]> git.proxmox.com Git - qemu.git/blob - vnc.c
projects / qemu.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
vnc: rework VncState release workflow.
[qemu.git] / vnc.c
1 /*
2 * QEMU VNC display driver
3 *
4 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5 * Copyright (C) 2006 Fabrice Bellard
6 * Copyright (C) 2009 Red Hat, Inc
7 *
8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to deal
10 * in the Software without restriction, including without limitation the rights
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12 * copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
14 *
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
17 *
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24 * THE SOFTWARE.
25 */
26
27 #include "vnc.h"
28 #include "sysemu.h"
29 #include "qemu_socket.h"
30 #include "qemu-timer.h"
31 #include "acl.h"
32
33 #define VNC_REFRESH_INTERVAL (1000 / 30)
34
35 #include "vnc_keysym.h"
36 #include "d3des.h"
37
38 #define count_bits(c, v) { \
39 for (c = 0; v; v >>= 1) \
40 { \
41 c += v & 1; \
42 } \
43 }
44
45
46 static VncDisplay *vnc_display; /* needed for info vnc */
47 static DisplayChangeListener *dcl;
48
49 static char *addr_to_string(const char *format,
50 struct sockaddr_storage *sa,
51 socklen_t salen) {
52 char *addr;
53 char host[NI_MAXHOST];
54 char serv[NI_MAXSERV];
55 int err;
56 size_t addrlen;
57
58 if ((err = getnameinfo((struct sockaddr *)sa, salen,
59 host, sizeof(host),
60 serv, sizeof(serv),
61 NI_NUMERICHOST | NI_NUMERICSERV)) != 0) {
62 VNC_DEBUG("Cannot resolve address %d: %s\n",
63 err, gai_strerror(err));
64 return NULL;
65 }
66
67 /* Enough for the existing format + the 2 vars we're
68 * substituting in. */
69 addrlen = strlen(format) + strlen(host) + strlen(serv);
70 addr = qemu_malloc(addrlen + 1);
71 snprintf(addr, addrlen, format, host, serv);
72 addr[addrlen] = '\0';
73
74 return addr;
75 }
76
77
78 char *vnc_socket_local_addr(const char *format, int fd) {
79 struct sockaddr_storage sa;
80 socklen_t salen;
81
82 salen = sizeof(sa);
83 if (getsockname(fd, (struct sockaddr*)&sa, &salen) < 0)
84 return NULL;
85
86 return addr_to_string(format, &sa, salen);
87 }
88
89 char *vnc_socket_remote_addr(const char *format, int fd) {
90 struct sockaddr_storage sa;
91 socklen_t salen;
92
93 salen = sizeof(sa);
94 if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0)
95 return NULL;
96
97 return addr_to_string(format, &sa, salen);
98 }
99
100 static const char *vnc_auth_name(VncDisplay *vd) {
101 switch (vd->auth) {
102 case VNC_AUTH_INVALID:
103 return "invalid";
104 case VNC_AUTH_NONE:
105 return "none";
106 case VNC_AUTH_VNC:
107 return "vnc";
108 case VNC_AUTH_RA2:
109 return "ra2";
110 case VNC_AUTH_RA2NE:
111 return "ra2ne";
112 case VNC_AUTH_TIGHT:
113 return "tight";
114 case VNC_AUTH_ULTRA:
115 return "ultra";
116 case VNC_AUTH_TLS:
117 return "tls";
118 case VNC_AUTH_VENCRYPT:
119 #ifdef CONFIG_VNC_TLS
120 switch (vd->subauth) {
121 case VNC_AUTH_VENCRYPT_PLAIN:
122 return "vencrypt+plain";
123 case VNC_AUTH_VENCRYPT_TLSNONE:
124 return "vencrypt+tls+none";
125 case VNC_AUTH_VENCRYPT_TLSVNC:
126 return "vencrypt+tls+vnc";
127 case VNC_AUTH_VENCRYPT_TLSPLAIN:
128 return "vencrypt+tls+plain";
129 case VNC_AUTH_VENCRYPT_X509NONE:
130 return "vencrypt+x509+none";
131 case VNC_AUTH_VENCRYPT_X509VNC:
132 return "vencrypt+x509+vnc";
133 case VNC_AUTH_VENCRYPT_X509PLAIN:
134 return "vencrypt+x509+plain";
135 case VNC_AUTH_VENCRYPT_TLSSASL:
136 return "vencrypt+tls+sasl";
137 case VNC_AUTH_VENCRYPT_X509SASL:
138 return "vencrypt+x509+sasl";
139 default:
140 return "vencrypt";
141 }
142 #else
143 return "vencrypt";
144 #endif
145 case VNC_AUTH_SASL:
146 return "sasl";
147 }
148 return "unknown";
149 }
150
151 static void do_info_vnc_client(Monitor *mon, VncState *client)
152 {
153 char *clientAddr =
154 vnc_socket_remote_addr(" address: %s:%s\n",
155 client->csock);
156 if (!clientAddr)
157 return;
158
159 monitor_printf(mon, "Client:\n");
160 monitor_printf(mon, "%s", clientAddr);
161 free(clientAddr);
162
163 #ifdef CONFIG_VNC_TLS
164 if (client->tls.session &&
165 client->tls.dname)
166 monitor_printf(mon, " x509 dname: %s\n", client->tls.dname);
167 else
168 monitor_printf(mon, " x509 dname: none\n");
169 #endif
170 #ifdef CONFIG_VNC_SASL
171 if (client->sasl.conn &&
172 client->sasl.username)
173 monitor_printf(mon, " username: %s\n", client->sasl.username);
174 else
175 monitor_printf(mon, " username: none\n");
176 #endif
177 }
178
179 void do_info_vnc(Monitor *mon)
180 {
181 if (vnc_display == NULL || vnc_display->display == NULL) {
182 monitor_printf(mon, "Server: disabled\n");
183 } else {
184 char *serverAddr = vnc_socket_local_addr(" address: %s:%s\n",
185 vnc_display->lsock);
186
187 if (!serverAddr)
188 return;
189
190 monitor_printf(mon, "Server:\n");
191 monitor_printf(mon, "%s", serverAddr);
192 free(serverAddr);
193 monitor_printf(mon, " auth: %s\n", vnc_auth_name(vnc_display));
194
195 if (vnc_display->clients) {
196 VncState *client = vnc_display->clients;
197 while (client) {
198 do_info_vnc_client(mon, client);
199 client = client->next;
200 }
201 } else {
202 monitor_printf(mon, "Client: none\n");
203 }
204 }
205 }
206
207 static inline uint32_t vnc_has_feature(VncState *vs, int feature) {
208 return (vs->features & (1 << feature));
209 }
210
211 /* TODO
212 1) Get the queue working for IO.
213 2) there is some weirdness when using the -S option (the screen is grey
214 and not totally invalidated
215 3) resolutions > 1024
216 */
217
218 static void vnc_update_client(void *opaque);
219 static void vnc_disconnect_start(VncState *vs);
220 static void vnc_disconnect_finish(VncState *vs);
221
222 static void vnc_colordepth(VncState *vs);
223
224 static inline void vnc_set_bit(uint32_t *d, int k)
225 {
226 d[k >> 5] |= 1 << (k & 0x1f);
227 }
228
229 static inline void vnc_clear_bit(uint32_t *d, int k)
230 {
231 d[k >> 5] &= ~(1 << (k & 0x1f));
232 }
233
234 static inline void vnc_set_bits(uint32_t *d, int n, int nb_words)
235 {
236 int j;
237
238 j = 0;
239 while (n >= 32) {
240 d[j++] = -1;
241 n -= 32;
242 }
243 if (n > 0)
244 d[j++] = (1 << n) - 1;
245 while (j < nb_words)
246 d[j++] = 0;
247 }
248
249 static inline int vnc_get_bit(const uint32_t *d, int k)
250 {
251 return (d[k >> 5] >> (k & 0x1f)) & 1;
252 }
253
254 static inline int vnc_and_bits(const uint32_t *d1, const uint32_t *d2,
255 int nb_words)
256 {
257 int i;
258 for(i = 0; i < nb_words; i++) {
259 if ((d1[i] & d2[i]) != 0)
260 return 1;
261 }
262 return 0;
263 }
264
265 static void vnc_update(VncState *vs, int x, int y, int w, int h)
266 {
267 struct VncSurface *s = &vs->guest;
268 int i;
269
270 h += y;
271
272 /* round x down to ensure the loop only spans one 16-pixel block per,
273 iteration. otherwise, if (x % 16) != 0, the last iteration may span
274 two 16-pixel blocks but we only mark the first as dirty
275 */
276 w += (x % 16);
277 x -= (x % 16);
278
279 x = MIN(x, s->ds->width);
280 y = MIN(y, s->ds->height);
281 w = MIN(x + w, s->ds->width) - x;
282 h = MIN(h, s->ds->height);
283
284 for (; y < h; y++)
285 for (i = 0; i < w; i += 16)
286 vnc_set_bit(s->dirty[y], (x + i) / 16);
287 }
288
289 static void vnc_dpy_update(DisplayState *ds, int x, int y, int w, int h)
290 {
291 VncDisplay *vd = ds->opaque;
292 VncState *vs = vd->clients;
293 while (vs != NULL) {
294 vnc_update(vs, x, y, w, h);
295 vs = vs->next;
296 }
297 }
298
299 static void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
300 int32_t encoding)
301 {
302 vnc_write_u16(vs, x);
303 vnc_write_u16(vs, y);
304 vnc_write_u16(vs, w);
305 vnc_write_u16(vs, h);
