Statistics
| Branch: | Revision:

root / vnc.c @ 9bd7854e

History | View | Annotate | Download (73.3 kB)

1
/*
2
 * QEMU VNC display driver
3
 *
4
 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5
 * Copyright (C) 2006 Fabrice Bellard
6
 * Copyright (C) 2009 Red Hat, Inc
7
 *
8
 * Permission is hereby granted, free of charge, to any person obtaining a copy
9
 * of this software and associated documentation files (the "Software"), to deal
10
 * in the Software without restriction, including without limitation the rights
11
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12
 * copies of the Software, and to permit persons to whom the Software is
13
 * furnished to do so, subject to the following conditions:
14
 *
15
 * The above copyright notice and this permission notice shall be included in
16
 * all copies or substantial portions of the Software.
17
 *
18
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24
 * THE SOFTWARE.
25
 */
26

    
27
#include "vnc.h"
28
#include "sysemu.h"
29
#include "qemu_socket.h"
30
#include "qemu-timer.h"
31
#include "acl.h"
32

    
33
#define VNC_REFRESH_INTERVAL_BASE 30
34
#define VNC_REFRESH_INTERVAL_INC  50
35
#define VNC_REFRESH_INTERVAL_MAX  2000
36

    
37
#include "vnc_keysym.h"
38
#include "d3des.h"
39

    
40
#define count_bits(c, v) { \
41
    for (c = 0; v; v >>= 1) \
42
    { \
43
        c += v & 1; \
44
    } \
45
}
46

    
47

    
48
static VncDisplay *vnc_display; /* needed for info vnc */
49
static DisplayChangeListener *dcl;
50

    
51
static char *addr_to_string(const char *format,
52
                            struct sockaddr_storage *sa,
53
                            socklen_t salen) {
54
    char *addr;
55
    char host[NI_MAXHOST];
56
    char serv[NI_MAXSERV];
57
    int err;
58
    size_t addrlen;
59

    
60
    if ((err = getnameinfo((struct sockaddr *)sa, salen,
61
                           host, sizeof(host),
62
                           serv, sizeof(serv),
63
                           NI_NUMERICHOST | NI_NUMERICSERV)) != 0) {
64
        VNC_DEBUG("Cannot resolve address %d: %s\n",
65
                  err, gai_strerror(err));
66
        return NULL;
67
    }
68

    
69
    /* Enough for the existing format + the 2 vars we're
70
     * substituting in. */
71
    addrlen = strlen(format) + strlen(host) + strlen(serv);
72
    addr = qemu_malloc(addrlen + 1);
73
    snprintf(addr, addrlen, format, host, serv);
74
    addr[addrlen] = '\0';
75

    
76
    return addr;
77
}
78

    
79

    
80
char *vnc_socket_local_addr(const char *format, int fd) {
81
    struct sockaddr_storage sa;
82
    socklen_t salen;
83

    
84
    salen = sizeof(sa);
85
    if (getsockname(fd, (struct sockaddr*)&sa, &salen) < 0)
86
        return NULL;
87

    
88
    return addr_to_string(format, &sa, salen);
89
}
90

    
91
char *vnc_socket_remote_addr(const char *format, int fd) {
92
    struct sockaddr_storage sa;
93
    socklen_t salen;
94

    
95
    salen = sizeof(sa);
96
    if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0)
97
        return NULL;
98

    
99
    return addr_to_string(format, &sa, salen);
100
}
101

    
102
static const char *vnc_auth_name(VncDisplay *vd) {
103
    switch (vd->auth) {
104
    case VNC_AUTH_INVALID:
105
        return "invalid";
106
    case VNC_AUTH_NONE:
107
        return "none";
108
    case VNC_AUTH_VNC:
109
        return "vnc";
110
    case VNC_AUTH_RA2:
111
        return "ra2";
112
    case VNC_AUTH_RA2NE:
113
        return "ra2ne";
114
    case VNC_AUTH_TIGHT:
115
        return "tight";
116
    case VNC_AUTH_ULTRA:
117
        return "ultra";
118
    case VNC_AUTH_TLS:
119
        return "tls";
120
    case VNC_AUTH_VENCRYPT:
121
#ifdef CONFIG_VNC_TLS
122
        switch (vd->subauth) {
123
        case VNC_AUTH_VENCRYPT_PLAIN:
124
            return "vencrypt+plain";
125
        case VNC_AUTH_VENCRYPT_TLSNONE:
126
            return "vencrypt+tls+none";
127
        case VNC_AUTH_VENCRYPT_TLSVNC:
128
            return "vencrypt+tls+vnc";
129
        case VNC_AUTH_VENCRYPT_TLSPLAIN:
130
            return "vencrypt+tls+plain";
131
        case VNC_AUTH_VENCRYPT_X509NONE:
132
            return "vencrypt+x509+none";
133
        case VNC_AUTH_VENCRYPT_X509VNC:
134
            return "vencrypt+x509+vnc";
135
        case VNC_AUTH_VENCRYPT_X509PLAIN:
136
            return "vencrypt+x509+plain";
137
        case VNC_AUTH_VENCRYPT_TLSSASL:
138
            return "vencrypt+tls+sasl";
139
        case VNC_AUTH_VENCRYPT_X509SASL:
140
            return "vencrypt+x509+sasl";
141
        default:
142
            return "vencrypt";
143
        }
144
#else
145
        return "vencrypt";
146
#endif
147
    case VNC_AUTH_SASL:
148
        return "sasl";
149
    }
150
    return "unknown";
151
}
152

    
153
static void do_info_vnc_client(Monitor *mon, VncState *client)
154
{
155
    char *clientAddr =
156
        vnc_socket_remote_addr("     address: %s:%s\n",
157
                               client->csock);
158
    if (!clientAddr)
159
        return;
160

    
161
    monitor_printf(mon, "Client:\n");
162
    monitor_printf(mon, "%s", clientAddr);
163
    free(clientAddr);
164

    
165
#ifdef CONFIG_VNC_TLS
166
    if (client->tls.session &&
167
        client->tls.dname)
168
        monitor_printf(mon, "  x509 dname: %s\n", client->tls.dname);
169
    else
170
        monitor_printf(mon, "  x509 dname: none\n");
171
#endif
172
#ifdef CONFIG_VNC_SASL
173
    if (client->sasl.conn &&
174
        client->sasl.username)
175
        monitor_printf(mon, "    username: %s\n", client->sasl.username);
176
    else
177
        monitor_printf(mon, "    username: none\n");
178
#endif
179
}
180

    
181
void do_info_vnc(Monitor *mon)
182
{
183
    if (vnc_display == NULL || vnc_display->display == NULL) {
184
        monitor_printf(mon, "Server: disabled\n");
185
    } else {
186
        char *serverAddr = vnc_socket_local_addr("     address: %s:%s\n",
187
                                                 vnc_display->lsock);
188

    
189
        if (!serverAddr)
190
            return;
191

    
192
        monitor_printf(mon, "Server:\n");
193
        monitor_printf(mon, "%s", serverAddr);
194
        free(serverAddr);
195
        monitor_printf(mon, "        auth: %s\n", vnc_auth_name(vnc_display));
196

    
197
        if (vnc_display->clients) {
198
            VncState *client = vnc_display->clients;
199
            while (client) {
200
                do_info_vnc_client(mon, client);
201
                client = client->next;
202
            }
203
        } else {
204
            monitor_printf(mon, "Client: none\n");
205
        }
206
    }
207
}
208

    
209
static inline uint32_t vnc_has_feature(VncState *vs, int feature) {
210
    return (vs->features & (1 << feature));
211
}
212

    
213
/* TODO
214
   1) Get the queue working for IO.
215
   2) there is some weirdness when using the -S option (the screen is grey
216
      and not totally invalidated
217
   3) resolutions > 1024
218
*/
219

    
220
static int vnc_update_client(VncState *vs, int has_dirty);
221
static void vnc_disconnect_start(VncState *vs);
222
static void vnc_disconnect_finish(VncState *vs);
223
static void vnc_init_timer(VncDisplay *vd);
224
static void vnc_remove_timer(VncDisplay *vd);
225

    
226
static void vnc_colordepth(VncState *vs);
227
static void framebuffer_update_request(VncState *vs, int incremental,
228
                                       int x_position, int y_position,
229
                                       int w, int h);
230
static void vnc_refresh(void *opaque);
231
static int vnc_refresh_server_surface(VncDisplay *vd);
232

    
233
static inline void vnc_set_bit(uint32_t *d, int k)
234
{
235
    d[k >> 5] |= 1 << (k & 0x1f);
236
}
237

    
238
static inline void vnc_clear_bit(uint32_t *d, int k)
239
{
240
    d[k >> 5] &= ~(1 << (k & 0x1f));
241
}
242

    
243
static inline void vnc_set_bits(uint32_t *d, int n, int nb_words)
244
{
245
    int j;
246

    
247
    j = 0;
248
    while (n >= 32) {
249
        d[j++] = -1;
250
        n -= 32;
251
    }
252
    if (n > 0)
253
        d[j++] = (1 << n) - 1;
254
    while (j < nb_words)
255
        d[j++] = 0;
256
}
257

    
258
static inline int vnc_get_bit(const uint32_t *d, int k)
259
{
260
    return (d[k >> 5] >> (k & 0x1f)) & 1;
261
}
262

    
263
static inline int vnc_and_bits(const uint32_t *d1, const uint32_t *d2,
264
                               int nb_words)
265
{
266
    int i;
267
    for(i = 0; i < nb_words; i++) {
268
        if ((d1[i] & d2[i]) != 0)
269
            return 1;
270
    }
271
    return 0;
272
}
273

    
274
static void vnc_dpy_update(DisplayState *ds, int x, int y, int w, int h)
275
{
276
    int i;
277
    VncDisplay *vd = ds->opaque;
278
    struct VncSurface *s = &vd->guest;
279

    
280
    h += y;
281

    
282
    /* round x down to ensure the loop only spans one 16-pixel block per,
283
       iteration.  otherwise, if (x % 16) != 0, the last iteration may span
284
       two 16-pixel blocks but we only mark the first as dirty
285
    */
286
    w += (x % 16);
287
    x -= (x % 16);
288

    
289
    x = MIN(x, s->ds->width);
290
    y = MIN(y, s->ds->height);
291
    w = MIN(x + w, s->ds->width) - x;
292
    h = MIN(h, s->ds->height);
293

    
294
    for (; y < h; y++)
295
        for (i = 0; i < w; i += 16)
296
            vnc_set_bit(s->dirty[y], (x + i) / 16);
297
}
298

    
299
static void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h,
300
                                   int32_t encoding)
301
{
302
    vnc_write_u16(vs, x);
303
    vnc_write_u16(vs, y);
304
    vnc_write_u16(vs, w);
305
    vnc_write_u16(vs, h);
306

    
307
    vnc_write_s32(vs, encoding);
308
}
309

    
310
void buffer_reserve(Buffer *buffer, size_t len)
311
{
312
    if ((buffer->capacity - buffer->offset) < len) {
313
        buffer->capacity += (len + 1024);
314
        buffer->buffer = qemu_realloc(buffer->buffer, buffer->capacity);
315
        if (buffer->buffer == NULL) {
316
            fprintf(stderr, "vnc: out of memory\n");
317
            exit(1);
318
        }
319
    }
320
}
321

    
322
int buffer_empty(Buffer *buffer)
323
{
324
    return buffer->offset == 0;
325
}
326

    
327
uint8_t *buffer_end(Buffer *buffer)
328
{
329
    return buffer->buffer + buffer->offset;
330
}
331

    
332
void buffer_reset(Buffer *buffer)
333
{
334
        buffer->offset = 0;
335
}
336

    
337
void buffer_append(Buffer *buffer, const void *data, size_t len)
338
{
339
    memcpy(buffer->buffer + buffer->offset, data, len);
340
    buffer->offset += len;
341
}
342

    
343
static void vnc_dpy_resize(DisplayState *ds)
344
{
345
    int size_changed;
346
    VncDisplay *vd = ds->opaque;
347
    VncState *vs = vd->clients;
348

