Statistics
| Branch: | Revision:

root / vnc.c @ 3cded540

History | View | Annotate | Download (66.8 kB)

1
/*
2
 * QEMU VNC display driver
3
 *
4
 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5
 * Copyright (C) 2006 Fabrice Bellard
6
 * Copyright (C) 2009 Red Hat, Inc
7
 *
8
 * Permission is hereby granted, free of charge, to any person obtaining a copy
9
 * of this software and associated documentation files (the "Software"), to deal
10
 * in the Software without restriction, including without limitation the rights
11
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12
 * copies of the Software, and to permit persons to whom the Software is
13
 * furnished to do so, subject to the following conditions:
14
 *
15
 * The above copyright notice and this permission notice shall be included in
16
 * all copies or substantial portions of the Software.
17
 *
18
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24
 * THE SOFTWARE.
25
 */
26

    
27
#include "vnc.h"
28
#include "sysemu.h"
29
#include "qemu_socket.h"
30
#include "qemu-timer.h"
31
#include "acl.h"
32

    
33
#define VNC_REFRESH_INTERVAL (1000 / 30)
34

    
35
#include "vnc_keysym.h"
36
#include "d3des.h"
37

    
38
#define count_bits(c, v) { \
39
    for (c = 0; v; v >>= 1) \
40
    { \
41
        c += v & 1; \
42
    } \
43
}
44

    
45

    
46
static VncDisplay *vnc_display; /* needed for info vnc */
47
static DisplayChangeListener *dcl;
48

    
49
static char *addr_to_string(const char *format,
50
                            struct sockaddr_storage *sa,
51
                            socklen_t salen) {
52
    char *addr;
53
    char host[NI_MAXHOST];
54
    char serv[NI_MAXSERV];
55
    int err;
56
    size_t addrlen;
57

    
58
    if ((err = getnameinfo((struct sockaddr *)sa, salen,
59
                           host, sizeof(host),
60
                           serv, sizeof(serv),
61
                           NI_NUMERICHOST | NI_NUMERICSERV)) != 0) {
62
        VNC_DEBUG("Cannot resolve address %d: %s\n",
63
                  err, gai_strerror(err));
64
        return NULL;
65
    }
66

    
67
    /* Enough for the existing format + the 2 vars we're
68
     * subsituting in. */
69
    addrlen = strlen(format) + strlen(host) + strlen(serv);
70
    addr = qemu_malloc(addrlen + 1);
71
    snprintf(addr, addrlen, format, host, serv);
72
    addr[addrlen] = '\0';
73

    
74
    return addr;
75
}
76

    
77

    
78
char *vnc_socket_local_addr(const char *format, int fd) {
79
    struct sockaddr_storage sa;
80
    socklen_t salen;
81

    
82
    salen = sizeof(sa);
83
    if (getsockname(fd, (struct sockaddr*)&sa, &salen) < 0)
84
        return NULL;
85

    
86
    return addr_to_string(format, &sa, salen);
87
}
88

    
89

    
90
char *vnc_socket_remote_addr(const char *format, int fd) {
91
    struct sockaddr_storage sa;
92
    socklen_t salen;
93

    
94
    salen = sizeof(sa);
95
    if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0)
96
        return NULL;
97

    
98
    return addr_to_string(format, &sa, salen);
99
}
100

    
101
static const char *vnc_auth_name(VncDisplay *vd) {
102
    switch (vd->auth) {
103
    case VNC_AUTH_INVALID:
104
        return "invalid";
105
    case VNC_AUTH_NONE:
106
        return "none";
107
    case VNC_AUTH_VNC:
108
        return "vnc";
109
    case VNC_AUTH_RA2:
110
        return "ra2";
111
    case VNC_AUTH_RA2NE:
112
        return "ra2ne";
113
    case VNC_AUTH_TIGHT:
114
        return "tight";
115
    case VNC_AUTH_ULTRA:
116
        return "ultra";
117
    case VNC_AUTH_TLS:
118
        return "tls";
119
    case VNC_AUTH_VENCRYPT:
120
#ifdef CONFIG_VNC_TLS
121
        switch (vd->subauth) {
122
        case VNC_AUTH_VENCRYPT_PLAIN:
123
            return "vencrypt+plain";
124
        case VNC_AUTH_VENCRYPT_TLSNONE:
125
            return "vencrypt+tls+none";
126
        case VNC_AUTH_VENCRYPT_TLSVNC:
127
            return "vencrypt+tls+vnc";
128
        case VNC_AUTH_VENCRYPT_TLSPLAIN:
129
            return "vencrypt+tls+plain";
130
        case VNC_AUTH_VENCRYPT_X509NONE:
131
            return "vencrypt+x509+none";
132
        case VNC_AUTH_VENCRYPT_X509VNC:
133
            return "vencrypt+x509+vnc";
134
        case VNC_AUTH_VENCRYPT_X509PLAIN:
135
            return "vencrypt+x509+plain";
136
        case VNC_AUTH_VENCRYPT_TLSSASL:
137
            return "vencrypt+tls+sasl";
138
        case VNC_AUTH_VENCRYPT_X509SASL:
139
            return "vencrypt+x509+sasl";
140
        default:
141
            return "vencrypt";
142
        }
143
#else
144
        return "vencrypt";
145
#endif
146
    case VNC_AUTH_SASL:
147
        return "sasl";
148
    }
149
    return "unknown";
150
}
151

    
152
static void do_info_vnc_client(Monitor *mon, VncState *client)
153
{
154
    char *clientAddr =
155
        vnc_socket_remote_addr("     address: %s:%s\n",
156
                               client->csock);
157
    if (!clientAddr)
158
        return;
159

    
160
    monitor_printf(mon, "Client:\n");
161
    monitor_printf(mon, "%s", clientAddr);
162
    free(clientAddr);
163

    
164
#ifdef CONFIG_VNC_TLS
165
    if (client->tls.session &&
166
        client->tls.dname)
167
        monitor_printf(mon, "  x509 dname: %s\n", client->tls.dname);
168
    else
169
        monitor_printf(mon, "  x509 dname: none\n");
170
#endif
171
#ifdef CONFIG_VNC_SASL
172
    if (client->sasl.conn &&
173
        client->sasl.username)
174
        monitor_printf(mon, "    username: %s\n", client->sasl.username);
175
    else
176
        monitor_printf(mon, "    username: none\n");
177
#endif
178
}
179

    
180
void do_info_vnc(Monitor *mon)
181
{
182
    if (vnc_display == NULL || vnc_display->display == NULL) {
183
        monitor_printf(mon, "Server: disabled\n");
184
    } else {
185
        char *serverAddr = vnc_socket_local_addr("     address: %s:%s\n",
186
                                                 vnc_display->lsock);
187

    
188
        if (!serverAddr)
189
            return;
190

    
191
        monitor_printf(mon, "Server:\n");
192
        monitor_printf(mon, "%s", serverAddr);
193
        free(serverAddr);
194
        monitor_printf(mon, "        auth: %s\n", vnc_auth_name(vnc_display));
195

    
196
        if (vnc_display->clients) {
197
            VncState *client = vnc_display->clients;
198
            while (client) {
199
                do_info_vnc_client(mon, client);
200
                client = client->next;
201
            }
202
        } else {
203
            monitor_printf(mon, "Client: none\n");
204
        }
205
    }
206
}
207

    
208
static inline uint32_t vnc_has_feature(VncState *vs, int feature) {
209
    return (vs->features & (1 << feature));
210
}
211

    
212
/* TODO
213
   1) Get the queue working for IO.
214
   2) there is some weirdness when using the -S option (the screen is grey
215
      and not totally invalidated
216
   3) resolutions > 1024
217
*/
218

    
219
static void vnc_update_client(void *opaque);
220

    
221
static void vnc_colordepth(VncState *vs);
222

    
223
static inline void vnc_set_bit(uint32_t *d, int k)
224
{
225
    d[k >> 5] |= 1 << (k & 0x1f);
226
}
227

    
228
static inline void vnc_clear_bit(uint32_t *d, int k)
229
{
230
    d[k >> 5] &= ~(1 << (k & 0x1f));
231
}
232

    
233
static inline void vnc_set_bits(uint32_t *d, int n, int nb_words)
234
{
235
    int j;
236

    
237
    j = 0;
238
    while (n >= 32) {
239
        d[j++] = -1;
240
        n -= 32;
241
    }
242
    if (n > 0)
243
        d[j++] = (1 << n) - 1;
244
    while (j < nb_words)
245
        d[j++] = 0;
246
}
247

    
248
static inline int vnc_get_bit(const uint32_t *d, int k)
249
{
250
    return (d[k >> 5] >> (k & 0x1f)) & 1;
251
}
252

    
253
static inline int vnc_and_bits(const uint32_t *d1, const uint32_t *d2,
254
                               int nb_words)
255
{
256
    int i;
257
    for(i = 0; i < nb_words; i++) {
258
        if ((d1[i] & d2[i]) != 0)
259
            return 1;
260
    }
261
    return 0;
262
}
263

    
264
static void vnc_update(VncState *vs, int x, int y, int w, int h)
265
{
266
    struct VncSurface *s = &vs->guest;
267
    int i;
268

    
269
    h += y;
270

    
271
    /* round x down to ensure the loop only spans one 16-pixel block per,
272
       iteration.  otherwise, if (x % 16) != 0, the last iteration may span
273
       two 16-pixel blocks but we only mark the first as dirty
274
    */
275
    w += (x % 16);
276
    x -= (x % 16);
277

    
278
    x = MIN(x, s->ds->width);
279
    y = MIN(y, s->ds->height);
280
    w = MIN(x + w, s->ds->width) - x;
281
    h = MIN(h, s->ds->height);
282

    
283
    for (; y < h; y++)
284
        for (i = 0; i < w; i += 16)
285
            vnc_set_bit(s->dirty[y], (x + i) / 16);
286
}
287

    
288
static void vnc_dpy_update(DisplayState *ds, int x, int y, int w, int h)
289
{
290
    VncDisplay *vd = ds->opaque;
291
    VncState *vs = vd->clients;
292
    while (vs != NULL) {
293
        vnc_update(vs, x, y, w, h);
294
        vs = vs->next;
295
    }
296
}
297

    
298
static void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
299
                                   int32_t encoding)
300
{
301
    vnc_write_u16(vs, x);
302
    vnc_write_u16(vs, y);
303
    vnc_write_u16(vs, w);
304
    vnc_write_u16(vs, h);
305

    
306
    vnc_write_s32(vs, encoding);
307
}
308

    
309
void buffer_reserve(Buffer *buffer, size_t len)
310
{
311
    if ((buffer->capacity - buffer->offset) < len) {
312
        buffer->capacity += (len + 1024);
313
        buffer->buffer = qemu_realloc(buffer->buffer, buffer->capacity);
314
        if (buffer->buffer == NULL) {
315
            fprintf(stderr, "vnc: out of memory\n");
316
            exit(1);
317
        }
318
    }
319
}
320

