1 /* 2 * QEMU VNC display driver 3 * 4 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws> 5 * Copyright (C) 2006 Fabrice Bellard 6 * Copyright (C) 2009 Red Hat, Inc 7 * 8 * Permission is hereby granted, free of charge, to any person obtaining a copy 9 * of this software and associated documentation files (the "Software"), to deal 10 * in the Software without restriction, including without limitation the rights 11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 12 * copies of the Software, and to permit persons to whom the Software is 13 * furnished to do so, subject to the following conditions: 14 * 15 * The above copyright notice and this permission notice shall be included in 16 * all copies or substantial portions of the Software. 17 * 18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 24 * THE SOFTWARE. 25 */ 26 27 #include "vnc.h" 28 #include "vnc-jobs.h" 29 #include "trace.h" 30 #include "hw/qdev.h" 31 #include "sysemu/sysemu.h" 32 #include "qemu/sockets.h" 33 #include "qemu/timer.h" 34 #include "qemu/acl.h" 35 #include "qemu/config-file.h" 36 #include "qapi/qmp/types.h" 37 #include "qmp-commands.h" 38 #include "qemu/osdep.h" 39 #include "ui/input.h" 40 #include "qapi-event.h" 41 42 #define VNC_REFRESH_INTERVAL_BASE GUI_REFRESH_INTERVAL_DEFAULT 43 #define VNC_REFRESH_INTERVAL_INC 50 44 #define VNC_REFRESH_INTERVAL_MAX GUI_REFRESH_INTERVAL_IDLE 45 static const struct timeval VNC_REFRESH_STATS = { 0, 500000 }; 46 static const struct timeval VNC_REFRESH_LOSSY = { 2, 0 }; 47 48 #include "vnc_keysym.h" 49 #include "d3des.h" 50 51 static QTAILQ_HEAD(, VncDisplay) vnc_displays = 52 QTAILQ_HEAD_INITIALIZER(vnc_displays); 53 54 static int vnc_cursor_define(VncState *vs); 55 static void vnc_release_modifiers(VncState *vs); 56 57 static void vnc_set_share_mode(VncState *vs, VncShareMode mode) 58 { 59 #ifdef _VNC_DEBUG 60 static const char *mn[] = { 61 [0] = "undefined", 62 [VNC_SHARE_MODE_CONNECTING] = "connecting", 63 [VNC_SHARE_MODE_SHARED] = "shared", 64 [VNC_SHARE_MODE_EXCLUSIVE] = "exclusive", 65 [VNC_SHARE_MODE_DISCONNECTED] = "disconnected", 66 }; 67 fprintf(stderr, "%s/%d: %s -> %s\n", __func__, 68 vs->csock, mn[vs->share_mode], mn[mode]); 69 #endif 70 71 switch (vs->share_mode) { 72 case VNC_SHARE_MODE_CONNECTING: 73 vs->vd->num_connecting--; 74 break; 75 case VNC_SHARE_MODE_SHARED: 76 vs->vd->num_shared--; 77 break; 78 case VNC_SHARE_MODE_EXCLUSIVE: 79 vs->vd->num_exclusive--; 80 break; 81 default: 82 break; 83 } 84 85 vs->share_mode = mode; 86 87 switch (vs->share_mode) { 88 case VNC_SHARE_MODE_CONNECTING: 89 vs->vd->num_connecting++; 90 break; 91 case VNC_SHARE_MODE_SHARED: 92 vs->vd->num_shared++; 93 break; 94 case VNC_SHARE_MODE_EXCLUSIVE: 95 vs->vd->num_exclusive++; 96 break; 97 default: 98 break; 99 } 100 } 101 102 static char *addr_to_string(const char *format, 103 struct sockaddr_storage *sa, 104 socklen_t salen) { 105 char *addr; 106 char host[NI_MAXHOST]; 107 char serv[NI_MAXSERV]; 108 int err; 109 size_t addrlen; 110 111 if ((err = getnameinfo((struct sockaddr *)sa, salen, 112 host, sizeof(host), 113 serv, sizeof(serv), 114 NI_NUMERICHOST | NI_NUMERICSERV)) != 0) { 115 VNC_DEBUG("Cannot resolve address %d: %s\n", 116 err, gai_strerror(err)); 117 return NULL; 118 } 119 120 /* Enough for the existing format + the 2 vars we're 121 * substituting in. */ 122 addrlen = strlen(format) + strlen(host) + strlen(serv); 123 addr = g_malloc(addrlen + 1); 124 snprintf(addr, addrlen, format, host, serv); 125 addr[addrlen] = '\0'; 126 127 return addr; 128 } 129 130 131 char *vnc_socket_local_addr(const char *format, int fd) { 132 struct sockaddr_storage sa; 133 socklen_t salen; 134 135 salen = sizeof(sa); 136 if (getsockname(fd, (struct sockaddr*)&sa, &salen) < 0) 137 return NULL; 138 139 return addr_to_string(format, &sa, salen); 140 } 141 142 char *vnc_socket_remote_addr(const char *format, int fd) { 143 struct sockaddr_storage sa; 144 socklen_t salen; 145 146 salen = sizeof(sa); 147 if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0) 148 return NULL; 149 150 return addr_to_string(format, &sa, salen); 151 } 152 153 static VncBasicInfo *vnc_basic_info_get(struct sockaddr_storage *sa, 154 socklen_t salen) 155 { 156 VncBasicInfo *info; 157 char host[NI_MAXHOST]; 158 char serv[NI_MAXSERV]; 159 int err; 160 161 if ((err = getnameinfo((struct sockaddr *)sa, salen, 162 host, sizeof(host), 163 serv, sizeof(serv), 164 NI_NUMERICHOST | NI_NUMERICSERV)) != 0) { 165 VNC_DEBUG("Cannot resolve address %d: %s\n", 166 err, gai_strerror(err)); 167 return NULL; 168 } 169 170 info = g_malloc0(sizeof(VncBasicInfo)); 171 info->host = g_strdup(host); 172 info->service = g_strdup(serv); 173 info->family = inet_netfamily(sa->ss_family); 174 return info; 175 } 176 177 static VncBasicInfo *vnc_basic_info_get_from_server_addr(int fd) 178 { 179 struct sockaddr_storage sa; 180 socklen_t salen; 181 182 salen = sizeof(sa); 183 if (getsockname(fd, (struct sockaddr*)&sa, &salen) < 0) { 184 return NULL; 185 } 186 187 return vnc_basic_info_get(&sa, salen); 188 } 189 190 static VncBasicInfo *vnc_basic_info_get_from_remote_addr(int fd) 191 { 192 struct sockaddr_storage sa; 193 socklen_t salen; 194 195 salen = sizeof(sa); 196 if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0) { 197 return NULL; 198 } 199 200 return vnc_basic_info_get(&sa, salen); 201 } 202 203 static const char *vnc_auth_name(VncDisplay *vd) { 204 switch (vd->auth) { 205 case VNC_AUTH_INVALID: 206 return "invalid"; 207 case VNC_AUTH_NONE: 208 return "none"; 209 case VNC_AUTH_VNC: 210 return "vnc"; 211 case VNC_AUTH_RA2: 212 return "ra2"; 213 case VNC_AUTH_RA2NE: 214 return "ra2ne"; 215 case VNC_AUTH_TIGHT: 216 return "tight"; 217 case VNC_AUTH_ULTRA: 218 return "ultra"; 219 case VNC_AUTH_TLS: 220 return "tls"; 221 case VNC_AUTH_VENCRYPT: 222 #ifdef CONFIG_VNC_TLS 223 switch (vd->subauth) { 224 case VNC_AUTH_VENCRYPT_PLAIN: 225 return "vencrypt+plain"; 226 case VNC_AUTH_VENCRYPT_TLSNONE: 227 return "vencrypt+tls+none"; 228 case VNC_AUTH_VENCRYPT_TLSVNC: 229 return "vencrypt+tls+vnc"; 230 case VNC_AUTH_VENCRYPT_TLSPLAIN: 231 return "vencrypt+tls+plain"; 232 case VNC_AUTH_VENCRYPT_X509NONE: 233 return "vencrypt+x509+none"; 234 case VNC_AUTH_VENCRYPT_X509VNC: 235 return "vencrypt+x509+vnc"; 236 case VNC_AUTH_VENCRYPT_X509PLAIN: 237 return "vencrypt+x509+plain"; 238 case VNC_AUTH_VENCRYPT_TLSSASL: 239 return "vencrypt+tls+sasl"; 240 case VNC_AUTH_VENCRYPT_X509SASL: 241 return "vencrypt+x509+sasl"; 242 default: 243 return "vencrypt"; 244 } 245 #else 246 return "vencrypt"; 247 #endif 248 case VNC_AUTH_SASL: 249 return "sasl"; 250 } 251 return "unknown"; 252 } 253 254 static VncServerInfo *vnc_server_info_get(VncDisplay *vd) 255 { 256 VncServerInfo *info; 257 VncBasicInfo *bi = vnc_basic_info_get_from_server_addr(vd->lsock); 258 if (!bi) { 259 return NULL; 260 } 261 262 info = g_malloc(sizeof(*info)); 263 info->base = bi; 264 info->has_auth = true; 265 info->auth = g_strdup(vnc_auth_name(vd)); 266 return info; 267 } 268 269 static void vnc_client_cache_auth(VncState *client) 270 { 271 if (!client->info) { 272 return; 273 } 274 275 #ifdef CONFIG_VNC_TLS 276 if (client->tls.session && 277 client->tls.dname) { 278 client->info->has_x509_dname = true; 279 client->info->x509_dname = g_strdup(client->tls.dname); 280 } 281 #endif 282 #ifdef CONFIG_VNC_SASL 283 if (client->sasl.conn && 284 client->sasl.username) { 285 client->info->has_sasl_username = true; 286 client->info->sasl_username = g_strdup(client->sasl.username); 287 } 288 #endif 289 } 290 291 static void vnc_client_cache_addr(VncState *client) 292 { 293 VncBasicInfo *bi = vnc_basic_info_get_from_remote_addr(client->csock); 294 295 if (bi) { 296 client->info = g_malloc0(sizeof(*client->info)); 297 client->info->base = bi; 298 } 299 } 300 301 static void vnc_qmp_event(VncState *vs, QAPIEvent event) 302 { 303 VncServerInfo *si; 304 305 if (!vs->info) { 306 return; 307 } 308 g_assert(vs->info->base); 309 310 si = vnc_server_info_get(vs->vd); 311 if (!si) { 312 return; 313 } 314 315 switch (event) { 316 case QAPI_EVENT_VNC_CONNECTED: 317 qapi_event_send_vnc_connected(si, vs->info->base, &error_abort); 318 break; 319 case QAPI_EVENT_VNC_INITIALIZED: 320 qapi_event_send_vnc_initialized(si, vs->info, &error_abort); 321 break; 322 case QAPI_EVENT_VNC_DISCONNECTED: 323 qapi_event_send_vnc_disconnected(si, vs->info, &error_abort); 324 break; 325 default: 326 break; 327 } 328 329 qapi_free_VncServerInfo(si); 330 } 331 332 static VncClientInfo *qmp_query_vnc_client(const VncState *client) 333 { 334 struct sockaddr_storage sa; 335 socklen_t salen = sizeof(sa); 336 char host[NI_MAXHOST]; 337 char serv[NI_MAXSERV]; 338 VncClientInfo *info; 339 340 if (getpeername(client->csock, (struct sockaddr *)&sa, &salen) < 0) { 341 return NULL; 342 } 343 344 if (getnameinfo((struct sockaddr *)&sa, salen, 345 host, sizeof(host), 346 serv, sizeof(serv), 347 NI_NUMERICHOST | NI_NUMERICSERV) < 0) { 348 return NULL; 349 } 350 351 info = g_malloc0(sizeof(*info)); 352 info->base = g_malloc0(sizeof(*info->base)); 353 info->base->host = g_strdup(host); 354 info->base->service = g_strdup(serv); 355 info->base->family = inet_netfamily(sa.ss_family); 356 #ifdef CONFIG_VNC_WS 357 info->base->websocket = client->websocket; 358 #endif 359 360 #ifdef CONFIG_VNC_TLS 361 if (client->tls.session && client->tls.dname) { 362 info->has_x509_dname = true; 363 info->x509_dname = g_strdup(client->tls.dname); 364 } 365 #endif 366 #ifdef CONFIG_VNC_SASL 367 if (client->sasl.conn && client->sasl.username) { 368 info->has_sasl_username = true; 369 info->sasl_username = g_strdup(client->sasl.username); 370 } 371 #endif 372 373 return info; 374 } 375 376 static VncDisplay *vnc_display_find(const char *id) 377 { 378 VncDisplay *vd; 379 380 if (id == NULL) { 381 return QTAILQ_FIRST(&vnc_displays); 382 } 383 QTAILQ_FOREACH(vd, &vnc_displays, next) { 384 if (strcmp(id, vd->id) == 0) { 385 return vd; 386 } 387 } 388 return NULL; 389 } 390 391 static VncClientInfoList *qmp_query_client_list(VncDisplay *vd) 392 { 393 VncClientInfoList *cinfo, *prev = NULL; 394 VncState *client; 395 396 QTAILQ_FOREACH(client, &vd->clients, next) { 397 cinfo = g_new0(VncClientInfoList, 1); 398 cinfo->value = qmp_query_vnc_client(client); 399 cinfo->next = prev; 400 prev = cinfo; 401 } 402 return prev; 403 } 404 405 VncInfo *qmp_query_vnc(Error **errp) 406 { 407 VncInfo *info = g_malloc0(sizeof(*info)); 408 VncDisplay *vd = vnc_display_find(NULL); 409 410 if (vd == NULL || !vd->enabled) { 411 info->enabled = false; 412 } else { 413 struct sockaddr_storage sa; 414 socklen_t salen = sizeof(sa); 415 char host[NI_MAXHOST]; 416 char serv[NI_MAXSERV]; 417 418 info->enabled = true; 419 420 /* for compatibility with the original command */ 421 info->has_clients = true; 422 info->clients = qmp_query_client_list(vd); 423 424 if (vd->lsock == -1) { 425 return info; 426 } 427 428 if (getsockname(vd->lsock, (struct sockaddr *)&sa, 429 &salen) == -1) { 430 error_set(errp, QERR_UNDEFINED_ERROR); 431 goto out_error; 432 } 433 434 if (getnameinfo((struct sockaddr *)&sa, salen, 435 host, sizeof(host), 436 serv, sizeof(serv), 437 NI_NUMERICHOST | NI_NUMERICSERV) < 0) { 438 error_set(errp, QERR_UNDEFINED_ERROR); 439 goto out_error; 440 } 441 442 info->has_host = true; 443 info->host = g_strdup(host); 444 445 info->has_service = true; 446 info->service = g_strdup(serv); 447 448 info->has_family = true; 449 info->family = inet_netfamily(sa.ss_family); 450 451 info->has_auth = true; 452 info->auth = g_strdup(vnc_auth_name(vd)); 453 } 454 455 return info; 456 457 out_error: 458 qapi_free_VncInfo(info); 459 return NULL; 460 } 461 462 static VncBasicInfoList *qmp_query_server_entry(int socket, 463 bool websocket, 464 VncBasicInfoList *prev) 465 { 466 VncBasicInfoList *list; 467 VncBasicInfo *info; 468 struct sockaddr_storage sa; 469 socklen_t salen = sizeof(sa); 470 char host[NI_MAXHOST]; 471 char serv[NI_MAXSERV]; 472 473 if (getsockname(socket, (struct sockaddr *)&sa, &salen) < 0 || 474 getnameinfo((struct sockaddr *)&sa, salen, 475 host, sizeof(host), serv, sizeof(serv), 476 NI_NUMERICHOST | NI_NUMERICSERV) < 0) { 477 return prev; 478 } 479 480 info = g_new0(VncBasicInfo, 1); 481 info->host = g_strdup(host); 482 info->service = g_strdup(serv); 483 info->family = inet_netfamily(sa.ss_family); 484 info->websocket = websocket; 485 486 list = g_new0(VncBasicInfoList, 1); 487 list->value = info; 488 list->next = prev; 489 return list; 490 } 491 492 static void qmp_query_auth(VncDisplay *vd, VncInfo2 *info) 493 { 494 switch (vd->auth) { 495 case VNC_AUTH_VNC: 496 info->auth = VNC_PRIMARY_AUTH_VNC; 497 break; 498 case VNC_AUTH_RA2: 499 info->auth = VNC_PRIMARY_AUTH_RA2; 500 break; 501 case VNC_AUTH_RA2NE: 502 info->auth = VNC_PRIMARY_AUTH_RA2NE; 503 break; 504 case VNC_AUTH_TIGHT: 505 info->auth = VNC_PRIMARY_AUTH_TIGHT; 506 break; 507 case VNC_AUTH_ULTRA: 508 info->auth = VNC_PRIMARY_AUTH_ULTRA; 509 break; 510 case VNC_AUTH_TLS: 