1 /* 2 * QEMU VNC display driver 3 * 4 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws> 5 * Copyright (C) 2006 Fabrice Bellard 6 * Copyright (C) 2009 Red Hat, Inc 7 * 8 * Permission is hereby granted, free of charge, to any person obtaining a copy 9 * of this software and associated documentation files (the "Software"), to deal 10 * in the Software without restriction, including without limitation the rights 11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 12 * copies of the Software, and to permit persons to whom the Software is 13 * furnished to do so, subject to the following conditions: 14 * 15 * The above copyright notice and this permission notice shall be included in 16 * all copies or substantial portions of the Software. 17 * 18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 24 * THE SOFTWARE. 25 */ 26 27 #include "vnc.h" 28 #include "vnc-jobs.h" 29 #include "trace.h" 30 #include "hw/qdev.h" 31 #include "sysemu/sysemu.h" 32 #include "qemu/sockets.h" 33 #include "qemu/timer.h" 34 #include "qemu/acl.h" 35 #include "qemu/config-file.h" 36 #include "qapi/qmp/types.h" 37 #include "qmp-commands.h" 38 #include "qemu/osdep.h" 39 #include "ui/input.h" 40 #include "qapi-event.h" 41 42 #define VNC_REFRESH_INTERVAL_BASE GUI_REFRESH_INTERVAL_DEFAULT 43 #define VNC_REFRESH_INTERVAL_INC 50 44 #define VNC_REFRESH_INTERVAL_MAX GUI_REFRESH_INTERVAL_IDLE 45 static const struct timeval VNC_REFRESH_STATS = { 0, 500000 }; 46 static const struct timeval VNC_REFRESH_LOSSY = { 2, 0 }; 47 48 #include "vnc_keysym.h" 49 #include "d3des.h" 50 51 static QTAILQ_HEAD(, VncDisplay) vnc_displays = 52 QTAILQ_HEAD_INITIALIZER(vnc_displays); 53 54 static int vnc_cursor_define(VncState *vs); 55 static void vnc_release_modifiers(VncState *vs); 56 57 static void vnc_set_share_mode(VncState *vs, VncShareMode mode) 58 { 59 #ifdef _VNC_DEBUG 60 static const char *mn[] = { 61 [0] = "undefined", 62 [VNC_SHARE_MODE_CONNECTING] = "connecting", 63 [VNC_SHARE_MODE_SHARED] = "shared", 64 [VNC_SHARE_MODE_EXCLUSIVE] = "exclusive", 65 [VNC_SHARE_MODE_DISCONNECTED] = "disconnected", 66 }; 67 fprintf(stderr, "%s/%d: %s -> %s\n", __func__, 68 vs->csock, mn[vs->share_mode], mn[mode]); 69 #endif 70 71 switch (vs->share_mode) { 72 case VNC_SHARE_MODE_CONNECTING: 73 vs->vd->num_connecting--; 74 break; 75 case VNC_SHARE_MODE_SHARED: 76 vs->vd->num_shared--; 77 break; 78 case VNC_SHARE_MODE_EXCLUSIVE: 79 vs->vd->num_exclusive--; 80 break; 81 default: 82 break; 83 } 84 85 vs->share_mode = mode; 86 87 switch (vs->share_mode) { 88 case VNC_SHARE_MODE_CONNECTING: 89 vs->vd->num_connecting++; 90 break; 91 case VNC_SHARE_MODE_SHARED: 92 vs->vd->num_shared++; 93 break; 94 case VNC_SHARE_MODE_EXCLUSIVE: 95 vs->vd->num_exclusive++; 96 break; 97 default: 98 break; 99 } 100 } 101 102 static char *addr_to_string(const char *format, 103 struct sockaddr_storage *sa, 104 socklen_t salen) { 105 char *addr; 106 char host[NI_MAXHOST]; 107 char serv[NI_MAXSERV]; 108 int err; 109 size_t addrlen; 110 111 if ((err = getnameinfo((struct sockaddr *)sa, salen, 112 host, sizeof(host), 113 serv, sizeof(serv), 114 NI_NUMERICHOST | NI_NUMERICSERV)) != 0) { 115 VNC_DEBUG("Cannot resolve address %d: %s\n", 116 err, gai_strerror(err)); 117 return NULL; 118 } 119 120 /* Enough for the existing format + the 2 vars we're 121 * substituting in. */ 122 addrlen = strlen(format) + strlen(host) + strlen(serv); 123 addr = g_malloc(addrlen + 1); 124 snprintf(addr, addrlen, format, host, serv); 125 addr[addrlen] = '\0'; 126 127 return addr; 128 } 129 130 131 char *vnc_socket_local_addr(const char *format, int fd) { 132 struct sockaddr_storage sa; 133 socklen_t salen; 134 135 salen = sizeof(sa); 136 if (getsockname(fd, (struct sockaddr*)&sa, &salen) < 0) 137 return NULL; 138 139 return addr_to_string(format, &sa, salen); 140 } 141 142 char *vnc_socket_remote_addr(const char *format, int fd) { 143 struct sockaddr_storage sa; 144 socklen_t salen; 145 146 salen = sizeof(sa); 147 if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0) 148 return NULL; 149 150 return addr_to_string(format, &sa, salen); 151 } 152 153 static VncBasicInfo *vnc_basic_info_get(struct sockaddr_storage *sa, 154 socklen_t salen) 155 { 156 VncBasicInfo *info; 157 char host[NI_MAXHOST]; 158 char serv[NI_MAXSERV]; 159 int err; 160 161 if ((err = getnameinfo((struct sockaddr *)sa, salen, 162 host, sizeof(host), 163 serv, sizeof(serv), 164 NI_NUMERICHOST | NI_NUMERICSERV)) != 0) { 165 VNC_DEBUG("Cannot resolve address %d: %s\n", 166 err, gai_strerror(err)); 167 return NULL; 168 } 169 170 info = g_malloc0(sizeof(VncBasicInfo)); 171 info->host = g_strdup(host); 172 info->service = g_strdup(serv); 173 info->family = inet_netfamily(sa->ss_family); 174 return info; 175 } 176 177 static VncBasicInfo *vnc_basic_info_get_from_server_addr(int fd) 178 { 179 struct sockaddr_storage sa; 180 socklen_t salen; 181 182 salen = sizeof(sa); 183 if (getsockname(fd, (struct sockaddr*)&sa, &salen) < 0) { 184 return NULL; 185 } 186 187 return vnc_basic_info_get(&sa, salen); 188 } 189 190 static VncBasicInfo *vnc_basic_info_get_from_remote_addr(int fd) 191 { 192 struct sockaddr_storage sa; 193 socklen_t salen; 194 195 salen = sizeof(sa); 196 if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0) { 197 return NULL; 198 } 199 200 return vnc_basic_info_get(&sa, salen); 201 } 202 203 static const char *vnc_auth_name(VncDisplay *vd) { 204 switch (vd->auth) { 205 case VNC_AUTH_INVALID: 206 return "invalid"; 207 case VNC_AUTH_NONE: 208 return "none"; 209 case VNC_AUTH_VNC: 210 return "vnc"; 211 case VNC_AUTH_RA2: 212 return "ra2"; 213 case VNC_AUTH_RA2NE: 214 return "ra2ne"; 215 case VNC_AUTH_TIGHT: 216 return "tight"; 217 case VNC_AUTH_ULTRA: 218 return "ultra"; 219 case VNC_AUTH_TLS: 220 return "tls"; 221 case VNC_AUTH_VENCRYPT: 222 #ifdef CONFIG_VNC_TLS 223 switch (vd->subauth) { 224 case VNC_AUTH_VENCRYPT_PLAIN: 225 return "vencrypt+plain"; 226 case VNC_AUTH_VENCRYPT_TLSNONE: 227 return "vencrypt+tls+none"; 228 case VNC_AUTH_VENCRYPT_TLSVNC: 229 return "vencrypt+tls+vnc"; 230 case VNC_AUTH_VENCRYPT_TLSPLAIN: 231 return "vencrypt+tls+plain"; 232 case VNC_AUTH_VENCRYPT_X509NONE: 233 return "vencrypt+x509+none"; 234 case VNC_AUTH_VENCRYPT_X509VNC: 235 return "vencrypt+x509+vnc"; 236 case VNC_AUTH_VENCRYPT_X509PLAIN: 237 return "vencrypt+x509+plain"; 238 case VNC_AUTH_VENCRYPT_TLSSASL: 239 return "vencrypt+tls+sasl"; 240 case VNC_AUTH_VENCRYPT_X509SASL: 241 return "vencrypt+x509+sasl"; 242 default: 243 return "vencrypt"; 244 } 245 #else 246 return "vencrypt"; 247 #endif 248 case VNC_AUTH_SASL: 249 return "sasl"; 250 } 251 return "unknown"; 252 } 253 254 static VncServerInfo *vnc_server_info_get(VncDisplay *vd) 255 { 256 VncServerInfo *info; 257 VncBasicInfo *bi = vnc_basic_info_get_from_server_addr(vd->lsock); 258 if (!bi) { 259 return NULL; 260 } 261 262 info = g_malloc(sizeof(*info)); 263 info->base = bi; 264 info->has_auth = true; 265 info->auth = g_strdup(vnc_auth_name(vd)); 266 return info; 267 } 268 269 static void vnc_client_cache_auth(VncState *client) 270 { 271 if (!client->info) { 272 return; 273 } 274 275 #ifdef CONFIG_VNC_TLS 276 if (client->tls.session && 277 client->tls.dname) { 278 client->info->has_x509_dname = true; 279 client->info->x509_dname = g_strdup(client->tls.dname); 280 } 281 #endif 282 #ifdef CONFIG_VNC_SASL 283 if (client->sasl.conn && 284 client->sasl.username) { 285 client->info->has_sasl_username = true; 286 client->info->sasl_username = g_strdup(client->sasl.username); 287 } 288 #endif 289 } 290 291 static void vnc_client_cache_addr(VncState *client) 292 { 293 VncBasicInfo *bi = vnc_basic_info_get_from_remote_addr(client->csock); 294 295 if (bi) { 296 client->info = g_malloc0(sizeof(*client->info)); 297 client->info->base = bi; 298 } 299 } 300 301 static void vnc_qmp_event(VncState *vs, QAPIEvent event) 302 { 303 VncServerInfo *si; 304 305 if (!vs->info) { 306 return; 307 } 308 g_assert(vs->info->base); 309 310 si = vnc_server_info_get(vs->vd); 311 if (!si) { 312 return; 313 } 314 315 switch (event) { 316 case QAPI_EVENT_VNC_CONNECTED: 317 qapi_event_send_vnc_connected(si, vs->info->base, &error_abort); 318 break; 319 case QAPI_EVENT_VNC_INITIALIZED: 320 qapi_event_send_vnc_initialized(si, vs->info, &error_abort); 321 break; 322 case QAPI_EVENT_VNC_DISCONNECTED: 323 qapi_event_send_vnc_disconnected(si, vs->info, &error_abort); 324 break; 325 default: 326 break; 327 } 328 329 qapi_free_VncServerInfo(si); 330 } 331 332 static VncClientInfo *qmp_query_vnc_client(const VncState *client) 333 { 334 struct sockaddr_storage sa; 335 socklen_t salen = sizeof(sa); 336 char host[NI_MAXHOST]; 337 char serv[NI_MAXSERV]; 338 VncClientInfo *info; 339 340 if (getpeername(client->csock, (struct sockaddr *)&sa, &salen) < 0) { 341 return NULL; 342 } 343 344 if (getnameinfo((struct sockaddr *)&sa, salen, 345 host, sizeof(host), 346 serv, sizeof(serv), 347 NI_NUMERICHOST | NI_NUMERICSERV) < 0) { 348 return NULL; 349 } 350 351 info = g_malloc0(sizeof(*info)); 352 info->base = g_malloc0(sizeof(*info->base)); 353 info->base->host = g_strdup(host); 354 info->base->service = g_strdup(serv); 355 info->base->family = inet_netfamily(sa.ss_family); 356 #ifdef CONFIG_VNC_WS 357 info->base->websocket = client->websocket; 358 #endif 359 360 #ifdef CONFIG_VNC_TLS 361 if (client->tls.session && client->tls.dname) { 362 info->has_x509_dname = true; 363 info->x509_dname = g_strdup(client->tls.dname); 364 } 365 #endif 366 #ifdef CONFIG_VNC_SASL 367 if (client->sasl.conn && client->sasl.username) { 368 info->has_sasl_username = true; 369 info->sasl_username = g_strdup(client->sasl.username); 370 } 371 #endif 372 373 return info; 374 } 375 376 static VncDisplay *vnc_display_find(const char *id) 377 { 378 VncDisplay *vd; 379 380 if (id == NULL) { 381 return QTAILQ_FIRST(&vnc_displays); 382 } 383 QTAILQ_FOREACH(vd, &vnc_displays, next) { 384 if (strcmp(id, vd->id) == 0) { 385 return vd; 386 } 387 } 388 return NULL; 389 } 390 391 static VncClientInfoList *qmp_query_client_list(VncDisplay *vd) 392 { 393 VncClientInfoList *cinfo, *prev = NULL; 394 VncState *client; 395 396 QTAILQ_FOREACH(client, &vd->clients, next) { 397 cinfo = g_new0(VncClientInfoList, 1); 398 cinfo->value = qmp_query_vnc_client(client); 399 cinfo->next = prev; 400 prev = cinfo; 401 } 402 return prev; 403 } 404 405 VncInfo *qmp_query_vnc(Error **errp) 406 { 407 VncInfo *info = g_malloc0(sizeof(*info)); 408 VncDisplay *vd = vnc_display_find(NULL); 409 410 if (vd == NULL || !vd->enabled) { 411 info->enabled = false; 412 } else { 413 struct sockaddr_storage sa; 414 socklen_t salen = sizeof(sa); 415 char host[NI_MAXHOST]; 416 char serv[NI_MAXSERV]; 417 418 info->enabled = true; 419 420 /* for compatibility with the original command */ 421 info->has_clients = true; 422 info->clients = qmp_query_client_list(vd); 423 424 if (vd->lsock == -1) { 425 return info; 426 } 427 428 if (getsockname(vd->lsock, (struct sockaddr *)&sa, 429 &salen) == -1) { 430 error_set(errp, QERR_UNDEFINED_ERROR); 431 goto out_error; 432 } 433 434 if (getnameinfo((struct sockaddr *)&sa, salen, 435 host, sizeof(host), 436 serv, sizeof(serv), 437 NI_NUMERICHOST | NI_NUMERICSERV) < 0) { 438 error_set(errp, QERR_UNDEFINED_ERROR); 439 goto out_error; 440 } 441 442 info->has_host = true; 443 info->host = g_strdup(host); 444 445 info->has_service = true; 446 info->service = g_strdup(serv); 447 448 info->has_family = true; 449 info->family = inet_netfamily(sa.ss_family); 450 451 info->has_auth = true; 452 info->auth = g_strdup(vnc_auth_name(vd)); 453 } 454 455 return info; 456 457 out_error: 458 qapi_free_VncInfo(info); 459 return NULL; 460 } 461 462 static VncBasicInfoList *qmp_query_server_entry(int socket, 463 bool websocket, 464 VncBasicInfoList *prev) 465 { 466 VncBasicInfoList *list; 467 VncBasicInfo *info; 468 struct sockaddr_storage sa; 469 socklen_t salen = sizeof(sa); 470 char host[NI_MAXHOST]; 471 char serv[NI_MAXSERV]; 472 473 if (getsockname(socket, (struct sockaddr *)&sa, &salen) < 0 || 474 getnameinfo((struct sockaddr *)&sa, salen, 475 host, sizeof(host), serv, sizeof(serv), 476 NI_NUMERICHOST | NI_NUMERICSERV) < 0) { 477 return prev; 478 } 479 480 info = g_new0(VncBasicInfo, 1); 481 info->host = g_strdup(host); 482 info->service = g_strdup(serv); 483 info->family = inet_netfamily(sa.ss_family); 484 info->websocket = websocket; 485 486 list = g_new0(VncBasicInfoList, 1); 487 list->value = info; 488 list->next = prev; 489 return list; 490 } 491 492 static void qmp_query_auth(VncDisplay *vd, VncInfo2 *info) 493 { 494 switch (vd->auth) { 495 case VNC_AUTH_VNC: 496 info->auth = VNC_PRIMARY_AUTH_VNC; 497 break; 498 case VNC_AUTH_RA2: 499 info->auth = VNC_PRIMARY_AUTH_RA2; 500 break; 501 case VNC_AUTH_RA2NE: 502 info->auth = VNC_PRIMARY_AUTH_RA2NE; 503 break; 504 case VNC_AUTH_TIGHT: 505 info->auth = VNC_PRIMARY_AUTH_TIGHT; 506 break; 507 case VNC_AUTH_ULTRA: 508 info->auth = VNC_PRIMARY_AUTH_ULTRA; 509 break; 510 case