1 /* 2 * QEMU VNC display driver 3 * 4 * Copyright (C) 2006 Anthony Liguori <anthony (at) codemonkey.ws> 5 * Copyright (C) 2006 Fabrice Bellard 6 * Copyright (C) 2009 Red Hat, Inc 7 * 8 * Permission is hereby granted, free of charge, to any person obtaining a copy 9 * of this software and associated documentation files (the "Software"), to deal 10 * in the Software without restriction, including without limitation the rights 11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 12 * copies of the Software, and to permit persons to whom the Software is 13 * furnished to do so, subject to the following conditions: 14 * 15 * The above copyright notice and this permission notice shall be included in 16 * all copies or substantial portions of the Software. 17 * 18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 24 * THE SOFTWARE. 25 */ 26 27 #include "vnc.h" 28 #include "sysemu/sysemu.h" 29 #include "qemu/sockets.h" 30 #include "qemu/timer.h" 31 #include "qemu/acl.h" 32 33 #define VNC_REFRESH_INTERVAL (1000 / 30) 34 35 #include "vnc_keysym.h" 36 #include "d3des.h" 37 38 #define count_bits(c, v) { \ 39 for (c = 0; v; v >>= 1) \ 40 { \ 41 c += v & 1; \ 42 } \ 43 } 44 45 46 static VncDisplay *vnc_display; /* needed for info vnc */ 47 static DisplayChangeListener *dcl; 48 49 static char *addr_to_string(const char *format, 50 struct sockaddr_storage *sa, 51 socklen_t salen) { 52 char *addr; 53 char host[NI_MAXHOST]; 54 char serv[NI_MAXSERV]; 55 int err; 56 size_t addrlen; 57 58 if ((err = getnameinfo((struct sockaddr *)sa, salen, 59 host, sizeof(host), 60 serv, sizeof(serv), 61 NI_NUMERICHOST | NI_NUMERICSERV)) != 0) { 62 VNC_DEBUG("Cannot resolve address %d: %s\n", 63 err, gai_strerror(err)); 64 return NULL; 65 } 66 67 /* Enough for the existing format + the 2 vars we're 68 * substituting in. */ 69 addrlen = strlen(format) + strlen(host) + strlen(serv); 70 addr = g_malloc(addrlen + 1); 71 snprintf(addr, addrlen, format, host, serv); 72 addr[addrlen] = '\0'; 73 74 return addr; 75 } 76 77 78 char *vnc_socket_local_addr(const char *format, int fd) { 79 struct sockaddr_storage sa; 80 socklen_t salen; 81 82 salen = sizeof(sa); 83 if (getsockname(fd, (struct sockaddr*)&sa, &salen) < 0) 84 return NULL; 85 86 return addr_to_string(format, &sa, salen); 87 } 88 89 char *vnc_socket_remote_addr(const char *format, int fd) { 90 struct sockaddr_storage sa; 91 socklen_t salen; 92 93 salen = sizeof(sa); 94 if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0) 95 return NULL; 96 97 return addr_to_string(format, &sa, salen); 98 } 99 100 static const char *vnc_auth_name(VncDisplay *vd) { 101 switch (vd->auth) { 102 case VNC_AUTH_INVALID: 103 return "invalid"; 104 case VNC_AUTH_NONE: 105 return "none"; 106 case VNC_AUTH_VNC: 107 return "vnc"; 108 case VNC_AUTH_RA2: 109 return "ra2"; 110 case VNC_AUTH_RA2NE: 111 return "ra2ne"; 112 case VNC_AUTH_TIGHT: 113 return "tight"; 114 case VNC_AUTH_ULTRA: 115 return "ultra"; 116 case VNC_AUTH_TLS: 117 return "tls"; 118 case VNC_AUTH_VENCRYPT: 119 #ifdef CONFIG_VNC_TLS 120 switch (vd->subauth) { 121 case VNC_AUTH_VENCRYPT_PLAIN: 122 return "vencrypt+plain"; 123 case VNC_AUTH_VENCRYPT_TLSNONE: 124 return "vencrypt+tls+none"; 125 case VNC_AUTH_VENCRYPT_TLSVNC: 126 return "vencrypt+tls+vnc"; 127 case VNC_AUTH_VENCRYPT_TLSPLAIN: 128 return "vencrypt+tls+plain"; 129 case VNC_AUTH_VENCRYPT_X509NONE: 130 return "vencrypt+x509+none"; 131 case VNC_AUTH_VENCRYPT_X509VNC: 132 return "vencrypt+x509+vnc"; 133 case VNC_AUTH_VENCRYPT_X509PLAIN: 134 return "vencrypt+x509+plain"; 135 case VNC_AUTH_VENCRYPT_TLSSASL: 136 return "vencrypt+tls+sasl"; 137 case VNC_AUTH_VENCRYPT_X509SASL: 138 return "vencrypt+x509+sasl"; 139 default: 140 return "vencrypt"; 141 } 142 #else 143 return "vencrypt"; 144 #endif 145 case VNC_AUTH_SASL: 146 return "sasl"; 147 } 148 return "unknown"; 149 } 150 151 static void do_info_vnc_client(Monitor *mon, VncState *client) 152 { 153 char *clientAddr = 154 vnc_socket_remote_addr(" address: %s:%s\n", 155 client->csock); 156 if (!clientAddr) 157 return; 158 159 monitor_printf(mon, "Client:\n"); 160 monitor_printf(mon, "%s", clientAddr); 161 free(clientAddr); 162 163 #ifdef CONFIG_VNC_TLS 164 if (client->tls.session && 165 client->tls.dname) 166 monitor_printf(mon, " x509 dname: %s\n", client->tls.dname); 167 else 168 monitor_printf(mon, " x509 dname: none\n"); 169 #endif 170 #ifdef CONFIG_VNC_SASL 171 if (client->sasl.conn && 172 client->sasl.username) 173 monitor_printf(mon, " username: %s\n", client->sasl.username); 174 else 175 monitor_printf(mon, " username: none\n"); 176 #endif 177 } 178 179 void do_info_vnc(Monitor *mon) 180 { 181 if (vnc_display == NULL || vnc_display->display == NULL) { 182 monitor_printf(mon, "Server: disabled\n"); 183 } else { 184 char *serverAddr = vnc_socket_local_addr(" address: %s:%s\n", 185 vnc_display->lsock); 186 187 if (!serverAddr) 188 return; 189 190 monitor_printf(mon, "Server:\n"); 191 monitor_printf(mon, "%s", serverAddr); 192 free(serverAddr); 193 monitor_printf(mon, " auth: %s\n", vnc_auth_name(vnc_display)); 194 195 if (vnc_display->clients) { 196 VncState *client = vnc_display->clients; 197 while (client) { 198 do_info_vnc_client(mon, client); 199 client = client->next; 200 } 201 } else { 202 monitor_printf(mon, "Client: none\n"); 203 } 204 } 205 } 206 207 static inline uint32_t vnc_has_feature(VncState *vs, int feature) { 208 return (vs->features & (1 << feature)); 209 } 210 211 /* TODO 212 1) Get the queue working for IO. 213 2) there is some weirdness when using the -S option (the screen is grey 214 and not totally invalidated 215 3) resolutions > 1024 216 */ 217 218 static void vnc_update_client(void *opaque); 219 static void vnc_disconnect_start(VncState *vs); 220 static void vnc_disconnect_finish(VncState *vs); 221 222 static void vnc_colordepth(VncState *vs); 223 224 static inline void vnc_set_bit(uint32_t *d, int k) 225 { 226 d[k >> 5] |= 1 << (k & 0x1f); 227 } 228 229 static inline void vnc_clear_bit(uint32_t *d, int k) 230 { 231 d[k >> 5] &= ~(1 << (k & 0x1f)); 232 } 233 234 static inline void vnc_set_bits(uint32_t *d, int n, int nb_words) 235 { 236 int j; 237 238 j = 0; 239 while (n >= 32) { 240 d[j++] = -1; 241 n -= 32; 242 } 243 if (n > 0) 244 d[j++] = (1 << n) - 1; 245 while (j < nb_words) 246 d[j++] = 0; 247 } 248 249 static inline int vnc_get_bit(const uint32_t *d, int k) 250 { 251 return (d[k >> 5] >> (k & 0x1f)) & 1; 252 } 253 254 static inline int vnc_and_bits(const uint32_t *d1, const uint32_t *d2, 255 int nb_words) 256 { 257 int i; 258 for(i = 0; i < nb_words; i++) { 259 if ((d1[i] & d2[i]) != 0) 260 return 1; 261 } 262 return 0; 263 } 264 265 static void vnc_update(VncState *vs, int x, int y, int w, int h) 266 { 267 struct VncSurface *s = &vs->guest; 268 int i; 269 270 h += y; 271 272 /* round x down to ensure the loop only spans one 16-pixel block per, 273 iteration. otherwise, if (x % 16) != 0, the last iteration may span 274 two 16-pixel blocks but we only mark the first as dirty 275 */ 276 w += (x % 16); 277 x -= (x % 16); 278 279 x = MIN(x, s->ds->width); 280 y = MIN(y, s->ds->height); 281 w = MIN(x + w, s->ds->width) - x; 282 h = MIN(h, s->ds->height); 283 284 for (; y < h; y++) 285 for (i = 0; i < w; i += 16) 286 vnc_set_bit(s->dirty[y], (x + i) / 16); 287 } 288 289 static void vnc_dpy_update(DisplayState *ds, int x, int y, int w, int h) 290 { 291 VncDisplay *vd = ds->opaque; 292 VncState *vs = vd->clients; 293 while (vs != NULL) { 294 vnc_update(vs, x, y, w, h); 295 vs = vs->next; 296 } 297 } 298 299 static void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h, 300 int32_t encoding) 301 { 302 vnc_write_u16(vs, x); 303 vnc_write_u16(vs, y); 304 vnc_write_u16(vs, w); 305 vnc_write_u16(vs, h); 306 307 vnc_write_s32(vs, encoding); 308 } 309 310 void buffer_reserve(Buffer *buffer, size_t len) 311 { 312 if ((buffer->capacity - buffer->offset) < len) { 313 buffer->capacity += (len + 1024); 314 buffer->buffer = g_realloc(buffer->buffer, buffer->capacity); 315 if (buffer->buffer == NULL) { 316 fprintf(stderr, "vnc: out of memory\n"); 317 exit(1); 318 } 319 } 320 } 321 322 int buffer_empty(Buffer *buffer) 323 { 324 return buffer->offset == 0; 325 } 326 327 uint8_t *buffer_end(Buffer *buffer) 328 { 329 return buffer->buffer + buffer->offset; 330 } 331 332 void buffer_reset(Buffer *buffer) 333 { 334 buffer->offset = 0; 335 } 336 337 void buffer_append(Buffer *buffer, const void *data, size_t len) 338 { 339 memcpy(buffer->buffer + buffer->offset, data, len); 340 buffer->offset += len; 341 } 342 343 static void vnc_resize(VncState *vs) 344 { 345 DisplayState *ds = vs->ds; 346 int size_changed; 347 348 /* guest surface */ 349 if (!vs->guest.ds) 350 vs->guest.ds = g_malloc0(sizeof(*vs->guest.ds)); 351 if (ds_get_bytes_per_pixel(ds) != vs->guest.ds->pf.bytes_per_pixel) 352 console_color_init(ds); 353 vnc_colordepth(vs); 354 size_changed = ds_get_width(ds) != vs->guest.ds->width || 355 ds_get_height(ds) != vs->guest.ds->height; 356 *(vs->guest.ds) = *(ds->surface); 357 if (size_changed) { 358 if (vs->csock != -1 && vnc_has_feature(vs, VNC_FEATURE_RESIZE)) { 359 vnc_write_u8(vs, 0); /* msg id */ 360 vnc_write_u8(vs, 0); 361 vnc_write_u16(vs, 1); /* number of rects */ 362 vnc_framebuffer_update(vs, 0, 0, ds_get_width(ds), ds_get_height(ds), 363 VNC_ENCODING_DESKTOPRESIZE); 364 vnc_flush(vs); 365 } 366 } 367 memset(vs->guest.dirty, 0xFF, sizeof(vs->guest.dirty)); 368 369 /* server surface */ 370 if (!vs->server.ds) 371 vs->server.ds = g_malloc0(sizeof(*vs->server.ds)); 372 if (vs->server.ds->data) 373 g_free(vs->server.ds->data); 374 *(vs->server.ds) = *(ds->surface); 375 vs->server.ds->data = g_malloc0(vs->server.ds->linesize * 376 vs->server.ds->height); 377 memset(vs->server.dirty, 0xFF, sizeof(vs->guest.dirty)); 378 } 379 380 static void vnc_dpy_resize(DisplayState *ds) 381 { 382 VncDisplay *vd = ds->opaque; 383 VncState *vs = vd->clients; 384 while (vs != NULL) { 385 vnc_resize(vs); 386 vs = vs->next; 387 } 388 } 389 390 /* fastest code */ 391 static void vnc_write_pixels_copy(VncState *vs, void *pixels, int size) 392 { 393 vnc_write(vs, pixels, size); 394 } 395 396 /* slowest but generic code. */ 397 static void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v) 398 { 399 uint8_t r, g, b; 400 401 r = ((((v & vs->server.ds->pf.rmask) >> vs->server.ds->pf.rshift) << vs->clientds.pf.rbits) >> 402 vs->server.ds->pf.rbits); 403 g = ((((v & vs->server.ds->pf.gmask) >> vs->server.ds->pf.gshift) << vs->clientds.pf.gbits) >> 404 vs->server.ds->pf.gbits); 405 b = ((((v & vs->server.ds->pf.bmask) >> vs->server.ds->pf.bshift) << vs->clientds.pf.bbits) >> 406 vs->server.ds->pf.bbits); 407 v = (r << vs->clientds.pf.rshift) | 408 (g << vs->clientds.pf.gshift) | 409 (b << vs->clientds.pf.bshift); 410 switch(vs->clientds.pf.bytes_per_pixel) { 411 case 1: 412 buf[0] = v; 413 break; 414 case 2: 415 if (vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) { 416 buf[0] = v >> 8; 417 buf[1] = v; 418 } else { 419 buf[1] = v >> 8; 420 buf[0] = v; 421 } 422 break; 423 default: 424 case 4: 425 if (vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) { 426 buf[0] = v >> 24; 427 buf[1] = v >> 16; 428 buf[2] = v >> 8; 429 buf[3] = v; 430 } else { 431 buf[3] = v >> 24; 432 buf[2] = v >> 16; 433 buf[1] = v >> 8; 434 buf[0] = v; 435 } 436 break; 437 } 438 } 439 440 static void vnc_write_pixels_generic(VncState *vs, void *pixels1, int size) 441 { 442 uint8_t buf[4]; 443 444 if (vs->server.ds->pf.bytes_per_pixel == 4) { 445 uint32_t *pixels = pixels1; 446 int n, i; 447 n = size >> 2; 448 for(i = 0; i < n; i++) { 449 vnc_convert_pixel(vs, buf, pixels[i]); 450 vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel); 451 } 452 } else if (vs->server.ds->pf.bytes_per_pixel == 2) { 453 uint16_t *pixels = pixels1; 454 int n, i; 455 n = size >> 1; 456 for(i = 0; i < n; i++) { 457 vnc_convert_pixel(vs, buf, pixels[i]); 458 vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel); 459 } 460 } else if (vs->server.ds->pf.bytes_per_pixel == 1) { 461 uint8_t *pixels = pixels1; 462 int n, i; 463 n = size; 464 for(i = 0; i < n; i++) { 465 vnc_convert_pixel(vs, buf, pixels[i]); 466 vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel); 467 } 468 } else { 469 fprintf(stderr, "vnc_write_pixels_generic: VncState color depth not supported\n"); 470 } 471 } 472 473 static void send_framebuffer_update_raw(VncState *vs, int x, int y, int w, int h) 474 { 475 int i; 476 uint8_t *row; 477 478 row = vs->server.ds->data + y * ds_get_linesize(vs->ds) + x * ds_get_bytes_per_pixel(vs->ds); 479 for (i = 0; i < h; i++) { 480 vs->write_pixels(vs, row, w * ds_get_bytes_per_pixel(vs->ds)); 481 row += ds_get_linesize(vs->ds); 482 } 483 } 484 485 static void hextile_enc_cord(uint8_t *ptr, int x, int y, int w, int h) 486 { 487 ptr[0] = ((x & 0x0F) << 4) | (y & 0x0F); 488 ptr[1] = (((w - 1) & 0x0F) << 4) | ((h - 1) & 0x0F); 489 } 490 491 #define BPP 8 492 #include "vnchextile.h" 493 #undef BPP 494 495 #define BPP 16 496 #include "vnchextile.h" 497 #undef BPP 498 499 #define BPP 32 500 #include "vnchextile.h" 501 #undef BPP 502 503 #define GENERIC 504 #define BPP 8 505 #include "vnchextile.h" 506 #undef BPP 507 #undef GENERIC 508 509 #define GENERIC 510 #define BPP 16 511 #include "vnchextile.h" 512 #undef BPP 513 #undef GENERIC 514 515 #define GENERIC 516 #define BPP 32 517 #include "vnchextile.h" 518 #undef BPP 519 #undef GENERIC 520 521 static void send_framebuffer_update_hextile(VncState *vs, int x, int y, int w, int h) 522 { 523 int i, j; 524 int has_fg, has_bg; 525 uint8_t *last_fg, *last_bg; 526 527 last_fg = (uint8_t *) g_malloc(vs->server.ds->pf.bytes_per_pixel); 528 last_bg = (uint8_t *) g_malloc(vs->server.ds->pf.bytes_per_pixel); 529 has_fg = has_bg = 0; 530 for (j = y; j < (y + h); j += 16) { 531 for (i = x; i < (x + w); i += 16) { 532 vs->send_hextile_tile(vs, i, j, 533 MIN(16, x + w - i), MIN(16, y + h - j), 534 last_bg, last_fg, &has_bg, &has_fg); 535 } 536 } 537 free(last_fg); 538 free(last_bg); 539 540 } 541 542 static void vnc_zlib_init(VncState *vs) 543 { 544 int i; 545 for (i=0; i<(sizeof(vs->zlib_stream) / sizeof(z_stream)); i++) 546 vs->zlib_stream[i].opaque = NULL; 547 } 548 549 static void vnc_zlib_start(VncState *vs) 550 { 551 buffer_reset(&vs->zlib); 552 553 // make the output buffer be the zlib buffer, so we can compress it later 554 vs->zlib_tmp = vs->output; 555 vs->output = vs->zlib; 556 } 557 558 static int vnc_zlib_stop(VncState *vs, int stream_id) 559 { 560 z_streamp zstream = &vs->zlib_stream[stream_id]; 561 int previous_out; 562 563 // switch back to normal output/zlib buffers 564 vs->zlib = vs->output; 565 vs->output = vs->zlib_tmp; 566 567 // compress the zlib buffer 568 569 // initialize the stream 570 // XXX need one stream per session 571 if (zstream->opaque != vs) { 572 int err; 573 574 VNC_DEBUG("VNC: initializing zlib stream %d\n", stream_id); 575 VNC_DEBUG("VNC: opaque = %p | vs = %p\n", zstream->opaque, vs); 576 zstream->zalloc = Z_NULL; 577 zstream->zfree = Z_NULL; 578 579 err = deflateInit2(zstream, vs->tight_compression, Z_DEFLATED, MAX_WBITS, 580 MAX_MEM_LEVEL, Z_DEFAULT_STRATEGY); 581 582 if (err != Z_OK) { 583 fprintf(stderr, "VNC: error initializing zlib\n"); 584 return -1; 585 } 586 587 zstream->opaque = vs; 588 } 589 590 // XXX what to do if tight_compression changed in between? 