474 VNC_DEBUG("Initializing VNC server with x509 password auth\n");
3475 *subauth = VNC_AUTH_VENCRYPT_X509VNC;
3476 } else {
3477 VNC_DEBUG("Initializing VNC server with TLS password auth\n");
3478 *subauth = VNC_AUTH_VENCRYPT_TLSVNC;
3479 }
3480
3481 } else if (sasl) {
3482 if (is_x509) {
3483 VNC_DEBUG("Initializing VNC server with x509 SASL auth\n");
3484 *subauth = VNC_AUTH_VENCRYPT_X509SASL;
3485 } else {
3486 VNC_DEBUG("Initializing VNC server with TLS SASL auth\n");
3487 *subauth = VNC_AUTH_VENCRYPT_TLSSASL;
3488 }
3489 } else {
3490 if (is_x509) {
3491 VNC_DEBUG("Initializing VNC server with x509 no auth\n");
3492 *subauth = VNC_AUTH_VENCRYPT_X509NONE;
3493 } else {
3494 VNC_DEBUG("Initializing VNC server with TLS no auth\n");
3495 *subauth = VNC_AUTH_VENCRYPT_TLSNONE;
3496 }
3497 }
3498 }
3499 return 0;
3500 }
3501
3502
3503 /*
3504 * Handle back compat with old CLI syntax by creating some
3505 * suitable QCryptoTLSCreds objects
3506 */
3507 static QCryptoTLSCreds *
3508 vnc_display_create_creds(bool x509,
3509 bool x509verify,
3510 const char *dir,
3511 const char *id,
3512 Error **errp)
3513 {
3514 gchar *credsid = g_strdup_printf("tlsvnc%s", id);
3515 Object *parent = object_get_objects_root();
3516 Object *creds;
3517 Error *err = NULL;
3518
3519 if (x509) {
3520 creds = object_new_with_props(TYPE_QCRYPTO_TLS_CREDS_X509,
3521 parent,
3522 credsid,
3523 &err,
3524 "endpoint", "server",
3525 "dir", dir,
3526 "verify-peer", x509verify ? "yes" : "no",
3527 NULL);
3528 } else {
3529 creds = object_new_with_props(TYPE_QCRYPTO_TLS_CREDS_ANON,
3530 parent,
3531 credsid,
3532 &err,
3533 "endpoint", "server",
3534 NULL);
3535 }
3536
3537 g_free(credsid);
3538
3539 if (err) {
3540 error_propagate(errp, err);
3541 return NULL;
3542 }
3543
3544 return QCRYPTO_TLS_CREDS(creds);
3545 }
3546
3547
3548 static int vnc_display_get_address(const char *addrstr,
3549 bool websocket,
3550 bool reverse,
3551 int displaynum,
3552 int to,
3553 bool has_ipv4,
3554 bool has_ipv6,
3555 bool ipv4,
3556 bool ipv6,
3557 SocketAddress **retaddr,
3558 Error **errp)
3559 {
3560 int ret = -1;
3561 SocketAddress *addr = NULL;
3562
3563 addr = g_new0(SocketAddress, 1);
3564
3565 if (strncmp(addrstr, "unix:", 5) == 0) {
3566 addr->type = SOCKET_ADDRESS_TYPE_UNIX;
3567 addr->u.q_unix.path = g_strdup(addrstr + 5);
3568
3569 if (websocket) {
3570 error_setg(errp, "UNIX sockets not supported with websock");
3571 goto cleanup;
3572 }
3573
3574 if (to) {
3575 error_setg(errp, "Port range not support with UNIX socket");
3576 goto cleanup;
3577 }
3578 ret = 0;
3579 } else {
3580 const char *port;
3581 size_t hostlen;
3582 unsigned long long baseport = 0;
3583 InetSocketAddress *inet;
3584
3585 port = strrchr(addrstr, ':');
3586 if (!port) {
3587 if (websocket) {
3588 hostlen = 0;
3589 port = addrstr;
3590 } else {
3591 error_setg(errp, "no vnc port specified");
3592 goto cleanup;
3593 }
3594 } else {
3595 hostlen = port - addrstr;
3596 port++;
3597 if (*port == '\0') {
3598 error_setg(errp, "vnc port cannot be empty");
