Statistics
| Branch: | Revision:

root / vnc.c @ 2c277908

History | View | Annotate | Download (67.5 kB)

1
/*
2
 * QEMU VNC display driver
3
 *
4
 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5
 * Copyright (C) 2006 Fabrice Bellard
6
 *
7
 * Permission is hereby granted, free of charge, to any person obtaining a copy
8
 * of this software and associated documentation files (the "Software"), to deal
9
 * in the Software without restriction, including without limitation the rights
10
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11
 * copies of the Software, and to permit persons to whom the Software is
12
 * furnished to do so, subject to the following conditions:
13
 *
14
 * The above copyright notice and this permission notice shall be included in
15
 * all copies or substantial portions of the Software.
16
 *
17
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23
 * THE SOFTWARE.
24
 */
25

    
26
#include "qemu-common.h"
27
#include "console.h"
28
#include "sysemu.h"
29
#include "qemu_socket.h"
30
#include "qemu-timer.h"
31
#include "audio/audio.h"
32

    
33
#define VNC_REFRESH_INTERVAL (1000 / 30)
34

    
35
#include "vnc_keysym.h"
36
#include "keymaps.c"
37
#include "d3des.h"
38

    
39
#ifdef CONFIG_VNC_TLS
40
#include <gnutls/gnutls.h>
41
#include <gnutls/x509.h>
42
#endif /* CONFIG_VNC_TLS */
43

    
44
// #define _VNC_DEBUG 1
45

    
46
#ifdef _VNC_DEBUG
47
#define VNC_DEBUG(fmt, ...) do { fprintf(stderr, fmt, ## __VA_ARGS__); } while (0)
48

    
49
#if CONFIG_VNC_TLS && _VNC_DEBUG >= 2
50
/* Very verbose, so only enabled for _VNC_DEBUG >= 2 */
51
static void vnc_debug_gnutls_log(int level, const char* str) {
52
    VNC_DEBUG("%d %s", level, str);
53
}
54
#endif /* CONFIG_VNC_TLS && _VNC_DEBUG */
55
#else
56
#define VNC_DEBUG(fmt, ...) do { } while (0)
57
#endif
58

    
59

    
60
typedef struct Buffer
61
{
62
    size_t capacity;
63
    size_t offset;
64
    uint8_t *buffer;
65
} Buffer;
66

    
67
typedef struct VncState VncState;
68

    
69
typedef int VncReadEvent(VncState *vs, uint8_t *data, size_t len);
70

    
71
typedef void VncWritePixels(VncState *vs, void *data, int size);
72

    
73
typedef void VncSendHextileTile(VncState *vs,
74
                                int x, int y, int w, int h,
75
                                void *last_bg,
76
                                void *last_fg,
77
                                int *has_bg, int *has_fg);
78

    
79
#define VNC_MAX_WIDTH 2048
80
#define VNC_MAX_HEIGHT 2048
81
#define VNC_DIRTY_WORDS (VNC_MAX_WIDTH / (16 * 32))
82

    
83
#define VNC_AUTH_CHALLENGE_SIZE 16
84

    
85
enum {
86
    VNC_AUTH_INVALID = 0,
87
    VNC_AUTH_NONE = 1,
88
    VNC_AUTH_VNC = 2,
89
    VNC_AUTH_RA2 = 5,
90
    VNC_AUTH_RA2NE = 6,
91
    VNC_AUTH_TIGHT = 16,
92
    VNC_AUTH_ULTRA = 17,
93
    VNC_AUTH_TLS = 18,
94
    VNC_AUTH_VENCRYPT = 19
95
};
96

    
97
#ifdef CONFIG_VNC_TLS
98
enum {
99
    VNC_WIREMODE_CLEAR,
100
    VNC_WIREMODE_TLS,
101
};
102

    
103
enum {
104
    VNC_AUTH_VENCRYPT_PLAIN = 256,
105
    VNC_AUTH_VENCRYPT_TLSNONE = 257,
106
    VNC_AUTH_VENCRYPT_TLSVNC = 258,
107
    VNC_AUTH_VENCRYPT_TLSPLAIN = 259,
108
    VNC_AUTH_VENCRYPT_X509NONE = 260,
109
    VNC_AUTH_VENCRYPT_X509VNC = 261,
110
    VNC_AUTH_VENCRYPT_X509PLAIN = 262,
111
};
112

    
113
#define X509_CA_CERT_FILE "ca-cert.pem"
114
#define X509_CA_CRL_FILE "ca-crl.pem"
115
#define X509_SERVER_KEY_FILE "server-key.pem"
116
#define X509_SERVER_CERT_FILE "server-cert.pem"
117

    
118
#endif /* CONFIG_VNC_TLS */
119

    
120
struct VncState
121
{
122
    QEMUTimer *timer;
123
    int lsock;
124
    int csock;
125
    DisplayState *ds;
126
    int need_update;
127
    int width;
128
    int height;
129
    uint32_t dirty_row[VNC_MAX_HEIGHT][VNC_DIRTY_WORDS];
130
    char *old_data;
131
    int depth; /* internal VNC frame buffer byte per pixel */
132
    int has_resize;
133
    int has_hextile;
134
    int has_pointer_type_change;
135
    int has_WMVi;
136
    int absolute;
137
    int last_x;
138
    int last_y;
139

    
140
    int major;
141
    int minor;
142

    
143
    char *display;
144
    char *password;
145
    int auth;
146
#ifdef CONFIG_VNC_TLS
147
    int subauth;
148
    int x509verify;
149

    
150
    char *x509cacert;
151
    char *x509cacrl;
152
    char *x509cert;
153
    char *x509key;
154
#endif
155
    char challenge[VNC_AUTH_CHALLENGE_SIZE];
156

    
157
#ifdef CONFIG_VNC_TLS
158
    int wiremode;
159
    gnutls_session_t tls_session;
160
#endif
161

    
162
    Buffer output;
163
    Buffer input;
164
    kbd_layout_t *kbd_layout;
165
    /* current output mode information */
166
    VncWritePixels *write_pixels;
167
    VncSendHextileTile *send_hextile_tile;
168
    int pix_bpp, pix_big_endian;
169
    int client_red_shift, client_red_max, server_red_shift, server_red_max;
170
    int client_green_shift, client_green_max, server_green_shift, server_green_max;
171
    int client_blue_shift, client_blue_max, server_blue_shift, server_blue_max;
172

    
173
    CaptureVoiceOut *audio_cap;
174
    struct audsettings as;
175

    
176
    VncReadEvent *read_handler;
177
    size_t read_handler_expect;
178
    /* input */
179
    uint8_t modifiers_state[256];
180
};
181

    
182
static VncState *vnc_state; /* needed for info vnc */
183

    
184
void do_info_vnc(void)
185
{
186
    if (vnc_state == NULL || vnc_state->display == NULL)
187
        term_printf("VNC server disabled\n");
188
    else {
189
        term_printf("VNC server active on: ");
190
        term_print_filename(vnc_state->display);
191
        term_printf("\n");
192

    
193
        if (vnc_state->csock == -1)
194
            term_printf("No client connected\n");
195
        else
196
            term_printf("Client connected\n");
197
    }
198
}
199

    
200
/* TODO
201
   1) Get the queue working for IO.
202
   2) there is some weirdness when using the -S option (the screen is grey
203
      and not totally invalidated
204
   3) resolutions > 1024
205
*/
206

    
207
static void vnc_write(VncState *vs, const void *data, size_t len);
208
static void vnc_write_u32(VncState *vs, uint32_t value);
209
static void vnc_write_s32(VncState *vs, int32_t value);
210
static void vnc_write_u16(VncState *vs, uint16_t value);
211
static void vnc_write_u8(VncState *vs, uint8_t value);
212
static void vnc_flush(VncState *vs);
213
static void vnc_update_client(void *opaque);
214
static void vnc_client_read(void *opaque);
215

    
216
static void vnc_colordepth(DisplayState *ds, int depth);
217

    
218
static inline void vnc_set_bit(uint32_t *d, int k)
219
{
220
    d[k >> 5] |= 1 << (k & 0x1f);
221
}
222

    
223
static inline void vnc_clear_bit(uint32_t *d, int k)
224
{
225
    d[k >> 5] &= ~(1 << (k & 0x1f));
226
}
227

    
228
static inline void vnc_set_bits(uint32_t *d, int n, int nb_words)
229
{
230
    int j;
231

    
232
    j = 0;
233
    while (n >= 32) {
234
        d[j++] = -1;
235
        n -= 32;
236
    }
237
    if (n > 0)
238
        d[j++] = (1 << n) - 1;
239
    while (j < nb_words)
240
        d[j++] = 0;
241
}
242

    
243
static inline int vnc_get_bit(const uint32_t *d, int k)
244
{
245
    return (d[k >> 5] >> (k & 0x1f)) & 1;
246
}
247

    
248
static inline int vnc_and_bits(const uint32_t *d1, const uint32_t *d2,
249
                               int nb_words)
250
{
251
    int i;
252
    for(i = 0; i < nb_words; i++) {
253
        if ((d1[i] & d2[i]) != 0)
254
            return 1;
255
    }
256
    return 0;
257
}
258

    
259
static void vnc_dpy_update(DisplayState *ds, int x, int y, int w, int h)
260
{
261
    VncState *vs = ds->opaque;
262
    int i;
263

    
264
    h += y;
265

    
266
    /* round x down to ensure the loop only spans one 16-pixel block per,
267
       iteration.  otherwise, if (x % 16) != 0, the last iteration may span
268
       two 16-pixel blocks but we only mark the first as dirty
269
    */
270
    w += (x % 16);
271
    x -= (x % 16);
272

    
273
    x = MIN(x, vs->width);
274
    y = MIN(y, vs->height);
275
    w = MIN(x + w, vs->width) - x;
276
    h = MIN(h, vs->height);
277

    
278
    for (; y < h; y++)
279
        for (i = 0; i < w; i += 16)
280
            vnc_set_bit(vs->dirty_row[y], (x + i) / 16);
281
}
282

    
283
static void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
284
                                   int32_t encoding)
285
{
286
    vnc_write_u16(vs, x);
287
    vnc_write_u16(vs, y);
288
    vnc_write_u16(vs, w);
289
    vnc_write_u16(vs, h);
290

    
291
    vnc_write_s32(vs, encoding);
292
}
293

    
294
static void vnc_dpy_resize(DisplayState *ds, int w, int h)
295
{
296
    int size_changed;
297
    VncState *vs = ds->opaque;
298

    
299
    ds->data = qemu_realloc(ds->data, w * h * vs->depth);
300
    vs->old_data = qemu_realloc(vs->old_data, w * h * vs->depth);
301

    
302
    if (ds->data == NULL || vs->old_data == NULL) {
303
        fprintf(stderr, "vnc: memory allocation failed\n");
304
        exit(1);
305
    }
306

    
307
    if (ds->depth != vs->depth * 8) {
308
        ds->depth = vs->depth * 8;
309
        console_color_init(ds);
310
    }
311
    size_changed = ds->width != w || ds->height != h;
312
    ds->width = w;
313
    ds->height = h;
314
    ds->linesize = w * vs->depth;
315
    if (size_changed) {
316
        vs->width = ds->width;
317
        vs->height = ds->height;
318
        if (vs->csock != -1 && vs->has_resize) {
319
            vnc_write_u8(vs, 0);  /* msg id */
320
            vnc_write_u8(vs, 0);
321
            vnc_write_u16(vs, 1); /* number of rects */
322
            vnc_framebuffer_update(vs, 0, 0, ds->width, ds->height, -223);
323
            vnc_flush(vs);
324
        }
325
    }
326

    
327
    memset(vs->dirty_row, 0xFF, sizeof(vs->dirty_row));
328
    memset(vs->old_data, 42, ds_get_linesize(vs->ds) * ds_get_height(vs->ds));
329
}
330

    
331
/* fastest code */
332
static void vnc_write_pixels_copy(VncState *vs, void *pixels, int size)
333
{
334
    vnc_write(vs, pixels, size);
335
}
336

    
337
/* slowest but generic code. */
338
static void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
339
{
340
    uint8_t r, g, b;
341