    
321
int buffer_empty(Buffer *buffer)
322
{
323
    return buffer->offset == 0;
324
}
325

    
326
uint8_t *buffer_end(Buffer *buffer)
327
{
328
    return buffer->buffer + buffer->offset;
329
}
330

    
331
void buffer_reset(Buffer *buffer)
332
{
333
        buffer->offset = 0;
334
}
335

    
336
void buffer_append(Buffer *buffer, const void *data, size_t len)
337
{
338
    memcpy(buffer->buffer + buffer->offset, data, len);
339
    buffer->offset += len;
340
}
341

    
342
static void vnc_resize(VncState *vs)
343
{
344
    DisplayState *ds = vs->ds;
345
    int size_changed;
346

    
347
    /* guest surface */
348
    if (!vs->guest.ds)
349
        vs->guest.ds = qemu_mallocz(sizeof(*vs->guest.ds));
350
    if (ds_get_bytes_per_pixel(ds) != vs->guest.ds->pf.bytes_per_pixel)
351
        console_color_init(ds);
352
    vnc_colordepth(vs);
353
    size_changed = ds_get_width(ds) != vs->guest.ds->width ||
354
                   ds_get_height(ds) != vs->guest.ds->height;
355
    *(vs->guest.ds) = *(ds->surface);
356
    if (size_changed) {
357
        if (vs->csock != -1 && vnc_has_feature(vs, VNC_FEATURE_RESIZE)) {
358
            vnc_write_u8(vs, 0);  /* msg id */
359
            vnc_write_u8(vs, 0);
360
            vnc_write_u16(vs, 1); /* number of rects */
361
            vnc_framebuffer_update(vs, 0, 0, ds_get_width(ds), ds_get_height(ds),
362
                                   VNC_ENCODING_DESKTOPRESIZE);
363
            vnc_flush(vs);
364
        }
365
    }
366
    memset(vs->guest.dirty, 0xFF, sizeof(vs->guest.dirty));
367

    
368
    /* server surface */
369
    if (!vs->server.ds) {
370
        vs->server.ds = default_allocator.create_displaysurface(ds_get_width(ds),
371
                                                                ds_get_height(ds));
372
    } else {
373
        default_allocator.resize_displaysurface(vs->server.ds,
374
                                                ds_get_width(ds), ds_get_height(ds));
375
    }
376
    if (vs->server.ds->data == NULL) {
377
        fprintf(stderr, "vnc: memory allocation failed\n");
378
        exit(1);
379
    }
380
    memset(vs->server.dirty, 0xFF, sizeof(vs->guest.dirty));
381
}
382

    
383
static void vnc_dpy_resize(DisplayState *ds)
384
{
385
    VncDisplay *vd = ds->opaque;
386
    VncState *vs = vd->clients;
387
    while (vs != NULL) {
388
        vnc_resize(vs);
389
        vs = vs->next;
390
    }
391
}
392

    
393
/* fastest code */
394
static void vnc_write_pixels_copy(VncState *vs, void *pixels, int size)
395
{
396
    vnc_write(vs, pixels, size);
397
}
398

    
399
/* slowest but generic code. */
400
static void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
401
{
402
    uint8_t r, g, b;
403

    
404
    r = ((((v & vs->server.ds->pf.rmask) >> vs->server.ds->pf.rshift) << vs->clientds.pf.rbits) >>
405
        vs->server.ds->pf.rbits);
406
    g = ((((v & vs->server.ds->pf.gmask) >> vs->server.ds->pf.gshift) << vs->clientds.pf.gbits) >>
407
        vs->server.ds->pf.gbits);
408
    b = ((((v & vs->server.ds->pf.bmask) >> vs->server.ds->pf.bshift) << vs->clientds.pf.bbits) >>
409
        vs->server.ds->pf.bbits);
410
    v = (r << vs->clientds.pf.rshift) |
411
        (g << vs->clientds.pf.gshift) |
412
        (b << vs->clientds.pf.bshift);
413
    switch(vs->clientds.pf.bytes_per_pixel) {
414
    case 1:
415
        buf[0] = v;
416
        break;
417
    case 2:
418
        if (vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) {
419
            buf[0] = v >> 8;
420
            buf[1] = v;
421
        } else {
422
            buf[1] = v >> 8;
423
            buf[0] = v;
424
        }
425
        break;
426
    default:
427
    case 4:
428
        if (vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) {
429
            buf[0] = v >> 24;
430
            buf[1] = v >> 16;
431
            buf[2] = v >> 8;
432
            buf[3] = v;
433
        } else {
434
            buf[3] = v >> 24;
435
            buf[2] = v >> 16;
436
            buf[1] = v >> 8;
437
            buf[0] = v;
438
        }
439
        break;
440
    }
441
}
442

    
443
static void vnc_write_pixels_generic(VncState *vs, void *pixels1, int size)
444
{
445
    uint8_t buf[4];
446

    
447
    if (vs->server.ds->pf.bytes_per_pixel == 4) {
448
        uint32_t *pixels = pixels1;
449
        int n, i;
450
        n = size >> 2;
451
        for(i = 0; i < n; i++) {
452
            vnc_convert_pixel(vs, buf, pixels[i]);
453
            vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
454
        }
455
    } else if (vs->server.ds->pf.bytes_per_pixel == 2) {
456
        uint16_t *pixels = pixels1;
457
        int n, i;
458
        n = size >> 1;
459
        for(i = 0; i < n; i++) {
460
            vnc_convert_pixel(vs, buf, pixels[i]);
461
            vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
462
        }
463
    } else if (vs->server.ds->pf.bytes_per_pixel == 1) {
464
        uint8_t *pixels = pixels1;
465
        int n, i;
466
        n = size;
467
        for(i = 0; i < n; i++) {
468
            vnc_convert_pixel(vs, buf, pixels[i]);
469
            vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
470
        }
471
    } else {
472
        fprintf(stderr, "vnc_write_pixels_generic: VncState color depth not supported\n");
473
    }
474
}
475

    
476
static void send_framebuffer_update_raw(VncState *vs, int x, int y, int w, int h)
477
{
478
    int i;
479
    uint8_t *row;
480

    
481
    row = vs->server.ds->data + y * ds_get_linesize(vs->ds) + x * ds_get_bytes_per_pixel(vs->ds);
482
    for (i = 0; i < h; i++) {
483
        vs->write_pixels(vs, row, w * ds_get_bytes_per_pixel(vs->ds));
484
        row += ds_get_linesize(vs->ds);
485
    }
486
}
487

    
488
static void hextile_enc_cord(uint8_t *ptr, int x, int y, int w, int h)
489
{
490
    ptr[0] = ((x & 0x0F) << 4) | (y & 0x0F);
491
    ptr[1] = (((w - 1) & 0x0F) << 4) | ((h - 1) & 0x0F);
492
}
493

    
494
#define BPP 8
495
#include "vnchextile.h"
496
#undef BPP
497

    
498
#define BPP 16
499
#include "vnchextile.h"
500
#undef BPP
501

    
502
#define BPP 32
503
#include "vnchextile.h"
504
#undef BPP
505

    
506
#define GENERIC
507
#define BPP 8
508
#include "vnchextile.h"
509
#undef BPP
510
#undef GENERIC
511

    
512
#define GENERIC
513
#define BPP 16
514
#include "vnchextile.h"
515
#undef BPP
516
#undef GENERIC
517

    
518
#define GENERIC
519
#define BPP 32
520
#include "vnchextile.h"
521
#undef BPP
522
#undef GENERIC
523

    
524
static void send_framebuffer_update_hextile(VncState *vs, int x, int y, int w, int h)
525
{
526
    int i, j;
527
    int has_fg, has_bg;
528
    uint8_t *last_fg, *last_bg;
529

    
530
    last_fg = (uint8_t *) qemu_malloc(vs->server.ds->pf.bytes_per_pixel);
531
    last_bg = (uint8_t *) qemu_malloc(vs->server.ds->pf.bytes_per_pixel);
532
    has_fg = has_bg = 0;
533
    for (j = y; j < (y + h); j += 16) {
534
        for (i = x; i < (x + w); i += 16) {
535
            vs->send_hextile_tile(vs, i, j,
536
                                  MIN(16, x + w - i), MIN(16, y + h - j),
537
                                  last_bg, last_fg, &has_bg, &has_fg);
538
        }
539
    }
540
    free(last_fg);
541
    free(last_bg);
542

    
543
}
544

    
545
static void vnc_zlib_init(VncState *vs)
546
{
547
    int i;
548
    for (i=0; i<(sizeof(vs->zlib_stream) / sizeof(z_stream)); i++)
549
        vs->zlib_stream[i].opaque = NULL;
550
}
551

    
552
static void vnc_zlib_start(VncState *vs)
553
{
554
    buffer_reset(&vs->zlib);
555

    
556
    // make the output buffer be the zlib buffer, so we can compress it later
557
    vs->zlib_tmp = vs->output;
558
    vs->output = vs->zlib;
559
}
560

    
561
static int vnc_zlib_stop(VncState *vs, int stream_id)
562
{
563
    z_streamp zstream = &vs->zlib_stream[stream_id];
564
    int previous_out;
565

    
566
    // switch back to normal output/zlib buffers
567
    vs->zlib = vs->output;
568
    vs->output = vs->zlib_tmp;
569

    
570
    // compress the zlib buffer
571

    
572
    // initialize the stream
573
    // XXX need one stream per session
574
    if (zstream->opaque != vs) {
575
        int err;
576

    
577
        VNC_DEBUG("VNC: initializing zlib stream %d\n", stream_id);
578
        VNC_DEBUG("VNC: opaque = %p | vs = %p\n", zstream->opaque, vs);
579
        zstream->zalloc = Z_NULL;
580
        zstream->zfree = Z_NULL;
581

    
582
        err = deflateInit2(zstream, vs->tight_compression, Z_DEFLATED, MAX_WBITS,
583
                           MAX_MEM_LEVEL, Z_DEFAULT_STRATEGY);
584

    
585
        if (err != Z_OK) {
586
            fprintf(stderr, "VNC: error initializing zlib\n");
587
            return -1;
588
        }
589

    
590
        zstream->opaque = vs;
591
    }
592

    
593
    // XXX what to do if tight_compression changed in between?
594

    
595
    // reserve memory in output buffer
596
    buffer_reserve(&vs->output, vs->zlib.offset + 64);
597

    
598
    // set pointers
599
    zstream->next_in = vs->zlib.buffer;
600
    zstream->avail_in = vs->zlib.offset;
601
    zstream->next_out = vs->output.buffer + vs->output.offset;
602
    zstream->avail_out = vs->output.capacity - vs->output.offset;
603
    zstream->data_type = Z_BINARY;
604
    previous_out = zstream->total_out;
605

    
606
    // start encoding
607
    if (deflate(zstream, Z_SYNC_FLUSH) != Z_OK) {
608
        fprintf(stderr, "VNC: error during zlib compression\n");
609
        return -1;
610
    }
611