    
349
    /* server surface */
350
    if (!vd->server)
351
        vd->server = qemu_mallocz(sizeof(*vd->server));
352
    if (vd->server->data)
353
        qemu_free(vd->server->data);
354
    *(vd->server) = *(ds->surface);
355
    vd->server->data = qemu_mallocz(vd->server->linesize *
356
                                    vd->server->height);
357

    
358
    /* guest surface */
359
    if (!vd->guest.ds)
360
        vd->guest.ds = qemu_mallocz(sizeof(*vd->guest.ds));
361
    if (ds_get_bytes_per_pixel(ds) != vd->guest.ds->pf.bytes_per_pixel)
362
        console_color_init(ds);
363
    size_changed = ds_get_width(ds) != vd->guest.ds->width ||
364
                   ds_get_height(ds) != vd->guest.ds->height;
365
    *(vd->guest.ds) = *(ds->surface);
366
    memset(vd->guest.dirty, 0xFF, sizeof(vd->guest.dirty));
367

    
368
    while (vs != NULL) {
369
        vnc_colordepth(vs);
370
        if (size_changed) {
371
            if (vs->csock != -1 && vnc_has_feature(vs, VNC_FEATURE_RESIZE)) {
372
                vnc_write_u8(vs, 0);  /* msg id */
373
                vnc_write_u8(vs, 0);
374
                vnc_write_u16(vs, 1); /* number of rects */
375
                vnc_framebuffer_update(vs, 0, 0, ds_get_width(ds), ds_get_height(ds),
376
                        VNC_ENCODING_DESKTOPRESIZE);
377
                vnc_flush(vs);
378
            }
379
        }
380
        memset(vs->dirty, 0xFF, sizeof(vs->dirty));
381
        vs = vs->next;
382
    }
383
}
384

    
385
/* fastest code */
386
static void vnc_write_pixels_copy(VncState *vs, void *pixels, int size)
387
{
388
    vnc_write(vs, pixels, size);
389
}
390

    
391
/* slowest but generic code. */
392
static void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v)
393
{
394
    uint8_t r, g, b;
395
    VncDisplay *vd = vs->vd;
396

    
397
    r = ((((v & vd->server->pf.rmask) >> vd->server->pf.rshift) << vs->clientds.pf.rbits) >>
398
        vd->server->pf.rbits);
399
    g = ((((v & vd->server->pf.gmask) >> vd->server->pf.gshift) << vs->clientds.pf.gbits) >>
400
        vd->server->pf.gbits);
401
    b = ((((v & vd->server->pf.bmask) >> vd->server->pf.bshift) << vs->clientds.pf.bbits) >>
402
        vd->server->pf.bbits);
403
    v = (r << vs->clientds.pf.rshift) |
404
        (g << vs->clientds.pf.gshift) |
405
        (b << vs->clientds.pf.bshift);
406
    switch(vs->clientds.pf.bytes_per_pixel) {
407
    case 1:
408
        buf[0] = v;
409
        break;
410
    case 2:
411
        if (vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) {
412
            buf[0] = v >> 8;
413
            buf[1] = v;
414
        } else {
415
            buf[1] = v >> 8;
416
            buf[0] = v;
417
        }
418
        break;
419
    default:
420
    case 4:
421
        if (vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) {
422
            buf[0] = v >> 24;
423
            buf[1] = v >> 16;
424
            buf[2] = v >> 8;
425
            buf[3] = v;
426
        } else {
427
            buf[3] = v >> 24;
428
            buf[2] = v >> 16;
429
            buf[1] = v >> 8;
430
            buf[0] = v;
431
        }
432
        break;
433
    }
434
}
435

    
436
static void vnc_write_pixels_generic(VncState *vs, void *pixels1, int size)
437
{
438
    uint8_t buf[4];
439
    VncDisplay *vd = vs->vd;
440

    
441
    if (vd->server->pf.bytes_per_pixel == 4) {
442
        uint32_t *pixels = pixels1;
443
        int n, i;
444
        n = size >> 2;
445
        for(i = 0; i < n; i++) {
446
            vnc_convert_pixel(vs, buf, pixels[i]);
447
            vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
448
        }
449
    } else if (vd->server->pf.bytes_per_pixel == 2) {
450
        uint16_t *pixels = pixels1;
451
        int n, i;
452
        n = size >> 1;
453
        for(i = 0; i < n; i++) {
454
            vnc_convert_pixel(vs, buf, pixels[i]);
455
            vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
456
        }
457
    } else if (vd->server->pf.bytes_per_pixel == 1) {
458
        uint8_t *pixels = pixels1;
459
        int n, i;
460
        n = size;
461
        for(i = 0; i < n; i++) {
462
            vnc_convert_pixel(vs, buf, pixels[i]);
463
            vnc_write(vs, buf, vs->clientds.pf.bytes_per_pixel);
464
        }
465
    } else {
466
        fprintf(stderr, "vnc_write_pixels_generic: VncState color depth not supported\n");
467
    }
468
}
469

    
470
static void send_framebuffer_update_raw(VncState *vs, int x, int y, int w, int h)
471
{
472
    int i;
473
    uint8_t *row;
474
    VncDisplay *vd = vs->vd;
475

    
476
    row = vd->server->data + y * ds_get_linesize(vs->ds) + x * ds_get_bytes_per_pixel(vs->ds);
477
    for (i = 0; i < h; i++) {
478
        vs->write_pixels(vs, row, w * ds_get_bytes_per_pixel(vs->ds));
479
        row += ds_get_linesize(vs->ds);
480
    }
481
}
482

    
483
static void hextile_enc_cord(uint8_t *ptr, int x, int y, int w, int h)
484
{
485
    ptr[0] = ((x & 0x0F) << 4) | (y & 0x0F);
486
    ptr[1] = (((w - 1) & 0x0F) << 4) | ((h - 1) & 0x0F);
487
}
488

    
489
#define BPP 8
490
#include "vnchextile.h"
491
#undef BPP
492

    
493
#define BPP 16
494
#include "vnchextile.h"
495
#undef BPP
496

    
497
#define BPP 32
498
#include "vnchextile.h"
499
#undef BPP
500

    
501
#define GENERIC
502
#define BPP 8
503
#include "vnchextile.h"
504
#undef BPP
505
#undef GENERIC
506

    
507
#define GENERIC
508
#define BPP 16
509
#include "vnchextile.h"
510
#undef BPP
511
#undef GENERIC
512

    
513
#define GENERIC
514
#define BPP 32
515
#include "vnchextile.h"
516
#undef BPP
517
#undef GENERIC
518

    
519
static void send_framebuffer_update_hextile(VncState *vs, int x, int y, int w, int h)
520
{
521
    int i, j;
522
    int has_fg, has_bg;
523
    uint8_t *last_fg, *last_bg;
524
    VncDisplay *vd = vs->vd;
525

    
526
    last_fg = (uint8_t *) qemu_malloc(vd->server->pf.bytes_per_pixel);
527
    last_bg = (uint8_t *) qemu_malloc(vd->server->pf.bytes_per_pixel);
528
    has_fg = has_bg = 0;
529
    for (j = y; j < (y + h); j += 16) {
530
        for (i = x; i < (x + w); i += 16) {
531
            vs->send_hextile_tile(vs, i, j,
532
                                  MIN(16, x + w - i), MIN(16, y + h - j),
533
                                  last_bg, last_fg, &has_bg, &has_fg);
534
        }
535
    }
536
    free(last_fg);
537
    free(last_bg);
538

    
539
}
540

    
541
#define ZALLOC_ALIGNMENT 16
542

    
543
static void *zalloc(void *x, unsigned items, unsigned size)
544
{
545
    void *p;
546

    
547
    size *= items;
548
    size = (size + ZALLOC_ALIGNMENT - 1) & ~(ZALLOC_ALIGNMENT - 1);
549

    
550
    p = qemu_mallocz(size);
551

    
552
    return (p);
553
}
554

    
555
static void zfree(void *x, void *addr)
556
{
557
    qemu_free(addr);
558
}
559

    
560
static void vnc_zlib_init(VncState *vs)
561
{
562
    int i;
563
    for (i=0; i<(sizeof(vs->zlib_stream) / sizeof(z_stream)); i++)
564
        vs->zlib_stream[i].opaque = NULL;
565
}
566

    
567
static void vnc_zlib_start(VncState *vs)
568
{
569
    buffer_reset(&vs->zlib);
570

    
571
    // make the output buffer be the zlib buffer, so we can compress it later
572
    vs->zlib_tmp = vs->output;
573
    vs->output = vs->zlib;
574
}
575

    
576
static int vnc_zlib_stop(VncState *vs, int stream_id)
577
{
578
    z_streamp zstream = &vs->zlib_stream[stream_id];
579
    int previous_out;
580

    
581
    // switch back to normal output/zlib buffers
582
    vs->zlib = vs->output;
583
    vs->output = vs->zlib_tmp;
584

    
585
    // compress the zlib buffer
586

    
587
    // initialize the stream
588
    // XXX need one stream per session
589
    if (zstream->opaque != vs) {
590
        int err;
591

    
592
        VNC_DEBUG("VNC: initializing zlib stream %d\n", stream_id);
593
        VNC_DEBUG("VNC: opaque = %p | vs = %p\n", zstream->opaque, vs);
594
        zstream->zalloc = zalloc;
595
        zstream->zfree = zfree;
596

    
597
        err = deflateInit2(zstream, vs->tight_compression, Z_DEFLATED, MAX_WBITS,
598
                           MAX_MEM_LEVEL, Z_DEFAULT_STRATEGY);
599

    
600
        if (err != Z_OK) {
601
            fprintf(stderr, "VNC: error initializing zlib\n");
602
            return -1;
603
        }
604

    
605
        zstream->opaque = vs;
606
    }
607

    
608
    // XXX what to do if tight_compression changed in between?
609

    
610
    // reserve memory in output buffer
611
    buffer_reserve(&vs->output, vs->zlib.offset + 64);
612

    
613
    // set pointers
614
    zstream->next_in = vs->zlib.buffer;
615
    zstream->avail_in = vs->zlib.offset;
616
    zstream->next_out = vs->output.buffer + vs->output.offset;
617
    zstream->avail_out = vs->output.capacity - vs->output.offset;
618
    zstream->data_type = Z_BINARY;
619
    previous_out = zstream->total_out;
620

    
621
    // start encoding
622
    if (deflate(zstream, Z_SYNC_FLUSH) != Z_OK) {
623
        fprintf(stderr, "VNC: error during zlib compression\n");
624
        return -1;
625
    }
626

    
627
    vs->output.offset = vs->output.capacity - zstream->avail_out;
628
    return zstream->total_out - previous_out;
629
}
630

    
631
static void send_framebuffer_update_zlib(VncState *vs, int x, int y, int w, int h)
632
{
633
    int old_offset, new_offset, bytes_written;
634

    
635
    vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_ZLIB);
636

    
637
    // remember where we put in the follow-up size
638
    old_offset = vs->output.offset;
639
    vnc_write_s32(vs, 0);
640

    
641
    // compress the stream
642
    vnc_zlib_start(vs);
643
    send_framebuffer_update_raw(vs, x, y, w, h);
644
    bytes_written = vnc_zlib_stop(vs, 0);
645

    
646
    if (bytes_written == -1)
647
        return;
648

    
649
    // hack in the size
650
    new_offset = vs->output.offset;
651
    vs->output.offset = old_offset;
652
    vnc_write_u32(vs, bytes_written);
653
    vs->output.offset = new_offset;
654
}
655

    
656
static void send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
657
{
658
    switch(vs->vnc_encoding) {
659
        case VNC_ENCODING_ZLIB:
660
            send_framebuffer_update_zlib(vs, x, y, w, h);
661
            break;
662
        case VNC_ENCODING_HEXTILE:
663
            vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE);
664
            send_framebuffer_update_hextile(vs, x, y, w, h);
665
            break;
666
        default:
667
            vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW);
668
            send_framebuffer_update_raw(vs, x, y, w, h);
669
            break;
670
    }
671
}
672