511 info->auth = VNC_PRIMARY_AUTH_TLS; 512 break; 513 case VNC_AUTH_VENCRYPT: 514 info->auth = VNC_PRIMARY_AUTH_VENCRYPT; 515 #ifdef CONFIG_VNC_TLS 516 info->has_vencrypt = true; 517 switch (vd->subauth) { 518 case VNC_AUTH_VENCRYPT_PLAIN: 519 info->vencrypt = VNC_VENCRYPT_SUB_AUTH_PLAIN; 520 break; 521 case VNC_AUTH_VENCRYPT_TLSNONE: 522 info->vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_NONE; 523 break; 524 case VNC_AUTH_VENCRYPT_TLSVNC: 525 info->vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_VNC; 526 break; 527 case VNC_AUTH_VENCRYPT_TLSPLAIN: 528 info->vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_PLAIN; 529 break; 530 case VNC_AUTH_VENCRYPT_X509NONE: 531 info->vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_NONE; 532 break; 533 case VNC_AUTH_VENCRYPT_X509VNC: 534 info->vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_VNC; 535 break; 536 case VNC_AUTH_VENCRYPT_X509PLAIN: 537 info->vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_PLAIN; 538 break; 539 case VNC_AUTH_VENCRYPT_TLSSASL: 540 info->vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_SASL; 541 break; 542 case VNC_AUTH_VENCRYPT_X509SASL: 543 info->vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_SASL; 544 break; 545 default: 546 info->has_vencrypt = false; 547 break; 548 } 549 #endif 550 break; 551 case VNC_AUTH_SASL: 552 info->auth = VNC_PRIMARY_AUTH_SASL; 553 break; 554 case VNC_AUTH_NONE: 555 default: 556 info->auth = VNC_PRIMARY_AUTH_NONE; 557 break; 558 } 559 } 560 561 VncInfo2List *qmp_query_vnc_servers(Error **errp) 562 { 563 VncInfo2List *item, *prev = NULL; 564 VncInfo2 *info; 565 VncDisplay *vd; 566 DeviceState *dev; 567 568 QTAILQ_FOREACH(vd, &vnc_displays, next) { 569 info = g_new0(VncInfo2, 1); 570 info->id = g_strdup(vd->id); 571 info->clients = qmp_query_client_list(vd); 572 qmp_query_auth(vd, info); 573 if (vd->dcl.con) { 574 dev = DEVICE(object_property_get_link(OBJECT(vd->dcl.con), 575 "device", NULL)); 576 info->has_display = true; 577 info->display = g_strdup(dev->id); 578 } 579 if (vd->lsock != -1) { 580 info->server = qmp_query_server_entry(vd->lsock, false, 581 info->server); 582 } 583 #ifdef CONFIG_VNC_WS 584 if (vd->lwebsock != -1) { 585 info->server = qmp_query_server_entry(vd->lwebsock, true, 586 info->server); 587 } 588 #endif 589 590 item = g_new0(VncInfo2List, 1); 591 item->value = info; 592 item->next = prev; 593 prev = item; 594 } 595 return prev; 596 } 597 598 /* TODO 599 1) Get the queue working for IO. 600 2) there is some weirdness when using the -S option (the screen is grey 601 and not totally invalidated 602 3) resolutions > 1024 603 */ 604 605 static int vnc_update_client(VncState *vs, int has_dirty, bool sync); 606 static void vnc_disconnect_start(VncState *vs); 607 608 static void vnc_colordepth(VncState *vs); 609 static void framebuffer_update_request(VncState *vs, int incremental, 610 int x_position, int y_position, 611 int w, int h); 612 static void vnc_refresh(DisplayChangeListener *dcl); 613 static int vnc_refresh_server_surface(VncDisplay *vd); 614 615 static void vnc_set_area_dirty(DECLARE_BITMAP(dirty[VNC_MAX_HEIGHT], 616 VNC_MAX_WIDTH / VNC_DIRTY_PIXELS_PER_BIT), 617 int width, int height, 618 int x, int y, int w, int h) { 619 /* this is needed this to ensure we updated all affected 620 * blocks if x % VNC_DIRTY_PIXELS_PER_BIT != 0 */ 621 w += (x % VNC_DIRTY_PIXELS_PER_BIT); 622 x -= (x % VNC_DIRTY_PIXELS_PER_BIT); 623 624 x = MIN(x, width); 625 y = MIN(y, height); 626 w = MIN(x + w, width) - x; 627 h = MIN(y + h, height); 628 629 for (; y < h; y++) { 630 bitmap_set(dirty[y], x / VNC_DIRTY_PIXELS_PER_BIT, 631 DIV_ROUND_UP(w, VNC_DIRTY_PIXELS_PER_BIT)); 632 } 633 } 634 635 static void vnc_dpy_update(DisplayChangeListener *dcl, 636 int x, int y, int w, int h) 637 { 638 VncDisplay *vd = container_of(dcl, VncDisplay, dcl); 639 struct VncSurface *s = &vd->guest; 640 int width = pixman_image_get_width(vd->server); 641 int height = pixman_image_get_height(vd->server); 642 643 vnc_set_area_dirty(s->dirty, width, height, x, y, w, h); 644 } 645 646 void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h, 647 int32_t encoding) 648 { 649 vnc_write_u16(vs, x); 650 vnc_write_u16(vs, y); 651 vnc_write_u16(vs, w); 652 vnc_write_u16(vs, h); 653 654 vnc_write_s32(vs, encoding); 655 } 656 657 void buffer_reserve(Buffer *buffer, size_t len) 658 { 659 if ((buffer->capacity - buffer->offset) < len) { 660 buffer->capacity += (len + 1024); 661 buffer->buffer = g_realloc(buffer->buffer, buffer->capacity); 662 } 663 } 664 665 static int buffer_empty(Buffer *buffer) 666 { 667 return buffer->offset == 0; 668 } 669 670 uint8_t *buffer_end(Buffer *buffer) 671 { 672 return buffer->buffer + buffer->offset; 673 } 674 675 void buffer_reset(Buffer *buffer) 676 { 677 buffer->offset = 0; 678 } 679 680 void buffer_free(Buffer *buffer) 681 { 682 g_free(buffer->buffer); 683 buffer->offset = 0; 684 buffer->capacity = 0; 685 buffer->buffer = NULL; 686 } 687 688 void buffer_append(Buffer *buffer, const void *data, size_t len) 689 { 690 memcpy(buffer->buffer + buffer->offset, data, len); 691 buffer->offset += len; 692 } 693 694 void buffer_advance(Buffer *buf, size_t len) 695 { 696 memmove(buf->buffer, buf->buffer + len, 697 (buf->offset - len)); 698 buf->offset -= len; 699 } 700 701 static void vnc_desktop_resize(VncState *vs) 702 { 703 if (vs->csock == -1 || !vnc_has_feature(vs, VNC_FEATURE_RESIZE)) { 704 return; 705 } 706 if (vs->client_width == pixman_image_get_width(vs->vd->server) && 707 vs->client_height == pixman_image_get_height(vs->vd->server)) { 708 return; 709 } 710 vs->client_width = pixman_image_get_width(vs->vd->server); 711 vs->client_height = pixman_image_get_height(vs->vd->server); 712 vnc_lock_output(vs); 713 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 714 vnc_write_u8(vs, 0); 715 vnc_write_u16(vs, 1); /* number of rects */ 716 vnc_framebuffer_update(vs, 0, 0, vs->client_width, vs->client_height, 717 VNC_ENCODING_DESKTOPRESIZE); 718 vnc_unlock_output(vs); 719 vnc_flush(vs); 720 } 721 722 static void vnc_abort_display_jobs(VncDisplay *vd) 723 { 724 VncState *vs; 725 726 QTAILQ_FOREACH(vs, &vd->clients, next) { 727 vnc_lock_output(vs); 728 vs->abort = true; 729 vnc_unlock_output(vs); 730 } 731 QTAILQ_FOREACH(vs, &vd->clients, next) { 732 vnc_jobs_join(vs); 733 } 734 QTAILQ_FOREACH(vs, &vd->clients, next) { 735 vnc_lock_output(vs); 736 vs->abort = false; 737 vnc_unlock_output(vs); 738 } 739 } 740 741 int vnc_server_fb_stride(VncDisplay *vd) 742 { 743 return pixman_image_get_stride(vd->server); 744 } 745 746 void *vnc_server_fb_ptr(VncDisplay *vd, int x, int y) 747 { 748 uint8_t *ptr; 749 750 ptr = (uint8_t *)pixman_image_get_data(vd->server); 751 ptr += y * vnc_server_fb_stride(vd); 752 ptr += x * VNC_SERVER_FB_BYTES; 753 return ptr; 754 } 755 756 static void vnc_dpy_switch(DisplayChangeListener *dcl, 757 DisplaySurface *surface) 758 { 759 VncDisplay *vd = container_of(dcl, VncDisplay, dcl); 760 VncState *vs; 761 int width, height; 762 763 vnc_abort_display_jobs(vd); 764 765 /* server surface */ 766 qemu_pixman_image_unref(vd->server); 767 vd->ds = surface; 768 width = MIN(VNC_MAX_WIDTH, ROUND_UP(surface_width(vd->ds), 769 VNC_DIRTY_PIXELS_PER_BIT)); 770 height = MIN(VNC_MAX_HEIGHT, surface_height(vd->ds)); 771 vd->server = pixman_image_create_bits(VNC_SERVER_FB_FORMAT, 772 width, height, NULL, 0); 773 774 /* guest surface */ 775 #if 0 /* FIXME */ 776 if (ds_get_bytes_per_pixel(ds) != vd->guest.ds->pf.bytes_per_pixel) 777 console_color_init(ds); 778 #endif 779 qemu_pixman_image_unref(vd->guest.fb); 780 vd->guest.fb = pixman_image_ref(surface->image); 781 vd->guest.format = surface->format; 782 memset(vd->guest.dirty, 0x00, sizeof(vd->guest.dirty)); 783 vnc_set_area_dirty(vd->guest.dirty, width, height, 0, 0, 784 width, height); 785 786 QTAILQ_FOREACH(vs, &vd->clients, next) { 787 vnc_colordepth(vs); 788 vnc_desktop_resize(vs); 789 if (vs->vd->cursor) { 790 vnc_cursor_define(vs); 791 } 792 memset(vs->dirty, 0x00, sizeof(vs->dirty)); 793 vnc_set_area_dirty(vs->dirty, width, height, 0, 0, 794 width, height); 795 } 796 } 797 798 /* fastest code */ 799 static void vnc_write_pixels_copy(VncState *vs, 800 void *pixels, int size) 801 { 802 vnc_write(vs, pixels, size); 803 } 804 805 /* slowest but generic code. */ 806 void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v) 807 { 808 uint8_t r, g, b; 809 810 #if VNC_SERVER_FB_FORMAT == PIXMAN_FORMAT(32, PIXMAN_TYPE_ARGB, 0, 8, 8, 8) 811 r = (((v & 0x00ff0000) >> 16) << vs->client_pf.rbits) >> 8; 812 g = (((v & 0x0000ff00) >> 8) << vs->client_pf.gbits) >> 8; 813 b = (((v & 0x000000ff) >> 0) << vs->client_pf.bbits) >> 8; 814 #else 815 # error need some bits here if you change VNC_SERVER_FB_FORMAT 816 #endif 817 v = (r << vs->client_pf.rshift) | 818 (g << vs->client_pf.gshift) | 819 (b << vs->client_pf.bshift); 820 switch (vs->client_pf.bytes_per_pixel) { 821 case 1: 822 buf[0] = v; 823 break; 824 case 2: 825 if (vs->client_be) { 826 buf[0] = v >> 8; 827 buf[1] = v; 828 } else { 829 buf[1] = v >> 8; 830 buf[0] = v; 831 } 832 break; 833 default: 834 case 4: 835 if (vs->client_be) { 836 buf[0] = v >> 24; 837 buf[1] = v >> 16; 838 buf[2] = v >> 8; 839 buf[3] = v; 840 } else { 841 buf[3] = v >> 24; 842 buf[2] = v >> 16; 843 buf[1] = v >> 8; 844 buf[0] = v; 845 } 846 break; 847 } 848 } 849 850 static void vnc_write_pixels_generic(VncState *vs, 851 void *pixels1, int size) 852 { 853 uint8_t buf[4]; 854 855 if (VNC_SERVER_FB_BYTES == 4) { 856 uint32_t *pixels = pixels1; 857 int n, i; 858 n = size >> 2; 859 for (i = 0; i < n; i++) { 860 vnc_convert_pixel(vs, buf, pixels[i]); 861 vnc_write(vs, buf, vs->client_pf.bytes_per_pixel); 862 } 863 } 864 } 865 866 int vnc_raw_send_framebuffer_update(VncState *vs, int x, int y, int w, int h) 867 { 868 int i; 869 uint8_t *row; 870 VncDisplay *vd = vs->vd; 871 872 row = vnc_server_fb_ptr(vd, x, y); 873 for (i = 0; i < h; i++) { 874 vs->write_pixels(vs, row, w * VNC_SERVER_FB_BYTES); 875 row += vnc_server_fb_stride(vd); 876 } 877 return 1; 878 } 879 880 int vnc_send_framebuffer_update(VncState *vs, int x, int y, int w, int h) 881 { 882 int n = 0; 883 884 switch(vs->vnc_encoding) { 885 case VNC_ENCODING_ZLIB: 886 n = vnc_zlib_send_framebuffer_update(vs, x, y, w, h); 887 break; 888 case VNC_ENCODING_HEXTILE: 889 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE); 890 n = vnc_hextile_send_framebuffer_update(vs, x, y, w, h); 891 break; 892 case VNC_ENCODING_TIGHT: 893 n = vnc_tight_send_framebuffer_update(vs, x, y, w, h); 894 break; 895 case VNC_ENCODING_TIGHT_PNG: 896 n = vnc_tight_png_send_framebuffer_update(vs, x, y, w, h); 897 break; 898 case VNC_ENCODING_ZRLE: 899 n = vnc_zrle_send_framebuffer_update(vs, x, y, w, h); 900 break; 901 case VNC_ENCODING_ZYWRLE: 902 n = vnc_zywrle_send_framebuffer_update(vs, x, y, w, h); 903 break; 904 default: 905 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW); 906 n = vnc_raw_send_framebuffer_update(vs, x, y, w, h); 907 break; 908 } 909 return n; 910 } 911 912 static void vnc_copy(VncState *vs, int src_x, int src_y, int dst_x, int dst_y, int w, int h) 913 { 914 /* send bitblit op to the vnc client */ 915 vnc_lock_output(vs); 916 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 917 vnc_write_u8(vs, 0); 918 vnc_write_u16(vs, 1); /* number of rects */ 919 vnc_framebuffer_update(vs, dst_x, dst_y, w, h, VNC_ENCODING_COPYRECT); 920 vnc_write_u16(vs, src_x); 921 vnc_write_u16(vs, src_y); 922 vnc_unlock_output(vs); 923 vnc_flush(vs); 924 } 925 926 static void vnc_dpy_copy(DisplayChangeListener *dcl, 927 int src_x, int src_y, 928 int dst_x, int dst_y, int w, int h) 929 { 930 VncDisplay *vd = container_of(dcl, VncDisplay, dcl); 931 VncState *vs, *vn; 932 uint8_t *src_row; 933 uint8_t *dst_row; 934 int i, x, y, pitch, inc, w_lim, s; 935 int cmp_bytes; 936 937 vnc_refresh_server_surface(vd); 938 QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) { 939 if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) { 940 vs->force_update = 1; 941 vnc_update_client(vs, 1, true); 942 /* vs might be free()ed here */ 943 } 944 } 945 946 /* do bitblit op on the local surface too */ 947 pitch = vnc_server_fb_stride(vd); 948 src_row = vnc_server_fb_ptr(vd, src_x, src_y); 949 dst_row = vnc_server_fb_ptr(vd, dst_x, dst_y); 950 y = dst_y; 951 inc = 1; 952 if (dst_y > src_y) { 953 /* copy backwards */ 954 src_row += pitch * (h-1); 955 dst_row += pitch * (h-1); 956 pitch = -pitch; 957 y = dst_y + h - 1; 958 inc = -1; 959 } 960 w_lim = w - (VNC_DIRTY_PIXELS_PER_BIT - (dst_x % VNC_DIRTY_PIXELS_PER_BIT)); 961 if (w_lim < 0) { 962 w_lim = w; 963 } else { 964 w_lim = w - (w_lim % VNC_DIRTY_PIXELS_PER_BIT); 965 } 966 for (i = 0; i < h; i++) { 967 for (x = 0; x <= w_lim; 968 x += s, src_row += cmp_bytes, dst_row += cmp_bytes) { 969 if (x == w_lim) { 970 if ((s = w - w_lim) == 0) 971 break; 972 } else if (!x) { 973 s = (VNC_DIRTY_PIXELS_PER_BIT - 974 (dst_x % VNC_DIRTY_PIXELS_PER_BIT)); 