VNC_AUTH_TLS: 511 info->auth = VNC_PRIMARY_AUTH_TLS; 512 break; 513 case VNC_AUTH_VENCRYPT: 514 info->auth = VNC_PRIMARY_AUTH_VENCRYPT; 515 #ifdef CONFIG_VNC_TLS 516 info->has_vencrypt = true; 517 switch (vd->subauth) { 518 case VNC_AUTH_VENCRYPT_PLAIN: 519 info->vencrypt = VNC_VENCRYPT_SUB_AUTH_PLAIN; 520 break; 521 case VNC_AUTH_VENCRYPT_TLSNONE: 522 info->vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_NONE; 523 break; 524 case VNC_AUTH_VENCRYPT_TLSVNC: 525 info->vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_VNC; 526 break; 527 case VNC_AUTH_VENCRYPT_TLSPLAIN: 528 info->vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_PLAIN; 529 break; 530 case VNC_AUTH_VENCRYPT_X509NONE: 531 info->vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_NONE; 532 break; 533 case VNC_AUTH_VENCRYPT_X509VNC: 534 info->vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_VNC; 535 break; 536 case VNC_AUTH_VENCRYPT_X509PLAIN: 537 info->vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_PLAIN; 538 break; 539 case VNC_AUTH_VENCRYPT_TLSSASL: 540 info->vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_SASL; 541 break; 542 case VNC_AUTH_VENCRYPT_X509SASL: 543 info->vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_SASL; 544 break; 545 default: 546 info->has_vencrypt = false; 547 break; 548 } 549 #endif 550 break; 551 case VNC_AUTH_SASL: 552 info->auth = VNC_PRIMARY_AUTH_SASL; 553 break; 554 case VNC_AUTH_NONE: 555 default: 556 info->auth = VNC_PRIMARY_AUTH_NONE; 557 break; 558 } 559 } 560 561 VncInfo2List *qmp_query_vnc_servers(Error **errp) 562 { 563 VncInfo2List *item, *prev = NULL; 564 VncInfo2 *info; 565 VncDisplay *vd; 566 DeviceState *dev; 567 568 QTAILQ_FOREACH(vd, &vnc_displays, next) { 569 info = g_new0(VncInfo2, 1); 570 info->id = g_strdup(vd->id); 571 info->clients = qmp_query_client_list(vd); 572 qmp_query_auth(vd, info); 573 if (vd->dcl.con) { 574 dev = DEVICE(object_property_get_link(OBJECT(vd->dcl.con), 575 "device", NULL)); 576 info->has_display = true; 577 info->display = g_strdup(dev->id); 578 } 579 if (vd->lsock != -1) { 580 info->server = qmp_query_server_entry(vd->lsock, false, 581 info->server); 582 } 583 #ifdef CONFIG_VNC_WS 584 if (vd->lwebsock != -1) { 585 info->server = qmp_query_server_entry(vd->lwebsock, true, 586 info->server); 587 } 588 #endif 589 590 item = g_new0(VncInfo2List, 1); 591 item->value = info; 592 item->next = prev; 593 prev = item; 594 } 595 return prev; 596 } 597 598 /* TODO 599 1) Get the queue working for IO. 600 2) there is some weirdness when using the -S option (the screen is grey 601 and not totally invalidated 602 3) resolutions > 1024 603 */ 604 605 static int vnc_update_client(VncState *vs, int has_dirty, bool sync); 606 static void vnc_disconnect_start(VncState *vs); 607 608 static void vnc_colordepth(VncState *vs); 609 static void framebuffer_update_request(VncState *vs, int incremental, 610 int x_position, int y_position, 611 int w, int h); 612 static void vnc_refresh(DisplayChangeListener *dcl); 613 static int vnc_refresh_server_surface(VncDisplay *vd); 614 615 static void vnc_set_area_dirty(DECLARE_BITMAP(dirty[VNC_MAX_HEIGHT], 616 VNC_MAX_WIDTH / VNC_DIRTY_PIXELS_PER_BIT), 617 int width, int height, 618 int x, int y, int w, int h) { 619 /* this is needed this to ensure we updated all affected 620 * blocks if x % VNC_DIRTY_PIXELS_PER_BIT != 0 */ 621 w += (x % VNC_DIRTY_PIXELS_PER_BIT); 622 x -= (x % VNC_DIRTY_PIXELS_PER_BIT); 623 624 x = MIN(x, width); 625 y = MIN(y, height); 626 w = MIN(x + w, width) - x; 627 h = MIN(y + h, height); 628 629 for (; y < h; y++) { 630 bitmap_set(dirty[y], x / VNC_DIRTY_PIXELS_PER_BIT, 631 DIV_ROUND_UP(w, VNC_DIRTY_PIXELS_PER_BIT)); 632 } 633 } 634 635 static void vnc_dpy_update(DisplayChangeListener *dcl, 636 int x, int y, int w, int h) 637 { 638 VncDisplay *vd = container_of(dcl, VncDisplay, dcl); 639 struct VncSurface *s = &vd->guest; 640 int width = pixman_image_get_width(vd->server); 641 int height = pixman_image_get_height(vd->server); 642 643 vnc_set_area_dirty(s->dirty, width, height, x, y, w, h); 644 } 645 646 void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h, 647 int32_t encoding) 648 { 649 vnc_write_u16(vs, x); 650 vnc_write_u16(vs, y); 651 vnc_write_u16(vs, w); 652 vnc_write_u16(vs, h); 653 654 vnc_write_s32(vs, encoding); 655 } 656 657 void buffer_reserve(Buffer *buffer, size_t len) 658 { 659 if ((buffer->capacity - buffer->offset) < len) { 660 buffer->capacity += (len + 1024); 661 buffer->buffer = g_realloc(buffer->buffer, buffer->capacity); 662 } 663 } 664 665 static int buffer_empty(Buffer *buffer) 666 { 667 return buffer->offset == 0; 668 } 669 670 uint8_t *buffer_end(Buffer *buffer) 671 { 672 return buffer->buffer + buffer->offset; 673 } 674 675 void buffer_reset(Buffer *buffer) 676 { 677 buffer->offset = 0; 678 } 679 680 void buffer_free(Buffer *buffer) 681 { 682 g_free(buffer->buffer); 683 buffer->offset = 0; 684 buffer->capacity = 0; 685 buffer->buffer = NULL; 686 } 687 688 void buffer_append(Buffer *buffer, const void *data, size_t len) 689 { 690 memcpy(buffer->buffer + buffer->offset, data, len); 691 buffer->offset += len; 692 } 693 694 void buffer_advance(Buffer *buf, size_t len) 695 { 696 memmove(buf->buffer, buf->buffer + len, 697 (buf->offset - len)); 698 buf->offset -= len; 699 } 700 701 static void vnc_desktop_resize(VncState *vs) 702 { 703 if (vs->csock == -1 || !vnc_has_feature(vs, VNC_FEATURE_RESIZE)) { 704 return; 705 } 706 if (vs->client_width == pixman_image_get_width(vs->vd->server) && 707 vs->client_height == pixman_image_get_height(vs->vd->server)) { 708 return; 709 } 710 vs->client_width = pixman_image_get_width(vs->vd->server); 711 vs->client_height = pixman_image_get_height(vs->vd->server); 712 vnc_lock_output(vs); 713 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 714 vnc_write_u8(vs, 0); 715 vnc_write_u16(vs, 1); /* number of rects */ 716 vnc_framebuffer_update(vs, 0, 0, vs->client_width, vs->client_height, 717 VNC_ENCODING_DESKTOPRESIZE); 718 vnc_unlock_output(vs); 719 vnc_flush(vs); 720 } 721 722 static void vnc_abort_display_jobs(VncDisplay *vd) 723 { 724 VncState *vs; 725 726 QTAILQ_FOREACH(vs, &vd->clients, next) { 727 vnc_lock_output(vs); 728 vs->abort = true; 729 vnc_unlock_output(vs); 730 } 731 QTAILQ_FOREACH(vs, &vd->clients, next) { 732 vnc_jobs_join(vs); 733 } 734 QTAILQ_FOREACH(vs, &vd->clients, next) { 735 vnc_lock_output(vs); 736 vs->abort = false; 737 vnc_unlock_output(vs); 738 } 739 } 740 741 int vnc_server_fb_stride(VncDisplay *vd) 742 { 743 return pixman_image_get_stride(vd->server); 744 } 745 746 void *vnc_server_fb_ptr(VncDisplay *vd, int x, int y) 747 { 748 uint8_t *ptr; 749 750 ptr = (uint8_t *)pixman_image_get_data(vd->server); 751 ptr += y * vnc_server_fb_stride(vd); 752 ptr += x * VNC_SERVER_FB_BYTES; 753 return ptr; 754 } 755 756 static void vnc_dpy_switch(DisplayChangeListener *dcl, 757 DisplaySurface *surface) 758 { 759 VncDisplay *vd = container_of(dcl, VncDisplay, dcl); 760 VncState *vs; 761 int width, height; 762 763 vnc_abort_display_jobs(vd); 764 765 /* server surface */ 766 qemu_pixman_image_unref(vd->server); 767 vd->ds = surface; 768 width = MIN(VNC_MAX_WIDTH, ROUND_UP(surface_width(vd->ds), 769 VNC_DIRTY_PIXELS_PER_BIT)); 770 height = MIN(VNC_MAX_HEIGHT, surface_height(vd->ds)); 771 vd->server = pixman_image_create_bits(VNC_SERVER_FB_FORMAT, 772 width, height, NULL, 0); 773 774 /* guest surface */ 775 #if 0 /* FIXME */ 776 if (ds_get_bytes_per_pixel(ds) != vd->guest.ds->pf.bytes_per_pixel) 777 console_color_init(ds); 778 #endif 779 qemu_pixman_image_unref(vd->guest.fb); 780 vd->guest.fb = pixman_image_ref(surface->image); 781 vd->guest.format = surface->format; 782 memset(vd->guest.dirty, 0x00, sizeof(vd->guest.dirty)); 783 vnc_set_area_dirty(vd->guest.dirty, width, height, 0, 0, 784 width, height); 785 786 QTAILQ_FOREACH(vs, &vd->clients, next) { 787 vnc_colordepth(vs); 788 vnc_desktop_resize(vs); 789 if (vs->vd->cursor) { 790 vnc_cursor_define(vs); 791 } 792 memset(vs->dirty, 0x00, sizeof(vs->dirty)); 793 vnc_set_area_dirty(vs->dirty, width, height, 0, 0, 794 width, height); 795 } 796 } 797 798 /* fastest code */ 799 static void vnc_write_pixels_copy(VncState *vs, 800 void *pixels, int size) 801 { 802 vnc_write(vs, pixels, size); 803 } 804 805 /* slowest but generic code. */ 806 void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v) 807 { 808 uint8_t r, g, b; 809 810 #if VNC_SERVER_FB_FORMAT == PIXMAN_FORMAT(32, PIXMAN_TYPE_ARGB, 0, 8, 8, 8) 811 r = (((v & 0x00ff0000) >> 16) << vs->client_pf.rbits) >> 8; 812 g = (((v & 0x0000ff00) >> 8) << vs->client_pf.gbits) >> 8; 813 b = (((v & 0x000000ff) >> 0) << vs->client_pf.bbits) >> 8; 814 #else 815 # error need some bits here if you change VNC_SERVER_FB_FORMAT 816 #endif 817 v = (r << vs->client_pf.rshift) | 818 (g << vs->client_pf.gshift) | 819 (b << vs->client_pf.bshift); 820 switch (vs->client_pf.bytes_per_pixel) { 821 case 1: 822 buf[0] = v; 823 break; 824 case 2: 825 if (vs->client_be) { 826 buf[0] = v >> 8; 827 buf[1] = v; 828 } else { 829 buf[1] = v >> 8; 830 buf[0] = v; 831 } 832 break; 833 default: 834 case 4: 835 if (vs->client_be) { 836 buf[0] = v >> 24; 837 buf[1] = v >> 16; 838 buf[2] = v >> 8; 839 buf[3] = v; 840 } else { 841 buf[3] = v >> 24; 842 buf[2] = v >> 16; 843 buf[1] = v >> 8; 844 buf[0] = v; 845 } 846 break; 847 } 848 } 849 850 static void vnc_write_pixels_generic(VncState *vs, 851 void *pixels1, int size) 852 { 853 uint8_t buf[4]; 854 855 if (VNC_SERVER_FB_BYTES == 4) { 856 uint32_t *pixels = pixels1; 857 int n, i; 858 n = size >> 2; 859 for (i = 0; i < n; i++) { 860 vnc_convert_pixel(vs, buf, pixels[i]); 861 vnc_write(vs, buf, vs->client_pf.bytes_per_pixel); 862 } 863 } 864 } 865 866 int vnc_raw_send_framebuffer_update(VncState *vs, int x, int y, int w, int h) 867 { 868 int i; 869 uint8_t *row; 870 VncDisplay *vd = vs->vd; 871 872 row = vnc_server_fb_ptr(vd, x, y); 873 for (i = 0; i < h; i++) { 874 vs->write_pixels(vs, row, w * VNC_SERVER_FB_BYTES); 875 row += vnc_server_fb_stride(vd); 876 } 877 return 1; 878 } 879 880 int vnc_send_framebuffer_update(VncState *vs, int x, int y, int w, int h) 881 { 882 int n = 0; 883 884 switch(vs->vnc_encoding) { 885 case VNC_ENCODING_ZLIB: 886 n = vnc_zlib_send_framebuffer_update(vs, x, y, w, h); 887 break; 888 case VNC_ENCODING_HEXTILE: 889 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE); 890 n = vnc_hextile_send_framebuffer_update(vs, x, y, w, h); 891 break; 892 case VNC_ENCODING_TIGHT: 893 n = vnc_tight_send_framebuffer_update(vs, x, y, w, h); 894 break; 895 case VNC_ENCODING_TIGHT_PNG: 896 n = vnc_tight_png_send_framebuffer_update(vs, x, y, w, h); 897 break; 898 case VNC_ENCODING_ZRLE: 899 n = vnc_zrle_send_framebuffer_update(vs, x, y, w, h); 900 break; 901 case VNC_ENCODING_ZYWRLE: 902 n = vnc_zywrle_send_framebuffer_update(vs, x, y, w, h); 903 break; 904 default: 905 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW); 906 n = vnc_raw_send_framebuffer_update(vs, x, y, w, h); 907 break; 908 } 909 return n; 910 } 911 912 static void vnc_copy(VncState *vs, int src_x, int src_y, int dst_x, int dst_y, int w, int h) 913 { 914 /* send bitblit op to the vnc client */ 915 vnc_lock_output(vs); 916 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 917 vnc_write_u8(vs, 0); 918 vnc_write_u16(vs, 1); /* number of rects */ 919 vnc_framebuffer_update(vs, dst_x, dst_y, w, h, VNC_ENCODING_COPYRECT); 920 vnc_write_u16(vs, src_x); 921 vnc_write_u16(vs, src_y); 922 vnc_unlock_output(vs); 923 vnc_flush(vs); 924 } 925 926 static void vnc_dpy_copy(DisplayChangeListener *dcl, 927 int src_x, int src_y, 928 int dst_x, int dst_y, int w, int h) 929 { 930 VncDisplay *vd = container_of(dcl, VncDisplay, dcl); 931 VncState *vs, *vn; 932 uint8_t *src_row; 933 uint8_t *dst_row; 934 int i, x, y, pitch, inc, w_lim, s; 935 int cmp_bytes; 936 937 vnc_refresh_server_surface(vd); 938 QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) { 939 if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) { 940 vs->force_update = 1; 941 vnc_update_client(vs, 1, true); 942 /* vs might be free()ed here */ 943 } 944 } 945 946 /* do bitblit op on the local surface too */ 947 pitch = vnc_server_fb_stride(vd); 948 src_row = vnc_server_fb_ptr(vd, src_x, src_y); 949 dst_row = vnc_server_fb_ptr(vd, dst_x, dst_y); 950 y = dst_y; 951 inc = 1; 952 if (dst_y > src_y) { 953 /* copy backwards */ 954 src_row += pitch * (h-1); 955 dst_row += pitch * (h-1); 956 pitch = -pitch; 957 y = dst_y + h - 1; 958 inc = -1; 959 } 960 w_lim = w - (VNC_DIRTY_PIXELS_PER_BIT - (dst_x % VNC_DIRTY_PIXELS_PER_BIT)); 961 if (w_lim < 0) { 962 w_lim = w; 963 } else { 964 w_lim = w - (w_lim % VNC_DIRTY_PIXELS_PER_BIT); 965 } 966 for (i = 0; i < h; i++) { 967 for (x = 0; x <= w_lim; 968 x += s, src_row += cmp_bytes, dst_row += cmp_bytes) { 969 if (x == w_lim) { 970 if ((s = w - w_lim) == 0) 971 break; 972 } else if (!x) { 973 s = (VNC_DIRTY_PIXELS_PER_BIT - 974 (dst_x % VNC_DIRTY_PIXELS_PER_BIT)); 975 s = MIN(s, w_lim); 976 } else { 977 s = VNC_DIRTY_PIXELS_PER_BIT; 978 } 979 cmp_bytes = s * VNC_SERVER_FB_BYTES; 980 if (memcmp(src_row, dst_row, cmp_bytes) == 0) 981 continue; 982 memmove(dst_row, src_row, cmp_bytes); 983 QTAILQ_FOREACH(vs, &vd->clients, next) { 984 if (!vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) { 985 set_bit(((x + dst_x) / VNC_DIRTY_PIXELS_PER_BIT), 986 vs->dirty[y]); 987 } 988 } 989 } 990 src_row += pitch - w * VNC_SERVER_FB_BYTES; 991 dst_row += pitch - w * VNC_SERVER_FB_BYTES; 992 y += inc; 993 } 994 995 QTAILQ_FOREACH(vs, &vd->clients, next) { 996 if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) { 997 vnc_copy(vs, src_x, src_y, dst_x, dst_y, w, h); 998 } 999 } 1000 } 1001 1002 static void vnc_mouse_set(DisplayChangeListener *dcl, 1003 int x, int y, int visible) 1004 { 1005 /* can we ask the client(s) to move the pointer ??? */ 1006 } 1007 1008 static int vnc_cursor_define(VncState *vs) 1009 { 1010 QEMUCursor *c = vs->vd->cursor; 1011 int isize; 1012 1013 if (vnc_has_feature(vs, VNC_FEATURE_RICH_CURSOR)) { 1014 vnc_lock_output(vs); 1015 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 1016 vnc_write_u8(vs, 0); /* padding */ 1017 vnc_write_u16(vs, 1); /* # of rects */ 1018 vnc_framebuffer_update(vs, c->hot_x, c->hot_y, c->width, c->height, 1019 VNC_ENCODING_RICH_CURSOR); 1020 isize = c->width * c->height * vs->client_pf.bytes_per_pixel; 1021 vnc_write_pixels_generic(vs, c->data, isize); 1022 vnc_write(vs, vs->vd->cursor_mask, vs->vd->cursor_msize); 1023 vnc_unlock_output(vs); 1024 return 0; 1025 } 1026 return -1; 1027 } 1028 1029 static void vnc_dpy_cursor_define(DisplayChangeListener *dcl, 1030 QEMUCursor *c) 1031 { 1032 VncDisplay *vd = container_of(dcl, VncDisplay, dcl); 1033 VncState *vs; 1034 1035 cursor_put(vd->cursor); 1036 g_free(vd->cursor_mask); 1037 1038 vd->cursor = c; 1039 cursor_get(vd->cursor); 1040 vd->cursor_msize = cursor_get_mono_bpl(c) * c->height; 1041 vd->cursor_mask = g_malloc0(vd->cursor_msize); 1042 cursor_get_mono_mask(c, 0, vd->cursor_mask); 1043 1044 QTAILQ_FOREACH(vs, &vd->clients, next) { 1045 vnc_cursor_define(vs); 1046 } 1047 } 1048 1049 static int find_and_clear_dirty_height(VncState *vs, 1050 int y, int last_x, int x, int height) 1051 { 1052 int h; 1053 1054 for (h = 1; h < (height - y); h++) { 1055 if (!test_bit(last_x, vs->dirty[y + h])) { 1056 break; 1057 } 1058 bitmap_clear(vs->dirty[y + h], last_x, x - last_x); 1059 } 1060 1061 return h; 1062 } 1063 1064 static int vnc_update_client(VncState *vs, int has_dirty, bool sync) 1065 { 1066 vs->has_dirty += has_dirty; 1067 if (vs->need_update && vs->csock != -1) { 1068 VncDisplay *vd = vs->vd; 1069 VncJob *job; 1070 int y; 1071 int height, width; 1072 int n = 0; 1073 1074 if (vs->output.offset && !vs->audio_cap && !vs->force_update) 1075 /* kernel send buffers are full -> drop frames to throttle */ 1076 return 0; 1077 1078 if (!vs->has_dirty && !vs->audio_cap && !vs->force_update) 1079 return 0; 1080 1081 /* 1082 * Send screen updates to the vnc client using the server 1083 * surface and server dirty map. guest surface updates 1084 * happening in parallel don't disturb us, the next pass will 1085 * send them to the client. 1086 */ 1087 job = vnc_job_new(vs); 1088 1089 height = pixman_image_get_height(vd->server); 1090 width = pixman_image_get_width(vd->server); 1091 1092 y = 0; 1093 for (;;) { 1094 int x, h; 1095 unsigned long x2; 1096 unsigned long offset = find_next_bit((unsigned long *) &vs->dirty, 1097 height * VNC_DIRTY_BPL(vs), 1098 y * VNC_DIRTY_BPL(vs)); 1099 if (offset == height * VNC_DIRTY_BPL(vs)) { 1100 /* no more dirty bits */ 1101 break; 1102 } 1103 y = offset / VNC_DIRTY_BPL(vs); 1104 x = offset % VNC_DIRTY_BPL(vs); 1105 x2 = find_next_zero_bit((unsigned long *) &vs->dirty[y], 1106 VNC_DIRTY_BPL(vs), x); 1107 bitmap_clear(vs->dirty[y], x, x2 - x); 1108 h = find_and_clear_dirty_height(vs, y, x, x2, height); 1109 x2 = MIN(x2, width / VNC_DIRTY_PIXELS_PER_BIT); 1110 if (x2 > x) { 1111 n += vnc_job_add_rect(job, x * VNC_DIRTY_PIXELS_PER_BIT, y, 1112 (x2 - x) * VNC_DIRTY_PIXELS_PER_BIT, h); 1113 } 1114 if (!x && x2 == width / VNC_DIRTY_PIXELS_PER_BIT) { 1115 y += h; 1116 if (y == height) { 1117 break; 1118 } 1119 } 1120 } 1121 1122 vnc_job_push(job); 1123 if (sync) { 1124 vnc_jobs_join(vs); 1125 } 1126 vs->force_update = 0; 1127 vs->has_dirty = 0; 1128 return n; 1129 } 1130 1131 if (vs->csock == -1) { 1132 vnc_disconnect_finish(vs); 1133 } else if (sync) { 1134 vnc_jobs_join(vs); 1135 } 1136 1137 return 0; 1138 } 1139 1140 /* audio */ 1141 static void audio_capture_notify(void *opaque, audcnotification_e cmd) 1142 { 1143 VncState *vs = opaque; 1144 1145 switch (cmd) { 1146 case AUD_CNOTIFY_DISABLE: 1147 vnc_lock_output(vs); 1148 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU); 1149 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO); 1150 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_END); 1151 vnc_unlock_output(vs); 1152 vnc_flush(vs); 1153 break; 1154 1155 case AUD_CNOTIFY_ENABLE: 1156 vnc_lock_output(vs); 1157 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU); 1158 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO); 1159 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_BEGIN); 1160 vnc_unlock_output(vs); 1161 vnc_flush(vs); 1162 break; 1163 } 1164 } 1165 1166 static void audio_capture_destroy(void *opaque) 1167 { 1168 } 1169 1170 static void audio_capture(void *opaque, void *buf, int size) 1171 { 1172 VncState *vs = opaque; 1173 1174 vnc_lock_output(vs); 1175 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU); 1176 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO); 1177 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_DATA); 1178 vnc_write_u32(vs, size); 1179 vnc_write(vs, buf, size); 1180 vnc_unlock_output(vs); 1181 vnc_flush(vs); 1182 } 1183 1184 static void audio_add(VncState *vs) 1185 { 1186 struct audio_capture_ops ops; 1187 1188 if (vs->audio_cap) { 1189 error_report("audio already running"); 1190 return; 1191 } 1192 1193 ops.notify = audio_capture_notify; 1194 ops.destroy = audio_capture_destroy; 1195 ops.capture = audio_capture; 1196 1197 vs->audio_cap = AUD_add_capture(&vs->as, &ops, vs); 1198 if (!vs->audio_cap) { 1199 error_report("Failed to add audio capture"); 1200 } 1201 } 1202 1203 static void audio_del(VncState *vs) 1204 { 1205 if (vs->audio_cap) { 1206 AUD_del_capture(vs->audio_cap, vs); 1207 vs->audio_cap = NULL; 1208 } 1209 } 1210 1211 static void vnc_disconnect_start(VncState *vs) 1212 { 1213 if (vs->csock == -1) 1214 return; 1215 vnc_set_share_mode(vs, VNC_SHARE_MODE_DISCONNECTED); 1216 qemu_set_fd_handler(vs->csock, NULL, NULL, NULL); 1217 closesocket(vs->csock); 1218 vs->csock = -1; 1219 } 1220 1221 void vnc_disconnect_finish(VncState *vs) 1222 { 1223 int i; 1224 1225 vnc_jobs_join(vs); /* Wait encoding jobs */ 1226 1227 vnc_lock_output(vs); 1228 vnc_qmp_event(vs, QAPI_EVENT_VNC_DISCONNECTED); 1229 1230 buffer_free(&vs->input); 1231 buffer_free(&vs->output); 1232 #ifdef CONFIG_VNC_WS 1233 buffer_free(&vs->ws_input); 1234 buffer_free(&vs->ws_output); 1235 #endif /* CONFIG_VNC_WS */ 1236 1237 qapi_free_VncClientInfo(vs->info); 1238 1239 vnc_zlib_clear(vs); 1240 vnc_tight_clear(vs); 1241 vnc_zrle_clear(vs); 1242 1243 #ifdef CONFIG_VNC_TLS 1244 vnc_tls_client_cleanup(vs); 1245 #endif /* CONFIG_VNC_TLS */ 1246 #ifdef CONFIG_VNC_SASL 1247 vnc_sasl_client_cleanup(vs); 1248 #endif /* CONFIG_VNC_SASL */ 1249 audio_del(vs); 1250 vnc_release_modifiers(vs); 1251 1252 if (vs->initialized) { 1253 QTAILQ_REMOVE(&vs->vd->clients, vs, next); 1254 qemu_remove_mouse_mode_change_notifier(&vs->mouse_mode_notifier); 1255 } 1256 1257 if (vs->vd->lock_key_sync) 1258 qemu_remove_led_event_handler(vs->led); 1259 vnc_unlock_output(vs); 1260 1261 qemu_mutex_destroy(&vs->output_mutex); 1262 if (vs->bh != NULL) { 1263 qemu_bh_delete(vs->bh); 1264 } 1265 buffer_free(&vs->jobs_buffer); 1266 1267 for (i = 0; i < VNC_STAT_ROWS; ++i) { 1268 g_free(vs->lossy_rect[i]); 1269 } 1270 g_free(vs->lossy_rect); 1271 g_free(vs); 1272 } 1273 1274 int vnc_client_io_error(VncState *vs, int ret, int last_errno) 1275 { 1276 if (ret == 0 || ret == -1) { 1277 if (ret == -1) { 1278 switch (last_errno) { 1279 case EINTR: 1280 case EAGAIN: 1281 #ifdef _WIN32 1282 case WSAEWOULDBLOCK: 1283 #endif 1284 return 0; 1285 default: 1286 break; 1287 } 1288 } 1289 1290 VNC_DEBUG("Closing down client sock: ret %d, errno %d\n", 1291 ret, ret < 0 ? last_errno : 0); 1292 vnc_disconnect_start(vs); 1293 1294 return 0; 1295 } 1296 return ret; 1297 } 1298 1299 1300 void vnc_client_error(VncState *vs) 1301 { 1302 VNC_DEBUG("Closing down client sock: protocol error\n"); 1303 vnc_disconnect_start(vs); 1304 } 1305 1306 #ifdef CONFIG_VNC_TLS 1307 static long vnc_client_write_tls(gnutls_session_t *session, 1308 const uint8_t *data, 1309 size_t datalen) 1310 { 1311 long ret = gnutls_write(*session, data, datalen); 1312 if (ret < 0) { 1313 if (ret == GNUTLS_E_AGAIN) { 1314 errno = EAGAIN; 1315 } else { 1316 errno = EIO; 1317 } 1318 ret = -1; 1319 } 1320 return ret; 1321 } 1322 #endif /* CONFIG_VNC_TLS */ 1323 1324 /* 1325 * Called to write a chunk of data to the client socket. The data may 1326 * be the raw data, or may have already been encoded by SASL. 1327 * The data will be written either straight onto the socket, or 1328 * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled 1329 * 1330 * NB, it is theoretically possible to have 2 layers of encryption, 1331 * both SASL, and this TLS layer. It is highly unlikely in practice 1332 * though, since SASL encryption will typically be a no-op if TLS 1333 * is active 1334 * 1335 * Returns the number of bytes written, which may be less than 1336 * the requested 'datalen' if the socket would block. Returns 1337 * -1 on error, and disconnects the client socket. 1338 */ 1339 long vnc_client_write_buf(VncState *vs, const uint8_t *data, size_t datalen) 1340 { 1341 long ret; 1342 #ifdef CONFIG_VNC_TLS 1343 if (vs->tls.session) { 1344 ret = vnc_client_write_tls(&vs->tls.session, data, datalen); 1345 } else { 1346 #endif /* CONFIG_VNC_TLS */ 1347 ret = send(vs->csock, (const void *)data, datalen, 0); 1348 #ifdef CONFIG_VNC_TLS 1349 } 1350 #endif /* CONFIG_VNC_TLS */ 1351 VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data, datalen, ret); 1352 return vnc_client_io_error(vs, ret, socket_error()); 1353 } 1354 1355 1356 /* 1357 * Called to write buffered data to the client socket, when not 1358 * using any SASL SSF encryption layers. Will write as much data 1359 * as possible without blocking. If all buffered data is written, 1360 * will switch the FD poll() handler back to read monitoring. 1361 * 1362 * Returns the number of bytes written, which may be less than 1363 * the buffered output data if the socket would block. Returns 1364 * -1 on error, and disconnects the client socket. 1365 */ 1366 static long vnc_client_write_plain(VncState *vs) 1367 { 1368 long ret; 1369 1370 #ifdef CONFIG_VNC_SASL 1371 VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n", 1372 vs->output.buffer, vs->output.capacity, vs->output.offset, 1373 vs->sasl.waitWriteSSF); 1374 1375 if (vs->sasl.conn && 1376 vs->sasl.runSSF && 1377 vs->sasl.waitWriteSSF) { 1378 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF); 1379 if (ret) 1380 vs->sasl.waitWriteSSF -= ret; 1381 } else 1382 #endif /* CONFIG_VNC_SASL */ 1383 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset); 1384 if (!ret) 1385 return 0; 1386 1387 buffer_advance(&vs->output, ret); 1388 1389 if (vs->output.offset == 0) { 1390 qemu_set_fd_handler(vs->csock, vnc_client_read, NULL, vs); 1391 } 1392 1393 return ret; 1394 } 1395 1396 1397 /* 1398 * First function called whenever there is data to be written to 1399 * the client socket. Will delegate actual work according to whether 1400 * SASL SSF layers are enabled (thus requiring encryption calls) 1401 */ 1402 static void vnc_client_write_locked(void *opaque) 1403 { 1404 VncState *vs = opaque; 1405 1406 #ifdef CONFIG_VNC_SASL 1407 if (vs->sasl.conn && 1408 vs->sasl.runSSF && 1409 !vs->sasl.waitWriteSSF) { 1410 vnc_client_write_sasl(vs); 1411 } else 1412 #endif /* CONFIG_VNC_SASL */ 1413 { 1414 #ifdef CONFIG_VNC_WS 1415 if (vs->encode_ws) { 1416 vnc_client_write_ws(vs); 1417 } else 1418 #endif /* CONFIG_VNC_WS */ 1419 { 1420 vnc_client_write_plain(vs); 1421 } 1422 } 1423 } 1424 1425 void vnc_client_write(void *opaque) 1426 { 1427 VncState *vs = opaque; 1428 1429 vnc_lock_output(vs); 1430 if (vs->output.offset 1431 #ifdef CONFIG_VNC_WS 1432 || vs->ws_output.offset 1433 #endif 1434 ) { 1435 vnc_client_write_locked(opaque); 1436 } else if (vs->csock != -1) { 1437 qemu_set_fd_handler(vs->csock, vnc_client_read, NULL, vs); 1438 } 1439 vnc_unlock_output(vs); 1440 } 1441 1442 void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting) 1443 { 1444 vs->read_handler = func; 1445 vs->read_handler_expect = expecting; 1446 } 1447 1448 #ifdef CONFIG_VNC_TLS 1449 static long vnc_client_read_tls(gnutls_session_t *session, uint8_t *data, 1450 size_t datalen) 1451 { 1452 long ret = gnutls_read(*session, data, datalen); 1453 if (ret < 0) { 1454 if (ret == GNUTLS_E_AGAIN) { 1455 errno = EAGAIN; 1456 } else { 1457 errno = EIO; 1458 } 1459 ret = -1; 1460 } 1461 return ret; 1462 } 1463 #endif /* CONFIG_VNC_TLS */ 1464 1465 /* 1466 * Called to read a chunk of data from the client socket. The data may 1467 * be the raw data, or may need to be further decoded by SASL. 1468 * The data will be read either straight from to the socket, or 1469 * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled 1470 * 1471 * NB, it is theoretically possible to have 2 layers of encryption, 1472 * both SASL, and this TLS layer. It is highly unlikely in practice 1473 * though, since SASL encryption will typically be a no-op if TLS 1474 * is active 1475 * 1476 * Returns the number of bytes read, which may be less than 1477 * the requested 'datalen' if the socket would block. Returns 1478 * -1 on error, and disconnects the client socket. 