    
673
static void vnc_copy(VncState *vs, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
674
{
675
    /* send bitblit op to the vnc client */
676
    vnc_write_u8(vs, 0);  /* msg id */
677
    vnc_write_u8(vs, 0);
678
    vnc_write_u16(vs, 1); /* number of rects */
679
    vnc_framebuffer_update(vs, dst_x, dst_y, w, h, VNC_ENCODING_COPYRECT);
680
    vnc_write_u16(vs, src_x);
681
    vnc_write_u16(vs, src_y);
682
    vnc_flush(vs);
683
}
684

    
685
static void vnc_dpy_copy(DisplayState *ds, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
686
{
687
    VncDisplay *vd = ds->opaque;
688
    VncState *vs, *vn;
689
    uint8_t *src_row;
690
    uint8_t *dst_row;
691
    int i,x,y,pitch,depth,inc,w_lim,s;
692
    int cmp_bytes;
693

    
694
    vnc_refresh_server_surface(vd);
695
    for (vs = vd->clients; vs != NULL; vs = vn) {
696
        vn = vs->next;
697
        if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
698
            vs->force_update = 1;
699
            vnc_update_client(vs, 1);
700
            /* vs might be free()ed here */
701
        }
702
    }
703

    
704
    /* do bitblit op on the local surface too */
705
    pitch = ds_get_linesize(vd->ds);
706
    depth = ds_get_bytes_per_pixel(vd->ds);
707
    src_row = vd->server->data + pitch * src_y + depth * src_x;
708
    dst_row = vd->server->data + pitch * dst_y + depth * dst_x;
709
    y = dst_y;
710
    inc = 1;
711
    if (dst_y > src_y) {
712
        /* copy backwards */
713
        src_row += pitch * (h-1);
714
        dst_row += pitch * (h-1);
715
        pitch = -pitch;
716
        y = dst_y + h - 1;
717
        inc = -1;
718
    }
719
    w_lim = w - (16 - (dst_x % 16));
720
    if (w_lim < 0)
721
        w_lim = w;
722
    else
723
        w_lim = w - (w_lim % 16);
724
    for (i = 0; i < h; i++) {
725
        for (x = 0; x <= w_lim;
726
                x += s, src_row += cmp_bytes, dst_row += cmp_bytes) {
727
            if (x == w_lim) {
728
                if ((s = w - w_lim) == 0)
729
                    break;
730
            } else if (!x) {
731
                s = (16 - (dst_x % 16));
732
                s = MIN(s, w_lim);
733
            } else {
734
                s = 16;
735
            }
736
            cmp_bytes = s * depth;
737
            if (memcmp(src_row, dst_row, cmp_bytes) == 0)
738
                continue;
739
            memmove(dst_row, src_row, cmp_bytes);
740
            vs = vd->clients;
741
            while (vs != NULL) {
742
                if (!vnc_has_feature(vs, VNC_FEATURE_COPYRECT))
743
                    vnc_set_bit(vs->dirty[y], ((x + dst_x) / 16));
744
                vs = vs->next;
745
            }
746
        }
747
        src_row += pitch - w * depth;
748
        dst_row += pitch - w * depth;
749
        y += inc;
750
    }
751

    
752
    for (vs = vd->clients; vs != NULL; vs = vs->next) {
753
        if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT))
754
            vnc_copy(vs, src_x, src_y, dst_x, dst_y, w, h);
755
    }
756
}
757

    
758
static int find_and_clear_dirty_height(struct VncState *vs,
759
                                       int y, int last_x, int x)
760
{
761
    int h;
762
    VncDisplay *vd = vs->vd;
763

    
764
    for (h = 1; h < (vd->server->height - y); h++) {
765
        int tmp_x;
766
        if (!vnc_get_bit(vs->dirty[y + h], last_x))
767
            break;
768
        for (tmp_x = last_x; tmp_x < x; tmp_x++)
769
            vnc_clear_bit(vs->dirty[y + h], tmp_x);
770
    }
771

    
772
    return h;
773
}
774

    
775
static int vnc_update_client(VncState *vs, int has_dirty)
776
{
777
    if (vs->need_update && vs->csock != -1) {
778
        VncDisplay *vd = vs->vd;
779
        int y;
780
        int n_rectangles;
781
        int saved_offset;
782

    
783
        if (vs->output.offset && !vs->audio_cap && !vs->force_update)
784
            /* kernel send buffers are full -> drop frames to throttle */
785
            return 0;
786

    
787
        if (!has_dirty && !vs->audio_cap && !vs->force_update)
788
            return 0;
789

    
790
        /*
791
         * Send screen updates to the vnc client using the server
792
         * surface and server dirty map.  guest surface updates
793
         * happening in parallel don't disturb us, the next pass will
794
         * send them to the client.
795
         */
796
        n_rectangles = 0;
797
        vnc_write_u8(vs, 0);  /* msg id */
798
        vnc_write_u8(vs, 0);
799
        saved_offset = vs->output.offset;
800
        vnc_write_u16(vs, 0);
801

    
802
        for (y = 0; y < vd->server->height; y++) {
803
            int x;
804
            int last_x = -1;
805
            for (x = 0; x < vd->server->width / 16; x++) {
806
                if (vnc_get_bit(vs->dirty[y], x)) {
807
                    if (last_x == -1) {
808
                        last_x = x;
809
                    }
810
                    vnc_clear_bit(vs->dirty[y], x);
811
                } else {
812
                    if (last_x != -1) {
813
                        int h = find_and_clear_dirty_height(vs, y, last_x, x);
814
                        send_framebuffer_update(vs, last_x * 16, y, (x - last_x) * 16, h);
815
                        n_rectangles++;
816
                    }
817
                    last_x = -1;
818
                }
819
            }
820
            if (last_x != -1) {
821
                int h = find_and_clear_dirty_height(vs, y, last_x, x);
822
                send_framebuffer_update(vs, last_x * 16, y, (x - last_x) * 16, h);
823
                n_rectangles++;
824
            }
825
        }
826
        vs->output.buffer[saved_offset] = (n_rectangles >> 8) & 0xFF;
827
        vs->output.buffer[saved_offset + 1] = n_rectangles & 0xFF;
828
        vnc_flush(vs);
829
        vs->force_update = 0;
830
        return n_rectangles;
831
    }
832

    
833
    if (vs->csock == -1)
834
        vnc_disconnect_finish(vs);
835

    
836
    return 0;
837
}
838

    
839
/* audio */
840
static void audio_capture_notify(void *opaque, audcnotification_e cmd)
841
{
842
    VncState *vs = opaque;
843

    
844
    switch (cmd) {
845
    case AUD_CNOTIFY_DISABLE:
846
        vnc_write_u8(vs, 255);
847
        vnc_write_u8(vs, 1);
848
        vnc_write_u16(vs, 0);
849
        vnc_flush(vs);
850
        break;
851

    
852
    case AUD_CNOTIFY_ENABLE:
853
        vnc_write_u8(vs, 255);
854
        vnc_write_u8(vs, 1);
855
        vnc_write_u16(vs, 1);
856
        vnc_flush(vs);
857
        break;
858
    }
859
}
860

    
861
static void audio_capture_destroy(void *opaque)
862
{
863
}
864

    
865
static void audio_capture(void *opaque, void *buf, int size)
866
{
867
    VncState *vs = opaque;
868

    
869
    vnc_write_u8(vs, 255);
870
    vnc_write_u8(vs, 1);
871
    vnc_write_u16(vs, 2);
872
    vnc_write_u32(vs, size);
873
    vnc_write(vs, buf, size);
874
    vnc_flush(vs);
875
}
876

    
877
static void audio_add(VncState *vs)
878
{
879
    Monitor *mon = cur_mon;
880
    struct audio_capture_ops ops;
881

    
882
    if (vs->audio_cap) {
883
        monitor_printf(mon, "audio already running\n");
884
        return;
885
    }
886

    
887
    ops.notify = audio_capture_notify;
888
    ops.destroy = audio_capture_destroy;
889
    ops.capture = audio_capture;
890

    
891
    vs->audio_cap = AUD_add_capture(&vs->as, &ops, vs);
892
    if (!vs->audio_cap) {
893
        monitor_printf(mon, "Failed to add audio capture\n");
894
    }
895
}
896

    
897
static void audio_del(VncState *vs)
898
{
899
    if (vs->audio_cap) {
900
        AUD_del_capture(vs->audio_cap, vs);
901
        vs->audio_cap = NULL;
902
    }
903
}
904

    
905
static void vnc_disconnect_start(VncState *vs)
906
{
907
    if (vs->csock == -1)
908
        return;
909
    qemu_set_fd_handler2(vs->csock, NULL, NULL, NULL, NULL);
910
    closesocket(vs->csock);
911
    vs->csock = -1;
912
}
913

    
914
static void vnc_disconnect_finish(VncState *vs)
915
{
916
    if (vs->input.buffer) {
917
        qemu_free(vs->input.buffer);
918
        vs->input.buffer = NULL;
919
    }
920
    if (vs->output.buffer) {
921
        qemu_free(vs->output.buffer);
922
        vs->output.buffer = NULL;
923
    }
924
#ifdef CONFIG_VNC_TLS
925
    vnc_tls_client_cleanup(vs);
926
#endif /* CONFIG_VNC_TLS */
927
#ifdef CONFIG_VNC_SASL
928
    vnc_sasl_client_cleanup(vs);
929
#endif /* CONFIG_VNC_SASL */
930
    audio_del(vs);
931

    
932
    VncState *p, *parent = NULL;
933
    for (p = vs->vd->clients; p != NULL; p = p->next) {
934
        if (p == vs) {
935
            if (parent)
936
                parent->next = p->next;
937
            else
938
                vs->vd->clients = p->next;
939
            break;
940
        }
941
        parent = p;
942
    }
943
    if (!vs->vd->clients)
944
        dcl->idle = 1;
945

    
946
    vnc_remove_timer(vs->vd);
947
    qemu_free(vs);
948
}
949

    
950
int vnc_client_io_error(VncState *vs, int ret, int last_errno)
951
{
952
    if (ret == 0 || ret == -1) {
953
        if (ret == -1) {
954
            switch (last_errno) {
955
                case EINTR:
956
                case EAGAIN:
957
#ifdef _WIN32
958
                case WSAEWOULDBLOCK:
959
#endif
960
                    return 0;
961
                default:
962
                    break;
963
            }
964
        }
965

    
966
        VNC_DEBUG("Closing down client sock: ret %d, errno %d\n",
967
                  ret, ret < 0 ? last_errno : 0);
968
        vnc_disconnect_start(vs);
969

    
970
        return 0;
971
    }
972
    return ret;
973
}
974

    
975

    
976
void vnc_client_error(VncState *vs)
977
{
978
    VNC_DEBUG("Closing down client sock: protocol error\n");
979
    vnc_disconnect_start(vs);
980
}
981

    
982

    
983
/*
984
 * Called to write a chunk of data to the client socket. The data may
985
 * be the raw data, or may have already been encoded by SASL.
986
 * The data will be written either straight onto the socket, or
987
 * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled
988
 *
989
 * NB, it is theoretically possible to have 2 layers of encryption,
990
 * both SASL, and this TLS layer. It is highly unlikely in practice
991
 * though, since SASL encryption will typically be a no-op if TLS
992
 * is active
993
 *
994
 * Returns the number of bytes written, which may be less than
995
 * the requested 'datalen' if the socket would block. Returns
996
 * -1 on error, and disconnects the client socket.
997
 */
998
long vnc_client_write_buf(VncState *vs, const uint8_t *data, size_t datalen)
999
{
1000
    long ret;
1001
#ifdef CONFIG_VNC_TLS
1002
    if (vs->tls.session) {
1003
        ret = gnutls_write(vs->tls.session, data, datalen);
1004
        if (ret < 0) {
1005
            if (ret == GNUTLS_E_AGAIN)
1006
                errno = EAGAIN;
1007
            else
1008
                errno = EIO;
1009
            ret = -1;
1010
        }
1011
    } else
1012
#endif /* CONFIG_VNC_TLS */
1013
        ret = send(vs->csock, (const void *)data, datalen, 0);
1014
    VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data, datalen, ret);
1015
    return vnc_client_io_error(vs, ret, socket_error());
1016
}
1017