306
307 vnc_write_s32(vs, encoding);
308 }
309
310 void buffer_reserve(Buffer *buffer, size_t len)
311 {
312 if ((buffer->capacity - buffer->offset) < len) {
313 buffer->capacity += (len + 1024);
314 buffer->buffer = qemu_realloc(buffer->buffer, buffer->capacity);
315 if (buffer->buffer == NULL) {
316 fprintf(stderr, "vnc: out of memory\n");
317 exit(1);
318 }
319 }
320 }
321
322 int buffer_empty(Buffer *buffer)
323 {
324 return buffer->offset == 0;
325 }
326
327 uint8_t *buffer_end(Buffer *buffer)
328 {
329 return buffer->buffer + buffer->offset;
330 }
331
332 void buffer_reset(Buffer *buffer)
333 {
334 buffer->offset = 0;
335 }
336
337 void buffer_append(Buffer *buffer, const void *data, size_t len)
338 {
339 memcpy(buffer->buffer + buffer->offset, data, len);
340 buffer->offset += len;
341 }
342
343 static void vnc_resize(VncState *vs)
344 {
345 DisplayState *ds = vs->ds;
346 int size_changed;
347
348 /* guest surface */
349 if (!vs->guest.ds)
350 vs->guest.ds = qemu_mallocz(sizeof(*vs->guest.ds));
351 if (ds_get_bytes_per_pixel(ds) != vs->guest.ds->pf.bytes_per_pixel)
352 console_color_init(ds);
353 vnc_colordepth(vs);
354 size_changed = ds_get_width(ds) != vs->guest.ds->width ||
355 ds_get_height(ds) != vs->guest.ds->height;
356 *(vs->guest.ds) = *(ds->surface);
357 if (size_changed) {
358 if (vs->csock != -1 && vnc_has_feature(vs, VNC_FEATURE_RESIZE)) {
359 vnc_write_u8(vs, 0); /* msg id */
360 vnc_write_u8(vs, 0);
361 vnc_write_u16(vs, 1); /* number of rects */
362 vnc_framebuffer_update(vs, 0, 0, ds_get_width(ds), ds_get_height(ds),
363 VNC_ENCODING_DESKTOPRESIZE);
364 vnc_flush(vs);
365 }
366 }
367 memset(vs->guest.dirty, 0xFF, sizeof(vs->guest.dirty));
368
369 /* server surface */
370 if (!vs->server.ds)
371 vs->server.ds = qemu_mallocz(sizeof(*vs->server.ds));
372 if (vs->server.ds->data)
373 qemu_free(vs->server.ds->data);
374 *(vs->server.ds) = *(ds->surface);
375 vs->server.ds->data = qemu_mallocz(vs->server.ds->linesize *
376 vs->server.ds->height);
377 memset(vs->server.dirty, 0xFF, sizeof(vs->guest.dirty));
378 }
379
380 static void vnc_dpy_resize(DisplayState *ds)
381 {
382 VncDisplay *vd = ds->opaque;
383 VncState *vs = vd->clients;
384 while (vs != NULL) {
385 vnc_resize(vs);
386 vs = vs->next;
387 }
388 }
389
390 /* fastest code */
391 static void vnc_write_pixels_copy(VncState *vs, void *pixels, int size)
392 {
393 vnc_write(vs, pixels, size);
394 }
395
396 /* slowest but generic code. */
397 static void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
398 {
399 uint8_t r, g, b;
400
401 r = ((((v & vs->server.ds->pf.rmask) >> vs->server.ds->pf.rshift) << vs->clientds.pf.rbits) >>
402 vs->server.ds->pf.rbits);
403 g = ((((v & vs->server.ds->pf.gmask) >> vs->server.ds->pf.gshift) << vs->clientds.pf.gbits) >>
404 vs->server.ds->pf.gbits);
405 b = ((((v & vs->server.ds->pf.bmask) >> vs->server.ds->pf.bshift) << vs->clientds.pf.bbits) >>
406 vs->server.ds->pf.bbits);
407 v = (r << vs->clientds.pf.rshift) |
408 (g << vs->clientds.pf.gshift) |
409 (b << vs->clientds.pf.bshift);
410 switch(vs->clientds.pf.bytes_per_pixel) {
411 case 1:
412 buf[0] = v;
413 break;
414 case 2:
415 if (vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) {
416 buf[0] = v >> 8;
417 buf[1] = v;
418 } else {
419 buf[1] = v >> 8;
420 buf[0] = v;
421 }
422 break;
423 default:
424 case 4:
425 if (vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) {
426 buf[0] = v >> 24;
427 buf[1] = v >> 16;
428 buf[2] = v >> 8;
429 buf[3] = v;
430 } else {
431 buf[3] = v >> 24;
432 buf[2] = v >> 16;
433 buf[1] = v >> 8;
434 buf[0] = v;
435 }
436 break;
437 }
438 }
439
440 static void vnc_write_pixels_generic(VncState *vs, void *pixels1, int size)
441 {
442 uint8_t buf[4];
443
444 if (vs->server.ds->pf.bytes_per_pixel == 4) {
445 uint32_t *pixels = pixels1;
446 int n, i;
447 n = size >> 2;
448 for(i = 0; i < n; i++) {
449 vnc_convert_pixel(vs, buf, pixels[i]);
450 vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
451 }
452 } else if (vs->server.ds->pf.bytes_per_pixel == 2) {
453 uint16_t *pixels = pixels1;
454 int n, i;
455 n = size >> 1;
456 for(i = 0; i < n; i++) {
457 vnc_convert_pixel(vs, buf, pixels[i]);
458 vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
459 }
460 } else if (vs->server.ds->pf.bytes_per_pixel == 1) {
461 uint8_t *pixels = pixels1;
462 int n, i;
463 n = size;
464 for(i = 0; i < n; i++) {
465 vnc_convert_pixel(vs, buf, pixels[i]);
466 vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
467 }
468 } else {
469 fprintf(stderr, "vnc_write_pixels_generic: VncState color depth not supported\n");
470 }
471 }
472
473 static void send_framebuffer_update_raw(VncState *vs, int x, int y, int w, int h)
474 {
475 int i;
476 uint8_t *row;
477
478 row = vs->server.ds->data + y * ds_get_linesize(vs->ds) + x * ds_get_bytes_per_pixel(vs->ds);
479 for (i = 0; i < h; i++) {
480 vs->write_pixels(vs, row, w * ds_get_bytes_per_pixel(vs->ds));
481 row += ds_get_linesize(vs->ds);
482 }
483 }
484
485 static void hextile_enc_cord(uint8_t *ptr, int x, int y, int w, int h)
486 {
487 ptr[0] = ((x & 0x0F) << 4) | (y & 0x0F);
488 ptr[1] = (((w - 1) & 0x0F) << 4) | ((h - 1) & 0x0F);
489 }
490
491 #define BPP 8
492 #include "vnchextile.h"
493 #undef BPP
494
495 #define BPP 16
496 #include "vnchextile.h"
497 #undef BPP
498
499 #define BPP 32
500 #include "vnchextile.h"
501 #undef BPP
502
503 #define GENERIC
504 #define BPP 8
505 #include "vnchextile.h"
506 #undef BPP
507 #undef GENERIC
508
509 #define GENERIC
510 #define BPP 16
511 #include "vnchextile.h"
512 #undef BPP
513 #undef GENERIC
514
515 #define GENERIC
516 #define BPP 32
517 #include "vnchextile.h"
518 #undef BPP
519 #undef GENERIC
520
521 static void send_framebuffer_update_hextile(VncState *vs, int x, int y, int w, int h)
522 {
523 int i, j;
524 int has_fg, has_bg;
525 uint8_t *last_fg, *last_bg;
526
527 last_fg = (uint8_t *) qemu_malloc(vs->server.ds->pf.bytes_per_pixel);
528 last_bg = (uint8_t *) qemu_malloc(vs->server.ds->pf.bytes_per_pixel);
529 has_fg = has_bg = 0;
530 for (j = y; j < (y + h); j += 16) {
531 for (i = x; i < (x + w); i += 16) {
532 vs->send_hextile_tile(vs, i, j,
533 MIN(16, x + w - i), MIN(16, y + h - j),
534 last_bg, last_fg, &has_bg, &has_fg);
535 }
536 }
537 free(last_fg);
538 free(last_bg);
539
540 }
541
542 static void vnc_zlib_init(VncState *vs)
543 {
544 int i;
545 for (i=0; i<(sizeof(vs->zlib_stream) / sizeof(z_stream)); i++)
546 vs->zlib_stream[i].opaque = NULL;
547 }
548
549 static void vnc_zlib_start(VncState *vs)
550 {
551 buffer_reset(&vs->zlib);
552
553 // make the output buffer be the zlib buffer, so we can compress it later
554 vs->zlib_tmp = vs->output;
555 vs->output = vs->zlib;
556 }
557
558 static int vnc_zlib_stop(VncState *vs, int stream_id)
559 {
560 z_streamp zstream = &vs->zlib_stream[stream_id];
561 int previous_out;
562
563 // switch back to normal output/zlib buffers
564 vs->zlib = vs->output;
565 vs->output = vs->zlib_tmp;
566
567 // compress the zlib buffer
568
569 // initialize the stream
570 // XXX need one stream per session
571 if (zstream->opaque != vs) {
572 int err;
573
574 VNC_DEBUG("VNC: initializing zlib stream %d\n", stream_id);
575 VNC_DEBUG("VNC: opaque = %p | vs = %p\n", zstream->opaque, vs);
576 zstream->zalloc = Z_NULL;
577 zstream->zfree = Z_NULL;
578
579 err = deflateInit2(zstream, vs->tight_compression, Z_DEFLATED, MAX_WBITS,
580 MAX_MEM_LEVEL, Z_DEFAULT_STRATEGY);
581
582 if (err != Z_OK) {
583 fprintf(stderr, "VNC: error initializing zlib\n");
584 return -1;
585 }
586
587 zstream->opaque = vs;
588 }
589
590 // XXX what to do if tight_compression changed in between?