591 592 // reserve memory in output buffer 593 buffer_reserve(&vs->output, vs->zlib.offset + 64); 594 595 // set pointers 596 zstream->next_in = vs->zlib.buffer; 597 zstream->avail_in = vs->zlib.offset; 598 zstream->next_out = vs->output.buffer + vs->output.offset; 599 zstream->avail_out = vs->output.capacity - vs->output.offset; 600 zstream->data_type = Z_BINARY; 601 previous_out = zstream->total_out; 602 603 // start encoding 604 if (deflate(zstream, Z_SYNC_FLUSH) != Z_OK) { 605 fprintf(stderr, "VNC: error during zlib compression\n"); 606 return -1; 607 } 608 609 vs->output.offset = vs->output.capacity - zstream->avail_out; 610 return zstream->total_out - previous_out; 611 } 612 613 static void send_framebuffer_update_zlib(VncState *vs, int x, int y, int w, int h) 614 { 615 int old_offset, new_offset, bytes_written; 616 617 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_ZLIB); 618 619 // remember where we put in the follow-up size 620 old_offset = vs->output.offset; 621 vnc_write_s32(vs, 0); 622 623 // compress the stream 624 vnc_zlib_start(vs); 625 send_framebuffer_update_raw(vs, x, y, w, h); 626 bytes_written = vnc_zlib_stop(vs, 0); 627 628 if (bytes_written == -1) 629 return; 630 631 // hack in the size 632 new_offset = vs->output.offset; 633 vs->output.offset = old_offset; 634 vnc_write_u32(vs, bytes_written); 635 vs->output.offset = new_offset; 636 } 637 638 static void send_framebuffer_update(VncState *vs, int x, int y, int w, int h) 639 { 640 switch(vs->vnc_encoding) { 641 case VNC_ENCODING_ZLIB: 642 send_framebuffer_update_zlib(vs, x, y, w, h); 643 break; 644 case VNC_ENCODING_HEXTILE: 645 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE); 646 send_framebuffer_update_hextile(vs, x, y, w, h); 647 break; 648 default: 649 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW); 650 send_framebuffer_update_raw(vs, x, y, w, h); 651 break; 652 } 653 } 654 655 static void vnc_copy(VncState *vs, int src_x, int src_y, int dst_x, int dst_y, int w, int h) 656 { 657 vnc_write_u8(vs, 0); /* msg id */ 658 vnc_write_u8(vs, 0); 659 vnc_write_u16(vs, 1); /* number of rects */ 660 vnc_framebuffer_update(vs, dst_x, dst_y, w, h, VNC_ENCODING_COPYRECT); 661 vnc_write_u16(vs, src_x); 662 vnc_write_u16(vs, src_y); 663 vnc_flush(vs); 664 } 665 666 static void vnc_dpy_copy(DisplayState *ds, int src_x, int src_y, int dst_x, int dst_y, int w, int h) 667 { 668 VncDisplay *vd = ds->opaque; 669 VncState *vs, *vn; 670 671 for (vs = vd->clients; vs != NULL; vs = vn) { 672 vn = vs->next; 673 if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) { 674 vs->force_update = 1; 675 vnc_update_client(vs); 676 /* vs might be free()ed here */ 677 } 678 } 679 680 for (vs = vd->clients; vs != NULL; vs = vs->next) { 681 if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) 682 vnc_copy(vs, src_x, src_y, dst_x, dst_y, w, h); 683 else /* TODO */ 684 vnc_update(vs, dst_x, dst_y, w, h); 685 } 686 } 687 688 static int find_and_clear_dirty_height(struct VncSurface *s, 689 int y, int last_x, int x) 690 { 691 int h; 692 693 for (h = 1; h < (s->ds->height - y); h++) { 694 int tmp_x; 695 if (!vnc_get_bit(s->dirty[y + h], last_x)) 696 break; 697 for (tmp_x = last_x; tmp_x < x; tmp_x++) 698 vnc_clear_bit(s->dirty[y + h], tmp_x); 699 } 700 701 return h; 702 } 703 704 static void vnc_update_client(void *opaque) 705 { 706 VncState *vs = opaque; 707 if (vs->need_update && vs->csock != -1) { 708 int y; 709 uint8_t *guest_row; 710 uint8_t *server_row; 711 int cmp_bytes; 712 uint32_t width_mask[VNC_DIRTY_WORDS]; 713 int n_rectangles; 714 int saved_offset; 715 int has_dirty = 0; 716 717 if (vs->output.offset && !vs->audio_cap && !vs->force_update) { 718 /* kernel send buffers are full -> drop frames to throttle */ 719 timer_mod(vs->timer, qemu_clock_get_ms(QEMU_CLOCK_REALTIME) + VNC_REFRESH_INTERVAL); 720 return; 721 } 722 723 vga_hw_update(); 724 725 /* 726 * Walk through the guest dirty map. 727 * Check and copy modified bits from guest to server surface. 728 * Update server dirty map. 729 */ 730 vnc_set_bits(width_mask, (ds_get_width(vs->ds) / 16), VNC_DIRTY_WORDS); 731 cmp_bytes = 16 * ds_get_bytes_per_pixel(vs->ds); 732 guest_row = vs->guest.ds->data; 733 server_row = vs->server.ds->data; 734 for (y = 0; y < vs->guest.ds->height; y++) { 735 if (vnc_and_bits(vs->guest.dirty[y], width_mask, VNC_DIRTY_WORDS)) { 736 int x; 737 uint8_t *guest_ptr; 738 uint8_t *server_ptr; 739 740 guest_ptr = guest_row; 741 server_ptr = server_row; 742 743 for (x = 0; x < vs->guest.ds->width; 744 x += 16, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) { 745 if (!vnc_get_bit(vs->guest.dirty[y], (x / 16))) 746 continue; 747 vnc_clear_bit(vs->guest.dirty[y], (x / 16)); 748 if (memcmp(server_ptr, guest_ptr, cmp_bytes) == 0) 749 continue; 750 memcpy(server_ptr, guest_ptr, cmp_bytes); 751 vnc_set_bit(vs->server.dirty[y], (x / 16)); 752 has_dirty++; 753 } 754 } 755 guest_row += ds_get_linesize(vs->ds); 756 server_row += ds_get_linesize(vs->ds); 757 } 758 759 if (!has_dirty && !vs->audio_cap && !vs->force_update) { 760 timer_mod(vs->timer, qemu_clock_get_ms(QEMU_CLOCK_REALTIME) + VNC_REFRESH_INTERVAL); 761 return; 762 } 763 764 /* 765 * Send screen updates to the vnc client using the server 766 * surface and server dirty map. guest surface updates 767 * happening in parallel don't disturb us, the next pass will 768 * send them to the client. 769 */ 770 n_rectangles = 0; 771 vnc_write_u8(vs, 0); /* msg id */ 772 vnc_write_u8(vs, 0); 773 saved_offset = vs->output.offset; 774 vnc_write_u16(vs, 0); 775 776 for (y = 0; y < vs->server.ds->height; y++) { 777 int x; 778 int last_x = -1; 779 for (x = 0; x < vs->server.ds->width / 16; x++) { 780 if (vnc_get_bit(vs->server.dirty[y], x)) { 781 if (last_x == -1) { 782 last_x = x; 783 } 784 vnc_clear_bit(vs->server.dirty[y], x); 785 } else { 786 if (last_x != -1) { 787 int h = find_and_clear_dirty_height(&vs->server, y, last_x, x); 788 send_framebuffer_update(vs, last_x * 16, y, (x - last_x) * 16, h); 789 n_rectangles++; 790 } 791 last_x = -1; 792 } 793 } 794 if (last_x != -1) { 795 int h = find_and_clear_dirty_height(&vs->server, y, last_x, x); 796 send_framebuffer_update(vs, last_x * 16, y, (x - last_x) * 16, h); 797 n_rectangles++; 798 } 799 } 800 vs->output.buffer[saved_offset] = (n_rectangles >> 8) & 0xFF; 801 vs->output.buffer[saved_offset + 1] = n_rectangles & 0xFF; 802 vnc_flush(vs); 803 vs->force_update = 0; 804 805 } 806 807 if (vs->csock != -1) { 808 timer_mod(vs->timer, qemu_clock_get_ms(QEMU_CLOCK_REALTIME) + VNC_REFRESH_INTERVAL); 809 } else { 810 vnc_disconnect_finish(vs); 811 } 812 813 } 814 815 /* audio */ 816 static void audio_capture_notify(void *opaque, audcnotification_e cmd) 817 { 818 VncState *vs = opaque; 819 820 switch (cmd) { 821 case AUD_CNOTIFY_DISABLE: 822 vnc_write_u8(vs, 255); 823 vnc_write_u8(vs, 1); 824 vnc_write_u16(vs, 0); 825 vnc_flush(vs); 826 break; 827 828 case AUD_CNOTIFY_ENABLE: 829 vnc_write_u8(vs, 255); 830 vnc_write_u8(vs, 1); 831 vnc_write_u16(vs, 1); 832 vnc_flush(vs); 833 break; 834 } 835 } 836 837 static void audio_capture_destroy(void *opaque) 838 { 839 } 840 841 static void audio_capture(void *opaque, void *buf, int size) 842 { 843 VncState *vs = opaque; 844 845 vnc_write_u8(vs, 255); 846 vnc_write_u8(vs, 1); 847 vnc_write_u16(vs, 2); 848 vnc_write_u32(vs, size); 849 vnc_write(vs, buf, size); 850 vnc_flush(vs); 851 } 852 853 static void audio_add(VncState *vs) 854 { 855 Monitor *mon = cur_mon; 856 struct audio_capture_ops ops; 857 858 if (vs->audio_cap) { 859 monitor_printf(mon, "audio already running\n"); 860 return; 861 } 862 863 ops.notify = audio_capture_notify; 864 ops.destroy = audio_capture_destroy; 865 ops.capture = audio_capture; 866 867 vs->audio_cap = AUD_add_capture(&vs->as, &ops, vs); 868 if (!vs->audio_cap) { 869 monitor_printf(mon, "Failed to add audio capture\n"); 870 } 871 } 872 873 static void audio_del(VncState *vs) 874 { 875 if (vs->audio_cap) { 876 AUD_del_capture(vs->audio_cap, vs); 877 vs->audio_cap = NULL; 878 } 879 } 880 881 static void vnc_disconnect_start(VncState *vs) 882 { 883 if (vs->csock == -1) 884 return; 885 qemu_set_fd_handler2(vs->csock, NULL, NULL, NULL, NULL); 886 closesocket(vs->csock); 887 vs->csock = -1; 888 } 889 890 static void vnc_disconnect_finish(VncState *vs) 891 { 892 timer_del(vs->timer); 893 timer_free(vs->timer); 894 if (vs->input.buffer) g_free(vs->input.buffer); 895 if (vs->output.buffer) g_free(vs->output.buffer); 896 #ifdef CONFIG_VNC_TLS 897 vnc_tls_client_cleanup(vs); 898 #endif /* CONFIG_VNC_TLS */ 899 #ifdef CONFIG_VNC_SASL 900 vnc_sasl_client_cleanup(vs); 901 #endif /* CONFIG_VNC_SASL */ 902 audio_del(vs); 903 904 VncState *p, *parent = NULL; 905 for (p = vs->vd->clients; p != NULL; p = p->next) { 906 if (p == vs) { 907 if (parent) 908 parent->next = p->next; 909 else 910 vs->vd->clients = p->next; 911 break; 912 } 913 parent = p; 914 } 915 if (!vs->vd->clients) 916 dcl->idle = 1; 917 918 g_free(vs->server.ds->data); 919 g_free(vs->server.ds); 920 g_free(vs->guest.ds); 921 g_free(vs); 922 } 923 924 int vnc_client_io_error(VncState *vs, int ret, int last_errno) 925 { 926 if (ret == 0 || ret == -1) { 927 if (ret == -1) { 928 switch (last_errno) { 929 case EINTR: 930 case EAGAIN: 931 #ifdef _WIN32 932 case WSAEWOULDBLOCK: 933 #endif 934 return 0; 935 default: 936 break; 937 } 938 } 939 940 VNC_DEBUG("Closing down client sock: ret %d, errno %d\n", 941 ret, ret < 0 ? last_errno : 0); 942 vnc_disconnect_start(vs); 943 944 return 0; 945 } 946 return ret; 947 } 948 949 950 void vnc_client_error(VncState *vs) 951 { 952 VNC_DEBUG("Closing down client sock: protocol error\n"); 953 vnc_disconnect_start(vs); 954 } 955 956 957 /* 958 * Called to write a chunk of data to the client socket. The data may 959 * be the raw data, or may have already been encoded by SASL. 960 * The data will be written either straight onto the socket, or 961 * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled 962 * 963 * NB, it is theoretically possible to have 2 layers of encryption, 964 * both SASL, and this TLS layer. It is highly unlikely in practice 965 * though, since SASL encryption will typically be a no-op if TLS 966 * is active 967 * 968 * Returns the number of bytes written, which may be less than 969 * the requested 'datalen' if the socket would block. Returns 970 * -1 on error, and disconnects the client socket. 