    
612
    vs->output.offset = vs->output.capacity - zstream->avail_out;
613
    return zstream->total_out - previous_out;
614
}
615

    
616
static void send_framebuffer_update_zlib(VncState *vs, int x, int y, int w, int h)
617
{
618
    int old_offset, new_offset, bytes_written;
619

    
620
    vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_ZLIB);
621

    
622
    // remember where we put in the follow-up size
623
    old_offset = vs->output.offset;
624
    vnc_write_s32(vs, 0);
625

    
626
    // compress the stream
627
    vnc_zlib_start(vs);
628
    send_framebuffer_update_raw(vs, x, y, w, h);
629
    bytes_written = vnc_zlib_stop(vs, 0);
630

    
631
    if (bytes_written == -1)
632
        return;
633

    
634
    // hack in the size
635
    new_offset = vs->output.offset;
636
    vs->output.offset = old_offset;
637
    vnc_write_u32(vs, bytes_written);
638
    vs->output.offset = new_offset;
639
}
640

    
641
static void send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
642
{
643
    switch(vs->vnc_encoding) {
644
        case VNC_ENCODING_ZLIB:
645
            send_framebuffer_update_zlib(vs, x, y, w, h);
646
            break;
647
        case VNC_ENCODING_HEXTILE:
648
            vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE);
649
            send_framebuffer_update_hextile(vs, x, y, w, h);
650
            break;
651
        default:
652
            vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW);
653
            send_framebuffer_update_raw(vs, x, y, w, h);
654
            break;
655
    }
656
}
657

    
658
static void vnc_copy(VncState *vs, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
659
{
660
    vs->force_update = 1;
661
    vnc_update_client(vs);
662

    
663
    vnc_write_u8(vs, 0);  /* msg id */
664
    vnc_write_u8(vs, 0);
665
    vnc_write_u16(vs, 1); /* number of rects */
666
    vnc_framebuffer_update(vs, dst_x, dst_y, w, h, VNC_ENCODING_COPYRECT);
667
    vnc_write_u16(vs, src_x);
668
    vnc_write_u16(vs, src_y);
669
    vnc_flush(vs);
670
}
671

    
672
static void vnc_dpy_copy(DisplayState *ds, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
673
{
674
    VncDisplay *vd = ds->opaque;
675
    VncState *vs = vd->clients;
676
    while (vs != NULL) {
677
        if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT))
678
            vnc_copy(vs, src_x, src_y, dst_x, dst_y, w, h);
679
        else /* TODO */
680
            vnc_update(vs, dst_x, dst_y, w, h);
681
        vs = vs->next;
682
    }
683
}
684

    
685
static int find_and_clear_dirty_height(struct VncSurface *s,
686
                                       int y, int last_x, int x)
687
{
688
    int h;
689

    
690
    for (h = 1; h < (s->ds->height - y) && h < 1; h++) {
691
        int tmp_x;
692
        if (!vnc_get_bit(s->dirty[y + h], last_x))
693
            break;
694
        for (tmp_x = last_x; tmp_x < x; tmp_x++)
695
            vnc_clear_bit(s->dirty[y + h], tmp_x);
696
    }
697

    
698
    return h;
699
}
700

    
701
static void vnc_update_client(void *opaque)
702
{
703
    VncState *vs = opaque;
704
    if (vs->need_update && vs->csock != -1) {
705
        int y;
706
        uint8_t *guest_row;
707
        uint8_t *server_row;
708
        int cmp_bytes = 16 * ds_get_bytes_per_pixel(vs->ds);
709
        uint32_t width_mask[VNC_DIRTY_WORDS];
710
        int n_rectangles;
711
        int saved_offset;
712
        int has_dirty = 0;
713

    
714
        if (vs->output.offset && !vs->audio_cap && !vs->force_update) {
715
            /* kernel send buffers are full -> drop frames to throttle */
716
            qemu_mod_timer(vs->timer, qemu_get_clock(rt_clock) + VNC_REFRESH_INTERVAL);
717
            return;
718
        }
719

    
720
        vga_hw_update();
721

    
722
        /*
723
         * Walk through the guest dirty map.
724
         * Check and copy modified bits from guest to server surface.
725
         * Update server dirty map.
726
         */
727
        vnc_set_bits(width_mask, (ds_get_width(vs->ds) / 16), VNC_DIRTY_WORDS);
728
        guest_row  = vs->guest.ds->data;
729
        server_row = vs->server.ds->data;
730
        for (y = 0; y < vs->guest.ds->height; y++) {
731
            if (vnc_and_bits(vs->guest.dirty[y], width_mask, VNC_DIRTY_WORDS)) {
732
                int x;
733
                uint8_t *guest_ptr;
734
                uint8_t *server_ptr;
735

    
736
                guest_ptr  = guest_row;
737
                server_ptr = server_row;
738

    
739
                for (x = 0; x < vs->guest.ds->width;
740
                     x += 16, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) {
741
                    if (!vnc_get_bit(vs->guest.dirty[y], (x / 16)))
742
                        continue;
743
                    vnc_clear_bit(vs->guest.dirty[y], (x / 16));
744
                    if (memcmp(server_ptr, guest_ptr, cmp_bytes) == 0)
745
                        continue;
746
                    memcpy(server_ptr, guest_ptr, cmp_bytes);
747
                    vnc_set_bit(vs->server.dirty[y], (x / 16));
748
                    has_dirty++;
749
                }
750
            }
751
            guest_row  += ds_get_linesize(vs->ds);
752
            server_row += ds_get_linesize(vs->ds);
753
        }
754

    
755
        if (!has_dirty && !vs->audio_cap && !vs->force_update) {
756
            qemu_mod_timer(vs->timer, qemu_get_clock(rt_clock) + VNC_REFRESH_INTERVAL);
757
            return;
758
        }
759

    
760
        /*
761
         * Send screen updates to the vnc client using the server
762
         * surface and server dirty map.  guest surface updates
763
         * happening in parallel don't disturb us, the next pass will
764
         * send them to the client.
765
         */
766
        n_rectangles = 0;
767
        vnc_write_u8(vs, 0);  /* msg id */
768
        vnc_write_u8(vs, 0);
769
        saved_offset = vs->output.offset;
770
        vnc_write_u16(vs, 0);
771

    
772
        for (y = 0; y < vs->server.ds->height; y++) {
773
            int x;
774
            int last_x = -1;
775
            for (x = 0; x < vs->server.ds->width / 16; x++) {
776
                if (vnc_get_bit(vs->server.dirty[y], x)) {
777
                    if (last_x == -1) {
778
                        last_x = x;
779
                    }
780
                    vnc_clear_bit(vs->server.dirty[y], x);
781
                } else {
782
                    if (last_x != -1) {
783
                        int h = find_and_clear_dirty_height(&vs->server, y, last_x, x);
784
                        send_framebuffer_update(vs, last_x * 16, y, (x - last_x) * 16, h);
785
                        n_rectangles++;
786
                    }
787
                    last_x = -1;
788
                }
789
            }
790
            if (last_x != -1) {
791
                int h = find_and_clear_dirty_height(&vs->server, y, last_x, x);
792
                send_framebuffer_update(vs, last_x * 16, y, (x - last_x) * 16, h);
793
                n_rectangles++;
794
            }
795
        }
796
        vs->output.buffer[saved_offset] = (n_rectangles >> 8) & 0xFF;
797
        vs->output.buffer[saved_offset + 1] = n_rectangles & 0xFF;
798
        vnc_flush(vs);
799
        vs->force_update = 0;
800

    
801
    }
802

    
803
    if (vs->csock != -1) {
804
        qemu_mod_timer(vs->timer, qemu_get_clock(rt_clock) + VNC_REFRESH_INTERVAL);
805
    }
806

    
807
}
808

    
809
/* audio */
810
static void audio_capture_notify(void *opaque, audcnotification_e cmd)
811
{
812
    VncState *vs = opaque;
813

    
814
    switch (cmd) {
815
    case AUD_CNOTIFY_DISABLE:
816
        vnc_write_u8(vs, 255);
817
        vnc_write_u8(vs, 1);
818
        vnc_write_u16(vs, 0);
819
        vnc_flush(vs);
820
        break;
821

    
822
    case AUD_CNOTIFY_ENABLE:
823
        vnc_write_u8(vs, 255);
824
        vnc_write_u8(vs, 1);
825
        vnc_write_u16(vs, 1);
826
        vnc_flush(vs);
827
        break;
828
    }
829
}
830

    
831
static void audio_capture_destroy(void *opaque)
832
{
833
}
834

    
835
static void audio_capture(void *opaque, void *buf, int size)
836
{
837
    VncState *vs = opaque;
838

    
839
    vnc_write_u8(vs, 255);
840
    vnc_write_u8(vs, 1);
841
    vnc_write_u16(vs, 2);
842
    vnc_write_u32(vs, size);
843
    vnc_write(vs, buf, size);
844
    vnc_flush(vs);
845
}
846

    
847
static void audio_add(VncState *vs)
848
{
849
    Monitor *mon = cur_mon;
850
    struct audio_capture_ops ops;
851

    
852
    if (vs->audio_cap) {
853
        monitor_printf(mon, "audio already running\n");
854
        return;
855
    }
856

    
857
    ops.notify = audio_capture_notify;
858
    ops.destroy = audio_capture_destroy;
859
    ops.capture = audio_capture;
860

    
861
    vs->audio_cap = AUD_add_capture(NULL, &vs->as, &ops, vs);
862
    if (!vs->audio_cap) {
863
        monitor_printf(mon, "Failed to add audio capture\n");
864
    }
865
}
866

    
867
static void audio_del(VncState *vs)
868
{
869
    if (vs->audio_cap) {
870
        AUD_del_capture(vs->audio_cap, vs);
871
        vs->audio_cap = NULL;
872
    }
873
}
874

    
875

    
876
int vnc_client_io_error(VncState *vs, int ret, int last_errno)
877
{
878
    if (ret == 0 || ret == -1) {
879
        if (ret == -1) {
880
            switch (last_errno) {
881
                case EINTR:
882
                case EAGAIN:
883
#ifdef _WIN32
884
                case WSAEWOULDBLOCK:
885
#endif
886
                    return 0;
887
                default:
888
                    break;
889
            }
890
        }
891

    
892
        VNC_DEBUG("Closing down client sock %d %d\n", ret, ret < 0 ? last_errno : 0);
893
        qemu_set_fd_handler2(vs->csock, NULL, NULL, NULL, NULL);
894
        closesocket(vs->csock);
895
        qemu_del_timer(vs->timer);
896
        qemu_free_timer(vs->timer);
897
        if (vs->input.buffer) qemu_free(vs->input.buffer);
898
        if (vs->output.buffer) qemu_free(vs->output.buffer);
899
#ifdef CONFIG_VNC_TLS
900
        vnc_tls_client_cleanup(vs);
901
#endif /* CONFIG_VNC_TLS */
902
#ifdef CONFIG_VNC_SASL
903
        vnc_sasl_client_cleanup(vs);
904
#endif /* CONFIG_VNC_SASL */
905
        audio_del(vs);
906