    
1018

    
1019
/*
1020
 * Called to write buffered data to the client socket, when not
1021
 * using any SASL SSF encryption layers. Will write as much data
1022
 * as possible without blocking. If all buffered data is written,
1023
 * will switch the FD poll() handler back to read monitoring.
1024
 *
1025
 * Returns the number of bytes written, which may be less than
1026
 * the buffered output data if the socket would block. Returns
1027
 * -1 on error, and disconnects the client socket.
1028
 */
1029
static long vnc_client_write_plain(VncState *vs)
1030
{
1031
    long ret;
1032

    
1033
#ifdef CONFIG_VNC_SASL
1034
    VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n",
1035
              vs->output.buffer, vs->output.capacity, vs->output.offset,
1036
              vs->sasl.waitWriteSSF);
1037

    
1038
    if (vs->sasl.conn &&
1039
        vs->sasl.runSSF &&
1040
        vs->sasl.waitWriteSSF) {
1041
        ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF);
1042
        if (ret)
1043
            vs->sasl.waitWriteSSF -= ret;
1044
    } else
1045
#endif /* CONFIG_VNC_SASL */
1046
        ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset);
1047
    if (!ret)
1048
        return 0;
1049

    
1050
    memmove(vs->output.buffer, vs->output.buffer + ret, (vs->output.offset - ret));
1051
    vs->output.offset -= ret;
1052

    
1053
    if (vs->output.offset == 0) {
1054
        qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
1055
    }
1056

    
1057
    return ret;
1058
}
1059

    
1060

    
1061
/*
1062
 * First function called whenever there is data to be written to
1063
 * the client socket. Will delegate actual work according to whether
1064
 * SASL SSF layers are enabled (thus requiring encryption calls)
1065
 */
1066
void vnc_client_write(void *opaque)
1067
{
1068
    long ret;
1069
    VncState *vs = opaque;
1070

    
1071
#ifdef CONFIG_VNC_SASL
1072
    if (vs->sasl.conn &&
1073
        vs->sasl.runSSF &&
1074
        !vs->sasl.waitWriteSSF)
1075
        ret = vnc_client_write_sasl(vs);
1076
    else
1077
#endif /* CONFIG_VNC_SASL */
1078
        ret = vnc_client_write_plain(vs);
1079
}
1080

    
1081
void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting)
1082
{
1083
    vs->read_handler = func;
1084
    vs->read_handler_expect = expecting;
1085
}
1086

    
1087

    
1088
/*
1089
 * Called to read a chunk of data from the client socket. The data may
1090
 * be the raw data, or may need to be further decoded by SASL.
1091
 * The data will be read either straight from to the socket, or
1092
 * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled
1093
 *
1094
 * NB, it is theoretically possible to have 2 layers of encryption,
1095
 * both SASL, and this TLS layer. It is highly unlikely in practice
1096
 * though, since SASL encryption will typically be a no-op if TLS
1097
 * is active
1098
 *
1099
 * Returns the number of bytes read, which may be less than
1100
 * the requested 'datalen' if the socket would block. Returns
1101
 * -1 on error, and disconnects the client socket.
1102
 */
1103
long vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen)
1104
{
1105
    long ret;
1106
#ifdef CONFIG_VNC_TLS
1107
    if (vs->tls.session) {
1108
        ret = gnutls_read(vs->tls.session, data, datalen);
1109
        if (ret < 0) {
1110
            if (ret == GNUTLS_E_AGAIN)
1111
                errno = EAGAIN;
1112
            else
1113
                errno = EIO;
1114
            ret = -1;
1115
        }
1116
    } else
1117
#endif /* CONFIG_VNC_TLS */
1118
        ret = recv(vs->csock, (void *)data, datalen, 0);
1119
    VNC_DEBUG("Read wire %p %zd -> %ld\n", data, datalen, ret);
1120
    return vnc_client_io_error(vs, ret, socket_error());
1121
}
1122

    
1123

    
1124
/*
1125
 * Called to read data from the client socket to the input buffer,
1126
 * when not using any SASL SSF encryption layers. Will read as much
1127
 * data as possible without blocking.
1128
 *
1129
 * Returns the number of bytes read. Returns -1 on error, and
1130
 * disconnects the client socket.
1131
 */
1132
static long vnc_client_read_plain(VncState *vs)
1133
{
1134
    int ret;
1135
    VNC_DEBUG("Read plain %p size %zd offset %zd\n",
1136
              vs->input.buffer, vs->input.capacity, vs->input.offset);
1137
    buffer_reserve(&vs->input, 4096);
1138
    ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096);
1139
    if (!ret)
1140
        return 0;
1141
    vs->input.offset += ret;
1142
    return ret;
1143
}
1144

    
1145

    
1146
/*
1147
 * First function called whenever there is more data to be read from
1148
 * the client socket. Will delegate actual work according to whether
1149
 * SASL SSF layers are enabled (thus requiring decryption calls)
1150
 */
1151
void vnc_client_read(void *opaque)
1152
{
1153
    VncState *vs = opaque;
1154
    long ret;
1155

    
1156
#ifdef CONFIG_VNC_SASL
1157
    if (vs->sasl.conn && vs->sasl.runSSF)
1158
        ret = vnc_client_read_sasl(vs);
1159
    else
1160
#endif /* CONFIG_VNC_SASL */
1161
        ret = vnc_client_read_plain(vs);
1162
    if (!ret) {
1163
        if (vs->csock == -1)
1164
            vnc_disconnect_finish(vs);
1165
        return;
1166
    }
1167

    
1168
    while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) {
1169
        size_t len = vs->read_handler_expect;
1170
        int ret;
1171

    
1172
        ret = vs->read_handler(vs, vs->input.buffer, len);
1173
        if (vs->csock == -1) {
1174
            vnc_disconnect_finish(vs);
1175
            return;
1176
        }
1177

    
1178
        if (!ret) {
1179
            memmove(vs->input.buffer, vs->input.buffer + len, (vs->input.offset - len));
1180
            vs->input.offset -= len;
1181
        } else {
1182
            vs->read_handler_expect = ret;
1183
        }
1184
    }
1185
}
1186

    
1187
void vnc_write(VncState *vs, const void *data, size_t len)
1188
{
1189
    buffer_reserve(&vs->output, len);
1190

    
1191
    if (vs->csock != -1 && buffer_empty(&vs->output)) {
1192
        qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, vnc_client_write, vs);
1193
    }
1194

    
1195
    buffer_append(&vs->output, data, len);
1196
}
1197

    
1198
void vnc_write_s32(VncState *vs, int32_t value)
1199
{
1200
    vnc_write_u32(vs, *(uint32_t *)&value);
1201
}
1202

    
1203
void vnc_write_u32(VncState *vs, uint32_t value)
1204
{
1205
    uint8_t buf[4];
1206

    
1207
    buf[0] = (value >> 24) & 0xFF;
1208
    buf[1] = (value >> 16) & 0xFF;
1209
    buf[2] = (value >>  8) & 0xFF;
1210
    buf[3] = value & 0xFF;
1211

    
1212
    vnc_write(vs, buf, 4);
1213
}
1214

    
1215
void vnc_write_u16(VncState *vs, uint16_t value)
1216
{
1217
    uint8_t buf[2];
1218

    
1219
    buf[0] = (value >> 8) & 0xFF;
1220
    buf[1] = value & 0xFF;
1221

    
1222
    vnc_write(vs, buf, 2);
1223
}
1224

    
1225
void vnc_write_u8(VncState *vs, uint8_t value)
1226
{
1227
    vnc_write(vs, (char *)&value, 1);
1228
}
1229

    
1230
void vnc_flush(VncState *vs)
1231
{
1232
    if (vs->csock != -1 && vs->output.offset)
1233
        vnc_client_write(vs);
1234
}
1235

    
1236
uint8_t read_u8(uint8_t *data, size_t offset)
1237
{
1238
    return data[offset];
1239
}
1240

    
1241
uint16_t read_u16(uint8_t *data, size_t offset)
1242
{
1243
    return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF);
1244
}
1245

    
1246
int32_t read_s32(uint8_t *data, size_t offset)
1247
{
1248
    return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) |
1249
                     (data[offset + 2] << 8) | data[offset + 3]);
1250
}
1251

    
1252
uint32_t read_u32(uint8_t *data, size_t offset)
1253
{
1254
    return ((data[offset] << 24) | (data[offset + 1] << 16) |
1255
            (data[offset + 2] << 8) | data[offset + 3]);
1256
}
1257

    
1258
static void client_cut_text(VncState *vs, size_t len, uint8_t *text)
1259
{
1260
}
1261

    
1262
static void check_pointer_type_change(VncState *vs, int absolute)
1263
{
1264
    if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) {
1265
        vnc_write_u8(vs, 0);
1266
        vnc_write_u8(vs, 0);
1267
        vnc_write_u16(vs, 1);
1268
        vnc_framebuffer_update(vs, absolute, 0,
1269
                               ds_get_width(vs->ds), ds_get_height(vs->ds),
1270
                               VNC_ENCODING_POINTER_TYPE_CHANGE);
1271
        vnc_flush(vs);
1272
    }
1273
    vs->absolute = absolute;
1274
}
1275

    
1276
static void pointer_event(VncState *vs, int button_mask, int x, int y)
1277
{
1278
    int buttons = 0;
1279
    int dz = 0;
1280

    
1281
    if (button_mask & 0x01)
1282
        buttons |= MOUSE_EVENT_LBUTTON;
1283
    if (button_mask & 0x02)
1284
        buttons |= MOUSE_EVENT_MBUTTON;
1285
    if (button_mask & 0x04)
1286
        buttons |= MOUSE_EVENT_RBUTTON;
1287
    if (button_mask & 0x08)
1288
        dz = -1;
1289
    if (button_mask & 0x10)
1290
        dz = 1;
1291

    
1292
    if (vs->absolute) {
1293
        kbd_mouse_event(x * 0x7FFF / (ds_get_width(vs->ds) - 1),
1294
                        y * 0x7FFF / (ds_get_height(vs->ds) - 1),
1295
                        dz, buttons);
1296
    } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) {
1297
        x -= 0x7FFF;
1298
        y -= 0x7FFF;
1299

    
1300
        kbd_mouse_event(x, y, dz, buttons);
1301
    } else {
1302
        if (vs->last_x != -1)
1303
            kbd_mouse_event(x - vs->last_x,
1304
                            y - vs->last_y,
1305
                            dz, buttons);
1306
        vs->last_x = x;
1307
        vs->last_y = y;
1308
    }
1309

    
1310
    check_pointer_type_change(vs, kbd_mouse_is_absolute());
1311
}
1312

    
1313
static void reset_keys(VncState *vs)
1314
{
1315
    int i;
1316
    for(i = 0; i < 256; i++) {
1317
        if (vs->modifiers_state[i]) {
1318
            if (i & 0x80)
1319
                kbd_put_keycode(0xe0);
1320
            kbd_put_keycode(i | 0x80);
1321
            vs->modifiers_state[i] = 0;
1322
        }
1323
    }
1324
}
1325

    
1326
static void press_key(VncState *vs, int keysym)
1327
{
1328
    kbd_put_keycode(keysym2scancode(vs->vd->kbd_layout, keysym) & 0x7f);
1329
    kbd_put_keycode(keysym2scancode(vs->vd->kbd_layout, keysym) | 0x80);
1330
}
1331

    
1332
static void do_key_event(VncState *vs, int down, int keycode, int sym)
1333
{
1334
    /* QEMU console switch */
1335
    switch(keycode) {
1336
    case 0x2a:                          /* Left Shift */
1337
    case 0x36:                          /* Right Shift */
1338
    case 0x1d:                          /* Left CTRL */
1339
    case 0x9d:                          /* Right CTRL */
1340
    case 0x38:                          /* Left ALT */
1341
    case 0xb8:                          /* Right ALT */
1342
        if (down)
1343
            vs->modifiers_state[keycode] = 1;
1344
        else
1345
            vs->modifiers_state[keycode] = 0;
1346
        break;
1347
    case 0x02 ... 0x0a: /* '1' to '9' keys */
1348
        if (down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) {
1349
            /* Reset the modifiers sent to the current console */
1350
            reset_keys(vs);
1351
            console_select(keycode - 0x02);
1352
            return;
1353
        }
1354
        break;
1355
    case 0x3a:                        /* CapsLock */
1356
    case 0x45:                        /* NumLock */
1357
        if (!down)
1358
            vs->modifiers_state[keycode] ^= 1;
1359
        break;
1360
    }
1361