971 */ 972 long vnc_client_write_buf(VncState *vs, const uint8_t *data, size_t datalen) 973 { 974 long ret; 975 #ifdef CONFIG_VNC_TLS 976 if (vs->tls.session) { 977 ret = gnutls_write(vs->tls.session, data, datalen); 978 if (ret < 0) { 979 if (ret == GNUTLS_E_AGAIN) 980 errno = EAGAIN; 981 else 982 errno = EIO; 983 ret = -1; 984 } 985 } else 986 #endif /* CONFIG_VNC_TLS */ 987 ret = send(vs->csock, (const void *)data, datalen, 0); 988 VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data, datalen, ret); 989 return vnc_client_io_error(vs, ret, socket_error()); 990 } 991 992 993 /* 994 * Called to write buffered data to the client socket, when not 995 * using any SASL SSF encryption layers. Will write as much data 996 * as possible without blocking. If all buffered data is written, 997 * will switch the FD poll() handler back to read monitoring. 998 * 999 * Returns the number of bytes written, which may be less than 1000 * the buffered output data if the socket would block. Returns 1001 * -1 on error, and disconnects the client socket. 1002 */ 1003 static long vnc_client_write_plain(VncState *vs) 1004 { 1005 long ret; 1006 1007 #ifdef CONFIG_VNC_SASL 1008 VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n", 1009 vs->output.buffer, vs->output.capacity, vs->output.offset, 1010 vs->sasl.waitWriteSSF); 1011 1012 if (vs->sasl.conn && 1013 vs->sasl.runSSF && 1014 vs->sasl.waitWriteSSF) { 1015 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF); 1016 if (ret) 1017 vs->sasl.waitWriteSSF -= ret; 1018 } else 1019 #endif /* CONFIG_VNC_SASL */ 1020 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset); 1021 if (!ret) 1022 return 0; 1023 1024 memmove(vs->output.buffer, vs->output.buffer + ret, (vs->output.offset - ret)); 1025 vs->output.offset -= ret; 1026 1027 if (vs->output.offset == 0) { 1028 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs); 1029 } 1030 1031 return ret; 1032 } 1033 1034 1035 /* 1036 * First function called whenever there is data to be written to 1037 * the client socket. Will delegate actual work according to whether 1038 * SASL SSF layers are enabled (thus requiring encryption calls) 1039 */ 1040 void vnc_client_write(void *opaque) 1041 { 1042 long ret; 1043 VncState *vs = opaque; 1044 1045 #ifdef CONFIG_VNC_SASL 1046 if (vs->sasl.conn && 1047 vs->sasl.runSSF && 1048 !vs->sasl.waitWriteSSF) 1049 ret = vnc_client_write_sasl(vs); 1050 else 1051 #endif /* CONFIG_VNC_SASL */ 1052 ret = vnc_client_write_plain(vs); 1053 } 1054 1055 void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting) 1056 { 1057 vs->read_handler = func; 1058 vs->read_handler_expect = expecting; 1059 } 1060 1061 1062 /* 1063 * Called to read a chunk of data from the client socket. The data may 1064 * be the raw data, or may need to be further decoded by SASL. 1065 * The data will be read either straight from to the socket, or 1066 * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled 1067 * 1068 * NB, it is theoretically possible to have 2 layers of encryption, 1069 * both SASL, and this TLS layer. It is highly unlikely in practice 1070 * though, since SASL encryption will typically be a no-op if TLS 1071 * is active 1072 * 1073 * Returns the number of bytes read, which may be less than 1074 * the requested 'datalen' if the socket would block. Returns 1075 * -1 on error, and disconnects the client socket. 1076 */ 1077 long vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen) 1078 { 1079 long ret; 1080 #ifdef CONFIG_VNC_TLS 1081 if (vs->tls.session) { 1082 ret = gnutls_read(vs->tls.session, data, datalen); 1083 if (ret < 0) { 1084 if (ret == GNUTLS_E_AGAIN) 1085 errno = EAGAIN; 1086 else 1087 errno = EIO; 1088 ret = -1; 1089 } 1090 } else 1091 #endif /* CONFIG_VNC_TLS */ 1092 ret = recv(vs->csock, (void *)data, datalen, 0); 1093 VNC_DEBUG("Read wire %p %zd -> %ld\n", data, datalen, ret); 1094 return vnc_client_io_error(vs, ret, socket_error()); 1095 } 1096 1097 1098 /* 1099 * Called to read data from the client socket to the input buffer, 1100 * when not using any SASL SSF encryption layers. Will read as much 1101 * data as possible without blocking. 1102 * 1103 * Returns the number of bytes read. Returns -1 on error, and 1104 * disconnects the client socket. 1105 */ 1106 static long vnc_client_read_plain(VncState *vs) 1107 { 1108 int ret; 1109 VNC_DEBUG("Read plain %p size %zd offset %zd\n", 1110 vs->input.buffer, vs->input.capacity, vs->input.offset); 1111 buffer_reserve(&vs->input, 4096); 1112 ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096); 1113 if (!ret) 1114 return 0; 1115 vs->input.offset += ret; 1116 return ret; 1117 } 1118 1119 1120 /* 1121 * First function called whenever there is more data to be read from 1122 * the client socket. Will delegate actual work according to whether 1123 * SASL SSF layers are enabled (thus requiring decryption calls) 1124 */ 1125 void vnc_client_read(void *opaque) 1126 { 1127 VncState *vs = opaque; 1128 long ret; 1129 1130 #ifdef CONFIG_VNC_SASL 1131 if (vs->sasl.conn && vs->sasl.runSSF) 1132 ret = vnc_client_read_sasl(vs); 1133 else 1134 #endif /* CONFIG_VNC_SASL */ 1135 ret = vnc_client_read_plain(vs); 1136 if (!ret) { 1137 if (vs->csock == -1) 1138 vnc_disconnect_finish(vs); 1139 return; 1140 } 1141 1142 while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) { 1143 size_t len = vs->read_handler_expect; 1144 int ret; 1145 1146 ret = vs->read_handler(vs, vs->input.buffer, len); 1147 if (vs->csock == -1) { 1148 vnc_disconnect_finish(vs); 1149 return; 1150 } 1151 1152 if (!ret) { 1153 memmove(vs->input.buffer, vs->input.buffer + len, (vs->input.offset - len)); 1154 vs->input.offset -= len; 1155 } else { 1156 vs->read_handler_expect = ret; 1157 } 1158 } 1159 } 1160 1161 void vnc_write(VncState *vs, const void *data, size_t len) 1162 { 1163 buffer_reserve(&vs->output, len); 1164 1165 if (vs->csock != -1 && buffer_empty(&vs->output)) { 1166 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, vnc_client_write, vs); 1167 } 1168 1169 buffer_append(&vs->output, data, len); 1170 } 1171 1172 void vnc_write_s32(VncState *vs, int32_t value) 1173 { 1174 vnc_write_u32(vs, *(uint32_t *)&value); 1175 } 1176 1177 void vnc_write_u32(VncState *vs, uint32_t value) 1178 { 1179 uint8_t buf[4]; 1180 1181 buf[0] = (value >> 24) & 0xFF; 1182 buf[1] = (value >> 16) & 0xFF; 1183 buf[2] = (value >> 8) & 0xFF; 1184 buf[3] = value & 0xFF; 1185 1186 vnc_write(vs, buf, 4); 1187 } 1188 1189 void vnc_write_u16(VncState *vs, uint16_t value) 1190 { 1191 uint8_t buf[2]; 1192 1193 buf[0] = (value >> 8) & 0xFF; 1194 buf[1] = value & 0xFF; 1195 1196 vnc_write(vs, buf, 2); 1197 } 1198 1199 void vnc_write_u8(VncState *vs, uint8_t value) 1200 { 1201 vnc_write(vs, (char *)&value, 1); 1202 } 1203 1204 void vnc_flush(VncState *vs) 1205 { 1206 if (vs->csock != -1 && vs->output.offset) 1207 vnc_client_write(vs); 1208 } 1209 1210 uint8_t read_u8(uint8_t *data, size_t offset) 1211 { 1212 return data[offset]; 1213 } 1214 1215 uint16_t read_u16(uint8_t *data, size_t offset) 1216 { 1217 return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF); 1218 } 1219 1220 