1479 */ 1480 long vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen) 1481 { 1482 long ret; 1483 #ifdef CONFIG_VNC_TLS 1484 if (vs->tls.session) { 1485 ret = vnc_client_read_tls(&vs->tls.session, data, datalen); 1486 } else { 1487 #endif /* CONFIG_VNC_TLS */ 1488 ret = qemu_recv(vs->csock, data, datalen, 0); 1489 #ifdef CONFIG_VNC_TLS 1490 } 1491 #endif /* CONFIG_VNC_TLS */ 1492 VNC_DEBUG("Read wire %p %zd -> %ld\n", data, datalen, ret); 1493 return vnc_client_io_error(vs, ret, socket_error()); 1494 } 1495 1496 1497 /* 1498 * Called to read data from the client socket to the input buffer, 1499 * when not using any SASL SSF encryption layers. Will read as much 1500 * data as possible without blocking. 1501 * 1502 * Returns the number of bytes read. Returns -1 on error, and 1503 * disconnects the client socket. 1504 */ 1505 static long vnc_client_read_plain(VncState *vs) 1506 { 1507 int ret; 1508 VNC_DEBUG("Read plain %p size %zd offset %zd\n", 1509 vs->input.buffer, vs->input.capacity, vs->input.offset); 1510 buffer_reserve(&vs->input, 4096); 1511 ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096); 1512 if (!ret) 1513 return 0; 1514 vs->input.offset += ret; 1515 return ret; 1516 } 1517 1518 static void vnc_jobs_bh(void *opaque) 1519 { 1520 VncState *vs = opaque; 1521 1522 vnc_jobs_consume_buffer(vs); 1523 } 1524 1525 /* 1526 * First function called whenever there is more data to be read from 1527 * the client socket. Will delegate actual work according to whether 1528 * SASL SSF layers are enabled (thus requiring decryption calls) 1529 */ 1530 void vnc_client_read(void *opaque) 1531 { 1532 VncState *vs = opaque; 1533 long ret; 1534 1535 #ifdef CONFIG_VNC_SASL 1536 if (vs->sasl.conn && vs->sasl.runSSF) 1537 ret = vnc_client_read_sasl(vs); 1538 else 1539 #endif /* CONFIG_VNC_SASL */ 1540 #ifdef CONFIG_VNC_WS 1541 if (vs->encode_ws) { 1542 ret = vnc_client_read_ws(vs); 1543 if (ret == -1) { 1544 vnc_disconnect_start(vs); 1545 return; 1546 } else if (ret == -2) { 1547 vnc_client_error(vs); 1548 return; 1549 } 1550 } else 1551 #endif /* CONFIG_VNC_WS */ 1552 { 1553 ret = vnc_client_read_plain(vs); 1554 } 1555 if (!ret) { 1556 if (vs->csock == -1) 1557 vnc_disconnect_finish(vs); 1558 return; 1559 } 1560 1561 while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) { 1562 size_t len = vs->read_handler_expect; 1563 int ret; 1564 1565 ret = vs->read_handler(vs, vs->input.buffer, len); 1566 if (vs->csock == -1) { 1567 vnc_disconnect_finish(vs); 1568 return; 1569 } 1570 1571 if (!ret) { 1572 buffer_advance(&vs->input, len); 1573 } else { 1574 vs->read_handler_expect = ret; 1575 } 1576 } 1577 } 1578 1579 void vnc_write(VncState *vs, const void *data, size_t len) 1580 { 1581 buffer_reserve(&vs->output, len); 1582 1583 if (vs->csock != -1 && buffer_empty(&vs->output)) { 1584 qemu_set_fd_handler(vs->csock, vnc_client_read, vnc_client_write, vs); 1585 } 1586 1587 buffer_append(&vs->output, data, len); 1588 } 1589 1590 void vnc_write_s32(VncState *vs, int32_t value) 1591 { 1592 vnc_write_u32(vs, *(uint32_t *)&value); 1593 } 1594 1595 void vnc_write_u32(VncState *vs, uint32_t value) 1596 { 1597 uint8_t buf[4]; 1598 1599 buf[0] = (value >> 24) & 0xFF; 1600 buf[1] = (value >> 16) & 0xFF; 1601 buf[2] = (value >> 8) & 0xFF; 1602 buf[3] = value & 0xFF; 1603 1604 vnc_write(vs, buf, 4); 1605 } 1606 1607 void vnc_write_u16(VncState *vs, uint16_t value) 1608 { 1609 uint8_t buf[2]; 1610 1611 buf[0] = (value >> 8) & 0xFF; 1612 buf[1] = value & 0xFF; 1613 1614 vnc_write(vs, buf, 2); 1615 } 1616 1617 void vnc_write_u8(VncState *vs, uint8_t value) 1618 { 1619 vnc_write(vs, (char *)&value, 1); 1620 } 1621 1622 void vnc_flush(VncState *vs) 1623 { 1624 vnc_lock_output(vs); 1625 if (vs->csock != -1 && (vs->output.offset 1626 #ifdef CONFIG_VNC_WS 1627 || vs->ws_output.offset 1628 #endif 1629 )) { 1630 vnc_client_write_locked(vs); 1631 } 1632 vnc_unlock_output(vs); 1633 } 1634 1635 static uint8_t read_u8(uint8_t *data, size_t offset) 1636 { 1637 return data[offset]; 1638 } 1639 1640 static uint16_t read_u16(uint8_t *data, size_t offset) 1641 { 1642 return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF); 1643 } 1644 1645 static int32_t read_s32(uint8_t *data, size_t offset) 1646 { 1647 return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) | 1648 (data[offset + 2] << 8) | data[offset + 3]); 1649 } 1650 1651 uint32_t read_u32(uint8_t *data, size_t offset) 1652 { 1653 return ((data[offset] << 24) | (data[offset + 1] << 16) | 1654 (data[offset + 2] << 8) | data[offset + 3]); 1655 } 1656 1657 static void client_cut_text(VncState *vs, size_t len, uint8_t *text) 1658 { 1659 } 1660 1661 static void check_pointer_type_change(Notifier *notifier, void *data) 1662 { 1663 VncState *vs = container_of(notifier, VncState, mouse_mode_notifier); 1664 int absolute = qemu_input_is_absolute(); 1665 1666 if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) { 1667 vnc_lock_output(vs); 1668 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 1669 vnc_write_u8(vs, 0); 1670 vnc_write_u16(vs, 1); 1671 vnc_framebuffer_update(vs, absolute, 0, 1672 pixman_image_get_width(vs->vd->server), 1673 pixman_image_get_height(vs->vd->server), 1674 VNC_ENCODING_POINTER_TYPE_CHANGE); 1675 vnc_unlock_output(vs); 1676 vnc_flush(vs); 1677 } 1678 vs->absolute = absolute; 1679 } 1680 1681 static void pointer_event(VncState *vs, int button_mask, int x, int y) 1682 { 1683 static uint32_t bmap[INPUT_BUTTON_MAX] = { 1684 [INPUT_BUTTON_LEFT] = 0x01, 1685 [INPUT_BUTTON_MIDDLE] = 0x02, 1686 [INPUT_BUTTON_RIGHT] = 0x04, 1687 [INPUT_BUTTON_WHEEL_UP] = 0x08, 1688 [INPUT_BUTTON_WHEEL_DOWN] = 0x10, 1689 }; 1690 QemuConsole *con = vs->vd->dcl.con; 1691 int width = pixman_image_get_width(vs->vd->server); 1692 int height = pixman_image_get_height(vs->vd->server); 1693 1694 if (vs->last_bmask != button_mask) { 1695 qemu_input_update_buttons(con, bmap, vs->last_bmask, button_mask); 1696 vs->last_bmask = button_mask; 1697 } 1698 1699 if (vs->absolute) { 1700 qemu_input_queue_abs(con, INPUT_AXIS_X, x, width); 1701 qemu_input_queue_abs(con, INPUT_AXIS_Y, y, height); 1702 } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) { 1703 qemu_input_queue_rel(con, INPUT_AXIS_X, x - 0x7FFF); 1704 qemu_input_queue_rel(con, INPUT_AXIS_Y, y - 0x7FFF); 1705 } else { 1706 if (vs->last_x != -1) { 1707 qemu_input_queue_rel(con, INPUT_AXIS_X, x - vs->last_x); 1708 qemu_input_queue_rel(con, INPUT_AXIS_Y, y - vs->last_y); 1709 } 1710 vs->last_x = x; 1711 vs->last_y = y; 1712 } 1713 qemu_input_event_sync(); 1714 } 1715 1716 static void reset_keys(VncState *vs) 1717 { 1718 int i; 1719 for(i = 0; i < 256; i++) { 1720 if (vs->modifiers_state[i]) { 1721 qemu_input_event_send_key_number(vs->vd->dcl.con, i, false); 1722 vs->modifiers_state[i] = 0; 1723 } 1724 } 1725 } 1726 1727 static void press_key(VncState *vs, int keysym) 1728 { 1729 int keycode = keysym2scancode(vs->vd->kbd_layout, keysym) & SCANCODE_KEYMASK; 1730 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, true); 1731 qemu_input_event_send_key_delay(0); 1732 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, false); 1733 qemu_input_event_send_key_delay(0); 1734 } 1735 1736 static int current_led_state(VncState *vs) 1737 { 1738 int ledstate = 0; 1739 1740 if (vs->modifiers_state[0x46]) { 1741 ledstate |= QEMU_SCROLL_LOCK_LED; 1742 } 1743 if (vs->modifiers_state[0x45]) { 1744 ledstate |= QEMU_NUM_LOCK_LED; 1745 } 1746 if (vs->modifiers_state[0x3a]) { 1747 ledstate |= QEMU_CAPS_LOCK_LED; 1748 } 1749 1750 return ledstate; 1751 } 1752 1753 static void vnc_led_state_change(VncState *vs) 1754 { 1755 int ledstate = 0; 1756 1757 if (!vnc_has_feature(vs, VNC_FEATURE_LED_STATE)) { 1758 return; 1759 } 1760 1761 ledstate = current_led_state(vs); 1762 vnc_lock_output(vs); 1763 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 1764 vnc_write_u8(vs, 0); 1765 vnc_write_u16(vs, 1); 1766 vnc_framebuffer_update(vs, 0, 0, 1, 1, VNC_ENCODING_LED_STATE); 1767 vnc_write_u8(vs, ledstate); 1768 vnc_unlock_output(vs); 1769 vnc_flush(vs); 1770 } 1771 1772 static void kbd_leds(void *opaque, int ledstate) 1773 { 1774 VncState *vs = opaque; 1775 int caps, num, scr; 1776 bool has_changed = (ledstate != current_led_state(vs)); 1777 1778 trace_vnc_key_guest_leds((ledstate & QEMU_CAPS_LOCK_LED), 1779 (ledstate & QEMU_NUM_LOCK_LED), 1780 (ledstate & QEMU_SCROLL_LOCK_LED)); 1781 1782 caps = ledstate & QEMU_CAPS_LOCK_LED ? 1 : 0; 1783 num = ledstate & QEMU_NUM_LOCK_LED ? 1 : 0; 1784 scr = ledstate & QEMU_SCROLL_LOCK_LED ? 1 : 0; 1785 1786 if (vs->modifiers_state[0x3a] != caps) { 1787 vs->modifiers_state[0x3a] = caps; 1788 } 1789 if (vs->modifiers_state[0x45] != num) { 1790 vs->modifiers_state[0x45] = num; 1791 } 1792 if (vs->modifiers_state[0x46] != scr) { 1793 vs->modifiers_state[0x46] = scr; 1794 } 1795 1796 /* Sending the current led state message to the client */ 1797 if (has_changed) { 1798 vnc_led_state_change(vs); 1799 } 1800 } 1801 1802 static void do_key_event(VncState *vs, int down, int keycode, int sym) 1803 { 1804 /* QEMU console switch */ 1805 switch(keycode) { 1806 case 0x2a: /* Left Shift */ 1807 case 0x36: /* Right Shift */ 1808 case 0x1d: /* Left CTRL */ 1809 case 0x9d: /* Right CTRL */ 1810 case 0x38: /* Left ALT */ 1811 case 0xb8: /* Right ALT */ 1812 if (down) 1813 vs->modifiers_state[keycode] = 1; 1814 else 1815 vs->modifiers_state[keycode] = 0; 1816 break; 1817 case 0x02 ... 0x0a: /* '1' to '9' keys */ 1818 if (vs->vd->dcl.con == NULL && 1819 down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) { 1820 /* Reset the modifiers sent to the current console */ 1821 reset_keys(vs); 1822 console_select(keycode - 0x02); 1823 return; 1824 } 1825 break; 1826 case 0x3a: /* CapsLock */ 1827 case 0x45: /* NumLock */ 1828 if (down) 1829 vs->modifiers_state[keycode] ^= 1; 1830 break; 1831 } 1832 1833 /* Turn off the lock state sync logic if the client support the led 1834 state extension. 1835 */ 1836 if (down && vs->vd->lock_key_sync && 1837 !vnc_has_feature(vs, VNC_FEATURE_LED_STATE) && 1838 keycode_is_keypad(vs->vd->kbd_layout, keycode)) { 1839 /* If the numlock state needs to change then simulate an additional 1840 keypress before sending this one. This will happen if the user 1841 toggles numlock away from the VNC window. 1842 */ 1843 if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) { 1844 if (!vs->modifiers_state[0x45]) { 1845 trace_vnc_key_sync_numlock(true); 1846 vs->modifiers_state[0x45] = 1; 1847 press_key(vs, 0xff7f); 1848 } 1849 } else { 1850 if (vs->modifiers_state[0x45]) { 1851 trace_vnc_key_sync_numlock(false); 1852 vs->modifiers_state[0x45] = 0; 1853 press_key(vs, 0xff7f); 1854 } 1855 } 1856 } 1857 1858 if (down && vs->vd->lock_key_sync && 1859 !vnc_has_feature(vs, VNC_FEATURE_LED_STATE) && 1860 ((sym >= 'A' && sym <= 'Z') || (sym >= 'a' && sym <= 'z'))) { 1861 /* If the capslock state needs to change then simulate an additional 1862 keypress before sending this one. This will happen if the user 1863 toggles capslock away from the VNC window. 1864 */ 1865 int uppercase = !!(sym >= 'A' && sym <= 'Z'); 1866 int shift = !!(vs->modifiers_state[0x2a] | vs->modifiers_state[0x36]); 1867 int capslock = !!