    
1362
    if (keycode_is_keypad(vs->vd->kbd_layout, keycode)) {
1363
        /* If the numlock state needs to change then simulate an additional
1364
           keypress before sending this one.  This will happen if the user
1365
           toggles numlock away from the VNC window.
1366
        */
1367
        if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) {
1368
            if (!vs->modifiers_state[0x45]) {
1369
                vs->modifiers_state[0x45] = 1;
1370
                press_key(vs, 0xff7f);
1371
            }
1372
        } else {
1373
            if (vs->modifiers_state[0x45]) {
1374
                vs->modifiers_state[0x45] = 0;
1375
                press_key(vs, 0xff7f);
1376
            }
1377
        }
1378
    }
1379

    
1380
    if ((sym >= 'A' && sym <= 'Z') || (sym >= 'a' && sym <= 'z')) {
1381
        /* If the capslock state needs to change then simulate an additional
1382
           keypress before sending this one.  This will happen if the user
1383
           toggles capslock away from the VNC window.
1384
        */
1385
        int uppercase = !!(sym >= 'A' && sym <= 'Z');
1386
        int shift = !!(vs->modifiers_state[0x2a] | vs->modifiers_state[0x36]);
1387
        int capslock = !!(vs->modifiers_state[0x3a]);
1388
        if (capslock) {
1389
            if (uppercase == shift) {
1390
                vs->modifiers_state[0x3a] = 0;
1391
                press_key(vs, 0xffe5);
1392
            }
1393
        } else {
1394
            if (uppercase != shift) {
1395
                vs->modifiers_state[0x3a] = 1;
1396
                press_key(vs, 0xffe5);
1397
            }
1398
        }
1399
    }
1400

    
1401
    if (is_graphic_console()) {
1402
        if (keycode & 0x80)
1403
            kbd_put_keycode(0xe0);
1404
        if (down)
1405
            kbd_put_keycode(keycode & 0x7f);
1406
        else
1407
            kbd_put_keycode(keycode | 0x80);
1408
    } else {
1409
        /* QEMU console emulation */
1410
        if (down) {
1411
            int numlock = vs->modifiers_state[0x45];
1412
            switch (keycode) {
1413
            case 0x2a:                          /* Left Shift */
1414
            case 0x36:                          /* Right Shift */
1415
            case 0x1d:                          /* Left CTRL */
1416
            case 0x9d:                          /* Right CTRL */
1417
            case 0x38:                          /* Left ALT */
1418
            case 0xb8:                          /* Right ALT */
1419
                break;
1420
            case 0xc8:
1421
                kbd_put_keysym(QEMU_KEY_UP);
1422
                break;
1423
            case 0xd0:
1424
                kbd_put_keysym(QEMU_KEY_DOWN);
1425
                break;
1426
            case 0xcb:
1427
                kbd_put_keysym(QEMU_KEY_LEFT);
1428
                break;
1429
            case 0xcd:
1430
                kbd_put_keysym(QEMU_KEY_RIGHT);
1431
                break;
1432
            case 0xd3:
1433
                kbd_put_keysym(QEMU_KEY_DELETE);
1434
                break;
1435
            case 0xc7:
1436
                kbd_put_keysym(QEMU_KEY_HOME);
1437
                break;
1438
            case 0xcf:
1439
                kbd_put_keysym(QEMU_KEY_END);
1440
                break;
1441
            case 0xc9:
1442
                kbd_put_keysym(QEMU_KEY_PAGEUP);
1443
                break;
1444
            case 0xd1:
1445
                kbd_put_keysym(QEMU_KEY_PAGEDOWN);
1446
                break;
1447

    
1448
            case 0x47:
1449
                kbd_put_keysym(numlock ? '7' : QEMU_KEY_HOME);
1450
                break;
1451
            case 0x48:
1452
                kbd_put_keysym(numlock ? '8' : QEMU_KEY_UP);
1453
                break;
1454
            case 0x49:
1455
                kbd_put_keysym(numlock ? '9' : QEMU_KEY_PAGEUP);
1456
                break;
1457
            case 0x4b:
1458
                kbd_put_keysym(numlock ? '4' : QEMU_KEY_LEFT);
1459
                break;
1460
            case 0x4c:
1461
                kbd_put_keysym('5');
1462
                break;
1463
            case 0x4d:
1464
                kbd_put_keysym(numlock ? '6' : QEMU_KEY_RIGHT);
1465
                break;
1466
            case 0x4f:
1467
                kbd_put_keysym(numlock ? '1' : QEMU_KEY_END);
1468
                break;
1469
            case 0x50:
1470
                kbd_put_keysym(numlock ? '2' : QEMU_KEY_DOWN);
1471
                break;
1472
            case 0x51:
1473
                kbd_put_keysym(numlock ? '3' : QEMU_KEY_PAGEDOWN);
1474
                break;
1475
            case 0x52:
1476
                kbd_put_keysym('0');
1477
                break;
1478
            case 0x53:
1479
                kbd_put_keysym(numlock ? '.' : QEMU_KEY_DELETE);
1480
                break;
1481

    
1482
            case 0xb5:
1483
                kbd_put_keysym('/');
1484
                break;
1485
            case 0x37:
1486
                kbd_put_keysym('*');
1487
                break;
1488
            case 0x4a:
1489
                kbd_put_keysym('-');
1490
                break;
1491
            case 0x4e:
1492
                kbd_put_keysym('+');
1493
                break;
1494
            case 0x9c:
1495
                kbd_put_keysym('\n');
1496
                break;
1497

    
1498
            default:
1499
                kbd_put_keysym(sym);
1500
                break;
1501
            }
1502
        }
1503
    }
1504
}
1505

    
1506
static void key_event(VncState *vs, int down, uint32_t sym)
1507
{
1508
    int keycode;
1509

    
1510
    if (sym >= 'A' && sym <= 'Z' && is_graphic_console())
1511
        sym = sym - 'A' + 'a';
1512

    
1513
    keycode = keysym2scancode(vs->vd->kbd_layout, sym & 0xFFFF);
1514
    do_key_event(vs, down, keycode, sym);
1515
}
1516

    
1517
static void ext_key_event(VncState *vs, int down,
1518
                          uint32_t sym, uint16_t keycode)
1519
{
1520
    /* if the user specifies a keyboard layout, always use it */
1521
    if (keyboard_layout)
1522
        key_event(vs, down, sym);
1523
    else
1524
        do_key_event(vs, down, keycode, sym);
1525
}
1526

    
1527
static void framebuffer_update_request(VncState *vs, int incremental,
1528
                                       int x_position, int y_position,
1529
                                       int w, int h)
1530
{
1531
    if (x_position > ds_get_width(vs->ds))
1532
        x_position = ds_get_width(vs->ds);
1533
    if (y_position > ds_get_height(vs->ds))
1534
        y_position = ds_get_height(vs->ds);
1535
    if (x_position + w >= ds_get_width(vs->ds))
1536
        w = ds_get_width(vs->ds)  - x_position;
1537
    if (y_position + h >= ds_get_height(vs->ds))
1538
        h = ds_get_height(vs->ds) - y_position;
1539

    
1540
    int i;
1541
    vs->need_update = 1;
1542
    if (!incremental) {
1543
        vs->force_update = 1;
1544
        for (i = 0; i < h; i++) {
1545
            vnc_set_bits(vs->dirty[y_position + i],
1546
                         (ds_get_width(vs->ds) / 16), VNC_DIRTY_WORDS);
1547
        }
1548
    }
1549
}
1550

    
1551
static void send_ext_key_event_ack(VncState *vs)
1552
{
1553
    vnc_write_u8(vs, 0);
1554
    vnc_write_u8(vs, 0);
1555
    vnc_write_u16(vs, 1);
1556
    vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
1557
                           VNC_ENCODING_EXT_KEY_EVENT);
1558
    vnc_flush(vs);
1559
}
1560

    
1561
static void send_ext_audio_ack(VncState *vs)
1562
{
1563
    vnc_write_u8(vs, 0);
1564
    vnc_write_u8(vs, 0);
1565
    vnc_write_u16(vs, 1);
1566
    vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), ds_get_height(vs->ds),
1567
                           VNC_ENCODING_AUDIO);
1568
    vnc_flush(vs);
1569
}
1570

    
1571
static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
1572
{
1573
    int i;
1574
    unsigned int enc = 0;
1575

    
1576
    vnc_zlib_init(vs);
1577
    vs->features = 0;
1578
    vs->vnc_encoding = 0;
1579
    vs->tight_compression = 9;
1580
    vs->tight_quality = 9;
1581
    vs->absolute = -1;
1582

    
1583
    for (i = n_encodings - 1; i >= 0; i--) {
1584
        enc = encodings[i];
1585
        switch (enc) {
1586
        case VNC_ENCODING_RAW:
1587
            vs->vnc_encoding = enc;
1588
            break;
1589
        case VNC_ENCODING_COPYRECT:
1590
            vs->features |= VNC_FEATURE_COPYRECT_MASK;
1591
            break;
1592
        case VNC_ENCODING_HEXTILE:
1593
            vs->features |= VNC_FEATURE_HEXTILE_MASK;
1594
            vs->vnc_encoding = enc;
1595
            break;
1596
        case VNC_ENCODING_ZLIB:
1597
            vs->features |= VNC_FEATURE_ZLIB_MASK;
1598
            vs->vnc_encoding = enc;
1599
            break;
1600
        case VNC_ENCODING_DESKTOPRESIZE:
1601
            vs->features |= VNC_FEATURE_RESIZE_MASK;
1602
            break;
1603
        case VNC_ENCODING_POINTER_TYPE_CHANGE:
1604
            vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK;
1605
            break;
1606
        case VNC_ENCODING_EXT_KEY_EVENT:
1607
            send_ext_key_event_ack(vs);
1608
            break;
1609
        case VNC_ENCODING_AUDIO:
1610
            send_ext_audio_ack(vs);
1611
            break;
1612
        case VNC_ENCODING_WMVi:
1613
            vs->features |= VNC_FEATURE_WMVI_MASK;
1614
            break;
1615
        case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9:
1616
            vs->tight_compression = (enc & 0x0F);
1617
            break;
1618
        case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9:
1619
            vs->tight_quality = (enc & 0x0F);
1620
            break;
1621
        default:
1622
            VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc);
1623
            break;
1624
        }
1625
    }
1626

    
1627
    check_pointer_type_change(vs, kbd_mouse_is_absolute());
1628
}
1629

    
1630
static void set_pixel_conversion(VncState *vs)
1631
{
1632
    if ((vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) ==
1633
        (vs->ds->surface->flags & QEMU_BIG_ENDIAN_FLAG) && 
1634
        !memcmp(&(vs->clientds.pf), &(vs->ds->surface->pf), sizeof(PixelFormat))) {
1635
        vs->write_pixels = vnc_write_pixels_copy;
1636
        switch (vs->ds->surface->pf.bits_per_pixel) {
1637
            case 8:
1638
                vs->send_hextile_tile = send_hextile_tile_8;
1639
                break;
1640
            case 16:
1641
                vs->send_hextile_tile = send_hextile_tile_16;
1642
                break;
1643
            case 32:
1644
                vs->send_hextile_tile = send_hextile_tile_32;
1645
                break;
1646
        }
1647
    } else {
1648
        vs->write_pixels = vnc_write_pixels_generic;
1649
        switch (vs->ds->surface->pf.bits_per_pixel) {
1650
            case 8:
1651
                vs->send_hextile_tile = send_hextile_tile_generic_8;
1652
                break;
1653
            case 16:
1654
                vs->send_hextile_tile = send_hextile_tile_generic_16;
1655
                break;
1656
            case 32:
1657
                vs->send_hextile_tile = send_hextile_tile_generic_32;
1658
                break;
1659
        }
1660
    }
1661
}
1662