591
592 // reserve memory in output buffer
593 buffer_reserve(&vs->output, vs->zlib.offset + 64);
594
595 // set pointers
596 zstream->next_in = vs->zlib.buffer;
597 zstream->avail_in = vs->zlib.offset;
598 zstream->next_out = vs->output.buffer + vs->output.offset;
599 zstream->avail_out = vs->output.capacity - vs->output.offset;
600 zstream->data_type = Z_BINARY;
601 previous_out = zstream->total_out;
602
603 // start encoding
604 if (deflate(zstream, Z_SYNC_FLUSH) != Z_OK) {
605 fprintf(stderr, "VNC: error during zlib compression\n");
606 return -1;
607 }
608
609 vs->output.offset = vs->output.capacity - zstream->avail_out;
610 return zstream->total_out - previous_out;
611 }
612
613 static void send_framebuffer_update_zlib(VncState *vs, int x, int y, int w, int h)
614 {
615 int old_offset, new_offset, bytes_written;
616
617 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_ZLIB);
618
619 // remember where we put in the follow-up size
620 old_offset = vs->output.offset;
621 vnc_write_s32(vs, 0);
622
623 // compress the stream
624 vnc_zlib_start(vs);
625 send_framebuffer_update_raw(vs, x, y, w, h);
626 bytes_written = vnc_zlib_stop(vs, 0);
627
628 if (bytes_written == -1)
629 return;
630
631 // hack in the size
632 new_offset = vs->output.offset;
633 vs->output.offset = old_offset;
634 vnc_write_u32(vs, bytes_written);
635 vs->output.offset = new_offset;
636 }
637
638 static void send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
639 {
640 switch(vs->vnc_encoding) {
641 case VNC_ENCODING_ZLIB:
642 send_framebuffer_update_zlib(vs, x, y, w, h);
643 break;
644 case VNC_ENCODING_HEXTILE:
645 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE);
646 send_framebuffer_update_hextile(vs, x, y, w, h);
647 break;
648 default:
649 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW);
650 send_framebuffer_update_raw(vs, x, y, w, h);
651 break;
652 }
653 }
654
655 static void vnc_copy(VncState *vs, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
656 {
657 vnc_write_u8(vs, 0); /* msg id */
658 vnc_write_u8(vs, 0);
659 vnc_write_u16(vs, 1); /* number of rects */
660 vnc_framebuffer_update(vs, dst_x, dst_y, w, h, VNC_ENCODING_COPYRECT);
661 vnc_write_u16(vs, src_x);
662 vnc_write_u16(vs, src_y);
663 vnc_flush(vs);
664 }
665
666 static void vnc_dpy_copy(DisplayState *ds, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
667 {
668 VncDisplay *vd = ds->opaque;
669 VncState *vs, *vn;
670
671 for (vs = vd->clients; vs != NULL; vs = vn) {
672 vn = vs->next;
673 if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
674 vs->force_update = 1;
675 vnc_update_client(vs);
676 /* vs might be free()ed here */
677 }
678 }
679
680 for (vs = vd->clients; vs != NULL; vs = vs->next) {
681 if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT))
682 vnc_copy(vs, src_x, src_y, dst_x, dst_y, w, h);
683 else /* TODO */
684 vnc_update(vs, dst_x, dst_y, w, h);
685 }
686 }
687
688 static int find_and_clear_dirty_height(struct VncSurface *s,
689 int y, int last_x, int x)
690 {
691 int h;
692
693 for (h = 1; h < (s->ds->height - y); h++) {
694 int tmp_x;
695 if (!vnc_get_bit(s->dirty[y + h], last_x))
696 break;
697 for (tmp_x = last_x; tmp_x < x; tmp_x++)
698 vnc_clear_bit(s->dirty[y + h], tmp_x);
699 }
700
701 return h;
702 }
703
704 static void vnc_update_client(void *opaque)
705 {
706 VncState *vs = opaque;
707 if (vs->need_update && vs->csock != -1) {
708 int y;
709 uint8_t *guest_row;
710 uint8_t *server_row;
711 int cmp_bytes;
712 uint32_t width_mask[VNC_DIRTY_WORDS];
713 int n_rectangles;
714 int saved_offset;
715 int has_dirty = 0;
716
717 if (vs->output.offset && !vs->audio_cap && !vs->force_update) {
718 /* kernel send buffers are full -> drop frames to throttle */
719 qemu_mod_timer(vs->timer, qemu_get_clock(rt_clock) + VNC_REFRESH_INTERVAL);
720 return;
721 }
722
723 vga_hw_update();
724
725 /*
726 * Walk through the guest dirty map.
727 * Check and copy modified bits from guest to server surface.
728 * Update server dirty map.
729 */
730 vnc_set_bits(width_mask, (ds_get_width(vs->ds) / 16), VNC_DIRTY_WORDS);
731 cmp_bytes = 16 * ds_get_bytes_per_pixel(vs->ds);
732 guest_row = vs->guest.ds->data;
733 server_row = vs->server.ds->data;
734 for (y = 0; y < vs->guest.ds->height; y++) {
735 if (vnc_and_bits(vs->guest.dirty[y], width_mask, VNC_DIRTY_WORDS)) {
736 int x;
737 uint8_t *guest_ptr;
738 uint8_t *server_ptr;
739
740 guest_ptr = guest_row;
741 server_ptr = server_row;
742
743 for (x = 0; x < vs->guest.ds->width;
744 x += 16, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) {
745 if (!vnc_get_bit(vs->guest.dirty[y], (x / 16)))
746 continue;
747 vnc_clear_bit(vs->guest.dirty[y], (x / 16));
748 if (memcmp(server_ptr, guest_ptr, cmp_bytes) == 0)
749 continue;
750 memcpy(server_ptr, guest_ptr, cmp_bytes);
751 vnc_set_bit(vs->server.dirty[y], (x / 16));
752 has_dirty++;
753 }
754 }
755 guest_row += ds_get_linesize(vs->ds);
756 server_row += ds_get_linesize(vs->ds);
757 }
758
759 if (!has_dirty && !vs->audio_cap && !vs->force_update) {
760 qemu_mod_timer(vs->timer, qemu_get_clock(rt_clock) + VNC_REFRESH_INTERVAL);
761 return;
762 }
763
764 /*
765 * Send screen updates to the vnc client using the server
766 * surface and server dirty map. guest surface updates
767 * happening in parallel don't disturb us, the next pass will
768 * send them to the client.
769 */
770 n_rectangles = 0;
771 vnc_write_u8(vs, 0); /* msg id */
772 vnc_write_u8(vs, 0);
773 saved_offset = vs->output.offset;
774 vnc_write_u16(vs, 0);
775
776 for (y = 0; y < vs->server.ds->height; y++) {
777 int x;
778 int last_x = -1;
779 for (x = 0; x < vs->server.ds->width / 16; x++) {
780 if (vnc_get_bit(vs->server.dirty[y], x)) {
781 if (last_x == -1) {
782 last_x = x;
783 }
784 vnc_clear_bit(vs->server.dirty[y], x);
785 } else {
786 if (last_x != -1) {
787 int h = find_and_clear_dirty_height(&vs->server, y, last_x, x);
788 send_framebuffer_update(vs, last_x * 16, y, (x - last_x) * 16, h);
789 n_rectangles++;
790 }
791 last_x = -1;
792 }
793 }
794 if (last_x != -1) {
795 int h = find_and_clear_dirty_height(&vs->server, y, last_x, x);
796 send_framebuffer_update(vs, last_x * 16, y, (x - last_x) * 16, h);
797 n_rectangles++;
798 }
799 }
800 vs->output.buffer[saved_offset] = (n_rectangles >> 8) & 0xFF;
801 vs->output.buffer[saved_offset + 1] = n_rectangles & 0xFF;
802 vnc_flush(vs);
803 vs->force_update = 0;
804
805 }
806
807 if (vs->csock != -1) {
808 qemu_mod_timer(vs->timer, qemu_get_clock(rt_clock) + VNC_REFRESH_INTERVAL);
809 } else {
810 vnc_disconnect_finish(vs);
811 }
812
813 }
814
815 /* audio */
816 static void audio_capture_notify(void *opaque, audcnotification_e cmd)
817 {
818 VncState *vs = opaque;
819
820 switch (cmd) {
821 case AUD_CNOTIFY_DISABLE:
822 vnc_write_u8(vs, 255);
823 vnc_write_u8(vs, 1);
824 vnc_write_u16(vs, 0);
825 vnc_flush(vs);
826 break;
827
828 case AUD_CNOTIFY_ENABLE:
829 vnc_write_u8(vs, 255);
830 vnc_write_u8(vs, 1);
831 vnc_write_u16(vs, 1);
832 vnc_flush(vs);
833 break;
834 }
835 }
836
837 static void audio_capture_destroy(void *opaque)
838 {
839 }
840
841 static void audio_capture(void *opaque, void *buf, int size)
842 {
843 VncState *vs = opaque;
844
845 vnc_write_u8(vs, 255);
846 vnc_write_u8(vs, 1);
847 vnc_write_u16(vs, 2);
848 vnc_write_u32(vs, size);
849 vnc_write(vs, buf, size);
850 vnc_flush(vs);
851 }
852
853 static void audio_add(VncState *vs)
854 {
855 Monitor *mon = cur_mon;
856 struct audio_capture_ops ops;
857
858 if (vs->audio_cap) {
859 monitor_printf(mon, "audio already running\n");
860 return;
861 }
862
863 ops.notify = audio_capture_notify;
864 ops.destroy = audio_capture_destroy;
865 ops.capture = audio_capture;
866
867 vs->audio_cap = AUD_add_capture(&vs->as, &ops, vs);
868 if (!vs->audio_cap) {
869 monitor_printf(mon, "Failed to add audio capture\n");
870 }
871 }
872
873 static void audio_del(VncState *vs)
874 {
875 if (vs->audio_cap) {
876 AUD_del_capture(vs->audio_cap, vs);
877 vs->audio_cap = NULL;
878 }
879 }
880
881 static void vnc_disconnect_start(VncState *vs)
882 {
883 if (vs->csock == -1)
884 return;
885 qemu_set_fd_handler2(vs->csock, NULL, NULL, NULL, NULL);
886 closesocket(vs->csock);
887 vs->csock = -1;
888 }
889
890 static void vnc_disconnect_finish(VncState *vs)
891 {
892 qemu_del_timer(vs->timer);
893 qemu_free_timer(vs->timer);
894 if (vs->input.buffer) qemu_free(vs->input.buffer);
895 if (vs->output.buffer) qemu_free(vs->output.buffer);
896 #ifdef CONFIG_VNC_TLS
897 vnc_tls_client_cleanup(vs);
898 #endif /* CONFIG_VNC_TLS */
899 #ifdef CONFIG_VNC_SASL
900 vnc_sasl_client_cleanup(vs);
901 #endif /* CONFIG_VNC_SASL */
902 audio_del(vs);
903
904 VncState *p, *parent = NULL;
905 for (p = vs->vd->clients; p != NULL; p = p->next) {
906 if (p == vs) {
907 if (parent)
908 parent->next = p->next;
909 else
910 vs->vd->clients = p->next;
911 break;
912 }
913 parent = p;
914 }
915 if (!vs->vd->clients)
916 dcl->idle = 1;
917
918 qemu_free(vs->server.ds->data);
919 qemu_free(vs->server.ds);
920 qemu_free(vs->guest.ds);
921 qemu_free(vs);
922 }
923
924 int vnc_client_io_error(VncState *vs, int ret, int last_errno)
925 {
926 if (ret == 0 || ret == -1) {
927 if (ret == -1) {
928 switch (last_errno) {
929 case EINTR:
930 case EAGAIN:
931 #ifdef _WIN32
932 case WSAEWOULDBLOCK:
933 #endif
934 return 0;
935 default:
936 break;
937 }
938 }
939
940 VNC_DEBUG("Closing down client sock: ret %d, errno %d\n",
941 ret, ret < 0 ? last_errno : 0);
942 vnc_disconnect_start(vs);
943
944 return 0;
945 }
946 return ret;
947 }
948
949
950 void vnc_client_error(VncState *vs)
951 {
952 VNC_DEBUG("Closing down client sock: protocol error\n");
953 vnc_disconnect_start(vs);
954 }
955
956
957 /*
958 * Called to write a chunk of data to the client socket. The data may
959 * be the raw data, or may have already been encoded by SASL.