(vs->modifiers_state[0x3a]); 1868 if (capslock) { 1869 if (uppercase == shift) { 1870 trace_vnc_key_sync_capslock(false); 1871 vs->modifiers_state[0x3a] = 0; 1872 press_key(vs, 0xffe5); 1873 } 1874 } else { 1875 if (uppercase != shift) { 1876 trace_vnc_key_sync_capslock(true); 1877 vs->modifiers_state[0x3a] = 1; 1878 press_key(vs, 0xffe5); 1879 } 1880 } 1881 } 1882 1883 if (qemu_console_is_graphic(NULL)) { 1884 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, down); 1885 } else { 1886 bool numlock = vs->modifiers_state[0x45]; 1887 bool control = (vs->modifiers_state[0x1d] || 1888 vs->modifiers_state[0x9d]); 1889 /* QEMU console emulation */ 1890 if (down) { 1891 switch (keycode) { 1892 case 0x2a: /* Left Shift */ 1893 case 0x36: /* Right Shift */ 1894 case 0x1d: /* Left CTRL */ 1895 case 0x9d: /* Right CTRL */ 1896 case 0x38: /* Left ALT */ 1897 case 0xb8: /* Right ALT */ 1898 break; 1899 case 0xc8: 1900 kbd_put_keysym(QEMU_KEY_UP); 1901 break; 1902 case 0xd0: 1903 kbd_put_keysym(QEMU_KEY_DOWN); 1904 break; 1905 case 0xcb: 1906 kbd_put_keysym(QEMU_KEY_LEFT); 1907 break; 1908 case 0xcd: 1909 kbd_put_keysym(QEMU_KEY_RIGHT); 1910 break; 1911 case 0xd3: 1912 kbd_put_keysym(QEMU_KEY_DELETE); 1913 break; 1914 case 0xc7: 1915 kbd_put_keysym(QEMU_KEY_HOME); 1916 break; 1917 case 0xcf: 1918 kbd_put_keysym(QEMU_KEY_END); 1919 break; 1920 case 0xc9: 1921 kbd_put_keysym(QEMU_KEY_PAGEUP); 1922 break; 1923 case 0xd1: 1924 kbd_put_keysym(QEMU_KEY_PAGEDOWN); 1925 break; 1926 1927 case 0x47: 1928 kbd_put_keysym(numlock ? '7' : QEMU_KEY_HOME); 1929 break; 1930 case 0x48: 1931 kbd_put_keysym(numlock ? '8' : QEMU_KEY_UP); 1932 break; 1933 case 0x49: 1934 kbd_put_keysym(numlock ? '9' : QEMU_KEY_PAGEUP); 1935 break; 1936 case 0x4b: 1937 kbd_put_keysym(numlock ? '4' : QEMU_KEY_LEFT); 1938 break; 1939 case 0x4c: 1940 kbd_put_keysym('5'); 1941 break; 1942 case 0x4d: 1943 kbd_put_keysym(numlock ? '6' : QEMU_KEY_RIGHT); 1944 break; 1945 case 0x4f: 1946 kbd_put_keysym(numlock ? '1' : QEMU_KEY_END); 1947 break; 1948 case 0x50: 1949 kbd_put_keysym(numlock ? '2' : QEMU_KEY_DOWN); 1950 break; 1951 case 0x51: 1952 kbd_put_keysym(numlock ? '3' : QEMU_KEY_PAGEDOWN); 1953 break; 1954 case 0x52: 1955 kbd_put_keysym('0'); 1956 break; 1957 case 0x53: 1958 kbd_put_keysym(numlock ? '.' : QEMU_KEY_DELETE); 1959 break; 1960 1961 case 0xb5: 1962 kbd_put_keysym('/'); 1963 break; 1964 case 0x37: 1965 kbd_put_keysym('*'); 1966 break; 1967 case 0x4a: 1968 kbd_put_keysym('-'); 1969 break; 1970 case 0x4e: 1971 kbd_put_keysym('+'); 1972 break; 1973 case 0x9c: 1974 kbd_put_keysym('\n'); 1975 break; 1976 1977 default: 1978 if (control) { 1979 kbd_put_keysym(sym & 0x1f); 1980 } else { 1981 kbd_put_keysym(sym); 1982 } 1983 break; 1984 } 1985 } 1986 } 1987 } 1988 1989 static void vnc_release_modifiers(VncState *vs) 1990 { 1991 static const int keycodes[] = { 1992 /* shift, control, alt keys, both left & right */ 1993 0x2a, 0x36, 0x1d, 0x9d, 0x38, 0xb8, 1994 }; 1995 int i, keycode; 1996 1997 if (!qemu_console_is_graphic(NULL)) { 1998 return; 1999 } 2000 for (i = 0; i < ARRAY_SIZE(keycodes); i++) { 2001 keycode = keycodes[i]; 2002 if (!vs->modifiers_state[keycode]) { 2003 continue; 2004 } 2005 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, false); 2006 } 2007 } 2008 2009 static const char *code2name(int keycode) 2010 { 2011 return QKeyCode_lookup[qemu_input_key_number_to_qcode(keycode)]; 2012 } 2013 2014 static void key_event(VncState *vs, int down, uint32_t sym) 2015 { 2016 int keycode; 2017 int lsym = sym; 2018 2019 if (lsym >= 'A' && lsym <= 'Z' && qemu_console_is_graphic(NULL)) { 2020 lsym = lsym - 'A' + 'a'; 2021 } 2022 2023 keycode = keysym2scancode(vs->vd->kbd_layout, lsym & 0xFFFF) & SCANCODE_KEYMASK; 2024 trace_vnc_key_event_map(down, sym, keycode, code2name(keycode)); 2025 do_key_event(vs, down, keycode, sym); 2026 } 2027 2028 static void ext_key_event(VncState *vs, int down, 2029 uint32_t sym, uint16_t keycode) 2030 { 2031 /* if the user specifies a keyboard layout, always use it */ 2032 if (keyboard_layout) { 2033 key_event(vs, down, sym); 2034 } else { 2035 trace_vnc_key_event_ext(down, sym, keycode, code2name(keycode)); 2036 do_key_event(vs, down, keycode, sym); 2037 } 2038 } 2039 2040 static void framebuffer_update_request(VncState *vs, int incremental, 2041 int x, int y, int w, int h) 2042 { 2043 int width = pixman_image_get_width(vs->vd->server); 2044 int height = pixman_image_get_height(vs->vd->server); 2045 2046 vs->need_update = 1; 2047 2048 if (incremental) { 2049 return; 2050 } 2051 2052 vs->force_update = 1; 2053 vnc_set_area_dirty(vs->dirty, width, height, x, y, w, h); 2054 } 2055 2056 static void send_ext_key_event_ack(VncState *vs) 2057 { 2058 vnc_lock_output(vs); 2059 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 2060 vnc_write_u8(vs, 0); 2061 vnc_write_u16(vs, 1); 2062 vnc_framebuffer_update(vs, 0, 0, 2063 pixman_image_get_width(vs->vd->server), 2064 pixman_image_get_height(vs->vd->server), 2065 VNC_ENCODING_EXT_KEY_EVENT); 2066 vnc_unlock_output(vs); 2067 vnc_flush(vs); 2068 } 2069 2070 static void send_ext_audio_ack(VncState *vs) 2071 { 2072 vnc_lock_output(vs); 2073 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 2074 vnc_write_u8(vs, 0); 2075 vnc_write_u16(vs, 1); 2076 vnc_framebuffer_update(vs, 0, 0, 2077 pixman_image_get_width(vs->vd->server), 2078 pixman_image_get_height(vs->vd->server), 2079 VNC_ENCODING_AUDIO); 2080 vnc_unlock_output(vs); 2081 vnc_flush(vs); 2082 } 2083 2084 static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings) 2085 { 2086 int i; 2087 unsigned int enc = 0; 2088 2089 vs->features = 0; 2090 vs->vnc_encoding = 0; 2091 vs->tight.compression = 9; 2092 vs->tight.quality = -1; /* Lossless by default */ 2093 vs->absolute = -1; 2094 2095 /* 2096 * Start from the end because the encodings are sent in order of preference. 2097 * This way the preferred encoding (first encoding defined in the array) 2098 * will be set at the end of the loop. 2099 */ 2100 for (i = n_encodings - 1; i >= 0; i--) { 2101 enc = encodings[i]; 2102 switch (enc) { 2103 case VNC_ENCODING_RAW: 2104 vs->vnc_encoding = enc; 2105 break; 2106 case VNC_ENCODING_COPYRECT: 2107 vs->features |= VNC_FEATURE_COPYRECT_MASK; 2108 break; 2109 case VNC_ENCODING_HEXTILE: 2110 vs->features |= VNC_FEATURE_HEXTILE_MASK; 2111 vs->vnc_encoding = enc; 2112 break; 2113 case VNC_ENCODING_TIGHT: 2114 vs->features |= VNC_FEATURE_TIGHT_MASK; 2115 vs->vnc_encoding = enc; 2116 break; 2117 #ifdef CONFIG_VNC_PNG 2118 case VNC_ENCODING_TIGHT_PNG: 2119 vs->features |= VNC_FEATURE_TIGHT_PNG_MASK; 2120 vs->vnc_encoding = enc; 2121 break; 2122 #endif 2123 case VNC_ENCODING_ZLIB: 2124 vs->features |= VNC_FEATURE_ZLIB_MASK; 2125 vs->vnc_encoding = enc; 2126 break; 2127 case VNC_ENCODING_ZRLE: 2128 vs->features |= VNC_FEATURE_ZRLE_MASK; 2129 vs->vnc_encoding = enc; 2130 break; 2131 case VNC_ENCODING_ZYWRLE: 2132 vs->features |= VNC_FEATURE_ZYWRLE_MASK; 2133 vs->vnc_encoding = enc; 2134 break; 2135 case VNC_ENCODING_DESKTOPRESIZE: 2136 vs->features |= VNC_FEATURE_RESIZE_MASK; 2137 break; 2138 case VNC_ENCODING_POINTER_TYPE_CHANGE: 2139 vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK; 2140 break; 2141 case VNC_ENCODING_RICH_CURSOR: 2142 vs->features |= VNC_FEATURE_RICH_CURSOR_MASK; 2143 break; 2144 case VNC_ENCODING_EXT_KEY_EVENT: 2145 send_ext_key_event_ack(vs); 2146 break; 2147 case VNC_ENCODING_AUDIO: 2148 send_ext_audio_ack(vs); 2149 break; 2150 case VNC_ENCODING_WMVi: 2151 vs->features |= VNC_FEATURE_WMVI_MASK; 2152 break; 2153 case VNC_ENCODING_LED_STATE: 2154 vs->features |= VNC_FEATURE_LED_STATE_MASK; 2155 break; 2156 case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9: 2157 vs->tight.compression = (enc & 0x0F); 2158 break; 2159 case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9: 2160 if (vs->vd->lossy) { 2161 vs->tight.quality = (enc & 0x0F); 2162 } 2163 break; 2164 default: 2165 VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc); 2166 break; 2167 } 2168 } 2169 vnc_desktop_resize(vs); 2170 check_pointer_type_change(&vs->mouse_mode_notifier, NULL); 2171 vnc_led_state_change(vs); 2172 } 2173 2174 static void set_pixel_conversion(VncState *vs) 2175 { 2176 pixman_format_code_t fmt = qemu_pixman_get_format(&vs->client_pf); 2177 2178 if (fmt == VNC_SERVER_FB_FORMAT) { 2179 vs->write_pixels = vnc_write_pixels_copy; 2180 vnc_hextile_set_pixel_conversion(vs, 0); 2181 } else { 2182 vs->write_pixels = vnc_write_pixels_generic; 2183 vnc_hextile_set_pixel_conversion(vs, 1); 2184 } 2185 } 2186 2187 static void set_pixel_format(VncState *vs, 2188 int bits_per_pixel, int depth, 2189 int big_endian_flag, int true_color_flag, 2190 int red_max, int green_max, int blue_max, 2191 int red_shift, int green_shift, int blue_shift) 2192 { 2193 if (!true_color_flag) { 2194 vnc_client_error(vs); 2195 return; 2196 } 2197 2198 switch (bits_per_pixel) { 2199 case 8: 2200 case 16: 2201 case 32: 2202 break; 2203 default: 2204 vnc_client_error(vs); 2205 return; 2206 } 2207 2208 vs->client_pf.rmax = red_max; 2209 vs->client_pf.rbits = hweight_long(red_max); 2210 vs->client_pf.rshift = red_shift; 2211 vs->client_pf.rmask = red_max << red_shift; 2212 vs->client_pf.gmax = green_max; 2213 vs->client_pf.gbits = hweight_long(green_max); 2214 vs->client_pf.gshift = green_shift; 2215 vs->client_pf.gmask = green_max << green_shift; 2216 vs->client_pf.bmax = blue_max; 2217 vs->client_pf.bbits = hweight_long(blue_max); 2218 vs->client_pf.bshift = blue_shift; 2219 vs->client_pf.bmask = blue_max << blue_shift; 2220 vs->client_pf.bits_per_pixel = bits_per_pixel; 2221 vs->client_pf.bytes_per_pixel = bits_per_pixel / 8; 2222 vs->client_pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel; 2223 vs->client_be = big_endian_flag; 2224 2225 set_pixel_conversion(vs); 2226 2227 graphic_hw_invalidate(vs->vd->dcl.con); 2228 graphic_hw_update(vs->vd->dcl.con); 2229 } 2230 2231 static void pixel_format_message (VncState *vs) { 2232 char pad[3] = { 0, 0, 0 }; 2233 2234 vs->client_pf = qemu_default_pixelformat(32); 2235 2236 vnc_write_u8(vs, vs->client_pf.bits_per_pixel); /* bits-per-pixel */ 2237 vnc_write_u8(vs, vs->client_pf.depth); /* depth */ 2238 2239 #ifdef HOST_WORDS_BIGENDIAN 2240 vnc_write_u8(vs, 1); /* big-endian-flag */ 2241 #else 2242 vnc_write_u8(vs, 0); /* big-endian-flag */ 2243 #endif 2244 vnc_write_u8(vs, 1); /* true-color-flag */ 2245 vnc_write_u16(vs, vs->client_pf.rmax); /* red-max */ 2246 vnc_write_u16(vs, vs->client_pf.gmax); /* green-max */ 2247 vnc_write_u16(vs, vs->client_pf.bmax); /* blue-max */ 2248 vnc_write_u8(vs, vs->client_pf.rshift); /* red-shift */ 2249 vnc_write_u8(vs, vs->client_pf.gshift); /* green-shift */ 2250 vnc_write_u8(vs, vs->client_pf.bshift); /* blue-shift */ 2251 vnc_write(vs, pad, 3); /* padding */ 2252 2253 vnc_hextile_set_pixel_conversion(vs, 0); 2254 vs->write_pixels = vnc_write_pixels_copy; 2255 } 2256 2257 static void vnc_colordepth(VncState *vs) 2258 { 2259 if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) { 2260 /* Sending a WMVi message to notify the client*/ 2261 vnc_lock_output(vs); 2262 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 2263 vnc_write_u8(vs, 0); 2264 vnc_write_u16(vs, 1); /* number of rects */ 2265 vnc_framebuffer_update(vs, 0, 0, 2266 pixman_image_get_width(vs->vd->server), 2267 pixman_image_get_height(vs->vd->server), 2268 VNC_ENCODING_WMVi); 2269 pixel_format_message(vs); 2270 vnc_unlock_output(vs); 2271 vnc_flush(vs); 2272 } else { 2273 set_pixel_conversion(vs); 2274 } 2275 } 2276 2277 static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len) 2278 { 2279 int i; 2280 uint16_t limit; 2281 VncDisplay *vd = vs->vd; 2282 2283 if (data[0] > 3) { 2284 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE); 2285 } 2286 2287 switch (data[0]) { 2288 case VNC_MSG_CLIENT_SET_PIXEL_FORMAT: 2289 if (len == 1) 2290 return 20; 2291 2292 set_pixel_format(vs, read_u8(data, 4), read_u8(data, 5), 2293 read_u8(data, 6), read_u8(data, 7), 2294 read_u16(data, 8), read_u16(data, 10), 2295 read_u16(data, 12), read_u8(data, 14), 2296 read_u8(data, 15), read_u8(data, 16)); 2297 break; 2298 case VNC_MSG_CLIENT_SET_ENCODINGS: 2299 if (len == 1) 2300 return 4; 2301 2302 if (len == 4) { 2303 limit = read_u16(data, 2); 2304 if (limit > 0) 2305 return 4 + (limit * 4); 2306 } else 2307 limit = read_u16(data, 2); 2308 2309 for (i = 0; i < limit; i++) { 2310 int32_t val = read_s32(data, 4 + (i * 4)); 2311 memcpy(data + 4 + (i * 4), &val, sizeof(val)); 2312 } 2313 2314 set_encodings(vs, (int32_t *)(data + 4), limit); 2315 break; 2316 case VNC_MSG_CLIENT_FRAMEBUFFER_UPDATE_REQUEST: 2317 if (len == 1) 2318 return 10; 2319 2320 framebuffer_update_request(vs, 2321 read_u8(data, 1), read_u16(data, 2), read_u16(data, 4), 2322 read_u16(data, 6), read_u16(data, 8)); 2323 break; 2324 case VNC_MSG_CLIENT_KEY_EVENT: 2325 if (len == 1) 2326 return 8; 2327 2328 key_event(vs, read_u8(data, 1), read_u32(data, 4)); 2329 break; 2330 case VNC_MSG_CLIENT_POINTER_EVENT: 2331 if (len == 1) 2332 return 6; 2333 2334 pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4)); 2335 break; 2336 case VNC_MSG_CLIENT_CUT_TEXT: 2337 if (len == 1) { 2338 return 8; 2339 } 2340 if (len == 8) { 2341 uint32_t dlen = read_u32(data, 4); 2342 if (dlen > (1 << 20)) { 2343 error_report("vnc: client_cut_text msg payload has %u bytes" 2344 " which exceeds our limit of 1MB.", dlen); 2345 vnc_client_error(vs); 2346 break; 2347 } 2348 if (dlen > 0) { 2349 return 8 + dlen; 2350 } 2351 } 2352 2353 client_cut_text(vs, read_u32(data, 4), data + 8); 2354 break; 2355 case VNC_MSG_CLIENT_QEMU: 2356 if (len == 1) 2357 return 2; 2358 2359 switch (read_u8(data, 1)) { 2360 case VNC_MSG_CLIENT_QEMU_EXT_KEY_EVENT: 2361 if (len == 2) 2362 return 12; 2363 2364 ext_key_event(vs, read_u16(data, 2), 2365 read_u32(data, 4), read_u32(data, 8)); 2366 break; 2367 case VNC_MSG_CLIENT_QEMU_AUDIO: 2368 if (len == 2) 2369 return 4; 2370 2371 switch (read_u16 (data, 2)) { 2372 case VNC_MSG_CLIENT_QEMU_AUDIO_ENABLE: 2373 audio_add(vs); 2374 break; 2375 case VNC_MSG_CLIENT_QEMU_AUDIO_DISABLE: 2376 audio_del(vs); 2377 break; 2378 case VNC_MSG_CLIENT_QEMU_AUDIO_SET_FORMAT: 2379 if (len == 4) 2380 return 10; 2381 switch (read_u8(data, 4)) { 2382 case 0: vs->as.fmt = AUD_FMT_U8; break; 2383 case 1: vs->as.fmt = AUD_FMT_S8; break; 2384 case 2: vs->as.fmt = AUD_FMT_U16; break; 2385 case 3: vs->as.fmt = AUD_FMT_S16; break; 2386 case 4: vs->as.fmt = AUD_FMT_U32; break; 2387 case 5: vs->as.fmt = AUD_FMT_S32; break; 2388 default: 2389 VNC_DEBUG("Invalid audio format %d\n", read_u8(data, 4)); 2390 vnc_client_error(vs); 2391 break; 2392 } 2393 vs->as.nchannels = read_u8(data, 5); 2394 if (vs->as.nchannels != 1 && vs->as.nchannels != 2) { 2395 VNC_DEBUG("Invalid audio channel coount %d\n", 2396 read_u8(data, 5)); 2397 vnc_client_error(vs); 2398 break; 2399 } 2400 vs->as.freq = read_u32(data, 6); 2401 break; 2402 default: 2403 VNC_DEBUG("Invalid audio message %d\n", read_u8(data, 4)); 2404 vnc_client_error(vs); 2405 break; 2406 } 2407 break; 2408 2409 default: 2410 VNC_DEBUG("Msg: %d\n", read_u16(data, 0)); 2411 vnc_client_error(vs); 2412 break; 2413 } 2414 break; 2415 default: 2416 VNC_DEBUG("Msg: %d\n", data[0]); 2417 vnc_client_error(vs); 2418 break; 2419 } 2420 2421 vnc_read_when(vs, protocol_client_msg, 1); 2422 return 0; 2423 } 2424 2425 static int protocol_client_init(VncState *vs, uint8_t *data, size_t len) 2426 { 2427 char buf[1024]; 2428 VncShareMode mode; 2429 int size; 2430 2431 mode = data[0] ? VNC_SHARE_MODE_SHARED : VNC_SHARE_MODE_EXCLUSIVE; 2432 switch (vs->vd->share_policy) { 2433 case VNC_SHARE_POLICY_IGNORE: 2434 /* 2435 * Ignore the shared flag. Nothing to do here. 2436 * 2437 * Doesn't conform to the rfb spec but is traditional qemu 2438 * behavior, thus left here as option for compatibility 2439 * reasons. 2440 */ 2441 break; 2442 case VNC_SHARE_POLICY_ALLOW_EXCLUSIVE: 2443 /* 2444 * Policy: Allow clients ask for exclusive access. 2445 * 2446 * Implementation: When a client asks for exclusive access, 2447 * disconnect all others. Shared connects are allowed as long 2448 * as no exclusive connection exists. 2449 * 2450 * This is how the rfb spec suggests to handle the shared flag. 2451 */ 2452 if (mode == VNC_SHARE_MODE_EXCLUSIVE) { 2453 VncState *client; 2454 QTAILQ_FOREACH(client, &vs->vd->clients, next) { 2455 if (vs == client) { 2456 continue; 2457 } 2458 if (client->share_mode != VNC_SHARE_MODE_EXCLUSIVE && 2459 client->share_mode != VNC_SHARE_MODE_SHARED) { 2460 continue; 2461 } 2462 vnc_disconnect_start(client); 2463 } 2464 } 2465 if (mode == VNC_SHARE_MODE_SHARED) { 2466 if (vs->vd->num_exclusive > 0) { 2467 vnc_disconnect_start(vs); 2468 return 0; 2469 } 2470 } 2471 break; 2472 case VNC_SHARE_POLICY_FORCE_SHARED: 2473 /* 2474 * Policy: Shared connects only. 2475 * Implementation: Disallow clients asking for exclusive access. 2476 * 2477 * Useful for shared desktop sessions where you don't want 2478 * someone forgetting to say -shared when running the vnc 2479 * client disconnect everybody else. 2480 */ 2481 if (mode == VNC_SHARE_MODE_EXCLUSIVE) { 2482 vnc_disconnect_start(vs); 2483 return 0; 2484 } 2485 break; 2486 } 2487 vnc_set_share_mode(vs, mode); 2488 2489 if (vs->vd->num_shared > vs->vd->connections_limit) { 2490 vnc_disconnect_start(vs); 2491 return 0; 2492 } 2493 2494 vs->client_width = pixman_image_get_width(vs->vd->server); 2495 vs->client_height = pixman_image_get_height(vs->vd->server); 2496 vnc_write_u16(vs, vs->client_width); 2497 vnc_write_u16(vs, vs->client_height); 2498 2499 pixel_format_message(vs); 2500 2501 if (qemu_name) 2502 size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name); 2503 else 2504 size = snprintf(buf, sizeof(buf), "QEMU"); 2505 2506 vnc_write_u32(vs, size); 2507 vnc_write(vs, buf, size); 2508 vnc_flush(vs); 2509 2510 vnc_client_cache_auth(vs); 2511 vnc_qmp_event(vs, QAPI_EVENT_VNC_INITIALIZED); 2512 2513 vnc_read_when(vs, protocol_client_msg, 1); 2514 2515 return 0; 2516 } 2517 2518 void start_client_init(VncState *vs) 2519 { 2520 vnc_read_when(vs, protocol_client_init, 1); 2521 } 2522 2523 static void make_challenge(VncState *vs) 2524 { 2525 int i; 2526 2527 srand(time(NULL)+getpid()+getpid()*987654+rand()); 2528 2529 for (i = 0 ; i < sizeof(vs->challenge) ; i++) 2530 vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0)); 2531 } 2532 2533 static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len) 2534 { 2535 unsigned char response[VNC_AUTH_CHALLENGE_SIZE]; 2536 int i, j, pwlen; 2537 unsigned char key[8]; 2538 time_t now = time(NULL); 2539 2540 if (!vs->vd->password) { 2541 VNC_DEBUG("No password configured on server"); 2542 goto reject; 2543 } 2544 if (vs->vd->expires < now) { 2545 VNC_DEBUG("Password is expired"); 2546 goto reject; 2547 } 2548 2549 memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE); 2550 2551 /* Calculate the expected challenge response */ 2552 pwlen = strlen(vs->vd->password); 2553 for (i=0; i<sizeof(key); i++) 2554 key[i] = i<pwlen ? vs->vd->password[i] : 0; 2555 deskey(key, EN0); 2556 for (j = 0; j < VNC_AUTH_CHALLENGE_SIZE; j += 8) 2557 des(response+j, response+j); 2558 2559 /* Compare expected vs actual challenge response */ 2560 if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) { 2561 VNC_DEBUG("Client challenge response did not match\n"); 2562 goto reject; 2563 } else { 2564 VNC_DEBUG("Accepting VNC challenge response\n"); 2565 vnc_write_u32(vs, 0); /* Accept auth */ 2566 vnc_flush(vs); 2567 2568 start_client_init(vs); 2569 } 2570 return 0; 2571 2572 reject: 2573 vnc_write_u32(vs, 1); /* Reject auth */ 2574 if (vs->minor >= 8) { 2575 static const char err[] = "Authentication failed"; 2576 vnc_write_u32(vs, sizeof(err)); 2577 vnc_write(vs, err, sizeof(err)); 2578 } 2579 vnc_flush(vs); 2580 vnc_client_error(vs); 2581 return 0; 2582 } 2583 2584 void start_auth_vnc(VncState *vs) 2585 { 2586 make_challenge(vs); 2587 /* Send client a 'random' challenge */ 2588 vnc_write(vs, vs->challenge, sizeof(vs->challenge)); 2589 vnc_flush(vs); 2590 2591 vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge)); 2592 } 2593 2594 2595 static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len) 2596 { 2597 /* We only advertise 1 auth scheme at a time, so client 2598 * must pick the one we sent. Verify this */ 2599 if (data[0] != vs->auth) { /* Reject auth */ 2600 VNC_DEBUG("Reject auth %d because it didn't match advertized\n", (int)data[0]); 2601 vnc_write_u32(vs, 1); 2602 if (vs->minor >= 8) { 2603 static const char err[] = "Authentication failed"; 2604 vnc_write_u32(vs, sizeof(err)); 2605 vnc_write(vs, err, sizeof(err)); 2606 } 2607 vnc_client_error(vs); 2608 } else { /* Accept requested auth */ 2609 VNC_DEBUG("Client requested auth %d\n", (int)data[0]); 2610 switch (vs->auth) { 2611 case VNC_AUTH_NONE: 2612 VNC_DEBUG("Accept auth none\n"); 2613 if (vs->minor >= 8) { 2614 vnc_write_u32(vs, 0); /* Accept auth completion */ 2615 vnc_flush(vs); 2616 } 2617 start_client_init(vs); 2618 break; 2619 2620 case VNC_AUTH_VNC: 2621 VNC_DEBUG("Start VNC auth\n"); 2622 start_auth_vnc(vs); 2623 break; 2624 2625 #ifdef CONFIG_VNC_TLS 2626 case VNC_AUTH_VENCRYPT: 2627 VNC_DEBUG("Accept VeNCrypt auth\n"); 2628 start_auth_vencrypt(vs); 2629 break; 2630 #endif /* CONFIG_VNC_TLS */ 2631 2632 #ifdef CONFIG_VNC_SASL 2633 case VNC_AUTH_SASL: 2634 VNC_DEBUG("Accept SASL auth\n"); 2635 start_auth_sasl(vs); 2636 break; 2637 #endif /* CONFIG_VNC_SASL */ 2638 2639 default: /* Should not be possible, but just in case */ 2640 VNC_DEBUG("Reject auth %d server code bug\n", vs->auth); 2641 vnc_write_u8(vs, 1); 2642 if (vs->minor >= 8) { 2643 static const char err[] = "Authentication failed"; 2644 vnc_write_u32(vs, sizeof(err)); 2645 vnc_write(vs, err, sizeof(err)); 2646 } 2647 vnc_client_error(vs); 2648 } 2649 } 2650 return 0; 2651 } 2652 2653 static int protocol_version(VncState *vs, uint8_t *version, size_t len) 2654 { 2655 char local[13]; 2656 2657 memcpy(local, version, 12); 2658 local[12] = 0; 2659 2660 if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) { 2661 VNC_DEBUG("Malformed protocol version %s\n", local); 2662 vnc_client_error(vs); 2663 return 0; 2664 } 2665 VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor); 2666 if (vs->major != 3 || 2667 (vs->minor != 3 && 2668 vs->minor != 4 && 2669 vs->minor != 5 && 2670 vs->minor != 7 && 2671 vs->minor != 8)) { 2672 VNC_DEBUG("Unsupported client version\n"); 2673 vnc_write_u32(vs, VNC_AUTH_INVALID); 2674 vnc_flush(vs); 2675 vnc_client_error(vs); 2676 return 0; 2677 } 2678 /* Some broken clients report v3.4 or v3.5, which spec requires to be treated 2679 * as equivalent to v3.3 by servers 2680 */ 2681 if (vs->minor == 4 || vs->minor == 5) 2682 vs->minor = 3; 2683 2684 if (vs->minor == 3) { 2685 if (vs->auth == VNC_AUTH_NONE) { 2686 VNC_DEBUG("Tell client auth none\n"); 2687 vnc_write_u32(vs, vs->auth); 2688 vnc_flush(vs); 2689 start_client_init(vs); 2690 } else if (vs->auth == VNC_AUTH_VNC) { 2691 VNC_DEBUG("Tell client VNC auth\n"); 2692 vnc_write_u32(vs, vs->auth); 2693 vnc_flush(vs); 2694 start_auth_vnc(vs); 2695 } else { 2696 VNC_DEBUG("Unsupported auth %d for protocol 3.3\n", vs->auth); 2697 vnc_write_u32(vs, VNC_AUTH_INVALID); 2698 vnc_flush(vs); 2699 vnc_client_error(vs); 2700 } 2701 } else { 2702 VNC_DEBUG("Telling client we support auth %d\n", vs->auth); 2703 vnc_write_u8(vs, 1); /* num auth */ 2704 vnc_write_u8(vs, vs->auth); 2705 vnc_read_when(vs, protocol_client_auth, 1); 2706 vnc_flush(vs); 2707 } 2708 2709 return 0; 2710 } 2711 2712 static VncRectStat *vnc_stat_rect(VncDisplay *vd, int x, int y) 2713 { 2714 struct VncSurface *vs = &vd->guest; 2715 2716 return &vs->stats[y / VNC_STAT_RECT][x / VNC_STAT_RECT]; 2717 } 2718 2719 void vnc_sent_lossy_rect(VncState *vs, int x, int y, int w, int h) 2720 { 2721 int i, j; 2722 2723 w = (x + w) / VNC_STAT_RECT; 2724 h = (y + h) / VNC_STAT_RECT; 2725 x /= VNC_STAT_RECT; 2726 y /= VNC_STAT_RECT; 2727 2728 for (j = y; j <= h; j++) { 2729 for (i = x; i <= w; i++) { 2730 vs->lossy_rect[j][i] = 1; 2731 } 2732 } 2733 } 2734 2735 static int vnc_refresh_lossy_rect(VncDisplay *vd, int x, int y) 2736 { 2737 VncState *vs; 2738 int sty = y / VNC_STAT_RECT; 2739 int stx = x / VNC_STAT_RECT; 2740 int has_dirty = 0; 2741 2742 y = y / VNC_STAT_RECT * VNC_STAT_RECT; 2743 x = x / VNC_STAT_RECT * VNC_STAT_RECT; 2744 2745 QTAILQ_FOREACH(vs, &vd->clients, next) { 2746 int j; 2747 2748 /* kernel send buffers are full -> refresh later */ 2749 if (vs->output.offset) { 2750 continue; 2751 } 2752 2753 if (!vs->lossy_rect[sty][stx]) { 2754 continue; 2755 } 2756 2757 vs->lossy_rect[sty][stx] = 0; 2758 for (j = 0; j < VNC_STAT_RECT; ++j) { 2759 bitmap_set(vs->dirty[y + j], 2760 x / VNC_DIRTY_PIXELS_PER_BIT, 2761 VNC_STAT_RECT / VNC_DIRTY_PIXELS_PER_BIT); 2762 } 2763 has_dirty++; 2764 } 2765 2766 return has_dirty; 2767 } 2768 2769 static int vnc_update_stats(VncDisplay *vd, struct timeval * tv) 2770 { 2771 int width = pixman_image_get_width(vd->guest.fb); 2772 int height = pixman_image_get_height(vd->guest.fb); 2773 int x, y; 2774 struct timeval res; 2775 int has_dirty = 0; 2776 2777 for (y = 0; y < height; y += VNC_STAT_RECT) { 2778 for (x = 0; x < width; x += VNC_STAT_RECT) { 2779 VncRectStat *rect = vnc_stat_rect(vd, x, y); 2780 2781 rect->updated = false; 2782 } 2783 } 2784 2785 qemu_timersub(tv, &VNC_REFRESH_STATS, &res); 2786 2787 if (timercmp(&vd->guest.last_freq_check, &res, >)) { 2788 return has_dirty; 2789 } 2790 vd->guest.last_freq_check = *tv; 2791 2792 for (y = 0; y < height; y += VNC_STAT_RECT) { 2793 for (x = 0; x < width; x += VNC_STAT_RECT) { 2794 VncRectStat *rect= vnc_stat_rect(vd, x, y); 2795 int count = ARRAY_SIZE(rect->times); 2796 struct timeval min, max; 2797 2798 if (!timerisset(&rect->times[count - 1])) { 2799 continue ; 2800 } 2801 2802 max = rect->times[(rect->idx + count - 1) % count]; 2803 qemu_timersub(tv, &max, &res); 2804 2805 if (timercmp(&res, &VNC_REFRESH_LOSSY, >)) { 2806 rect->freq = 0; 2807 has_dirty += vnc_refresh_lossy_rect(vd, x, y); 2808 memset(rect->times, 0, sizeof (rect->times)); 2809 continue ; 2810 } 2811 2812 min = rect->times[rect->idx]; 2813 max = rect->times[(rect->idx + count - 1) % count]; 2814 qemu_timersub(&max, &min, &res); 2815 2816 rect->freq = res.tv_sec + res.tv_usec / 1000000.; 2817 rect->freq /= count; 2818 rect->freq = 1. / rect->freq; 2819 } 2820 } 2821 return has_dirty; 2822 } 2823 2824 double vnc_update_freq(VncState *vs, int x, int y, int w, int h) 2825 { 2826 int i, j; 2827 double total = 0; 2828 int num = 0; 2829 2830 x = (x / VNC_STAT_RECT) * VNC_STAT_RECT; 2831 y = (y / VNC_STAT_RECT) * VNC_STAT_RECT; 2832 2833 for (j = y; j <= y + h; j += VNC_STAT_RECT) { 2834 for (i = x; i <= x + w; i += VNC_STAT_RECT) { 2835 total += vnc_stat_rect(vs->vd, i, j)->freq; 2836 num++; 2837 } 2838 } 2839 2840 if (num) { 2841 return total / num; 2842 } else { 2843 return 0; 2844 } 2845 } 2846 2847 static void vnc_rect_updated(VncDisplay *vd, int x, int y, struct timeval * tv) 2848 { 2849 VncRectStat *rect; 2850 2851 rect = vnc_stat_rect(vd, x, y); 2852 if (rect->updated) { 2853 return ; 2854 } 2855 rect->times[rect->idx] = *tv; 2856 rect->idx = (rect->idx + 1) % ARRAY_SIZE(rect->times); 2857 rect->updated = true; 2858 } 2859 2860 static int vnc_refresh_server_surface(VncDisplay *vd) 2861 { 2862 int width = MIN(pixman_image_get_width(vd->guest.fb), 2863 pixman_image_get_width(vd->server)); 2864 int height = MIN(pixman_image_get_height(vd->guest.fb), 2865 pixman_image_get_height(vd->server)); 2866 int cmp_bytes, server_stride, min_stride, guest_stride, y = 0; 2867 uint8_t *guest_row0 = NULL, *server_row0; 2868 VncState *vs; 2869 int has_dirty = 0; 2870 pixman_image_t *tmpbuf = NULL; 2871 2872 struct timeval tv = { 0, 0 }; 2873 2874 if (!vd->non_adaptive) { 2875 gettimeofday(&tv, NULL); 2876 has_dirty = vnc_update_stats(vd, &tv); 2877 } 2878 2879 /* 2880 * Walk through the guest dirty map. 2881 * Check and copy modified bits from guest to server surface. 