    
1663
static void set_pixel_format(VncState *vs,
1664
                             int bits_per_pixel, int depth,
1665
                             int big_endian_flag, int true_color_flag,
1666
                             int red_max, int green_max, int blue_max,
1667
                             int red_shift, int green_shift, int blue_shift)
1668
{
1669
    if (!true_color_flag) {
1670
        vnc_client_error(vs);
1671
        return;
1672
    }
1673

    
1674
    vs->clientds = *(vs->vd->guest.ds);
1675
    vs->clientds.pf.rmax = red_max;
1676
    count_bits(vs->clientds.pf.rbits, red_max);
1677
    vs->clientds.pf.rshift = red_shift;
1678
    vs->clientds.pf.rmask = red_max << red_shift;
1679
    vs->clientds.pf.gmax = green_max;
1680
    count_bits(vs->clientds.pf.gbits, green_max);
1681
    vs->clientds.pf.gshift = green_shift;
1682
    vs->clientds.pf.gmask = green_max << green_shift;
1683
    vs->clientds.pf.bmax = blue_max;
1684
    count_bits(vs->clientds.pf.bbits, blue_max);
1685
    vs->clientds.pf.bshift = blue_shift;
1686
    vs->clientds.pf.bmask = blue_max << blue_shift;
1687
    vs->clientds.pf.bits_per_pixel = bits_per_pixel;
1688
    vs->clientds.pf.bytes_per_pixel = bits_per_pixel / 8;
1689
    vs->clientds.pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;
1690
    vs->clientds.flags = big_endian_flag ? QEMU_BIG_ENDIAN_FLAG : 0x00;
1691

    
1692
    set_pixel_conversion(vs);
1693

    
1694
    vga_hw_invalidate();
1695
    vga_hw_update();
1696
}
1697

    
1698
static void pixel_format_message (VncState *vs) {
1699
    char pad[3] = { 0, 0, 0 };
1700

    
1701
    vnc_write_u8(vs, vs->ds->surface->pf.bits_per_pixel); /* bits-per-pixel */
1702
    vnc_write_u8(vs, vs->ds->surface->pf.depth); /* depth */
1703

    
1704
#ifdef HOST_WORDS_BIGENDIAN
1705
    vnc_write_u8(vs, 1);             /* big-endian-flag */
1706
#else
1707
    vnc_write_u8(vs, 0);             /* big-endian-flag */
1708
#endif
1709
    vnc_write_u8(vs, 1);             /* true-color-flag */
1710
    vnc_write_u16(vs, vs->ds->surface->pf.rmax);     /* red-max */
1711
    vnc_write_u16(vs, vs->ds->surface->pf.gmax);     /* green-max */
1712
    vnc_write_u16(vs, vs->ds->surface->pf.bmax);     /* blue-max */
1713
    vnc_write_u8(vs, vs->ds->surface->pf.rshift);    /* red-shift */
1714
    vnc_write_u8(vs, vs->ds->surface->pf.gshift);    /* green-shift */
1715
    vnc_write_u8(vs, vs->ds->surface->pf.bshift);    /* blue-shift */
1716
    if (vs->ds->surface->pf.bits_per_pixel == 32)
1717
        vs->send_hextile_tile = send_hextile_tile_32;
1718
    else if (vs->ds->surface->pf.bits_per_pixel == 16)
1719
        vs->send_hextile_tile = send_hextile_tile_16;
1720
    else if (vs->ds->surface->pf.bits_per_pixel == 8)
1721
        vs->send_hextile_tile = send_hextile_tile_8;
1722
    vs->clientds = *(vs->ds->surface);
1723
    vs->clientds.flags &= ~QEMU_ALLOCATED_FLAG;
1724
    vs->write_pixels = vnc_write_pixels_copy;
1725

    
1726
    vnc_write(vs, pad, 3);           /* padding */
1727
}
1728

    
1729
static void vnc_dpy_setdata(DisplayState *ds)
1730
{
1731
    /* We don't have to do anything */
1732
}
1733

    
1734
static void vnc_colordepth(VncState *vs)
1735
{
1736
    if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) {
1737
        /* Sending a WMVi message to notify the client*/
1738
        vnc_write_u8(vs, 0);  /* msg id */
1739
        vnc_write_u8(vs, 0);
1740
        vnc_write_u16(vs, 1); /* number of rects */
1741
        vnc_framebuffer_update(vs, 0, 0, ds_get_width(vs->ds), 
1742
                               ds_get_height(vs->ds), VNC_ENCODING_WMVi);
1743
        pixel_format_message(vs);
1744
        vnc_flush(vs);
1745
    } else {
1746
        set_pixel_conversion(vs);
1747
    }
1748
}
1749

    
1750
static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len)
1751
{
1752
    int i;
1753
    uint16_t limit;
1754
    VncDisplay *vd = vs->vd;
1755

    
1756
    if (data[0] > 3) {
1757
        vd->timer_interval = VNC_REFRESH_INTERVAL_BASE;
1758
        if (!qemu_timer_expired(vd->timer, qemu_get_clock(rt_clock) + vd->timer_interval))
1759
            qemu_mod_timer(vd->timer, qemu_get_clock(rt_clock) + vd->timer_interval);
1760
    }
1761

    
1762
    switch (data[0]) {
1763
    case 0:
1764
        if (len == 1)
1765
            return 20;
1766

    
1767
        set_pixel_format(vs, read_u8(data, 4), read_u8(data, 5),
1768
                         read_u8(data, 6), read_u8(data, 7),
1769
                         read_u16(data, 8), read_u16(data, 10),
1770
                         read_u16(data, 12), read_u8(data, 14),
1771
                         read_u8(data, 15), read_u8(data, 16));
1772
        break;
1773
    case 2:
1774
        if (len == 1)
1775
            return 4;
1776

    
1777
        if (len == 4) {
1778
            limit = read_u16(data, 2);
1779
            if (limit > 0)
1780
                return 4 + (limit * 4);
1781
        } else
1782
            limit = read_u16(data, 2);
1783

    
1784
        for (i = 0; i < limit; i++) {
1785
            int32_t val = read_s32(data, 4 + (i * 4));
1786
            memcpy(data + 4 + (i * 4), &val, sizeof(val));
1787
        }
1788

    
1789
        set_encodings(vs, (int32_t *)(data + 4), limit);
1790
        break;
1791
    case 3:
1792
        if (len == 1)
1793
            return 10;
1794

    
1795
        framebuffer_update_request(vs,
1796
                                   read_u8(data, 1), read_u16(data, 2), read_u16(data, 4),
1797
                                   read_u16(data, 6), read_u16(data, 8));
1798
        break;
1799
    case 4:
1800
        if (len == 1)
1801
            return 8;
1802

    
1803
        key_event(vs, read_u8(data, 1), read_u32(data, 4));
1804
        break;
1805
    case 5:
1806
        if (len == 1)
1807
            return 6;
1808

    
1809
        pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4));
1810
        break;
1811
    case 6:
1812
        if (len == 1)
1813
            return 8;
1814

    
1815
        if (len == 8) {
1816
            uint32_t dlen = read_u32(data, 4);
1817
            if (dlen > 0)
1818
                return 8 + dlen;
1819
        }
1820

    
1821
        client_cut_text(vs, read_u32(data, 4), data + 8);
1822
        break;
1823
    case 255:
1824
        if (len == 1)
1825
            return 2;
1826

    
1827
        switch (read_u8(data, 1)) {
1828
        case 0:
1829
            if (len == 2)
1830
                return 12;
1831

    
1832
            ext_key_event(vs, read_u16(data, 2),
1833
                          read_u32(data, 4), read_u32(data, 8));
1834
            break;
1835
        case 1:
1836
            if (len == 2)
1837
                return 4;
1838

    
1839
            switch (read_u16 (data, 2)) {
1840
            case 0:
1841
                audio_add(vs);
1842
                break;
1843
            case 1:
1844
                audio_del(vs);
1845
                break;
1846
            case 2:
1847
                if (len == 4)
1848
                    return 10;
1849
                switch (read_u8(data, 4)) {
1850
                case 0: vs->as.fmt = AUD_FMT_U8; break;
1851
                case 1: vs->as.fmt = AUD_FMT_S8; break;
1852
                case 2: vs->as.fmt = AUD_FMT_U16; break;
1853
                case 3: vs->as.fmt = AUD_FMT_S16; break;
1854
                case 4: vs->as.fmt = AUD_FMT_U32; break;
1855
                case 5: vs->as.fmt = AUD_FMT_S32; break;
1856
                default:
1857
                    printf("Invalid audio format %d\n", read_u8(data, 4));
1858
                    vnc_client_error(vs);
1859
                    break;
1860
                }
1861
                vs->as.nchannels = read_u8(data, 5);
1862
                if (vs->as.nchannels != 1 && vs->as.nchannels != 2) {
1863
                    printf("Invalid audio channel coount %d\n",
1864
                           read_u8(data, 5));
1865
                    vnc_client_error(vs);
1866
                    break;
1867
                }
1868
                vs->as.freq = read_u32(data, 6);
1869
                break;
1870
            default:
1871
                printf ("Invalid audio message %d\n", read_u8(data, 4));
1872
                vnc_client_error(vs);
1873
                break;
1874
            }
1875
            break;
1876

    
1877
        default:
1878
            printf("Msg: %d\n", read_u16(data, 0));
1879
            vnc_client_error(vs);
1880
            break;
1881
        }
1882
        break;
1883
    default:
1884
        printf("Msg: %d\n", data[0]);
1885
        vnc_client_error(vs);
1886
        break;
1887
    }
1888

    
1889
    vnc_read_when(vs, protocol_client_msg, 1);
1890
    return 0;
1891
}
1892

    
1893
static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
1894
{
1895
    char buf[1024];
1896
    int size;
1897

    
1898
    vnc_write_u16(vs, ds_get_width(vs->ds));
1899
    vnc_write_u16(vs, ds_get_height(vs->ds));
1900

    
1901
    pixel_format_message(vs);
1902

    
1903
    if (qemu_name)
1904
        size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
1905
    else
1906
        size = snprintf(buf, sizeof(buf), "QEMU");
1907

    
1908
    vnc_write_u32(vs, size);
1909
    vnc_write(vs, buf, size);
1910
    vnc_flush(vs);
1911

    
1912
    vnc_read_when(vs, protocol_client_msg, 1);
1913

    
1914
    return 0;
1915
}
1916

    
1917
void start_client_init(VncState *vs)
1918
{
1919
    vnc_read_when(vs, protocol_client_init, 1);
1920
}
1921

    
1922
static void make_challenge(VncState *vs)
1923
{
1924
    int i;
1925

    
1926
    srand(time(NULL)+getpid()+getpid()*987654+rand());
1927

    
1928
    for (i = 0 ; i < sizeof(vs->challenge) ; i++)
1929
        vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0));
1930
}
1931

    
1932
static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)
1933
{
1934
    unsigned char response[VNC_AUTH_CHALLENGE_SIZE];
1935
    int i, j, pwlen;
1936
    unsigned char key[8];
1937

    
1938
    if (!vs->vd->password || !vs->vd->password[0]) {
1939
        VNC_DEBUG("No password configured on server");
1940
        vnc_write_u32(vs, 1); /* Reject auth */
1941
        if (vs->minor >= 8) {
1942
            static const char err[] = "Authentication failed";
1943
            vnc_write_u32(vs, sizeof(err));
1944
            vnc_write(vs, err, sizeof(err));
1945
        }
1946
        vnc_flush(vs);
1947
        vnc_client_error(vs);
1948
        return 0;
1949
    }
1950

    
1951
    memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE);
1952

    
1953
    /* Calculate the expected challenge response */
1954
    pwlen = strlen(vs->vd->password);
1955
    for (i=0; i<sizeof(key); i++)
1956
        key[i] = i<pwlen ? vs->vd->password[i] : 0;
1957
    deskey(key, EN0);
1958
    for (j = 0; j < VNC_AUTH_CHALLENGE_SIZE; j += 8)
1959
        des(response+j, response+j);
1960