    
907
        VncState *p, *parent = NULL;
908
        for (p = vs->vd->clients; p != NULL; p = p->next) {
909
            if (p == vs) {
910
                if (parent)
911
                    parent->next = p->next;
912
                else
913
                    vs->vd->clients = p->next;
914
                break;
915
            }
916
            parent = p;
917
        }
918
        if (!vs->vd->clients)
919
            dcl->idle = 1;
920

    
921
        default_allocator.free_displaysurface(vs->server.ds);
922
        qemu_free(vs->guest.ds);
923
        qemu_free(vs);
924

    
925
        return 0;
926
    }
927
    return ret;
928
}
929

    
930

    
931
void vnc_client_error(VncState *vs)
932
{
933
    vnc_client_io_error(vs, -1, EINVAL);
934
}
935

    
936

    
937
/*
938
 * Called to write a chunk of data to the client socket. The data may
939
 * be the raw data, or may have already been encoded by SASL.
940
 * The data will be written either straight onto the socket, or
941
 * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled
942
 *
943
 * NB, it is theoretically possible to have 2 layers of encryption,
944
 * both SASL, and this TLS layer. It is highly unlikely in practice
945
 * though, since SASL encryption will typically be a no-op if TLS
946
 * is active
947
 *
948
 * Returns the number of bytes written, which may be less than
949
 * the requested 'datalen' if the socket would block. Returns
950
 * -1 on error, and disconnects the client socket.
951
 */
952
long vnc_client_write_buf(VncState *vs, const uint8_t *data, size_t datalen)
953
{
954
    long ret;
955
#ifdef CONFIG_VNC_TLS
956
    if (vs->tls.session) {
957
        ret = gnutls_write(vs->tls.session, data, datalen);
958
        if (ret < 0) {
959
            if (ret == GNUTLS_E_AGAIN)
960
                errno = EAGAIN;
961
            else
962
                errno = EIO;
963
            ret = -1;
964
        }
965
    } else
966
#endif /* CONFIG_VNC_TLS */
967
        ret = send(vs->csock, data, datalen, 0);
968
    VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data, datalen, ret);
969
    return vnc_client_io_error(vs, ret, socket_error());
970
}
971

    
972

    
973
/*
974
 * Called to write buffered data to the client socket, when not
975
 * using any SASL SSF encryption layers. Will write as much data
976
 * as possible without blocking. If all buffered data is written,
977
 * will switch the FD poll() handler back to read monitoring.
978
 *
979
 * Returns the number of bytes written, which may be less than
980
 * the buffered output data if the socket would block. Returns
981
 * -1 on error, and disconnects the client socket.
982
 */
983
static long vnc_client_write_plain(VncState *vs)
984
{
985
    long ret;
986

    
987
#ifdef CONFIG_VNC_SASL
988
    VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n",
989
              vs->output.buffer, vs->output.capacity, vs->output.offset,
990
              vs->sasl.waitWriteSSF);
991

    
992
    if (vs->sasl.conn &&
993
        vs->sasl.runSSF &&
994
        vs->sasl.waitWriteSSF) {
995
        ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF);
996
        if (ret)
997
            vs->sasl.waitWriteSSF -= ret;
998
    } else
999
#endif /* CONFIG_VNC_SASL */
1000
        ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset);
1001
    if (!ret)
1002
        return 0;
1003

    
1004
    memmove(vs->output.buffer, vs->output.buffer + ret, (vs->output.offset - ret));
1005
    vs->output.offset -= ret;
1006

    
1007
    if (vs->output.offset == 0) {
1008
        qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
1009
    }
1010

    
1011
    return ret;
1012
}
1013

    
1014

    
1015
/*
1016
 * First function called whenever there is data to be written to
1017
 * the client socket. Will delegate actual work according to whether
1018
 * SASL SSF layers are enabled (thus requiring encryption calls)
1019
 */
1020
void vnc_client_write(void *opaque)
1021
{
1022
    long ret;
1023
    VncState *vs = opaque;
1024

    
1025
#ifdef CONFIG_VNC_SASL
1026
    if (vs->sasl.conn &&
1027
        vs->sasl.runSSF &&
1028
        !vs->sasl.waitWriteSSF)
1029
        ret = vnc_client_write_sasl(vs);
1030
    else
1031
#endif /* CONFIG_VNC_SASL */
1032
        ret = vnc_client_write_plain(vs);
1033
}
1034

    
1035
void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting)
1036
{
1037
    vs->read_handler = func;
1038
    vs->read_handler_expect = expecting;
1039
}
1040

    
1041

    
1042
/*
1043
 * Called to read a chunk of data from the client socket. The data may
1044
 * be the raw data, or may need to be further decoded by SASL.
1045
 * The data will be read either straight from to the socket, or
1046
 * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1047
 *
1048
 * NB, it is theoretically possible to have 2 layers of encryption,
1049
 * both SASL, and this TLS layer. It is highly unlikely in practice
1050
 * though, since SASL encryption will typically be a no-op if TLS
1051
 * is active
1052
 *
1053
 * Returns the number of bytes read, which may be less than
1054
 * the requested 'datalen' if the socket would block. Returns
1055
 * -1 on error, and disconnects the client socket.
1056
 */
1057
long vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen)
1058
{
1059
    long ret;
1060
#ifdef CONFIG_VNC_TLS
1061
    if (vs->tls.session) {
1062
        ret = gnutls_read(vs->tls.session, data, datalen);
1063
        if (ret < 0) {
1064
            if (ret == GNUTLS_E_AGAIN)
1065
                errno = EAGAIN;
1066
            else
1067
                errno = EIO;
1068
            ret = -1;
1069
        }
1070
    } else
1071
#endif /* CONFIG_VNC_TLS */
1072
        ret = recv(vs->csock, data, datalen, 0);
1073
    VNC_DEBUG("Read wire %p %zd -> %ld\n", data, datalen, ret);
1074
    return vnc_client_io_error(vs, ret, socket_error());
1075
}
1076

    
1077

    
1078
/*
1079
 * Called to read data from the client socket to the input buffer,
1080
 * when not using any SASL SSF encryption layers. Will read as much
1081
 * data as possible without blocking.
1082
 *
1083
 * Returns the number of bytes read. Returns -1 on error, and
1084
 * disconnects the client socket.
1085
 */
1086
static long vnc_client_read_plain(VncState *vs)
1087
{
1088
    int ret;
1089
    VNC_DEBUG("Read plain %p size %zd offset %zd\n",
1090
              vs->input.buffer, vs->input.capacity, vs->input.offset);
1091
    buffer_reserve(&vs->input, 4096);
1092
    ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096);
1093
    if (!ret)
1094
        return 0;
1095
    vs->input.offset += ret;
1096
    return ret;
1097
}
1098

    
1099

    
1100
/*
1101
 * First function called whenever there is more data to be read from
1102
 * the client socket. Will delegate actual work according to whether
1103
 * SASL SSF layers are enabled (thus requiring decryption calls)
1104
 */
1105
void vnc_client_read(void *opaque)
1106
{
1107
    VncState *vs = opaque;
1108
    long ret;
1109

    
1110
#ifdef CONFIG_VNC_SASL
1111
    if (vs->sasl.conn && vs->sasl.runSSF)
1112
        ret = vnc_client_read_sasl(vs);
1113
    else
1114
#endif /* CONFIG_VNC_SASL */
1115
        ret = vnc_client_read_plain(vs);
1116
    if (!ret)
1117
        return;
1118

    
1119
    while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) {
1120
        size_t len = vs->read_handler_expect;
1121
        int ret;
1122

    
1123
        ret = vs->read_handler(vs, vs->input.buffer, len);
1124
        if (vs->csock == -1)
1125
            return;
1126

    
1127
        if (!ret) {
1128
            memmove(vs->input.buffer, vs->input.buffer + len, (vs->input.offset - len));
1129
            vs->input.offset -= len;
1130
        } else {
1131
            vs->read_handler_expect = ret;
1132
        }
1133
    }
1134
}
1135

    
1136
void vnc_write(VncState *vs, const void *data, size_t len)
1137
{
1138
    buffer_reserve(&vs->output, len);
1139

    
1140
    if (buffer_empty(&vs->output)) {
1141
        qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, vnc_client_write, vs);
1142
    }
1143

    
1144
    buffer_append(&vs->output, data, len);
1145
}
1146

    
1147
void vnc_write_s32(VncState *vs, int32_t value)
1148
{
1149
    vnc_write_u32(vs, *(uint32_t *)&value);
1150
}
1151

    
1152
void vnc_write_u32(VncState *vs, uint32_t value)
1153
{
1154
    uint8_t buf[4];
1155

    
1156
    buf[0] = (value >> 24) & 0xFF;
1157
    buf[1] = (value >> 16) & 0xFF;
1158
    buf[2] = (value >>  8) & 0xFF;
1159
    buf[3] = value & 0xFF;
1160

    
1161
    vnc_write(vs, buf, 4);
1162
}
1163

    
1164
void vnc_write_u16(VncState *vs, uint16_t value)
1165
{
1166
    uint8_t buf[2];
1167

    
1168
    buf[0] = (value >> 8) & 0xFF;
1169
    buf[1] = value & 0xFF;
1170

    
1171
    vnc_write(vs, buf, 2);
1172
}
1173

    
1174
void vnc_write_u8(VncState *vs, uint8_t value)
1175
{
1176
    vnc_write(vs, (char *)&value, 1);
1177
}
1178

    
1179
void vnc_flush(VncState *vs)
1180
{
1181
    if (vs->output.offset)
1182
        vnc_client_write(vs);
1183
}
1184

    
1185
uint8_t read_u8(uint8_t *data, size_t offset)
1186
{
1187
    return data[offset];
1188
}
1189

    
1190
uint16_t read_u16(uint8_t *data, size_t offset)
1191
{
1192
    return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF);
1193
}
1194

    
1195
int32_t read_s32(uint8_t *data, size_t offset)
1196
{
1197
    return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) |
1198
                     (data[offset + 2] << 8) | data[offset + 3]);
1199
}
1200

    
1201
uint32_t read_u32(uint8_t *data, size_t offset)
1202
{
1203
    return ((data[offset] << 24) | (data[offset + 1] << 16) |
1204
            (data[offset + 2] << 8) | data[offset + 3]);
1205
}
1206

    
1207
static void client_cut_text(VncState *vs, size_t len, uint8_t *text)
1208
{
1209
}
1210

    
1211
static void check_pointer_type_change(VncState *vs, int absolute)
1212
{
1213
    if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) {
1214
        vnc_write_u8(vs, 0);
1215
        vnc_write_u8(vs, 0);
1216
        vnc_write_u16(vs, 1);
1217
        vnc_framebuffer_update(vs, absolute, 0,
1218
                               ds_get_width(vs->ds), ds_get_height(vs->ds),
1219
                               VNC_ENCODING_POINTER_TYPE_CHANGE);
1220
        vnc_flush(vs);
1221
    }
1222
    vs->absolute = absolute;
1223
}
1224