    
342
    r = ((v >> vs->server_red_shift) & vs->server_red_max) * (vs->client_red_max + 1) /
343
        (vs->server_red_max + 1);
344
    g = ((v >> vs->server_green_shift) & vs->server_green_max) * (vs->client_green_max + 1) /
345
        (vs->server_green_max + 1);
346
    b = ((v >> vs->server_blue_shift) & vs->server_blue_max) * (vs->client_blue_max + 1) /
347
        (vs->server_blue_max + 1);
348
    v = (r << vs->client_red_shift) |
349
        (g << vs->client_green_shift) |
350
        (b << vs->client_blue_shift);
351
    switch(vs->pix_bpp) {
352
    case 1:
353
        buf[0] = v;
354
        break;
355
    case 2:
356
        if (vs->pix_big_endian) {
357
            buf[0] = v >> 8;
358
            buf[1] = v;
359
        } else {
360
            buf[1] = v >> 8;
361
            buf[0] = v;
362
        }
363
        break;
364
    default:
365
    case 4:
366
        if (vs->pix_big_endian) {
367
            buf[0] = v >> 24;
368
            buf[1] = v >> 16;
369
            buf[2] = v >> 8;
370
            buf[3] = v;
371
        } else {
372
            buf[3] = v >> 24;
373
            buf[2] = v >> 16;
374
            buf[1] = v >> 8;
375
            buf[0] = v;
376
        }
377
        break;
378
    }
379
}
380

    
381
static void vnc_write_pixels_generic(VncState *vs, void *pixels1, int size)
382
{
383
    uint8_t buf[4];
384

    
385
    if (vs->depth == 4) {
386
        uint32_t *pixels = pixels1;
387
        int n, i;
388
        n = size >> 2;
389
        for(i = 0; i < n; i++) {
390
            vnc_convert_pixel(vs, buf, pixels[i]);
391
            vnc_write(vs, buf, vs->pix_bpp);
392
        }
393
    } else if (vs->depth == 2) {
394
        uint16_t *pixels = pixels1;
395
        int n, i;
396
        n = size >> 1;
397
        for(i = 0; i < n; i++) {
398
            vnc_convert_pixel(vs, buf, pixels[i]);
399
            vnc_write(vs, buf, vs->pix_bpp);
400
        }
401
    } else if (vs->depth == 1) {
402
        uint8_t *pixels = pixels1;
403
        int n, i;
404
        n = size;
405
        for(i = 0; i < n; i++) {
406
            vnc_convert_pixel(vs, buf, pixels[i]);
407
            vnc_write(vs, buf, vs->pix_bpp);
408
        }
409
    } else {
410
        fprintf(stderr, "vnc_write_pixels_generic: VncState color depth not supported\n");
411
    }
412
}
413

    
414
static void send_framebuffer_update_raw(VncState *vs, int x, int y, int w, int h)
415
{
416
    int i;
417
    uint8_t *row;
418

    
419
    vnc_framebuffer_update(vs, x, y, w, h, 0);
420

    
421
    row = ds_get_data(vs->ds) + y * ds_get_linesize(vs->ds) + x * vs->depth;
422
    for (i = 0; i < h; i++) {
423
        vs->write_pixels(vs, row, w * vs->depth);
424
        row += ds_get_linesize(vs->ds);
425
    }
426
}
427

    
428
static void hextile_enc_cord(uint8_t *ptr, int x, int y, int w, int h)
429
{
430
    ptr[0] = ((x & 0x0F) << 4) | (y & 0x0F);
431
    ptr[1] = (((w - 1) & 0x0F) << 4) | ((h - 1) & 0x0F);
432
}
433

    
434
#define BPP 8
435
#include "vnchextile.h"
436
#undef BPP
437

    
438
#define BPP 16
439
#include "vnchextile.h"
440
#undef BPP
441

    
442
#define BPP 32
443
#include "vnchextile.h"
444
#undef BPP
445

    
446
#define GENERIC
447
#define BPP 8
448
#include "vnchextile.h"
449
#undef BPP
450
#undef GENERIC
451

    
452
#define GENERIC
453
#define BPP 16
454
#include "vnchextile.h"
455
#undef BPP
456
#undef GENERIC
457

    
458
#define GENERIC
459
#define BPP 32
460
#include "vnchextile.h"
461
#undef BPP
462
#undef GENERIC
463

    
464
static void send_framebuffer_update_hextile(VncState *vs, int x, int y, int w, int h)
465
{
466
    int i, j;
467
    int has_fg, has_bg;
468
    uint8_t *last_fg, *last_bg;
469

    
470
    vnc_framebuffer_update(vs, x, y, w, h, 5);
471

    
472
    last_fg = (uint8_t *) malloc(vs->depth);
473
    last_bg = (uint8_t *) malloc(vs->depth);
474
    has_fg = has_bg = 0;
475
    for (j = y; j < (y + h); j += 16) {
476
        for (i = x; i < (x + w); i += 16) {
477
            vs->send_hextile_tile(vs, i, j,
478
                                  MIN(16, x + w - i), MIN(16, y + h - j),
479
                                  last_bg, last_fg, &has_bg, &has_fg);
480
        }
481
    }
482
    free(last_fg);
483
    free(last_bg);
484

    
485
}
486

    
487
static void send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
488
{
489
        if (vs->has_hextile)
490
            send_framebuffer_update_hextile(vs, x, y, w, h);
491
        else
492
            send_framebuffer_update_raw(vs, x, y, w, h);
493
}
494

    
495
static void vnc_copy(DisplayState *ds, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
496
{
497
    int src, dst;
498
    uint8_t *src_row;
499
    uint8_t *dst_row;
500
    char *old_row;
501
    int y = 0;
502
    int pitch = ds_get_linesize(ds);
503
    VncState *vs = ds->opaque;
504

    
505
    vnc_update_client(vs);
506

    
507
    if (dst_y > src_y) {
508
        y = h - 1;
509
        pitch = -pitch;
510
    }
511

    
512
    src = (ds_get_linesize(ds) * (src_y + y) + vs->depth * src_x);
513
    dst = (ds_get_linesize(ds) * (dst_y + y) + vs->depth * dst_x);
514

    
515
    src_row = ds_get_data(ds) + src;
516
    dst_row = ds_get_data(ds) + dst;
517
    old_row = vs->old_data + dst;
518

    
519
    for (y = 0; y < h; y++) {
520
        memmove(old_row, src_row, w * vs->depth);
521
        memmove(dst_row, src_row, w * vs->depth);
522
        src_row += pitch;
523
        dst_row += pitch;
524
        old_row += pitch;
525
    }
526

    
527
    vnc_write_u8(vs, 0);  /* msg id */
528
    vnc_write_u8(vs, 0);
529
    vnc_write_u16(vs, 1); /* number of rects */
530
    vnc_framebuffer_update(vs, dst_x, dst_y, w, h, 1);
531
    vnc_write_u16(vs, src_x);
532
    vnc_write_u16(vs, src_y);
533
    vnc_flush(vs);
534
}
535

    
536
static int find_dirty_height(VncState *vs, int y, int last_x, int x)
537
{
538
    int h;
539

    
540
    for (h = 1; h < (vs->height - y); h++) {
541
        int tmp_x;
542
        if (!vnc_get_bit(vs->dirty_row[y + h], last_x))
543
            break;
544
        for (tmp_x = last_x; tmp_x < x; tmp_x++)
545
            vnc_clear_bit(vs->dirty_row[y + h], tmp_x);
546
    }
547

    
548
    return h;
549
}
550

    
551
static void vnc_update_client(void *opaque)
552
{
553
    VncState *vs = opaque;
554

    
555
    if (vs->need_update && vs->csock != -1) {
556
        int y;
557
        uint8_t *row;
558
        char *old_row;
559
        uint32_t width_mask[VNC_DIRTY_WORDS];
560
        int n_rectangles;
561
        int saved_offset;
562
        int has_dirty = 0;
563

    
564
        vga_hw_update();
565

    
566
        vnc_set_bits(width_mask, (vs->width / 16), VNC_DIRTY_WORDS);
567

    
568
        /* Walk through the dirty map and eliminate tiles that
569
           really aren't dirty */
570
        row = ds_get_data(vs->ds);
571
        old_row = vs->old_data;
572

    
573
        for (y = 0; y < vs->height; y++) {
574
            if (vnc_and_bits(vs->dirty_row[y], width_mask, VNC_DIRTY_WORDS)) {
575
                int x;
576
                uint8_t *ptr;
577
                char *old_ptr;
578

    
579
                ptr = row;
580
                old_ptr = (char*)old_row;
581

    
582
                for (x = 0; x < ds_get_width(vs->ds); x += 16) {
583
                    if (memcmp(old_ptr, ptr, 16 * vs->depth) == 0) {
584
                        vnc_clear_bit(vs->dirty_row[y], (x / 16));
585
                    } else {
586
                        has_dirty = 1;
587
                        memcpy(old_ptr, ptr, 16 * vs->depth);
588
                    }
589

    
590
                    ptr += 16 * vs->depth;
591
                    old_ptr += 16 * vs->depth;
592
                }
593
            }
594

    
595
            row += ds_get_linesize(vs->ds);
596
            old_row += ds_get_linesize(vs->ds);
597
        }
598

    
599
        if (!has_dirty && !vs->audio_cap) {
600
            qemu_mod_timer(vs->timer, qemu_get_clock(rt_clock) + VNC_REFRESH_INTERVAL);
601
            return;
602
        }
603

    
604
        /* Count rectangles */
605
        n_rectangles = 0;
606
        vnc_write_u8(vs, 0);  /* msg id */
607
        vnc_write_u8(vs, 0);
608
        saved_offset = vs->output.offset;
609
        vnc_write_u16(vs, 0);
610

    
611
        for (y = 0; y < vs->height; y++) {
612
            int x;
613
            int last_x = -1;
614
            for (x = 0; x < vs->width / 16; x++) {
615
                if (vnc_get_bit(vs->dirty_row[y], x)) {
616
                    if (last_x == -1) {
617
                        last_x = x;
618
                    }
619
                    vnc_clear_bit(vs->dirty_row[y], x);
620
                } else {
621
                    if (last_x != -1) {
622
                        int h = find_dirty_height(vs, y, last_x, x);
623
                        send_framebuffer_update(vs, last_x * 16, y, (x - last_x) * 16, h);
624
                        n_rectangles++;
625
                    }
626
                    last_x = -1;
627
                }
628
            }
629
            if (last_x != -1) {
630
                int h = find_dirty_height(vs, y, last_x, x);
631
                send_framebuffer_update(vs, last_x * 16, y, (x - last_x) * 16, h);
632
                n_rectangles++;
633
            }
634
        }
635
        vs->output.buffer[saved_offset] = (n_rectangles >> 8) & 0xFF;
636
        vs->output.buffer[saved_offset + 1] = n_rectangles & 0xFF;
637
        vnc_flush(vs);
638

    
639
    }
640

    
641
    if (vs->csock != -1) {
642
        qemu_mod_timer(vs->timer, qemu_get_clock(rt_clock) + VNC_REFRESH_INTERVAL);
643
    }
644

    
645
}
646

    
647
static int vnc_listen_poll(void *opaque)
648
{
649
    VncState *vs = opaque;
650
    if (vs->csock == -1)
651
        return 1;
652
    return 0;
653
}
654

    
655
static void buffer_reserve(Buffer *buffer, size_t len)
656
{
657
    if ((buffer->capacity - buffer->offset) < len) {
658
        buffer->capacity += (len + 1024);
659
        buffer->buffer = qemu_realloc(buffer->buffer, buffer->capacity);
660
        if (buffer->buffer == NULL) {
661
            fprintf(stderr, "vnc: out of memory\n");
662
            exit(1);
663
        }
664
    }
665
}
666

    
667
static int buffer_empty(Buffer *buffer)
668
{
669
    return buffer->offset == 0;
670
}
671

    
672
static uint8_t *buffer_end(Buffer *buffer)
673
{
674
    return buffer->buffer + buffer->offset;
675
}
676

    
677
static void buffer_reset(Buffer *buffer)
678
{
679
        buffer->offset = 0;
680
}
681

    
682
static void buffer_append(Buffer *buffer, const void *data, size_t len)
683
{
684
    memcpy(buffer->buffer + buffer->offset, data, len);
685
    buffer->offset += len;
686
}
687

    
688
/* audio */
689
static void audio_capture_notify(void *opaque, audcnotification_e cmd)
690
{
691
    VncState *vs = opaque;
692

