1 /* 2 * QEMU VNC display driver 3 * 4 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws> 5 * Copyright (C) 2006 Fabrice Bellard 6 * Copyright (C) 2009 Red Hat, Inc 7 * 8 * Permission is hereby granted, free of charge, to any person obtaining a copy 9 * of this software and associated documentation files (the "Software"), to deal 10 * in the Software without restriction, including without limitation the rights 11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 12 * copies of the Software, and to permit persons to whom the Software is 13 * furnished to do so, subject to the following conditions: 14 * 15 * The above copyright notice and this permission notice shall be included in 16 * all copies or substantial portions of the Software. 17 * 18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 24 * THE SOFTWARE. 25 */ 26 27 #include "qemu/osdep.h" 28 #include "vnc.h" 29 #include "vnc-jobs.h" 30 #include "trace.h" 31 #include "sysemu/sysemu.h" 32 #include "qemu/error-report.h" 33 #include "qemu/option.h" 34 #include "qemu/sockets.h" 35 #include "qemu/timer.h" 36 #include "qemu/acl.h" 37 #include "qemu/config-file.h" 38 #include "qapi/error.h" 39 #include "qmp-commands.h" 40 #include "ui/input.h" 41 #include "qapi-event.h" 42 #include "crypto/hash.h" 43 #include "crypto/tlscredsanon.h" 44 #include "crypto/tlscredsx509.h" 45 #include "qom/object_interfaces.h" 46 #include "qemu/cutils.h" 47 #include "io/dns-resolver.h" 48 49 #define VNC_REFRESH_INTERVAL_BASE GUI_REFRESH_INTERVAL_DEFAULT 50 #define VNC_REFRESH_INTERVAL_INC 50 51 #define VNC_REFRESH_INTERVAL_MAX GUI_REFRESH_INTERVAL_IDLE 52 static const struct timeval VNC_REFRESH_STATS = { 0, 500000 }; 53 static const struct timeval VNC_REFRESH_LOSSY = { 2, 0 }; 54 55 #include "vnc_keysym.h" 56 #include "crypto/cipher.h" 57 58 static QTAILQ_HEAD(, VncDisplay) vnc_displays = 59 QTAILQ_HEAD_INITIALIZER(vnc_displays); 60 61 static int vnc_cursor_define(VncState *vs); 62 static void vnc_release_modifiers(VncState *vs); 63 static void vnc_update_throttle_offset(VncState *vs); 64 65 static void vnc_set_share_mode(VncState *vs, VncShareMode mode) 66 { 67 #ifdef _VNC_DEBUG 68 static const char *mn[] = { 69 [0] = "undefined", 70 [VNC_SHARE_MODE_CONNECTING] = "connecting", 71 [VNC_SHARE_MODE_SHARED] = "shared", 72 [VNC_SHARE_MODE_EXCLUSIVE] = "exclusive", 73 [VNC_SHARE_MODE_DISCONNECTED] = "disconnected", 74 }; 75 fprintf(stderr, "%s/%p: %s -> %s\n", __func__, 76 vs->ioc, mn[vs->share_mode], mn[mode]); 77 #endif 78 79 switch (vs->share_mode) { 80 case VNC_SHARE_MODE_CONNECTING: 81 vs->vd->num_connecting--; 82 break; 83 case VNC_SHARE_MODE_SHARED: 84 vs->vd->num_shared--; 85 break; 86 case VNC_SHARE_MODE_EXCLUSIVE: 87 vs->vd->num_exclusive--; 88 break; 89 default: 90 break; 91 } 92 93 vs->share_mode = mode; 94 95 switch (vs->share_mode) { 96 case VNC_SHARE_MODE_CONNECTING: 97 vs->vd->num_connecting++; 98 break; 99 case VNC_SHARE_MODE_SHARED: 100 vs->vd->num_shared++; 101 break; 102 case VNC_SHARE_MODE_EXCLUSIVE: 103 vs->vd->num_exclusive++; 104 break; 105 default: 106 break; 107 } 108 } 109 110 111 static void vnc_init_basic_info(SocketAddress *addr, 112 VncBasicInfo *info, 113 Error **errp) 114 { 115 switch (addr->type) { 116 case SOCKET_ADDRESS_TYPE_INET: 117 info->host = g_strdup(addr->u.inet.host); 118 info->service = g_strdup(addr->u.inet.port); 119 if (addr->u.inet.ipv6) { 120 info->family = NETWORK_ADDRESS_FAMILY_IPV6; 121 } else { 122 info->family = NETWORK_ADDRESS_FAMILY_IPV4; 123 } 124 break; 125 126 case SOCKET_ADDRESS_TYPE_UNIX: 127 info->host = g_strdup(""); 128 info->service = g_strdup(addr->u.q_unix.path); 129 info->family = NETWORK_ADDRESS_FAMILY_UNIX; 130 break; 131 132 case SOCKET_ADDRESS_TYPE_VSOCK: 133 case SOCKET_ADDRESS_TYPE_FD: 134 error_setg(errp, "Unsupported socket address type %s", 135 SocketAddressType_str(addr->type)); 136 break; 137 default: 138 abort(); 139 } 140 141 return; 142 } 143 144 static void vnc_init_basic_info_from_server_addr(QIOChannelSocket *ioc, 145 VncBasicInfo *info, 146 Error **errp) 147 { 148 SocketAddress *addr = NULL; 149 150 if (!ioc) { 151 error_setg(errp, "No listener socket available"); 152 return; 153 } 154 155 addr = qio_channel_socket_get_local_address(ioc, errp); 156 if (!addr) { 157 return; 158 } 159 160 vnc_init_basic_info(addr, info, errp); 161 qapi_free_SocketAddress(addr); 162 } 163 164 static void vnc_init_basic_info_from_remote_addr(QIOChannelSocket *ioc, 165 VncBasicInfo *info, 166 Error **errp) 167 { 168 SocketAddress *addr = NULL; 169 170 addr = qio_channel_socket_get_remote_address(ioc, errp); 171 if (!addr) { 172 return; 173 } 174 175 vnc_init_basic_info(addr, info, errp); 176 qapi_free_SocketAddress(addr); 177 } 178 179 static const char *vnc_auth_name(VncDisplay *vd) { 180 switch (vd->auth) { 181 case VNC_AUTH_INVALID: 182 return "invalid"; 183 case VNC_AUTH_NONE: 184 return "none"; 185 case VNC_AUTH_VNC: 186 return "vnc"; 187 case VNC_AUTH_RA2: 188 return "ra2"; 189 case VNC_AUTH_RA2NE: 190 return "ra2ne"; 191 case VNC_AUTH_TIGHT: 192 return "tight"; 193 case VNC_AUTH_ULTRA: 194 return "ultra"; 195 case VNC_AUTH_TLS: 196 return "tls"; 197 case VNC_AUTH_VENCRYPT: 198 switch (vd->subauth) { 199 case VNC_AUTH_VENCRYPT_PLAIN: 200 return "vencrypt+plain"; 201 case VNC_AUTH_VENCRYPT_TLSNONE: 202 return "vencrypt+tls+none"; 203 case VNC_AUTH_VENCRYPT_TLSVNC: 204 return "vencrypt+tls+vnc"; 205 case VNC_AUTH_VENCRYPT_TLSPLAIN: 206 return "vencrypt+tls+plain"; 207 case VNC_AUTH_VENCRYPT_X509NONE: 208 return "vencrypt+x509+none"; 209 case VNC_AUTH_VENCRYPT_X509VNC: 210 return "vencrypt+x509+vnc"; 211 case VNC_AUTH_VENCRYPT_X509PLAIN: 212 return "vencrypt+x509+plain"; 213 case VNC_AUTH_VENCRYPT_TLSSASL: 214 return "vencrypt+tls+sasl"; 215 case VNC_AUTH_VENCRYPT_X509SASL: 216 return "vencrypt+x509+sasl"; 217 default: 218 return "vencrypt"; 219 } 220 case VNC_AUTH_SASL: 221 return "sasl"; 222 } 223 return "unknown"; 224 } 225 226 static VncServerInfo *vnc_server_info_get(VncDisplay *vd) 227 { 228 VncServerInfo *info; 229 Error *err = NULL; 230 231 if (!vd->listener || !vd->listener->nsioc) { 232 return NULL; 233 } 234 235 info = g_malloc0(sizeof(*info)); 236 vnc_init_basic_info_from_server_addr(vd->listener->sioc[0], 237 qapi_VncServerInfo_base(info), &err); 238 info->has_auth = true; 239 info->auth = g_strdup(vnc_auth_name(vd)); 240 if (err) { 241 qapi_free_VncServerInfo(info); 242 info = NULL; 243 error_free(err); 244 } 245 return info; 246 } 247 248 static void vnc_client_cache_auth(VncState *client) 249 { 250 if (!client->info) { 251 return; 252 } 253 254 if (client->tls) { 255 client->info->x509_dname = 256 qcrypto_tls_session_get_peer_name(client->tls); 257 client->info->has_x509_dname = 258 client->info->x509_dname != NULL; 259 } 260 #ifdef CONFIG_VNC_SASL 261 if (client->sasl.conn && 262 client->sasl.username) { 263 client->info->has_sasl_username = true; 264 client->info->sasl_username = g_strdup(client->sasl.username); 265 } 266 #endif 267 } 268 269 static void vnc_client_cache_addr(VncState *client) 270 { 271 Error *err = NULL; 272 273 client->info = g_malloc0(sizeof(*client->info)); 274 vnc_init_basic_info_from_remote_addr(client->sioc, 275 qapi_VncClientInfo_base(client->info), 276 &err); 277 if (err) { 278 qapi_free_VncClientInfo(client->info); 279 client->info = NULL; 280 error_free(err); 281 } 282 } 283 284 static void vnc_qmp_event(VncState *vs, QAPIEvent event) 285 { 286 VncServerInfo *si; 287 288 if (!vs->info) { 289 return; 290 } 291 292 si = vnc_server_info_get(vs->vd); 293 if (!si) { 294 return; 295 } 296 297 switch (event) { 298 case QAPI_EVENT_VNC_CONNECTED: 299 qapi_event_send_vnc_connected(si, qapi_VncClientInfo_base(vs->info), 300 &error_abort); 301 break; 302 case QAPI_EVENT_VNC_INITIALIZED: 303 qapi_event_send_vnc_initialized(si, vs->info, &error_abort); 304 break; 305 case QAPI_EVENT_VNC_DISCONNECTED: 306 qapi_event_send_vnc_disconnected(si, vs->info, &error_abort); 307 break; 308 default: 309 break; 310 } 311 312 qapi_free_VncServerInfo(si); 313 } 314 315 static VncClientInfo *qmp_query_vnc_client(const VncState *client) 316 { 317 VncClientInfo *info; 318 Error *err = NULL; 319 320 info = g_malloc0(sizeof(*info)); 321 322 vnc_init_basic_info_from_remote_addr(client->sioc, 323 qapi_VncClientInfo_base(info), 324 &err); 325 if (err) { 326 error_free(err); 327 qapi_free_VncClientInfo(info); 328 return NULL; 329 } 330 331 info->websocket = client->websocket; 332 333 if (client->tls) { 334 info->x509_dname = qcrypto_tls_session_get_peer_name(client->tls); 335 info->has_x509_dname = info->x509_dname != NULL; 336 } 337 #ifdef CONFIG_VNC_SASL 338 if (client->sasl.conn && client->sasl.username) { 339 info->has_sasl_username = true; 340 info->sasl_username = g_strdup(client->sasl.username); 341 } 342 #endif 343 344 return info; 345 } 346 347 static VncDisplay *vnc_display_find(const char *id) 348 { 349 VncDisplay *vd; 350 351 if (id == NULL) { 352 return QTAILQ_FIRST(&vnc_displays); 353 } 354 QTAILQ_FOREACH(vd, &vnc_displays, next) { 355 if (strcmp(id, vd->id) == 0) { 356 return vd; 357 } 358 } 359 return NULL; 360 } 361 362 static VncClientInfoList *qmp_query_client_list(VncDisplay *vd) 363 { 364 VncClientInfoList *cinfo, *prev = NULL; 365 VncState *client; 366 367 QTAILQ_FOREACH(client, &vd->clients, next) { 368 cinfo = g_new0(VncClientInfoList, 1); 369 cinfo->value = qmp_query_vnc_client(client); 370 cinfo->next = prev; 371 prev = cinfo; 372 } 373 return prev; 374 } 375 376 VncInfo *qmp_query_vnc(Error **errp) 377 { 378 VncInfo *info = g_malloc0(sizeof(*info)); 379 VncDisplay *vd = vnc_display_find(NULL); 380 SocketAddress *addr = NULL; 381 382 if (vd == NULL || !vd->listener || !vd->listener->nsioc) { 383 info->enabled = false; 384 } else { 385 info->enabled = true; 386 387 /* for compatibility with the original command */ 388 info->has_clients = true; 389 info->clients = qmp_query_client_list(vd); 390 391 addr = qio_channel_socket_get_local_address(vd->listener->sioc[0], 392 errp); 393 if (!addr) { 394 goto out_error; 395 } 396 397 switch (addr->type) { 398 case SOCKET_ADDRESS_TYPE_INET: 399 