960 * The data will be written either straight onto the socket, or
961 * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled
962 *
963 * NB, it is theoretically possible to have 2 layers of encryption,
964 * both SASL, and this TLS layer. It is highly unlikely in practice
965 * though, since SASL encryption will typically be a no-op if TLS
966 * is active
967 *
968 * Returns the number of bytes written, which may be less than
969 * the requested 'datalen' if the socket would block. Returns
970 * -1 on error, and disconnects the client socket.
971 */
972 long vnc_client_write_buf(VncState *vs, const uint8_t *data, size_t datalen)
973 {
974 long ret;
975 #ifdef CONFIG_VNC_TLS
976 if (vs->tls.session) {
977 ret = gnutls_write(vs->tls.session, data, datalen);
978 if (ret < 0) {
979 if (ret == GNUTLS_E_AGAIN)
980 errno = EAGAIN;
981 else
982 errno = EIO;
983 ret = -1;
984 }
985 } else
986 #endif /* CONFIG_VNC_TLS */
987 ret = send(vs->csock, (const void *)data, datalen, 0);
988 VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data, datalen, ret);
989 return vnc_client_io_error(vs, ret, socket_error());
990 }
991
992
993 /*
994 * Called to write buffered data to the client socket, when not
995 * using any SASL SSF encryption layers. Will write as much data
996 * as possible without blocking. If all buffered data is written,
997 * will switch the FD poll() handler back to read monitoring.
998 *
999 * Returns the number of bytes written, which may be less than
1000 * the buffered output data if the socket would block. Returns
1001 * -1 on error, and disconnects the client socket.
1002 */
1003 static long vnc_client_write_plain(VncState *vs)
1004 {
1005 long ret;
1006
1007 #ifdef CONFIG_VNC_SASL
1008 VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n",
1009 vs->output.buffer, vs->output.capacity, vs->output.offset,
1010 vs->sasl.waitWriteSSF);
1011
1012 if (vs->sasl.conn &&
1013 vs->sasl.runSSF &&
1014 vs->sasl.waitWriteSSF) {
1015 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF);
1016 if (ret)
1017 vs->sasl.waitWriteSSF -= ret;
1018 } else
1019 #endif /* CONFIG_VNC_SASL */
1020 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset);
1021 if (!ret)
1022 return 0;
1023
1024 memmove(vs->output.buffer, vs->output.buffer + ret, (vs->output.offset - ret));
1025 vs->output.offset -= ret;
1026
1027 if (vs->output.offset == 0) {
1028 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
1029 }
1030
1031 return ret;
1032 }
1033
1034
1035 /*
1036 * First function called whenever there is data to be written to
1037 * the client socket. Will delegate actual work according to whether
1038 * SASL SSF layers are enabled (thus requiring encryption calls)
1039 */
1040 void vnc_client_write(void *opaque)
1041 {
1042 long ret;
1043 VncState *vs = opaque;
1044
1045 #ifdef CONFIG_VNC_SASL
1046 if (vs->sasl.conn &&
1047 vs->sasl.runSSF &&
1048 !vs->sasl.waitWriteSSF)
1049 ret = vnc_client_write_sasl(vs);
1050 else
1051 #endif /* CONFIG_VNC_SASL */
1052 ret = vnc_client_write_plain(vs);
1053 }
1054
1055 void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting)
1056 {
1057 vs->read_handler = func;
1058 vs->read_handler_expect = expecting;
1059 }
1060
1061
1062 /*
1063 * Called to read a chunk of data from the client socket. The data may
1064 * be the raw data, or may need to be further decoded by SASL.
1065 * The data will be read either straight from to the socket, or
1066 * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1067 *
1068 * NB, it is theoretically possible to have 2 layers of encryption,
1069 * both SASL, and this TLS layer. It is highly unlikely in practice
1070 * though, since SASL encryption will typically be a no-op if TLS
1071 * is active
1072 *
1073 * Returns the number of bytes read, which may be less than
1074 * the requested 'datalen' if the socket would block. Returns
1075 * -1 on error, and disconnects the client socket.
1076 */
1077 long vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen)
1078 {
1079 long ret;
1080 #ifdef CONFIG_VNC_TLS
1081 if (vs->tls.session) {
1082 ret = gnutls_read(vs->tls.session, data, datalen);
1083 if (ret < 0) {
1084 if (ret == GNUTLS_E_AGAIN)
1085 errno = EAGAIN;
1086 else
1087 errno = EIO;
1088 ret = -1;
1089 }
1090 } else
1091 #endif /* CONFIG_VNC_TLS */
1092 ret = recv(vs->csock, (void *)data, datalen, 0);
1093 VNC_DEBUG("Read wire %p %zd -> %ld\n", data, datalen, ret);
1094 return vnc_client_io_error(vs, ret, socket_error());
1095 }
1096
1097
1098 /*
1099 * Called to read data from the client socket to the input buffer,
1100 * when not using any SASL SSF encryption layers. Will read as much
1101 * data as possible without blocking.
1102 *
1103 * Returns the number of bytes read. Returns -1 on error, and
1104 * disconnects the client socket.
1105 */
1106 static long vnc_client_read_plain(VncState *vs)
1107 {
1108 int ret;
1109 VNC_DEBUG("Read plain %p size %zd offset %zd\n",
1110 vs->input.buffer, vs->input.capacity, vs->input.offset);
1111 buffer_reserve(&vs->input, 4096);
1112 ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096);
1113 if (!ret)
1114 return 0;
1115 vs->input.offset += ret;
1116 return ret;
1117 }
1118
1119
1120 /*
1121 * First function called whenever there is more data to be read from
1122 * the client socket. Will delegate actual work according to whether
1123 * SASL SSF layers are enabled (thus requiring decryption calls)
1124 */
1125 void vnc_client_read(void *opaque)
1126 {
1127 VncState *vs = opaque;
1128 long ret;
1129
1130 #ifdef CONFIG_VNC_SASL
1131 if (vs->sasl.conn && vs->sasl.runSSF)
1132 ret = vnc_client_read_sasl(vs);
1133 else
1134 #endif /* CONFIG_VNC_SASL */
1135 ret = vnc_client_read_plain(vs);
1136 if (!ret) {
1137 if (vs->csock == -1)
1138 vnc_disconnect_finish(vs);
1139 return;
1140 }
1141
1142 while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) {
1143 size_t len = vs->read_handler_expect;
1144 int ret;
1145
1146 ret = vs->read_handler(vs, vs->input.buffer, len);
1147 if (vs->csock == -1) {
1148 vnc_disconnect_finish(vs);
1149 return;
1150 }
1151
1152 if (!ret) {
1153 memmove(vs->input.buffer, vs->input.buffer + len, (vs->input.offset - len));
1154 vs->input.offset -= len;
1155 } else {
1156 vs->read_handler_expect = ret;
1157 }
1158 }
1159 }
1160
1161 void vnc_write(VncState *vs, const void *data, size_t len)
1162 {
1163 buffer_reserve(&vs->output, len);
1164
1165 if (vs->csock != -1 && buffer_empty(&vs->output)) {
1166 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, vnc_client_write, vs);
1167 }
1168
1169 buffer_append(&vs->output, data, len);
1170 }
1171
1172 void vnc_write_s32(VncState *vs, int32_t value)
1173 {
1174 vnc_write_u32(vs, *(uint32_t *)&value);
1175 }
1176
1177 void vnc_write_u32(VncState *vs, uint32_t value)
1178 {
1179 uint8_t buf[4];
1180
1181 buf[0] = (value >> 24) & 0xFF;
1182 buf[1] = (value >> 16) & 0xFF;
1183 buf[2] = (value >> 8) & 0xFF;
1184 buf[3] = value & 0xFF;
1185
1186 vnc_write(vs, buf, 4);
1187 }
1188
1189 void vnc_write_u16(VncState *vs, uint16_t value)
1190 {
1191 uint8_t buf[2];
1192
1193 buf[0] = (value >> 8) & 0xFF;
1194 buf[1] = value & 0xFF;
1195
1196 vnc_write(vs, buf, 2);
1197 }
1198
1199 void vnc_write_u8(VncState *vs, uint8_t value)
1200 {
1201 vnc_write(vs, (char *)&value, 1);
1202 }
1203
1204 void vnc_flush(VncState *vs)
1205 {
1206 if (vs->csock != -1 && vs->output.offset)
1207 vnc_client_write(vs);
1208 }
1209
1210 uint8_t read_u8(uint8_t *data, size_t offset)
1211 {
1212 return data[offset];
1213 }
1214
1215 uint16_t read_u16(uint8_t *data, size_t offset)
1216 {
1217 return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF);
1218 }
1219
1220 int32_t read_s32(uint8_t *data, size_t offset)
1221 {
1222 return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) |
1223 (data[offset + 2] << 8) | data[offset + 3]);
1224 }
1225
1226 uint32_t read_u32(uint8_t *data, size_t offset)