    
693
    switch (cmd) {
694
    case AUD_CNOTIFY_DISABLE:
695
        vnc_write_u8(vs, 255);
696
        vnc_write_u8(vs, 1);
697
        vnc_write_u16(vs, 0);
698
        vnc_flush(vs);
699
        break;
700

    
701
    case AUD_CNOTIFY_ENABLE:
702
        vnc_write_u8(vs, 255);
703
        vnc_write_u8(vs, 1);
704
        vnc_write_u16(vs, 1);
705
        vnc_flush(vs);
706
        break;
707
    }
708
}
709

    
710
static void audio_capture_destroy(void *opaque)
711
{
712
}
713

    
714
static void audio_capture(void *opaque, void *buf, int size)
715
{
716
    VncState *vs = opaque;
717

    
718
    vnc_write_u8(vs, 255);
719
    vnc_write_u8(vs, 1);
720
    vnc_write_u16(vs, 2);
721
    vnc_write_u32(vs, size);
722
    vnc_write(vs, buf, size);
723
    vnc_flush(vs);
724
}
725

    
726
static void audio_add(VncState *vs)
727
{
728
    struct audio_capture_ops ops;
729

    
730
    if (vs->audio_cap) {
731
        term_printf ("audio already running\n");
732
        return;
733
    }
734

    
735
    ops.notify = audio_capture_notify;
736
    ops.destroy = audio_capture_destroy;
737
    ops.capture = audio_capture;
738

    
739
    vs->audio_cap = AUD_add_capture(NULL, &vs->as, &ops, vs);
740
    if (!vs->audio_cap) {
741
        term_printf ("Failed to add audio capture\n");
742
    }
743
}
744

    
745
static void audio_del(VncState *vs)
746
{
747
    if (vs->audio_cap) {
748
        AUD_del_capture(vs->audio_cap, vs);
749
        vs->audio_cap = NULL;
750
    }
751
}
752

    
753
static int vnc_client_io_error(VncState *vs, int ret, int last_errno)
754
{
755
    if (ret == 0 || ret == -1) {
756
        if (ret == -1) {
757
            switch (last_errno) {
758
                case EINTR:
759
                case EAGAIN:
760
#ifdef _WIN32
761
                case WSAEWOULDBLOCK:
762
#endif
763
                    return 0;
764
                default:
765
                    break;
766
            }
767
        }
768

    
769
        VNC_DEBUG("Closing down client sock %d %d\n", ret, ret < 0 ? last_errno : 0);
770
        qemu_set_fd_handler2(vs->csock, NULL, NULL, NULL, NULL);
771
        closesocket(vs->csock);
772
        vs->csock = -1;
773
        vs->ds->idle = 1;
774
        buffer_reset(&vs->input);
775
        buffer_reset(&vs->output);
776
        vs->need_update = 0;
777
#ifdef CONFIG_VNC_TLS
778
        if (vs->tls_session) {
779
            gnutls_deinit(vs->tls_session);
780
            vs->tls_session = NULL;
781
        }
782
        vs->wiremode = VNC_WIREMODE_CLEAR;
783
#endif /* CONFIG_VNC_TLS */
784
        audio_del(vs);
785
        return 0;
786
    }
787
    return ret;
788
}
789

    
790
static void vnc_client_error(VncState *vs)
791
{
792
    vnc_client_io_error(vs, -1, EINVAL);
793
}
794

    
795
static void vnc_client_write(void *opaque)
796
{
797
    long ret;
798
    VncState *vs = opaque;
799

    
800
#ifdef CONFIG_VNC_TLS
801
    if (vs->tls_session) {
802
        ret = gnutls_write(vs->tls_session, vs->output.buffer, vs->output.offset);
803
        if (ret < 0) {
804
            if (ret == GNUTLS_E_AGAIN)
805
                errno = EAGAIN;
806
            else
807
                errno = EIO;
808
            ret = -1;
809
        }
810
    } else
811
#endif /* CONFIG_VNC_TLS */
812
        ret = send(vs->csock, vs->output.buffer, vs->output.offset, 0);
813
    ret = vnc_client_io_error(vs, ret, socket_error());
814
    if (!ret)
815
        return;
816

    
817
    memmove(vs->output.buffer, vs->output.buffer + ret, (vs->output.offset - ret));
818
    vs->output.offset -= ret;
819

    
820
    if (vs->output.offset == 0) {
821
        qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
822
    }
823
}
824

    
825
static void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting)
826
{
827
    vs->read_handler = func;
828
    vs->read_handler_expect = expecting;
829
}
830

    
831
static void vnc_client_read(void *opaque)
832
{
833
    VncState *vs = opaque;
834
    long ret;
835

    
836
    buffer_reserve(&vs->input, 4096);
837

    
838
#ifdef CONFIG_VNC_TLS
839
    if (vs->tls_session) {
840
        ret = gnutls_read(vs->tls_session, buffer_end(&vs->input), 4096);
841
        if (ret < 0) {
842
            if (ret == GNUTLS_E_AGAIN)
843
                errno = EAGAIN;
844
            else
845
                errno = EIO;
846
            ret = -1;
847
        }
848
    } else
849
#endif /* CONFIG_VNC_TLS */
850
        ret = recv(vs->csock, buffer_end(&vs->input), 4096, 0);
851
    ret = vnc_client_io_error(vs, ret, socket_error());
852
    if (!ret)
853
        return;
854

    
855
    vs->input.offset += ret;
856

    
857
    while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) {
858
        size_t len = vs->read_handler_expect;
859
        int ret;
860

    
861
        ret = vs->read_handler(vs, vs->input.buffer, len);
862
        if (vs->csock == -1)
863
            return;
864

    
865
        if (!ret) {
866
            memmove(vs->input.buffer, vs->input.buffer + len, (vs->input.offset - len));
867
            vs->input.offset -= len;
868
        } else {
869
            vs->read_handler_expect = ret;
870
        }
871
    }
872
}
873

    
874
static void vnc_write(VncState *vs, const void *data, size_t len)
875
{
876
    buffer_reserve(&vs->output, len);
877

    
878
    if (buffer_empty(&vs->output)) {
879
        qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, vnc_client_write, vs);
880
    }
881

    
882
    buffer_append(&vs->output, data, len);
883
}
884

    
885
static void vnc_write_s32(VncState *vs, int32_t value)
886
{
887
    vnc_write_u32(vs, *(uint32_t *)&value);
888
}
889

    
890
static void vnc_write_u32(VncState *vs, uint32_t value)
891
{
892
    uint8_t buf[4];
893

    
894
    buf[0] = (value >> 24) & 0xFF;
895
    buf[1] = (value >> 16) & 0xFF;
896
    buf[2] = (value >>  8) & 0xFF;
897
    buf[3] = value & 0xFF;
898

    
899
    vnc_write(vs, buf, 4);
900
}
901

    
902
static void vnc_write_u16(VncState *vs, uint16_t value)
903
{
904
    uint8_t buf[2];
905

    
906
    buf[0] = (value >> 8) & 0xFF;
907
    buf[1] = value & 0xFF;
908

    
909
    vnc_write(vs, buf, 2);
910
}
911

    
912
static void vnc_write_u8(VncState *vs, uint8_t value)
913
{
914
    vnc_write(vs, (char *)&value, 1);
915
}
916

    
917
static void vnc_flush(VncState *vs)
918
{
919
    if (vs->output.offset)
920
        vnc_client_write(vs);
921
}
922

    
923
static uint8_t read_u8(uint8_t *data, size_t offset)
924
{
925
    return data[offset];
926
}
927

    
928
static uint16_t read_u16(uint8_t *data, size_t offset)
929
{
930
    return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF);
931
}
932

    
933
static int32_t read_s32(uint8_t *data, size_t offset)
934
{
935
    return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) |
936
                     (data[offset + 2] << 8) | data[offset + 3]);
937
}
938

    
939
static uint32_t read_u32(uint8_t *data, size_t offset)
940
{
941
    return ((data[offset] << 24) | (data[offset + 1] << 16) |
942
            (data[offset + 2] << 8) | data[offset + 3]);
943
}
944

    
945
#ifdef CONFIG_VNC_TLS
946
static ssize_t vnc_tls_push(gnutls_transport_ptr_t transport,
947
                            const void *data,
948
                            size_t len) {
949
    struct VncState *vs = (struct VncState *)transport;
950
    int ret;
951

    
952
 retry:
953
    ret = send(vs->csock, data, len, 0);
954
    if (ret < 0) {
955
        if (errno == EINTR)
956
            goto retry;
957
        return -1;
958
    }
959
    return ret;
960
}
961

    
962

    
963
static ssize_t vnc_tls_pull(gnutls_transport_ptr_t transport,
964
                            void *data,
965
                            size_t len) {
966
    struct VncState *vs = (struct VncState *)transport;
967
    int ret;
968

    
969
 retry:
970
    ret = recv(vs->csock, data, len, 0);
971
    if (ret < 0) {
972
        if (errno == EINTR)
973
            goto retry;
974
        return -1;
975
    }
976
    return ret;
977
}
978
#endif /* CONFIG_VNC_TLS */
979

    
980
static void client_cut_text(VncState *vs, size_t len, uint8_t *text)
981
{
982
}
983

    
984
static void check_pointer_type_change(VncState *vs, int absolute)
985
{
986
    if (vs->has_pointer_type_change && vs->absolute != absolute) {
987
        vnc_write_u8(vs, 0);
988
        vnc_write_u8(vs, 0);
989
        vnc_write_u16(vs, 1);
990
        vnc_framebuffer_update(vs, absolute, 0,
991
                               ds_get_width(vs->ds), ds_get_height(vs->ds), -257);
992
        vnc_flush(vs);
993
    }
994
    vs->absolute = absolute;
995
}
996

    
997
static void pointer_event(VncState *vs, int button_mask, int x, int y)
998
{
999
    int buttons = 0;
1000
    int dz = 0;
1001

    
1002
    if (button_mask & 0x01)
1003
        buttons |= MOUSE_EVENT_LBUTTON;
1004
    if (button_mask & 0x02)
1005
        buttons |= MOUSE_EVENT_MBUTTON;
1006
    if (button_mask & 0x04)
1007
        buttons |= MOUSE_EVENT_RBUTTON;
1008
    if (button_mask & 0x08)
1009
        dz = -1;
1010
    if (button_mask & 0x10)
1011
        dz = 1;
1012

    
1013
    if (vs->absolute) {
1014
        kbd_mouse_event(x * 0x7FFF / (ds_get_width(vs->ds) - 1),
1015
                        y * 0x7FFF / (ds_get_height(vs->ds) - 1),
1016
                        dz, buttons);
1017
    } else if (vs->has_pointer_type_change) {
1018
        x -= 0x7FFF;
1019
        y -= 0x7FFF;
1020

    
1021
        kbd_mouse_event(x, y, dz, buttons);
1022
    } else {
1023
        if (vs->last_x != -1)
1024
            kbd_mouse_event(x - vs->last_x,
1025
                            y - vs->last_y,
1026
                            dz, buttons);
1027
        vs->last_x = x;
1028
        vs->last_y = y;
1029
    }
1030

    
1031
    check_pointer_type_change(vs, kbd_mouse_is_absolute());
1032
}
1033

    
1034
static void reset_keys(VncState *vs)
1035
{
1036
    int i;
1037
    for(i = 0; i < 256; i++) {
1038
        if (vs->modifiers_state[i]) {
1039
            if (i & 0x80)
1040
                kbd_put_keycode(0xe0);
1041
            kbd_put_keycode(i | 0x80);
1042
            vs->modifiers_state[i] = 0;
1043
        }
1044
    }
1045
}
1046

    
1047
static void press_key(VncState *vs, int keysym)
1048
{
1049
    kbd_put_keycode(keysym2scancode(vs->kbd_layout, keysym) & 0x7f);
1050
    kbd_put_keycode(keysym2scancode(vs->kbd_layout, keysym) | 0x80);
1051
}
1052