info->host = g_strdup(addr->u.inet.host); 400 info->service = g_strdup(addr->u.inet.port); 401 if (addr->u.inet.ipv6) { 402 info->family = NETWORK_ADDRESS_FAMILY_IPV6; 403 } else { 404 info->family = NETWORK_ADDRESS_FAMILY_IPV4; 405 } 406 break; 407 408 case SOCKET_ADDRESS_TYPE_UNIX: 409 info->host = g_strdup(""); 410 info->service = g_strdup(addr->u.q_unix.path); 411 info->family = NETWORK_ADDRESS_FAMILY_UNIX; 412 break; 413 414 case SOCKET_ADDRESS_TYPE_VSOCK: 415 case SOCKET_ADDRESS_TYPE_FD: 416 error_setg(errp, "Unsupported socket address type %s", 417 SocketAddressType_str(addr->type)); 418 goto out_error; 419 default: 420 abort(); 421 } 422 423 info->has_host = true; 424 info->has_service = true; 425 info->has_family = true; 426 427 info->has_auth = true; 428 info->auth = g_strdup(vnc_auth_name(vd)); 429 } 430 431 qapi_free_SocketAddress(addr); 432 return info; 433 434 out_error: 435 qapi_free_SocketAddress(addr); 436 qapi_free_VncInfo(info); 437 return NULL; 438 } 439 440 441 static void qmp_query_auth(int auth, int subauth, 442 VncPrimaryAuth *qmp_auth, 443 VncVencryptSubAuth *qmp_vencrypt, 444 bool *qmp_has_vencrypt); 445 446 static VncServerInfo2List *qmp_query_server_entry(QIOChannelSocket *ioc, 447 bool websocket, 448 int auth, 449 int subauth, 450 VncServerInfo2List *prev) 451 { 452 VncServerInfo2List *list; 453 VncServerInfo2 *info; 454 Error *err = NULL; 455 SocketAddress *addr; 456 457 addr = qio_channel_socket_get_local_address(ioc, &err); 458 if (!addr) { 459 error_free(err); 460 return prev; 461 } 462 463 info = g_new0(VncServerInfo2, 1); 464 vnc_init_basic_info(addr, qapi_VncServerInfo2_base(info), &err); 465 qapi_free_SocketAddress(addr); 466 if (err) { 467 qapi_free_VncServerInfo2(info); 468 error_free(err); 469 return prev; 470 } 471 info->websocket = websocket; 472 473 qmp_query_auth(auth, subauth, &info->auth, 474 &info->vencrypt, &info->has_vencrypt); 475 476 list = g_new0(VncServerInfo2List, 1); 477 list->value = info; 478 list->next = prev; 479 return list; 480 } 481 482 static void qmp_query_auth(int auth, int subauth, 483 VncPrimaryAuth *qmp_auth, 484 VncVencryptSubAuth *qmp_vencrypt, 485 bool *qmp_has_vencrypt) 486 { 487 switch (auth) { 488 case VNC_AUTH_VNC: 489 *qmp_auth = VNC_PRIMARY_AUTH_VNC; 490 break; 491 case VNC_AUTH_RA2: 492 *qmp_auth = VNC_PRIMARY_AUTH_RA2; 493 break; 494 case VNC_AUTH_RA2NE: 495 *qmp_auth = VNC_PRIMARY_AUTH_RA2NE; 496 break; 497 case VNC_AUTH_TIGHT: 498 *qmp_auth = VNC_PRIMARY_AUTH_TIGHT; 499 break; 500 case VNC_AUTH_ULTRA: 501 *qmp_auth = VNC_PRIMARY_AUTH_ULTRA; 502 break; 503 case VNC_AUTH_TLS: 504 *qmp_auth = VNC_PRIMARY_AUTH_TLS; 505 break; 506 case VNC_AUTH_VENCRYPT: 507 *qmp_auth = VNC_PRIMARY_AUTH_VENCRYPT; 508 *qmp_has_vencrypt = true; 509 switch (subauth) { 510 case VNC_AUTH_VENCRYPT_PLAIN: 511 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_PLAIN; 512 break; 513 case VNC_AUTH_VENCRYPT_TLSNONE: 514 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_NONE; 515 break; 516 case VNC_AUTH_VENCRYPT_TLSVNC: 517 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_VNC; 518 break; 519 case VNC_AUTH_VENCRYPT_TLSPLAIN: 520 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_PLAIN; 521 break; 522 case VNC_AUTH_VENCRYPT_X509NONE: 523 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_NONE; 524 break; 525 case VNC_AUTH_VENCRYPT_X509VNC: 526 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_VNC; 527 break; 528 case VNC_AUTH_VENCRYPT_X509PLAIN: 529 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_PLAIN; 530 break; 531 case VNC_AUTH_VENCRYPT_TLSSASL: 532 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_SASL; 533 break; 534 case VNC_AUTH_VENCRYPT_X509SASL: 535 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_SASL; 536 break; 537 default: 538 *qmp_has_vencrypt = false; 539 break; 540 } 541 break; 542 case VNC_AUTH_SASL: 543 *qmp_auth = VNC_PRIMARY_AUTH_SASL; 544 break; 545 case VNC_AUTH_NONE: 546 default: 547 *qmp_auth = VNC_PRIMARY_AUTH_NONE; 548 break; 549 } 550 } 551 552 VncInfo2List *qmp_query_vnc_servers(Error **errp) 553 { 554 VncInfo2List *item, *prev = NULL; 555 VncInfo2 *info; 556 VncDisplay *vd; 557 DeviceState *dev; 558 size_t i; 559 560 QTAILQ_FOREACH(vd, &vnc_displays, next) { 561 info = g_new0(VncInfo2, 1); 562 info->id = g_strdup(vd->id); 563 info->clients = qmp_query_client_list(vd); 564 qmp_query_auth(vd->auth, vd->subauth, &info->auth, 565 &info->vencrypt, &info->has_vencrypt); 566 if (vd->dcl.con) { 567 dev = DEVICE(object_property_get_link(OBJECT(vd->dcl.con), 568 "device", NULL)); 569 info->has_display = true; 570 info->display = g_strdup(dev->id); 571 } 572 for (i = 0; vd->listener != NULL && i < vd->listener->nsioc; i++) { 573 info->server = qmp_query_server_entry( 574 vd->listener->sioc[i], false, vd->auth, vd->subauth, 575 info->server); 576 } 577 for (i = 0; vd->wslistener != NULL && i < vd->wslistener->nsioc; i++) { 578 info->server = qmp_query_server_entry( 579 vd->wslistener->sioc[i], true, vd->ws_auth, 580 vd->ws_subauth, info->server); 581 } 582 583 item = g_new0(VncInfo2List, 1); 584 item->value = info; 585 item->next = prev; 586 prev = item; 587 } 588 return prev; 589 } 590 591 /* TODO 592 1) Get the queue working for IO. 593 2) there is some weirdness when using the -S option (the screen is grey 594 and not totally invalidated 595 3) resolutions > 1024 596 */ 597 598 static int vnc_update_client(VncState *vs, int has_dirty); 599 static void vnc_disconnect_start(VncState *vs); 600 601 static void vnc_colordepth(VncState *vs); 602 static void framebuffer_update_request(VncState *vs, int incremental, 603 int x_position, int y_position, 604 int w, int h); 605 static void vnc_refresh(DisplayChangeListener *dcl); 606 static int vnc_refresh_server_surface(VncDisplay *vd); 607 608 static int vnc_width(VncDisplay *vd) 609 { 610 return MIN(VNC_MAX_WIDTH, ROUND_UP(surface_width(vd->ds), 611 VNC_DIRTY_PIXELS_PER_BIT)); 612 } 613 614 static int vnc_height(VncDisplay *vd) 615 { 616 return MIN(VNC_MAX_HEIGHT, surface_height(vd->ds)); 617 } 618 619 static void vnc_set_area_dirty(DECLARE_BITMAP(dirty[VNC_MAX_HEIGHT], 620 VNC_MAX_WIDTH / VNC_DIRTY_PIXELS_PER_BIT), 621 VncDisplay *vd, 622 int x, int y, int w, int h) 623 { 624 int width = vnc_width(vd); 625 int height = vnc_height(vd); 626 627 /* this is needed this to ensure we updated all affected 628 * blocks if x % VNC_DIRTY_PIXELS_PER_BIT != 0 */ 629 w += (x % VNC_DIRTY_PIXELS_PER_BIT); 630 x -= (x % VNC_DIRTY_PIXELS_PER_BIT); 631 632 x = MIN(x, width); 633 y = MIN(y, height); 634 w = MIN(x + w, width) - x; 635 h = MIN(y + h, height); 636 637 for (; y < h; y++) { 638 bitmap_set(dirty[y], x / VNC_DIRTY_PIXELS_PER_BIT, 639 DIV_ROUND_UP(w, VNC_DIRTY_PIXELS_PER_BIT)); 640 } 641 } 642 643 static void vnc_dpy_update(DisplayChangeListener *dcl, 644 int x, int y, int w, int h) 645 { 646 VncDisplay *vd = container_of(dcl, VncDisplay, dcl); 647 struct VncSurface *s = &vd->guest; 648 649 vnc_set_area_dirty(s->dirty, vd, x, y, w, h); 650 } 651 652 void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h, 653 int32_t encoding) 654 { 655 vnc_write_u16(vs, x); 656 vnc_write_u16(vs, y); 657 vnc_write_u16(vs, w); 658 vnc_write_u16(vs, h); 659 660 vnc_write_s32(vs, encoding); 661 } 662 663 664 static void vnc_desktop_resize(VncState *vs) 665 { 666 if (vs->ioc == NULL || !vnc_has_feature(vs, VNC_FEATURE_RESIZE)) { 667 return; 668 } 669 if (vs->client_width == pixman_image_get_width(vs->vd->server) && 670 vs->client_height == pixman_image_get_height(vs->vd->server)) { 671 return; 672 } 673 674 assert(pixman_image_get_width(vs->vd->server) < 65536 && 675 pixman_image_get_width(vs->vd->server) >= 0); 676 assert(pixman_image_get_height(vs->vd->server) < 65536 && 677 pixman_image_get_height(vs->vd->server) >= 0); 678 vs->client_width = pixman_image_get_width(vs->vd->server); 679 vs->client_height = pixman_image_get_height(vs->vd->server); 680 vnc_lock_output(vs); 681 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 682 vnc_write_u8(vs, 0); 683 vnc_write_u16(vs, 1); /* number of rects */ 684 vnc_framebuffer_update(vs, 0, 0, vs->client_width, vs->client_height, 685 VNC_ENCODING_DESKTOPRESIZE); 686 vnc_unlock_output(vs); 687 vnc_flush(vs); 688 } 689 690 static void vnc_abort_display_jobs(VncDisplay *vd) 691 { 692 VncState *vs; 693 694 QTAILQ_FOREACH(vs, &vd->clients, next) { 695 vnc_lock_output(vs); 696 vs->abort = true; 697 vnc_unlock_output(vs); 698 } 699 QTAILQ_FOREACH(vs, &vd->clients, next) { 700 vnc_jobs_join(vs); 701 } 702 QTAILQ_FOREACH(vs, &vd->clients, next) { 703 vnc_lock_output(vs); 704 vs->abort = false; 705 vnc_unlock_output(vs); 706 } 707 } 708 709 int vnc_server_fb_stride(VncDisplay *vd) 710 { 711 return pixman_image_get_stride(vd->server); 712 } 713 714 void *vnc_server_fb_ptr(VncDisplay *vd, int x, int y) 715 { 716 uint8_t *ptr; 717 718 ptr = (uint8_t *)pixman_image_get_data(vd->server); 719 ptr += y * vnc_server_fb_stride(vd); 720 ptr += x * VNC_SERVER_FB_BYTES; 721 return ptr; 722 } 723 724 static void vnc_update_server_surface(VncDisplay *vd) 725 { 726 int width, height; 727 728 qemu_pixman_image_unref(vd->server); 729 vd->server = NULL; 730 731 if (QTAILQ_EMPTY(&vd->clients)) { 732 return; 733 } 734 735 width = vnc_width(vd); 736 height = vnc_height(vd); 737 vd->server = pixman_image_create_bits(VNC_SERVER_FB_FORMAT, 738 width, height, 739 NULL, 0); 740 741 memset(vd->guest.dirty, 0x00, sizeof(vd->guest.dirty)); 742 vnc_set_area_dirty(vd->guest.dirty, vd, 0, 0, 743 width, height); 744 } 745 746 static void vnc_dpy_switch(DisplayChangeListener *dcl, 747 DisplaySurface *surface) 748 { 749 VncDisplay *vd = container_of(dcl, VncDisplay, dcl); 750 VncState *vs; 751 752 vnc_abort_display_jobs(vd); 753 vd->ds = surface; 754 755 /* server surface */ 756 vnc_update_server_surface(vd); 757 758 /* guest surface */ 759 qemu_pixman_image_unref(vd->guest.fb); 760 vd->guest.fb = pixman_image_ref(surface->image); 761 vd->guest.format = surface->format; 762 763 QTAILQ_FOREACH(vs, &vd->clients, next) { 764 vnc_colordepth(vs); 765 vnc_desktop_resize(vs); 766 if (vs->vd->cursor) { 767 