975 s = MIN(s, w_lim); 976 } else { 977 s = VNC_DIRTY_PIXELS_PER_BIT; 978 } 979 cmp_bytes = s * VNC_SERVER_FB_BYTES; 980 if (memcmp(src_row, dst_row, cmp_bytes) == 0) 981 continue; 982 memmove(dst_row, src_row, cmp_bytes); 983 QTAILQ_FOREACH(vs, &vd->clients, next) { 984 if (!vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) { 985 set_bit(((x + dst_x) / VNC_DIRTY_PIXELS_PER_BIT), 986 vs->dirty[y]); 987 } 988 } 989 } 990 src_row += pitch - w * VNC_SERVER_FB_BYTES; 991 dst_row += pitch - w * VNC_SERVER_FB_BYTES; 992 y += inc; 993 } 994 995 QTAILQ_FOREACH(vs, &vd->clients, next) { 996 if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) { 997 vnc_copy(vs, src_x, src_y, dst_x, dst_y, w, h); 998 } 999 } 1000 } 1001 1002 static void vnc_mouse_set(DisplayChangeListener *dcl, 1003 int x, int y, int visible) 1004 { 1005 /* can we ask the client(s) to move the pointer ??? */ 1006 } 1007 1008 static int vnc_cursor_define(VncState *vs) 1009 { 1010 QEMUCursor *c = vs->vd->cursor; 1011 int isize; 1012 1013 if (vnc_has_feature(vs, VNC_FEATURE_RICH_CURSOR)) { 1014 vnc_lock_output(vs); 1015 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 1016 vnc_write_u8(vs, 0); /* padding */ 1017 vnc_write_u16(vs, 1); /* # of rects */ 1018 vnc_framebuffer_update(vs, c->hot_x, c->hot_y, c->width, c->height, 1019 VNC_ENCODING_RICH_CURSOR); 1020 isize = c->width * c->height * vs->client_pf.bytes_per_pixel; 1021 vnc_write_pixels_generic(vs, c->data, isize); 1022 vnc_write(vs, vs->vd->cursor_mask, vs->vd->cursor_msize); 1023 vnc_unlock_output(vs); 1024 return 0; 1025 } 1026 return -1; 1027 } 1028 1029 static void vnc_dpy_cursor_define(DisplayChangeListener *dcl, 1030 QEMUCursor *c) 1031 { 1032 VncDisplay *vd = container_of(dcl, VncDisplay, dcl); 1033 VncState *vs; 1034 1035 cursor_put(vd->cursor); 1036 g_free(vd->cursor_mask); 1037 1038 vd->cursor = c; 1039 cursor_get(vd->cursor); 1040 vd->cursor_msize = cursor_get_mono_bpl(c) * c->height; 1041 vd->cursor_mask = g_malloc0(vd->cursor_msize); 1042 cursor_get_mono_mask(c, 0, vd->cursor_mask); 1043 1044 QTAILQ_FOREACH(vs, &vd->clients, next) { 1045 vnc_cursor_define(vs); 1046 } 1047 } 1048 1049 static int find_and_clear_dirty_height(VncState *vs, 1050 int y, int last_x, int x, int height) 1051 { 1052 int h; 1053 1054 for (h = 1; h < (height - y); h++) { 1055 if (!test_bit(last_x, vs->dirty[y + h])) { 1056 break; 1057 } 1058 bitmap_clear(vs->dirty[y + h], last_x, x - last_x); 1059 } 1060 1061 return h; 1062 } 1063 1064 static int vnc_update_client(VncState *vs, int has_dirty, bool sync) 1065 { 1066 vs->has_dirty += has_dirty; 1067 if (vs->need_update && vs->csock != -1) { 1068 VncDisplay *vd = vs->vd; 1069 VncJob *job; 1070 int y; 1071 int height, width; 1072 int n = 0; 1073 1074 if (vs->output.offset && !vs->audio_cap && !vs->force_update) 1075 /* kernel send buffers are full -> drop frames to throttle */ 1076 return 0; 1077 1078 if (!vs->has_dirty && !vs->audio_cap && !vs->force_update) 1079 return 0; 1080 1081 /* 1082 * Send screen updates to the vnc client using the server 1083 * surface and server dirty map. guest surface updates 1084 * happening in parallel don't disturb us, the next pass will 1085 * send them to the client. 1086 */ 1087 job = vnc_job_new(vs); 1088 1089 height = pixman_image_get_height(vd->server); 1090 width = pixman_image_get_width(vd->server); 1091 1092 y = 0; 1093 for (;;) { 1094 int x, h; 1095 unsigned long x2; 1096 unsigned long offset = find_next_bit((unsigned long *) &vs->dirty, 1097 height * VNC_DIRTY_BPL(vs), 1098 y * VNC_DIRTY_BPL(vs)); 1099 if (offset == height * VNC_DIRTY_BPL(vs)) { 1100 /* no more dirty bits */ 1101 break; 1102 } 1103 y = offset / VNC_DIRTY_BPL(vs); 1104 x = offset % VNC_DIRTY_BPL(vs); 1105 x2 = find_next_zero_bit((unsigned long *) &vs->dirty[y], 1106 VNC_DIRTY_BPL(vs), x); 1107 bitmap_clear(vs->dirty[y], x, x2 - x); 1108 h = find_and_clear_dirty_height(vs, y, x, x2, height); 1109 x2 = MIN(x2, width / VNC_DIRTY_PIXELS_PER_BIT); 1110 if (x2 > x) { 1111 n += vnc_job_add_rect(job, x * VNC_DIRTY_PIXELS_PER_BIT, y, 1112 (x2 - x) * VNC_DIRTY_PIXELS_PER_BIT, h); 1113 } 1114 if (!x && x2 == width / VNC_DIRTY_PIXELS_PER_BIT) { 1115 y += h; 1116 if (y == height) { 1117 break; 1118 } 1119 } 1120 } 1121 1122 vnc_job_push(job); 1123 if (sync) { 1124 vnc_jobs_join(vs); 1125 } 1126 vs->force_update = 0; 1127 vs->has_dirty = 0; 1128 return n; 1129 } 1130 1131 if (vs->csock == -1) { 1132 vnc_disconnect_finish(vs); 1133 } else if (sync) { 1134 vnc_jobs_join(vs); 1135 } 1136 1137 return 0; 1138 } 1139 1140 /* audio */ 1141 static void audio_capture_notify(void *opaque, audcnotification_e cmd) 1142 { 1143 VncState *vs = opaque; 1144 1145 switch (cmd) { 1146 case AUD_CNOTIFY_DISABLE: 1147 vnc_lock_output(vs); 1148 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU); 1149 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO); 1150 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_END); 1151 vnc_unlock_output(vs); 1152 vnc_flush(vs); 1153 break; 1154 1155 case AUD_CNOTIFY_ENABLE: 1156 vnc_lock_output(vs); 1157 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU); 1158 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO); 1159 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_BEGIN); 1160 vnc_unlock_output(vs); 1161 vnc_flush(vs); 1162 break; 1163 } 1164 } 1165 1166 static void audio_capture_destroy(void *opaque) 1167 { 1168 } 1169 1170 static void audio_capture(void *opaque, void *buf, int size) 1171 { 1172 VncState *vs = opaque; 1173 1174 vnc_lock_output(vs); 1175 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU); 1176 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO); 1177 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_DATA); 1178 vnc_write_u32(vs, size); 1179 vnc_write(vs, buf, size); 1180 vnc_unlock_output(vs); 1181 vnc_flush(vs); 1182 } 1183 1184 static void audio_add(VncState *vs) 1185 { 1186 struct audio_capture_ops ops; 1187 1188 if (vs->audio_cap) { 1189 error_report("audio already running"); 1190 return; 1191 } 1192 1193 ops.notify = audio_capture_notify; 1194 ops.destroy = audio_capture_destroy; 1195 ops.capture = audio_capture; 1196 1197 vs->audio_cap = AUD_add_capture(&vs->as, &ops, vs); 1198 if (!vs->audio_cap) { 1199 error_report("Failed to add audio capture"); 1200 } 1201 } 1202 1203 static void audio_del(VncState *vs) 1204 { 1205 if (vs->audio_cap) { 1206 AUD_del_capture(vs->audio_cap, vs); 1207 vs->audio_cap = NULL; 1208 } 1209 } 1210 1211 static void vnc_disconnect_start(VncState *vs) 1212 { 1213 if (vs->csock == -1) 1214 return; 1215 vnc_set_share_mode(vs, VNC_SHARE_MODE_DISCONNECTED); 1216 qemu_set_fd_handler2(vs->csock, NULL, NULL, NULL, NULL); 1217 closesocket(vs->csock); 1218 vs->csock = -1; 1219 } 1220 1221 void vnc_disconnect_finish(VncState *vs) 1222 { 1223 int i; 1224 1225 vnc_jobs_join(vs); /* Wait encoding jobs */ 1226 1227 vnc_lock_output(vs); 1228 vnc_qmp_event(vs, QAPI_EVENT_VNC_DISCONNECTED); 1229 1230 buffer_free(&vs->input); 1231 buffer_free(&vs->output); 1232 #ifdef CONFIG_VNC_WS 1233 buffer_free(&vs->ws_input); 1234 buffer_free(&vs->ws_output); 1235 #endif /* CONFIG_VNC_WS */ 1236 1237 qapi_free_VncClientInfo(vs->info); 1238 1239 vnc_zlib_clear(vs); 1240 vnc_tight_clear(vs); 1241 vnc_zrle_clear(vs); 1242 1243 #ifdef CONFIG_VNC_TLS 1244 vnc_tls_client_cleanup(vs); 1245 #endif /* CONFIG_VNC_TLS */ 1246 #ifdef CONFIG_VNC_SASL 1247 vnc_sasl_client_cleanup(vs); 1248 #endif /* CONFIG_VNC_SASL */ 1249 audio_del(vs); 1250 vnc_release_modifiers(vs); 1251 1252 if (vs->initialized) { 1253 QTAILQ_REMOVE(&vs->vd->clients, vs, next); 1254 qemu_remove_mouse_mode_change_notifier(&vs->mouse_mode_notifier); 1255 } 1256 1257 if (vs->vd->lock_key_sync) 1258 qemu_remove_led_event_handler(vs->led); 1259 vnc_unlock_output(vs); 1260 1261 qemu_mutex_destroy(&vs->output_mutex); 1262 if (vs->bh != NULL) { 1263 qemu_bh_delete(vs->bh); 1264 } 1265 buffer_free(&vs->jobs_buffer); 1266 1267 for (i = 0; i < VNC_STAT_ROWS; ++i) { 1268 g_free(vs->lossy_rect[i]); 1269 } 1270 g_free(vs->lossy_rect); 1271 g_free(vs); 1272 } 1273 1274 int vnc_client_io_error(VncState *vs, int ret, int last_errno) 1275 { 1276 if (ret == 0 || ret == -1) { 1277 if (ret == -1) { 1278 switch (last_errno) { 1279 case EINTR: 1280 case EAGAIN: 1281 #ifdef _WIN32 1282 case WSAEWOULDBLOCK: 1283 #endif 1284 return 0; 1285 default: 1286 break; 1287 } 1288 } 1289 1290 VNC_DEBUG("Closing down client sock: ret %d, errno %d\n", 1291 ret, ret < 0 ? last_errno : 0); 1292 vnc_disconnect_start(vs); 1293 1294 return 0; 1295 } 1296 return ret; 1297 } 1298 1299 1300 void vnc_client_error(VncState *vs) 1301 { 1302 VNC_DEBUG("Closing down client sock: protocol error\n"); 1303 vnc_disconnect_start(vs); 1304 } 1305 1306 #ifdef CONFIG_VNC_TLS 1307 static long vnc_client_write_tls(gnutls_session_t *session, 1308 const uint8_t *data, 1309 size_t datalen) 1310 { 1311 long ret = gnutls_write(*session, data, datalen); 1312 if (ret < 0) { 1313 if (ret == GNUTLS_E_AGAIN) { 1314 errno = EAGAIN; 1315 } else { 1316 errno = EIO; 1317 } 1318 ret = -1; 1319 } 1320 return ret; 1321 } 1322 #endif /* CONFIG_VNC_TLS */ 1323 1324 /* 1325 * Called to write a chunk of data to the client socket. The data may 1326 * be the raw data, or may have already been encoded by SASL. 1327 * The data will be written either straight onto the socket, or 1328 * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled 1329 * 1330 * NB, it is theoretically possible to have 2 layers of encryption, 1331 * both SASL, and this TLS layer. It is highly unlikely in practice 1332 * though, since SASL encryption will typically be a no-op if TLS 1333 * is active 1334 * 1335 * Returns the number of bytes written, which may be less than 1336 * the requested 'datalen' if the socket would block. Returns 1337 * -1 on error, and disconnects the client socket. 1338 */ 1339 long vnc_client_write_buf(VncState *vs, const uint8_t *data, size_t datalen) 1340 { 1341 long ret; 1342 #ifdef CONFIG_VNC_TLS 1343 if (vs->tls.session) { 1344 ret = vnc_client_write_tls(&vs->tls.session, data, datalen); 1345 } else { 1346 #endif /* CONFIG_VNC_TLS */ 1347 ret = send(vs->csock, (const void *)data, datalen, 0); 1348 #ifdef CONFIG_VNC_TLS 1349 } 1350 #endif /* CONFIG_VNC_TLS */ 1351 VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data, datalen, ret); 1352 return vnc_client_io_error(vs, ret, socket_error()); 1353 } 1354 1355 1356 /* 1357 * Called to write buffered data to the client socket, when not 1358 * using any SASL SSF encryption layers. Will write as much data 1359 * as possible without blocking. If all buffered data is written, 1360 * will switch the FD poll() handler back to read monitoring. 1361 * 1362 * Returns the number of bytes written, which may be less than 1363 * the buffered output data if the socket would block. Returns 1364 * -1 on error, and disconnects the client socket. 1365 */ 1366 static long vnc_client_write_plain(VncState *vs) 1367 { 1368 long ret; 1369 1370 #ifdef CONFIG_VNC_SASL 1371 VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n", 1372 vs->output.buffer, vs->output.capacity, vs->output.offset, 1373 vs->sasl.waitWriteSSF); 1374 1375 if (vs->sasl.conn && 1376 vs->sasl.runSSF && 1377 vs->sasl.waitWriteSSF) { 1378 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF); 1379 if (ret) 1380 vs->sasl.waitWriteSSF -= ret; 1381 } else 1382 #endif /* CONFIG_VNC_SASL */ 1383 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset); 1384 if (!ret) 1385 return 0; 1386 1387 buffer_advance(&vs->output, ret); 1388 1389 if (vs->output.offset == 0) { 1390 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs); 1391 } 1392 1393 return ret; 1394 } 1395 1396 1397 /* 1398 * First function called whenever there is data to be written to 1399 * the client socket. Will delegate actual work according to whether 1400 * SASL SSF layers are enabled (thus requiring encryption calls) 1401 */ 1402 static void vnc_client_write_locked(void *opaque) 1403 { 1404 VncState *vs = opaque; 1405 1406 #ifdef CONFIG_VNC_SASL 1407 if (vs->sasl.conn && 1408 vs->sasl.runSSF && 1409 !vs->sasl.waitWriteSSF) { 1410 vnc_client_write_sasl(vs); 1411 } else 1412 #endif /* CONFIG_VNC_SASL */ 1413 { 1414 #ifdef CONFIG_VNC_WS 1415 if (vs->encode_ws) { 1416 vnc_client_write_ws(vs); 1417 } else 1418 #endif /* CONFIG_VNC_WS */ 1419 { 1420 vnc_client_write_plain(vs); 1421 } 1422 } 1423 } 1424 1425 void vnc_client_write(void *opaque) 1426 { 1427 VncState *vs = opaque; 1428 1429 vnc_lock_output(vs); 1430 if (vs->output.offset 1431 #ifdef CONFIG_VNC_WS 1432 || vs->ws_output.offset 1433 #endif 1434 ) { 1435 vnc_client_write_locked(opaque); 1436 } else if (vs->csock != -1) { 1437 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs); 1438 } 1439 vnc_unlock_output(vs); 1440 } 1441 1442 void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting) 1443 { 1444 vs->read_handler = func; 1445 vs->read_handler_expect = expecting; 1446 } 1447 1448 #ifdef CONFIG_VNC_TLS 1449 static long vnc_client_read_tls(gnutls_session_t *session, uint8_t *data, 1450 size_t datalen) 1451 { 1452 long ret = gnutls_read(*session, data, datalen); 1453 if (ret < 0) { 1454 if (ret == GNUTLS_E_AGAIN) { 1455 errno = EAGAIN; 1456 } else { 1457 errno = EIO; 1458 } 1459 ret = -1; 1460 } 1461 return ret; 1462 } 1463 #endif /* CONFIG_VNC_TLS */ 1464 1465 /* 1466 * Called to read a chunk of data from the client socket. The data may 1467 * be the raw data, or may need to be further decoded by SASL. 1468 * The data will be read either straight from to the socket, or 1469 * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled 1470 * 1471 * NB, it is theoretically possible to have 2 layers of encryption, 1472 * both SASL, and this TLS layer. It is highly unlikely in practice 1473 * though, since SASL encryption will typically be a no-op if TLS 1474 * is active 1475 * 1476 * Returns the number of bytes read, which may be less than 1477 * the requested 'datalen' if the socket would block. Returns 1478 * -1 on error, and disconnects the client socket. 