    
1053
static void do_key_event(VncState *vs, int down, int keycode, int sym)
1054
{
1055
    /* QEMU console switch */
1056
    switch(keycode) {
1057
    case 0x2a:                          /* Left Shift */
1058
    case 0x36:                          /* Right Shift */
1059
    case 0x1d:                          /* Left CTRL */
1060
    case 0x9d:                          /* Right CTRL */
1061
    case 0x38:                          /* Left ALT */
1062
    case 0xb8:                          /* Right ALT */
1063
        if (down)
1064
            vs->modifiers_state[keycode] = 1;
1065
        else
1066
            vs->modifiers_state[keycode] = 0;
1067
        break;
1068
    case 0x02 ... 0x0a: /* '1' to '9' keys */
1069
        if (down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) {
1070
            /* Reset the modifiers sent to the current console */
1071
            reset_keys(vs);
1072
            console_select(keycode - 0x02);
1073
            return;
1074
        }
1075
        break;
1076
    case 0x3a:                        /* CapsLock */
1077
    case 0x45:                        /* NumLock */
1078
        if (!down)
1079
            vs->modifiers_state[keycode] ^= 1;
1080
        break;
1081
    }
1082

    
1083
    if (keycode_is_keypad(vs->kbd_layout, keycode)) {
1084
        /* If the numlock state needs to change then simulate an additional
1085
           keypress before sending this one.  This will happen if the user
1086
           toggles numlock away from the VNC window.
1087
        */
1088
        if (keysym_is_numlock(vs->kbd_layout, sym & 0xFFFF)) {
1089
            if (!vs->modifiers_state[0x45]) {
1090
                vs->modifiers_state[0x45] = 1;
1091
                press_key(vs, 0xff7f);
1092
            }
1093
        } else {
1094
            if (vs->modifiers_state[0x45]) {
1095
                vs->modifiers_state[0x45] = 0;
1096
                press_key(vs, 0xff7f);
1097
            }
1098
        }
1099
    }
1100

    
1101
    if (is_graphic_console()) {
1102
        if (keycode & 0x80)
1103
            kbd_put_keycode(0xe0);
1104
        if (down)
1105
            kbd_put_keycode(keycode & 0x7f);
1106
        else
1107
            kbd_put_keycode(keycode | 0x80);
1108
    } else {
1109
        /* QEMU console emulation */
1110
        if (down) {
1111
            switch (keycode) {
1112
            case 0x2a:                          /* Left Shift */
1113
            case 0x36:                          /* Right Shift */
1114
            case 0x1d:                          /* Left CTRL */
1115
            case 0x9d:                          /* Right CTRL */
1116
            case 0x38:                          /* Left ALT */
1117
            case 0xb8:                          /* Right ALT */
1118
                break;
1119
            case 0xc8:
1120
                kbd_put_keysym(QEMU_KEY_UP);
1121
                break;
1122
            case 0xd0:
1123
                kbd_put_keysym(QEMU_KEY_DOWN);
1124
                break;
1125
            case 0xcb:
1126
                kbd_put_keysym(QEMU_KEY_LEFT);
1127
                break;
1128
            case 0xcd:
1129
                kbd_put_keysym(QEMU_KEY_RIGHT);
1130
                break;
1131
            case 0xd3:
1132
                kbd_put_keysym(QEMU_KEY_DELETE);
1133
                break;
1134
            case 0xc7:
1135
                kbd_put_keysym(QEMU_KEY_HOME);
1136
                break;
1137
            case 0xcf:
1138
                kbd_put_keysym(QEMU_KEY_END);
1139
                break;
1140
            case 0xc9:
1141
                kbd_put_keysym(QEMU_KEY_PAGEUP);
1142
                break;
1143
            case 0xd1:
1144
                kbd_put_keysym(QEMU_KEY_PAGEDOWN);
1145
                break;
1146
            default:
1147
                kbd_put_keysym(sym);
1148
                break;
1149
            }
1150
        }
1151
    }
1152
}
1153

    
1154
static void key_event(VncState *vs, int down, uint32_t sym)
1155
{
1156
    int keycode;
1157

    
1158
    if (sym >= 'A' && sym <= 'Z' && is_graphic_console())
1159
        sym = sym - 'A' + 'a';
1160

    
1161
    keycode = keysym2scancode(vs->kbd_layout, sym & 0xFFFF);
1162
    do_key_event(vs, down, keycode, sym);
1163
}
1164

    
1165
static void ext_key_event(VncState *vs, int down,
1166
                          uint32_t sym, uint16_t keycode)
1167
{
1168
    /* if the user specifies a keyboard layout, always use it */
1169
    if (keyboard_layout)
1170
        key_event(vs, down, sym);
1171
    else
1172
        do_key_event(vs, down, keycode, sym);
1173
}
1174

    
1175
static void framebuffer_update_request(VncState *vs, int incremental,
1176
                                       int x_position, int y_position,
1177
                                       int w, int h)
1178
{
1179
    if (x_position > ds_get_width(vs->ds))
1180
        x_position = ds_get_width(vs->ds);
1181
    if (y_position > ds_get_height(vs->ds))
1182
        y_position = ds_get_height(vs->ds);
1183
    if (x_position + w >= ds_get_width(vs->ds))
1184
        w = ds_get_width(vs->ds)  - x_position;
1185
    if (y_position + h >= ds_get_height(vs->ds))
1186
        h = ds_get_height(vs->ds) - y_position;
1187

    
1188
    int i;
1189
    vs->need_update = 1;
1190
    if (!incremental) {
1191
        char *old_row = vs->old_data + y_position * ds_get_linesize(vs->ds);
1192

    
1193
        for (i = 0; i < h; i++) {
1194
            vnc_set_bits(vs->dirty_row[y_position + i],
1195
                         (ds_get_width(vs->ds) / 16), VNC_DIRTY_WORDS);
1196
            memset(old_row, 42, ds_get_width(vs->ds) * vs->depth);
1197
            old_row += ds_get_linesize(vs->ds);
1198
        }
1199
    }
1200
}
1201

    
1202
static void send_ext_key_event_ack(VncState *vs)
1203
{
1204
    vnc_write_u8(vs, 0);
1205
    vnc_write_u8(vs, 0);
1206
    vnc_write_u16(vs, 1);
1207
    vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds), -258);
1208
    vnc_flush(vs);
1209
}
1210

    
1211
static void send_ext_audio_ack(VncState *vs)
1212
{
1213
    vnc_write_u8(vs, 0);
1214
    vnc_write_u8(vs, 0);
1215
    vnc_write_u16(vs, 1);
1216
    vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds), -259);
1217
    vnc_flush(vs);
1218
}
1219

    
1220
static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
1221
{
1222
    int i;
1223

    
1224
    vs->has_hextile = 0;
1225
    vs->has_resize = 0;
1226
    vs->has_pointer_type_change = 0;
1227
    vs->has_WMVi = 0;
1228
    vs->absolute = -1;
1229
    vs->ds->dpy_copy = NULL;
1230

    
1231
    for (i = n_encodings - 1; i >= 0; i--) {
1232
        switch (encodings[i]) {
1233
        case 0: /* Raw */
1234
            vs->has_hextile = 0;
1235
            break;
1236
        case 1: /* CopyRect */
1237
            vs->ds->dpy_copy = vnc_copy;
1238
            break;
1239
        case 5: /* Hextile */
1240
            vs->has_hextile = 1;
1241
            break;
1242
        case -223: /* DesktopResize */
1243
            vs->has_resize = 1;
1244
            break;
1245
        case -257:
1246
            vs->has_pointer_type_change = 1;
1247
            break;
1248
        case -258:
1249
            send_ext_key_event_ack(vs);
1250
            break;
1251
        case -259:
1252
            send_ext_audio_ack(vs);
1253
            break;
1254
        case 0x574D5669:
1255
            vs->has_WMVi = 1;
1256
            break;
1257
        default:
1258
            break;
1259
        }
1260
    }
1261

    
1262
    check_pointer_type_change(vs, kbd_mouse_is_absolute());
1263
}
1264

    
1265
static void set_pixel_format(VncState *vs,
1266
                             int bits_per_pixel, int depth,
1267
                             int big_endian_flag, int true_color_flag,
1268
                             int red_max, int green_max, int blue_max,
1269
                             int red_shift, int green_shift, int blue_shift)
1270
{
1271
    int host_big_endian_flag;
1272

    
1273
#ifdef WORDS_BIGENDIAN
1274
    host_big_endian_flag = 1;
1275
#else
1276
    host_big_endian_flag = 0;
1277
#endif
1278
    if (!true_color_flag) {
1279
    fail:
1280
        vnc_client_error(vs);
1281
        return;
1282
    }
1283
    if (bits_per_pixel == 32 &&
1284
        bits_per_pixel == vs->depth * 8 &&
1285
        host_big_endian_flag == big_endian_flag &&
1286
        red_max == 0xff && green_max == 0xff && blue_max == 0xff &&
1287
        red_shift == 16 && green_shift == 8 && blue_shift == 0) {
1288
        vs->depth = 4;
1289
        vs->write_pixels = vnc_write_pixels_copy;
1290
        vs->send_hextile_tile = send_hextile_tile_32;
1291
    } else
1292
    if (bits_per_pixel == 16 &&
1293
        bits_per_pixel == vs->depth * 8 && 
1294
        host_big_endian_flag == big_endian_flag &&
1295
        red_max == 31 && green_max == 63 && blue_max == 31 &&
1296
        red_shift == 11 && green_shift == 5 && blue_shift == 0) {
1297
        vs->depth = 2;
1298
        vs->write_pixels = vnc_write_pixels_copy;
1299
        vs->send_hextile_tile = send_hextile_tile_16;
1300
    } else
1301
    if (bits_per_pixel == 8 &&
1302
        bits_per_pixel == vs->depth * 8 &&
1303
        red_max == 7 && green_max == 7 && blue_max == 3 &&
1304
        red_shift == 5 && green_shift == 2 && blue_shift == 0) {
1305
        vs->depth = 1;
1306
        vs->write_pixels = vnc_write_pixels_copy;
1307
        vs->send_hextile_tile = send_hextile_tile_8;
1308
    } else
1309
    {
1310
        /* generic and slower case */
1311
        if (bits_per_pixel != 8 &&
1312
            bits_per_pixel != 16 &&
1313
            bits_per_pixel != 32)
1314
            goto fail;
1315
        if (vs->depth == 4) {
1316
            vs->send_hextile_tile = send_hextile_tile_generic_32;
1317
        } else if (vs->depth == 2) {
1318
           vs->send_hextile_tile = send_hextile_tile_generic_16;
1319
        } else {
1320
            vs->send_hextile_tile = send_hextile_tile_generic_8;
1321
        }
1322

    
1323
        vs->pix_big_endian = big_endian_flag;
1324
        vs->write_pixels = vnc_write_pixels_generic;
1325
    }
1326

    
1327
    vs->client_red_shift = red_shift;
1328
    vs->client_red_max = red_max;
1329
    vs->client_green_shift = green_shift;
1330
    vs->client_green_max = green_max;
1331
    vs->client_blue_shift = blue_shift;
1332
    vs->client_blue_max = blue_max;
1333
    vs->pix_bpp = bits_per_pixel / 8;
1334

    
1335
    vga_hw_invalidate();
1336
    vga_hw_update();
1337
}
1338

    
1339
static void pixel_format_message (VncState *vs) {
1340
    char pad[3] = { 0, 0, 0 };
1341

    
1342
    vnc_write_u8(vs, vs->depth * 8); /* bits-per-pixel */
1343
    if (vs->depth == 4) vnc_write_u8(vs, 24); /* depth */
1344
    else vnc_write_u8(vs, vs->depth * 8); /* depth */
1345