vnc_cursor_define(vs); 768 } 769 memset(vs->dirty, 0x00, sizeof(vs->dirty)); 770 vnc_set_area_dirty(vs->dirty, vd, 0, 0, 771 vnc_width(vd), 772 vnc_height(vd)); 773 vnc_update_throttle_offset(vs); 774 } 775 } 776 777 /* fastest code */ 778 static void vnc_write_pixels_copy(VncState *vs, 779 void *pixels, int size) 780 { 781 vnc_write(vs, pixels, size); 782 } 783 784 /* slowest but generic code. */ 785 void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v) 786 { 787 uint8_t r, g, b; 788 789 #if VNC_SERVER_FB_FORMAT == PIXMAN_FORMAT(32, PIXMAN_TYPE_ARGB, 0, 8, 8, 8) 790 r = (((v & 0x00ff0000) >> 16) << vs->client_pf.rbits) >> 8; 791 g = (((v & 0x0000ff00) >> 8) << vs->client_pf.gbits) >> 8; 792 b = (((v & 0x000000ff) >> 0) << vs->client_pf.bbits) >> 8; 793 #else 794 # error need some bits here if you change VNC_SERVER_FB_FORMAT 795 #endif 796 v = (r << vs->client_pf.rshift) | 797 (g << vs->client_pf.gshift) | 798 (b << vs->client_pf.bshift); 799 switch (vs->client_pf.bytes_per_pixel) { 800 case 1: 801 buf[0] = v; 802 break; 803 case 2: 804 if (vs->client_be) { 805 buf[0] = v >> 8; 806 buf[1] = v; 807 } else { 808 buf[1] = v >> 8; 809 buf[0] = v; 810 } 811 break; 812 default: 813 case 4: 814 if (vs->client_be) { 815 buf[0] = v >> 24; 816 buf[1] = v >> 16; 817 buf[2] = v >> 8; 818 buf[3] = v; 819 } else { 820 buf[3] = v >> 24; 821 buf[2] = v >> 16; 822 buf[1] = v >> 8; 823 buf[0] = v; 824 } 825 break; 826 } 827 } 828 829 static void vnc_write_pixels_generic(VncState *vs, 830 void *pixels1, int size) 831 { 832 uint8_t buf[4]; 833 834 if (VNC_SERVER_FB_BYTES == 4) { 835 uint32_t *pixels = pixels1; 836 int n, i; 837 n = size >> 2; 838 for (i = 0; i < n; i++) { 839 vnc_convert_pixel(vs, buf, pixels[i]); 840 vnc_write(vs, buf, vs->client_pf.bytes_per_pixel); 841 } 842 } 843 } 844 845 int vnc_raw_send_framebuffer_update(VncState *vs, int x, int y, int w, int h) 846 { 847 int i; 848 uint8_t *row; 849 VncDisplay *vd = vs->vd; 850 851 row = vnc_server_fb_ptr(vd, x, y); 852 for (i = 0; i < h; i++) { 853 vs->write_pixels(vs, row, w * VNC_SERVER_FB_BYTES); 854 row += vnc_server_fb_stride(vd); 855 } 856 return 1; 857 } 858 859 int vnc_send_framebuffer_update(VncState *vs, int x, int y, int w, int h) 860 { 861 int n = 0; 862 bool encode_raw = false; 863 size_t saved_offs = vs->output.offset; 864 865 switch(vs->vnc_encoding) { 866 case VNC_ENCODING_ZLIB: 867 n = vnc_zlib_send_framebuffer_update(vs, x, y, w, h); 868 break; 869 case VNC_ENCODING_HEXTILE: 870 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE); 871 n = vnc_hextile_send_framebuffer_update(vs, x, y, w, h); 872 break; 873 case VNC_ENCODING_TIGHT: 874 n = vnc_tight_send_framebuffer_update(vs, x, y, w, h); 875 break; 876 case VNC_ENCODING_TIGHT_PNG: 877 n = vnc_tight_png_send_framebuffer_update(vs, x, y, w, h); 878 break; 879 case VNC_ENCODING_ZRLE: 880 n = vnc_zrle_send_framebuffer_update(vs, x, y, w, h); 881 break; 882 case VNC_ENCODING_ZYWRLE: 883 n = vnc_zywrle_send_framebuffer_update(vs, x, y, w, h); 884 break; 885 default: 886 encode_raw = true; 887 break; 888 } 889 890 /* If the client has the same pixel format as our internal buffer and 891 * a RAW encoding would need less space fall back to RAW encoding to 892 * save bandwidth and processing power in the client. */ 893 if (!encode_raw && vs->write_pixels == vnc_write_pixels_copy && 894 12 + h * w * VNC_SERVER_FB_BYTES <= (vs->output.offset - saved_offs)) { 895 vs->output.offset = saved_offs; 896 encode_raw = true; 897 } 898 899 if (encode_raw) { 900 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW); 901 n = vnc_raw_send_framebuffer_update(vs, x, y, w, h); 902 } 903 904 return n; 905 } 906 907 static void vnc_mouse_set(DisplayChangeListener *dcl, 908 int x, int y, int visible) 909 { 910 /* can we ask the client(s) to move the pointer ??? */ 911 } 912 913 static int vnc_cursor_define(VncState *vs) 914 { 915 QEMUCursor *c = vs->vd->cursor; 916 int isize; 917 918 if (vnc_has_feature(vs, VNC_FEATURE_RICH_CURSOR)) { 919 vnc_lock_output(vs); 920 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 921 vnc_write_u8(vs, 0); /* padding */ 922 vnc_write_u16(vs, 1); /* # of rects */ 923 vnc_framebuffer_update(vs, c->hot_x, c->hot_y, c->width, c->height, 924 VNC_ENCODING_RICH_CURSOR); 925 isize = c->width * c->height * vs->client_pf.bytes_per_pixel; 926 vnc_write_pixels_generic(vs, c->data, isize); 927 vnc_write(vs, vs->vd->cursor_mask, vs->vd->cursor_msize); 928 vnc_unlock_output(vs); 929 return 0; 930 } 931 return -1; 932 } 933 934 static void vnc_dpy_cursor_define(DisplayChangeListener *dcl, 935 QEMUCursor *c) 936 { 937 VncDisplay *vd = container_of(dcl, VncDisplay, dcl); 938 VncState *vs; 939 940 cursor_put(vd->cursor); 941 g_free(vd->cursor_mask); 942 943 vd->cursor = c; 944 cursor_get(vd->cursor); 945 vd->cursor_msize = cursor_get_mono_bpl(c) * c->height; 946 vd->cursor_mask = g_malloc0(vd->cursor_msize); 947 cursor_get_mono_mask(c, 0, vd->cursor_mask); 948 949 QTAILQ_FOREACH(vs, &vd->clients, next) { 950 vnc_cursor_define(vs); 951 } 952 } 953 954 static int find_and_clear_dirty_height(VncState *vs, 955 int y, int last_x, int x, int height) 956 { 957 int h; 958 959 for (h = 1; h < (height - y); h++) { 960 if (!test_bit(last_x, vs->dirty[y + h])) { 961 break; 962 } 963 bitmap_clear(vs->dirty[y + h], last_x, x - last_x); 964 } 965 966 return h; 967 } 968 969 /* 970 * Figure out how much pending data we should allow in the output 971 * buffer before we throttle incremental display updates, and/or 972 * drop audio samples. 