1227 {
1228 return ((data[offset] << 24) | (data[offset + 1] << 16) |
1229 (data[offset + 2] << 8) | data[offset + 3]);
1230 }
1231
1232 static void client_cut_text(VncState *vs, size_t len, uint8_t *text)
1233 {
1234 }
1235
1236 static void check_pointer_type_change(VncState *vs, int absolute)
1237 {
1238 if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) {
1239 vnc_write_u8(vs, 0);
1240 vnc_write_u8(vs, 0);
1241 vnc_write_u16(vs, 1);
1242 vnc_framebuffer_update(vs, absolute, 0,
1243 ds_get_width(vs->ds), ds_get_height(vs->ds),
1244 VNC_ENCODING_POINTER_TYPE_CHANGE);
1245 vnc_flush(vs);
1246 }
1247 vs->absolute = absolute;
1248 }
1249
1250 static void pointer_event(VncState *vs, int button_mask, int x, int y)
1251 {
1252 int buttons = 0;
1253 int dz = 0;
1254
1255 if (button_mask & 0x01)
1256 buttons |= MOUSE_EVENT_LBUTTON;
1257 if (button_mask & 0x02)
1258 buttons |= MOUSE_EVENT_MBUTTON;
1259 if (button_mask & 0x04)
1260 buttons |= MOUSE_EVENT_RBUTTON;
1261 if (button_mask & 0x08)
1262 dz = -1;
1263 if (button_mask & 0x10)
1264 dz = 1;
1265
1266 if (vs->absolute) {
1267 kbd_mouse_event(x * 0x7FFF / (ds_get_width(vs->ds) - 1),
1268 y * 0x7FFF / (ds_get_height(vs->ds) - 1),
1269 dz, buttons);
1270 } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) {
1271 x -= 0x7FFF;
1272 y -= 0x7FFF;
1273
1274 kbd_mouse_event(x, y, dz, buttons);
1275 } else {
1276 if (vs->last_x != -1)
1277 kbd_mouse_event(x - vs->last_x,
1278 y - vs->last_y,
1279 dz, buttons);
1280 vs->last_x = x;
1281 vs->last_y = y;
1282 }
1283
1284 check_pointer_type_change(vs, kbd_mouse_is_absolute());
1285 }
1286
1287 static void reset_keys(VncState *vs)
1288 {
1289 int i;
1290 for(i = 0; i < 256; i++) {
1291 if (vs->modifiers_state[i]) {
1292 if (i & 0x80)
1293 kbd_put_keycode(0xe0);
1294 kbd_put_keycode(i | 0x80);
1295 vs->modifiers_state[i] = 0;
1296 }
1297 }
1298 }
1299
1300 static void press_key(VncState *vs, int keysym)
1301 {
1302 kbd_put_keycode(keysym2scancode(vs->vd->kbd_layout, keysym) & 0x7f);
1303 kbd_put_keycode(keysym2scancode(vs->vd->kbd_layout, keysym) | 0x80);
1304 }
1305
1306 static void do_key_event(VncState *vs, int down, int keycode, int sym)
1307 {
1308 /* QEMU console switch */
1309 switch(keycode) {
1310 case 0x2a: /* Left Shift */
1311 case 0x36: /* Right Shift */
1312 case 0x1d: /* Left CTRL */
1313 case 0x9d: /* Right CTRL */
1314 case 0x38: /* Left ALT */
1315 case 0xb8: /* Right ALT */
1316 if (down)
1317 vs->modifiers_state[keycode] = 1;
1318 else
1319 vs->modifiers_state[keycode] = 0;
1320 break;
1321 case 0x02 ... 0x0a: /* '1' to '9' keys */
1322 if (down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) {
1323 /* Reset the modifiers sent to the current console */
1324 reset_keys(vs);
1325 console_select(keycode - 0x02);
1326 return;
1327 }
1328 break;
1329 case 0x3a: /* CapsLock */
1330 case 0x45: /* NumLock */
1331 if (!down)
1332 vs->modifiers_state[keycode] ^= 1;
1333 break;
1334 }
1335
1336 if (keycode_is_keypad(vs->vd->kbd_layout, keycode)) {
1337 /* If the numlock state needs to change then simulate an additional
1338 keypress before sending this one. This will happen if the user
1339 toggles numlock away from the VNC window.
1340 */
1341 if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) {
1342 if (!vs->modifiers_state[0x45]) {
1343 vs->modifiers_state[0x45] = 1;
1344 press_key(vs, 0xff7f);
1345 }
1346 } else {
1347 if (vs->modifiers_state[0x45]) {
1348 vs->modifiers_state[0x45] = 0;
1349 press_key(vs, 0xff7f);
1350 }
1351 }
1352 }
1353
1354 if (is_graphic_console()) {
1355 if (keycode & 0x80)
1356 kbd_put_keycode(0xe0);
1357 if (down)
1358 kbd_put_keycode(keycode & 0x7f);
1359 else
1360 kbd_put_keycode(keycode | 0x80);
1361 } else {
1362 /* QEMU console emulation */
1363 if (down) {
1364 switch (keycode) {
1365 case 0x2a: /* Left Shift */
1366 case 0x36: /* Right Shift */
1367 case 0x1d: /* Left CTRL */
1368 case 0x9d: /* Right CTRL */
1369 case 0x38: /* Left ALT */
1370 case 0xb8: /* Right ALT */
1371 break;
1372 case 0xc8:
1373 case 0x48:
1374 kbd_put_keysym(QEMU_KEY_UP);
1375 break;
1376 case 0xd0:
1377 case 0x50:
1378 kbd_put_keysym(QEMU_KEY_DOWN);
1379 break;
1380 case 0xcb:
1381 case 0x4b:
1382 kbd_put_keysym(QEMU_KEY_LEFT);
1383 break;
1384 case 0xcd:
1385 case 0x4d:
1386 kbd_put_keysym(QEMU_KEY_RIGHT);
1387 break;
1388 case 0xd3:
1389 case 0x53:
1390 kbd_put_keysym(QEMU_KEY_DELETE);
1391 break;
1392 case 0xc7:
1393 case 0x47:
1394 kbd_put_keysym(QEMU_KEY_HOME);
1395 break;
1396 case 0xcf:
1397 case 0x4f:
1398 kbd_put_keysym(QEMU_KEY_END);
1399 break;
1400 case 0xc9:
1401 case 0x49:
1402 kbd_put_keysym(QEMU_KEY_PAGEUP);
1403 break;
1404 case 0xd1:
1405 case 0x51:
1406 kbd_put_keysym(QEMU_KEY_PAGEDOWN);
1407 break;
1408 default:
1409 kbd_put_keysym(sym);
1410 break;
1411 }
1412 }
1413 }
1414 }
1415
1416 static void key_event(VncState *vs, int down, uint32_t sym)
1417 {
1418 int keycode;
1419
1420 if (sym >= 'A' && sym <= 'Z' && is_graphic_console())
1421 sym = sym - 'A' + 'a';
1422
1423 keycode = keysym2scancode(vs->vd->kbd_layout, sym & 0xFFFF);
1424 do_key_event(vs, down, keycode, sym);
1425 }
1426
1427 static void ext_key_event(VncState *vs, int down,
1428 uint32_t sym, uint16_t keycode)
1429 {
1430 /* if the user specifies a keyboard layout, always use it */
1431 if (keyboard_layout)
1432 key_event(vs, down, sym);
1433 else
1434 do_key_event(vs, down, keycode, sym);
1435 }
1436
1437 static void framebuffer_update_request(VncState *vs, int incremental,
1438 int x_position, int y_position,
1439 int w, int h)
1440 {
1441 if (x_position > ds_get_width(vs->ds))
1442 x_position = ds_get_width(vs->ds);
1443 if (y_position > ds_get_height(vs->ds))
1444 y_position = ds_get_height(vs->ds);
1445 if (x_position + w >= ds_get_width(vs->ds))
1446 w = ds_get_width(vs->ds) - x_position;
1447 if (y_position + h >= ds_get_height(vs->ds))
1448 h = ds_get_height(vs->ds) - y_position;
1449
1450 int i;
1451 vs->need_update = 1;
1452 if (!incremental) {
1453 vs->force_update = 1;
1454 for (i = 0; i < h; i++) {
1455 vnc_set_bits(vs->guest.dirty[y_position + i],
1456 (ds_get_width(vs->ds) / 16), VNC_DIRTY_WORDS);
1457 vnc_set_bits(vs->server.dirty[y_position + i],
1458 (ds_get_width(vs->ds) / 16), VNC_DIRTY_WORDS);
1459 }
1460 }
1461 }
1462
1463 static void send_ext_key_event_ack(VncState *vs)
1464 {
1465 vnc_write_u8(vs, 0);
1466 vnc_write_u8(vs, 0);
1467 vnc_write_u16(vs, 1);
1468 vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
1469 VNC_ENCODING_EXT_KEY_EVENT);
1470 vnc_flush(vs);
1471 }
1472
1473 static void send_ext_audio_ack(VncState *vs)
1474 {
1475 vnc_write_u8(vs, 0);
1476 vnc_write_u8(vs, 0);
1477 vnc_write_u16(vs, 1);
1478 vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
1479 VNC_ENCODING_AUDIO);
1480 vnc_flush(vs);
1481 }
1482
1483 static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
1484 {
1485 int i;
1486 unsigned int enc = 0;
1487
1488 vnc_zlib_init(vs);
1489 vs->features = 0;
1490 vs->vnc_encoding = 0;
1491 vs->tight_compression = 9;
1492 vs->tight_quality = 9;
1493 vs->absolute = -1;
1494
1495 for (i = n_encodings - 1; i >= 0; i--) {
1496 enc = encodings[i];
1497 switch (enc) {
1498 case VNC_ENCODING_RAW:
1499 vs->vnc_encoding = enc;
1500 break;
1501 case VNC_ENCODING_COPYRECT:
1502 vs->features |= VNC_FEATURE_COPYRECT_MASK;
1503 break;
1504 case VNC_ENCODING_HEXTILE:
1505 vs->features |= VNC_FEATURE_HEXTILE_MASK;
1506 vs->vnc_encoding = enc;
1507 break;
1508 case VNC_ENCODING_ZLIB:
1509 vs->features |= VNC_FEATURE_ZLIB_MASK;
1510 vs->vnc_encoding = enc;
1511 break;
1512 case VNC_ENCODING_DESKTOPRESIZE:
1513 vs->features |= VNC_FEATURE_RESIZE_MASK;
1514 break;
1515 case VNC_ENCODING_POINTER_TYPE_CHANGE:
1516 vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK;
1517 break;
1518 case VNC_ENCODING_EXT_KEY_EVENT:
1519 send_ext_key_event_ack(vs);
1520 break;
1521 case VNC_ENCODING_AUDIO:
1522 send_ext_audio_ack(vs);
1523 break;
1524 case VNC_ENCODING_WMVi:
1525 vs->features |= VNC_FEATURE_WMVI_MASK;
1526 break;
1527 case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9:
1528 vs->tight_compression = (enc & 0x0F);
1529 break;
1530 case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9:
1531 vs->tight_quality = (enc & 0x0F);
1532 break;
1533 default:
1534 VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc);
1535 break;
1536 }
1537 }
1538
1539 check_pointer_type_change(vs, kbd_mouse_is_absolute());
1540 }
1541
1542 static void set_pixel_conversion(VncState *vs)
1543 {
1544 if ((vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) ==
1545 (vs->ds->surface->flags & QEMU_BIG_ENDIAN_FLAG) &&
1546 !memcmp(&(vs->clientds.pf), &(vs->ds->surface->pf), sizeof(PixelFormat))) {
1547 vs->write_pixels = vnc_write_pixels_copy;
1548 switch (vs->ds->surface->pf.bits_per_pixel) {
1549 case 8:
1550 vs->send_hextile_tile = send_hextile_tile_8;
1551 break;
1552 case 16:
1553 vs->send_hextile_tile = send_hextile_tile_16;
1554 break;
1555 case 32:
1556 vs->send_hextile_tile = send_hextile_tile_32;
1557 break;
1558 }
1559 } else {
1560 vs->write_pixels = vnc_write_pixels_generic;
1561 switch (vs->ds->surface->pf.bits_per_pixel) {
1562 case 8:
1563 vs->send_hextile_tile = send_hextile_tile_generic_8;
1564 break;
1565 case 16:
1566 vs->send_hextile_tile = send_hextile_tile_generic_16;
1567 break;
1568 case 32:
1569 vs->send_hextile_tile = send_hextile_tile_generic_32;
1570 break;
1571 }
1572 }
1573 }
1574
1575 static void set_pixel_format(VncState *vs,
1576 int bits_per_pixel, int depth,
1577 int big_endian_flag, int true_color_flag,
1578 int red_max, int green_max, int blue_max,
1579 int red_shift, int green_shift, int blue_shift)
1580 {
1581 if (!true_color_flag) {
1582 vnc_client_error(vs);
1583 return;
1584 }
1585
1586 vs->clientds = *(vs->guest.ds);
1587 vs->clientds.pf.rmax = red_max;
1588 count_bits(vs->clientds.pf.rbits, red_max);
1589 vs->clientds.pf.rshift = red_shift;
1590 vs->clientds.pf.rmask = red_max << red_shift;
1591 vs->clientds.pf.gmax = green_max;
1592 count_bits(vs->clientds.pf.gbits, green_max);
1593 vs->clientds.pf.gshift = green_shift;
1594 vs->clientds.pf.gmask = green_max << green_shift;
1595 vs->clientds.pf.bmax = blue_max;
1596 count_bits(vs->clientds.pf.bbits, blue_max);
1597 vs->clientds.pf.bshift = blue_shift;
1598 vs->clientds.pf.bmask = blue_max << blue_shift;
1599 vs->clientds.pf.bits_per_pixel = bits_per_pixel;
1600 vs->clientds.pf.bytes_per_pixel = bits_per_pixel / 8;
1601 vs->clientds.pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;
1602 vs->clientds.flags = big_endian_flag ? QEMU_BIG_ENDIAN_FLAG : 0x00;
1603
1604 set_pixel_conversion(vs);
1605
1606 vga_hw_invalidate();
1607 vga_hw_update();
1608 }
1609
1610 static void pixel_format_message (VncState *vs) {
1611 char pad[3] = { 0, 0, 0 };
1612
1613 vnc_write_u8(vs, vs->ds->surface->pf.bits_per_pixel); /* bits-per-pixel */
1614 vnc_write_u8(vs, vs->ds->surface->pf.depth); /* depth */
1615
1616 #ifdef WORDS_BIGENDIAN
1617 vnc_write_u8(vs, 1); /* big-endian-flag */
1618 #else
1619 vnc_write_u8(vs, 0); /* big-endian-flag */
1620 #endif
1621 vnc_write_u8(vs, 1); /* true-color-flag */
1622 vnc_write_u16(vs, vs->ds->surface->pf.rmax); /* red-max */
1623 vnc_write_u16(vs, vs->ds->surface->pf.gmax); /* green-max */
1624 vnc_write_u16(vs, vs->ds->surface->pf.bmax); /* blue-max */
1625 vnc_write_u8(vs, vs->ds->surface->pf.rshift); /* red-shift */
1626 vnc_write_u8(vs, vs->ds->surface->pf.gshift); /* green-shift */
1627 vnc_write_u8(vs, vs->ds->surface->pf.bshift); /* blue-shift */
1628 if (vs->ds->surface->pf.bits_per_pixel == 32)
1629 vs->send_hextile_tile = send_hextile_tile_32;
1630 else if (vs->ds->surface->pf.bits_per_pixel == 16)
1631 vs->send_hextile_tile = send_hextile_tile_16;
1632 else if (vs->ds->surface->pf.bits_per_pixel == 8)
1633 vs->send_hextile_tile = send_hextile_tile_8;
1634 vs->clientds = *(vs->ds->surface);
1635 vs->clientds.flags &= ~QEMU_ALLOCATED_FLAG;
1636 vs->write_pixels = vnc_write_pixels_copy;
1637
1638 vnc_write(vs, pad, 3); /* padding */
1639 }
1640
1641 static void vnc_dpy_setdata(DisplayState *ds)
1642 {
1643 /* We don't have to do anything */
1644 }
1645
1646 static void vnc_colordepth(VncState *vs)
1647 {
1648 if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) {
1649 /* Sending a WMVi message to notify the client*/
1650 vnc_write_u8(vs, 0); /* msg id */
1651 vnc_write_u8(vs, 0);
1652 vnc_write_u16(vs, 1); /* number of rects */
1653 vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds),
1654 ds_get_height(vs->ds), VNC_ENCODING_WMVi);
1655 pixel_format_message(vs);
1656 vnc_flush(vs);
1657 } else {
1658 set_pixel_conversion(vs);
1659 }
1660 }
1661
1662 static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
1663 {
1664 int i;
1665 uint16_t limit;
1666
1667 switch (data[0]) {
1668 case 0:
1669 if (len == 1)
1670 return 20;
1671
1672 set_pixel_format(vs, read_u8(data, 4), read_u8(data, 5),
1673 read_u8(data, 6), read_u8(data, 7),
1674 read_u16(data, 8), read_u16(data, 10),
1675 read_u16(data, 12), read_u8(data, 14),
1676 read_u8(data, 15), read_u8(data, 16));
1677 break;
1678 case 2:
1679 if (len == 1)
1680 return 4;
1681
1682 if (len == 4) {
1683 limit = read_u16(data, 2);
1684 if (limit > 0)
1685 return 4 + (limit * 4);
1686 } else
1687 limit = read_u16(data, 2);
1688
1689 for (i = 0; i < limit; i++) {
1690 int32_t val = read_s32(data, 4 + (i * 4));
1691 memcpy(data + 4 + (i * 4), &val, sizeof(val));
1692 }
1693
1694 set_encodings(vs, (int32_t *)(data + 4), limit);
1695 break;
1696 case 3:
1697 if (len == 1)
1698 return 10;
1699
1700 framebuffer_update_request(vs,
1701 read_u8(data, 1), read_u16(data, 2), read_u16(data, 4),
1702 read_u16(data, 6), read_u16(data, 8));
1703 break;
1704 case 4:
1705 if (len == 1)
1706 return 8;
1707
1708 key_event(vs, read_u8(data, 1), read_u32(data, 4));
1709 break;
1710 case 5:
1711 if (len == 1)
1712 return 6;
1713
1714 pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
1715 break;
1716 case 6:
1717 if (len == 1)
1718 return 8;
1719
1720 if (len == 8) {
1721 uint32_t dlen = read_u32(data, 4);
1722 if (dlen > 0)
1723 return 8 + dlen;
1724 }
1725
1726 client_cut_text(vs, read_u32(data, 4), data + 8);
1727 break;
1728 case 255:
1729 if (len == 1)
1730 return 2;
1731
1732 switch (read_u8(data, 1)) {
1733 case 0:
1734 if (len == 2)
1735 return 12;
1736
1737 ext_key_event(vs, read_u16(data, 2),
1738 read_u32(data, 4), read_u32(data, 8));
1739 break;
1740 case 1:
1741 if (len == 2)
1742 return 4;
1743
1744 switch (read_u16 (data, 2)) {
1745 case 0:
1746 audio_add(vs);
1747 break;
1748 case 1:
1749 audio_del(vs);
1750 break;
1751 case 2:
1752 if (len == 4)
1753 return 10;
1754 switch (read_u8(data, 4)) {
1755 case 0: vs->as.fmt = AUD_FMT_U8; break;
1756 case 1: vs->as.fmt = AUD_FMT_S8; break;
1757 case 2: vs->as.fmt = AUD_FMT_U16; break;
1758 case 3: vs->as.fmt = AUD_FMT_S16; break;
1759 case 4: vs->as.fmt = AUD_FMT_U32; break;
1760 case 5: vs->as.fmt = AUD_FMT_S32; break;
1761 default:
1762 printf("Invalid audio format %d\n", read_u8(data, 4));
1763 vnc_client_error(vs);
1764 break;
1765 }
1766 vs->as.nchannels = read_u8(data, 5);
1767 if (vs->as.nchannels != 1 && vs->as.nchannels != 2) {
1768 printf("Invalid audio channel coount %d\n",
1769 read_u8(data, 5));
1770 vnc_client_error(vs);
1771 break;
1772 }
1773 vs->as.freq = read_u32(data, 6);
1774 break;
1775 default:
1776 printf ("Invalid audio message %d\n", read_u8(data, 4));
1777 vnc_client_error(vs);
1778 break;
1779 }
1780 break;
1781
1782 default:
1783 printf("Msg: %d\n", read_u16(data, 0));
1784 vnc_client_error(vs);
1785 break;
1786 }
1787 break;
1788 default:
1789 printf("Msg: %d\n", data[0]);
1790 vnc_client_error(vs);
1791 break;
1792 }
1793
1794 vnc_read_when(vs, protocol_client_msg, 1);
1795 return 0;
1796 }
1797