int32_t read_s32(uint8_t *data, size_t offset) 1221 { 1222 return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) | 1223 (data[offset + 2] << 8) | data[offset + 3]); 1224 } 1225 1226 uint32_t read_u32(uint8_t *data, size_t offset) 1227 { 1228 return ((data[offset] << 24) | (data[offset + 1] << 16) | 1229 (data[offset + 2] << 8) | data[offset + 3]); 1230 } 1231 1232 static void client_cut_text(VncState *vs, size_t len, uint8_t *text) 1233 { 1234 } 1235 1236 static void check_pointer_type_change(VncState *vs, int absolute) 1237 { 1238 if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) { 1239 vnc_write_u8(vs, 0); 1240 vnc_write_u8(vs, 0); 1241 vnc_write_u16(vs, 1); 1242 vnc_framebuffer_update(vs, absolute, 0, 1243 ds_get_width(vs->ds), ds_get_height(vs->ds), 1244 VNC_ENCODING_POINTER_TYPE_CHANGE); 1245 vnc_flush(vs); 1246 } 1247 vs->absolute = absolute; 1248 } 1249 1250 static void pointer_event(VncState *vs, int button_mask, int x, int y) 1251 { 1252 int buttons = 0; 1253 int dz = 0; 1254 1255 if (button_mask & 0x01) 1256 buttons |= MOUSE_EVENT_LBUTTON; 1257 if (button_mask & 0x02) 1258 buttons |= MOUSE_EVENT_MBUTTON; 1259 if (button_mask & 0x04) 1260 buttons |= MOUSE_EVENT_RBUTTON; 1261 if (button_mask & 0x08) 1262 dz = -1; 1263 if (button_mask & 0x10) 1264 dz = 1; 1265 1266 if (vs->absolute) { 1267 kbd_mouse_event(x * 0x7FFF / (ds_get_width(vs->ds) - 1), 1268 y * 0x7FFF / (ds_get_height(vs->ds) - 1), 1269 dz, buttons); 1270 } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) { 1271 x -= 0x7FFF; 1272 y -= 0x7FFF; 1273 1274 kbd_mouse_event(x, y, dz, buttons); 1275 } else { 1276 if (vs->last_x != -1) 1277 kbd_mouse_event(x - vs->last_x, 1278 y - vs->last_y, 1279 dz, buttons); 1280 vs->last_x = x; 1281 vs->last_y = y; 1282 } 1283 1284 check_pointer_type_change(vs, kbd_mouse_is_absolute()); 1285 } 1286 1287 static void reset_keys(VncState *vs) 1288 { 1289 int i; 1290 for(i = 0; i < 256; i++) { 1291 if (vs->modifiers_state[i]) { 1292 if (i & 0x80) 1293 kbd_put_keycode(0xe0); 1294 kbd_put_keycode(i | 0x80); 1295 vs->modifiers_state[i] = 0; 1296 } 1297 } 1298 } 1299 1300 static void press_key(VncState *vs, int keysym) 1301 { 1302 kbd_put_keycode(keysym2scancode(vs->vd->kbd_layout, keysym) & 0x7f); 1303 kbd_put_keycode(keysym2scancode(vs->vd->kbd_layout, keysym) | 0x80); 1304 } 1305 1306 static void do_key_event(VncState *vs, int down, int keycode, int sym) 1307 { 1308 /* QEMU console switch */ 1309 switch(keycode) { 1310 case 0x2a: /* Left Shift */ 1311 case 0x36: /* Right Shift */ 1312 case 0x1d: /* Left CTRL */ 1313 case 0x9d: /* Right CTRL */ 1314 case 0x38: /* Left ALT */ 1315 case 0xb8: /* Right ALT */ 1316 if (down) 1317 vs->modifiers_state[keycode] = 1; 1318 else 1319 vs->modifiers_state[keycode] = 0; 1320 break; 1321 case 0x02 ... 0x0a: /* '1' to '9' keys */ 1322 if (down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) { 1323 /* Reset the modifiers sent to the current console */ 1324 reset_keys(vs); 1325 console_select(keycode - 0x02); 1326 return; 1327 } 1328 break; 1329 case 0x3a: /* CapsLock */ 1330 case 0x45: /* NumLock */ 1331 if (!down) 1332 vs->modifiers_state[keycode] ^= 1; 1333 break; 1334 } 1335 1336 if (keycode_is_keypad(vs->vd->kbd_layout, keycode)) { 1337 /* If the numlock state needs to change then simulate an additional 1338 keypress before sending this one. This will happen if the user 1339 toggles numlock away from the VNC window. 1340 */ 1341 if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) { 1342 if (!vs->modifiers_state[0x45]) { 1343 vs->modifiers_state[0x45] = 1; 1344 press_key(vs, 0xff7f); 1345 } 1346 } else { 1347 if (vs->modifiers_state[0x45]) { 1348 vs->modifiers_state[0x45] = 0; 1349 press_key(vs, 0xff7f); 1350 } 1351 } 1352 } 1353 1354 if (is_graphic_console()) { 1355 if (keycode & 0x80) 1356 kbd_put_keycode(0xe0); 1357 if (down) 1358 kbd_put_keycode(keycode & 0x7f); 1359 else 1360 kbd_put_keycode(keycode | 0x80); 1361 } else { 1362 /* QEMU console emulation */ 1363 if (down) { 1364 int numlock = vs->modifiers_state[0x45]; 1365 switch (keycode) { 1366 case 0x2a: /* Left Shift */ 1367 case 0x36: /* Right Shift */ 1368 case 0x1d: /* Left CTRL */ 1369 case 0x9d: /* Right CTRL */ 1370 case 0x38: /* Left ALT */ 1371 case 0xb8: /* Right ALT */ 1372 break; 1373 case 0xc8: 1374 kbd_put_keysym(QEMU_KEY_UP); 1375 break; 1376 case 0xd0: 1377 kbd_put_keysym(QEMU_KEY_DOWN); 1378 break; 1379 case 0xcb: 1380 kbd_put_keysym(QEMU_KEY_LEFT); 1381 break; 1382 case 0xcd: 1383 kbd_put_keysym(QEMU_KEY_RIGHT); 1384 break; 1385 case 0xd3: 1386 kbd_put_keysym(QEMU_KEY_DELETE); 1387 break; 1388 case 0xc7: 1389 kbd_put_keysym(QEMU_KEY_HOME); 1390 break; 1391 case 0xcf: 1392 kbd_put_keysym(QEMU_KEY_END); 1393 break; 1394 case 0xc9: 1395 kbd_put_keysym(QEMU_KEY_PAGEUP); 1396 break; 1397 case 0xd1: 1398 kbd_put_keysym(QEMU_KEY_PAGEDOWN); 1399 break; 1400 1401 case 0x47: 1402 kbd_put_keysym(numlock ? '7' : QEMU_KEY_HOME); 1403 break; 1404 case 0x48: 1405 kbd_put_keysym(numlock ? '8' : QEMU_KEY_UP); 1406 break; 1407 case 0x49: 1408 kbd_put_keysym(numlock ? '9' : QEMU_KEY_PAGEUP); 1409 break; 1410 case 0x4b: 1411 kbd_put_keysym(numlock ? '4' : QEMU_KEY_LEFT); 1412 break; 1413 case 0x4c: 1414 kbd_put_keysym('5'); 1415 break; 1416 case 0x4d: 1417 kbd_put_keysym(numlock ? '6' : QEMU_KEY_RIGHT); 1418 break; 1419 case 0x4f: 1420 kbd_put_keysym(numlock ? '1' : QEMU_KEY_END); 1421 break; 1422 case 0x50: 1423 kbd_put_keysym(numlock ? '2' : QEMU_KEY_DOWN); 1424 break; 1425 case 0x51: 1426 kbd_put_keysym(numlock ? '3' : QEMU_KEY_PAGEDOWN); 1427 break; 1428 case 0x52: 1429 kbd_put_keysym('0'); 1430 break; 1431 case 0x53: 1432 kbd_put_keysym(numlock ? '.' : QEMU_KEY_DELETE); 1433 break; 1434 1435 case 0xb5: 1436 kbd_put_keysym('/'); 1437 break; 1438 case 0x37: 1439 kbd_put_keysym('*'); 1440 break; 1441 case 0x4a: 1442 kbd_put_keysym('-'); 1443 break; 1444 case 0x4e: 1445 kbd_put_keysym('+'); 1446 break; 1447 case 0x9c: 1448 kbd_put_keysym('\n'); 1449 break; 1450 1451 default: 1452 kbd_put_keysym(sym); 1453 break; 1454 } 1455 } 1456 } 1457 } 1458 1459 static void key_event(VncState *vs, int down, uint32_t sym) 1460 { 1461 int keycode; 1462 1463 if (sym >= 'A' && sym <= 'Z' && is_graphic_console()) 1464 sym = sym - 'A' + 'a'; 1465 1466 keycode = keysym2scancode(vs->vd->kbd_layout, sym & 0xFFFF); 1467 do_key_event(vs, down, keycode, sym); 1468 } 1469 1470 static void ext_key_event(VncState *vs, int down, 1471 uint32_t sym, uint16_t keycode) 1472 { 1473 /* if the user specifies a keyboard layout, always use it */ 1474 if (keyboard_layout) 1475 key_event(vs, down, sym); 1476 else 1477 do_key_event(vs, down, keycode, sym); 1478 } 1479 1480 static void framebuffer_update_request(VncState *vs, int incremental, 1481 int x_position, int y_position, 1482 int w, int h) 1483 { 1484 if (x_position > ds_get_width(vs->ds)) 1485 x_position = ds_get_width(vs->ds); 1486 if (y_position > ds_get_height(vs->ds)) 1487 y_position = ds_get_height(vs->ds); 1488 if (x_position + w >= ds_get_width(vs->ds)) 1489 w = ds_get_width(vs->ds) - x_position; 1490 if (y_position + h >= ds_get_height(vs->ds)) 1491 h = ds_get_height(vs->ds) - y_position; 1492 1493 int i; 1494 vs->need_update = 1; 1495 if (!incremental) { 1496 vs->force_update = 1; 1497 for (i = 0; i < h; i++) { 1498 vnc_set_bits(vs->guest.dirty[y_position + i], 1499 (ds_get_width(vs->ds) / 16), VNC_DIRTY_WORDS); 1500 vnc_set_bits(vs->server.dirty[y_position + i], 1501 (ds_get_width(vs->ds) / 16), VNC_DIRTY_WORDS); 1502 } 1503 } 1504 } 1505 1506 static void send_ext_key_event_ack(VncState *vs) 1507 { 1508 vnc_write_u8(vs, 0); 1509 vnc_write_u8(vs, 0); 1510 vnc_write_u16(vs, 1); 1511 vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds), 1512 VNC_ENCODING_EXT_KEY_EVENT); 1513 vnc_flush(vs); 1514 } 1515 1516 static void send_ext_audio_ack(VncState *vs) 1517 { 1518 vnc_write_u8(vs, 0); 1519 vnc_write_u8(vs, 0); 1520 vnc_write_u16(vs, 1); 1521 vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds), 1522 VNC_ENCODING_AUDIO); 1523 vnc_flush(vs); 1524 } 1525 1526 static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings) 1527 { 1528 int i; 1529 unsigned int enc = 0; 1530 1531 vnc_zlib_init(vs); 1532 vs->features = 0; 