973 * 974 * We allow for equiv of 1 full display's worth of FB updates, 975 * and 1 second of audio samples. If audio backlog was larger 976 * than that the client would already suffering awful audio 977 * glitches, so dropping samples is no worse really). 978 */ 979 static void vnc_update_throttle_offset(VncState *vs) 980 { 981 size_t offset = 982 vs->client_width * vs->client_height * vs->client_pf.bytes_per_pixel; 983 984 if (vs->audio_cap) { 985 int bps; 986 switch (vs->as.fmt) { 987 default: 988 case AUD_FMT_U8: 989 case AUD_FMT_S8: 990 bps = 1; 991 break; 992 case AUD_FMT_U16: 993 case AUD_FMT_S16: 994 bps = 2; 995 break; 996 case AUD_FMT_U32: 997 case AUD_FMT_S32: 998 bps = 4; 999 break; 1000 } 1001 offset += vs->as.freq * bps * vs->as.nchannels; 1002 } 1003 1004 /* Put a floor of 1MB on offset, so that if we have a large pending 1005 * buffer and the display is resized to a small size & back again 1006 * we don't suddenly apply a tiny send limit 1007 */ 1008 offset = MAX(offset, 1024 * 1024); 1009 1010 if (vs->throttle_output_offset != offset) { 1011 trace_vnc_client_throttle_threshold( 1012 vs, vs->ioc, vs->throttle_output_offset, offset, vs->client_width, 1013 vs->client_height, vs->client_pf.bytes_per_pixel, vs->audio_cap); 1014 } 1015 1016 vs->throttle_output_offset = offset; 1017 } 1018 1019 static bool vnc_should_update(VncState *vs) 1020 { 1021 switch (vs->update) { 1022 case VNC_STATE_UPDATE_NONE: 1023 break; 1024 case VNC_STATE_UPDATE_INCREMENTAL: 1025 /* Only allow incremental updates if the pending send queue 1026 * is less than the permitted threshold, and the job worker 1027 * is completely idle. 1028 */ 1029 if (vs->output.offset < vs->throttle_output_offset && 1030 vs->job_update == VNC_STATE_UPDATE_NONE) { 1031 return true; 1032 } 1033 trace_vnc_client_throttle_incremental( 1034 vs, vs->ioc, vs->job_update, vs->output.offset); 1035 break; 1036 case VNC_STATE_UPDATE_FORCE: 1037 /* Only allow forced updates if the pending send queue 1038 * does not contain a previous forced update, and the 1039 * job worker is completely idle. 1040 * 1041 * Note this means we'll queue a forced update, even if 1042 * the output buffer size is otherwise over the throttle 1043 * output limit. 1044 */ 1045 if (vs->force_update_offset == 0 && 1046 vs->job_update == VNC_STATE_UPDATE_NONE) { 1047 return true; 1048 } 1049 trace_vnc_client_throttle_forced( 1050 vs, vs->ioc, vs->job_update, vs->force_update_offset); 1051 break; 1052 } 1053 return false; 1054 } 1055 1056 static int vnc_update_client(VncState *vs, int has_dirty) 1057 { 1058 VncDisplay *vd = vs->vd; 1059 VncJob *job; 1060 int y; 1061 int height, width; 1062 int n = 0; 1063 1064 if (vs->disconnecting) { 1065 vnc_disconnect_finish(vs); 1066 return 0; 1067 } 1068 1069 vs->has_dirty += has_dirty; 1070 if (!vnc_should_update(vs)) { 1071 return 0; 1072 } 1073 1074 if (!vs->has_dirty && vs->update != VNC_STATE_UPDATE_FORCE) { 1075 return 0; 1076 } 1077 1078 /* 1079 * Send screen updates to the vnc client using the server 1080 * surface and server dirty map. guest surface updates 1081 * happening in parallel don't disturb us, the next pass will 1082 * send them to the client. 1083 */ 1084 job = vnc_job_new(vs); 1085 1086 height = pixman_image_get_height(vd->server); 1087 width = pixman_image_get_width(vd->server); 1088 1089 y = 0; 1090 for (;;) { 1091 int x, h; 1092 unsigned long x2; 1093 unsigned long offset = find_next_bit((unsigned long *) &vs->dirty, 1094 height * VNC_DIRTY_BPL(vs), 1095 y * VNC_DIRTY_BPL(vs)); 1096 if (offset == height * VNC_DIRTY_BPL(vs)) { 1097 /* no more dirty bits */ 1098 break; 1099 } 1100 y = offset / VNC_DIRTY_BPL(vs); 1101 x = offset % VNC_DIRTY_BPL(vs); 1102 x2 = find_next_zero_bit((unsigned long *) &vs->dirty[y], 1103 VNC_DIRTY_BPL(vs), x); 1104 bitmap_clear(vs->dirty[y], x, x2 - x); 1105 h = find_and_clear_dirty_height(vs, y, x, x2, height); 1106 x2 = MIN(x2, width / VNC_DIRTY_PIXELS_PER_BIT); 1107 if (x2 > x) { 1108 n += vnc_job_add_rect(job, x * VNC_DIRTY_PIXELS_PER_BIT, y, 1109 (x2 - x) * VNC_DIRTY_PIXELS_PER_BIT, h); 1110 } 1111 if (!x && x2 == width / VNC_DIRTY_PIXELS_PER_BIT) { 1112 y += h; 1113 if (y == height) { 1114 break; 1115 } 1116 } 1117 } 1118 1119 vs->job_update = vs->update; 1120 vs->update = VNC_STATE_UPDATE_NONE; 1121 vnc_job_push(job); 1122 vs->has_dirty = 0; 1123 return n; 1124 } 1125 1126 /* audio */ 1127 static void audio_capture_notify(void *opaque, audcnotification_e cmd) 1128 { 1129 VncState *vs = opaque; 1130 1131 switch (cmd) { 1132 case AUD_CNOTIFY_DISABLE: 1133 vnc_lock_output(vs); 1134 