1479 */ 1480 long vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen) 1481 { 1482 long ret; 1483 #ifdef CONFIG_VNC_TLS 1484 if (vs->tls.session) { 1485 ret = vnc_client_read_tls(&vs->tls.session, data, datalen); 1486 } else { 1487 #endif /* CONFIG_VNC_TLS */ 1488 ret = qemu_recv(vs->csock, data, datalen, 0); 1489 #ifdef CONFIG_VNC_TLS 1490 } 1491 #endif /* CONFIG_VNC_TLS */ 1492 VNC_DEBUG("Read wire %p %zd -> %ld\n", data, datalen, ret); 1493 return vnc_client_io_error(vs, ret, socket_error()); 1494 } 1495 1496 1497 /* 1498 * Called to read data from the client socket to the input buffer, 1499 * when not using any SASL SSF encryption layers. Will read as much 1500 * data as possible without blocking. 1501 * 1502 * Returns the number of bytes read. Returns -1 on error, and 1503 * disconnects the client socket. 1504 */ 1505 static long vnc_client_read_plain(VncState *vs) 1506 { 1507 int ret; 1508 VNC_DEBUG("Read plain %p size %zd offset %zd\n", 1509 vs->input.buffer, vs->input.capacity, vs->input.offset); 1510 buffer_reserve(&vs->input, 4096); 1511 ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096); 1512 if (!ret) 1513 return 0; 1514 vs->input.offset += ret; 1515 return ret; 1516 } 1517 1518 static void vnc_jobs_bh(void *opaque) 1519 { 1520 VncState *vs = opaque; 1521 1522 vnc_jobs_consume_buffer(vs); 1523 } 1524 1525 /* 1526 * First function called whenever there is more data to be read from 1527 * the client socket. Will delegate actual work according to whether 1528 * SASL SSF layers are enabled (thus requiring decryption calls) 1529 */ 1530 void vnc_client_read(void *opaque) 1531 { 1532 VncState *vs = opaque; 1533 long ret; 1534 1535 #ifdef CONFIG_VNC_SASL 1536 if (vs->sasl.conn && vs->sasl.runSSF) 1537 ret = vnc_client_read_sasl(vs); 1538 else 1539 #endif /* CONFIG_VNC_SASL */ 1540 #ifdef CONFIG_VNC_WS 1541 if (vs->encode_ws) { 1542 ret = vnc_client_read_ws(vs); 1543 if (ret == -1) { 1544 vnc_disconnect_start(vs); 1545 return; 1546 } else if (ret == -2) { 1547 vnc_client_error(vs); 1548 return; 1549 } 1550 } else 1551 #endif /* CONFIG_VNC_WS */ 1552 { 1553 ret = vnc_client_read_plain(vs); 1554 } 1555 if (!ret) { 1556 if (vs->csock == -1) 1557 vnc_disconnect_finish(vs); 1558 return; 1559 } 1560 1561 while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) { 1562 size_t len = vs->read_handler_expect; 1563 int ret; 1564 1565 ret = vs->read_handler(vs, vs->input.buffer, len); 1566 if (vs->csock == -1) { 1567 vnc_disconnect_finish(vs); 1568 return; 1569 } 1570 1571 if (!ret) { 1572 buffer_advance(&vs->input, len); 1573 } else { 1574 vs->read_handler_expect = ret; 1575 } 1576 } 1577 } 1578 1579 void vnc_write(VncState *vs, const void *data, size_t len) 1580 { 1581 buffer_reserve(&vs->output, len); 1582 1583 if (vs->csock != -1 && buffer_empty(&vs->output)) { 1584 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, vnc_client_write, vs); 1585 } 1586 1587 buffer_append(&vs->output, data, len); 1588 } 1589 1590 void vnc_write_s32(VncState *vs, int32_t value) 1591 { 1592 vnc_write_u32(vs, *(uint32_t *)&value); 1593 } 1594 1595 void vnc_write_u32(VncState *vs, uint32_t value) 1596 { 1597 uint8_t buf[4]; 1598 1599 buf[0] = (value >> 24) & 0xFF; 1600 buf[1] = (value >> 16) & 0xFF; 1601 buf[2] = (value >> 8) & 0xFF; 1602 buf[3] = value & 0xFF; 1603 1604 vnc_write(vs, buf, 4); 1605 } 1606 1607 void vnc_write_u16(VncState *vs, uint16_t value) 1608 { 1609 uint8_t buf[2]; 1610 1611 buf[0] = (value >> 8) & 0xFF; 1612 buf[1] = value & 0xFF; 1613 1614 vnc_write(vs, buf, 2); 1615 } 1616 1617 void vnc_write_u8(VncState *vs, uint8_t value) 1618 { 1619 vnc_write(vs, (char *)&value, 1); 1620 } 1621 1622 void vnc_flush(VncState *vs) 1623 { 1624 vnc_lock_output(vs); 1625 if (vs->csock != -1 && (vs->output.offset 1626 #ifdef CONFIG_VNC_WS 1627 || vs->ws_output.offset 1628 #endif 1629 )) { 1630 vnc_client_write_locked(vs); 1631 } 1632 vnc_unlock_output(vs); 1633 } 1634 1635 static uint8_t read_u8(uint8_t *data, size_t offset) 1636 { 1637 return data[offset]; 1638 } 1639 1640 static uint16_t read_u16(uint8_t *data, size_t offset) 1641 { 1642 return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF); 1643 } 1644 1645 static int32_t read_s32(uint8_t *data, size_t offset) 1646 { 1647 return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) | 1648 (data[offset + 2] << 8) | data[offset + 3]); 1649 } 1650 1651 uint32_t read_u32(uint8_t *data, size_t offset) 1652 { 1653 return ((data[offset] << 24) | (data[offset + 1] << 16) | 1654 (data[offset + 2] << 8) | data[offset + 3]); 1655 } 1656 1657 static void client_cut_text(VncState *vs, size_t len, uint8_t *text) 1658 { 1659 } 1660 1661 static void check_pointer_type_change(Notifier *notifier, void *data) 1662 { 1663 VncState *vs = container_of(notifier, VncState, mouse_mode_notifier); 1664 int absolute = qemu_input_is_absolute(); 1665 1666 if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) { 1667 vnc_lock_output(vs); 1668 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 1669 vnc_write_u8(vs, 0); 1670 vnc_write_u16(vs, 1); 1671 vnc_framebuffer_update(vs, absolute, 0, 1672 pixman_image_get_width(vs->vd->server), 1673 pixman_image_get_height(vs->vd->server), 1674 VNC_ENCODING_POINTER_TYPE_CHANGE); 1675 vnc_unlock_output(vs); 1676 vnc_flush(vs); 1677 } 1678 vs->absolute = absolute; 1679 } 1680 1681 static void pointer_event(VncState *vs, int button_mask, int x, int y) 1682 { 1683 static uint32_t bmap[INPUT_BUTTON_MAX] = { 1684 [INPUT_BUTTON_LEFT] = 0x01, 1685 [INPUT_BUTTON_MIDDLE] = 0x02, 1686 [INPUT_BUTTON_RIGHT] = 0x04, 1687 [INPUT_BUTTON_WHEEL_UP] = 0x08, 1688 [INPUT_BUTTON_WHEEL_DOWN] = 0x10, 1689 }; 1690 QemuConsole *con = vs->vd->dcl.con; 1691 int width = pixman_image_get_width(vs->vd->server); 1692 int height = pixman_image_get_height(vs->vd->server); 1693 1694 if (vs->last_bmask != button_mask) { 1695 qemu_input_update_buttons(con, bmap, vs->last_bmask, button_mask); 1696 vs->last_bmask = button_mask; 1697 } 1698 1699 if (vs->absolute) { 1700 qemu_input_queue_abs(con, INPUT_AXIS_X, x, width); 1701 qemu_input_queue_abs(con, INPUT_AXIS_Y, y, height); 1702 } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) { 1703 qemu_input_queue_rel(con, INPUT_AXIS_X, x - 0x7FFF); 1704 qemu_input_queue_rel(con, INPUT_AXIS_Y, y - 0x7FFF); 1705 } else { 1706 if (vs->last_x != -1) { 1707 qemu_input_queue_rel(con, INPUT_AXIS_X, x - vs->last_x); 1708 qemu_input_queue_rel(con, INPUT_AXIS_Y, y - vs->last_y); 1709 } 1710 vs->last_x = x; 1711 vs->last_y = y; 1712 } 1713 qemu_input_event_sync(); 1714 } 1715 1716 static void reset_keys(VncState *vs) 1717 { 1718 int i; 1719 for(i = 0; i < 256; i++) { 1720 if (vs->modifiers_state[i]) { 1721 qemu_input_event_send_key_number(vs->vd->dcl.con, i, false); 1722 vs->modifiers_state[i] = 0; 1723 } 1724 } 1725 } 1726 1727 static void press_key(VncState *vs, int keysym) 1728 { 1729 int keycode = keysym2scancode(vs->vd->kbd_layout, keysym) & SCANCODE_KEYMASK; 1730 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, true); 1731 qemu_input_event_send_key_delay(0); 1732 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, false); 1733 qemu_input_event_send_key_delay(0); 1734 } 1735 1736 static int current_led_state(VncState *vs) 1737 { 1738 int ledstate = 0; 1739 1740 if (vs->modifiers_state[0x46]) { 1741 ledstate |= QEMU_SCROLL_LOCK_LED; 1742 } 1743 if (vs->modifiers_state[0x45]) { 1744 ledstate |= QEMU_NUM_LOCK_LED; 1745 } 1746 if (vs->modifiers_state[0x3a]) { 1747 ledstate |= QEMU_CAPS_LOCK_LED; 1748 } 1749 1750 return ledstate; 1751 } 1752 1753 static void vnc_led_state_change(VncState *vs) 1754 { 1755 int ledstate = 0; 1756 1757 if (!vnc_has_feature(vs, VNC_FEATURE_LED_STATE)) { 1758 return; 1759 } 1760 1761 ledstate = current_led_state(vs); 1762 vnc_lock_output(vs); 1763 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 1764 vnc_write_u8(vs, 0); 1765 vnc_write_u16(vs, 1); 1766 vnc_framebuffer_update(vs, 0, 0, 1, 1, VNC_ENCODING_LED_STATE); 1767 vnc_write_u8(vs, ledstate); 1768 vnc_unlock_output(vs); 1769 vnc_flush(vs); 1770 } 1771 1772 static void kbd_leds(void *opaque, int ledstate) 1773 { 1774 VncState *vs = opaque; 1775 int caps, num, scr; 1776 bool has_changed = (ledstate != current_led_state(vs)); 1777 1778 trace_vnc_key_guest_leds((ledstate & QEMU_CAPS_LOCK_LED), 1779 (ledstate & QEMU_NUM_LOCK_LED), 1780 (ledstate & QEMU_SCROLL_LOCK_LED)); 1781 1782 caps = ledstate & QEMU_CAPS_LOCK_LED ? 1 : 0; 1783 num = ledstate & QEMU_NUM_LOCK_LED ? 1 : 0; 1784 scr = ledstate & QEMU_SCROLL_LOCK_LED ? 1 : 0; 1785 1786 if (vs->modifiers_state[0x3a] != caps) { 1787 vs->modifiers_state[0x3a] = caps; 1788 } 1789 if (vs->modifiers_state[0x45] != num) { 1790 vs->modifiers_state[0x45] = num; 1791 } 1792 if (vs->modifiers_state[0x46] != scr) { 1793 vs->modifiers_state[0x46] = scr; 1794 } 1795 1796 /* Sending the current led state message to the client */ 1797 if (has_changed) { 1798 vnc_led_state_change(vs); 1799 } 1800 } 1801 1802 static void do_key_event(VncState *vs, int down, int keycode, int sym) 1803 { 1804 /* QEMU console switch */ 1805 switch(keycode) { 1806 case 0x2a: /* Left Shift */ 1807 case 0x36: /* Right Shift */ 1808 case 0x1d: /* Left CTRL */ 1809 case 0x9d: /* Right CTRL */ 1810 case 0x38: /* Left ALT */ 1811 case 0xb8: /* Right ALT */ 1812 if (down) 1813 vs->modifiers_state[keycode] = 1; 1814 else 1815 vs->modifiers_state[keycode] = 0; 1816 break; 1817 case 0x02 ... 0x0a: /* '1' to '9' keys */ 1818 if (vs->vd->dcl.con == NULL && 1819 down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) { 1820 /* Reset the modifiers sent to the current console */ 1821 reset_keys(vs); 1822 console_select(keycode - 0x02); 1823 return; 1824 } 1825 break; 1826 case 0x3a: /* CapsLock */ 1827 case 0x45: /* NumLock */ 1828 if (down) 1829 vs->modifiers_state[keycode] ^= 1; 1830 break; 1831 } 1832 1833 /* Turn off the lock state sync logic if the client support the led 1834 state extension. 1835 */ 1836 if (down && vs->vd->lock_key_sync && 1837 !vnc_has_feature(vs, VNC_FEATURE_LED_STATE) && 1838 keycode_is_keypad(vs->vd->kbd_layout, keycode)) { 1839 /* If the numlock state needs to change then simulate an additional 1840 keypress before sending this one. This will happen if the user 1841 toggles numlock away from the VNC window. 1842 */ 1843 if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) { 1844 if (!vs->modifiers_state[0x45]) { 1845 trace_vnc_key_sync_numlock(true); 1846 vs->modifiers_state[0x45] = 1; 1847 press_key(vs, 0xff7f); 1848 } 1849 } else { 1850 if (vs->modifiers_state[0x45]) { 1851 trace_vnc_key_sync_numlock(false); 1852 vs->modifiers_state[0x45] = 0; 1853 press_key(vs, 0xff7f); 1854 } 1855 } 1856 } 1857 1858 if (down && vs->vd->lock_key_sync && 1859 !vnc_has_feature(vs, VNC_FEATURE_LED_STATE) && 1860 ((sym >= 'A' && sym <= 'Z') || (sym >= 'a' && sym <= 'z'))) { 1861 /* If the capslock state needs to change then simulate an additional 1862 keypress before sending this one. This will happen if the user 1863 toggles capslock away from the VNC window. 1864 */ 1865 int uppercase = !!(sym >= 'A' && sym <= 'Z'); 1866 int shift = !!(vs->modifiers_state[0x2a] | vs->modifiers_state[0x36]); 1867 int capslock = !!