3599 goto cleanup;
3600 }
3601 }
3602
3603 addr->type = SOCKET_ADDRESS_TYPE_INET;
3604 inet = &addr->u.inet;
3605 if (addrstr[0] == '[' && addrstr[hostlen - 1] == ']') {
3606 inet->host = g_strndup(addrstr + 1, hostlen - 2);
3607 } else {
3608 inet->host = g_strndup(addrstr, hostlen);
3609 }
3610 /* plain VNC port is just an offset, for websocket
3611 * port is absolute */
3612 if (websocket) {
3613 if (g_str_equal(addrstr, "") ||
3614 g_str_equal(addrstr, "on")) {
3615 if (displaynum == -1) {
3616 error_setg(errp, "explicit websocket port is required");
3617 goto cleanup;
3618 }
3619 inet->port = g_strdup_printf(
3620 "%d", displaynum + 5700);
3621 if (to) {
3622 inet->has_to = true;
3623 inet->to = to + 5700;
3624 }
3625 } else {
3626 inet->port = g_strdup(port);
3627 }
3628 } else {
3629 int offset = reverse ? 0 : 5900;
3630 if (parse_uint_full(port, &baseport, 10) < 0) {
3631 error_setg(errp, "can't convert to a number: %s", port);
3632 goto cleanup;
3633 }
3634 if (baseport > 65535 ||
3635 baseport + offset > 65535) {
3636 error_setg(errp, "port %s out of range", port);
3637 goto cleanup;
3638 }
3639 inet->port = g_strdup_printf(
3640 "%d", (int)baseport + offset);
3641
3642 if (to) {
3643 inet->has_to = true;
3644 inet->to = to + offset;
3645 }
3646 }
3647
3648 inet->ipv4 = ipv4;
3649 inet->has_ipv4 = has_ipv4;
3650 inet->ipv6 = ipv6;
3651 inet->has_ipv6 = has_ipv6;
3652
3653 ret = baseport;
3654 }
3655
3656 *retaddr = addr;
3657
3658 cleanup:
3659 if (ret < 0) {
3660 qapi_free_SocketAddress(addr);
3661 }
3662 return ret;
3663 }
3664
3665 static void vnc_free_addresses(SocketAddress ***retsaddr,
3666 size_t *retnsaddr)
3667 {
3668 size_t i;
3669
3670 for (i = 0; i < *retnsaddr; i++) {
3671 qapi_free_SocketAddress((*retsaddr)[i]);
3672 }
3673 g_free(*retsaddr);
3674
3675 *retsaddr = NULL;
3676 *retnsaddr = 0;
3677 }
3678
3679 static int vnc_display_get_addresses(QemuOpts *opts,
3680 bool reverse,
3681 SocketAddress ***retsaddr,
3682 size_t *retnsaddr,
3683 SocketAddress ***retwsaddr,
3684 size_t *retnwsaddr,
3685 Error **errp)
3686 {
3687 SocketAddress *saddr = NULL;
3688 SocketAddress *wsaddr = NULL;
3689 QemuOptsIter addriter;
3690 const char *addr;
3691 int to = qemu_opt_get_number(opts, "to", 0);
3692 bool has_ipv4 = qemu_opt_get(opts, "ipv4");
3693 bool has_ipv6 = qemu_opt_get(opts, "ipv6");
3694 bool ipv4 = qemu_opt_get_bool(opts, "ipv4", false);
3695 bool ipv6 = qemu_opt_get_bool(opts, "ipv6", false);
3696 int displaynum = -1;
3697 int ret = -1;
3698
3699 *retsaddr = NULL;
3700 *retnsaddr = 0;
3701 *retwsaddr = NULL;
3702 *retnwsaddr = 0;
3703
3704 addr = qemu_opt_get(opts, "vnc");
3705 if (addr == NULL || g_str_equal(addr, "none")) {
3706 ret = 0;
3707 goto cleanup;
3708 }
3709 if (qemu_opt_get(opts, "websocket") &&
3710 !qcrypto_hash_supports(QCRYPTO_HASH_ALG_SHA1)) {
3711 error_setg(errp,
3712 "SHA1 hash support is required for websockets");
3713 goto cleanup;
3714 }
3715
3716 qemu_opt_iter_init(&addriter, opts, "vnc");
3717 while ((addr = qemu_opt_iter_next(&addriter)) != NULL) {