    
1346
#ifdef WORDS_BIGENDIAN
1347
    vnc_write_u8(vs, 1);             /* big-endian-flag */
1348
#else
1349
    vnc_write_u8(vs, 0);             /* big-endian-flag */
1350
#endif
1351
    vnc_write_u8(vs, 1);             /* true-color-flag */
1352
    if (vs->depth == 4) {
1353
        vnc_write_u16(vs, 0xFF);     /* red-max */
1354
        vnc_write_u16(vs, 0xFF);     /* green-max */
1355
        vnc_write_u16(vs, 0xFF);     /* blue-max */
1356
        vnc_write_u8(vs, 16);        /* red-shift */
1357
        vnc_write_u8(vs, 8);         /* green-shift */
1358
        vnc_write_u8(vs, 0);         /* blue-shift */
1359
        vs->send_hextile_tile = send_hextile_tile_32;
1360
    } else if (vs->depth == 2) {
1361
        vnc_write_u16(vs, 31);       /* red-max */
1362
        vnc_write_u16(vs, 63);       /* green-max */
1363
        vnc_write_u16(vs, 31);       /* blue-max */
1364
        vnc_write_u8(vs, 11);        /* red-shift */
1365
        vnc_write_u8(vs, 5);         /* green-shift */
1366
        vnc_write_u8(vs, 0);         /* blue-shift */
1367
        vs->send_hextile_tile = send_hextile_tile_16;
1368
    } else if (vs->depth == 1) {
1369
        /* XXX: change QEMU pixel 8 bit pixel format to match the VNC one ? */
1370
        vnc_write_u16(vs, 7);        /* red-max */
1371
        vnc_write_u16(vs, 7);        /* green-max */
1372
        vnc_write_u16(vs, 3);        /* blue-max */
1373
        vnc_write_u8(vs, 5);         /* red-shift */
1374
        vnc_write_u8(vs, 2);         /* green-shift */
1375
        vnc_write_u8(vs, 0);         /* blue-shift */
1376
        vs->send_hextile_tile = send_hextile_tile_8;
1377
    }
1378
    vs->client_red_max = vs->server_red_max;
1379
    vs->client_green_max = vs->server_green_max;
1380
    vs->client_blue_max = vs->server_blue_max;
1381
    vs->client_red_shift = vs->server_red_shift;
1382
    vs->client_green_shift = vs->server_green_shift;
1383
    vs->client_blue_shift = vs->server_blue_shift;
1384
    vs->pix_bpp = vs->depth * 8;
1385
    vs->write_pixels = vnc_write_pixels_copy;
1386

    
1387
    vnc_write(vs, pad, 3);           /* padding */
1388
}
1389

    
1390
static void vnc_colordepth(DisplayState *ds, int depth)
1391
{
1392
    int host_big_endian_flag;
1393
    struct VncState *vs = ds->opaque;
1394

    
1395
    switch (depth) {
1396
        case 24:
1397
            if (ds->depth == 32) return;
1398
            depth = 32;
1399
            break;
1400
        case 15:
1401
        case 8:
1402
        case 0:
1403
            return;
1404
        default:
1405
            break;
1406
    }
1407

    
1408
#ifdef WORDS_BIGENDIAN
1409
    host_big_endian_flag = 1;
1410
#else
1411
    host_big_endian_flag = 0;
1412
#endif   
1413
    
1414
    switch (depth) {
1415
        case 8:
1416
            vs->depth = depth / 8;
1417
            vs->server_red_max = 7;
1418
            vs->server_green_max = 7;
1419
            vs->server_blue_max = 3;
1420
            vs->server_red_shift = 5;
1421
            vs->server_green_shift = 2;
1422
            vs->server_blue_shift = 0;
1423
            break;
1424
        case 16:
1425
            vs->depth = depth / 8;
1426
            vs->server_red_max = 31;
1427
            vs->server_green_max = 63;
1428
            vs->server_blue_max = 31;
1429
            vs->server_red_shift = 11;
1430
            vs->server_green_shift = 5;
1431
            vs->server_blue_shift = 0;
1432
            break;
1433
        case 32:
1434
            vs->depth = 4;
1435
            vs->server_red_max = 255;
1436
            vs->server_green_max = 255;
1437
            vs->server_blue_max = 255;
1438
            vs->server_red_shift = 16;
1439
            vs->server_green_shift = 8;
1440
            vs->server_blue_shift = 0;
1441
            break;
1442
        default:
1443
            return;
1444
    }
1445

    
1446
    if (vs->csock != -1 && vs->has_WMVi) {
1447
        /* Sending a WMVi message to notify the client*/
1448
        vnc_write_u8(vs, 0);  /* msg id */
1449
        vnc_write_u8(vs, 0);
1450
        vnc_write_u16(vs, 1); /* number of rects */
1451
        vnc_framebuffer_update(vs, 0, 0, ds->width, ds->height, 0x574D5669);
1452
        pixel_format_message(vs);
1453
        vnc_flush(vs);
1454
    } else {
1455
        if (vs->pix_bpp == 4 && vs->depth == 4 &&
1456
                host_big_endian_flag == vs->pix_big_endian &&
1457
                vs->client_red_max == 0xff && vs->client_green_max == 0xff && vs->client_blue_max == 0xff &&
1458
                vs->client_red_shift == 16 && vs->client_green_shift == 8 && vs->client_blue_shift == 0) {
1459
            vs->write_pixels = vnc_write_pixels_copy;
1460
            vs->send_hextile_tile = send_hextile_tile_32;
1461
        } else if (vs->pix_bpp == 2 && vs->depth == 2 &&
1462
                host_big_endian_flag == vs->pix_big_endian &&
1463
                vs->client_red_max == 31 && vs->client_green_max == 63 && vs->client_blue_max == 31 &&
1464
                vs->client_red_shift == 11 && vs->client_green_shift == 5 && vs->client_blue_shift == 0) {
1465
            vs->write_pixels = vnc_write_pixels_copy;
1466
            vs->send_hextile_tile = send_hextile_tile_16;
1467
        } else if (vs->pix_bpp == 1 && vs->depth == 1 &&
1468
                host_big_endian_flag == vs->pix_big_endian &&
1469
                vs->client_red_max == 7 && vs->client_green_max == 7 && vs->client_blue_max == 3 &&
1470
                vs->client_red_shift == 5 && vs->client_green_shift == 2 && vs->client_blue_shift == 0) {
1471
            vs->write_pixels = vnc_write_pixels_copy;
1472
            vs->send_hextile_tile = send_hextile_tile_8;
1473
        } else {
1474
            if (vs->depth == 4) {
1475
                vs->send_hextile_tile = send_hextile_tile_generic_32;
1476
            } else if (vs->depth == 2) {
1477
                vs->send_hextile_tile = send_hextile_tile_generic_16;
1478
            } else {
1479
                vs->send_hextile_tile = send_hextile_tile_generic_8;
1480
            }
1481
            vs->write_pixels = vnc_write_pixels_generic;
1482
        }
1483
    }
1484
}
1485

    
1486
static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
1487
{
1488
    int i;
1489
    uint16_t limit;
1490

    
1491
    switch (data[0]) {
1492
    case 0:
1493
        if (len == 1)
1494
            return 20;
1495

    
1496
        set_pixel_format(vs, read_u8(data, 4), read_u8(data, 5),
1497
                         read_u8(data, 6), read_u8(data, 7),
1498
                         read_u16(data, 8), read_u16(data, 10),
1499
                         read_u16(data, 12), read_u8(data, 14),
1500
                         read_u8(data, 15), read_u8(data, 16));
1501
        break;
1502
    case 2:
1503
        if (len == 1)
1504
            return 4;
1505

    
1506
        if (len == 4) {
1507
            limit = read_u16(data, 2);
1508
            if (limit > 0)
1509
                return 4 + (limit * 4);
1510
        } else
1511
            limit = read_u16(data, 2);
1512

    
1513
        for (i = 0; i < limit; i++) {
1514
            int32_t val = read_s32(data, 4 + (i * 4));
1515
            memcpy(data + 4 + (i * 4), &val, sizeof(val));
1516
        }
1517

    
1518
        set_encodings(vs, (int32_t *)(data + 4), limit);
1519
        break;
1520
    case 3:
1521
        if (len == 1)
1522
            return 10;
1523

    
1524
        framebuffer_update_request(vs,
1525
                                   read_u8(data, 1), read_u16(data, 2), read_u16(data, 4),
1526
                                   read_u16(data, 6), read_u16(data, 8));
1527
        break;
1528
    case 4:
1529
        if (len == 1)
1530
            return 8;
1531

    
1532
        key_event(vs, read_u8(data, 1), read_u32(data, 4));
1533
        break;
1534
    case 5:
1535
        if (len == 1)
1536
            return 6;
1537

    
1538
        pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
1539
        break;
1540
    case 6:
1541
        if (len == 1)
1542
            return 8;
1543

    
1544
        if (len == 8) {
1545
            uint32_t dlen = read_u32(data, 4);
1546
            if (dlen > 0)
1547
                return 8 + dlen;
1548
        }
1549

    
1550
        client_cut_text(vs, read_u32(data, 4), data + 8);
1551
        break;
1552
    case 255:
1553
        if (len == 1)
1554
            return 2;
1555

    
1556
        switch (read_u8(data, 1)) {
1557
        case 0:
1558
            if (len == 2)
1559
                return 12;
1560

    
1561
            ext_key_event(vs, read_u16(data, 2),
1562
                          read_u32(data, 4), read_u32(data, 8));
1563
            break;
1564
        case 1:
1565
            if (len == 2)
1566
                return 4;
1567

    
1568
            switch (read_u16 (data, 2)) {
1569
            case 0:
1570
                audio_add(vs);
1571
                break;
1572
            case 1:
1573
                audio_del(vs);
1574
                break;
1575
            case 2:
1576
                if (len == 4)
1577
                    return 10;
1578
                switch (read_u8(data, 4)) {
1579
                case 0: vs->as.fmt = AUD_FMT_U8; break;
1580
                case 1: vs->as.fmt = AUD_FMT_S8; break;
1581
                case 2: vs->as.fmt = AUD_FMT_U16; break;
1582
                case 3: vs->as.fmt = AUD_FMT_S16; break;
1583
                case 4: vs->as.fmt = AUD_FMT_U32; break;
1584
                case 5: vs->as.fmt = AUD_FMT_S32; break;
1585
                default:
1586
                    printf("Invalid audio format %d\n", read_u8(data, 4));
1587
                    vnc_client_error(vs);
1588
                    break;
1589
                }
1590
                vs->as.nchannels = read_u8(data, 5);
1591
                if (vs->as.nchannels != 1 && vs->as.nchannels != 2) {
1592
                    printf("Invalid audio channel coount %d\n",
1593
                           read_u8(data, 5));
1594
                    vnc_client_error(vs);
1595
                    break;
1596
                }
1597
                vs->as.freq = read_u32(data, 6);
1598
                break;
1599
            default:
1600
                printf ("Invalid audio message %d\n", read_u8(data, 4));
1601
                vnc_client_error(vs);
1602
                break;
1603
            }
1604
            break;
1605

    
1606
        default:
1607
            printf("Msg: %d\n", read_u16(data, 0));
1608
            vnc_client_error(vs);
1609
            break;
1610
        }
1611
        break;
1612
    default:
1613
        printf("Msg: %d\n", data[0]);
1614
        vnc_client_error(vs);
1615
        break;
1616
    }
1617

    
1618
    vnc_read_when(vs, protocol_client_msg, 1);
1619
    return 0;
1620
}
1621

    
1622
static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
1623
{
1624
    char buf[1024];
1625
    int size;
1626

    
1627
    vs->width = ds_get_width(vs->ds);
1628
    vs->height = ds_get_height(vs->ds);
1629
    vnc_write_u16(vs, ds_get_width(vs->ds));
1630
    vnc_write_u16(vs, ds_get_height(vs->ds));
1631

    
1632
    pixel_format_message(vs);
1633

    
1634
    if (qemu_name)
1635
        size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
1636
    else
1637
        size = snprintf(buf, sizeof(buf), "QEMU");
1638

    
1639
    vnc_write_u32(vs, size);
1640
    vnc_write(vs, buf, size);
1641
    vnc_flush(vs);
1642

    
1643
    vnc_read_when(vs, protocol_client_msg, 1);
1644

    
1645
    return 0;
1646
}
1647

    
1648
static void make_challenge(VncState *vs)
1649
{
1650
    int i;
1651

    
1652
    srand(time(NULL)+getpid()+getpid()*987654+rand());
1653

    
1654
    for (i = 0 ; i < sizeof(vs->challenge) ; i++)
1655
        vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
1656
}
1657

    
1658
static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
1659
{
1660
    unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
1661
    int i, j, pwlen;
1662
    unsigned char key[8];
1663

    
1664
    if (!vs->password || !vs->password[0]) {
1665
        VNC_DEBUG("No password configured on server");
1666
        vnc_write_u32(vs, 1); /* Reject auth */
1667
        if (vs->minor >= 8) {
1668
            static const char err[] = "Authentication failed";
1669
            vnc_write_u32(vs, sizeof(err));
1670
            vnc_write(vs, err, sizeof(err));
1671
        }
1672
        vnc_flush(vs);
1673
        vnc_client_error(vs);
1674
        return 0;
1675
    }
1676