(vs->modifiers_state[0x3a]); 1868 if (capslock) { 1869 if (uppercase == shift) { 1870 trace_vnc_key_sync_capslock(false); 1871 vs->modifiers_state[0x3a] = 0; 1872 press_key(vs, 0xffe5); 1873 } 1874 } else { 1875 if (uppercase != shift) { 1876 trace_vnc_key_sync_capslock(true); 1877 vs->modifiers_state[0x3a] = 1; 1878 press_key(vs, 0xffe5); 1879 } 1880 } 1881 } 1882 1883 if (qemu_console_is_graphic(NULL)) { 1884 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, down); 1885 } else { 1886 bool numlock = vs->modifiers_state[0x45]; 1887 bool control = (vs->modifiers_state[0x1d] || 1888 vs->modifiers_state[0x9d]); 1889 /* QEMU console emulation */ 1890 if (down) { 1891 switch (keycode) { 1892 case 0x2a: /* Left Shift */ 1893 case 0x36: /* Right Shift */ 1894 case 0x1d: /* Left CTRL */ 1895 case 0x9d: /* Right CTRL */ 1896 case 0x38: /* Left ALT */ 1897 case 0xb8: /* Right ALT */ 1898 break; 1899 case 0xc8: 1900 kbd_put_keysym(QEMU_KEY_UP); 1901 break; 1902 case 0xd0: 1903 kbd_put_keysym(QEMU_KEY_DOWN); 1904 break; 1905 case 0xcb: 1906 kbd_put_keysym(QEMU_KEY_LEFT); 1907 break; 1908 case 0xcd: 1909 kbd_put_keysym(QEMU_KEY_RIGHT); 1910 break; 1911 case 0xd3: 1912 kbd_put_keysym(QEMU_KEY_DELETE); 1913 break; 1914 case 0xc7: 1915 kbd_put_keysym(QEMU_KEY_HOME); 1916 break; 1917 case 0xcf: 1918 kbd_put_keysym(QEMU_KEY_END); 1919 break; 1920 case 0xc9: 1921 kbd_put_keysym(QEMU_KEY_PAGEUP); 1922 break; 1923 case 0xd1: 1924 kbd_put_keysym(QEMU_KEY_PAGEDOWN); 1925 break; 1926 1927 case 0x47: 1928 kbd_put_keysym(numlock ? '7' : QEMU_KEY_HOME); 1929 break; 1930 case 0x48: 1931 kbd_put_keysym(numlock ? '8' : QEMU_KEY_UP); 1932 break; 1933 case 0x49: 1934 kbd_put_keysym(numlock ? '9' : QEMU_KEY_PAGEUP); 1935 break; 1936 case 0x4b: 1937 kbd_put_keysym(numlock ? '4' : QEMU_KEY_LEFT); 1938 break; 1939 case 0x4c: 1940 kbd_put_keysym('5'); 1941 break; 1942 case 0x4d: 1943 kbd_put_keysym(numlock ? '6' : QEMU_KEY_RIGHT); 1944 break; 1945 case 0x4f: 1946 kbd_put_keysym(numlock ? '1' : QEMU_KEY_END); 1947 break; 1948 case 0x50: 1949 kbd_put_keysym(numlock ? '2' : QEMU_KEY_DOWN); 1950 break; 1951 case 0x51: 1952 kbd_put_keysym(numlock ? '3' : QEMU_KEY_PAGEDOWN); 1953 break; 1954 case 0x52: 1955 kbd_put_keysym('0'); 1956 break; 1957 case 0x53: 1958 kbd_put_keysym(numlock ? '.' : QEMU_KEY_DELETE); 1959 break; 1960 1961 case 0xb5: 1962 kbd_put_keysym('/'); 1963 break; 1964 case 0x37: 1965 kbd_put_keysym('*'); 1966 break; 1967 case 0x4a: 1968 kbd_put_keysym('-'); 1969 break; 1970 case 0x4e: 1971 kbd_put_keysym('+'); 1972 break; 1973 case 0x9c: 1974 kbd_put_keysym('\n'); 1975 break; 1976 1977 default: 1978 if (control) { 1979 kbd_put_keysym(sym & 0x1f); 1980 } else { 1981 kbd_put_keysym(sym); 1982 } 1983 break; 1984 } 1985 } 1986 } 1987 } 1988 1989 static void vnc_release_modifiers(VncState *vs) 1990 { 1991 static const int keycodes[] = { 1992 /* shift, control, alt keys, both left & right */ 1993 0x2a, 0x36, 0x1d, 0x9d, 0x38, 0xb8, 1994 }; 1995 int i, keycode; 1996 1997 if (!qemu_console_is_graphic(NULL)) { 1998 return; 1999 } 2000 for (i = 0; i < ARRAY_SIZE(keycodes); i++) { 2001 keycode = keycodes[i]; 2002 if (!vs->modifiers_state[keycode]) { 2003 continue; 2004 } 2005 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, false); 2006 } 2007 } 2008 2009 static const char *code2name(int keycode) 2010 { 2011 return QKeyCode_lookup[qemu_input_key_number_to_qcode(keycode)]; 2012 } 2013 2014 static void key_event(VncState *vs, int down, uint32_t sym) 2015 { 2016 int keycode; 2017 int lsym = sym; 2018 2019 if (lsym >= 'A' && lsym <= 'Z' && qemu_console_is_graphic(NULL)) { 2020 lsym = lsym - 'A' + 'a'; 2021 } 2022 2023 keycode = keysym2scancode(vs->vd->kbd_layout, lsym & 0xFFFF) & SCANCODE_KEYMASK; 2024 trace_vnc_key_event_map(down, sym, keycode, code2name(keycode)); 2025 do_key_event(vs, down, keycode, sym); 2026 } 2027 2028 static void ext_key_event(VncState *vs, int down, 2029 uint32_t sym, uint16_t keycode) 2030 { 2031 /* if the user specifies a keyboard layout, always use it */ 2032 if (keyboard_layout) { 2033 key_event(vs, down, sym); 2034 } else { 2035 trace_vnc_key_event_ext(down, sym, keycode, code2name(keycode)); 2036 do_key_event(vs, down, keycode, sym); 2037 } 2038 } 2039 2040 static void framebuffer_update_request(VncState *vs, int incremental, 2041 int x, int y, int w, int h) 2042 { 2043 int width = pixman_image_get_width(vs->vd->server); 2044 int height = pixman_image_get_height(vs->vd->server); 2045 2046 vs->need_update = 1; 2047 2048 if (incremental) { 2049 return; 2050 } 2051 2052 vs->force_update = 1; 2053 vnc_set_area_dirty(vs->dirty, width, height, x, y, w, h); 2054 } 2055 2056 static void send_ext_key_event_ack(VncState *vs) 2057 { 2058 vnc_lock_output(vs); 2059 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 2060 vnc_write_u8(vs, 0); 2061 vnc_write_u16(vs, 1); 2062 vnc_framebuffer_update(vs, 0, 0, 2063 pixman_image_get_width(vs->vd->server), 2064 pixman_image_get_height(vs->vd->server), 2065 VNC_ENCODING_EXT_KEY_EVENT); 2066 vnc_unlock_output(vs); 2067 vnc_flush(vs); 2068 } 2069 2070 static void send_ext_audio_ack(VncState *vs) 2071 { 2072 vnc_lock_output(vs); 2073 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 2074 vnc_write_u8(vs, 0); 2075 vnc_write_u16(vs, 1); 2076 vnc_framebuffer_update(vs, 0, 0, 2077 pixman_image_get_width(vs->vd->server), 2078 pixman_image_get_height(vs->vd->server), 2079 VNC_ENCODING_AUDIO); 2080 vnc_unlock_output(vs); 2081 vnc_flush(vs); 2082 } 2083 2084 static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings) 2085 { 2086 int i; 2087 unsigned int enc = 0; 2088 2089 vs->features = 0; 2090 vs->vnc_encoding = 0; 2091 vs->tight.compression = 9; 2092 vs->tight.quality = -1; /* Lossless by default */ 2093 vs->absolute = -1; 2094 2095 /* 2096 * Start from the end because the encodings are sent in order of preference. 2097 * This way the preferred encoding (first encoding defined in the array) 2098 * will be set at the end of the loop. 2099 */ 2100 for (i = n_encodings - 1; i >= 0; i--) { 2101 enc = encodings[i]; 2102 switch (enc) { 2103 case VNC_ENCODING_RAW: 2104 vs->vnc_encoding = enc; 2105 break; 2106 case VNC_ENCODING_COPYRECT: 2107 vs->features |= VNC_FEATURE_COPYRECT_MASK; 2108 break; 2109 case VNC_ENCODING_HEXTILE: 2110 vs->features |= VNC_FEATURE_HEXTILE_MASK; 2111 vs->vnc_encoding = enc; 2112 break; 2113 case VNC_ENCODING_TIGHT: 2114 vs->features |= VNC_FEATURE_TIGHT_MASK; 2115 vs->vnc_encoding = enc; 2116 break; 2117 #ifdef CONFIG_VNC_PNG 2118 case VNC_ENCODING_TIGHT_PNG: 2119 vs->features |= VNC_FEATURE_TIGHT_PNG_MASK; 2120 vs->vnc_encoding = enc; 2121 break; 2122 #endif 2123 case VNC_ENCODING_ZLIB: 2124 vs->features |= VNC_FEATURE_ZLIB_MASK; 2125 vs->vnc_encoding = enc; 2126 break; 2127 case VNC_ENCODING_ZRLE: 2128 vs->features |= VNC_FEATURE_ZRLE_MASK; 2129 vs->vnc_encoding = enc; 2130 break; 2131 case VNC_ENCODING_ZYWRLE: 2132 vs->features |= VNC_FEATURE_ZYWRLE_MASK; 2133 vs->vnc_encoding = enc; 2134 break; 2135 case VNC_ENCODING_DESKTOPRESIZE: 2136 vs->features |= VNC_FEATURE_RESIZE_MASK; 2137 break; 2138 case VNC_ENCODING_POINTER_TYPE_CHANGE: 2139 vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK; 2140 break; 2141 case VNC_ENCODING_RICH_CURSOR: 2142 vs->features |= VNC_FEATURE_RICH_CURSOR_MASK; 2143 break; 2144 case VNC_ENCODING_EXT_KEY_EVENT: 2145 send_ext_key_event_ack(vs); 2146 break; 2147 case VNC_ENCODING_AUDIO: 2148 send_ext_audio_ack(vs); 2149 break; 2150 case VNC_ENCODING_WMVi: 2151 vs->features |= VNC_FEATURE_WMVI_MASK; 2152 break; 2153 case VNC_ENCODING_LED_STATE: 2154 vs->features |= VNC_FEATURE_LED_STATE_MASK; 2155 break; 2156 case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9: 2157 vs->tight.compression = (enc & 0x0F); 2158 break; 2159 case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9: 2160 if (vs->vd->lossy) { 2161 vs->tight.quality = (enc & 0x0F); 2162 } 2163 break; 2164 default: 2165 VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc); 2166 break; 2167 } 2168 } 2169 vnc_desktop_resize(vs); 2170 check_pointer_type_change(&vs->mouse_mode_notifier, NULL); 2171 vnc_led_state_change(vs); 2172 } 2173 2174 static void set_pixel_conversion(VncState *vs) 2175 { 2176 pixman_format_code_t fmt = qemu_pixman_get_format(&vs->client_pf); 2177 2178 if (fmt == VNC_SERVER_FB_FORMAT) { 2179 vs->write_pixels = vnc_write_pixels_copy; 2180 vnc_hextile_set_pixel_conversion(vs, 0); 2181 } else { 2182 vs->write_pixels = vnc_write_pixels_generic; 2183 vnc_hextile_set_pixel_conversion(vs, 1); 2184 } 2185 } 2186 2187 static void set_pixel_format(VncState *vs, 2188 int bits_per_pixel, int depth, 2189 int big_endian_flag, int true_color_flag, 2190 int red_max, int green_max, int blue_max, 2191 int red_shift, int green_shift, int blue_shift) 2192 { 2193 if (!true_color_flag) { 2194 vnc_client_error(vs); 2195 return; 2196 } 2197 2198 switch (bits_per_pixel) { 2199 case 8: 2200 case 16: 2201 case 32: 2202 break; 2203 default: 2204 vnc_client_error(vs); 2205 return; 2206 } 2207 2208 vs->client_pf.rmax = red_max; 2209 vs->client_pf.rbits = hweight_long(red_max); 2210 vs->client_pf.rshift = red_shift; 2211 vs->client_pf.rmask = red_max << red_shift; 2212 vs->client_pf.gmax = green_max; 2213 vs->client_pf.gbits = hweight_long(green_max); 2214 vs->client_pf.gshift = green_shift; 2215 vs->client_pf.gmask = green_max << green_shift; 2216 vs->client_pf.bmax = blue_max; 2217 vs->client_pf.bbits = hweight_long(blue_max); 2218 vs->client_pf.bshift = blue_shift; 2219 vs->client_pf.bmask = blue_max << blue_shift; 2220 vs->client_pf.bits_per_pixel = bits_per_pixel; 2221 vs->client_pf.bytes_per_pixel = bits_per_pixel / 8; 2222 vs->client_pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel; 2223 vs->client_be = big_endian_flag; 2224 2225 set_pixel_conversion(vs); 2226 2227 graphic_hw_invalidate(vs->vd->dcl.con); 2228 graphic_hw_update(vs->vd->dcl.con); 2229 } 2230 2231 static void pixel_format_message (VncState *vs) { 2232 char pad[3] = { 0, 0, 0 }; 2233 2234 vs->client_pf = qemu_default_pixelformat(32); 2235 2236 vnc_write_u8(vs, vs->client_pf.bits_per_pixel); /* bits-per-pixel */ 2237 vnc_write_u8(vs, vs->client_pf.depth); /* depth */ 2238 2239 #ifdef HOST_WORDS_BIGENDIAN 2240 vnc_write_u8(vs, 1); /* big-endian-flag */ 2241 #else 2242 vnc_write_u8(vs, 0); /* big-endian-flag */ 2243 #endif 2244 vnc_write_u8(vs, 1); /* true-color-flag */ 2245 vnc_write_u16(vs, vs->client_pf.rmax); /* red-max */ 2246 vnc_write_u16(vs, vs->client_pf.gmax); /* green-max */ 2247 vnc_write_u16(vs, vs->client_pf.bmax); /* blue-max */ 2248 vnc_write_u8(vs, vs->client_pf.rshift); /* red-shift */ 2249 vnc_write_u8(vs, vs->client_pf.gshift); /* green-shift */ 2250 vnc_write_u8(vs, vs->client_pf.bshift); /* blue-shift */ 2251 vnc_write(vs, pad, 3); /* padding */ 2252 2253 vnc_hextile_set_pixel_conversion(vs, 0); 2254 vs->write_pixels = vnc_write_pixels_copy; 2255 } 2256 2257 static void vnc_colordepth(VncState *vs) 2258 { 2259 if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) { 2260 /* Sending a WMVi message to notify the client*/ 2261 vnc_lock_output(vs); 2262 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 2263 vnc_write_u8(vs, 0); 2264 vnc_write_u16(vs, 1); /* number of rects */ 2265 vnc_framebuffer_update(vs, 0, 0, 2266 pixman_image_get_width(vs->vd->server), 2267 pixman_image_get_height(vs->vd->server), 2268 VNC_ENCODING_WMVi); 2269 pixel_format_message(vs); 2270 vnc_unlock_output(vs); 2271 vnc_flush(vs); 2272 } else { 2273 set_pixel_conversion(vs); 2274 } 2275 } 2276 2277 static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len) 2278 { 2279 int i; 2280 uint16_t limit; 2281 VncDisplay *vd = vs->vd; 2282 2283 if (data[0] > 3) { 2284 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE); 2285 } 2286 2287 switch (data[0]) { 2288 case VNC_MSG_CLIENT_SET_PIXEL_FORMAT: 2289 if (len == 1) 2290 return 20; 2291 2292 set_pixel_format(vs, read_u8(data, 4), read_u8(data, 5), 2293 read_u8(data, 6), read_u8(data, 7), 2294 read_u16(data, 8), read_u16(data, 10), 2295 read_u16(data, 12), read_u8(data, 14), 2296 read_u8(data, 15), read_u8(data, 16)); 2297 break; 2298 case VNC_MSG_CLIENT_SET_ENCODINGS: 2299 if (len == 1) 2300 return 4; 2301 2302 if (len == 4) { 2303 limit = read_u16(data, 2); 2304 if (limit > 0) 2305 return 4 + (limit * 4); 2306 } else 2307 limit = read_u16(data, 2); 2308 2309 for (i = 0; i < limit; i++) { 2310 int32_t val = read_s32(data, 4 + (i * 4)); 2311 memcpy(data + 4 + (i * 4), &val, sizeof(val)); 2312 } 2313 2314 set_encodings(vs, (int32_t *)(data + 4), limit); 2315 break; 2316 case VNC_MSG_CLIENT_FRAMEBUFFER_UPDATE_REQUEST: 2317 if (len == 1) 2318 return 10; 2319 2320 framebuffer_update_request(vs, 2321 read_u8(data, 1), read_u16(data, 2), read_u16(data, 4), 2322 read_u16(data, 6), read_u16(data, 8)); 2323 break; 2324 case VNC_MSG_CLIENT_KEY_EVENT: 2325 if (len == 1) 2326 return 8; 2327 2328 key_event(vs, read_u8(data, 1), read_u32(data, 4)); 2329 break; 2330 case VNC_MSG_CLIENT_POINTER_EVENT: 2331 if (len == 1) 2332 return 6; 2333 2334 pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4)); 2335 break; 2336 case VNC_MSG_CLIENT_CUT_TEXT: 2337 if (len == 1) { 2338 return 8; 2339 } 2340 if (len == 8) { 2341 uint32_t dlen = read_u32(data, 4); 2342 if (dlen > (1 << 20)) { 2343 error_report("vnc: client_cut_text msg payload has %u bytes" 2344 " which exceeds our limit of 1MB.", dlen); 2345 vnc_client_error(vs); 2346 break; 2347 } 2348 if (dlen > 0) { 2349 return 8 + dlen; 2350 } 2351 } 2352 2353 client_cut_text(vs, read_u32(data, 4), data + 8); 2354 break; 2355 case VNC_MSG_CLIENT_QEMU: 2356 if (len == 1) 2357 return 2; 2358 2359 switch (read_u8(data, 1)) { 2360 case