    
1225
static void pointer_event(VncState *vs, int button_mask, int x, int y)
1226
{
1227
    int buttons = 0;
1228
    int dz = 0;
1229

    
1230
    if (button_mask & 0x01)
1231
        buttons |= MOUSE_EVENT_LBUTTON;
1232
    if (button_mask & 0x02)
1233
        buttons |= MOUSE_EVENT_MBUTTON;
1234
    if (button_mask & 0x04)
1235
        buttons |= MOUSE_EVENT_RBUTTON;
1236
    if (button_mask & 0x08)
1237
        dz = -1;
1238
    if (button_mask & 0x10)
1239
        dz = 1;
1240

    
1241
    if (vs->absolute) {
1242
        kbd_mouse_event(x * 0x7FFF / (ds_get_width(vs->ds) - 1),
1243
                        y * 0x7FFF / (ds_get_height(vs->ds) - 1),
1244
                        dz, buttons);
1245
    } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) {
1246
        x -= 0x7FFF;
1247
        y -= 0x7FFF;
1248

    
1249
        kbd_mouse_event(x, y, dz, buttons);
1250
    } else {
1251
        if (vs->last_x != -1)
1252
            kbd_mouse_event(x - vs->last_x,
1253
                            y - vs->last_y,
1254
                            dz, buttons);
1255
        vs->last_x = x;
1256
        vs->last_y = y;
1257
    }
1258

    
1259
    check_pointer_type_change(vs, kbd_mouse_is_absolute());
1260
}
1261

    
1262
static void reset_keys(VncState *vs)
1263
{
1264
    int i;
1265
    for(i = 0; i < 256; i++) {
1266
        if (vs->modifiers_state[i]) {
1267
            if (i & 0x80)
1268
                kbd_put_keycode(0xe0);
1269
            kbd_put_keycode(i | 0x80);
1270
            vs->modifiers_state[i] = 0;
1271
        }
1272
    }
1273
}
1274

    
1275
static void press_key(VncState *vs, int keysym)
1276
{
1277
    kbd_put_keycode(keysym2scancode(vs->vd->kbd_layout, keysym) & 0x7f);
1278
    kbd_put_keycode(keysym2scancode(vs->vd->kbd_layout, keysym) | 0x80);
1279
}
1280

    
1281
static void do_key_event(VncState *vs, int down, int keycode, int sym)
1282
{
1283
    /* QEMU console switch */
1284
    switch(keycode) {
1285
    case 0x2a:                          /* Left Shift */
1286
    case 0x36:                          /* Right Shift */
1287
    case 0x1d:                          /* Left CTRL */
1288
    case 0x9d:                          /* Right CTRL */
1289
    case 0x38:                          /* Left ALT */
1290
    case 0xb8:                          /* Right ALT */
1291
        if (down)
1292
            vs->modifiers_state[keycode] = 1;
1293
        else
1294
            vs->modifiers_state[keycode] = 0;
1295
        break;
1296
    case 0x02 ... 0x0a: /* '1' to '9' keys */
1297
        if (down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) {
1298
            /* Reset the modifiers sent to the current console */
1299
            reset_keys(vs);
1300
            console_select(keycode - 0x02);
1301
            return;
1302
        }
1303
        break;
1304
    case 0x3a:                        /* CapsLock */
1305
    case 0x45:                        /* NumLock */
1306
        if (!down)
1307
            vs->modifiers_state[keycode] ^= 1;
1308
        break;
1309
    }
1310

    
1311
    if (keycode_is_keypad(vs->vd->kbd_layout, keycode)) {
1312
        /* If the numlock state needs to change then simulate an additional
1313
           keypress before sending this one.  This will happen if the user
1314
           toggles numlock away from the VNC window.
1315
        */
1316
        if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) {
1317
            if (!vs->modifiers_state[0x45]) {
1318
                vs->modifiers_state[0x45] = 1;
1319
                press_key(vs, 0xff7f);
1320
            }
1321
        } else {
1322
            if (vs->modifiers_state[0x45]) {
1323
                vs->modifiers_state[0x45] = 0;
1324
                press_key(vs, 0xff7f);
1325
            }
1326
        }
1327
    }
1328

    
1329
    if (is_graphic_console()) {
1330
        if (keycode & 0x80)
1331
            kbd_put_keycode(0xe0);
1332
        if (down)
1333
            kbd_put_keycode(keycode & 0x7f);
1334
        else
1335
            kbd_put_keycode(keycode | 0x80);
1336
    } else {
1337
        /* QEMU console emulation */
1338
        if (down) {
1339
            switch (keycode) {
1340
            case 0x2a:                          /* Left Shift */
1341
            case 0x36:                          /* Right Shift */
1342
            case 0x1d:                          /* Left CTRL */
1343
            case 0x9d:                          /* Right CTRL */
1344
            case 0x38:                          /* Left ALT */
1345
            case 0xb8:                          /* Right ALT */
1346
                break;
1347
            case 0xc8:
1348
                kbd_put_keysym(QEMU_KEY_UP);
1349
                break;
1350
            case 0xd0:
1351
                kbd_put_keysym(QEMU_KEY_DOWN);
1352
                break;
1353
            case 0xcb:
1354
                kbd_put_keysym(QEMU_KEY_LEFT);
1355
                break;
1356
            case 0xcd:
1357
                kbd_put_keysym(QEMU_KEY_RIGHT);
1358
                break;
1359
            case 0xd3:
1360
                kbd_put_keysym(QEMU_KEY_DELETE);
1361
                break;
1362
            case 0xc7:
1363
                kbd_put_keysym(QEMU_KEY_HOME);
1364
                break;
1365
            case 0xcf:
1366
                kbd_put_keysym(QEMU_KEY_END);
1367
                break;
1368
            case 0xc9:
1369
                kbd_put_keysym(QEMU_KEY_PAGEUP);
1370
                break;
1371
            case 0xd1:
1372
                kbd_put_keysym(QEMU_KEY_PAGEDOWN);
1373
                break;
1374
            default:
1375
                kbd_put_keysym(sym);
1376
                break;
1377
            }
1378
        }
1379
    }
1380
}
1381

    
1382
static void key_event(VncState *vs, int down, uint32_t sym)
1383
{
1384
    int keycode;
1385

    
1386
    if (sym >= 'A' && sym <= 'Z' && is_graphic_console())
1387
        sym = sym - 'A' + 'a';
1388

    
1389
    keycode = keysym2scancode(vs->vd->kbd_layout, sym & 0xFFFF);
1390
    do_key_event(vs, down, keycode, sym);
1391
}
1392

    
1393
static void ext_key_event(VncState *vs, int down,
1394
                          uint32_t sym, uint16_t keycode)
1395
{
1396
    /* if the user specifies a keyboard layout, always use it */
1397
    if (keyboard_layout)
1398
        key_event(vs, down, sym);
1399
    else
1400
        do_key_event(vs, down, keycode, sym);
1401
}
1402

    
1403
static void framebuffer_update_request(VncState *vs, int incremental,
1404
                                       int x_position, int y_position,
1405
                                       int w, int h)
1406
{
1407
    if (x_position > ds_get_width(vs->ds))
1408
        x_position = ds_get_width(vs->ds);
1409
    if (y_position > ds_get_height(vs->ds))
1410
        y_position = ds_get_height(vs->ds);
1411
    if (x_position + w >= ds_get_width(vs->ds))
1412
        w = ds_get_width(vs->ds)  - x_position;
1413
    if (y_position + h >= ds_get_height(vs->ds))
1414
        h = ds_get_height(vs->ds) - y_position;
1415

    
1416
    int i;
1417
    vs->need_update = 1;
1418
    vs->force_update = 1;
1419
    if (!incremental) {
1420
        for (i = 0; i < h; i++) {
1421
            vnc_set_bits(vs->guest.dirty[y_position + i],
1422
                         (ds_get_width(vs->ds) / 16), VNC_DIRTY_WORDS);
1423
            vnc_set_bits(vs->server.dirty[y_position + i],
1424
                         (ds_get_width(vs->ds) / 16), VNC_DIRTY_WORDS);
1425
        }
1426
    }
1427
}
1428

    
1429
static void send_ext_key_event_ack(VncState *vs)
1430
{
1431
    vnc_write_u8(vs, 0);
1432
    vnc_write_u8(vs, 0);
1433
    vnc_write_u16(vs, 1);
1434
    vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
1435
                           VNC_ENCODING_EXT_KEY_EVENT);
1436
    vnc_flush(vs);
1437
}
1438

    
1439
static void send_ext_audio_ack(VncState *vs)
1440
{
1441
    vnc_write_u8(vs, 0);
1442
    vnc_write_u8(vs, 0);
1443
    vnc_write_u16(vs, 1);
1444
    vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
1445
                           VNC_ENCODING_AUDIO);
1446
    vnc_flush(vs);
1447
}
1448

    
1449
static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
1450
{
1451
    int i;
1452
    unsigned int enc = 0;
1453

    
1454
    vnc_zlib_init(vs);
1455
    vs->features = 0;
1456
    vs->vnc_encoding = 0;
1457
    vs->tight_compression = 9;
1458
    vs->tight_quality = 9;
1459
    vs->absolute = -1;
1460

    
1461
    for (i = n_encodings - 1; i >= 0; i--) {
1462
        enc = encodings[i];
1463
        switch (enc) {
1464
        case VNC_ENCODING_RAW:
1465
            vs->vnc_encoding = enc;
1466
            break;
1467
        case VNC_ENCODING_COPYRECT:
1468
            vs->features |= VNC_FEATURE_COPYRECT_MASK;
1469
            break;
1470
        case VNC_ENCODING_HEXTILE:
1471
            vs->features |= VNC_FEATURE_HEXTILE_MASK;
1472
            vs->vnc_encoding = enc;
1473
            break;
1474
        case VNC_ENCODING_ZLIB:
1475
            vs->features |= VNC_FEATURE_ZLIB_MASK;
1476
            vs->vnc_encoding = enc;
1477
            break;
1478
        case VNC_ENCODING_DESKTOPRESIZE:
1479
            vs->features |= VNC_FEATURE_RESIZE_MASK;
1480
            break;
1481
        case VNC_ENCODING_POINTER_TYPE_CHANGE:
1482
            vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK;
1483
            break;
1484
        case VNC_ENCODING_EXT_KEY_EVENT:
1485
            send_ext_key_event_ack(vs);
1486
            break;
1487
        case VNC_ENCODING_AUDIO:
1488
            send_ext_audio_ack(vs);
1489
            break;
1490
        case VNC_ENCODING_WMVi:
1491
            vs->features |= VNC_FEATURE_WMVI_MASK;
1492
            break;
1493
        case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9:
1494
            vs->tight_compression = (enc & 0x0F);
1495
            break;
1496
        case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9:
1497
            vs->tight_quality = (enc & 0x0F);
1498
            break;
1499
        default:
1500
            VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc);
1501
            break;
1502
        }
1503
    }
1504