    
1961
    /* Compare expected vs actual challenge response */
1962
    if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) {
1963
        VNC_DEBUG("Client challenge reponse did not match\n");
1964
        vnc_write_u32(vs, 1); /* Reject auth */
1965
        if (vs->minor >= 8) {
1966
            static const char err[] = "Authentication failed";
1967
            vnc_write_u32(vs, sizeof(err));
1968
            vnc_write(vs, err, sizeof(err));
1969
        }
1970
        vnc_flush(vs);
1971
        vnc_client_error(vs);
1972
    } else {
1973
        VNC_DEBUG("Accepting VNC challenge response\n");
1974
        vnc_write_u32(vs, 0); /* Accept auth */
1975
        vnc_flush(vs);
1976

    
1977
        start_client_init(vs);
1978
    }
1979
    return 0;
1980
}
1981

    
1982
void start_auth_vnc(VncState *vs)
1983
{
1984
    make_challenge(vs);
1985
    /* Send client a 'random' challenge */
1986
    vnc_write(vs, vs->challenge, sizeof(vs->challenge));
1987
    vnc_flush(vs);
1988

    
1989
    vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge));
1990
}
1991

    
1992

    
1993
static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
1994
{
1995
    /* We only advertise 1 auth scheme at a time, so client
1996
     * must pick the one we sent. Verify this */
1997
    if (data[0] != vs->vd->auth) { /* Reject auth */
1998
       VNC_DEBUG("Reject auth %d because it didn't match advertized\n", (int)data[0]);
1999
       vnc_write_u32(vs, 1);
2000
       if (vs->minor >= 8) {
2001
           static const char err[] = "Authentication failed";
2002
           vnc_write_u32(vs, sizeof(err));
2003
           vnc_write(vs, err, sizeof(err));
2004
       }
2005
       vnc_client_error(vs);
2006
    } else { /* Accept requested auth */
2007
       VNC_DEBUG("Client requested auth %d\n", (int)data[0]);
2008
       switch (vs->vd->auth) {
2009
       case VNC_AUTH_NONE:
2010
           VNC_DEBUG("Accept auth none\n");
2011
           if (vs->minor >= 8) {
2012
               vnc_write_u32(vs, 0); /* Accept auth completion */
2013
               vnc_flush(vs);
2014
           }
2015
           start_client_init(vs);
2016
           break;
2017

    
2018
       case VNC_AUTH_VNC:
2019
           VNC_DEBUG("Start VNC auth\n");
2020
           start_auth_vnc(vs);
2021
           break;
2022

    
2023
#ifdef CONFIG_VNC_TLS
2024
       case VNC_AUTH_VENCRYPT:
2025
           VNC_DEBUG("Accept VeNCrypt auth\n");;
2026
           start_auth_vencrypt(vs);
2027
           break;
2028
#endif /* CONFIG_VNC_TLS */
2029

    
2030
#ifdef CONFIG_VNC_SASL
2031
       case VNC_AUTH_SASL:
2032
           VNC_DEBUG("Accept SASL auth\n");
2033
           start_auth_sasl(vs);
2034
           break;
2035
#endif /* CONFIG_VNC_SASL */
2036

    
2037
       default: /* Should not be possible, but just in case */
2038
           VNC_DEBUG("Reject auth %d server code bug\n", vs->vd->auth);
2039
           vnc_write_u8(vs, 1);
2040
           if (vs->minor >= 8) {
2041
               static const char err[] = "Authentication failed";
2042
               vnc_write_u32(vs, sizeof(err));
2043
               vnc_write(vs, err, sizeof(err));
2044
           }
2045
           vnc_client_error(vs);
2046
       }
2047
    }
2048
    return 0;
2049
}
2050

    
2051
static int protocol_version(VncState *vs, uint8_t *version, size_t len)
2052
{
2053
    char local[13];
2054

    
2055
    memcpy(local, version, 12);
2056
    local[12] = 0;
2057

    
2058
    if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) {
2059
        VNC_DEBUG("Malformed protocol version %s\n", local);
2060
        vnc_client_error(vs);
2061
        return 0;
2062
    }
2063
    VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor);
2064
    if (vs->major != 3 ||
2065
        (vs->minor != 3 &&
2066
         vs->minor != 4 &&
2067
         vs->minor != 5 &&
2068
         vs->minor != 7 &&
2069
         vs->minor != 8)) {
2070
        VNC_DEBUG("Unsupported client version\n");
2071
        vnc_write_u32(vs, VNC_AUTH_INVALID);
2072
        vnc_flush(vs);
2073
        vnc_client_error(vs);
2074
        return 0;
2075
    }
2076
    /* Some broken clients report v3.4 or v3.5, which spec requires to be treated
2077
     * as equivalent to v3.3 by servers
2078
     */
2079
    if (vs->minor == 4 || vs->minor == 5)
2080
        vs->minor = 3;
2081

    
2082
    if (vs->minor == 3) {
2083
        if (vs->vd->auth == VNC_AUTH_NONE) {
2084
            VNC_DEBUG("Tell client auth none\n");
2085
            vnc_write_u32(vs, vs->vd->auth);
2086
            vnc_flush(vs);
2087
            start_client_init(vs);
2088
       } else if (vs->vd->auth == VNC_AUTH_VNC) {
2089
            VNC_DEBUG("Tell client VNC auth\n");
2090
            vnc_write_u32(vs, vs->vd->auth);
2091
            vnc_flush(vs);
2092
            start_auth_vnc(vs);
2093
       } else {
2094
            VNC_DEBUG("Unsupported auth %d for protocol 3.3\n", vs->vd->auth);
2095
            vnc_write_u32(vs, VNC_AUTH_INVALID);
2096
            vnc_flush(vs);
2097
            vnc_client_error(vs);
2098
       }
2099
    } else {
2100
        VNC_DEBUG("Telling client we support auth %d\n", vs->vd->auth);
2101
        vnc_write_u8(vs, 1); /* num auth */
2102
        vnc_write_u8(vs, vs->vd->auth);
2103
        vnc_read_when(vs, protocol_client_auth, 1);
2104
        vnc_flush(vs);
2105
    }
2106

    
2107
    return 0;
2108
}
2109

    
2110
static int vnc_refresh_server_surface(VncDisplay *vd)
2111
{
2112
    int y;
2113
    uint8_t *guest_row;
2114
    uint8_t *server_row;
2115
    int cmp_bytes;
2116
    uint32_t width_mask[VNC_DIRTY_WORDS];
2117
    VncState *vs = NULL;
2118
    int has_dirty = 0;
2119

    
2120
    /*
2121
     * Walk through the guest dirty map.
2122
     * Check and copy modified bits from guest to server surface.
2123
     * Update server dirty map.
2124
     */
2125
    vnc_set_bits(width_mask, (ds_get_width(vd->ds) / 16), VNC_DIRTY_WORDS);
2126
    cmp_bytes = 16 * ds_get_bytes_per_pixel(vd->ds);
2127
    guest_row  = vd->guest.ds->data;
2128
    server_row = vd->server->data;
2129
    for (y = 0; y < vd->guest.ds->height; y++) {
2130
        if (vnc_and_bits(vd->guest.dirty[y], width_mask, VNC_DIRTY_WORDS)) {
2131
            int x;
2132
            uint8_t *guest_ptr;
2133
            uint8_t *server_ptr;
2134

    
2135
            guest_ptr  = guest_row;
2136
            server_ptr = server_row;
2137

    
2138
            for (x = 0; x < vd->guest.ds->width;
2139
                    x += 16, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) {
2140
                if (!vnc_get_bit(vd->guest.dirty[y], (x / 16)))
2141
                    continue;
2142
                vnc_clear_bit(vd->guest.dirty[y], (x / 16));
2143
                if (memcmp(server_ptr, guest_ptr, cmp_bytes) == 0)
2144
                    continue;
2145
                memcpy(server_ptr, guest_ptr, cmp_bytes);
2146
                vs = vd->clients;
2147
                while (vs != NULL) {
2148
                    vnc_set_bit(vs->dirty[y], (x / 16));
2149
                    vs = vs->next;
2150
                }
2151
                has_dirty++;
2152
            }
2153
        }
2154
        guest_row  += ds_get_linesize(vd->ds);
2155
        server_row += ds_get_linesize(vd->ds);
2156
    }
2157
    return has_dirty;
2158
}
2159

    
2160
static void vnc_refresh(void *opaque)
2161
{
2162
    VncDisplay *vd = opaque;
2163
    VncState *vs = NULL;
2164
    int has_dirty = 0, rects = 0;
2165

    
2166
    vga_hw_update();
2167

    
2168
    has_dirty = vnc_refresh_server_surface(vd);
2169

    
2170
    vs = vd->clients;
2171
    while (vs != NULL) {
2172
        rects += vnc_update_client(vs, has_dirty);
2173
        vs = vs->next;
2174
    }
2175

    
2176
    if (has_dirty && rects) {
2177
        vd->timer_interval /= 2;
2178
        if (vd->timer_interval < VNC_REFRESH_INTERVAL_BASE)
2179
            vd->timer_interval = VNC_REFRESH_INTERVAL_BASE;
2180
    } else {
2181
        vd->timer_interval += VNC_REFRESH_INTERVAL_INC;
2182
        if (vd->timer_interval > VNC_REFRESH_INTERVAL_MAX)
2183
            vd->timer_interval = VNC_REFRESH_INTERVAL_MAX;
2184
    }
2185
    qemu_mod_timer(vd->timer, qemu_get_clock(rt_clock) + vd->timer_interval);
2186
}
2187

    
2188
static void vnc_init_timer(VncDisplay *vd)
2189
{
2190
    vd->timer_interval = VNC_REFRESH_INTERVAL_BASE;
2191
    if (vd->timer == NULL && vd->clients != NULL) {
2192
        vd->timer = qemu_new_timer(rt_clock, vnc_refresh, vd);
2193
        vnc_refresh(vd);
2194
    }
2195
}
2196

    
2197
static void vnc_remove_timer(VncDisplay *vd)
2198
{
2199
    if (vd->timer != NULL && vd->clients == NULL) {
2200
        qemu_del_timer(vd->timer);
2201
        qemu_free_timer(vd->timer);
2202
        vd->timer = NULL;
2203
    }
2204
}
2205

    
2206
static void vnc_connect(VncDisplay *vd, int csock)
2207
{
2208
    VncState *vs = qemu_mallocz(sizeof(VncState));
2209
    vs->csock = csock;
2210

    
2211
    VNC_DEBUG("New client on socket %d\n", csock);
2212
    dcl->idle = 0;
2213
    socket_set_nonblock(vs->csock);
2214
    qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
2215

    
2216
    vs->vd = vd;
2217
    vs->ds = vd->ds;
2218
    vs->last_x = -1;
2219
    vs->last_y = -1;
2220

    
2221
    vs->as.freq = 44100;
2222
    vs->as.nchannels = 2;
2223
    vs->as.fmt = AUD_FMT_S16;
2224
    vs->as.endianness = 0;
2225

    
2226
    vs->next = vd->clients;
2227
    vd->clients = vs;
2228

    
2229
    vga_hw_update();
2230

    
2231
    vnc_write(vs, "RFB 003.008\n", 12);
2232
    vnc_flush(vs);
2233
    vnc_read_when(vs, protocol_version, 12);
2234
    reset_keys(vs);
2235

    
2236
    vnc_init_timer(vd);
2237

    
2238
    /* vs might be free()ed here */
2239
}
2240

    
2241
static void vnc_listen_read(void *opaque)
2242
{
2243
    VncDisplay *vs = opaque;
2244
    struct sockaddr_in addr;
2245
    socklen_t addrlen = sizeof(addr);
2246

    
2247
    /* Catch-up */
2248
    vga_hw_update();
2249

    
2250
    int csock = accept(vs->lsock, (struct sockaddr *)&addr, &addrlen);
2251
    if (csock != -1) {
2252
        vnc_connect(vs, csock);
2253
    }
2254
}
2255

    
2256
void vnc_display_init(DisplayState *ds)
2257
{
2258
    VncDisplay *vs = qemu_mallocz(sizeof(*vs));
2259