3718 int rv;
3719 rv = vnc_display_get_address(addr, false, reverse, 0, to,
3720 has_ipv4, has_ipv6,
3721 ipv4, ipv6,
3722 &saddr, errp);
3723 if (rv < 0) {
3724 goto cleanup;
3725 }
3726 /* Historical compat - first listen address can be used
3727 * to set the default websocket port
3728 */
3729 if (displaynum == -1) {
3730 displaynum = rv;
3731 }
3732 *retsaddr = g_renew(SocketAddress *, *retsaddr, *retnsaddr + 1);
3733 (*retsaddr)[(*retnsaddr)++] = saddr;
3734 }
3735
3736 /* If we had multiple primary displays, we don't do defaults
3737 * for websocket, and require explicit config instead. */
3738 if (*retnsaddr > 1) {
3739 displaynum = -1;
3740 }
3741
3742 qemu_opt_iter_init(&addriter, opts, "websocket");
3743 while ((addr = qemu_opt_iter_next(&addriter)) != NULL) {
3744 if (vnc_display_get_address(addr, true, reverse, displaynum, to,
3745 has_ipv4, has_ipv6,
3746 ipv4, ipv6,
3747 &wsaddr, errp) < 0) {
3748 goto cleanup;
3749 }
3750
3751 /* Historical compat - if only a single listen address was
3752 * provided, then this is used to set the default listen
3753 * address for websocket too
3754 */
3755 if (*retnsaddr == 1 &&
3756 (*retsaddr)[0]->type == SOCKET_ADDRESS_TYPE_INET &&
3757 wsaddr->type == SOCKET_ADDRESS_TYPE_INET &&
3758 g_str_equal(wsaddr->u.inet.host, "") &&
3759 !g_str_equal((*retsaddr)[0]->u.inet.host, "")) {
3760 g_free(wsaddr->u.inet.host);
3761 wsaddr->u.inet.host = g_strdup((*retsaddr)[0]->u.inet.host);
3762 }
3763
3764 *retwsaddr = g_renew(SocketAddress *, *retwsaddr, *retnwsaddr + 1);
3765 (*retwsaddr)[(*retnwsaddr)++] = wsaddr;
3766 }
3767
3768 ret = 0;
3769 cleanup:
3770 if (ret < 0) {
3771 vnc_free_addresses(retsaddr, retnsaddr);
3772 vnc_free_addresses(retwsaddr, retnwsaddr);
3773 }
3774 return ret;
3775 }
3776
3777 static int vnc_display_connect(VncDisplay *vd,
3778 SocketAddress **saddr,
3779 size_t nsaddr,
3780 SocketAddress **wsaddr,
3781 size_t nwsaddr,
3782 Error **errp)
3783 {
3784 /* connect to viewer */
3785 QIOChannelSocket *sioc = NULL;
3786 if (nwsaddr != 0) {
3787 error_setg(errp, "Cannot use websockets in reverse mode");
3788 return -1;
3789 }
3790 if (nsaddr != 1) {
3791 error_setg(errp, "Expected a single address in reverse mode");
3792 return -1;
3793 }
3794 /* TODO SOCKET_ADDRESS_TYPE_FD when fd has AF_UNIX */
3795 vd->is_unix = saddr[0]->type == SOCKET_ADDRESS_TYPE_UNIX;
3796 sioc = qio_channel_socket_new();
3797 qio_channel_set_name(QIO_CHANNEL(sioc), "vnc-reverse");
3798 if (qio_channel_socket_connect_sync(sioc, saddr[0], errp) < 0) {
3799 return -1;
3800 }
3801 vnc_connect(vd, sioc, false, false);
3802 object_unref(OBJECT(sioc));
3803 return 0;
3804 }
3805
3806
3807 static int vnc_display_listen(VncDisplay *vd,
3808 SocketAddress **saddr,
3809 size_t nsaddr,
3810 SocketAddress **wsaddr,
3811 size_t nwsaddr,
3812 Error **errp)
3813 {
3814 size_t i;
3815
3816 if (nsaddr) {
3817 vd->listener = qio_net_listener_new();
3818 qio_net_listener_set_name(vd->listener, "vnc-listen");
3819 for (i = 0; i < nsaddr; i++) {
3820 if (qio_net_listener_open_sync(vd->listener,