    
1505
    check_pointer_type_change(vs, kbd_mouse_is_absolute());
1506
}
1507

    
1508
static void set_pixel_conversion(VncState *vs)
1509
{
1510
    if ((vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) ==
1511
        (vs->ds->surface->flags & QEMU_BIG_ENDIAN_FLAG) && 
1512
        !memcmp(&(vs->clientds.pf), &(vs->ds->surface->pf), sizeof(PixelFormat))) {
1513
        vs->write_pixels = vnc_write_pixels_copy;
1514
        switch (vs->ds->surface->pf.bits_per_pixel) {
1515
            case 8:
1516
                vs->send_hextile_tile = send_hextile_tile_8;
1517
                break;
1518
            case 16:
1519
                vs->send_hextile_tile = send_hextile_tile_16;
1520
                break;
1521
            case 32:
1522
                vs->send_hextile_tile = send_hextile_tile_32;
1523
                break;
1524
        }
1525
    } else {
1526
        vs->write_pixels = vnc_write_pixels_generic;
1527
        switch (vs->ds->surface->pf.bits_per_pixel) {
1528
            case 8:
1529
                vs->send_hextile_tile = send_hextile_tile_generic_8;
1530
                break;
1531
            case 16:
1532
                vs->send_hextile_tile = send_hextile_tile_generic_16;
1533
                break;
1534
            case 32:
1535
                vs->send_hextile_tile = send_hextile_tile_generic_32;
1536
                break;
1537
        }
1538
    }
1539
}
1540

    
1541
static void set_pixel_format(VncState *vs,
1542
                             int bits_per_pixel, int depth,
1543
                             int big_endian_flag, int true_color_flag,
1544
                             int red_max, int green_max, int blue_max,
1545
                             int red_shift, int green_shift, int blue_shift)
1546
{
1547
    if (!true_color_flag) {
1548
        vnc_client_error(vs);
1549
        return;
1550
    }
1551

    
1552
    vs->clientds = *(vs->guest.ds);
1553
    vs->clientds.pf.rmax = red_max;
1554
    count_bits(vs->clientds.pf.rbits, red_max);
1555
    vs->clientds.pf.rshift = red_shift;
1556
    vs->clientds.pf.rmask = red_max << red_shift;
1557
    vs->clientds.pf.gmax = green_max;
1558
    count_bits(vs->clientds.pf.gbits, green_max);
1559
    vs->clientds.pf.gshift = green_shift;
1560
    vs->clientds.pf.gmask = green_max << green_shift;
1561
    vs->clientds.pf.bmax = blue_max;
1562
    count_bits(vs->clientds.pf.bbits, blue_max);
1563
    vs->clientds.pf.bshift = blue_shift;
1564
    vs->clientds.pf.bmask = blue_max << blue_shift;
1565
    vs->clientds.pf.bits_per_pixel = bits_per_pixel;
1566
    vs->clientds.pf.bytes_per_pixel = bits_per_pixel / 8;
1567
    vs->clientds.pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;
1568
    vs->clientds.flags = big_endian_flag ? QEMU_BIG_ENDIAN_FLAG : 0x00;
1569

    
1570
    set_pixel_conversion(vs);
1571

    
1572
    vga_hw_invalidate();
1573
    vga_hw_update();
1574
}
1575

    
1576
static void pixel_format_message (VncState *vs) {
1577
    char pad[3] = { 0, 0, 0 };
1578

    
1579
    vnc_write_u8(vs, vs->ds->surface->pf.bits_per_pixel); /* bits-per-pixel */
1580
    vnc_write_u8(vs, vs->ds->surface->pf.depth); /* depth */
1581

    
1582
#ifdef WORDS_BIGENDIAN
1583
    vnc_write_u8(vs, 1);             /* big-endian-flag */
1584
#else
1585
    vnc_write_u8(vs, 0);             /* big-endian-flag */
1586
#endif
1587
    vnc_write_u8(vs, 1);             /* true-color-flag */
1588
    vnc_write_u16(vs, vs->ds->surface->pf.rmax);     /* red-max */
1589
    vnc_write_u16(vs, vs->ds->surface->pf.gmax);     /* green-max */
1590
    vnc_write_u16(vs, vs->ds->surface->pf.bmax);     /* blue-max */
1591
    vnc_write_u8(vs, vs->ds->surface->pf.rshift);    /* red-shift */
1592
    vnc_write_u8(vs, vs->ds->surface->pf.gshift);    /* green-shift */
1593
    vnc_write_u8(vs, vs->ds->surface->pf.bshift);    /* blue-shift */
1594
    if (vs->ds->surface->pf.bits_per_pixel == 32)
1595
        vs->send_hextile_tile = send_hextile_tile_32;
1596
    else if (vs->ds->surface->pf.bits_per_pixel == 16)
1597
        vs->send_hextile_tile = send_hextile_tile_16;
1598
    else if (vs->ds->surface->pf.bits_per_pixel == 8)
1599
        vs->send_hextile_tile = send_hextile_tile_8;
1600
    vs->clientds = *(vs->ds->surface);
1601
    vs->clientds.flags &= ~QEMU_ALLOCATED_FLAG;
1602
    vs->write_pixels = vnc_write_pixels_copy;
1603

    
1604
    vnc_write(vs, pad, 3);           /* padding */
1605
}
1606

    
1607
static void vnc_dpy_setdata(DisplayState *ds)
1608
{
1609
    /* We don't have to do anything */
1610
}
1611

    
1612
static void vnc_colordepth(VncState *vs)
1613
{
1614
    if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) {
1615
        /* Sending a WMVi message to notify the client*/
1616
        vnc_write_u8(vs, 0);  /* msg id */
1617
        vnc_write_u8(vs, 0);
1618
        vnc_write_u16(vs, 1); /* number of rects */
1619
        vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), 
1620
                               ds_get_height(vs->ds), VNC_ENCODING_WMVi);
1621
        pixel_format_message(vs);
1622
        vnc_flush(vs);
1623
    } else {
1624
        set_pixel_conversion(vs);
1625
    }
1626
}
1627

    
1628
static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
1629
{
1630
    int i;
1631
    uint16_t limit;
1632

    
1633
    switch (data[0]) {
1634
    case 0:
1635
        if (len == 1)
1636
            return 20;
1637

    
1638
        set_pixel_format(vs, read_u8(data, 4), read_u8(data, 5),
1639
                         read_u8(data, 6), read_u8(data, 7),
1640
                         read_u16(data, 8), read_u16(data, 10),
1641
                         read_u16(data, 12), read_u8(data, 14),
1642
                         read_u8(data, 15), read_u8(data, 16));
1643
        break;
1644
    case 2:
1645
        if (len == 1)
1646
            return 4;
1647

    
1648
        if (len == 4) {
1649
            limit = read_u16(data, 2);
1650
            if (limit > 0)
1651
                return 4 + (limit * 4);
1652
        } else
1653
            limit = read_u16(data, 2);
1654

    
1655
        for (i = 0; i < limit; i++) {
1656
            int32_t val = read_s32(data, 4 + (i * 4));
1657
            memcpy(data + 4 + (i * 4), &val, sizeof(val));
1658
        }
1659

    
1660
        set_encodings(vs, (int32_t *)(data + 4), limit);
1661
        break;
1662
    case 3:
1663
        if (len == 1)
1664
            return 10;
1665

    
1666
        framebuffer_update_request(vs,
1667
                                   read_u8(data, 1), read_u16(data, 2), read_u16(data, 4),
1668
                                   read_u16(data, 6), read_u16(data, 8));
1669
        break;
1670
    case 4:
1671
        if (len == 1)
1672
            return 8;
1673

    
1674
        key_event(vs, read_u8(data, 1), read_u32(data, 4));
1675
        break;
1676
    case 5:
1677
        if (len == 1)
1678
            return 6;
1679

    
1680
        pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
1681
        break;
1682
    case 6:
1683
        if (len == 1)
1684
            return 8;
1685

    
1686
        if (len == 8) {
1687
            uint32_t dlen = read_u32(data, 4);
1688
            if (dlen > 0)
1689
                return 8 + dlen;
1690
        }
1691

    
1692
        client_cut_text(vs, read_u32(data, 4), data + 8);
1693
        break;
1694
    case 255:
1695
        if (len == 1)
1696
            return 2;
1697

    
1698
        switch (read_u8(data, 1)) {
1699
        case 0:
1700
            if (len == 2)
1701
                return 12;
1702

    
1703
            ext_key_event(vs, read_u16(data, 2),
1704
                          read_u32(data, 4), read_u32(data, 8));
1705
            break;
1706
        case 1:
1707
            if (len == 2)
1708
                return 4;
1709

    
1710
            switch (read_u16 (data, 2)) {
1711
            case 0:
1712
                audio_add(vs);
1713
                break;
1714
            case 1:
1715
                audio_del(vs);
1716
                break;
1717
            case 2:
1718
                if (len == 4)
1719
                    return 10;
1720
                switch (read_u8(data, 4)) {
1721
                case 0: vs->as.fmt = AUD_FMT_U8; break;
1722
                case 1: vs->as.fmt = AUD_FMT_S8; break;
1723
                case 2: vs->as.fmt = AUD_FMT_U16; break;
1724
                case 3: vs->as.fmt = AUD_FMT_S16; break;
1725
                case 4: vs->as.fmt = AUD_FMT_U32; break;
1726
                case 5: vs->as.fmt = AUD_FMT_S32; break;
1727
                default:
1728
                    printf("Invalid audio format %d\n", read_u8(data, 4));
1729
                    vnc_client_error(vs);
1730
                    break;
1731
                }
1732
                vs->as.nchannels = read_u8(data, 5);
1733
                if (vs->as.nchannels != 1 && vs->as.nchannels != 2) {
1734
                    printf("Invalid audio channel coount %d\n",
1735
                           read_u8(data, 5));
1736
                    vnc_client_error(vs);
1737
                    break;
1738
                }
1739
                vs->as.freq = read_u32(data, 6);
1740
                break;
1741
            default:
1742
                printf ("Invalid audio message %d\n", read_u8(data, 4));
1743
                vnc_client_error(vs);
1744
                break;
1745
            }
1746
            break;
1747

    
1748
        default:
1749
            printf("Msg: %d\n", read_u16(data, 0));
1750
            vnc_client_error(vs);
1751
            break;
1752
        }
1753
        break;
1754
    default:
1755
        printf("Msg: %d\n", data[0]);
1756
        vnc_client_error(vs);
1757
        break;
1758
    }
1759

    
1760
    vnc_read_when(vs, protocol_client_msg, 1);
1761
    return 0;
1762
}
1763

    
1764
static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
1765
{
1766
    char buf[1024];
1767
    int size;
1768