VNC_MSG_CLIENT_QEMU_EXT_KEY_EVENT: 2361 if (len == 2) 2362 return 12; 2363 2364 ext_key_event(vs, read_u16(data, 2), 2365 read_u32(data, 4), read_u32(data, 8)); 2366 break; 2367 case VNC_MSG_CLIENT_QEMU_AUDIO: 2368 if (len == 2) 2369 return 4; 2370 2371 switch (read_u16 (data, 2)) { 2372 case VNC_MSG_CLIENT_QEMU_AUDIO_ENABLE: 2373 audio_add(vs); 2374 break; 2375 case VNC_MSG_CLIENT_QEMU_AUDIO_DISABLE: 2376 audio_del(vs); 2377 break; 2378 case VNC_MSG_CLIENT_QEMU_AUDIO_SET_FORMAT: 2379 if (len == 4) 2380 return 10; 2381 switch (read_u8(data, 4)) { 2382 case 0: vs->as.fmt = AUD_FMT_U8; break; 2383 case 1: vs->as.fmt = AUD_FMT_S8; break; 2384 case 2: vs->as.fmt = AUD_FMT_U16; break; 2385 case 3: vs->as.fmt = AUD_FMT_S16; break; 2386 case 4: vs->as.fmt = AUD_FMT_U32; break; 2387 case 5: vs->as.fmt = AUD_FMT_S32; break; 2388 default: 2389 VNC_DEBUG("Invalid audio format %d\n", read_u8(data, 4)); 2390 vnc_client_error(vs); 2391 break; 2392 } 2393 vs->as.nchannels = read_u8(data, 5); 2394 if (vs->as.nchannels != 1 && vs->as.nchannels != 2) { 2395 VNC_DEBUG("Invalid audio channel coount %d\n", 2396 read_u8(data, 5)); 2397 vnc_client_error(vs); 2398 break; 2399 } 2400 vs->as.freq = read_u32(data, 6); 2401 break; 2402 default: 2403 VNC_DEBUG("Invalid audio message %d\n", read_u8(data, 4)); 2404 vnc_client_error(vs); 2405 break; 2406 } 2407 break; 2408 2409 default: 2410 VNC_DEBUG("Msg: %d\n", read_u16(data, 0)); 2411 vnc_client_error(vs); 2412 break; 2413 } 2414 break; 2415 default: 2416 VNC_DEBUG("Msg: %d\n", data[0]); 2417 vnc_client_error(vs); 2418 break; 2419 } 2420 2421 vnc_read_when(vs, protocol_client_msg, 1); 2422 return 0; 2423 } 2424 2425 static int protocol_client_init(VncState *vs, uint8_t *data, size_t len) 2426 { 2427 char buf[1024]; 2428 VncShareMode mode; 2429 int size; 2430 2431 mode = data[0] ? VNC_SHARE_MODE_SHARED : VNC_SHARE_MODE_EXCLUSIVE; 2432 switch (vs->vd->share_policy) { 2433 case VNC_SHARE_POLICY_IGNORE: 2434 /* 2435 * Ignore the shared flag. Nothing to do here. 2436 * 2437 * Doesn't conform to the rfb spec but is traditional qemu 2438 * behavior, thus left here as option for compatibility 2439 * reasons. 2440 */ 2441 break; 2442 case VNC_SHARE_POLICY_ALLOW_EXCLUSIVE: 2443 /* 2444 * Policy: Allow clients ask for exclusive access. 2445 * 2446 * Implementation: When a client asks for exclusive access, 2447 * disconnect all others. Shared connects are allowed as long 2448 * as no exclusive connection exists. 2449 * 2450 * This is how the rfb spec suggests to handle the shared flag. 2451 */ 2452 if (mode == VNC_SHARE_MODE_EXCLUSIVE) { 2453 VncState *client; 2454 QTAILQ_FOREACH(client, &vs->vd->clients, next) { 2455 if (vs == client) { 2456 continue; 2457 } 2458 if (client->share_mode != VNC_SHARE_MODE_EXCLUSIVE && 2459 client->share_mode != VNC_SHARE_MODE_SHARED) { 2460 continue; 2461 } 2462 vnc_disconnect_start(client); 2463 } 2464 } 2465 if (mode == VNC_SHARE_MODE_SHARED) { 2466 if (vs->vd->num_exclusive > 0) { 2467 vnc_disconnect_start(vs); 2468 return 0; 2469 } 2470 } 2471 break; 2472 case VNC_SHARE_POLICY_FORCE_SHARED: 2473 /* 2474 * Policy: Shared connects only. 2475 * Implementation: Disallow clients asking for exclusive access. 2476 * 2477 * Useful for shared desktop sessions where you don't want 2478 * someone forgetting to say -shared when running the vnc 2479 * client disconnect everybody else. 2480 */ 2481 if (mode == VNC_SHARE_MODE_EXCLUSIVE) { 2482 vnc_disconnect_start(vs); 2483 return 0; 2484 } 2485 break; 2486 } 2487 vnc_set_share_mode(vs, mode); 2488 2489 if (vs->vd->num_shared > vs->vd->connections_limit) { 2490 vnc_disconnect_start(vs); 2491 return 0; 2492 } 2493 2494 vs->client_width = pixman_image_get_width(vs->vd->server); 2495 vs->client_height = pixman_image_get_height(vs->vd->server); 2496 vnc_write_u16(vs, vs->client_width); 2497 vnc_write_u16(vs, vs->client_height); 2498 2499 pixel_format_message(vs); 2500 2501 if (qemu_name) 2502 size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name); 2503 else 2504 size = snprintf(buf, sizeof(buf), "QEMU"); 2505 2506 vnc_write_u32(vs, size); 2507 vnc_write(vs, buf, size); 2508 vnc_flush(vs); 2509 2510 vnc_client_cache_auth(vs); 2511 vnc_qmp_event(vs, QAPI_EVENT_VNC_INITIALIZED); 2512 2513 vnc_read_when(vs, protocol_client_msg, 1); 2514 2515 return 0; 2516 } 2517 2518 void start_client_init(VncState *vs) 2519 { 2520 vnc_read_when(vs, protocol_client_init, 1); 2521 } 2522 2523 static void make_challenge(VncState *vs) 2524 { 2525 int i; 2526 2527 srand(time(NULL)+getpid()+getpid()*987654+rand()); 2528 2529 for (i = 0 ; i < sizeof(vs->challenge) ; i++) 2530 vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0)); 2531 } 2532 2533 static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len) 2534 { 2535 unsigned char response[VNC_AUTH_CHALLENGE_SIZE]; 2536 int i, j, pwlen; 2537 unsigned char key[8]; 2538 time_t now = time(NULL); 2539 2540 if (!vs->vd->password) { 2541 VNC_DEBUG("No password configured on server"); 2542 goto reject; 2543 } 2544 if (vs->vd->expires < now) { 2545 VNC_DEBUG("Password is expired"); 2546 goto reject; 2547 } 2548 2549 memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE); 2550 2551 /* Calculate the expected challenge response */ 2552 pwlen = strlen(vs->vd->password); 2553 for (i=0; i<sizeof(key); i++) 2554 key[i] = i<pwlen ? vs->vd->password[i] : 0; 2555 deskey(key, EN0); 2556 for (j = 0; j < VNC_AUTH_CHALLENGE_SIZE; j += 8) 2557 des(response+j, response+j); 2558 2559 /* Compare expected vs actual challenge response */ 2560 if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) { 2561 VNC_DEBUG("Client challenge response did not match\n"); 2562 goto reject; 2563 } else { 2564 VNC_DEBUG("Accepting VNC challenge response\n"); 2565 vnc_write_u32(vs, 0); /* Accept auth */ 2566 vnc_flush(vs); 2567 2568 start_client_init(vs); 2569 } 2570 return 0; 2571 2572 reject: 2573 vnc_write_u32(vs, 1); /* Reject auth */ 2574 if (vs->minor >= 8) { 2575 static const char err[] = "Authentication failed"; 2576 vnc_write_u32(vs, sizeof(err)); 2577 vnc_write(vs, err, sizeof(err)); 2578 } 2579 vnc_flush(vs); 2580 vnc_client_error(vs); 2581 return 0; 2582 } 2583 2584 void start_auth_vnc(VncState *vs) 2585 { 2586 make_challenge(vs); 2587 /* Send client a 'random' challenge */ 2588 vnc_write(vs, vs->challenge, sizeof(vs->challenge)); 2589 vnc_flush(vs); 2590 2591 vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge)); 2592 } 2593 2594 2595 static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len) 2596 { 2597 /* We only advertise 1 auth scheme at a time, so client 2598 * must pick the one we sent. Verify this */ 2599 if (data[0] != vs->auth) { /* Reject auth */ 2600 VNC_DEBUG("Reject auth %d because it didn't match advertized\n", (int)data[0]); 2601 vnc_write_u32(vs, 1); 2602 if (vs->minor >= 8) { 2603 static const char err[] = "Authentication failed"; 2604 vnc_write_u32(vs, sizeof(err)); 2605 vnc_write(vs, err, sizeof(err)); 2606 } 2607 vnc_client_error(vs); 2608 } else { /* Accept requested auth */ 2609 VNC_DEBUG("Client requested auth %d\n", (int)data[0]); 2610 switch (vs->auth) { 2611 case VNC_AUTH_NONE: 2612 VNC_DEBUG("Accept auth none\n"); 2613 if (vs->minor >= 8) { 2614 vnc_write_u32(vs, 0); /* Accept auth completion */ 2615 vnc_flush(vs); 2616 } 2617 start_client_init(vs); 2618 break; 2619 2620 case VNC_AUTH_VNC: 2621 VNC_DEBUG("Start VNC auth\n"); 2622 start_auth_vnc(vs); 2623 break; 2624 2625 #ifdef CONFIG_VNC_TLS 2626 case VNC_AUTH_VENCRYPT: 2627 VNC_DEBUG("Accept VeNCrypt auth\n"); 2628 start_auth_vencrypt(vs); 2629 break; 2630 #endif /* CONFIG_VNC_TLS */ 2631 2632 #ifdef CONFIG_VNC_SASL 2633 case VNC_AUTH_SASL: 2634 VNC_DEBUG("Accept SASL auth\n"); 2635 start_auth_sasl(vs); 2636 break; 2637 #endif /* CONFIG_VNC_SASL */ 2638 2639 default: /* Should not be possible, but just in case */ 2640 VNC_DEBUG("Reject auth %d server code bug\n", vs->auth); 2641 vnc_write_u8(vs, 1); 2642 if (vs->minor >= 8) { 2643 static const char err[] = "Authentication failed"; 2644 vnc_write_u32(vs, sizeof(err)); 2645 vnc_write(vs, err, sizeof(err)); 2646 } 2647 vnc_client_error(vs); 2648 } 2649 } 2650 return 0; 2651 } 2652 2653 static int protocol_version(VncState *vs, uint8_t *version, size_t len) 2654 { 2655 char local[13]; 2656 2657 memcpy(local, version, 12); 2658 local[12] = 0; 2659 2660 if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) { 2661 VNC_DEBUG("Malformed protocol version %s\n", local); 2662 vnc_client_error(vs); 2663 return 0; 2664 } 2665 VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor); 2666 if (vs->major != 3 || 2667 (vs->minor != 3 && 2668 vs->minor != 4 && 2669 vs->minor != 5 && 2670 vs->minor != 7 && 2671 vs->minor != 8)) { 2672 VNC_DEBUG("Unsupported client version\n"); 2673 vnc_write_u32(vs, VNC_AUTH_INVALID); 2674 vnc_flush(vs); 2675 vnc_client_error(vs); 2676 return 0; 2677 } 2678 /* Some broken clients report v3.4 or v3.5, which spec requires to be treated 2679 * as equivalent to v3.3 by servers 2680 */ 2681 if (vs->minor == 4 || vs->minor == 5) 2682 vs->minor = 3; 2683 2684 if (vs->minor == 3) { 2685 if (vs->auth == VNC_AUTH_NONE) { 2686 VNC_DEBUG("Tell client auth none\n"); 2687 vnc_write_u32(vs, vs->auth); 2688 vnc_flush(vs); 2689 start_client_init(vs); 2690 } else if (vs->auth == VNC_AUTH_VNC) { 2691 VNC_DEBUG("Tell client VNC auth\n"); 2692 vnc_write_u32(vs, vs->auth); 2693 vnc_flush(vs); 2694 start_auth_vnc(vs); 2695 } else { 2696 VNC_DEBUG("Unsupported auth %d for protocol 3.3\n", vs->auth); 2697 vnc_write_u32(vs, VNC_AUTH_INVALID); 2698 vnc_flush(vs); 2699 vnc_client_error(vs); 2700 } 2701 } else { 2702 VNC_DEBUG("Telling client we support auth %d\n", vs->auth); 2703 vnc_write_u8(vs, 1); /* num auth */ 2704 vnc_write_u8(vs, vs->auth); 2705 vnc_read_when(vs, protocol_client_auth, 1); 2706 vnc_flush(vs); 2707 } 2708 2709 return 0; 2710 } 2711 2712 static VncRectStat *vnc_stat_rect(VncDisplay *vd, int x, int y) 2713 { 2714 struct VncSurface *vs = &vd->guest; 2715 2716 return &vs->stats[y / VNC_STAT_RECT][x / VNC_STAT_RECT]; 2717 } 2718 2719 void vnc_sent_lossy_rect(VncState *vs, int x, int y, int w, int h) 2720 { 2721 int i, j; 2722 2723 w = (x + w) / VNC_STAT_RECT; 2724 h = (y + h) / VNC_STAT_RECT; 2725 x /= VNC_STAT_RECT; 2726 y /= VNC_STAT_RECT; 2727 2728 for (j = y; j <= h; j++) { 2729 for (i = x; i <= w; i++) { 2730 vs->lossy_rect[j][i] = 1; 2731 } 2732 } 2733 } 2734 2735 static int vnc_refresh_lossy_rect(VncDisplay *vd, int x, int y) 2736 { 2737 VncState *vs; 2738 int sty = y / VNC_STAT_RECT; 2739 int stx = x / VNC_STAT_RECT; 2740 int has_dirty = 0; 2741 2742 y = y / VNC_STAT_RECT * VNC_STAT_RECT; 2743 x = x / VNC_STAT_RECT * VNC_STAT_RECT; 2744 2745 QTAILQ_FOREACH(vs, &vd->clients, next) { 2746 int j; 2747 2748 /* kernel send buffers are full -> refresh later */ 2749 if (vs->output.offset) { 2750 continue; 2751 } 2752 2753 if (!vs->lossy_rect[sty][stx]) { 2754 continue; 2755 } 2756 2757 vs->lossy_rect[sty][stx] = 0; 2758 for (j = 0; j < VNC_STAT_RECT; ++j) { 2759 bitmap_set(vs->dirty[y + j], 2760 x / VNC_DIRTY_PIXELS_PER_BIT, 2761 VNC_STAT_RECT / VNC_DIRTY_PIXELS_PER_BIT); 2762 } 2763 has_dirty++; 2764 } 2765 2766 return has_dirty; 2767 } 2768 2769 static int vnc_update_stats(VncDisplay *vd, struct timeval * tv) 2770 { 2771 int width = pixman_image_get_width(vd->guest.fb); 2772 int height = pixman_image_get_height(vd->guest.fb); 2773 int x, y; 2774 struct timeval res; 2775 int has_dirty = 0; 2776 2777 for (y = 0; y < height; y += VNC_STAT_RECT) { 2778 for (x = 0; x < width; x += VNC_STAT_RECT) { 2779 VncRectStat *rect = vnc_stat_rect(vd, x, y); 2780 2781 rect->updated = false; 2782 } 2783 } 2784 2785 qemu_timersub(tv, &VNC_REFRESH_STATS, &res); 2786 2787 if (timercmp(&vd->guest.last_freq_check, &res, >)) { 2788 return has_dirty; 2789 } 2790 vd->guest.last_freq_check = *tv; 2791 2792 for (y = 0; y < height; y += VNC_STAT_RECT) { 2793 for (x = 0; x < width; x += VNC_STAT_RECT) { 2794 VncRectStat *rect= vnc_stat_rect(vd, x, y); 2795 int count = ARRAY_SIZE(rect->times); 2796 struct timeval min, max; 2797 2798 if (!timerisset(&rect->times[count - 1])) { 2799 continue ; 2800 } 2801 2802 max = rect->times[(rect->idx + count - 1) % count]; 2803 qemu_timersub(tv, &max, &res); 2804 2805 if (timercmp(&res, &VNC_REFRESH_LOSSY, >)) { 2806 rect->freq = 0; 2807 has_dirty += vnc_refresh_lossy_rect(vd, x, y); 2808 memset(rect->times, 0, sizeof (rect->times)); 2809 continue ; 2810 } 2811 2812 min = rect->times[rect->idx]; 2813 max = rect->times[(rect->idx + count - 1) % count]; 2814 qemu_timersub(&max, &min, &res); 2815 2816 rect->freq = res.tv_sec + res.tv_usec / 1000000.; 2817 rect->freq /= count; 2818 rect->freq = 1. / rect->freq; 2819 } 2820 } 2821 return has_dirty; 2822 } 2823 2824 double vnc_update_freq(VncState *vs, int x, int y, int w, int h) 2825 { 2826 int i, j; 2827 double total = 0; 2828 int num = 0; 2829 2830 x = (x / VNC_STAT_RECT) * VNC_STAT_RECT; 2831 y = (y / VNC_STAT_RECT) * VNC_STAT_RECT; 2832 2833 for (j = y; j <= y + h; j += VNC_STAT_RECT) { 2834 for (i = x; i <= x + w; i += VNC_STAT_RECT) { 2835 total += vnc_stat_rect(vs->vd, i, j)->freq; 2836 num++; 2837 } 2838 } 2839 2840 if (num) { 2841 return total / num; 2842 } else { 2843 return 0; 2844 } 2845 } 2846 2847 static void vnc_rect_updated(VncDisplay *vd, int x, int y, struct timeval * tv) 2848 { 2849 VncRectStat *rect; 2850 2851 rect = vnc_stat_rect(vd, x, y); 2852 if (rect->updated) { 2853 return ; 2854 } 2855 rect->times[rect->idx] = *tv; 2856 rect->idx = (rect->idx + 1) % ARRAY_SIZE(rect->times); 2857 rect->updated = true; 2858 } 2859 2860 static int vnc_refresh_server_surface(VncDisplay *vd) 2861 { 2862 int width = MIN(pixman_image_get_width(vd->guest.fb), 2863 pixman_image_get_width(vd->server)); 2864 int height = MIN(pixman_image_get_height(vd->guest.fb), 2865 pixman_image_get_height(vd->server)); 2866 int cmp_bytes, server_stride, min_stride, guest_stride, y = 0; 2867 uint8_t *guest_row0 = NULL, *server_row0; 2868 VncState *vs; 2869 int has_dirty = 0; 2870 pixman_image_t *tmpbuf = NULL; 2871 2872 struct timeval tv = { 0, 0 }; 2873 2874 if (!vd->non_adaptive) { 2875 gettimeofday(&tv, NULL); 2876 has_dirty = vnc_update_stats(vd, &tv); 2877 } 2878 2879 /* 2880 * Walk through the guest dirty map. 2881 * Check and copy modified bits from guest to server surface. 