3821 saddr[i],
3822 errp) < 0) {
3823 return -1;
3824 }
3825 }
3826
3827 qio_net_listener_set_client_func(vd->listener,
3828 vnc_listen_io, vd, NULL);
3829 }
3830
3831 if (nwsaddr) {
3832 vd->wslistener = qio_net_listener_new();
3833 qio_net_listener_set_name(vd->wslistener, "vnc-ws-listen");
3834 for (i = 0; i < nwsaddr; i++) {
3835 if (qio_net_listener_open_sync(vd->wslistener,
3836 wsaddr[i],
3837 errp) < 0) {
3838 return -1;
3839 }
3840 }
3841
3842 qio_net_listener_set_client_func(vd->wslistener,
3843 vnc_listen_io, vd, NULL);
3844 }
3845
3846 return 0;
3847 }
3848
3849
3850 void vnc_display_open(const char *id, Error **errp)
3851 {
3852 VncDisplay *vd = vnc_display_find(id);
3853 QemuOpts *opts = qemu_opts_find(&qemu_vnc_opts, id);
3854 SocketAddress **saddr = NULL, **wsaddr = NULL;
3855 size_t nsaddr, nwsaddr;
3856 const char *share, *device_id;
3857 QemuConsole *con;
3858 bool password = false;
3859 bool reverse = false;
3860 const char *credid;
3861 bool sasl = false;
3862 #ifdef CONFIG_VNC_SASL
3863 int saslErr;
3864 #endif
3865 int acl = 0;
3866 int lock_key_sync = 1;
3867 int key_delay_ms;
3868
3869 if (!vd) {
3870 error_setg(errp, "VNC display not active");
3871 return;
3872 }
3873 vnc_display_close(vd);
3874
3875 if (!opts) {
3876 return;
3877 }
3878
3879 reverse = qemu_opt_get_bool(opts, "reverse", false);
3880 if (vnc_display_get_addresses(opts, reverse, &saddr, &nsaddr,
3881 &wsaddr, &nwsaddr, errp) < 0) {
3882 goto fail;
3883 }
3884
3885 password = qemu_opt_get_bool(opts, "password", false);
3886 if (password) {
3887 if (fips_get_state()) {
3888 error_setg(errp,
3889 "VNC password auth disabled due to FIPS mode, "
3890 "consider using the VeNCrypt or SASL authentication "
3891 "methods as an alternative");
3892 goto fail;
3893 }
3894 if (!qcrypto_cipher_supports(
3895 QCRYPTO_CIPHER_ALG_DES_RFB, QCRYPTO_CIPHER_MODE_ECB)) {
3896 error_setg(errp,
3897 "Cipher backend does not support DES RFB algorithm");
3898 goto fail;
3899 }
3900 }
3901
3902 lock_key_sync = qemu_opt_get_bool(opts, "lock-key-sync", true);
3903 key_delay_ms = qemu_opt_get_number(opts, "key-delay-ms", 10);
3904 sasl = qemu_opt_get_bool(opts, "sasl", false);
3905 #ifndef CONFIG_VNC_SASL
3906 if (sasl) {
3907 error_setg(errp, "VNC SASL auth requires cyrus-sasl support");
3908 goto fail;
3909 }
3910 #endif /* CONFIG_VNC_SASL */
3911 credid = qemu_opt_get(opts, "tls-creds");
3912 if (credid) {
3913 Object *creds;
3914 if (qemu_opt_get(opts, "tls") ||
3915 qemu_opt_get(opts, "x509") ||
3916 qemu_opt_get(opts, "x509verify")) {
3917 error_setg(errp,
3918 "'tls-creds' parameter is mutually exclusive with "
3919 "'tls', 'x509' and 'x509verify' parameters");
3920 goto fail;
3921 }
3922
3923 creds = object_resolve_path_component(
3924 object_get_objects_root(), credid);
3925 if (!creds) {
3926 error_setg(errp, "No TLS credentials with id '%s'",
3927 credid);
3928 goto fail;
3929 }
3930 vd->tlscreds = (QCryptoTLSCreds *)
3931 object_dynamic_cast(creds,
3932 TYPE_QCRYPTO_TLS_CREDS);
3933 if (!vd->tlscreds) {