    
1677
    memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
1678

    
1679
    /* Calculate the expected challenge response */
1680
    pwlen = strlen(vs->password);
1681
    for (i=0; i<sizeof(key); i++)
1682
        key[i] = i<pwlen ? vs->password[i] : 0;
1683
    deskey(key, EN0);
1684
    for (j = 0; j < VNC_AUTH_CHALLENGE_SIZE; j += 8)
1685
        des(response+j, response+j);
1686

    
1687
    /* Compare expected vs actual challenge response */
1688
    if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) {
1689
        VNC_DEBUG("Client challenge reponse did not match\n");
1690
        vnc_write_u32(vs, 1); /* Reject auth */
1691
        if (vs->minor >= 8) {
1692
            static const char err[] = "Authentication failed";
1693
            vnc_write_u32(vs, sizeof(err));
1694
            vnc_write(vs, err, sizeof(err));
1695
        }
1696
        vnc_flush(vs);
1697
        vnc_client_error(vs);
1698
    } else {
1699
        VNC_DEBUG("Accepting VNC challenge response\n");
1700
        vnc_write_u32(vs, 0); /* Accept auth */
1701
        vnc_flush(vs);
1702

    
1703
        vnc_read_when(vs, protocol_client_init, 1);
1704
    }
1705
    return 0;
1706
}
1707

    
1708
static int start_auth_vnc(VncState *vs)
1709
{
1710
    make_challenge(vs);
1711
    /* Send client a 'random' challenge */
1712
    vnc_write(vs, vs->challenge, sizeof(vs->challenge));
1713
    vnc_flush(vs);
1714

    
1715
    vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge));
1716
    return 0;
1717
}
1718

    
1719

    
1720
#ifdef CONFIG_VNC_TLS
1721
#define DH_BITS 1024
1722
static gnutls_dh_params_t dh_params;
1723

    
1724
static int vnc_tls_initialize(void)
1725
{
1726
    static int tlsinitialized = 0;
1727

    
1728
    if (tlsinitialized)
1729
        return 1;
1730

    
1731
    if (gnutls_global_init () < 0)
1732
        return 0;
1733

    
1734
    /* XXX ought to re-generate diffie-hellmen params periodically */
1735
    if (gnutls_dh_params_init (&dh_params) < 0)
1736
        return 0;
1737
    if (gnutls_dh_params_generate2 (dh_params, DH_BITS) < 0)
1738
        return 0;
1739

    
1740
#if defined(_VNC_DEBUG) && _VNC_DEBUG >= 2
1741
    gnutls_global_set_log_level(10);
1742
    gnutls_global_set_log_function(vnc_debug_gnutls_log);
1743
#endif
1744

    
1745
    tlsinitialized = 1;
1746

    
1747
    return 1;
1748
}
1749

    
1750
static gnutls_anon_server_credentials vnc_tls_initialize_anon_cred(void)
1751
{
1752
    gnutls_anon_server_credentials anon_cred;
1753
    int ret;
1754

    
1755
    if ((ret = gnutls_anon_allocate_server_credentials(&anon_cred)) < 0) {
1756
        VNC_DEBUG("Cannot allocate credentials %s\n", gnutls_strerror(ret));
1757
        return NULL;
1758
    }
1759

    
1760
    gnutls_anon_set_server_dh_params(anon_cred, dh_params);
1761

    
1762
    return anon_cred;
1763
}
1764

    
1765

    
1766
static gnutls_certificate_credentials_t vnc_tls_initialize_x509_cred(VncState *vs)
1767
{
1768
    gnutls_certificate_credentials_t x509_cred;
1769
    int ret;
1770

    
1771
    if (!vs->x509cacert) {
1772
        VNC_DEBUG("No CA x509 certificate specified\n");
1773
        return NULL;
1774
    }
1775
    if (!vs->x509cert) {
1776
        VNC_DEBUG("No server x509 certificate specified\n");
1777
        return NULL;
1778
    }
1779
    if (!vs->x509key) {
1780
        VNC_DEBUG("No server private key specified\n");
1781
        return NULL;
1782
    }
1783

    
1784
    if ((ret = gnutls_certificate_allocate_credentials(&x509_cred)) < 0) {
1785
        VNC_DEBUG("Cannot allocate credentials %s\n", gnutls_strerror(ret));
1786
        return NULL;
1787
    }
1788
    if ((ret = gnutls_certificate_set_x509_trust_file(x509_cred,
1789
                                                      vs->x509cacert,
1790
                                                      GNUTLS_X509_FMT_PEM)) < 0) {
1791
        VNC_DEBUG("Cannot load CA certificate %s\n", gnutls_strerror(ret));
1792
        gnutls_certificate_free_credentials(x509_cred);
1793
        return NULL;
1794
    }
1795

    
1796
    if ((ret = gnutls_certificate_set_x509_key_file (x509_cred,
1797
                                                     vs->x509cert,
1798
                                                     vs->x509key,
1799
                                                     GNUTLS_X509_FMT_PEM)) < 0) {
1800
        VNC_DEBUG("Cannot load certificate & key %s\n", gnutls_strerror(ret));
1801
        gnutls_certificate_free_credentials(x509_cred);
1802
        return NULL;
1803
    }
1804

    
1805
    if (vs->x509cacrl) {
1806
        if ((ret = gnutls_certificate_set_x509_crl_file(x509_cred,
1807
                                                        vs->x509cacrl,
1808
                                                        GNUTLS_X509_FMT_PEM)) < 0) {
1809
            VNC_DEBUG("Cannot load CRL %s\n", gnutls_strerror(ret));
1810
            gnutls_certificate_free_credentials(x509_cred);
1811
            return NULL;
1812
        }
1813
    }
1814

    
1815
    gnutls_certificate_set_dh_params (x509_cred, dh_params);
1816

    
1817
    return x509_cred;
1818
}
1819

    
1820
static int vnc_validate_certificate(struct VncState *vs)
1821
{
1822
    int ret;
1823
    unsigned int status;
1824
    const gnutls_datum_t *certs;
1825
    unsigned int nCerts, i;
1826
    time_t now;
1827

    
1828
    VNC_DEBUG("Validating client certificate\n");
1829
    if ((ret = gnutls_certificate_verify_peers2 (vs->tls_session, &status)) < 0) {
1830
        VNC_DEBUG("Verify failed %s\n", gnutls_strerror(ret));
1831
        return -1;
1832
    }
1833

    
1834
    if ((now = time(NULL)) == ((time_t)-1)) {
1835
        return -1;
1836
    }
1837

    
1838
    if (status != 0) {
1839
        if (status & GNUTLS_CERT_INVALID)
1840
            VNC_DEBUG("The certificate is not trusted.\n");
1841

    
1842
        if (status & GNUTLS_CERT_SIGNER_NOT_FOUND)
1843
            VNC_DEBUG("The certificate hasn't got a known issuer.\n");
1844

    
1845
        if (status & GNUTLS_CERT_REVOKED)
1846
            VNC_DEBUG("The certificate has been revoked.\n");
1847

    
1848
        if (status & GNUTLS_CERT_INSECURE_ALGORITHM)
1849
            VNC_DEBUG("The certificate uses an insecure algorithm\n");
1850

    
1851
        return -1;
1852
    } else {
1853
        VNC_DEBUG("Certificate is valid!\n");
1854
    }
1855

    
1856
    /* Only support x509 for now */
1857
    if (gnutls_certificate_type_get(vs->tls_session) != GNUTLS_CRT_X509)
1858
        return -1;
1859

    
1860
    if (!(certs = gnutls_certificate_get_peers(vs->tls_session, &nCerts)))
1861
        return -1;
1862

    
1863
    for (i = 0 ; i < nCerts ; i++) {
1864
        gnutls_x509_crt_t cert;
1865
        VNC_DEBUG ("Checking certificate chain %d\n", i);
1866
        if (gnutls_x509_crt_init (&cert) < 0)
1867
            return -1;
1868

    
1869
        if (gnutls_x509_crt_import(cert, &certs[i], GNUTLS_X509_FMT_DER) < 0) {
1870
            gnutls_x509_crt_deinit (cert);
1871
            return -1;
1872
        }
1873

    
1874
        if (gnutls_x509_crt_get_expiration_time (cert) < now) {
1875
            VNC_DEBUG("The certificate has expired\n");
1876
            gnutls_x509_crt_deinit (cert);
1877
            return -1;
1878
        }
1879

    
1880
        if (gnutls_x509_crt_get_activation_time (cert) > now) {
1881
            VNC_DEBUG("The certificate is not yet activated\n");
1882
            gnutls_x509_crt_deinit (cert);
1883
            return -1;
1884
        }
1885

    
1886
        if (gnutls_x509_crt_get_activation_time (cert) > now) {
1887
            VNC_DEBUG("The certificate is not yet activated\n");
1888
            gnutls_x509_crt_deinit (cert);
1889
            return -1;
1890
        }
1891

    
1892
        gnutls_x509_crt_deinit (cert);
1893
    }
1894

    
1895
    return 0;
1896
}
1897

    
1898

    
1899
static int start_auth_vencrypt_subauth(VncState *vs)
1900
{
1901
    switch (vs->subauth) {
1902
    case VNC_AUTH_VENCRYPT_TLSNONE:
1903
    case VNC_AUTH_VENCRYPT_X509NONE:
1904
       VNC_DEBUG("Accept TLS auth none\n");
1905
       vnc_write_u32(vs, 0); /* Accept auth completion */
1906
       vnc_read_when(vs, protocol_client_init, 1);
1907
       break;
1908

    
1909
    case VNC_AUTH_VENCRYPT_TLSVNC:
1910
    case VNC_AUTH_VENCRYPT_X509VNC:
1911
       VNC_DEBUG("Start TLS auth VNC\n");
1912
       return start_auth_vnc(vs);
1913

    
1914
    default: /* Should not be possible, but just in case */
1915
       VNC_DEBUG("Reject auth %d\n", vs->auth);
1916
       vnc_write_u8(vs, 1);
1917
       if (vs->minor >= 8) {
1918
           static const char err[] = "Unsupported authentication type";
1919
           vnc_write_u32(vs, sizeof(err));
1920
           vnc_write(vs, err, sizeof(err));
1921
       }
1922
       vnc_client_error(vs);
1923
    }
1924

    
1925
    return 0;
1926
}
1927

    
1928
static void vnc_handshake_io(void *opaque);
1929

    
1930
static int vnc_continue_handshake(struct VncState *vs) {
1931
    int ret;
1932

    
1933
    if ((ret = gnutls_handshake(vs->tls_session)) < 0) {
1934
       if (!gnutls_error_is_fatal(ret)) {
1935
           VNC_DEBUG("Handshake interrupted (blocking)\n");
1936
           if (!gnutls_record_get_direction(vs->tls_session))
1937
               qemu_set_fd_handler(vs->csock, vnc_handshake_io, NULL, vs);
1938
           else
1939
               qemu_set_fd_handler(vs->csock, NULL, vnc_handshake_io, vs);
1940
           return 0;
1941
       }
1942
       VNC_DEBUG("Handshake failed %s\n", gnutls_strerror(ret));
1943
       vnc_client_error(vs);
1944
       return -1;
1945
    }
1946

    
1947
    if (vs->x509verify) {
1948
        if (vnc_validate_certificate(vs) < 0) {
1949
            VNC_DEBUG("Client verification failed\n");
1950
            vnc_client_error(vs);
1951
            return -1;
1952
        } else {
1953
            VNC_DEBUG("Client verification passed\n");
1954
        }
1955
    }
1956

    
1957
    VNC_DEBUG("Handshake done, switching to TLS data mode\n");
1958
    vs->wiremode = VNC_WIREMODE_TLS;
1959
    qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, vnc_client_write, vs);
1960

    
1961
    return start_auth_vencrypt_subauth(vs);
1962
}
1963

    
1964
static void vnc_handshake_io(void *opaque) {
1965
    struct VncState *vs = (struct VncState *)opaque;
1966

    
1967
    VNC_DEBUG("Handshake IO continue\n");
1968
    vnc_continue_handshake(vs);
1969
}
1970

    
1971
#define NEED_X509_AUTH(vs)                              \
1972
    ((vs)->subauth == VNC_AUTH_VENCRYPT_X509NONE ||   \
1973
     (vs)->subauth == VNC_AUTH_VENCRYPT_X509VNC ||    \
1974
     (vs)->subauth == VNC_AUTH_VENCRYPT_X509PLAIN)
1975