2882 * Update server dirty map. 2883 */ 2884 server_row0 = (uint8_t *)pixman_image_get_data(vd->server); 2885 server_stride = guest_stride = pixman_image_get_stride(vd->server); 2886 cmp_bytes = MIN(VNC_DIRTY_PIXELS_PER_BIT * VNC_SERVER_FB_BYTES, 2887 server_stride); 2888 if (vd->guest.format != VNC_SERVER_FB_FORMAT) { 2889 int width = pixman_image_get_width(vd->server); 2890 tmpbuf = qemu_pixman_linebuf_create(VNC_SERVER_FB_FORMAT, width); 2891 } else { 2892 guest_row0 = (uint8_t *)pixman_image_get_data(vd->guest.fb); 2893 guest_stride = pixman_image_get_stride(vd->guest.fb); 2894 } 2895 min_stride = MIN(server_stride, guest_stride); 2896 2897 for (;;) { 2898 int x; 2899 uint8_t *guest_ptr, *server_ptr; 2900 unsigned long offset = find_next_bit((unsigned long *) &vd->guest.dirty, 2901 height * VNC_DIRTY_BPL(&vd->guest), 2902 y * VNC_DIRTY_BPL(&vd->guest)); 2903 if (offset == height * VNC_DIRTY_BPL(&vd->guest)) { 2904 /* no more dirty bits */ 2905 break; 2906 } 2907 y = offset / VNC_DIRTY_BPL(&vd->guest); 2908 x = offset % VNC_DIRTY_BPL(&vd->guest); 2909 2910 server_ptr = server_row0 + y * server_stride + x * cmp_bytes; 2911 2912 if (vd->guest.format != VNC_SERVER_FB_FORMAT) { 2913 qemu_pixman_linebuf_fill(tmpbuf, vd->guest.fb, width, 0, y); 2914 guest_ptr = (uint8_t *)pixman_image_get_data(tmpbuf); 2915 } else { 2916 guest_ptr = guest_row0 + y * guest_stride; 2917 } 2918 guest_ptr += x * cmp_bytes; 2919 2920 for (; x < DIV_ROUND_UP(width, VNC_DIRTY_PIXELS_PER_BIT); 2921 x++, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) { 2922 int _cmp_bytes = cmp_bytes; 2923 if (!test_and_clear_bit(x, vd->guest.dirty[y])) { 2924 continue; 2925 } 2926 if ((x + 1) * cmp_bytes > min_stride) { 2927 _cmp_bytes = min_stride - x * cmp_bytes; 2928 } 2929 if (memcmp(server_ptr, guest_ptr, _cmp_bytes) == 0) { 2930 continue; 2931 } 2932 memcpy(server_ptr, guest_ptr, _cmp_bytes); 2933 if (!vd->non_adaptive) { 2934 vnc_rect_updated(vd, x * VNC_DIRTY_PIXELS_PER_BIT, 2935 y, &tv); 2936 } 2937 QTAILQ_FOREACH(vs, &vd->clients, next) { 2938 set_bit(x, vs->dirty[y]); 2939 } 2940 has_dirty++; 2941 } 2942 2943 y++; 2944 } 2945 qemu_pixman_image_unref(tmpbuf); 2946 return has_dirty; 2947 } 2948 2949 static void vnc_refresh(DisplayChangeListener *dcl) 2950 { 2951 VncDisplay *vd = container_of(dcl, VncDisplay, dcl); 2952 VncState *vs, *vn; 2953 int has_dirty, rects = 0; 2954 2955 if (QTAILQ_EMPTY(&vd->clients)) { 2956 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_MAX); 2957 return; 2958 } 2959 2960 graphic_hw_update(vd->dcl.con); 2961 2962 if (vnc_trylock_display(vd)) { 2963 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE); 2964 return; 2965 } 2966 2967 has_dirty = vnc_refresh_server_surface(vd); 2968 vnc_unlock_display(vd); 2969 2970 QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) { 2971 rects += vnc_update_client(vs, has_dirty, false); 2972 /* vs might be free()ed here */ 2973 } 2974 2975 if (has_dirty && rects) { 2976 vd->dcl.update_interval /= 2; 2977 if (vd->dcl.update_interval < VNC_REFRESH_INTERVAL_BASE) { 2978 vd->dcl.update_interval = VNC_REFRESH_INTERVAL_BASE; 2979 } 2980 } else { 2981 vd->dcl.update_interval += VNC_REFRESH_INTERVAL_INC; 2982 if (vd->dcl.update_interval > VNC_REFRESH_INTERVAL_MAX) { 2983 vd->dcl.update_interval = VNC_REFRESH_INTERVAL_MAX; 2984 } 2985 } 2986 } 2987 2988 static void vnc_connect(VncDisplay *vd, int csock, 2989 bool skipauth, bool websocket) 2990 { 2991 VncState *vs = g_malloc0(sizeof(VncState)); 2992 int i; 2993 2994 vs->csock = csock; 2995 vs->vd = vd; 2996 2997 if (skipauth) { 2998 vs->auth = VNC_AUTH_NONE; 2999 vs->subauth = VNC_AUTH_INVALID; 3000 } else { 3001 if (websocket) { 3002 vs->auth = vd->ws_auth; 3003 vs->subauth = VNC_AUTH_INVALID; 3004 } else { 3005 vs->auth = vd->auth; 3006 vs->subauth = vd->subauth; 3007 } 3008 } 3009 VNC_DEBUG("Client sock=%d ws=%d auth=%d subauth=%d\n", 3010 csock, websocket, vs->auth, vs->subauth); 3011 3012 vs->lossy_rect = g_malloc0(VNC_STAT_ROWS * sizeof (*vs->lossy_rect)); 3013 for (i = 0; i < VNC_STAT_ROWS; ++i) { 3014 vs->lossy_rect[i] = g_malloc0(VNC_STAT_COLS * sizeof (uint8_t)); 3015 } 3016 3017 VNC_DEBUG("New client on socket %d\n", csock); 3018 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE); 3019 qemu_set_nonblock(vs->csock); 3020 #ifdef CONFIG_VNC_WS 3021 if (websocket) { 3022 vs->websocket = 1; 3023 #ifdef CONFIG_VNC_TLS 3024 if (vd->ws_tls) { 3025 qemu_set_fd_handler2(vs->csock, NULL, vncws_tls_handshake_io, 3026 NULL, vs); 3027 } else 3028 #endif /* CONFIG_VNC_TLS */ 3029 { 3030 qemu_set_fd_handler2(vs->csock, NULL, vncws_handshake_read, 3031 NULL, vs); 3032 } 3033 } else 3034 #endif /* CONFIG_VNC_WS */ 3035 { 3036 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs); 3037 } 3038 3039 vnc_client_cache_addr(vs); 3040 vnc_qmp_event(vs, QAPI_EVENT_VNC_CONNECTED); 3041 vnc_set_share_mode(vs, VNC_SHARE_MODE_CONNECTING); 3042 3043 #ifdef CONFIG_VNC_WS 3044 if (!vs->websocket) 3045 #endif 3046 { 3047 vnc_init_state(vs); 3048 } 3049 3050 if (vd->num_connecting > vd->connections_limit) { 3051 QTAILQ_FOREACH(vs, &vd->clients, next) { 3052 if (vs->share_mode == VNC_SHARE_MODE_CONNECTING) { 3053 vnc_disconnect_start(vs); 3054 return; 3055 } 3056 } 3057 } 3058 } 3059 3060 void vnc_init_state(VncState *vs) 3061 { 3062 vs->initialized = true; 3063 VncDisplay *vd = vs->vd; 3064 3065 vs->last_x = -1; 3066 vs->last_y = -1; 3067 3068 vs->as.freq = 44100; 3069 vs->as.nchannels = 2; 3070 vs->as.fmt = AUD_FMT_S16; 3071 vs->as.endianness = 0; 3072 3073 qemu_mutex_init(&vs->output_mutex); 3074 vs->bh = qemu_bh_new(vnc_jobs_bh, vs); 3075 3076 QTAILQ_INSERT_TAIL(&vd->clients, vs, next); 3077 3078 graphic_hw_update(vd->dcl.con); 3079 3080 vnc_write(vs, "RFB 003.008\n", 12); 3081 vnc_flush(vs); 3082 vnc_read_when(vs, protocol_version, 12); 3083 reset_keys(vs); 3084 if (vs->vd->lock_key_sync) 3085 vs->led = qemu_add_led_event_handler(kbd_leds, vs); 3086 3087 vs->mouse_mode_notifier.notify = check_pointer_type_change; 3088 qemu_add_mouse_mode_change_notifier(&vs->mouse_mode_notifier); 3089 3090 /* vs might be free()ed here */ 3091 } 3092 3093 static void vnc_listen_read(void *opaque, bool websocket) 3094 { 3095 VncDisplay *vs = opaque; 3096 struct sockaddr_in addr; 3097 socklen_t addrlen = sizeof(addr); 3098 int csock; 3099 3100 /* Catch-up */ 3101 graphic_hw_update(vs->dcl.con); 3102 #ifdef CONFIG_VNC_WS 3103 if (websocket) { 3104 csock = qemu_accept(vs->lwebsock, (struct sockaddr *)&addr, &addrlen); 3105 } else 3106 #endif /* CONFIG_VNC_WS */ 3107 { 3108 csock = qemu_accept(vs->lsock, (struct sockaddr *)&addr, &addrlen); 3109 } 3110 3111 if (csock != -1) { 3112 socket_set_nodelay(csock); 3113 vnc_connect(vs, csock, false, websocket); 3114 } 3115 } 3116 3117 static void vnc_listen_regular_read(void *opaque) 3118 { 3119 vnc_listen_read(opaque, false); 3120 } 3121 3122 #ifdef CONFIG_VNC_WS 3123 static void vnc_listen_websocket_read(void *opaque) 3124 { 3125 vnc_listen_read(opaque, true); 3126 } 3127 #endif /* CONFIG_VNC_WS */ 3128 3129 static const DisplayChangeListenerOps dcl_ops = { 3130 .dpy_name = "vnc", 3131 .dpy_refresh = vnc_refresh, 3132 .dpy_gfx_copy = vnc_dpy_copy, 3133 .dpy_gfx_update = vnc_dpy_update, 3134 .dpy_gfx_switch = vnc_dpy_switch, 3135 .dpy_gfx_check_format = qemu_pixman_check_format, 3136 .dpy_mouse_set = vnc_mouse_set, 3137 .dpy_cursor_define = vnc_dpy_cursor_define, 3138 }; 3139 3140 void vnc_display_init(const char *id) 3141 { 3142 VncDisplay *vs; 3143 3144 if (vnc_display_find(id) != NULL) { 3145 return; 3146 } 3147 vs = g_malloc0(sizeof(*vs)); 3148 3149 vs->id = strdup(id); 3150 QTAILQ_INSERT_TAIL(&vnc_displays, vs, next); 3151 3152 vs->lsock = -1; 3153 #ifdef CONFIG_VNC_WS 3154 vs->lwebsock = -1; 3155 #endif 3156 3157 QTAILQ_INIT(&vs->clients); 3158 vs->expires = TIME_MAX; 3159 3160 if (keyboard_layout) { 3161 trace_vnc_key_map_init(keyboard_layout); 3162 vs->kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout); 3163 } else { 3164 vs->kbd_layout = init_keyboard_layout(name2keysym, "en-us"); 3165 } 3166 3167 if (!vs->kbd_layout) 3168 exit(1); 3169 3170 qemu_mutex_init(&vs->mutex); 3171 vnc_start_worker_thread(); 3172 3173 vs->dcl.ops = &dcl_ops; 3174 register_displaychangelistener(&vs->dcl); 3175 } 3176 3177 3178 static void vnc_display_close(VncDisplay *vs) 3179 { 3180 if (!vs) 3181 return; 3182 vs->enabled = false; 3183 vs->is_unix = false; 3184 if (vs->lsock != -1) { 3185 qemu_set_fd_handler2(vs->lsock, NULL, NULL, NULL, NULL); 3186 close(vs->lsock); 3187 vs->lsock = -1; 3188 } 3189 #ifdef CONFIG_VNC_WS 3190 vs->ws_enabled = false; 3191 if (vs->lwebsock != -1) { 3192 qemu_set_fd_handler2(vs->lwebsock, NULL, NULL, NULL, NULL); 3193 close(vs->lwebsock); 3194 vs->lwebsock = -1; 3195 } 3196 #endif /* CONFIG_VNC_WS */ 3197 vs->auth = VNC_AUTH_INVALID; 3198 vs->subauth = VNC_AUTH_INVALID; 3199 #ifdef CONFIG_VNC_TLS 3200 vs->tls.x509verify = 0; 3201 #endif 3202 } 3203 3204 int vnc_display_password(const char *id, const char *password) 3205 { 3206 VncDisplay *vs = vnc_display_find(id); 3207 3208 if (!vs) { 3209 return -EINVAL; 3210 } 3211 if (vs->auth == VNC_AUTH_NONE) { 3212 error_printf_unless_qmp("If you want use passwords please enable " 3213 "password auth using '-vnc ${dpy},password'."); 3214 return -EINVAL; 3215 } 3216 3217 g_free(vs->password); 3218 vs->password = g_strdup(password); 3219 3220 return 0; 3221 } 3222 3223 int vnc_display_pw_expire(const char *id, time_t expires) 3224 { 3225 VncDisplay *vs = vnc_display_find(id); 3226 3227 if (!vs) { 3228 return -EINVAL; 3229 } 3230 3231 vs->expires = expires; 3232 return 0; 3233 } 3234 3235 char *vnc_display_local_addr(const char *id) 3236 { 3237 VncDisplay *vs = vnc_display_find(id); 3238 3239 assert(vs); 3240 return vnc_socket_local_addr("%s:%s", vs->lsock); 3241 } 3242 3243 static QemuOptsList qemu_vnc_opts = { 3244 .name = "vnc", 3245 .head = QTAILQ_HEAD_INITIALIZER(qemu_vnc_opts.head), 3246 .implied_opt_name = "vnc", 3247 .desc = { 3248 { 3249 .name = "vnc", 3250 .type = QEMU_OPT_STRING, 3251 },{ 3252 .name = "websocket", 3253 .type = QEMU_OPT_STRING, 3254 },{ 3255 .name = "x509", 3256 .type = QEMU_OPT_STRING, 3257 },{ 3258 .name = "share", 3259 .type = QEMU_OPT_STRING, 3260 },{ 3261 .name = "display", 3262 .type = QEMU_OPT_STRING, 3263 },{ 3264 .name = "head", 3265 .type = QEMU_OPT_NUMBER, 3266 },{ 3267 .name = "connections", 3268 .type = QEMU_OPT_NUMBER, 3269 },{ 3270 .name = "to", 3271 .type = QEMU_OPT_NUMBER, 3272 },{ 3273 .name = "ipv4", 3274 .type = QEMU_OPT_BOOL, 3275 },{ 3276 .name = "ipv6", 3277 .type = QEMU_OPT_BOOL, 3278 },{ 3279 .name = "password", 3280 .type = QEMU_OPT_BOOL, 3281 },{ 3282 .name = "reverse", 3283 .type = QEMU_OPT_BOOL, 3284 },{ 3285 .name = "lock-key-sync", 3286 .type = QEMU_OPT_BOOL, 3287 },{ 3288 .name = "sasl", 3289 .type = QEMU_OPT_BOOL, 3290 },{ 3291 .name = "tls", 3292 .type = QEMU_OPT_BOOL, 3293 },{ 3294 .name = "x509verify", 3295 .type = QEMU_OPT_STRING, 3296 },{ 3297 .name = "acl", 3298 .type = QEMU_OPT_BOOL, 3299 },{ 3300 .name = "lossy", 3301 .type = QEMU_OPT_BOOL, 3302 },{ 3303 .name = "non-adaptive", 3304 .type = QEMU_OPT_BOOL, 3305 }, 3306 { /* end of list */ } 3307 }, 3308 }; 3309 3310 3311 static void 3312 vnc_display_setup_auth(VncDisplay *vs, 3313 bool password, 3314 bool sasl, 3315 bool tls, 3316 bool x509, 3317 bool websocket) 3318 { 3319 /* 3320 * We have a choice of 3 authentication options 3321 * 3322 * 1. none 3323 * 2. vnc 3324 * 3. sasl 3325 * 3326 * The channel can be run in 2 modes 3327 * 3328 * 1. clear 3329 * 2. tls 3330 * 3331 * And TLS can use 2 types of credentials 3332 * 3333 * 1. anon 3334 * 2. x509 3335 * 3336 * We thus have 9 possible logical combinations 3337 * 3338 * 1. clear + none 3339 * 2. clear + vnc 3340 * 3. clear + sasl 3341 * 4. tls + anon + none 3342 * 5. tls + anon + vnc 3343 * 6. tls + anon + sasl 3344 * 7. tls + x509 + none 3345 * 8. tls + x509 + vnc 3346 * 9. tls + x509 + sasl 3347 * 3348 * These need to be mapped into the VNC auth schemes 3349 * in an appropriate manner. In regular VNC, all the 3350 * TLS options get mapped into VNC_AUTH_VENCRYPT 3351 * sub-auth types. 