3934 error_setg(errp, "Object with id '%s' is not TLS credentials",
3935 credid);
3936 goto fail;
3937 }
3938 object_ref(OBJECT(vd->tlscreds));
3939
3940 if (vd->tlscreds->endpoint != QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
3941 error_setg(errp,
3942 "Expecting TLS credentials with a server endpoint");
3943 goto fail;
3944 }
3945 } else {
3946 const char *path;
3947 bool tls = false, x509 = false, x509verify = false;
3948 tls = qemu_opt_get_bool(opts, "tls", false);
3949 if (tls) {
3950 path = qemu_opt_get(opts, "x509");
3951
3952 if (path) {
3953 x509 = true;
3954 } else {
3955 path = qemu_opt_get(opts, "x509verify");
3956 if (path) {
3957 x509 = true;
3958 x509verify = true;
3959 }
3960 }
3961 vd->tlscreds = vnc_display_create_creds(x509,
3962 x509verify,
3963 path,
3964 vd->id,
3965 errp);
3966 if (!vd->tlscreds) {
3967 goto fail;
3968 }
3969 }
3970 }
3971 acl = qemu_opt_get_bool(opts, "acl", false);
3972
3973 share = qemu_opt_get(opts, "share");
3974 if (share) {
3975 if (strcmp(share, "ignore") == 0) {
3976 vd->share_policy = VNC_SHARE_POLICY_IGNORE;
3977 } else if (strcmp(share, "allow-exclusive") == 0) {
3978 vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
3979 } else if (strcmp(share, "force-shared") == 0) {
3980 vd->share_policy = VNC_SHARE_POLICY_FORCE_SHARED;
3981 } else {
3982 error_setg(errp, "unknown vnc share= option");
3983 goto fail;
3984 }
3985 } else {
3986 vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE;
3987 }
3988 vd->connections_limit = qemu_opt_get_number(opts, "connections", 32);
3989
3990 #ifdef CONFIG_VNC_JPEG
3991 vd->lossy = qemu_opt_get_bool(opts, "lossy", false);
3992 #endif
3993 vd->non_adaptive = qemu_opt_get_bool(opts, "non-adaptive", false);
3994 /* adaptive updates are only used with tight encoding and
3995 * if lossy updates are enabled so we can disable all the
3996 * calculations otherwise */
3997 if (!vd->lossy) {
3998 vd->non_adaptive = true;
3999 }
4000
4001 if (acl) {
4002 if (strcmp(vd->id, "default") == 0) {
4003 vd->tlsaclname = g_strdup("vnc.x509dname");
4004 } else {
4005 vd->tlsaclname = g_strdup_printf("vnc.%s.x509dname", vd->id);
4006 }
4007 qemu_acl_init(vd->tlsaclname);
4008 }
4009 #ifdef CONFIG_VNC_SASL
4010 if (acl && sasl) {
4011 char *aclname;
4012
4013 if (strcmp(vd->id, "default") == 0) {
4014 aclname = g_strdup("vnc.username");
4015 } else {
4016 aclname = g_strdup_printf("vnc.%s.username", vd->id);
4017 }
4018 vd->sasl.acl = qemu_acl_init(aclname);
4019 g_free(aclname);
4020 }
4021 #endif
4022
4023 if (vnc_display_setup_auth(&vd->auth, &vd->subauth,
4024 vd->tlscreds, password,
4025 sasl, false, errp) < 0) {
4026 goto fail;
4027 }
4028 trace_vnc_auth_init(vd, 0, vd->auth, vd->subauth);
4029
4030 if (vnc_display_setup_auth(&vd->ws_auth, &vd->ws_subauth,
4031 vd->tlscreds, password,
4032 sasl, true, errp) < 0) {
4033 goto fail;
4034 }
4035 trace_vnc_auth_init(vd, 1, vd->ws_auth, vd->ws_subauth);
4036
4037 #ifdef CONFIG_VNC_SASL
4038 if ((saslErr = sasl_server_init(NULL, "qemu")) != SASL_OK) {