    
1976

    
1977
static int vnc_start_tls(struct VncState *vs) {
1978
    static const int cert_type_priority[] = { GNUTLS_CRT_X509, 0 };
1979
    static const int protocol_priority[]= { GNUTLS_TLS1_1, GNUTLS_TLS1_0, GNUTLS_SSL3, 0 };
1980
    static const int kx_anon[] = {GNUTLS_KX_ANON_DH, 0};
1981
    static const int kx_x509[] = {GNUTLS_KX_DHE_DSS, GNUTLS_KX_RSA, GNUTLS_KX_DHE_RSA, GNUTLS_KX_SRP, 0};
1982

    
1983
    VNC_DEBUG("Do TLS setup\n");
1984
    if (vnc_tls_initialize() < 0) {
1985
        VNC_DEBUG("Failed to init TLS\n");
1986
        vnc_client_error(vs);
1987
        return -1;
1988
    }
1989
    if (vs->tls_session == NULL) {
1990
        if (gnutls_init(&vs->tls_session, GNUTLS_SERVER) < 0) {
1991
            vnc_client_error(vs);
1992
            return -1;
1993
        }
1994

    
1995
        if (gnutls_set_default_priority(vs->tls_session) < 0) {
1996
            gnutls_deinit(vs->tls_session);
1997
            vs->tls_session = NULL;
1998
            vnc_client_error(vs);
1999
            return -1;
2000
        }
2001

    
2002
        if (gnutls_kx_set_priority(vs->tls_session, NEED_X509_AUTH(vs) ? kx_x509 : kx_anon) < 0) {
2003
            gnutls_deinit(vs->tls_session);
2004
            vs->tls_session = NULL;
2005
            vnc_client_error(vs);
2006
            return -1;
2007
        }
2008

    
2009
        if (gnutls_certificate_type_set_priority(vs->tls_session, cert_type_priority) < 0) {
2010
            gnutls_deinit(vs->tls_session);
2011
            vs->tls_session = NULL;
2012
            vnc_client_error(vs);
2013
            return -1;
2014
        }
2015

    
2016
        if (gnutls_protocol_set_priority(vs->tls_session, protocol_priority) < 0) {
2017
            gnutls_deinit(vs->tls_session);
2018
            vs->tls_session = NULL;
2019
            vnc_client_error(vs);
2020
            return -1;
2021
        }
2022

    
2023
        if (NEED_X509_AUTH(vs)) {
2024
            gnutls_certificate_server_credentials x509_cred = vnc_tls_initialize_x509_cred(vs);
2025
            if (!x509_cred) {
2026
                gnutls_deinit(vs->tls_session);
2027
                vs->tls_session = NULL;
2028
                vnc_client_error(vs);
2029
                return -1;
2030
            }
2031
            if (gnutls_credentials_set(vs->tls_session, GNUTLS_CRD_CERTIFICATE, x509_cred) < 0) {
2032
                gnutls_deinit(vs->tls_session);
2033
                vs->tls_session = NULL;
2034
                gnutls_certificate_free_credentials(x509_cred);
2035
                vnc_client_error(vs);
2036
                return -1;
2037
            }
2038
            if (vs->x509verify) {
2039
                VNC_DEBUG("Requesting a client certificate\n");
2040
                gnutls_certificate_server_set_request (vs->tls_session, GNUTLS_CERT_REQUEST);
2041
            }
2042

    
2043
        } else {
2044
            gnutls_anon_server_credentials anon_cred = vnc_tls_initialize_anon_cred();
2045
            if (!anon_cred) {
2046
                gnutls_deinit(vs->tls_session);
2047
                vs->tls_session = NULL;
2048
                vnc_client_error(vs);
2049
                return -1;
2050
            }
2051
            if (gnutls_credentials_set(vs->tls_session, GNUTLS_CRD_ANON, anon_cred) < 0) {
2052
                gnutls_deinit(vs->tls_session);
2053
                vs->tls_session = NULL;
2054
                gnutls_anon_free_server_credentials(anon_cred);
2055
                vnc_client_error(vs);
2056
                return -1;
2057
            }
2058
        }
2059

    
2060
        gnutls_transport_set_ptr(vs->tls_session, (gnutls_transport_ptr_t)vs);
2061
        gnutls_transport_set_push_function(vs->tls_session, vnc_tls_push);
2062
        gnutls_transport_set_pull_function(vs->tls_session, vnc_tls_pull);
2063
    }
2064

    
2065
    VNC_DEBUG("Start TLS handshake process\n");
2066
    return vnc_continue_handshake(vs);
2067
}
2068

    
2069
static int protocol_client_vencrypt_auth(VncState *vs, uint8_t *data, size_t len)
2070
{
2071
    int auth = read_u32(data, 0);
2072

    
2073
    if (auth != vs->subauth) {
2074
        VNC_DEBUG("Rejecting auth %d\n", auth);
2075
        vnc_write_u8(vs, 0); /* Reject auth */
2076
        vnc_flush(vs);
2077
        vnc_client_error(vs);
2078
    } else {
2079
        VNC_DEBUG("Accepting auth %d, starting handshake\n", auth);
2080
        vnc_write_u8(vs, 1); /* Accept auth */
2081
        vnc_flush(vs);
2082

    
2083
        if (vnc_start_tls(vs) < 0) {
2084
            VNC_DEBUG("Failed to complete TLS\n");
2085
            return 0;
2086
        }
2087

    
2088
        if (vs->wiremode == VNC_WIREMODE_TLS) {
2089
            VNC_DEBUG("Starting VeNCrypt subauth\n");
2090
            return start_auth_vencrypt_subauth(vs);
2091
        } else {
2092
            VNC_DEBUG("TLS handshake blocked\n");
2093
            return 0;
2094
        }
2095
    }
2096
    return 0;
2097
}
2098

    
2099
static int protocol_client_vencrypt_init(VncState *vs, uint8_t *data, size_t len)
2100
{
2101
    if (data[0] != 0 ||
2102
        data[1] != 2) {
2103
        VNC_DEBUG("Unsupported VeNCrypt protocol %d.%d\n", (int)data[0], (int)data[1]);
2104
        vnc_write_u8(vs, 1); /* Reject version */
2105
        vnc_flush(vs);
2106
        vnc_client_error(vs);
2107
    } else {
2108
        VNC_DEBUG("Sending allowed auth %d\n", vs->subauth);
2109
        vnc_write_u8(vs, 0); /* Accept version */
2110
        vnc_write_u8(vs, 1); /* Number of sub-auths */
2111
        vnc_write_u32(vs, vs->subauth); /* The supported auth */
2112
        vnc_flush(vs);
2113
        vnc_read_when(vs, protocol_client_vencrypt_auth, 4);
2114
    }
2115
    return 0;
2116
}
2117

    
2118
static int start_auth_vencrypt(VncState *vs)
2119
{
2120
    /* Send VeNCrypt version 0.2 */
2121
    vnc_write_u8(vs, 0);
2122
    vnc_write_u8(vs, 2);
2123

    
2124
    vnc_read_when(vs, protocol_client_vencrypt_init, 2);
2125
    return 0;
2126
}
2127
#endif /* CONFIG_VNC_TLS */
2128

    
2129
static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
2130
{
2131
    /* We only advertise 1 auth scheme at a time, so client
2132
     * must pick the one we sent. Verify this */
2133
    if (data[0] != vs->auth) { /* Reject auth */
2134
       VNC_DEBUG("Reject auth %d\n", (int)data[0]);
2135
       vnc_write_u32(vs, 1);
2136
       if (vs->minor >= 8) {
2137
           static const char err[] = "Authentication failed";
2138
           vnc_write_u32(vs, sizeof(err));
2139
           vnc_write(vs, err, sizeof(err));
2140
       }
2141
       vnc_client_error(vs);
2142
    } else { /* Accept requested auth */
2143
       VNC_DEBUG("Client requested auth %d\n", (int)data[0]);
2144
       switch (vs->auth) {
2145
       case VNC_AUTH_NONE:
2146
           VNC_DEBUG("Accept auth none\n");
2147
           if (vs->minor >= 8) {
2148
               vnc_write_u32(vs, 0); /* Accept auth completion */
2149
               vnc_flush(vs);
2150
           }
2151
           vnc_read_when(vs, protocol_client_init, 1);
2152
           break;
2153

    
2154
       case VNC_AUTH_VNC:
2155
           VNC_DEBUG("Start VNC auth\n");
2156
           return start_auth_vnc(vs);
2157

    
2158
#ifdef CONFIG_VNC_TLS
2159
       case VNC_AUTH_VENCRYPT:
2160
           VNC_DEBUG("Accept VeNCrypt auth\n");;
2161
           return start_auth_vencrypt(vs);
2162
#endif /* CONFIG_VNC_TLS */
2163

    
2164
       default: /* Should not be possible, but just in case */
2165
           VNC_DEBUG("Reject auth %d\n", vs->auth);
2166
           vnc_write_u8(vs, 1);
2167
           if (vs->minor >= 8) {
2168
               static const char err[] = "Authentication failed";
2169
               vnc_write_u32(vs, sizeof(err));
2170
               vnc_write(vs, err, sizeof(err));
2171
           }
2172
           vnc_client_error(vs);
2173
       }
2174
    }
2175
    return 0;
2176
}
2177

    
2178
static int protocol_version(VncState *vs, uint8_t *version, size_t len)
2179
{
2180
    char local[13];
2181

    
2182
    memcpy(local, version, 12);
2183
    local[12] = 0;
2184

    
2185
    if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) {
2186
        VNC_DEBUG("Malformed protocol version %s\n", local);
2187
        vnc_client_error(vs);
2188
        return 0;
2189
    }
2190
    VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor);
2191
    if (vs->major != 3 ||
2192
        (vs->minor != 3 &&
2193
         vs->minor != 4 &&
2194
         vs->minor != 5 &&
2195
         vs->minor != 7 &&
2196
         vs->minor != 8)) {
2197
        VNC_DEBUG("Unsupported client version\n");
2198
        vnc_write_u32(vs, VNC_AUTH_INVALID);
2199
        vnc_flush(vs);
2200
        vnc_client_error(vs);
2201
        return 0;
2202
    }
2203
    /* Some broken clients report v3.4 or v3.5, which spec requires to be treated
2204
     * as equivalent to v3.3 by servers
2205
     */
2206
    if (vs->minor == 4 || vs->minor == 5)
2207
        vs->minor = 3;
2208

    
2209
    if (vs->minor == 3) {
2210
        if (vs->auth == VNC_AUTH_NONE) {
2211
            VNC_DEBUG("Tell client auth none\n");
2212
            vnc_write_u32(vs, vs->auth);
2213
            vnc_flush(vs);
2214
            vnc_read_when(vs, protocol_client_init, 1);
2215
       } else if (vs->auth == VNC_AUTH_VNC) {
2216
            VNC_DEBUG("Tell client VNC auth\n");
2217
            vnc_write_u32(vs, vs->auth);
2218
            vnc_flush(vs);
2219
            start_auth_vnc(vs);
2220
       } else {
2221
            VNC_DEBUG("Unsupported auth %d for protocol 3.3\n", vs->auth);
2222
            vnc_write_u32(vs, VNC_AUTH_INVALID);
2223
            vnc_flush(vs);
2224
            vnc_client_error(vs);
2225
       }
2226
    } else {
2227
        VNC_DEBUG("Telling client we support auth %d\n", vs->auth);
2228
        vnc_write_u8(vs, 1); /* num auth */
2229
        vnc_write_u8(vs, vs->auth);
2230
        vnc_read_when(vs, protocol_client_auth, 1);
2231
        vnc_flush(vs);
2232
    }
2233

    
2234
    return 0;
2235
}
2236

    
2237
static void vnc_connect(VncState *vs)
2238
{
2239
    VNC_DEBUG("New client on socket %d\n", vs->csock);
2240
    vs->ds->idle = 0;
2241
    socket_set_nonblock(vs->csock);
2242
    qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
2243
    vnc_write(vs, "RFB 003.008\n", 12);
2244
    vnc_flush(vs);
2245
    vnc_read_when(vs, protocol_version, 12);
2246
    memset(vs->old_data, 0, ds_get_linesize(vs->ds) * ds_get_height(vs->ds));
2247
    memset(vs->dirty_row, 0xFF, sizeof(vs->dirty_row));
2248
    vs->has_resize = 0;
2249
    vs->has_hextile = 0;
2250
    vs->ds->dpy_copy = NULL;
2251
    vnc_update_client(vs);
2252
    reset_keys(vs);
2253
}
2254