1798 static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
1799 {
1800 char buf[1024];
1801 int size;
1802
1803 vnc_write_u16(vs, ds_get_width(vs->ds));
1804 vnc_write_u16(vs, ds_get_height(vs->ds));
1805
1806 pixel_format_message(vs);
1807
1808 if (qemu_name)
1809 size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
1810 else
1811 size = snprintf(buf, sizeof(buf), "QEMU");
1812
1813 vnc_write_u32(vs, size);
1814 vnc_write(vs, buf, size);
1815 vnc_flush(vs);
1816
1817 vnc_read_when(vs, protocol_client_msg, 1);
1818
1819 return 0;
1820 }
1821
1822 void start_client_init(VncState *vs)
1823 {
1824 vnc_read_when(vs, protocol_client_init, 1);
1825 }
1826
1827 static void make_challenge(VncState *vs)
1828 {
1829 int i;
1830
1831 srand(time(NULL)+getpid()+getpid()*987654+rand());
1832
1833 for (i = 0 ; i < sizeof(vs->challenge) ; i++)
1834 vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
1835 }
1836
1837 static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
1838 {
1839 unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
1840 int i, j, pwlen;
1841 unsigned char key[8];
1842
1843 if (!vs->vd->password || !vs->vd->password[0]) {
1844 VNC_DEBUG("No password configured on server");
1845 vnc_write_u32(vs, 1); /* Reject auth */
1846 if (vs->minor >= 8) {
1847 static const char err[] = "Authentication failed";
1848 vnc_write_u32(vs, sizeof(err));
1849 vnc_write(vs, err, sizeof(err));
1850 }
1851 vnc_flush(vs);
1852 vnc_client_error(vs);
1853 return 0;
1854 }
1855
1856 memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
1857
1858 /* Calculate the expected challenge response */
1859 pwlen = strlen(vs->vd->password);
1860 for (i=0; i<sizeof(key); i++)
1861 key[i] = i<pwlen ? vs->vd->password[i] : 0;
1862 deskey(key, EN0);
1863 for (j = 0; j < VNC_AUTH_CHALLENGE_SIZE; j += 8)
1864 des(response+j, response+j);
1865
1866 /* Compare expected vs actual challenge response */
1867 if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) {
1868 VNC_DEBUG("Client challenge reponse did not match\n");
1869 vnc_write_u32(vs, 1); /* Reject auth */
1870 if (vs->minor >= 8) {
1871 static const char err[] = "Authentication failed";
1872 vnc_write_u32(vs, sizeof(err));
1873 vnc_write(vs, err, sizeof(err));
1874 }
1875 vnc_flush(vs);
1876 vnc_client_error(vs);
1877 } else {
1878 VNC_DEBUG("Accepting VNC challenge response\n");
1879 vnc_write_u32(vs, 0); /* Accept auth */
1880 vnc_flush(vs);
1881
1882 start_client_init(vs);
1883 }
1884 return 0;
1885 }
1886
1887 void start_auth_vnc(VncState *vs)
1888 {
1889 make_challenge(vs);
1890 /* Send client a 'random' challenge */
1891 vnc_write(vs, vs->challenge, sizeof(vs->challenge));
1892 vnc_flush(vs);
1893
1894 vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge));
1895 }
1896
1897
1898 static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
1899 {
1900 /* We only advertise 1 auth scheme at a time, so client
1901 * must pick the one we sent. Verify this */
1902 if (data[0] != vs->vd->auth) { /* Reject auth */
1903 VNC_DEBUG("Reject auth %d because it didn't match advertized\n", (int)data[0]);
1904 vnc_write_u32(vs, 1);
1905 if (vs->minor >= 8) {
1906 static const char err[] = "Authentication failed";
1907 vnc_write_u32(vs, sizeof(err));
1908 vnc_write(vs, err, sizeof(err));
1909 }
1910 vnc_client_error(vs);
1911 } else { /* Accept requested auth */
1912 VNC_DEBUG("Client requested auth %d\n", (int)data[0]);
1913 switch (vs->vd->auth) {
1914 case VNC_AUTH_NONE:
1915 VNC_DEBUG("Accept auth none\n");
1916 if (vs->minor >= 8) {
1917 vnc_write_u32(vs, 0); /* Accept auth completion */
1918 vnc_flush(vs);
1919 }
1920 start_client_init(vs);
1921 break;
1922
1923 case VNC_AUTH_VNC:
1924 VNC_DEBUG("Start VNC auth\n");
1925 start_auth_vnc(vs);
1926 break;
1927
1928 #ifdef CONFIG_VNC_TLS
1929 case VNC_AUTH_VENCRYPT:
1930 VNC_DEBUG("Accept VeNCrypt auth\n");;
1931 start_auth_vencrypt(vs);
1932 break;
1933 #endif /* CONFIG_VNC_TLS */
1934
1935 #ifdef CONFIG_VNC_SASL
1936 case VNC_AUTH_SASL:
1937 VNC_DEBUG("Accept SASL auth\n");
1938 start_auth_sasl(vs);
1939 break;
1940 #endif /* CONFIG_VNC_SASL */
1941
1942 default: /* Should not be possible, but just in case */
1943 VNC_DEBUG("Reject auth %d server code bug\n", vs->vd->auth);
1944 vnc_write_u8(vs, 1);
1945 if (vs->minor >= 8) {
1946 static const char err[] = "Authentication failed";
1947 vnc_write_u32(vs, sizeof(err));
1948 vnc_write(vs, err, sizeof(err));
1949 }
1950 vnc_client_error(vs);
1951 }
1952 }
1953 return 0;
1954 }
1955
1956 static int protocol_version(VncState *vs, uint8_t *version, size_t len)
1957 {
1958 char local[13];
1959
1960 memcpy(local, version, 12);
1961 local[12] = 0;
1962
1963 if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) {
1964 VNC_DEBUG("Malformed protocol version %s\n", local);
1965 vnc_client_error(vs);
1966 return 0;
1967 }
1968 VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor);
1969 if (vs->major != 3 ||
1970 (vs->minor != 3 &&
1971 vs->minor != 4 &&
1972 vs->minor != 5 &&
1973 vs->minor != 7 &&
1974 vs->minor != 8)) {
1975 VNC_DEBUG("Unsupported client version\n");
1976 vnc_write_u32(vs, VNC_AUTH_INVALID);
1977 vnc_flush(vs);
1978 vnc_client_error(vs);
1979 return 0;
1980 }
1981 /* Some broken clients report v3.4 or v3.5, which spec requires to be treated
1982 * as equivalent to v3.3 by servers
1983 */
1984 if (vs->minor == 4 || vs->minor == 5)
1985 vs->minor = 3;
1986
1987 if (vs->minor == 3) {
1988 if (vs->vd->auth == VNC_AUTH_NONE) {
1989 VNC_DEBUG("Tell client auth none\n");
1990 vnc_write_u32(vs, vs->vd->auth);
1991 vnc_flush(vs);
1992 start_client_init(vs);
1993 } else if (vs->vd->auth == VNC_AUTH_VNC) {
1994 VNC_DEBUG("Tell client VNC auth\n");
1995 vnc_write_u32(vs, vs->vd->auth);
1996 vnc_flush(vs);
1997 start_auth_vnc(vs);
1998 } else {
1999 VNC_DEBUG("Unsupported auth %d for protocol 3.3\n", vs->vd->auth);
2000 vnc_write_u32(vs, VNC_AUTH_INVALID);
2001 vnc_flush(vs);
2002 vnc_client_error(vs);
2003 }
2004 } else {
2005 VNC_DEBUG("Telling client we support auth %d\n", vs->vd->auth);
2006 vnc_write_u8(vs, 1); /* num auth */
2007 vnc_write_u8(vs, vs->vd->auth);
2008 vnc_read_when(vs, protocol_client_auth, 1);
2009 vnc_flush(vs);
2010 }
2011
2012 return 0;
2013 }
2014
2015 static void vnc_connect(VncDisplay *vd, int csock)
2016 {
2017 VncState *vs = qemu_mallocz(sizeof(VncState));
2018 vs->csock = csock;
2019
2020 VNC_DEBUG("New client on socket %d\n", csock);
2021 dcl->idle = 0;
2022 socket_set_nonblock(vs->csock);
2023 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
2024
2025 vs->vd = vd;
2026 vs->ds = vd->ds;
2027 vs->timer = qemu_new_timer(rt_clock, vnc_update_client, vs);
2028 vs->last_x = -1;
2029 vs->last_y = -1;
2030
2031 vs->as.freq = 44100;
2032 vs->as.nchannels = 2;
2033 vs->as.fmt = AUD_FMT_S16;
2034 vs->as.endianness = 0;
2035
2036 vnc_resize(vs);
2037 vnc_write(vs, "RFB 003.008\n", 12);
2038 vnc_flush(vs);
2039 vnc_read_when(vs, protocol_version, 12);
2040 reset_keys(vs);
2041
2042 vs->next = vd->clients;
2043 vd->clients = vs;
2044
2045 vnc_update_client(vs);
2046 /* vs might be free()ed here */
2047 }
2048
2049 static void vnc_listen_read(void *opaque)
2050 {
2051 VncDisplay *vs = opaque;
2052 struct sockaddr_in addr;
2053 socklen_t addrlen = sizeof(addr);
2054
2055 /* Catch-up */
2056 vga_hw_update();
2057
2058 int csock = accept(vs->lsock, (struct sockaddr *)&addr, &addrlen);
2059 if (csock != -1) {
2060 vnc_connect(vs, csock);
2061 }
2062 }
2063
2064 void vnc_display_init(DisplayState *ds)
2065 {
2066 VncDisplay *vs = qemu_mallocz(sizeof(*vs));
2067
2068 dcl = qemu_mallocz(sizeof(DisplayChangeListener));
2069
2070 ds->opaque = vs;
2071 dcl->idle = 1;
2072 vnc_display = vs;
2073
2074 vs->lsock = -1;
2075
2076 vs->ds = ds;
2077
2078 if (keyboard_layout)
2079 vs->kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout);
2080 else
2081 vs->kbd_layout = init_keyboard_layout(name2keysym, "en-us");