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU); 1135 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO); 1136 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_END); 1137 vnc_unlock_output(vs); 1138 vnc_flush(vs); 1139 break; 1140 1141 case AUD_CNOTIFY_ENABLE: 1142 vnc_lock_output(vs); 1143 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU); 1144 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO); 1145 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_BEGIN); 1146 vnc_unlock_output(vs); 1147 vnc_flush(vs); 1148 break; 1149 } 1150 } 1151 1152 static void audio_capture_destroy(void *opaque) 1153 { 1154 } 1155 1156 static void audio_capture(void *opaque, void *buf, int size) 1157 { 1158 VncState *vs = opaque; 1159 1160 vnc_lock_output(vs); 1161 if (vs->output.offset < vs->throttle_output_offset) { 1162 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU); 1163 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO); 1164 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_DATA); 1165 vnc_write_u32(vs, size); 1166 vnc_write(vs, buf, size); 1167 } else { 1168 trace_vnc_client_throttle_audio(vs, vs->ioc, vs->output.offset); 1169 } 1170 vnc_unlock_output(vs); 1171 vnc_flush(vs); 1172 } 1173 1174 static void audio_add(VncState *vs) 1175 { 1176 struct audio_capture_ops ops; 1177 1178 if (vs->audio_cap) { 1179 error_report("audio already running"); 1180 return; 1181 } 1182 1183 ops.notify = audio_capture_notify; 1184 ops.destroy = audio_capture_destroy; 1185 ops.capture = audio_capture; 1186 1187 vs->audio_cap = AUD_add_capture(&vs->as, &ops, vs); 1188 if (!vs->audio_cap) { 1189 error_report("Failed to add audio capture"); 1190 } 1191 } 1192 1193 static void audio_del(VncState *vs) 1194 { 1195 if (vs->audio_cap) { 1196 AUD_del_capture(vs->audio_cap, vs); 1197 vs->audio_cap = NULL; 1198 } 1199 } 1200 1201 static void vnc_disconnect_start(VncState *vs) 1202 { 1203 if (vs->disconnecting) { 1204 return; 1205 } 1206 trace_vnc_client_disconnect_start(vs, vs->ioc); 1207 vnc_set_share_mode(vs, VNC_SHARE_MODE_DISCONNECTED); 1208 if (vs->ioc_tag) { 1209 g_source_remove(vs->ioc_tag); 1210 vs->ioc_tag = 0; 1211 } 1212 qio_channel_close(vs->ioc, NULL); 1213 vs->disconnecting = TRUE; 1214 } 1215 1216 void vnc_disconnect_finish(VncState *vs) 1217 { 1218 int i; 1219 1220 trace_vnc_client_disconnect_finish(vs, vs->ioc); 1221 1222 vnc_jobs_join(vs); /* Wait encoding jobs */ 1223 1224 vnc_lock_output(vs); 1225 vnc_qmp_event(vs, QAPI_EVENT_VNC_DISCONNECTED); 1226 1227 buffer_free(&vs->input); 1228 buffer_free(&vs->output); 1229 1230 qapi_free_VncClientInfo(vs->info); 1231 1232 vnc_zlib_clear(vs); 1233 vnc_tight_clear(vs); 1234 vnc_zrle_clear(vs); 1235 1236 #ifdef CONFIG_VNC_SASL 1237 vnc_sasl_client_cleanup(vs); 1238 #endif /* CONFIG_VNC_SASL */ 1239 audio_del(vs); 1240 vnc_release_modifiers(vs); 1241 1242 if (vs->mouse_mode_notifier.notify != NULL) { 1243 qemu_remove_mouse_mode_change_notifier(&vs->mouse_mode_notifier); 1244 } 1245 QTAILQ_REMOVE(&vs->vd->clients, vs, next); 1246 if (QTAILQ_EMPTY(&vs->vd->clients)) { 1247 /* last client gone */ 1248 vnc_update_server_surface(vs->vd); 1249 } 1250 1251 vnc_unlock_output(vs); 1252 1253 qemu_mutex_destroy(&vs->output_mutex); 1254 if (vs->bh != NULL) { 1255 qemu_bh_delete(vs->bh); 1256 } 1257 buffer_free(&vs->jobs_buffer); 1258 1259 for (i = 0; i < VNC_STAT_ROWS; ++i) { 1260 g_free(vs->lossy_rect[i]); 1261 } 1262 g_free(vs->lossy_rect); 1263 1264 object_unref(OBJECT(vs->ioc)); 1265 vs->ioc = NULL; 1266 object_unref(OBJECT(vs->sioc)); 1267 vs->sioc = NULL; 1268 g_free(vs); 1269 } 1270 1271 size_t vnc_client_io_error(VncState *vs, ssize_t ret, Error **errp) 1272 { 1273 if (ret <= 0) { 1274 if (ret == 0) { 1275 trace_vnc_client_eof(vs, vs->ioc); 1276 vnc_disconnect_start(vs); 1277 } else if (ret != QIO_CHANNEL_ERR_BLOCK) { 1278 trace_vnc_client_io_error(vs, vs->ioc, 1279 errp ? error_get_pretty(*errp) : 1280 "Unknown"); 1281 vnc_disconnect_start(vs); 1282 } 1283 1284 if (errp) { 1285 error_free(*errp); 1286 *errp = NULL; 1287 } 1288 return 0; 1289 } 1290 return ret; 1291 } 1292 1293 1294 void vnc_client_error(VncState *vs) 1295 { 1296 VNC_DEBUG("Closing down client sock: protocol error\n"); 1297 vnc_disconnect_start(vs); 1298 } 1299 1300 1301 /* 1302 * Called to write a chunk of data to the client socket. The data may 1303 * be the raw data, or may have already been encoded by SASL. 1304 * The data will be written either straight onto the socket, or 1305 * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled 1306 * 1307 * NB, it is theoretically possible to have 2 layers of encryption, 1308 * both SASL, and this TLS layer. It is highly unlikely in practice 1309 * though, since SASL encryption will typically be a no-op if TLS 1310 * is active 1311 * 1312 * Returns the number of bytes written, which may be less than 1313 * the requested 'datalen' if the socket would block. Returns 1314 * 0 on I/O error, and disconnects the client socket. 