    
2255
static void vnc_listen_read(void *opaque)
2256
{
2257
    VncState *vs = opaque;
2258
    struct sockaddr_in addr;
2259
    socklen_t addrlen = sizeof(addr);
2260

    
2261
    /* Catch-up */
2262
    vga_hw_update();
2263

    
2264
    vs->csock = accept(vs->lsock, (struct sockaddr *)&addr, &addrlen);
2265
    if (vs->csock != -1) {
2266
        vnc_connect(vs);
2267
    }
2268
}
2269

    
2270
void vnc_display_init(DisplayState *ds)
2271
{
2272
    VncState *vs;
2273

    
2274
    vs = qemu_mallocz(sizeof(VncState));
2275
    if (!vs)
2276
        exit(1);
2277

    
2278
    ds->opaque = vs;
2279
    ds->idle = 1;
2280
    vnc_state = vs;
2281
    vs->display = NULL;
2282
    vs->password = NULL;
2283

    
2284
    vs->lsock = -1;
2285
    vs->csock = -1;
2286
    vs->last_x = -1;
2287
    vs->last_y = -1;
2288

    
2289
    vs->ds = ds;
2290

    
2291
    if (keyboard_layout)
2292
        vs->kbd_layout = init_keyboard_layout(keyboard_layout);
2293
    else
2294
        vs->kbd_layout = init_keyboard_layout("en-us");
2295

    
2296
    if (!vs->kbd_layout)
2297
        exit(1);
2298

    
2299
    vs->timer = qemu_new_timer(rt_clock, vnc_update_client, vs);
2300

    
2301
    vs->ds->data = NULL;
2302
    vs->ds->dpy_update = vnc_dpy_update;
2303
    vs->ds->dpy_resize = vnc_dpy_resize;
2304
    vs->ds->dpy_refresh = NULL;
2305

    
2306
    vnc_colordepth(vs->ds, 32);
2307
    vnc_dpy_resize(vs->ds, 640, 400);
2308

    
2309
    vs->as.freq = 44100;
2310
    vs->as.nchannels = 2;
2311
    vs->as.fmt = AUD_FMT_S16;
2312
    vs->as.endianness = 0;
2313
}
2314

    
2315
#ifdef CONFIG_VNC_TLS
2316
static int vnc_set_x509_credential(VncState *vs,
2317
                                   const char *certdir,
2318
                                   const char *filename,
2319
                                   char **cred,
2320
                                   int ignoreMissing)
2321
{
2322
    struct stat sb;
2323

    
2324
    if (*cred) {
2325
        qemu_free(*cred);
2326
        *cred = NULL;
2327
    }
2328

    
2329
    if (!(*cred = qemu_malloc(strlen(certdir) + strlen(filename) + 2)))
2330
        return -1;
2331

    
2332
    strcpy(*cred, certdir);
2333
    strcat(*cred, "/");
2334
    strcat(*cred, filename);
2335

    
2336
    VNC_DEBUG("Check %s\n", *cred);
2337
    if (stat(*cred, &sb) < 0) {
2338
        qemu_free(*cred);
2339
        *cred = NULL;
2340
        if (ignoreMissing && errno == ENOENT)
2341
            return 0;
2342
        return -1;
2343
    }
2344

    
2345
    return 0;
2346
}
2347

    
2348
static int vnc_set_x509_credential_dir(VncState *vs,
2349
                                       const char *certdir)
2350
{
2351
    if (vnc_set_x509_credential(vs, certdir, X509_CA_CERT_FILE, &vs->x509cacert, 0) < 0)
2352
        goto cleanup;
2353
    if (vnc_set_x509_credential(vs, certdir, X509_CA_CRL_FILE, &vs->x509cacrl, 1) < 0)
2354
        goto cleanup;
2355
    if (vnc_set_x509_credential(vs, certdir, X509_SERVER_CERT_FILE, &vs->x509cert, 0) < 0)
2356
        goto cleanup;
2357
    if (vnc_set_x509_credential(vs, certdir, X509_SERVER_KEY_FILE, &vs->x509key, 0) < 0)
2358
        goto cleanup;
2359

    
2360
    return 0;
2361

    
2362
 cleanup:
2363
    qemu_free(vs->x509cacert);
2364
    qemu_free(vs->x509cacrl);
2365
    qemu_free(vs->x509cert);
2366
    qemu_free(vs->x509key);
2367
    vs->x509cacert = vs->x509cacrl = vs->x509cert = vs->x509key = NULL;
2368
    return -1;
2369
}
2370
#endif /* CONFIG_VNC_TLS */
2371

    
2372
void vnc_display_close(DisplayState *ds)
2373
{
2374
    VncState *vs = ds ? (VncState *)ds->opaque : vnc_state;
2375

    
2376
    if (vs->display) {
2377
        qemu_free(vs->display);
2378
        vs->display = NULL;
2379
    }
2380
    if (vs->lsock != -1) {
2381
        qemu_set_fd_handler2(vs->lsock, NULL, NULL, NULL, NULL);
2382
        close(vs->lsock);
2383
        vs->lsock = -1;
2384
    }
2385
    if (vs->csock != -1) {
2386
        qemu_set_fd_handler2(vs->csock, NULL, NULL, NULL, NULL);
2387
        closesocket(vs->csock);
2388
        vs->csock = -1;
2389
        buffer_reset(&vs->input);
2390
        buffer_reset(&vs->output);
2391
        vs->need_update = 0;
2392
#ifdef CONFIG_VNC_TLS
2393
        if (vs->tls_session) {
2394
            gnutls_deinit(vs->tls_session);
2395
            vs->tls_session = NULL;
2396
        }
2397
        vs->wiremode = VNC_WIREMODE_CLEAR;
2398
#endif /* CONFIG_VNC_TLS */
2399
    }
2400
    vs->auth = VNC_AUTH_INVALID;
2401
#ifdef CONFIG_VNC_TLS
2402
    vs->subauth = VNC_AUTH_INVALID;
2403
    vs->x509verify = 0;
2404
#endif
2405
    audio_del(vs);
2406
}
2407

    
2408
int vnc_display_password(DisplayState *ds, const char *password)
2409
{
2410
    VncState *vs = ds ? (VncState *)ds->opaque : vnc_state;
2411

    
2412
    if (vs->password) {
2413
        qemu_free(vs->password);
2414
        vs->password = NULL;
2415
    }
2416
    if (password && password[0]) {
2417
        if (!(vs->password = qemu_strdup(password)))
2418
            return -1;
2419
    }
2420

    
2421
    return 0;
2422
}
2423

    
2424
int vnc_display_open(DisplayState *ds, const char *display)
2425
{
2426
    VncState *vs = ds ? (VncState *)ds->opaque : vnc_state;
2427
    const char *options;
2428
    int password = 0;
2429
    int reverse = 0;
2430
    int to_port = 0;
2431
#ifdef CONFIG_VNC_TLS
2432
    int tls = 0, x509 = 0;
2433
#endif
2434

    
2435
    vnc_display_close(ds);
2436
    if (strcmp(display, "none") == 0)
2437
        return 0;
2438

    
2439
    if (!(vs->display = strdup(display)))
2440
        return -1;
2441

    
2442
    options = display;
2443
    while ((options = strchr(options, ','))) {
2444
        options++;
2445
        if (strncmp(options, "password", 8) == 0) {
2446
            password = 1; /* Require password auth */
2447
        } else if (strncmp(options, "reverse", 7) == 0) {
2448
            reverse = 1;
2449
        } else if (strncmp(options, "to=", 3) == 0) {
2450
            to_port = atoi(options+3) + 5900;
2451
#ifdef CONFIG_VNC_TLS
2452
        } else if (strncmp(options, "tls", 3) == 0) {
2453
            tls = 1; /* Require TLS */
2454
        } else if (strncmp(options, "x509", 4) == 0) {
2455
            char *start, *end;
2456
            x509 = 1; /* Require x509 certificates */
2457
            if (strncmp(options, "x509verify", 10) == 0)
2458
                vs->x509verify = 1; /* ...and verify client certs */
2459

    
2460
            /* Now check for 'x509=/some/path' postfix
2461
             * and use that to setup x509 certificate/key paths */
2462
            start = strchr(options, '=');
2463
            end = strchr(options, ',');
2464
            if (start && (!end || (start < end))) {
2465
                int len = end ? end-(start+1) : strlen(start+1);
2466
                char *path = qemu_strndup(start + 1, len);
2467

    
2468
                VNC_DEBUG("Trying certificate path '%s'\n", path);
2469
                if (vnc_set_x509_credential_dir(vs, path) < 0) {
2470
                    fprintf(stderr, "Failed to find x509 certificates/keys in %s\n", path);
2471
                    qemu_free(path);
2472
                    qemu_free(vs->display);
2473
                    vs->display = NULL;
2474
                    return -1;
2475
                }
2476
                qemu_free(path);
2477
            } else {
2478
                fprintf(stderr, "No certificate path provided\n");
2479
                qemu_free(vs->display);
2480
                vs->display = NULL;
2481
                return -1;
2482
            }
2483
#endif
2484
        }
2485
    }
2486

    
2487
    if (password) {
2488
#ifdef CONFIG_VNC_TLS
2489
        if (tls) {
2490
            vs->auth = VNC_AUTH_VENCRYPT;
2491
            if (x509) {
2492
                VNC_DEBUG("Initializing VNC server with x509 password auth\n");
2493
                vs->subauth = VNC_AUTH_VENCRYPT_X509VNC;
2494
            } else {
2495
                VNC_DEBUG("Initializing VNC server with TLS password auth\n");
2496
                vs->subauth = VNC_AUTH_VENCRYPT_TLSVNC;
2497
            }
2498
        } else {
2499
#endif
2500
            VNC_DEBUG("Initializing VNC server with password auth\n");
2501
            vs->auth = VNC_AUTH_VNC;
2502
#ifdef CONFIG_VNC_TLS
2503
            vs->subauth = VNC_AUTH_INVALID;
2504
        }
2505
#endif
2506
    } else {
2507
#ifdef CONFIG_VNC_TLS
2508
        if (tls) {
2509
            vs->auth = VNC_AUTH_VENCRYPT;
2510
            if (x509) {
2511
                VNC_DEBUG("Initializing VNC server with x509 no auth\n");
2512
                vs->subauth = VNC_AUTH_VENCRYPT_X509NONE;
2513
            } else {
2514
                VNC_DEBUG("Initializing VNC server with TLS no auth\n");
2515
                vs->subauth = VNC_AUTH_VENCRYPT_TLSNONE;
2516
            }
2517
        } else {
2518
#endif
2519
            VNC_DEBUG("Initializing VNC server with no auth\n");
2520
            vs->auth = VNC_AUTH_NONE;
2521
#ifdef CONFIG_VNC_TLS
2522
            vs->subauth = VNC_AUTH_INVALID;
2523
        }
2524
#endif
2525
    }
2526

    
2527
    if (reverse) {
2528
        /* connect to viewer */
2529
        if (strncmp(display, "unix:", 5) == 0)
2530
            vs->lsock = unix_connect(display+5);
2531
        else
2532
            vs->lsock = inet_connect(display, SOCK_STREAM);
2533
        if (-1 == vs->lsock) {
2534
            free(vs->display);
2535
            vs->display = NULL;
2536
            return -1;
2537
        } else {
2538
            vs->csock = vs->lsock;
2539
            vs->lsock = -1;
2540
            vnc_connect(vs);
2541
        }
2542
        return 0;
2543

    
2544
    } else {
2545
        /* listen for connects */
2546
        char *dpy;
2547
        dpy = qemu_malloc(256);
2548
        if (strncmp(display, "unix:", 5) == 0) {
2549
            strcpy(dpy, "unix:");
2550
            vs->lsock = unix_listen(display+5, dpy+5, 256-5);
2551
        } else {
2552
            vs->lsock = inet_listen(display, dpy, 256, SOCK_STREAM, 5900);
2553
        }
2554
        if (-1 == vs->lsock) {
2555
            free(dpy);
2556
            return -1;
2557
        } else {
2558
            free(vs->display);
2559
            vs->display = dpy;
2560
        }
2561
    }
2562

    
2563
    return qemu_set_fd_handler2(vs->lsock, vnc_listen_poll, vnc_listen_read, NULL, vs);
2564
}