3352 * 3353 * In websockets, the https:// protocol already provides 3354 * TLS support, so there is no need to make use of the 3355 * VeNCrypt extension. Furthermore, websockets browser 3356 * clients could not use VeNCrypt even if they wanted to, 3357 * as they cannot control when the TLS handshake takes 3358 * place. Thus there is no option but to rely on https://, 3359 * meaning combinations 4->6 and 7->9 will be mapped to 3360 * VNC auth schemes in the same way as combos 1->3. 3361 * 3362 * Regardless of fact that we have a different mapping to 3363 * VNC auth mechs for plain VNC vs websockets VNC, the end 3364 * result has the same security characteristics. 3365 */ 3366 if (password) { 3367 if (tls) { 3368 vs->auth = VNC_AUTH_VENCRYPT; 3369 if (websocket) { 3370 vs->ws_tls = true; 3371 } 3372 if (x509) { 3373 VNC_DEBUG("Initializing VNC server with x509 password auth\n"); 3374 vs->subauth = VNC_AUTH_VENCRYPT_X509VNC; 3375 } else { 3376 VNC_DEBUG("Initializing VNC server with TLS password auth\n"); 3377 vs->subauth = VNC_AUTH_VENCRYPT_TLSVNC; 3378 } 3379 } else { 3380 VNC_DEBUG("Initializing VNC server with password auth\n"); 3381 vs->auth = VNC_AUTH_VNC; 3382 vs->subauth = VNC_AUTH_INVALID; 3383 } 3384 if (websocket) { 3385 vs->ws_auth = VNC_AUTH_VNC; 3386 } else { 3387 vs->ws_auth = VNC_AUTH_INVALID; 3388 } 3389 } else if (sasl) { 3390 if (tls) { 3391 vs->auth = VNC_AUTH_VENCRYPT; 3392 if (websocket) { 3393 vs->ws_tls = true; 3394 } 3395 if (x509) { 3396 VNC_DEBUG("Initializing VNC server with x509 SASL auth\n"); 3397 vs->subauth = VNC_AUTH_VENCRYPT_X509SASL; 3398 } else { 3399 VNC_DEBUG("Initializing VNC server with TLS SASL auth\n"); 3400 vs->subauth = VNC_AUTH_VENCRYPT_TLSSASL; 3401 } 3402 } else { 3403 VNC_DEBUG("Initializing VNC server with SASL auth\n"); 3404 vs->auth = VNC_AUTH_SASL; 3405 vs->subauth = VNC_AUTH_INVALID; 3406 } 3407 if (websocket) { 3408 vs->ws_auth = VNC_AUTH_SASL; 3409 } else { 3410 vs->ws_auth = VNC_AUTH_INVALID; 3411 } 3412 } else { 3413 if (tls) { 3414 vs->auth = VNC_AUTH_VENCRYPT; 3415 if (websocket) { 3416 vs->ws_tls = true; 3417 } 3418 if (x509) { 3419 VNC_DEBUG("Initializing VNC server with x509 no auth\n"); 3420 vs->subauth = VNC_AUTH_VENCRYPT_X509NONE; 3421 } else { 3422 VNC_DEBUG("Initializing VNC server with TLS no auth\n"); 3423 vs->subauth = VNC_AUTH_VENCRYPT_TLSNONE; 3424 } 3425 } else { 3426 VNC_DEBUG("Initializing VNC server with no auth\n"); 3427 vs->auth = VNC_AUTH_NONE; 3428 vs->subauth = VNC_AUTH_INVALID; 3429 } 3430 if (websocket) { 3431 vs->ws_auth = VNC_AUTH_NONE; 3432 } else { 3433 vs->ws_auth = VNC_AUTH_INVALID; 3434 } 3435 } 3436 } 3437 3438 void vnc_display_open(const char *id, Error **errp) 3439 { 3440 VncDisplay *vs = vnc_display_find(id); 3441 QemuOpts *opts = qemu_opts_find(&qemu_vnc_opts, id); 3442 QemuOpts *sopts, *wsopts; 3443 const char *share, *device_id; 3444 QemuConsole *con; 3445 bool password = false; 3446 bool reverse = false; 3447 const char *vnc; 3448 const char *has_to; 3449 char *h; 3450 bool has_ipv4 = false; 3451 bool has_ipv6 = false; 3452 const char *websocket; 3453 bool tls = false, x509 = false; 3454 #ifdef CONFIG_VNC_TLS 3455 const char *path; 3456 #endif 3457 bool sasl = false; 3458 #ifdef CONFIG_VNC_SASL 3459 int saslErr; 3460 #endif 3461 #if defined(CONFIG_VNC_TLS) || defined(CONFIG_VNC_SASL) 3462 int acl = 0; 3463 #endif 3464 int lock_key_sync = 1; 3465 3466 if (!vs) { 3467 error_setg(errp, "VNC display not active"); 3468 return; 3469 } 3470 vnc_display_close(vs); 3471 3472 if (!opts) { 3473 return; 3474 } 3475 vnc = qemu_opt_get(opts, "vnc"); 3476 if (!vnc || strcmp(vnc, "none") == 0) { 3477 return; 3478 } 3479 3480 sopts = qemu_opts_create(&socket_optslist, NULL, 0, &error_abort); 3481 wsopts = qemu_opts_create(&socket_optslist, NULL, 0, &error_abort); 3482 3483 h = strrchr(vnc, ':'); 3484 if (h) { 3485 char *host; 3486 size_t hlen = h - vnc; 3487 3488 if (vnc[0] == '[' && vnc[hlen - 1] == ']') { 3489 host = g_strndup(vnc + 1, hlen - 2); 3490 } else { 3491 host = g_strndup(vnc, hlen); 3492 } 3493 qemu_opt_set(sopts, "host", host, &error_abort); 3494 qemu_opt_set(wsopts, "host", host, &error_abort); 3495 qemu_opt_set(sopts, "port", h+1, &error_abort); 3496 g_free(host); 3497 } else { 3498 error_setg(errp, "no vnc port specified"); 3499 goto fail; 3500 } 3501 3502 has_to = qemu_opt_get(opts, "to"); 3503 has_ipv4 = qemu_opt_get_bool(opts, "ipv4", false); 3504 has_ipv6 = qemu_opt_get_bool(opts, "ipv6", false); 3505 if (has_to) { 3506 qemu_opt_set(sopts, "to", has_to, &error_abort); 3507 qemu_opt_set(wsopts, "to", has_to, &error_abort); 3508 } 3509 if (has_ipv4) { 3510 qemu_opt_set(sopts, "ipv4", "on", &error_abort); 3511 qemu_opt_set(wsopts, "ipv4", "on", &error_abort); 3512 } 3513 if (has_ipv6) { 3514 qemu_opt_set(sopts, "ipv6", "on", &error_abort); 3515 qemu_opt_set(wsopts, "ipv6", "on", &error_abort); 3516 } 3517 3518 password = qemu_opt_get_bool(opts, "password", false); 3519 if (password && fips_get_state()) { 3520 error_setg(errp, 3521 "VNC password auth disabled due to FIPS mode, " 3522 "consider using the VeNCrypt or SASL authentication " 3523 "methods as an alternative"); 3524 goto fail; 3525 } 3526 3527 reverse = qemu_opt_get_bool(opts, "reverse", false); 3528 lock_key_sync = qemu_opt_get_bool(opts, "lock-key-sync", true); 3529 sasl = qemu_opt_get_bool(opts, "sasl", false); 3530 #ifndef CONFIG_VNC_SASL 3531 if (sasl) { 3532 error_setg(errp, "VNC SASL auth requires cyrus-sasl support"); 3533 goto fail; 3534 } 3535 #endif /* CONFIG_VNC_SASL */ 3536 tls = qemu_opt_get_bool(opts, "tls", false); 3537 #ifdef CONFIG_VNC_TLS 3538 path = qemu_opt_get(opts, "x509"); 3539 if (!path) { 3540 path = qemu_opt_get(opts, "x509verify"); 3541 if (path) { 3542 vs->tls.x509verify = true; 3543 } 3544 } 3545 if (path) { 3546 x509 = true; 3547 if (vnc_tls_set_x509_creds_dir(vs, path) < 0) { 3548 error_setg(errp, "Failed to find x509 certificates/keys in %s", 3549 path); 3550 goto fail; 3551 } 3552 } 3553 #else /* ! CONFIG_VNC_TLS */ 3554 if (tls) { 3555 error_setg(errp, "VNC TLS auth requires gnutls support"); 3556 goto fail; 3557 } 3558 #endif /* ! CONFIG_VNC_TLS */ 3559 #if defined(CONFIG_VNC_TLS) || defined(CONFIG_VNC_SASL) 3560 acl = qemu_opt_get_bool(opts, "acl", false); 3561 #endif 3562 3563 share = qemu_opt_get(opts, "share"); 3564 if (share) { 3565 if (strcmp(share, "ignore") == 0) { 3566 vs->share_policy = VNC_SHARE_POLICY_IGNORE; 3567 } else if (strcmp(share, "allow-exclusive") == 0) { 3568 vs->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE; 3569 } else if (strcmp(share, "force-shared") == 0) { 3570 vs->share_policy = VNC_SHARE_POLICY_FORCE_SHARED; 3571 } else { 3572 error_setg(errp, "unknown vnc share= option"); 3573 goto fail; 3574 } 3575 } else { 3576 vs->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE; 3577 } 3578 vs->connections_limit = qemu_opt_get_number(opts, "connections", 32); 3579 3580 websocket = qemu_opt_get(opts, "websocket"); 3581 if (websocket) { 3582 #ifdef CONFIG_VNC_WS 3583 vs->ws_enabled = true; 3584 qemu_opt_set(wsopts, "port", websocket, &error_abort); 3585 #else /* ! CONFIG_VNC_WS */ 3586 error_setg(errp, "Websockets protocol requires gnutls support"); 3587 goto fail; 3588 #endif /* ! CONFIG_VNC_WS */ 3589 } 3590 3591 #ifdef CONFIG_VNC_JPEG 3592 vs->lossy = qemu_opt_get_bool(opts, "lossy", false); 3593 #endif 3594 vs->non_adaptive = qemu_opt_get_bool(opts, "non-adaptive", false); 3595 /* adaptive updates are only used with tight encoding and 3596 * if lossy updates are enabled so we can disable all the 3597 * calculations otherwise */ 3598 if (!vs->lossy) { 3599 vs->non_adaptive = true; 3600 } 3601 3602 #ifdef CONFIG_VNC_TLS 3603 if (acl && x509 && vs->tls.x509verify) { 3604 char *aclname; 3605 3606 if (strcmp(vs->id, "default") == 0) { 3607 aclname = g_strdup("vnc.x509dname"); 3608 } else { 3609 aclname = g_strdup_printf("vnc.%s.x509dname", vs->id); 3610 } 3611 vs->tls.acl = qemu_acl_init(aclname); 3612 g_free(aclname); 3613 } 3614 #endif 3615 #ifdef CONFIG_VNC_SASL 3616 if (acl && sasl) { 3617 char *aclname; 3618 3619 if (strcmp(vs->id, "default") == 0) { 3620 aclname = g_strdup("vnc.username"); 3621 } else { 3622 aclname = g_strdup_printf("vnc.%s.username", vs->id); 3623 } 3624 vs->sasl.acl = qemu_acl_init(aclname); 3625 g_free(aclname); 3626 } 3627 #endif 3628 3629 vnc_display_setup_auth(vs, password, sasl, tls, x509, websocket); 3630 3631 #ifdef CONFIG_VNC_SASL 3632 if ((saslErr = sasl_server_init(NULL, "qemu")) != SASL_OK) { 3633 error_setg(errp, "Failed to initialize SASL auth: %s", 3634 sasl_errstring(saslErr, NULL, NULL)); 3635 goto fail; 3636 } 3637 #endif 3638 vs->lock_key_sync = lock_key_sync; 3639 3640 device_id = qemu_opt_get(opts, "display"); 3641 if (device_id) { 3642 DeviceState *dev; 3643 int head = qemu_opt_get_number(opts, "head", 0); 3644 3645 dev = qdev_find_recursive(sysbus_get_default(), device_id); 3646 if (dev == NULL) { 3647 error_setg(errp, "Device '%s' not found", device_id); 3648 goto fail; 3649 } 3650 3651 con = qemu_console_lookup_by_device(dev, head); 3652 if (con == NULL) { 3653 error_setg(errp, "Device %s is not bound to a QemuConsole", 3654 device_id); 3655 goto fail; 3656 } 3657 } else { 3658 con = NULL; 3659 } 3660 3661 if (con != vs->dcl.con) { 3662 unregister_displaychangelistener(&vs->dcl); 3663 vs->dcl.con = con; 3664 register_displaychangelistener(&vs->dcl); 3665 } 3666 3667 if (reverse) { 3668 /* connect to viewer */ 3669 int csock; 3670 vs->lsock = -1; 3671 #ifdef CONFIG_VNC_WS 3672 vs->lwebsock = -1; 3673 #endif 3674 if (strncmp(vnc, "unix:", 5) == 0) { 3675 csock = unix_connect(vnc+5, errp); 3676 } else { 3677 csock = inet_connect(vnc, errp); 3678 } 3679 if (csock < 0) { 3680 goto fail; 3681 } 3682 vnc_connect(vs, csock, false, false); 3683 } else { 3684 /* listen for connects */ 3685 if (strncmp(vnc, "unix:", 5) == 0) { 3686 vs->lsock = unix_listen(vnc+5, NULL, 0, errp); 3687 if (vs->lsock < 0) { 3688 goto fail; 3689 } 3690 vs->is_unix = true; 3691 } else { 3692 vs->lsock = inet_listen_opts(sopts, 5900, errp); 3693 if (vs->lsock < 0) { 3694 goto fail; 3695 } 3696 #ifdef CONFIG_VNC_WS 3697 if (vs->ws_enabled) { 3698 vs->lwebsock = inet_listen_opts(wsopts, 0, errp); 3699 if (vs->lwebsock < 0) { 3700 if (vs->lsock != -1) { 3701 close(vs->lsock); 3702 vs->lsock = -1; 3703 } 3704 goto fail; 3705 } 3706 } 3707 #endif /* CONFIG_VNC_WS */ 3708 } 3709 vs->enabled = true; 3710 qemu_set_fd_handler2(vs->lsock, NULL, 3711 vnc_listen_regular_read, NULL, vs); 3712 #ifdef CONFIG_VNC_WS 3713 if (vs->ws_enabled) { 3714 qemu_set_fd_handler2(vs->lwebsock, NULL, 3715 vnc_listen_websocket_read, NULL, vs); 3716 } 3717 #endif /* CONFIG_VNC_WS */ 3718 } 3719 qemu_opts_del(sopts); 3720 qemu_opts_del(wsopts); 3721 return; 3722 3723 fail: 3724 qemu_opts_del(sopts); 3725 qemu_opts_del(wsopts); 3726 vs->enabled = false; 3727 #ifdef CONFIG_VNC_WS 3728 vs->ws_enabled = false; 3729 #endif /* CONFIG_VNC_WS */ 3730 } 3731 3732 void vnc_display_add_client(const char *id, int csock, bool skipauth) 3733 { 3734 VncDisplay *vs = vnc_display_find(id); 3735 3736 if (!vs) { 3737 return; 3738 } 3739 vnc_connect(vs, csock, skipauth, false); 3740 } 3741 3742 static void vnc_auto_assign_id(QemuOptsList *olist, QemuOpts *opts) 3743 { 3744 int i = 2; 3745 char *id; 3746 3747 id = g_strdup("default"); 3748 while (qemu_opts_find(olist, id)) { 3749 g_free(id); 3750 id = g_strdup_printf("vnc%d", i++); 3751 } 3752 qemu_opts_set_id(opts, id); 3753 } 3754 3755 QemuOpts *vnc_parse_func(const char *str) 3756 { 3757 QemuOptsList *olist = qemu_find_opts("vnc"); 3758 QemuOpts *opts = qemu_opts_parse(olist, str, 1); 3759 const char *id; 3760 3761 if (!opts) { 3762 return NULL; 3763 } 3764 3765 id = qemu_opts_id(opts); 3766 if (!id) { 3767 /* auto-assign id if not present */ 3768 vnc_auto_assign_id(olist, opts); 3769 } 3770 return opts; 3771 } 3772 3773 int vnc_init_func(void *opaque, QemuOpts *opts, Error **errp) 3774 { 3775 Error *local_err = NULL; 3776 char *id = (char *)qemu_opts_id(opts); 3777 3778 assert(id); 3779 vnc_display_init(id); 3780 vnc_display_open(id, &local_err); 3781 if (local_err != NULL) { 3782 error_report("Failed to start VNC server: %s", 3783 error_get_pretty(local_err)); 3784 error_free(local_err); 3785 exit(1); 3786 } 3787 return 0; 3788 } 3789 3790 static void vnc_register_config(void) 3791 { 3792 qemu_add_opts(&qemu_vnc_opts); 3793 } 3794 machine_init(vnc_register_config); 3795