2082
2083 if (!vs->kbd_layout)
2084 exit(1);
2085
2086 dcl->dpy_copy = vnc_dpy_copy;
2087 dcl->dpy_update = vnc_dpy_update;
2088 dcl->dpy_resize = vnc_dpy_resize;
2089 dcl->dpy_setdata = vnc_dpy_setdata;
2090 register_displaychangelistener(ds, dcl);
2091 }
2092
2093
2094 void vnc_display_close(DisplayState *ds)
2095 {
2096 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2097
2098 if (!vs)
2099 return;
2100 if (vs->display) {
2101 qemu_free(vs->display);
2102 vs->display = NULL;
2103 }
2104 if (vs->lsock != -1) {
2105 qemu_set_fd_handler2(vs->lsock, NULL, NULL, NULL, NULL);
2106 close(vs->lsock);
2107 vs->lsock = -1;
2108 }
2109 vs->auth = VNC_AUTH_INVALID;
2110 #ifdef CONFIG_VNC_TLS
2111 vs->subauth = VNC_AUTH_INVALID;
2112 vs->tls.x509verify = 0;
2113 #endif
2114 }
2115
2116 int vnc_display_password(DisplayState *ds, const char *password)
2117 {
2118 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2119
2120 if (vs->password) {
2121 qemu_free(vs->password);
2122 vs->password = NULL;
2123 }
2124 if (password && password[0]) {
2125 if (!(vs->password = qemu_strdup(password)))
2126 return -1;
2127 }
2128
2129 return 0;
2130 }
2131
2132 char *vnc_display_local_addr(DisplayState *ds)
2133 {
2134 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2135
2136 return vnc_socket_local_addr("%s:%s", vs->lsock);
2137 }
2138
2139 int vnc_display_open(DisplayState *ds, const char *display)
2140 {
2141 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2142 const char *options;
2143 int password = 0;
2144 int reverse = 0;
2145 int to_port = 0;
2146 #ifdef CONFIG_VNC_TLS
2147 int tls = 0, x509 = 0;
2148 #endif
2149 #ifdef CONFIG_VNC_SASL
2150 int sasl = 0;
2151 int saslErr;
2152 #endif
2153 int acl = 0;
2154
2155 if (!vnc_display)
2156 return -1;
2157 vnc_display_close(ds);
2158 if (strcmp(display, "none") == 0)
2159 return 0;
2160
2161 if (!(vs->display = strdup(display)))
2162 return -1;
2163
2164 options = display;
2165 while ((options = strchr(options, ','))) {
2166 options++;
2167 if (strncmp(options, "password", 8) == 0) {
2168 password = 1; /* Require password auth */
2169 } else if (strncmp(options, "reverse", 7) == 0) {
2170 reverse = 1;
2171 } else if (strncmp(options, "to=", 3) == 0) {
2172 to_port = atoi(options+3) + 5900;
2173 #ifdef CONFIG_VNC_SASL
2174 } else if (strncmp(options, "sasl", 4) == 0) {
2175 sasl = 1; /* Require SASL auth */
2176 #endif
2177 #ifdef CONFIG_VNC_TLS
2178 } else if (strncmp(options, "tls", 3) == 0) {
2179 tls = 1; /* Require TLS */
2180 } else if (strncmp(options, "x509", 4) == 0) {
2181 char *start, *end;
2182 x509 = 1; /* Require x509 certificates */
2183 if (strncmp(options, "x509verify", 10) == 0)
2184 vs->tls.x509verify = 1; /* ...and verify client certs */
2185
2186 /* Now check for 'x509=/some/path' postfix
2187 * and use that to setup x509 certificate/key paths */
2188 start = strchr(options, '=');
2189 end = strchr(options, ',');
2190 if (start && (!end || (start < end))) {
2191 int len = end ? end-(start+1) : strlen(start+1);
2192 char *path = qemu_strndup(start + 1, len);
2193
2194 VNC_DEBUG("Trying certificate path '%s'\n", path);
2195 if (vnc_tls_set_x509_creds_dir(vs, path) < 0) {
2196 fprintf(stderr, "Failed to find x509 certificates/keys in %s\n", path);
2197 qemu_free(path);
2198 qemu_free(vs->display);
2199 vs->display = NULL;
2200 return -1;
2201 }
2202 qemu_free(path);
2203 } else {
2204 fprintf(stderr, "No certificate path provided\n");
2205 qemu_free(vs->display);
2206 vs->display = NULL;
2207 return -1;
2208 }
2209 #endif
2210 } else if (strncmp(options, "acl", 3) == 0) {
2211 acl = 1;
2212 }
2213 }
2214
2215 #ifdef CONFIG_VNC_TLS
2216 if (acl && x509 && vs->tls.x509verify) {
2217 if (!(vs->tls.acl = qemu_acl_init("vnc.x509dname"))) {
2218 fprintf(stderr, "Failed to create x509 dname ACL\n");
2219 exit(1);
2220 }
2221 }
2222 #endif
2223 #ifdef CONFIG_VNC_SASL
2224 if (acl && sasl) {
2225 if (!(vs->sasl.acl = qemu_acl_init("vnc.username"))) {
2226 fprintf(stderr, "Failed to create username ACL\n");
2227 exit(1);
2228 }
2229 }
2230 #endif
2231
2232 /*
2233 * Combinations we support here:
2234 *
2235 * - no-auth (clear text, no auth)
2236 * - password (clear text, weak auth)
2237 * - sasl (encrypt, good auth *IF* using Kerberos via GSSAPI)
2238 * - tls (encrypt, weak anonymous creds, no auth)
2239 * - tls + password (encrypt, weak anonymous creds, weak auth)
2240 * - tls + sasl (encrypt, weak anonymous creds, good auth)
2241 * - tls + x509 (encrypt, good x509 creds, no auth)
2242 * - tls + x509 + password (encrypt, good x509 creds, weak auth)
2243 * - tls + x509 + sasl (encrypt, good x509 creds, good auth)
2244 *
2245 * NB1. TLS is a stackable auth scheme.
2246 * NB2. the x509 schemes have option to validate a client cert dname
2247 */
2248 if (password) {
2249 #ifdef CONFIG_VNC_TLS
2250 if (tls) {
2251 vs->auth = VNC_AUTH_VENCRYPT;
2252 if (x509) {
2253 VNC_DEBUG("Initializing VNC server with x509 password auth\n");
2254 vs->subauth = VNC_AUTH_VENCRYPT_X509VNC;
2255 } else {
2256 VNC_DEBUG("Initializing VNC server with TLS password auth\n");
2257 vs->subauth = VNC_AUTH_VENCRYPT_TLSVNC;
2258 }
2259 } else {
2260 #endif /* CONFIG_VNC_TLS */
2261 VNC_DEBUG("Initializing VNC server with password auth\n");
2262 vs->auth = VNC_AUTH_VNC;
2263 #ifdef CONFIG_VNC_TLS
2264 vs->subauth = VNC_AUTH_INVALID;
2265 }
2266 #endif /* CONFIG_VNC_TLS */
2267 #ifdef CONFIG_VNC_SASL
2268 } else if (sasl) {
2269 #ifdef CONFIG_VNC_TLS
2270 if (tls) {
2271 vs->auth = VNC_AUTH_VENCRYPT;
2272 if (x509) {
2273 VNC_DEBUG("Initializing VNC server with x509 SASL auth\n");
2274 vs->subauth = VNC_AUTH_VENCRYPT_X509SASL;
2275 } else {
2276 VNC_DEBUG("Initializing VNC server with TLS SASL auth\n");
2277 vs->subauth = VNC_AUTH_VENCRYPT_TLSSASL;
2278 }
2279 } else {
2280 #endif /* CONFIG_VNC_TLS */
2281 VNC_DEBUG("Initializing VNC server with SASL auth\n");
2282 vs->auth = VNC_AUTH_SASL;
2283 #ifdef CONFIG_VNC_TLS
2284 vs->subauth = VNC_AUTH_INVALID;
2285 }
2286 #endif /* CONFIG_VNC_TLS */
2287 #endif /* CONFIG_VNC_SASL */
2288 } else {
2289 #ifdef CONFIG_VNC_TLS
2290 if (tls) {
2291 vs->auth = VNC_AUTH_VENCRYPT;
2292 if (x509) {
2293 VNC_DEBUG("Initializing VNC server with x509 no auth\n");
2294 vs->subauth = VNC_AUTH_VENCRYPT_X509NONE;
2295 } else {
2296 VNC_DEBUG("Initializing VNC server with TLS no auth\n");
2297 vs->subauth = VNC_AUTH_VENCRYPT_TLSNONE;
2298 }
2299 } else {
2300 #endif
2301 VNC_DEBUG("Initializing VNC server with no auth\n");
2302 vs->auth = VNC_AUTH_NONE;
2303 #ifdef CONFIG_VNC_TLS
2304 vs->subauth = VNC_AUTH_INVALID;
2305 }
2306 #endif
2307 }
2308
2309 #ifdef CONFIG_VNC_SASL
2310 if ((saslErr = sasl_server_init(NULL, "qemu")) != SASL_OK) {
2311 fprintf(stderr, "Failed to initialize SASL auth %s",
2312 sasl_errstring(saslErr, NULL, NULL));
2313 free(vs->display);
2314 vs->display = NULL;
2315 return -1;
2316 }
2317 #endif
2318
2319 if (reverse) {
2320 /* connect to viewer */
2321 if (strncmp(display, "unix:", 5) == 0)
2322 vs->lsock = unix_connect(display+5);
2323 else
2324 vs->lsock = inet_connect(display, SOCK_STREAM);
2325 if (-1 == vs->lsock) {
2326 free(vs->display);
2327 vs->display = NULL;
2328 return -1;
2329 } else {
2330 int csock = vs->lsock;
2331 vs->lsock = -1;
2332 vnc_connect(vs, csock);
2333 }
2334 return 0;
2335
2336 } else {
2337 /* listen for connects */
2338 char *dpy;
2339 dpy = qemu_malloc(256);
2340 if (strncmp(display, "unix:", 5) == 0) {
2341 pstrcpy(dpy, 256, "unix:");
2342 vs->lsock = unix_listen(display+5, dpy+5, 256-5);
2343 } else {
2344 vs->lsock = inet_listen(display, dpy, 256, SOCK_STREAM, 5900);
2345 }
2346 if (-1 == vs->lsock) {
2347 free(dpy);
2348 return -1;
2349 } else {
2350 free(vs->display);
2351 vs->display = dpy;
2352 }
2353 }
2354 return qemu_set_fd_handler2(vs->lsock, NULL, vnc_listen_read, NULL, vs);
2355 }
Qemu copy for testing