1533 vs->vnc_encoding = 0; 1534 vs->tight_compression = 9; 1535 vs->tight_quality = 9; 1536 vs->absolute = -1; 1537 1538 for (i = n_encodings - 1; i >= 0; i--) { 1539 enc = encodings[i]; 1540 switch (enc) { 1541 case VNC_ENCODING_RAW: 1542 vs->vnc_encoding = enc; 1543 break; 1544 case VNC_ENCODING_COPYRECT: 1545 vs->features |= VNC_FEATURE_COPYRECT_MASK; 1546 break; 1547 case VNC_ENCODING_HEXTILE: 1548 vs->features |= VNC_FEATURE_HEXTILE_MASK; 1549 vs->vnc_encoding = enc; 1550 break; 1551 case VNC_ENCODING_ZLIB: 1552 vs->features |= VNC_FEATURE_ZLIB_MASK; 1553 vs->vnc_encoding = enc; 1554 break; 1555 case VNC_ENCODING_DESKTOPRESIZE: 1556 vs->features |= VNC_FEATURE_RESIZE_MASK; 1557 break; 1558 case VNC_ENCODING_POINTER_TYPE_CHANGE: 1559 vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK; 1560 break; 1561 case VNC_ENCODING_EXT_KEY_EVENT: 1562 send_ext_key_event_ack(vs); 1563 break; 1564 case VNC_ENCODING_AUDIO: 1565 send_ext_audio_ack(vs); 1566 break; 1567 case VNC_ENCODING_WMVi: 1568 vs->features |= VNC_FEATURE_WMVI_MASK; 1569 break; 1570 case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9: 1571 vs->tight_compression = (enc & 0x0F); 1572 break; 1573 case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9: 1574 vs->tight_quality = (enc & 0x0F); 1575 break; 1576 default: 1577 VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc); 1578 break; 1579 } 1580 } 1581 1582 check_pointer_type_change(vs, kbd_mouse_is_absolute()); 1583 } 1584 1585 static void set_pixel_conversion(VncState *vs) 1586 { 1587 if ((vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) == 1588 (vs->ds->surface->flags & QEMU_BIG_ENDIAN_FLAG) && 1589 !memcmp(&(vs->clientds.pf), &(vs->ds->surface->pf), sizeof(PixelFormat))) { 1590 vs->write_pixels = vnc_write_pixels_copy; 1591 switch (vs->ds->surface->pf.bits_per_pixel) { 1592 case 8: 1593 vs->send_hextile_tile = send_hextile_tile_8; 1594 break; 1595 case 16: 1596 vs->send_hextile_tile = send_hextile_tile_16; 1597 break; 1598 case 32: 1599 vs->send_hextile_tile = send_hextile_tile_32; 1600 break; 1601 } 1602 } else { 1603 vs->write_pixels = vnc_write_pixels_generic; 1604 switch (vs->ds->surface->pf.bits_per_pixel) { 1605 case 8: 1606 vs->send_hextile_tile = send_hextile_tile_generic_8; 1607 break; 1608 case 16: 1609 vs->send_hextile_tile = send_hextile_tile_generic_16; 1610 break; 1611 case 32: 1612 vs->send_hextile_tile = send_hextile_tile_generic_32; 1613 break; 1614 } 1615 } 1616 } 1617 1618 static void set_pixel_format(VncState *vs, 1619 int bits_per_pixel, int depth, 1620 int big_endian_flag, int true_color_flag, 1621 int red_max, int green_max, int blue_max, 1622 int red_shift, int green_shift, int blue_shift) 1623 { 1624 if (!true_color_flag) { 1625 vnc_client_error(vs); 1626 return; 1627 } 1628 1629 vs->clientds = *(vs->guest.ds); 1630 vs->clientds.pf.rmax = red_max; 1631 count_bits(vs->clientds.pf.rbits, red_max); 1632 vs->clientds.pf.rshift = red_shift; 1633 vs->clientds.pf.rmask = red_max << red_shift; 1634 vs->clientds.pf.gmax = green_max; 1635 count_bits(vs->clientds.pf.gbits, green_max); 1636 vs->clientds.pf.gshift = green_shift; 1637 vs->clientds.pf.gmask = green_max << green_shift; 1638 vs->clientds.pf.bmax = blue_max; 1639 count_bits(vs->clientds.pf.bbits, blue_max); 1640 vs->clientds.pf.bshift = blue_shift; 1641 vs->clientds.pf.bmask = blue_max << blue_shift; 1642 vs->clientds.pf.bits_per_pixel = bits_per_pixel; 1643 vs->clientds.pf.bytes_per_pixel = bits_per_pixel / 8; 1644 vs->clientds.pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel; 1645 vs->clientds.flags = big_endian_flag ? QEMU_BIG_ENDIAN_FLAG : 0x00; 1646 1647 set_pixel_conversion(vs); 1648 1649 vga_hw_invalidate(); 1650 vga_hw_update(); 1651 } 1652 1653 static void pixel_format_message (VncState *vs) { 1654 char pad[3] = { 0, 0, 0 }; 1655 1656 vnc_write_u8(vs, vs->ds->surface->pf.bits_per_pixel); /* bits-per-pixel */ 1657 vnc_write_u8(vs, vs->ds->surface->pf.depth); /* depth */ 1658 1659 #ifdef HOST_WORDS_BIGENDIAN 1660 vnc_write_u8(vs, 1); /* big-endian-flag */ 1661 #else 1662 vnc_write_u8(vs, 0); /* big-endian-flag */ 1663 #endif 1664 vnc_write_u8(vs, 1); /* true-color-flag */ 1665 vnc_write_u16(vs, vs->ds->surface->pf.rmax); /* red-max */ 1666 vnc_write_u16(vs, vs->ds->surface->pf.gmax); /* green-max */ 1667 vnc_write_u16(vs, vs->ds->surface->pf.bmax); /* blue-max */ 1668 vnc_write_u8(vs, vs->ds->surface->pf.rshift); /* red-shift */ 1669 vnc_write_u8(vs, vs->ds->surface->pf.gshift); /* green-shift */ 1670 vnc_write_u8(vs, vs->ds->surface->pf.bshift); /* blue-shift */ 1671 if (vs->ds->surface->pf.bits_per_pixel == 32) 1672 vs->send_hextile_tile = send_hextile_tile_32; 1673 else if (vs->ds->surface->pf.bits_per_pixel == 16) 1674 vs->send_hextile_tile = send_hextile_tile_16; 1675 else if (vs->ds->surface->pf.bits_per_pixel == 8) 1676 vs->send_hextile_tile = send_hextile_tile_8; 1677 vs->clientds = *(vs->ds->surface); 1678 vs->clientds.flags &= ~QEMU_ALLOCATED_FLAG; 1679 vs->write_pixels = vnc_write_pixels_copy; 1680 1681 vnc_write(vs, pad, 3); /* padding */ 1682 } 1683 1684 static void vnc_dpy_setdata(DisplayState *ds) 1685 { 1686 /* We don't have to do anything */ 1687 } 1688 1689 static void vnc_colordepth(VncState *vs) 1690 { 1691 if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) { 1692 /* Sending a WMVi message to notify the client*/ 1693 vnc_write_u8(vs, 0); /* msg id */ 1694 vnc_write_u8(vs, 0); 1695 vnc_write_u16(vs, 1); /* number of rects */ 1696 vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), 1697 ds_get_height(vs->ds), VNC_ENCODING_WMVi); 1698 pixel_format_message(vs); 1699 vnc_flush(vs); 1700 } else { 1701 set_pixel_conversion(vs); 1702 } 1703 } 1704 1705 static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len) 1706 { 1707 int i; 1708 uint16_t limit; 1709 1710 switch (data[0]) { 1711 case 0: 1712 if (len == 1) 1713 return 20; 1714 1715 set_pixel_format(vs, read_u8(data, 4), read_u8(data, 5), 1716 read_u8(data, 6), read_u8(data, 7), 1717 read_u16(data, 8), read_u16(data, 10), 1718 read_u16(data, 12), read_u8(data, 14), 1719 read_u8(data, 15), read_u8(data, 16)); 1720 break; 1721 case 2: 1722 if (len == 1) 1723 return 4; 1724 1725 if (len == 4) { 1726 limit = read_u16(data, 2); 1727 if (limit > 0) 1728 return 4 + (limit * 4); 1729 } else 1730 limit = read_u16(data, 2); 1731 1732 for (i = 0; i < limit; i++) { 1733 int32_t val = read_s32(data, 4 + (i * 4)); 1734 memcpy(data + 4 + (i * 4), &val, sizeof(val)); 1735 } 1736 1737 set_encodings(vs, (int32_t *)(data + 4), limit); 1738 break; 1739 case 3: 1740 if (len == 1) 1741 return 10; 1742 1743 framebuffer_update_request(vs, 1744 read_u8(data, 1), read_u16(data, 2), read_u16(data, 4), 1745 read_u16(data, 6), read_u16(data, 8)); 1746 break; 1747 case 4: 1748 if (len == 1) 1749 return 8; 1750 1751 key_event(vs, read_u8(data, 1), read_u32(data, 4)); 1752 break; 1753 case 5: 1754 if (len == 1) 1755 return 6; 1756 1757 pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4)); 1758 break; 1759 case 6: 1760 if (len == 1) 1761 return 8; 1762 1763 if (len == 8) { 1764 uint32_t dlen = read_u32(data, 4); 1765 if (dlen > 0) 1766 return 8 + dlen; 1767 } 1768 1769 client_cut_text(vs, read_u32(data, 4), data + 8); 1770 break; 1771 case 255: 1772 if (len == 1) 1773 return 2; 1774 1775 switch (read_u8(data, 1)) { 1776 case 0: 1777 if (len == 2) 1778 return 12; 1779 1780 ext_key_event(vs, read_u16(data, 2), 1781 read_u32(data, 4), read_u32(data, 8)); 1782 break; 1783 case 1: 1784 if (len == 2) 1785 return 4; 1786 1787 switch (read_u16 (data, 2)) { 1788 case 0: 1789 audio_add(vs); 1790 break; 1791 case 1: 1792 audio_del(vs); 1793 break; 1794 case 2: 1795 if (len == 4) 1796 return 10; 1797 switch (read_u8(data, 4)) { 1798 case 0: vs->as.fmt = AUD_FMT_U8; break; 1799 case 1: vs->as.fmt = AUD_FMT_S8; break; 1800 case 2: vs->as.fmt = AUD_FMT_U16; break; 1801 case 3: vs->as.fmt = AUD_FMT_S16; break; 1802 case 4: vs->as.fmt = AUD_FMT_U32; break; 1803 case 5: vs->as.fmt = AUD_FMT_S32; break; 1804 default: 1805 printf("Invalid audio format %d\n", read_u8(data, 4)); 1806 vnc_client_error(vs); 1807 break; 1808 } 1809 vs->as.nchannels = read_u8(data, 5); 1810 if (vs->as.nchannels != 1 && vs->as.nchannels != 2) { 1811 printf("Invalid audio channel coount %d\n", 1812 read_u8(data, 5)); 1813 vnc_client_error(vs); 1814 break; 1815 } 1816 vs->as.freq = read_u32(data, 6); 1817 break; 1818 default: 1819 printf ("Invalid audio message %d\n", read_u8(data, 4)); 1820 vnc_client_error(vs); 1821 break; 1822 } 1823 break; 1824 1825 default: 1826 printf("Msg: %d\n", read_u16(data, 0)); 1827 vnc_client_error(vs); 1828 break; 1829 } 1830 break; 1831 default: 1832 printf("Msg: %d\n", data[0]); 1833 vnc_client_error(vs); 1834 break; 1835 } 1836 1837 vnc_read_when(vs, protocol_client_msg, 1); 1838 return 0; 1839 } 1840 1841 static int protocol_client_init(VncState *vs, uint8_t *data, size_t len) 1842 { 1843 char buf[1024]; 1844 int size; 1845 1846 vnc_write_u16(vs, ds_get_width(vs->ds)); 1847 vnc_write_u16(vs, ds_get_height(vs->ds)); 1848 1849 pixel_format_message(vs); 1850 1851 if (qemu_name) 1852 size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name); 1853 else 1854 size = snprintf(buf, sizeof(buf), "QEMU"); 1855 1856 vnc_write_u32(vs, size); 1857 vnc_write(vs, buf, size); 1858 vnc_flush(vs); 1859 1860 vnc_read_when(vs, protocol_client_msg, 1); 1861 1862 return 0; 1863 } 1864 1865 void start_client_init(VncState *vs) 1866 { 1867 vnc_read_when(vs, protocol_client_init, 1); 1868 } 1869 1870 static void make_challenge(VncState *vs) 1871 { 1872 int i; 1873 1874 srand(time(NULL)+getpid()+getpid()*987654+rand()); 1875 1876 for (i = 0 ; i < sizeof(vs->challenge) ; i++) 1877 vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0)); 1878 } 1879 1880 static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len) 1881 { 1882 unsigned char response[VNC_AUTH_CHALLENGE_SIZE]; 1883 int i, j, pwlen; 1884 unsigned char key[8]; 1885 1886 if (!vs->vd->password || !vs->vd->password[0]) { 1887 VNC_DEBUG("No password configured on server"); 1888 vnc_write_u32(vs, 1); /* Reject auth */ 1889 if (vs->minor >= 8) { 1890 static const char err[] = "Authentication failed"; 1891 vnc_write_u32(vs, sizeof(err)); 1892 vnc_write(vs, err, sizeof(err)); 1893 } 1894 vnc_flush(vs); 1895 vnc_client_error(vs); 1896 return 0; 1897 } 1898 1899 memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE); 1900 1901 /* Calculate the expected challenge response */ 1902 pwlen = strlen(vs->vd->password); 1903 for (i=0; i<sizeof(key); i++) 1904 key[i] = i<pwlen ? vs->vd->password[i] : 0; 1905 deskey(key, EN0); 1906 for (j = 0; j < VNC_AUTH_CHALLENGE_SIZE; j += 8) 1907 des(response+j, response+j); 1908 1909 /* Compare expected vs actual challenge response */ 1910 if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) { 1911 VNC_DEBUG("Client challenge reponse did not match\n"); 1912 vnc_write_u32(vs, 1); /* Reject auth */ 1913 if (vs->minor >= 8) { 1914 static const char err[] = "Authentication failed"; 1915 vnc_write_u32(vs, sizeof(err)); 1916 vnc_write(vs, err, sizeof(err)); 1917 } 1918 vnc_flush(vs); 1919 vnc_client_error(vs); 1920 } else { 1921 VNC_DEBUG("Accepting VNC challenge response\n"); 1922 vnc_write_u32(vs, 0); /* Accept auth */ 1923 vnc_flush(vs); 1924 1925 start_client_init(vs); 1926 } 1927 return 0; 1928 } 1929 1930 void start_auth_vnc(VncState *vs) 1931 { 1932 make_challenge(vs); 1933 /* Send client a 'random' challenge */ 1934 vnc_write(vs, vs->challenge, sizeof(vs->challenge)); 1935 vnc_flush(vs); 1936 1937 vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge)); 1938 } 1939 1940 1941 static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len) 1942 { 1943 /* We only advertise 1 auth scheme at a time, so client 1944 * must pick the one we sent. Verify this */ 1945 if (data[0] != vs->vd->auth) { /* Reject auth */ 1946 VNC_DEBUG("Reject auth %d because it didn't match advertized\n", (int)data[0]); 1947 vnc_write_u32(vs, 1); 1948 if (vs->minor >= 8) { 1949 static const char err[] = "Authentication failed"; 1950 vnc_write_u32(vs, sizeof(err)); 1951 vnc_write(vs, err, sizeof(err)); 1952 } 1953 vnc_client_error(vs); 1954 } else { /* Accept requested auth */ 1955 VNC_DEBUG("Client requested auth %d\n", (int)data[0]); 1956 switch (vs->vd->auth) { 1957 case VNC_AUTH_NONE: 1958 VNC_DEBUG("Accept auth none\n"); 1959 if (vs->minor >= 8) { 1960 vnc_write_u32(vs, 0); /* Accept auth completion */ 1961 vnc_flush(vs); 1962 } 1963 start_client_init(vs); 1964 break; 1965 1966 case VNC_AUTH_VNC: 1967 VNC_DEBUG("Start VNC auth\n"); 1968 start_auth_vnc(vs); 1969 break; 1970 1971 #ifdef CONFIG_VNC_TLS 1972 case VNC_AUTH_VENCRYPT: 1973 VNC_DEBUG("Accept VeNCrypt auth\n");; 1974 start_auth_vencrypt(vs); 1975 break; 1976 #endif /* CONFIG_VNC_TLS */ 1977 1978 #ifdef CONFIG_VNC_SASL 1979 case VNC_AUTH_SASL: 1980 VNC_DEBUG("Accept SASL auth\n"); 1981 start_auth_sasl(vs); 1982 break; 1983 #endif /* CONFIG_VNC_SASL */ 1984 1985 default: /* Should not be possible, but just in case */ 1986 VNC_DEBUG("Reject auth %d server code bug\n", vs->vd->auth); 1987 vnc_write_u8(vs, 1); 1988 if (vs->minor >= 8) { 1989 static const char err[] = "Authentication failed"; 1990 vnc_write_u32(vs, sizeof(err)); 1991 vnc_write(vs, err, sizeof(err)); 1992 } 1993 vnc_client_error(vs); 1994 } 1995 } 1996 return 0; 1997 } 1998 1999 static int protocol_version(VncState *vs, uint8_t *version, size_t len) 2000 { 2001 char local[13]; 2002 2003 memcpy(local, version, 12); 2004 local[12] = 0; 2005 2006 if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) { 2007 VNC_DEBUG("Malformed protocol version %s\n", local); 2008 vnc_client_error(vs); 2009 return 0; 2010 } 2011 VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor); 2012 if (vs->major != 3 || 2013 (vs->minor != 3 && 2014 vs->minor != 4 && 2015 vs->minor != 5 && 2016 vs->minor != 7 && 2017 vs->minor != 8)) { 2018 VNC_DEBUG("Unsupported client version\n"); 2019 vnc_write_u32(vs, VNC_AUTH_INVALID); 2020 vnc_flush(vs); 2021 vnc_client_error(vs); 2022 return 0; 2023 } 2024 /* Some broken clients report v3.4 or v3.5, which spec requires to be treated 2025 * as equivalent to v3.3 by servers 2026 */ 2027 if (vs->minor == 4 || vs->minor == 5) 2028 vs->minor = 3; 2029 2030 if (vs->minor == 3) { 2031 if (vs->vd->auth == VNC_AUTH_NONE) { 2032 VNC_DEBUG("Tell client auth none\n"); 2033 vnc_write_u32(vs, vs->vd->auth); 2034 vnc_flush(vs); 2035 start_client_init(vs); 2036 } else if (vs->vd->auth == VNC_AUTH_VNC) { 2037 VNC_DEBUG("Tell client VNC auth\n"); 2038 vnc_write_u32(vs, vs->vd->auth); 2039 vnc_flush(vs); 2040 start_auth_vnc(vs); 2041 } else { 2042 VNC_DEBUG("Unsupported auth %d for protocol 3.3\n", vs->vd->auth); 2043 vnc_write_u32(vs, VNC_AUTH_INVALID); 2044 vnc_flush(vs); 2045 vnc_client_error(vs); 2046 } 2047 } else { 2048 VNC_DEBUG("Telling client we support auth %d\n", vs->vd->auth); 2049 vnc_write_u8(vs, 1); /* num auth */ 2050 vnc_write_u8(vs, vs->vd->auth); 2051 vnc_read_when(vs, protocol_client_auth, 1); 2052 vnc_flush(vs); 2053 } 2054 2055 return 0; 2056 } 2057 2058 static void vnc_connect(VncDisplay *vd, int csock) 2059 { 2060 VncState *vs = g_malloc0(sizeof(VncState)); 2061 vs->csock = csock; 2062 2063 VNC_DEBUG("New client on socket %d\n", csock); 2064 dcl->idle = 0; 2065 socket_set_nonblock(vs->csock); 2066 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs); 2067 2068 vs->vd = vd; 2069 vs->ds = vd->ds; 2070 vs->timer = timer_new(QEMU_CLOCK_REALTIME, SCALE_MS, vnc_update_client, vs); 2071 vs->last_x = -1; 2072 vs->last_y = -1; 2073 2074 vs->as.freq = 44100; 2075 vs->as.nchannels = 2; 2076 vs->as.fmt = AUD_FMT_S16; 2077 vs->as.endianness = 0; 2078 2079 vnc_resize(vs); 2080 vnc_write(vs, "RFB 003.008\n", 12); 2081 vnc_flush(vs); 2082 vnc_read_when(vs, protocol_version, 12); 2083 reset_keys(vs); 2084 2085 vs->next = vd->clients; 2086 vd->clients = vs; 2087 2088 vnc_update_client(vs); 2089 /* vs might be free()ed here */ 2090 } 2091 2092 static void vnc_listen_read(void *opaque) 2093 { 2094 VncDisplay *vs = opaque; 2095 struct sockaddr_in addr; 2096 socklen_t addrlen = sizeof(addr); 2097 2098 /* Catch-up */ 2099 vga_hw_update(); 2100 2101 int csock = accept(vs->lsock, (struct sockaddr *)&addr, &addrlen); 2102 if (csock != -1) { 2103 vnc_connect(vs, csock); 2104 } 2105 } 2106 2107 void vnc_display_init(DisplayState *ds) 2108 { 2109 VncDisplay *vs = g_malloc0(sizeof(*vs)); 