4039 error_setg(errp, "Failed to initialize SASL auth: %s",
4040 sasl_errstring(saslErr, NULL, NULL));
4041 goto fail;
4042 }
4043 #endif
4044 vd->lock_key_sync = lock_key_sync;
4045 if (lock_key_sync) {
4046 vd->led = qemu_add_led_event_handler(kbd_leds, vd);
4047 }
4048 vd->ledstate = 0;
4049 vd->key_delay_ms = key_delay_ms;
4050
4051 device_id = qemu_opt_get(opts, "display");
4052 if (device_id) {
4053 int head = qemu_opt_get_number(opts, "head", 0);
4054 Error *err = NULL;
4055
4056 con = qemu_console_lookup_by_device_name(device_id, head, &err);
4057 if (err) {
4058 error_propagate(errp, err);
4059 goto fail;
4060 }
4061 } else {
4062 con = NULL;
4063 }
4064
4065 if (con != vd->dcl.con) {
4066 unregister_displaychangelistener(&vd->dcl);
4067 vd->dcl.con = con;
4068 register_displaychangelistener(&vd->dcl);
4069 }
4070
4071 if (saddr == NULL) {
4072 goto cleanup;
4073 }
4074
4075 if (reverse) {
4076 if (vnc_display_connect(vd, saddr, nsaddr, wsaddr, nwsaddr, errp) < 0) {
4077 goto fail;
4078 }
4079 } else {
4080 if (vnc_display_listen(vd, saddr, nsaddr, wsaddr, nwsaddr, errp) < 0) {
4081 goto fail;
4082 }
4083 }
4084
4085 if (qemu_opt_get(opts, "to")) {
4086 vnc_display_print_local_addr(vd);
4087 }
4088
4089 cleanup:
4090 vnc_free_addresses(&saddr, &nsaddr);
4091 vnc_free_addresses(&wsaddr, &nwsaddr);
4092 return;
4093
4094 fail:
4095 vnc_display_close(vd);
4096 goto cleanup;
4097 }
4098
4099 void vnc_display_add_client(const char *id, int csock, bool skipauth)
4100 {
4101 VncDisplay *vd = vnc_display_find(id);
4102 QIOChannelSocket *sioc;
4103
4104 if (!vd) {
4105 return;
4106 }
4107
4108 sioc = qio_channel_socket_new_fd(csock, NULL);
4109 if (sioc) {
4110 qio_channel_set_name(QIO_CHANNEL(sioc), "vnc-server");
4111 vnc_connect(vd, sioc, skipauth, false);
4112 object_unref(OBJECT(sioc));
4113 }
4114 }
4115
4116 static void vnc_auto_assign_id(QemuOptsList *olist, QemuOpts *opts)
4117 {
4118 int i = 2;
4119 char *id;
4120
4121 id = g_strdup("default");
4122 while (qemu_opts_find(olist, id)) {
4123 g_free(id);
4124 id = g_strdup_printf("vnc%d", i++);
4125 }
4126 qemu_opts_set_id(opts, id);
4127 }
4128
4129 QemuOpts *vnc_parse(const char *str, Error **errp)
4130 {
4131 QemuOptsList *olist = qemu_find_opts("vnc");
4132 QemuOpts *opts = qemu_opts_parse(olist, str, true, errp);
4133 const char *id;
4134
4135 if (!opts) {
4136 return NULL;
4137 }
4138
4139 id = qemu_opts_id(opts);
4140 if (!id) {
4141 /* auto-assign id if not present */
4142 vnc_auto_assign_id(olist, opts);
4143 }
4144 return opts;
4145 }
4146
4147 int vnc_init_func(void *opaque, QemuOpts *opts, Error **errp)
4148 {
4149 Error *local_err = NULL;
4150 char *id = (char *)qemu_opts_id(opts);
4151
4152 assert(id);
4153 vnc_display_init(id);
4154 vnc_display_open(id, &local_err);
4155 if (local_err != NULL) {
4156 error_reportf_err(local_err, "Failed to start VNC server: ");
4157 exit(1);
4158 }
4159 return 0;
4160 }
4161
4162 static void vnc_register_config(void)
4163 {
4164 qemu_add_opts(&qemu_vnc_opts);
4165 }
4166 opts_init(vnc_register_config);
QEMU mirror