    
1769
    vnc_write_u16(vs, ds_get_width(vs->ds));
1770
    vnc_write_u16(vs, ds_get_height(vs->ds));
1771

    
1772
    pixel_format_message(vs);
1773

    
1774
    if (qemu_name)
1775
        size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
1776
    else
1777
        size = snprintf(buf, sizeof(buf), "QEMU");
1778

    
1779
    vnc_write_u32(vs, size);
1780
    vnc_write(vs, buf, size);
1781
    vnc_flush(vs);
1782

    
1783
    vnc_read_when(vs, protocol_client_msg, 1);
1784

    
1785
    return 0;
1786
}
1787

    
1788
void start_client_init(VncState *vs)
1789
{
1790
    vnc_read_when(vs, protocol_client_init, 1);
1791
}
1792

    
1793
static void make_challenge(VncState *vs)
1794
{
1795
    int i;
1796

    
1797
    srand(time(NULL)+getpid()+getpid()*987654+rand());
1798

    
1799
    for (i = 0 ; i < sizeof(vs->challenge) ; i++)
1800
        vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
1801
}
1802

    
1803
static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
1804
{
1805
    unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
1806
    int i, j, pwlen;
1807
    unsigned char key[8];
1808

    
1809
    if (!vs->vd->password || !vs->vd->password[0]) {
1810
        VNC_DEBUG("No password configured on server");
1811
        vnc_write_u32(vs, 1); /* Reject auth */
1812
        if (vs->minor >= 8) {
1813
            static const char err[] = "Authentication failed";
1814
            vnc_write_u32(vs, sizeof(err));
1815
            vnc_write(vs, err, sizeof(err));
1816
        }
1817
        vnc_flush(vs);
1818
        vnc_client_error(vs);
1819
        return 0;
1820
    }
1821

    
1822
    memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
1823

    
1824
    /* Calculate the expected challenge response */
1825
    pwlen = strlen(vs->vd->password);
1826
    for (i=0; i<sizeof(key); i++)
1827
        key[i] = i<pwlen ? vs->vd->password[i] : 0;
1828
    deskey(key, EN0);
1829
    for (j = 0; j < VNC_AUTH_CHALLENGE_SIZE; j += 8)
1830
        des(response+j, response+j);
1831

    
1832
    /* Compare expected vs actual challenge response */
1833
    if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) {
1834
        VNC_DEBUG("Client challenge reponse did not match\n");
1835
        vnc_write_u32(vs, 1); /* Reject auth */
1836
        if (vs->minor >= 8) {
1837
            static const char err[] = "Authentication failed";
1838
            vnc_write_u32(vs, sizeof(err));
1839
            vnc_write(vs, err, sizeof(err));
1840
        }
1841
        vnc_flush(vs);
1842
        vnc_client_error(vs);
1843
    } else {
1844
        VNC_DEBUG("Accepting VNC challenge response\n");
1845
        vnc_write_u32(vs, 0); /* Accept auth */
1846
        vnc_flush(vs);
1847

    
1848
        start_client_init(vs);
1849
    }
1850
    return 0;
1851
}
1852

    
1853
void start_auth_vnc(VncState *vs)
1854
{
1855
    make_challenge(vs);
1856
    /* Send client a 'random' challenge */
1857
    vnc_write(vs, vs->challenge, sizeof(vs->challenge));
1858
    vnc_flush(vs);
1859

    
1860
    vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge));
1861
}
1862

    
1863

    
1864
static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
1865
{
1866
    /* We only advertise 1 auth scheme at a time, so client
1867
     * must pick the one we sent. Verify this */
1868
    if (data[0] != vs->vd->auth) { /* Reject auth */
1869
       VNC_DEBUG("Reject auth %d because it didn't match advertized\n", (int)data[0]);
1870
       vnc_write_u32(vs, 1);
1871
       if (vs->minor >= 8) {
1872
           static const char err[] = "Authentication failed";
1873
           vnc_write_u32(vs, sizeof(err));
1874
           vnc_write(vs, err, sizeof(err));
1875
       }
1876
       vnc_client_error(vs);
1877
    } else { /* Accept requested auth */
1878
       VNC_DEBUG("Client requested auth %d\n", (int)data[0]);
1879
       switch (vs->vd->auth) {
1880
       case VNC_AUTH_NONE:
1881
           VNC_DEBUG("Accept auth none\n");
1882
           if (vs->minor >= 8) {
1883
               vnc_write_u32(vs, 0); /* Accept auth completion */
1884
               vnc_flush(vs);
1885
           }
1886
           start_client_init(vs);
1887
           break;
1888

    
1889
       case VNC_AUTH_VNC:
1890
           VNC_DEBUG("Start VNC auth\n");
1891
           start_auth_vnc(vs);
1892
           break;
1893

    
1894
#ifdef CONFIG_VNC_TLS
1895
       case VNC_AUTH_VENCRYPT:
1896
           VNC_DEBUG("Accept VeNCrypt auth\n");;
1897
           start_auth_vencrypt(vs);
1898
           break;
1899
#endif /* CONFIG_VNC_TLS */
1900

    
1901
#ifdef CONFIG_VNC_SASL
1902
       case VNC_AUTH_SASL:
1903
           VNC_DEBUG("Accept SASL auth\n");
1904
           start_auth_sasl(vs);
1905
           break;
1906
#endif /* CONFIG_VNC_SASL */
1907

    
1908
       default: /* Should not be possible, but just in case */
1909
           VNC_DEBUG("Reject auth %d server code bug\n", vs->vd->auth);
1910
           vnc_write_u8(vs, 1);
1911
           if (vs->minor >= 8) {
1912
               static const char err[] = "Authentication failed";
1913
               vnc_write_u32(vs, sizeof(err));
1914
               vnc_write(vs, err, sizeof(err));
1915
           }
1916
           vnc_client_error(vs);
1917
       }
1918
    }
1919
    return 0;
1920
}
1921

    
1922
static int protocol_version(VncState *vs, uint8_t *version, size_t len)
1923
{
1924
    char local[13];
1925

    
1926
    memcpy(local, version, 12);
1927
    local[12] = 0;
1928

    
1929
    if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) {
1930
        VNC_DEBUG("Malformed protocol version %s\n", local);
1931
        vnc_client_error(vs);
1932
        return 0;
1933
    }
1934
    VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor);
1935
    if (vs->major != 3 ||
1936
        (vs->minor != 3 &&
1937
         vs->minor != 4 &&
1938
         vs->minor != 5 &&
1939
         vs->minor != 7 &&
1940
         vs->minor != 8)) {
1941
        VNC_DEBUG("Unsupported client version\n");
1942
        vnc_write_u32(vs, VNC_AUTH_INVALID);
1943
        vnc_flush(vs);
1944
        vnc_client_error(vs);
1945
        return 0;
1946
    }
1947
    /* Some broken clients report v3.4 or v3.5, which spec requires to be treated
1948
     * as equivalent to v3.3 by servers
1949
     */
1950
    if (vs->minor == 4 || vs->minor == 5)
1951
        vs->minor = 3;
1952

    
1953
    if (vs->minor == 3) {
1954
        if (vs->vd->auth == VNC_AUTH_NONE) {
1955
            VNC_DEBUG("Tell client auth none\n");
1956
            vnc_write_u32(vs, vs->vd->auth);
1957
            vnc_flush(vs);
1958
            start_client_init(vs);
1959
       } else if (vs->vd->auth == VNC_AUTH_VNC) {
1960
            VNC_DEBUG("Tell client VNC auth\n");
1961
            vnc_write_u32(vs, vs->vd->auth);
1962
            vnc_flush(vs);
1963
            start_auth_vnc(vs);
1964
       } else {
1965
            VNC_DEBUG("Unsupported auth %d for protocol 3.3\n", vs->vd->auth);
1966
            vnc_write_u32(vs, VNC_AUTH_INVALID);
1967
            vnc_flush(vs);
1968
            vnc_client_error(vs);
1969
       }
1970
    } else {
1971
        VNC_DEBUG("Telling client we support auth %d\n", vs->vd->auth);
1972
        vnc_write_u8(vs, 1); /* num auth */
1973
        vnc_write_u8(vs, vs->vd->auth);
1974
        vnc_read_when(vs, protocol_client_auth, 1);
1975
        vnc_flush(vs);
1976
    }
1977

    
1978
    return 0;
1979
}
1980

    
1981
static void vnc_connect(VncDisplay *vd, int csock)
1982
{
1983
    VncState *vs = qemu_mallocz(sizeof(VncState));
1984
    vs->csock = csock;
1985

    
1986
    VNC_DEBUG("New client on socket %d\n", csock);
1987
    dcl->idle = 0;
1988
    socket_set_nonblock(vs->csock);
1989
    qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
1990

    
1991
    vs->vd = vd;
1992
    vs->ds = vd->ds;
1993
    vs->timer = qemu_new_timer(rt_clock, vnc_update_client, vs);
1994
    vs->last_x = -1;
1995
    vs->last_y = -1;
1996

    
1997
    vs->as.freq = 44100;
1998
    vs->as.nchannels = 2;
1999
    vs->as.fmt = AUD_FMT_S16;
2000
    vs->as.endianness = 0;
2001

    
2002
    vnc_resize(vs);
2003
    vnc_write(vs, "RFB 003.008\n", 12);
2004
    vnc_flush(vs);
2005
    vnc_read_when(vs, protocol_version, 12);
2006
    vnc_update_client(vs);
2007
    reset_keys(vs);
2008

    
2009
    vs->next = vd->clients;
2010
    vd->clients = vs;
2011
}
2012

    
2013
static void vnc_listen_read(void *opaque)
2014
{
2015
    VncDisplay *vs = opaque;
2016
    struct sockaddr_in addr;
2017
    socklen_t addrlen = sizeof(addr);
2018

    
2019
    /* Catch-up */
2020
    vga_hw_update();
2021

    
2022
    int csock = accept(vs->lsock, (struct sockaddr *)&addr, &addrlen);
2023
    if (csock != -1) {
2024
        vnc_connect(vs, csock);
2025
    }
2026
}
2027

    
2028
void vnc_display_init(DisplayState *ds)
2029
{
2030
    VncDisplay *vs;
2031

    
2032
    vs = qemu_mallocz(sizeof(VncState));
2033
    dcl = qemu_mallocz(sizeof(DisplayChangeListener));
2034

    
2035
    ds->opaque = vs;
2036
    dcl->idle = 1;
2037
    vnc_display = vs;
2038

    
2039
    vs->lsock = -1;
2040

    
2041
    vs->ds = ds;
2042

    
2043
    if (keyboard_layout)
2044
        vs->kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout);
2045
    else
2046
        vs->kbd_layout = init_keyboard_layout(name2keysym, "en-us");
2047