    
2260
    dcl = qemu_mallocz(sizeof(DisplayChangeListener));
2261

    
2262
    ds->opaque = vs;
2263
    dcl->idle = 1;
2264
    vnc_display = vs;
2265

    
2266
    vs->lsock = -1;
2267

    
2268
    vs->ds = ds;
2269

    
2270
    if (keyboard_layout)
2271
        vs->kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout);
2272
    else
2273
        vs->kbd_layout = init_keyboard_layout(name2keysym, "en-us");
2274

    
2275
    if (!vs->kbd_layout)
2276
        exit(1);
2277

    
2278
    dcl->dpy_copy = vnc_dpy_copy;
2279
    dcl->dpy_update = vnc_dpy_update;
2280
    dcl->dpy_resize = vnc_dpy_resize;
2281
    dcl->dpy_setdata = vnc_dpy_setdata;
2282
    register_displaychangelistener(ds, dcl);
2283
}
2284

    
2285

    
2286
void vnc_display_close(DisplayState *ds)
2287
{
2288
    VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2289

    
2290
    if (!vs)
2291
        return;
2292
    if (vs->display) {
2293
        qemu_free(vs->display);
2294
        vs->display = NULL;
2295
    }
2296
    if (vs->lsock != -1) {
2297
        qemu_set_fd_handler2(vs->lsock, NULL, NULL, NULL, NULL);
2298
        close(vs->lsock);
2299
        vs->lsock = -1;
2300
    }
2301
    vs->auth = VNC_AUTH_INVALID;
2302
#ifdef CONFIG_VNC_TLS
2303
    vs->subauth = VNC_AUTH_INVALID;
2304
    vs->tls.x509verify = 0;
2305
#endif
2306
}
2307

    
2308
int vnc_display_password(DisplayState *ds, const char *password)
2309
{
2310
    VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2311

    
2312
    if (!vs) {
2313
        return -1;
2314
    }
2315

    
2316
    if (vs->password) {
2317
        qemu_free(vs->password);
2318
        vs->password = NULL;
2319
    }
2320
    if (password && password[0]) {
2321
        if (!(vs->password = qemu_strdup(password)))
2322
            return -1;
2323
        if (vs->auth == VNC_AUTH_NONE) {
2324
            vs->auth = VNC_AUTH_VNC;
2325
        }
2326
    } else {
2327
        vs->auth = VNC_AUTH_NONE;
2328
    }
2329

    
2330
    return 0;
2331
}
2332

    
2333
char *vnc_display_local_addr(DisplayState *ds)
2334
{
2335
    VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2336
    
2337
    return vnc_socket_local_addr("%s:%s", vs->lsock);
2338
}
2339

    
2340
int vnc_display_open(DisplayState *ds, const char *display)
2341
{
2342
    VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
2343
    const char *options;
2344
    int password = 0;
2345
    int reverse = 0;
2346
    int to_port = 0;
2347
#ifdef CONFIG_VNC_TLS
2348
    int tls = 0, x509 = 0;
2349
#endif
2350
#ifdef CONFIG_VNC_SASL
2351
    int sasl = 0;
2352
    int saslErr;
2353
#endif
2354
    int acl = 0;
2355

    
2356
    if (!vnc_display)
2357
        return -1;
2358
    vnc_display_close(ds);
2359
    if (strcmp(display, "none") == 0)
2360
        return 0;
2361

    
2362
    if (!(vs->display = strdup(display)))
2363
        return -1;
2364

    
2365
    options = display;
2366
    while ((options = strchr(options, ','))) {
2367
        options++;
2368
        if (strncmp(options, "password", 8) == 0) {
2369
            password = 1; /* Require password auth */
2370
        } else if (strncmp(options, "reverse", 7) == 0) {
2371
            reverse = 1;
2372
        } else if (strncmp(options, "to=", 3) == 0) {
2373
            to_port = atoi(options+3) + 5900;
2374
#ifdef CONFIG_VNC_SASL
2375
        } else if (strncmp(options, "sasl", 4) == 0) {
2376
            sasl = 1; /* Require SASL auth */
2377
#endif
2378
#ifdef CONFIG_VNC_TLS
2379
        } else if (strncmp(options, "tls", 3) == 0) {
2380
            tls = 1; /* Require TLS */
2381
        } else if (strncmp(options, "x509", 4) == 0) {
2382
            char *start, *end;
2383
            x509 = 1; /* Require x509 certificates */
2384
            if (strncmp(options, "x509verify", 10) == 0)
2385
                vs->tls.x509verify = 1; /* ...and verify client certs */
2386

    
2387
            /* Now check for 'x509=/some/path' postfix
2388
             * and use that to setup x509 certificate/key paths */
2389
            start = strchr(options, '=');
2390
            end = strchr(options, ',');
2391
            if (start && (!end || (start < end))) {
2392
                int len = end ? end-(start+1) : strlen(start+1);
2393
                char *path = qemu_strndup(start + 1, len);
2394

    
2395
                VNC_DEBUG("Trying certificate path '%s'\n", path);
2396
                if (vnc_tls_set_x509_creds_dir(vs, path) < 0) {
2397
                    fprintf(stderr, "Failed to find x509 certificates/keys in %s\n", path);
2398
                    qemu_free(path);
2399
                    qemu_free(vs->display);
2400
                    vs->display = NULL;
2401
                    return -1;
2402
                }
2403
                qemu_free(path);
2404
            } else {
2405
                fprintf(stderr, "No certificate path provided\n");
2406
                qemu_free(vs->display);
2407
                vs->display = NULL;
2408
                return -1;
2409
            }
2410
#endif
2411
        } else if (strncmp(options, "acl", 3) == 0) {
2412
            acl = 1;
2413
        }
2414
    }
2415

    
2416
#ifdef CONFIG_VNC_TLS
2417
    if (acl && x509 && vs->tls.x509verify) {
2418
        if (!(vs->tls.acl = qemu_acl_init("vnc.x509dname"))) {
2419
            fprintf(stderr, "Failed to create x509 dname ACL\n");
2420
            exit(1);
2421
        }
2422
    }
2423
#endif
2424
#ifdef CONFIG_VNC_SASL
2425
    if (acl && sasl) {
2426
        if (!(vs->sasl.acl = qemu_acl_init("vnc.username"))) {
2427
            fprintf(stderr, "Failed to create username ACL\n");
2428
            exit(1);
2429
        }
2430
    }
2431
#endif
2432

    
2433
    /*
2434
     * Combinations we support here:
2435
     *
2436
     *  - no-auth                (clear text, no auth)
2437
     *  - password               (clear text, weak auth)
2438
     *  - sasl                   (encrypt, good auth *IF* using Kerberos via GSSAPI)
2439
     *  - tls                    (encrypt, weak anonymous creds, no auth)
2440
     *  - tls + password         (encrypt, weak anonymous creds, weak auth)
2441
     *  - tls + sasl             (encrypt, weak anonymous creds, good auth)
2442
     *  - tls + x509             (encrypt, good x509 creds, no auth)
2443
     *  - tls + x509 + password  (encrypt, good x509 creds, weak auth)
2444
     *  - tls + x509 + sasl      (encrypt, good x509 creds, good auth)
2445
     *
2446
     * NB1. TLS is a stackable auth scheme.
2447
     * NB2. the x509 schemes have option to validate a client cert dname
2448
     */
2449
    if (password) {
2450
#ifdef CONFIG_VNC_TLS
2451
        if (tls) {
2452
            vs->auth = VNC_AUTH_VENCRYPT;
2453
            if (x509) {
2454
                VNC_DEBUG("Initializing VNC server with x509 password auth\n");
2455
                vs->subauth = VNC_AUTH_VENCRYPT_X509VNC;
2456
            } else {
2457
                VNC_DEBUG("Initializing VNC server with TLS password auth\n");
2458
                vs->subauth = VNC_AUTH_VENCRYPT_TLSVNC;
2459
            }
2460
        } else {
2461
#endif /* CONFIG_VNC_TLS */
2462
            VNC_DEBUG("Initializing VNC server with password auth\n");
2463
            vs->auth = VNC_AUTH_VNC;
2464
#ifdef CONFIG_VNC_TLS
2465
            vs->subauth = VNC_AUTH_INVALID;
2466
        }
2467
#endif /* CONFIG_VNC_TLS */
2468
#ifdef CONFIG_VNC_SASL
2469
    } else if (sasl) {
2470
#ifdef CONFIG_VNC_TLS
2471
        if (tls) {
2472
            vs->auth = VNC_AUTH_VENCRYPT;
2473
            if (x509) {
2474
                VNC_DEBUG("Initializing VNC server with x509 SASL auth\n");
2475
                vs->subauth = VNC_AUTH_VENCRYPT_X509SASL;
2476
            } else {
2477
                VNC_DEBUG("Initializing VNC server with TLS SASL auth\n");
2478
                vs->subauth = VNC_AUTH_VENCRYPT_TLSSASL;
2479
            }
2480
        } else {
2481
#endif /* CONFIG_VNC_TLS */
2482
            VNC_DEBUG("Initializing VNC server with SASL auth\n");
2483
            vs->auth = VNC_AUTH_SASL;
2484
#ifdef CONFIG_VNC_TLS
2485
            vs->subauth = VNC_AUTH_INVALID;
2486
        }
2487
#endif /* CONFIG_VNC_TLS */
2488
#endif /* CONFIG_VNC_SASL */
2489
    } else {
2490
#ifdef CONFIG_VNC_TLS
2491
        if (tls) {
2492
            vs->auth = VNC_AUTH_VENCRYPT;
2493
            if (x509) {
2494
                VNC_DEBUG("Initializing VNC server with x509 no auth\n");
2495
                vs->subauth = VNC_AUTH_VENCRYPT_X509NONE;
2496
            } else {
2497
                VNC_DEBUG("Initializing VNC server with TLS no auth\n");
2498
                vs->subauth = VNC_AUTH_VENCRYPT_TLSNONE;
2499
            }
2500
        } else {
2501
#endif
2502
            VNC_DEBUG("Initializing VNC server with no auth\n");
2503
            vs->auth = VNC_AUTH_NONE;
2504
#ifdef CONFIG_VNC_TLS
2505
            vs->subauth = VNC_AUTH_INVALID;
2506
        }
2507
#endif
2508
    }
2509

    
2510
#ifdef CONFIG_VNC_SASL
2511
    if ((saslErr = sasl_server_init(NULL, "qemu")) != SASL_OK) {
2512
        fprintf(stderr, "Failed to initialize SASL auth %s",
2513
                sasl_errstring(saslErr, NULL, NULL));
2514
        free(vs->display);
2515
        vs->display = NULL;
2516
        return -1;
2517
    }
2518
#endif
2519

    
2520
    if (reverse) {
2521
        /* connect to viewer */
2522
        if (strncmp(display, "unix:", 5) == 0)
2523
            vs->lsock = unix_connect(display+5);
2524
        else
2525
            vs->lsock = inet_connect(display, SOCK_STREAM);
2526
        if (-1 == vs->lsock) {
2527
            free(vs->display);
2528
            vs->display = NULL;
2529
            return -1;
2530
        } else {
2531
            int csock = vs->lsock;
2532
            vs->lsock = -1;
2533
            vnc_connect(vs, csock);
2534
        }
2535
        return 0;
2536

    
2537
    } else {
2538
        /* listen for connects */
2539
        char *dpy;
2540
        dpy = qemu_malloc(256);
2541
        if (strncmp(display, "unix:", 5) == 0) {
2542
            pstrcpy(dpy, 256, "unix:");
2543
            vs->lsock = unix_listen(display+5, dpy+5, 256-5);
2544
        } else {
2545
            vs->lsock = inet_listen(display, dpy, 256, SOCK_STREAM, 5900);
2546
        }
2547
        if (-1 == vs->lsock) {
2548
            free(dpy);
2549
            return -1;
2550
        } else {
2551
            free(vs->display);
2552
            vs->display = dpy;
2553
        }
2554
    }
2555
    return qemu_set_fd_handler2(vs->lsock, NULL, vnc_listen_read, NULL, vs);
2556
}