2110 2111 dcl = g_malloc0(sizeof(DisplayChangeListener)); 2112 2113 ds->opaque = vs; 2114 dcl->idle = 1; 2115 vnc_display = vs; 2116 2117 vs->lsock = -1; 2118 2119 vs->ds = ds; 2120 2121 if (keyboard_layout) 2122 vs->kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout); 2123 else 2124 vs->kbd_layout = init_keyboard_layout(name2keysym, "en-us"); 2125 2126 if (!vs->kbd_layout) 2127 exit(1); 2128 2129 dcl->dpy_copy = vnc_dpy_copy; 2130 dcl->dpy_update = vnc_dpy_update; 2131 dcl->dpy_resize = vnc_dpy_resize; 2132 dcl->dpy_setdata = vnc_dpy_setdata; 2133 register_displaychangelistener(ds, dcl); 2134 } 2135 2136 2137 void vnc_display_close(DisplayState *ds) 2138 { 2139 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display; 2140 2141 if (!vs) 2142 return; 2143 if (vs->display) { 2144 g_free(vs->display); 2145 vs->display = NULL; 2146 } 2147 if (vs->lsock != -1) { 2148 qemu_set_fd_handler2(vs->lsock, NULL, NULL, NULL, NULL); 2149 close(vs->lsock); 2150 vs->lsock = -1; 2151 } 2152 vs->auth = VNC_AUTH_INVALID; 2153 #ifdef CONFIG_VNC_TLS 2154 vs->subauth = VNC_AUTH_INVALID; 2155 vs->tls.x509verify = 0; 2156 #endif 2157 } 2158 2159 int vnc_display_password(DisplayState *ds, const char *password) 2160 { 2161 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display; 2162 2163 if (vs->password) { 2164 g_free(vs->password); 2165 vs->password = NULL; 2166 } 2167 if (password && password[0]) { 2168 if (!(vs->password = g_strdup(password))) 2169 return -1; 2170 } 2171 2172 return 0; 2173 } 2174 2175 char *vnc_display_local_addr(DisplayState *ds) 2176 { 2177 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display; 2178 2179 return vnc_socket_local_addr("%s:%s", vs->lsock); 2180 } 2181 2182 int vnc_display_open(DisplayState *ds, const char *display) 2183 { 2184 VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display; 2185 const char *options; 2186 int password = 0; 2187 int reverse = 0; 2188 int to_port = 0; 2189 #ifdef CONFIG_VNC_TLS 2190 int tls = 0, x509 = 0; 2191 #endif 2192 #ifdef CONFIG_VNC_SASL 2193 int sasl = 0; 2194 int saslErr; 2195 #endif 2196 int acl = 0; 2197 2198 if (!vnc_display) 2199 return -1; 2200 vnc_display_close(ds); 2201 if (strcmp(display, "none") == 0) 2202 return 0; 2203 2204 if (!(vs->display = strdup(display))) 2205 return -1; 2206 2207 options = display; 2208 while ((options = strchr(options, ','))) { 2209 options++; 2210 if (strncmp(options, "password", 8) == 0) { 2211 password = 1; /* Require password auth */ 2212 } else if (strncmp(options, "reverse", 7) == 0) { 2213 reverse = 1; 2214 } else if (strncmp(options, "to=", 3) == 0) { 2215 to_port = atoi(options+3) + 5900; 2216 #ifdef CONFIG_VNC_SASL 2217 } else if (strncmp(options, "sasl", 4) == 0) { 2218 sasl = 1; /* Require SASL auth */ 2219 #endif 2220 #ifdef CONFIG_VNC_TLS 2221 } else if (strncmp(options, "tls", 3) == 0) { 2222 tls = 1; /* Require TLS */ 2223 } else if (strncmp(options, "x509", 4) == 0) { 2224 char *start, *end; 2225 x509 = 1; /* Require x509 certificates */ 2226 if (strncmp(options, "x509verify", 10) == 0) 2227 vs->tls.x509verify = 1; /* ...and verify client certs */ 2228 2229 /* Now check for 'x509=/some/path' postfix 2230 * and use that to setup x509 certificate/key paths */ 2231 start = strchr(options, '='); 2232 end = strchr(options, ','); 2233 if (start && (!end || (start < end))) { 2234 int len = end ? end-(start+1) : strlen(start+1); 2235 char *path = g_strndup(start + 1, len); 2236 2237 VNC_DEBUG("Trying certificate path '%s'\n", path); 2238 if (vnc_tls_set_x509_creds_dir(vs, path) < 0) { 2239 fprintf(stderr, "Failed to find x509 certificates/keys in %s\n", path); 2240 g_free(path); 2241 g_free(vs->display); 2242 vs->display = NULL; 2243 return -1; 2244 } 2245 g_free(path); 2246 } else { 2247 fprintf(stderr, "No certificate path provided\n"); 2248 g_free(vs->display); 2249 vs->display = NULL; 2250 return -1; 2251 } 2252 #endif 2253 } else if (strncmp(options, "acl", 3) == 0) { 2254 acl = 1; 2255 } 2256 } 2257 2258 #ifdef CONFIG_VNC_TLS 2259 if (acl && x509 && vs->tls.x509verify) { 2260 if (!(vs->tls.acl = qemu_acl_init("vnc.x509dname"))) { 2261 fprintf(stderr, "Failed to create x509 dname ACL\n"); 2262 exit(1); 2263 } 2264 } 2265 #endif 2266 #ifdef CONFIG_VNC_SASL 2267 if (acl && sasl) { 2268 if (!(vs->sasl.acl = qemu_acl_init("vnc.username"))) { 2269 fprintf(stderr, "Failed to create username ACL\n"); 2270 exit(1); 2271 } 2272 } 2273 #endif 2274 2275 /* 2276 * Combinations we support here: 2277 * 2278 * - no-auth (clear text, no auth) 2279 * - password (clear text, weak auth) 2280 * - sasl (encrypt, good auth *IF* using Kerberos via GSSAPI) 2281 * - tls (encrypt, weak anonymous creds, no auth) 2282 * - tls + password (encrypt, weak anonymous creds, weak auth) 2283 * - tls + sasl (encrypt, weak anonymous creds, good auth) 2284 * - tls + x509 (encrypt, good x509 creds, no auth) 2285 * - tls + x509 + password (encrypt, good x509 creds, weak auth) 2286 * - tls + x509 + sasl (encrypt, good x509 creds, good auth) 2287 * 2288 * NB1. TLS is a stackable auth scheme. 2289 * NB2. the x509 schemes have option to validate a client cert dname 2290 */ 2291 if (password) { 2292 #ifdef CONFIG_VNC_TLS 2293 if (tls) { 2294 vs->auth = VNC_AUTH_VENCRYPT; 2295 if (x509) { 2296 VNC_DEBUG("Initializing VNC server with x509 password auth\n"); 2297 vs->subauth = VNC_AUTH_VENCRYPT_X509VNC; 2298 } else { 2299 VNC_DEBUG("Initializing VNC server with TLS password auth\n"); 2300 vs->subauth = VNC_AUTH_VENCRYPT_TLSVNC; 2301 } 2302 } else { 2303 #endif /* CONFIG_VNC_TLS */ 2304 VNC_DEBUG("Initializing VNC server with password auth\n"); 2305 vs->auth = VNC_AUTH_VNC; 2306 #ifdef CONFIG_VNC_TLS 2307 vs->subauth = VNC_AUTH_INVALID; 2308 } 2309 #endif /* CONFIG_VNC_TLS */ 2310 #ifdef CONFIG_VNC_SASL 2311 } else if (sasl) { 2312 #ifdef CONFIG_VNC_TLS 2313 if (tls) { 2314 vs->auth = VNC_AUTH_VENCRYPT; 2315 if (x509) { 2316 VNC_DEBUG("Initializing VNC server with x509 SASL auth\n"); 2317 vs->subauth = VNC_AUTH_VENCRYPT_X509SASL; 2318 } else { 2319 VNC_DEBUG("Initializing VNC server with TLS SASL auth\n"); 2320 vs->subauth = VNC_AUTH_VENCRYPT_TLSSASL; 2321 } 2322 } else { 2323 #endif /* CONFIG_VNC_TLS */ 2324 VNC_DEBUG("Initializing VNC server with SASL auth\n"); 2325 vs->auth = VNC_AUTH_SASL; 2326 #ifdef CONFIG_VNC_TLS 2327 vs->subauth = VNC_AUTH_INVALID; 2328 } 2329 #endif /* CONFIG_VNC_TLS */ 2330 #endif /* CONFIG_VNC_SASL */ 2331 } else { 2332 #ifdef CONFIG_VNC_TLS 2333 if (tls) { 2334 vs->auth = VNC_AUTH_VENCRYPT; 2335 if (x509) { 2336 VNC_DEBUG("Initializing VNC server with x509 no auth\n"); 2337 vs->subauth = VNC_AUTH_VENCRYPT_X509NONE; 2338 } else { 2339 VNC_DEBUG("Initializing VNC server with TLS no auth\n"); 2340 vs->subauth = VNC_AUTH_VENCRYPT_TLSNONE; 2341 } 2342 } else { 2343 #endif 2344 VNC_DEBUG("Initializing VNC server with no auth\n"); 2345 vs->auth = VNC_AUTH_NONE; 2346 #ifdef CONFIG_VNC_TLS 2347 vs->subauth = VNC_AUTH_INVALID; 2348 } 2349 #endif 2350 } 2351 2352 #ifdef CONFIG_VNC_SASL 2353 if ((saslErr = sasl_server_init(NULL, "qemu")) != SASL_OK) { 2354 fprintf(stderr, "Failed to initialize SASL auth %s", 2355 sasl_errstring(saslErr, NULL, NULL)); 2356 free(vs->display); 2357 vs->display = NULL; 2358 return -1; 2359 } 2360 #endif 2361 2362 if (reverse) { 2363 /* connect to viewer */ 2364 if (strncmp(display, "unix:", 5) == 0) 2365 vs->lsock = unix_connect(display+5); 2366 else 2367 vs->lsock = inet_connect(display, SOCK_STREAM); 2368 if (-1 == vs->lsock) { 2369 free(vs->display); 2370 vs->display = NULL; 2371 return -1; 2372 } else { 2373 int csock = vs->lsock; 2374 vs->lsock = -1; 2375 vnc_connect(vs, csock); 2376 } 2377 return 0; 2378 2379 } else { 2380 /* listen for connects */ 2381 char *dpy; 2382 dpy = g_malloc(256); 2383 if (strncmp(display, "unix:", 5) == 0) { 2384 pstrcpy(dpy, 256, "unix:"); 2385 vs->lsock = unix_listen(display+5, dpy+5, 256-5); 2386 } else { 2387 vs->lsock = inet_listen(display, dpy, 256, SOCK_STREAM, 5900); 2388 } 2389 if (-1 == vs->lsock) { 2390 free(dpy); 2391 return -1; 2392 } else { 2393 free(vs->display); 2394 vs->display = dpy; 2395 } 2396 } 2397 return qemu_set_fd_handler2(vs->lsock, NULL, vnc_listen_read, NULL, vs); 2398 } 2399