    
2048
    if (!vs->kbd_layout)
2049
        exit(1);
2050

    
2051
    dcl->dpy_copy = vnc_dpy_copy;
2052
    dcl->dpy_update = vnc_dpy_update;
2053
    dcl->dpy_resize = vnc_dpy_resize;
2054
    dcl->dpy_setdata = vnc_dpy_setdata;
2055
    register_displaychangelistener(ds, dcl);
2056
}
2057

    
2058

    
2059
void vnc_display_close(DisplayState *ds)
2060
{
2061
    VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2062

    
2063
    if (!vs)
2064
        return;
2065
    if (vs->display) {
2066
        qemu_free(vs->display);
2067
        vs->display = NULL;
2068
    }
2069
    if (vs->lsock != -1) {
2070
        qemu_set_fd_handler2(vs->lsock, NULL, NULL, NULL, NULL);
2071
        close(vs->lsock);
2072
        vs->lsock = -1;
2073
    }
2074
    vs->auth = VNC_AUTH_INVALID;
2075
#ifdef CONFIG_VNC_TLS
2076
    vs->subauth = VNC_AUTH_INVALID;
2077
    vs->tls.x509verify = 0;
2078
#endif
2079
}
2080

    
2081
int vnc_display_password(DisplayState *ds, const char *password)
2082
{
2083
    VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2084

    
2085
    if (vs->password) {
2086
        qemu_free(vs->password);
2087
        vs->password = NULL;
2088
    }
2089
    if (password && password[0]) {
2090
        if (!(vs->password = qemu_strdup(password)))
2091
            return -1;
2092
    }
2093

    
2094
    return 0;
2095
}
2096

    
2097
int vnc_display_open(DisplayState *ds, const char *display)
2098
{
2099
    VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2100
    const char *options;
2101
    int password = 0;
2102
    int reverse = 0;
2103
    int to_port = 0;
2104
#ifdef CONFIG_VNC_TLS
2105
    int tls = 0, x509 = 0;
2106
#endif
2107
#ifdef CONFIG_VNC_SASL
2108
    int sasl = 0;
2109
    int saslErr;
2110
#endif
2111
    int acl = 0;
2112

    
2113
    if (!vnc_display)
2114
        return -1;
2115
    vnc_display_close(ds);
2116
    if (strcmp(display, "none") == 0)
2117
        return 0;
2118

    
2119
    if (!(vs->display = strdup(display)))
2120
        return -1;
2121

    
2122
    options = display;
2123
    while ((options = strchr(options, ','))) {
2124
        options++;
2125
        if (strncmp(options, "password", 8) == 0) {
2126
            password = 1; /* Require password auth */
2127
        } else if (strncmp(options, "reverse", 7) == 0) {
2128
            reverse = 1;
2129
        } else if (strncmp(options, "to=", 3) == 0) {
2130
            to_port = atoi(options+3) + 5900;
2131
#ifdef CONFIG_VNC_SASL
2132
        } else if (strncmp(options, "sasl", 4) == 0) {
2133
            sasl = 1; /* Require SASL auth */
2134
#endif
2135
#ifdef CONFIG_VNC_TLS
2136
        } else if (strncmp(options, "tls", 3) == 0) {
2137
            tls = 1; /* Require TLS */
2138
        } else if (strncmp(options, "x509", 4) == 0) {
2139
            char *start, *end;
2140
            x509 = 1; /* Require x509 certificates */
2141
            if (strncmp(options, "x509verify", 10) == 0)
2142
                vs->tls.x509verify = 1; /* ...and verify client certs */
2143

    
2144
            /* Now check for 'x509=/some/path' postfix
2145
             * and use that to setup x509 certificate/key paths */
2146
            start = strchr(options, '=');
2147
            end = strchr(options, ',');
2148
            if (start && (!end || (start < end))) {
2149
                int len = end ? end-(start+1) : strlen(start+1);
2150
                char *path = qemu_strndup(start + 1, len);
2151

    
2152
                VNC_DEBUG("Trying certificate path '%s'\n", path);
2153
                if (vnc_tls_set_x509_creds_dir(vs, path) < 0) {
2154
                    fprintf(stderr, "Failed to find x509 certificates/keys in %s\n", path);
2155
                    qemu_free(path);
2156
                    qemu_free(vs->display);
2157
                    vs->display = NULL;
2158
                    return -1;
2159
                }
2160
                qemu_free(path);
2161
            } else {
2162
                fprintf(stderr, "No certificate path provided\n");
2163
                qemu_free(vs->display);
2164
                vs->display = NULL;
2165
                return -1;
2166
            }
2167
#endif
2168
        } else if (strncmp(options, "acl", 3) == 0) {
2169
            acl = 1;
2170
        }
2171
    }
2172

    
2173
#ifdef CONFIG_VNC_TLS
2174
    if (acl && x509 && vs->tls.x509verify) {
2175
        if (!(vs->tls.acl = qemu_acl_init("vnc.x509dname"))) {
2176
            fprintf(stderr, "Failed to create x509 dname ACL\n");
2177
            exit(1);
2178
        }
2179
    }
2180
#endif
2181
#ifdef CONFIG_VNC_SASL
2182
    if (acl && sasl) {
2183
        if (!(vs->sasl.acl = qemu_acl_init("vnc.username"))) {
2184
            fprintf(stderr, "Failed to create username ACL\n");
2185
            exit(1);
2186
        }
2187
    }
2188
#endif
2189

    
2190
    /*
2191
     * Combinations we support here:
2192
     *
2193
     *  - no-auth                (clear text, no auth)
2194
     *  - password               (clear text, weak auth)
2195
     *  - sasl                   (encrypt, good auth *IF* using Kerberos via GSSAPI)
2196
     *  - tls                    (encrypt, weak anonymous creds, no auth)
2197
     *  - tls + password         (encrypt, weak anonymous creds, weak auth)
2198
     *  - tls + sasl             (encrypt, weak anonymous creds, good auth)
2199
     *  - tls + x509             (encrypt, good x509 creds, no auth)
2200
     *  - tls + x509 + password  (encrypt, good x509 creds, weak auth)
2201
     *  - tls + x509 + sasl      (encrypt, good x509 creds, good auth)
2202
     *
2203
     * NB1. TLS is a stackable auth scheme.
2204
     * NB2. the x509 schemes have option to validate a client cert dname
2205
     */
2206
    if (password) {
2207
#ifdef CONFIG_VNC_TLS
2208
        if (tls) {
2209
            vs->auth = VNC_AUTH_VENCRYPT;
2210
            if (x509) {
2211
                VNC_DEBUG("Initializing VNC server with x509 password auth\n");
2212
                vs->subauth = VNC_AUTH_VENCRYPT_X509VNC;
2213
            } else {
2214
                VNC_DEBUG("Initializing VNC server with TLS password auth\n");
2215
                vs->subauth = VNC_AUTH_VENCRYPT_TLSVNC;
2216
            }
2217
        } else {
2218
#endif /* CONFIG_VNC_TLS */
2219
            VNC_DEBUG("Initializing VNC server with password auth\n");
2220
            vs->auth = VNC_AUTH_VNC;
2221
#ifdef CONFIG_VNC_TLS
2222
            vs->subauth = VNC_AUTH_INVALID;
2223
        }
2224
#endif /* CONFIG_VNC_TLS */
2225
#ifdef CONFIG_VNC_SASL
2226
    } else if (sasl) {
2227
#ifdef CONFIG_VNC_TLS
2228
        if (tls) {
2229
            vs->auth = VNC_AUTH_VENCRYPT;
2230
            if (x509) {
2231
                VNC_DEBUG("Initializing VNC server with x509 SASL auth\n");
2232
                vs->subauth = VNC_AUTH_VENCRYPT_X509SASL;
2233
            } else {
2234
                VNC_DEBUG("Initializing VNC server with TLS SASL auth\n");
2235
                vs->subauth = VNC_AUTH_VENCRYPT_TLSSASL;
2236
            }
2237
        } else {
2238
#endif /* CONFIG_VNC_TLS */
2239
            VNC_DEBUG("Initializing VNC server with SASL auth\n");
2240
            vs->auth = VNC_AUTH_SASL;
2241
#ifdef CONFIG_VNC_TLS
2242
            vs->subauth = VNC_AUTH_INVALID;
2243
        }
2244
#endif /* CONFIG_VNC_TLS */
2245
#endif /* CONFIG_VNC_SASL */
2246
    } else {
2247
#ifdef CONFIG_VNC_TLS
2248
        if (tls) {
2249
            vs->auth = VNC_AUTH_VENCRYPT;
2250
            if (x509) {
2251
                VNC_DEBUG("Initializing VNC server with x509 no auth\n");
2252
                vs->subauth = VNC_AUTH_VENCRYPT_X509NONE;
2253
            } else {
2254
                VNC_DEBUG("Initializing VNC server with TLS no auth\n");
2255
                vs->subauth = VNC_AUTH_VENCRYPT_TLSNONE;
2256
            }
2257
        } else {
2258
#endif
2259
            VNC_DEBUG("Initializing VNC server with no auth\n");
2260
            vs->auth = VNC_AUTH_NONE;
2261
#ifdef CONFIG_VNC_TLS
2262
            vs->subauth = VNC_AUTH_INVALID;
2263
        }
2264
#endif
2265
    }
2266

    
2267
#ifdef CONFIG_VNC_SASL
2268
    if ((saslErr = sasl_server_init(NULL, "qemu")) != SASL_OK) {
2269
        fprintf(stderr, "Failed to initialize SASL auth %s",
2270
                sasl_errstring(saslErr, NULL, NULL));
2271
        free(vs->display);
2272
        vs->display = NULL;
2273
        return -1;
2274
    }
2275
#endif
2276

    
2277
    if (reverse) {
2278
        /* connect to viewer */
2279
        if (strncmp(display, "unix:", 5) == 0)
2280
            vs->lsock = unix_connect(display+5);
2281
        else
2282
            vs->lsock = inet_connect(display, SOCK_STREAM);
2283
        if (-1 == vs->lsock) {
2284
            free(vs->display);
2285
            vs->display = NULL;
2286
            return -1;
2287
        } else {
2288
            int csock = vs->lsock;
2289
            vs->lsock = -1;
2290
            vnc_connect(vs, csock);
2291
        }
2292
        return 0;
2293

    
2294
    } else {
2295
        /* listen for connects */
2296
        char *dpy;
2297
        dpy = qemu_malloc(256);
2298
        if (strncmp(display, "unix:", 5) == 0) {
2299
            pstrcpy(dpy, 256, "unix:");
2300
            vs->lsock = unix_listen(display+5, dpy+5, 256-5);
2301
        } else {
2302
            vs->lsock = inet_listen(display, dpy, 256, SOCK_STREAM, 5900);
2303
        }
2304
        if (-1 == vs->lsock) {
2305
            free(dpy);
2306
            return -1;
2307
        } else {
2308
            free(vs->display);
2309
            vs->display = dpy;
2310
        }
2311
    }
2312
    return qemu_set_fd_handler2(vs->lsock, NULL, vnc_listen_read, NULL, vs);
2313
}