2882 * Update server dirty map. 2883 */ 2884 server_row0 = (uint8_t *)pixman_image_get_data(vd->server); 2885 server_stride = guest_stride = pixman_image_get_stride(vd->server); 2886 cmp_bytes = MIN(VNC_DIRTY_PIXELS_PER_BIT * VNC_SERVER_FB_BYTES, 2887 server_stride); 2888 if (vd->guest.format != VNC_SERVER_FB_FORMAT) { 2889 int width = pixman_image_get_width(vd->server); 2890 tmpbuf = qemu_pixman_linebuf_create(VNC_SERVER_FB_FORMAT, width); 2891 } else { 2892 guest_row0 = (uint8_t *)pixman_image_get_data(vd->guest.fb); 2893 guest_stride = pixman_image_get_stride(vd->guest.fb); 2894 } 2895 min_stride = MIN(server_stride, guest_stride); 2896 2897 for (;;) { 2898 int x; 2899 uint8_t *guest_ptr, *server_ptr; 2900 unsigned long offset = find_next_bit((unsigned long *) &vd->guest.dirty, 2901 height * VNC_DIRTY_BPL(&vd->guest), 2902 y * VNC_DIRTY_BPL(&vd->guest)); 2903 if (offset == height * VNC_DIRTY_BPL(&vd->guest)) { 2904 /* no more dirty bits */ 2905 break; 2906 } 2907 y = offset / VNC_DIRTY_BPL(&vd->guest); 2908 x = offset % VNC_DIRTY_BPL(&vd->guest); 2909 2910 server_ptr = server_row0 + y * server_stride + x * cmp_bytes; 2911 2912 if (vd->guest.format != VNC_SERVER_FB_FORMAT) { 2913 qemu_pixman_linebuf_fill(tmpbuf, vd->guest.fb, width, 0, y); 2914 guest_ptr = (uint8_t *)pixman_image_get_data(tmpbuf); 2915 } else { 2916 guest_ptr = guest_row0 + y * guest_stride; 2917 } 2918 guest_ptr += x * cmp_bytes; 2919 2920 for (; x < DIV_ROUND_UP(width, VNC_DIRTY_PIXELS_PER_BIT); 2921 x++, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) { 2922 int _cmp_bytes = cmp_bytes; 2923 if (!test_and_clear_bit(x, vd->guest.dirty[y])) { 2924 continue; 2925 } 2926 if ((x + 1) * cmp_bytes > min_stride) { 2927 _cmp_bytes = min_stride - x * cmp_bytes; 2928 } 2929 if (memcmp(server_ptr, guest_ptr, _cmp_bytes) == 0) { 2930 continue; 2931 } 2932 memcpy(server_ptr, guest_ptr, _cmp_bytes); 2933 if (!vd->non_adaptive) { 2934 vnc_rect_updated(vd, x * VNC_DIRTY_PIXELS_PER_BIT, 2935 y, &tv); 2936 } 2937 QTAILQ_FOREACH(vs, &vd->clients, next) { 2938 set_bit(x, vs->dirty[y]); 2939 } 2940 has_dirty++; 2941 } 2942 2943 y++; 2944 } 2945 qemu_pixman_image_unref(tmpbuf); 2946 return has_dirty; 2947 } 2948 2949 static void vnc_refresh(DisplayChangeListener *dcl) 2950 { 2951 VncDisplay *vd = container_of(dcl, VncDisplay, dcl); 2952 VncState *vs, *vn; 2953 int has_dirty, rects = 0; 2954 2955 if (QTAILQ_EMPTY(&vd->clients)) { 2956 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_MAX); 2957 return; 2958 } 2959 2960 graphic_hw_update(vd->dcl.con); 2961 2962 if (vnc_trylock_display(vd)) { 2963 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE); 2964 return; 2965 } 2966 2967 has_dirty = vnc_refresh_server_surface(vd); 2968 vnc_unlock_display(vd); 2969 2970 QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) { 2971 rects += vnc_update_client(vs, has_dirty, false); 2972 /* vs might be free()ed here */ 2973 } 2974 2975 if (has_dirty && rects) { 2976 vd->dcl.update_interval /= 2; 2977 if (vd->dcl.update_interval < VNC_REFRESH_INTERVAL_BASE) { 2978 vd->dcl.update_interval = VNC_REFRESH_INTERVAL_BASE; 2979 } 2980 } else { 2981 vd->dcl.update_interval += VNC_REFRESH_INTERVAL_INC; 2982 if (vd->dcl.update_interval > VNC_REFRESH_INTERVAL_MAX) { 2983 vd->dcl.update_interval = VNC_REFRESH_INTERVAL_MAX; 2984 } 2985 } 2986 } 2987 2988 static void vnc_connect(VncDisplay *vd, int csock, 2989 bool skipauth, bool websocket) 2990 { 2991 VncState *vs = g_malloc0(sizeof(VncState)); 2992 int i; 2993 2994 vs->csock = csock; 2995 vs->vd = vd; 2996 2997 if (skipauth) { 2998 vs->auth = VNC_AUTH_NONE; 2999 vs->subauth = VNC_AUTH_INVALID; 3000 } else { 3001 if (websocket) { 3002 vs->auth = vd->ws_auth; 3003 vs->subauth = VNC_AUTH_INVALID; 3004 } else { 3005 vs->auth = vd->auth; 3006 vs->subauth = vd->subauth; 3007 } 3008 } 3009 VNC_DEBUG("Client sock=%d ws=%d auth=%d subauth=%d\n", 3010 csock, websocket, vs->auth, vs->subauth); 3011 3012 vs->lossy_rect = g_malloc0(VNC_STAT_ROWS * sizeof (*vs->lossy_rect)); 3013 for (i = 0; i < VNC_STAT_ROWS; ++i) { 3014 vs->lossy_rect[i] = g_malloc0(VNC_STAT_COLS * sizeof (uint8_t)); 3015 } 3016 3017 VNC_DEBUG("New client on socket %d\n", csock); 3018 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE); 3019 qemu_set_nonblock(vs->csock); 3020 #ifdef CONFIG_VNC_WS 3021 if (websocket) { 3022 vs->websocket = 1; 3023 #ifdef CONFIG_VNC_TLS 3024 if (vd->ws_tls) { 3025 qemu_set_fd_handler(vs->csock, vncws_tls_handshake_io, NULL, vs); 3026 } else 3027 #endif /* CONFIG_VNC_TLS */ 3028 { 3029 qemu_set_fd_handler(vs->csock, vncws_handshake_read, NULL, vs); 3030 } 3031 } else 3032 #endif /* CONFIG_VNC_WS */ 3033 { 3034 qemu_set_fd_handler(vs->csock, vnc_client_read, NULL, vs); 3035 } 3036 3037 vnc_client_cache_addr(vs); 3038 vnc_qmp_event(vs, QAPI_EVENT_VNC_CONNECTED); 3039 vnc_set_share_mode(vs, VNC_SHARE_MODE_CONNECTING); 3040 3041 #ifdef CONFIG_VNC_WS 3042 if (!vs->websocket) 3043 #endif 3044 { 3045 vnc_init_state(vs); 3046 } 3047 3048 if (vd->num_connecting > vd->connections_limit) { 3049 QTAILQ_FOREACH(vs, &vd->clients, next) { 3050 if (vs->share_mode == VNC_SHARE_MODE_CONNECTING) { 3051 vnc_disconnect_start(vs); 3052 return; 3053 } 3054 } 3055 } 3056 } 3057 3058 void vnc_init_state(VncState *vs) 3059 { 3060 vs->initialized = true; 3061 VncDisplay *vd = vs->vd; 3062 3063 vs->last_x = -1; 3064 vs->last_y = -1; 3065 3066 vs->as.freq = 44100; 3067 vs->as.nchannels = 2; 3068 vs->as.fmt = AUD_FMT_S16; 3069 vs->as.endianness = 0; 3070 3071 qemu_mutex_init(&vs->output_mutex); 3072 vs->bh = qemu_bh_new(vnc_jobs_bh, vs); 3073 3074 QTAILQ_INSERT_TAIL(&vd->clients, vs, next); 3075 3076 graphic_hw_update(vd->dcl.con); 3077 3078 vnc_write(vs, "RFB 003.008\n", 12); 3079 vnc_flush(vs); 3080 vnc_read_when(vs, protocol_version, 12); 3081 reset_keys(vs); 3082 if (vs->vd->lock_key_sync) 3083 vs->led = qemu_add_led_event_handler(kbd_leds, vs); 3084 3085 vs->mouse_mode_notifier.notify = check_pointer_type_change; 3086 qemu_add_mouse_mode_change_notifier(&vs->mouse_mode_notifier); 3087 3088 /* vs might be free()ed here */ 3089 } 3090 3091 static void vnc_listen_read(void *opaque, bool websocket) 3092 { 3093 VncDisplay *vs = opaque; 3094 struct sockaddr_in addr; 3095 socklen_t addrlen = sizeof(addr); 3096 int csock; 3097 3098 /* Catch-up */ 3099 graphic_hw_update(vs->dcl.con); 3100 #ifdef CONFIG_VNC_WS 3101 if (websocket) { 3102 csock = qemu_accept(vs->lwebsock, (struct sockaddr *)&addr, &addrlen); 3103 } else 3104 #endif /* CONFIG_VNC_WS */ 3105 { 3106 csock = qemu_accept(vs->lsock, (struct sockaddr *)&addr, &addrlen); 3107 } 3108 3109 if (csock != -1) { 3110 socket_set_nodelay(csock); 3111 vnc_connect(vs, csock, false, websocket); 3112 } 3113 } 3114 3115 static void vnc_listen_regular_read(void *opaque) 3116 { 3117 vnc_listen_read(opaque, false); 3118 } 3119 3120 #ifdef CONFIG_VNC_WS 3121 static void vnc_listen_websocket_read(void *opaque) 3122 { 3123 vnc_listen_read(opaque, true); 3124 } 3125 #endif /* CONFIG_VNC_WS */ 3126 3127 static const DisplayChangeListenerOps dcl_ops = { 3128 .dpy_name = "vnc", 3129 .dpy_refresh = vnc_refresh, 3130 .dpy_gfx_copy = vnc_dpy_copy, 3131 .dpy_gfx_update = vnc_dpy_update, 3132 .dpy_gfx_switch = vnc_dpy_switch, 3133 .dpy_gfx_check_format = qemu_pixman_check_format, 3134 .dpy_mouse_set = vnc_mouse_set, 3135 .dpy_cursor_define = vnc_dpy_cursor_define, 3136 }; 3137 3138 void vnc_display_init(const char *id) 3139 { 3140 VncDisplay *vs; 3141 3142 if (vnc_display_find(id) != NULL) { 3143 return; 3144 } 3145 vs = g_malloc0(sizeof(*vs)); 3146 3147 vs->id = strdup(id); 3148 QTAILQ_INSERT_TAIL(&vnc_displays, vs, next); 3149 3150 vs->lsock = -1; 3151 #ifdef CONFIG_VNC_WS 3152 vs->lwebsock = -1; 3153 #endif 3154 3155 QTAILQ_INIT(&vs->clients); 3156 vs->expires = TIME_MAX; 3157 3158 if (keyboard_layout) { 3159 trace_vnc_key_map_init(keyboard_layout); 3160 vs->kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout); 3161 } else { 3162 vs->kbd_layout = init_keyboard_layout(name2keysym, "en-us"); 3163 } 3164 3165 if (!vs->kbd_layout) 3166 exit(1); 3167 3168 qemu_mutex_init(&vs->mutex); 3169 vnc_start_worker_thread(); 3170 3171 vs->dcl.ops = &dcl_ops; 3172 register_displaychangelistener(&vs->dcl); 3173 } 3174 3175 3176 static void vnc_display_close(VncDisplay *vs) 3177 { 3178 if (!vs) 3179 return; 3180 vs->enabled = false; 3181 vs->is_unix = false; 3182 if (vs->lsock != -1) { 3183 qemu_set_fd_handler(vs->lsock, NULL, NULL, NULL); 3184 close(vs->lsock); 3185 vs->lsock = -1; 3186 } 3187 #ifdef CONFIG_VNC_WS 3188 vs->ws_enabled = false; 3189 if (vs->lwebsock != -1) { 3190 qemu_set_fd_handler(vs->lwebsock, NULL, NULL, NULL); 3191 close(vs->lwebsock); 3192 vs->lwebsock = -1; 3193 } 3194 #endif /* CONFIG_VNC_WS */ 3195 vs->auth = VNC_AUTH_INVALID; 3196 vs->subauth = VNC_AUTH_INVALID; 3197 #ifdef CONFIG_VNC_TLS 3198 vs->tls.x509verify = 0; 3199 #endif 3200 } 3201 3202 int vnc_display_password(const char *id, const char *password) 3203 { 3204 VncDisplay *vs = vnc_display_find(id); 3205 3206 if (!vs) { 3207 return -EINVAL; 3208 } 3209 if (vs->auth == VNC_AUTH_NONE) { 3210 error_printf_unless_qmp("If you want use passwords please enable " 3211 "password auth using '-vnc ${dpy},password'."); 3212 return -EINVAL; 3213 } 3214 3215 g_free(vs->password); 3216 vs->password = g_strdup(password); 3217 3218 return 0; 3219 } 3220 3221 int vnc_display_pw_expire(const char *id, time_t expires) 3222 { 3223 VncDisplay *vs = vnc_display_find(id); 3224 3225 if (!vs) { 3226 return -EINVAL; 3227 } 3228 3229 vs->expires = expires; 3230 return 0; 3231 } 3232 3233 char *vnc_display_local_addr(const char *id) 3234 { 3235 VncDisplay *vs = vnc_display_find(id); 3236 3237 assert(vs); 3238 return vnc_socket_local_addr("%s:%s", vs->lsock); 3239 } 3240 3241 static QemuOptsList qemu_vnc_opts = { 3242 .name = "vnc", 3243 .head = QTAILQ_HEAD_INITIALIZER(qemu_vnc_opts.head), 3244 .implied_opt_name = "vnc", 3245 .desc = { 3246 { 3247 .name = "vnc", 3248 .type = QEMU_OPT_STRING, 3249 },{ 3250 .name = "websocket", 3251 .type = QEMU_OPT_STRING, 3252 },{ 3253 .name = "x509", 3254 .type = QEMU_OPT_STRING, 3255 },{ 3256 .name = "share", 3257 .type = QEMU_OPT_STRING, 3258 },{ 3259 .name = "display", 3260 .type = QEMU_OPT_STRING, 3261 },{ 3262 .name = "head", 3263 .type = QEMU_OPT_NUMBER, 3264 },{ 3265 .name = "connections", 3266 .type = QEMU_OPT_NUMBER, 3267 },{ 3268 .name = "to", 3269 .type = QEMU_OPT_NUMBER, 3270 },{ 3271 .name = "ipv4", 3272 .type = QEMU_OPT_BOOL, 3273 },{ 3274 .name = "ipv6", 3275 .type = QEMU_OPT_BOOL, 3276 },{ 3277 .name = "password", 3278 .type = QEMU_OPT_BOOL, 3279 },{ 3280 .name = "reverse", 3281 .type = QEMU_OPT_BOOL, 3282 },{ 3283 .name = "lock-key-sync", 3284 .type = QEMU_OPT_BOOL, 3285 },{ 3286 .name = "sasl", 3287 .type = QEMU_OPT_BOOL, 3288 },{ 3289 .name = "tls", 3290 .type = QEMU_OPT_BOOL, 3291 },{ 3292 .name = "x509verify", 3293 .type = QEMU_OPT_STRING, 3294 },{ 3295 .name = "acl", 3296 .type = QEMU_OPT_BOOL, 3297 },{ 3298 .name = "lossy", 3299 .type = QEMU_OPT_BOOL, 3300 },{ 3301 .name = "non-adaptive", 3302 .type = QEMU_OPT_BOOL, 3303 }, 3304 { /* end of list */ } 3305 }, 3306 }; 3307 3308 3309 static void 3310 vnc_display_setup_auth(VncDisplay *vs, 3311 bool password, 3312 bool sasl, 3313 bool tls, 3314 bool x509, 3315 bool websocket) 3316 { 3317 /* 3318 * We have a choice of 3 authentication options 3319 * 3320 * 1. none 3321 * 2. vnc 3322 * 3. sasl 3323 * 3324 * The channel can be run in 2 modes 3325 * 3326 * 1. clear 3327 * 2. tls 3328 * 3329 * And TLS can use 2 types of credentials 3330 * 3331 * 1. anon 3332 * 2. x509 3333 * 3334 * We thus have 9 possible logical combinations 3335 * 3336 * 1. clear + none 3337 * 2. clear + vnc 3338 * 3. clear + sasl 3339 * 4. tls + anon + none 3340 * 5. tls + anon + vnc 3341 * 6. tls + anon + sasl 3342 * 7. tls + x509 + none 3343 * 8. tls + x509 + vnc 3344 * 9. tls + x509 + sasl 3345 * 3346 * These need to be mapped into the VNC auth schemes 3347 * in an appropriate manner. In regular VNC, all the 3348 * TLS options get mapped into VNC_AUTH_VENCRYPT 3349 * sub-auth types. 3350 * 3351 * In websockets, the https:// protocol already provides 3352 * TLS support, so there is no need to make use of the 3353 * VeNCrypt extension. Furthermore, websockets browser 3354 * clients could not use VeNCrypt even if they wanted to, 3355 * as they cannot control when the TLS handshake takes 3356 * place. Thus there is no option but to rely on https://, 3357 * meaning combinations 4->6 and 7->9 will be mapped to 3358 * VNC auth schemes in the same way as combos 1->3. 3359 * 3360 * Regardless of fact that we have a different mapping to 3361 * VNC auth mechs for plain VNC vs websockets VNC, the end 3362 * result has the same security characteristics. 3363 */ 3364 if (password) { 3365 if (tls) { 3366 vs->auth = VNC_AUTH_VENCRYPT; 3367 if (websocket) { 3368 vs->ws_tls = true; 3369 } 3370 if (x509) { 3371 VNC_DEBUG("Initializing VNC server with x509 password auth\n"); 3372 vs->subauth = VNC_AUTH_VENCRYPT_X509VNC; 3373 } else { 3374 VNC_DEBUG("Initializing VNC server with TLS password auth\n"); 3375 vs->subauth = VNC_AUTH_VENCRYPT_TLSVNC; 3376 } 3377 } else { 3378 VNC_DEBUG("Initializing VNC server with password auth\n"); 3379 vs->auth = VNC_AUTH_VNC; 3380 vs->subauth = VNC_AUTH_INVALID; 3381 } 3382 if (websocket) { 3383 vs->ws_auth = VNC_AUTH_VNC; 3384 } else { 3385 vs->ws_auth = VNC_AUTH_INVALID; 3386 } 3387 } else if (sasl) { 3388 if (tls) { 3389 vs->auth = VNC_AUTH_VENCRYPT; 3390 if (websocket) { 3391 vs->ws_tls = true; 3392 } 3393 if (x509) { 3394 VNC_DEBUG("Initializing VNC server with x509 SASL auth\n"); 3395 vs->subauth = VNC_AUTH_VENCRYPT_X509SASL; 3396 } else { 3397 VNC_DEBUG("Initializing VNC server with TLS SASL auth\n"); 3398 vs->subauth = VNC_AUTH_VENCRYPT_TLSSASL; 3399 } 3400 } else { 3401 VNC_DEBUG("Initializing VNC server with SASL auth\n"); 3402 vs->auth = VNC_AUTH_SASL; 3403 vs->subauth = VNC_AUTH_INVALID; 3404 } 3405 if (websocket) { 3406 vs->ws_auth = VNC_AUTH_SASL; 3407 } else { 3408 vs->ws_auth = VNC_AUTH_INVALID; 3409 } 3410 } else { 3411 if (tls) { 3412 vs->auth = VNC_AUTH_VENCRYPT; 3413 if (websocket) { 3414 vs->ws_tls = true; 3415 } 3416 if (x509) { 3417 VNC_DEBUG("Initializing VNC server with x509 no auth\n"); 3418 vs->subauth = VNC_AUTH_VENCRYPT_X509NONE; 3419 } else { 3420 VNC_DEBUG("Initializing VNC server with TLS no auth\n"); 3421 vs->subauth = VNC_AUTH_VENCRYPT_TLSNONE; 3422 } 3423 } else { 3424 VNC_DEBUG("Initializing VNC server with no auth\n"); 3425 vs->auth = VNC_AUTH_NONE; 3426 vs->subauth = VNC_AUTH_INVALID; 3427 } 3428 if (websocket) { 3429 vs->ws_auth = VNC_AUTH_NONE; 3430 } else { 3431 vs->ws_auth = VNC_AUTH_INVALID; 3432 } 3433 } 3434 } 3435 3436 void vnc_display_open(const char *id, Error **errp) 3437 { 3438 VncDisplay *vs = vnc_display_find(id); 3439 QemuOpts *opts = qemu_opts_find(&qemu_vnc_opts, id); 3440 QemuOpts *sopts, *wsopts; 3441 const char *share, *device_id; 3442 QemuConsole *con; 3443 bool password = false; 3444 bool reverse = false; 3445 const char *vnc; 3446 const char *has_to; 3447 char *h; 3448 bool has_ipv4 = false; 3449 bool has_ipv6 = false; 3450 const char *websocket; 3451 bool tls = false, x509 = false; 3452 #ifdef CONFIG_VNC_TLS 3453 const char *path; 3454 #endif 3455 bool sasl = false; 3456 #ifdef CONFIG_VNC_SASL 3457 int saslErr; 3458 #endif 3459 #if defined(CONFIG_VNC_TLS) || defined(CONFIG_VNC_SASL) 3460 int acl = 0; 3461 #endif 3462 int lock_key_sync = 1; 3463 3464 if (!vs) { 3465 error_setg(errp, "VNC display not active"); 3466 return; 3467 } 3468 vnc_display_close(vs); 3469 3470 if (!opts) { 3471 return; 3472 } 3473 vnc = qemu_opt_get(opts, "vnc"); 3474 if (!vnc || strcmp(vnc, "none") == 0) { 3475 return; 3476 } 3477 3478 sopts = qemu_opts_create(&socket_optslist, NULL, 0, &error_abort); 3479 wsopts = qemu_opts_create(&socket_optslist, NULL, 0, &error_abort); 3480 3481 h = strrchr(vnc, ':'); 3482 if (h) { 3483 char *host; 3484 size_t hlen = h - vnc; 3485 3486 if (vnc[0] == '[' && vnc[hlen - 1] == ']') { 3487 host = g_strndup(vnc + 1, hlen - 2); 3488 } else { 3489 host = g_strndup(vnc, hlen); 3490 } 3491 qemu_opt_set(sopts, "host", host, &error_abort); 3492 qemu_opt_set(wsopts, "host", host, &error_abort); 3493 qemu_opt_set(sopts, "port", h+1, &error_abort); 3494 g_free(host); 3495 } else { 3496 error_setg(errp, "no vnc port specified"); 3497 goto fail; 3498 } 3499 3500 has_to = qemu_opt_get(opts, "to"); 3501 has_ipv4 = qemu_opt_get_bool(opts, "ipv4", false); 3502 has_ipv6 = qemu_opt_get_bool(opts, "ipv6", false); 3503 if (has_to) { 3504 qemu_opt_set(sopts, "to", has_to, &error_abort); 3505 qemu_opt_set(wsopts, "to", has_to, &error_abort); 3506 } 3507 if (has_ipv4) { 3508 qemu_opt_set(sopts, "ipv4", "on", &error_abort); 3509 qemu_opt_set(wsopts, "ipv4", "on", &error_abort); 3510 } 3511 if (has_ipv6) { 3512 qemu_opt_set(sopts, "ipv6", "on", &error_abort); 3513 qemu_opt_set(wsopts, "ipv6", "on", &error_abort); 3514 } 3515 3516 password = qemu_opt_get_bool(opts, "password", false); 3517 if (password && fips_get_state()) { 3518 error_setg(errp, 3519 "VNC password auth disabled due to FIPS mode, " 3520 "consider using the VeNCrypt or SASL authentication " 3521 "methods as an alternative"); 3522 goto fail; 3523 } 3524 3525 reverse = qemu_opt_get_bool(opts, "reverse", false); 3526 lock_key_sync = qemu_opt_get_bool(opts, "lock-key-sync", true); 3527 sasl = qemu_opt_get_bool(opts, "sasl", false); 3528 #ifndef CONFIG_VNC_SASL 3529 if (sasl) { 3530 error_setg(errp, "VNC SASL auth requires cyrus-sasl support"); 3531 goto fail; 3532 } 3533 #endif /* CONFIG_VNC_SASL */ 3534 tls = qemu_opt_get_bool(opts, "tls", false); 3535 #ifdef CONFIG_VNC_TLS 3536 path = qemu_opt_get(opts, "x509"); 3537 if (!path) { 3538 path = qemu_opt_get(opts, "x509verify"); 3539 if (path) { 3540 vs->tls.x509verify = true; 3541 } 3542 } 3543 if (path) { 3544 x509 = true; 3545 if (vnc_tls_set_x509_creds_dir(vs, path) < 0) { 3546 error_setg(errp, "Failed to find x509 certificates/keys in %s", 3547 path); 3548 goto fail; 3549 } 3550 } 3551 #else /* ! CONFIG_VNC_TLS */ 3552 if (tls) { 3553 error_setg(errp, "VNC TLS auth requires gnutls support"); 3554 goto fail; 3555 } 3556 #endif /* ! CONFIG_VNC_TLS */ 3557 #if defined(CONFIG_VNC_TLS) || defined(CONFIG_VNC_SASL) 3558 acl = qemu_opt_get_bool(opts, "acl", false); 3559 #endif 3560 3561 share = qemu_opt_get(opts, "share"); 3562 if (share) { 3563 if (strcmp(share, "ignore") == 0) { 3564 vs->share_policy = VNC_SHARE_POLICY_IGNORE; 3565 } else if (strcmp(share, "allow-exclusive") == 0) { 3566 vs->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE; 3567 } else if (strcmp(share, "force-shared") == 0) { 3568 vs->share_policy = VNC_SHARE_POLICY_FORCE_SHARED; 3569 } else { 3570 error_setg(errp, "unknown vnc share= option"); 3571 goto fail; 3572 } 3573 } else { 3574 vs->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE; 3575 } 3576 vs->connections_limit = qemu_opt_get_number(opts, "connections", 32); 3577 3578 websocket = qemu_opt_get(opts, "websocket"); 3579 if (websocket) { 3580 #ifdef CONFIG_VNC_WS 3581 vs->ws_enabled = true; 3582 qemu_opt_set(wsopts, "port", websocket, &error_abort); 3583 #else /* ! CONFIG_VNC_WS */ 3584 error_setg(errp, "Websockets protocol requires gnutls support"); 3585 goto fail; 3586 #endif /* ! CONFIG_VNC_WS */ 3587 } 3588 3589 #ifdef CONFIG_VNC_JPEG 3590 vs->lossy = qemu_opt_get_bool(opts, "lossy", false); 3591 #endif 3592 vs->non_adaptive = qemu_opt_get_bool(opts, "non-adaptive", false); 3593 /* adaptive updates are only used with tight encoding and 3594 * if lossy updates are enabled so we can disable all the 3595 * calculations otherwise */ 3596 if (!vs->lossy) { 3597 vs->non_adaptive = true; 3598 } 3599 3600 #ifdef CONFIG_VNC_TLS 3601 if (acl && x509 && vs->tls.x509verify) { 3602 char *aclname; 3603 3604 if (strcmp(vs->id, "default") == 0) { 3605 aclname = g_strdup("vnc.x509dname"); 3606 } else { 3607 aclname = g_strdup_printf("vnc.%s.x509dname", vs->id); 3608 } 3609 vs->tls.acl = qemu_acl_init(aclname); 3610 g_free(aclname); 3611 } 3612 #endif 3613 #ifdef CONFIG_VNC_SASL 3614 if (acl && sasl) { 3615 char *aclname; 3616 3617 if (strcmp(vs->id, "default") == 0) { 3618 aclname = g_strdup("vnc.username"); 3619 } else { 3620 aclname = g_strdup_printf("vnc.%s.username", vs->id); 3621 } 3622 vs->sasl.acl = qemu_acl_init(aclname); 3623 g_free(aclname); 3624 } 3625 #endif 3626 3627 vnc_display_setup_auth(vs, password, sasl, tls, x509, websocket); 3628 3629 #ifdef CONFIG_VNC_SASL 3630 if ((saslErr = sasl_server_init(NULL, "qemu")) != SASL_OK) { 3631 error_setg(errp, "Failed to initialize SASL auth: %s", 3632 sasl_errstring(saslErr, NULL, NULL)); 3633 goto fail; 3634 } 3635 #endif 3636 vs->lock_key_sync = lock_key_sync; 3637 3638 device_id = qemu_opt_get(opts, "display"); 3639 if (device_id) { 3640 DeviceState *dev; 3641 int head = qemu_opt_get_number(opts, "head", 0); 3642 3643 dev = qdev_find_recursive(sysbus_get_default(), device_id); 3644 if (dev == NULL) { 3645 error_setg(errp, "Device '%s' not found", device_id); 3646 goto fail; 3647 } 3648 3649 con = qemu_console_lookup_by_device(dev, head); 3650 if (con == NULL) { 3651 error_setg(errp, "Device %s is not bound to a QemuConsole", 3652 device_id); 3653 goto fail; 3654 } 3655 } else { 3656 con = NULL; 3657 } 3658 3659 if (con != vs->dcl.con) { 3660 unregister_displaychangelistener(&vs->dcl); 3661 vs->dcl.con = con; 3662 register_displaychangelistener(&vs->dcl); 3663 } 3664 3665 if (reverse) { 3666 /* connect to viewer */ 3667 int csock; 3668 vs->lsock = -1; 3669 #ifdef CONFIG_VNC_WS 3670 vs->lwebsock = -1; 3671 #endif 3672 if (strncmp(vnc, "unix:", 5) == 0) { 3673 csock = unix_connect(vnc+5, errp); 3674 } else { 3675 csock = inet_connect(vnc, errp); 3676 } 3677 if (csock < 0) { 3678 goto fail; 3679 } 3680 vnc_connect(vs, csock, false, false); 3681 } else { 3682 /* listen for connects */ 3683 if (strncmp(vnc, "unix:", 5) == 0) { 3684 vs->lsock = unix_listen(vnc+5, NULL, 0, errp); 3685 if (vs->lsock < 0) { 3686 goto fail; 3687 } 3688 vs->is_unix = true; 3689 } else { 3690 vs->lsock = inet_listen_opts(sopts, 5900, errp); 3691 if (vs->lsock < 0) { 3692 goto fail; 3693 } 3694 #ifdef CONFIG_VNC_WS 3695 if (vs->ws_enabled) { 3696 vs->lwebsock = inet_listen_opts(wsopts, 0, errp); 3697 if (vs->lwebsock < 0) { 3698 if (vs->lsock != -1) { 3699 close(vs->lsock); 3700 vs->lsock = -1; 3701 } 3702 goto fail; 3703 } 3704 } 3705 #endif /* CONFIG_VNC_WS */ 3706 } 3707 vs->enabled = true; 3708 qemu_set_fd_handler(vs->lsock, vnc_listen_regular_read, NULL, vs); 3709 #ifdef CONFIG_VNC_WS 3710 if (vs->ws_enabled) { 3711 qemu_set_fd_handler(vs->lwebsock, vnc_listen_websocket_read, 3712 NULL, vs); 3713 } 3714 #endif /* CONFIG_VNC_WS */ 3715 } 3716 qemu_opts_del(sopts); 3717 qemu_opts_del(wsopts); 3718 return; 3719 3720 fail: 3721 qemu_opts_del(sopts); 3722 qemu_opts_del(wsopts); 3723 vs->enabled = false; 3724 #ifdef CONFIG_VNC_WS 3725 vs->ws_enabled = false; 3726 #endif /* CONFIG_VNC_WS */ 3727 } 3728 3729 void vnc_display_add_client(const char *id, int csock, bool skipauth) 3730 { 3731 VncDisplay *vs = vnc_display_find(id); 3732 3733 if (!vs) { 3734 return; 3735 } 3736 vnc_connect(vs, csock, skipauth, false); 3737 } 3738 3739 static void vnc_auto_assign_id(QemuOptsList *olist, QemuOpts *opts) 3740 { 3741 int i = 2; 3742 char *id; 3743 3744 id = g_strdup("default"); 3745 while (qemu_opts_find(olist, id)) { 3746 g_free(id); 3747 id = g_strdup_printf("vnc%d", i++); 3748 } 3749 qemu_opts_set_id(opts, id); 3750 } 3751 3752 QemuOpts *vnc_parse_func(const char *str) 3753 { 3754 QemuOptsList *olist = qemu_find_opts("vnc"); 3755 QemuOpts *opts = qemu_opts_parse(olist, str, 1); 3756 const char *id; 3757 3758 if (!opts) { 3759 return NULL; 3760 } 3761 3762 id = qemu_opts_id(opts); 3763 if (!id) { 3764 /* auto-assign id if not present */ 3765 vnc_auto_assign_id(olist, opts); 3766 } 3767 return opts; 3768 } 3769 3770 int vnc_init_func(void *opaque, QemuOpts *opts, Error **errp) 3771 { 3772 Error *local_err = NULL; 3773 char *id = (char *)qemu_opts_id(opts); 3774 3775 assert(id); 3776 vnc_display_init(id); 3777 vnc_display_open(id, &local_err); 3778 if (local_err != NULL) { 3779 error_report("Failed to start VNC server: %s", 3780 error_get_pretty(local_err)); 3781 error_free(local_err); 3782 exit(1); 3783 } 3784 return 0; 3785 } 3786 3787 static void vnc_register_config(void) 3788 { 3789 qemu_add_opts(&qemu_vnc_opts); 3790 } 3791 machine_init(vnc_register_config); 3792