1315 */ 1316 size_t vnc_client_write_buf(VncState *vs, const uint8_t *data, size_t datalen) 1317 { 1318 Error *err = NULL; 1319 ssize_t ret; 1320 ret = qio_channel_write( 1321 vs->ioc, (const char *)data, datalen, &err); 1322 VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data, datalen, ret); 1323 return vnc_client_io_error(vs, ret, &err); 1324 } 1325 1326 1327 /* 1328 * Called to write buffered data to the client socket, when not 1329 * using any SASL SSF encryption layers. Will write as much data 1330 * as possible without blocking. If all buffered data is written, 1331 * will switch the FD poll() handler back to read monitoring. 1332 * 1333 * Returns the number of bytes written, which may be less than 1334 * the buffered output data if the socket would block. Returns 1335 * 0 on I/O error, and disconnects the client socket. 1336 */ 1337 static size_t vnc_client_write_plain(VncState *vs) 1338 { 1339 size_t offset; 1340 size_t ret; 1341 1342 #ifdef CONFIG_VNC_SASL 1343 VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n", 1344 vs->output.buffer, vs->output.capacity, vs->output.offset, 1345 vs->sasl.waitWriteSSF); 1346 1347 if (vs->sasl.conn && 1348 vs->sasl.runSSF && 1349 vs->sasl.waitWriteSSF) { 1350 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF); 1351 if (ret) 1352 vs->sasl.waitWriteSSF -= ret; 1353 } else 1354 #endif /* CONFIG_VNC_SASL */ 1355 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset); 1356 if (!ret) 1357 return 0; 1358 1359 if (ret >= vs->force_update_offset) { 1360 if (vs->force_update_offset != 0) { 1361 trace_vnc_client_unthrottle_forced(vs, vs->ioc); 1362 } 1363 vs->force_update_offset = 0; 1364 } else { 1365 vs->force_update_offset -= ret; 1366 } 1367 offset = vs->output.offset; 1368 buffer_advance(&vs->output, ret); 1369 if (offset >= vs->throttle_output_offset && 1370 vs->output.offset < vs->throttle_output_offset) { 1371 trace_vnc_client_unthrottle_incremental(vs, vs->ioc, vs->output.offset); 1372 } 1373 1374 if (vs->output.offset == 0) { 1375 if (vs->ioc_tag) { 1376 g_source_remove(vs->ioc_tag); 1377 } 1378 vs->ioc_tag = qio_channel_add_watch( 1379 vs->ioc, G_IO_IN, vnc_client_io, vs, NULL); 1380 } 1381 1382 return ret; 1383 } 1384 1385 1386 /* 1387 * First function called whenever there is data to be written to 1388 * the client socket. Will delegate actual work according to whether 1389 * SASL SSF layers are enabled (thus requiring encryption calls) 1390 */ 1391 static void vnc_client_write_locked(VncState *vs) 1392 { 1393 #ifdef CONFIG_VNC_SASL 1394 if (vs->sasl.conn && 1395 vs->sasl.runSSF && 1396 !vs->sasl.waitWriteSSF) { 1397 vnc_client_write_sasl(vs); 1398 } else 1399 #endif /* CONFIG_VNC_SASL */ 1400 { 1401 vnc_client_write_plain(vs); 1402 } 1403 } 1404 1405 static void vnc_client_write(VncState *vs) 1406 { 1407 1408 vnc_lock_output(vs); 1409 if (vs->output.offset) { 1410 vnc_client_write_locked(vs); 1411 } else if (vs->ioc != NULL) { 1412 if (vs->ioc_tag) { 1413 g_source_remove(vs->ioc_tag); 1414 } 1415 vs->ioc_tag = qio_channel_add_watch( 1416 vs->ioc, G_IO_IN, vnc_client_io, vs, NULL); 1417 } 1418 vnc_unlock_output(vs); 1419 } 1420 1421 void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting) 1422 { 1423 vs->read_handler = func; 1424 vs->read_handler_expect = expecting; 1425 } 1426 1427 1428 /* 1429 * Called to read a chunk of data from the client socket. The data may 1430 * be the raw data, or may need to be further decoded by SASL. 1431 * The data will be read either straight from to the socket, or 1432 * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled 1433 * 1434 * NB, it is theoretically possible to have 2 layers of encryption, 1435 * both SASL, and this TLS layer. It is highly unlikely in practice 1436 * though, since SASL encryption will typically be a no-op if TLS 1437 * is active 1438 * 1439 * Returns the number of bytes read, which may be less than 1440 * the requested 'datalen' if the socket would block. Returns 1441 * 0 on I/O error or EOF, and disconnects the client socket. 1442 */ 1443 size_t vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen) 1444 { 1445 ssize_t ret; 1446 Error *err = NULL; 1447 ret = qio_channel_read( 1448 vs->ioc, (char *)data, datalen, &err); 1449 VNC_DEBUG("Read wire %p %zd -> %ld\n", data, datalen, ret); 1450 return vnc_client_io_error(vs, ret, &err); 1451 } 1452 1453 1454 /* 1455 * Called to read data from the client socket to the input buffer, 1456 * when not using any SASL SSF encryption layers. Will read as much 1457 * data as possible without blocking. 1458 * 1459 * Returns the number of bytes read, which may be less than 1460 * the requested 'datalen' if the socket would block. Returns 1461 * 0 on I/O error or EOF, and disconnects the client socket. 1462 */ 1463 static size_t vnc_client_read_plain(VncState *vs) 1464 { 1465 size_t ret; 1466 VNC_DEBUG("Read plain %p size %zd offset %zd\n", 1467 vs->input.buffer, vs->input.capacity, vs->input.offset); 1468 buffer_reserve(&vs->input, 4096); 1469 ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096); 1470 if (!ret) 1471 return 0; 1472 vs->input.offset += ret; 1473 return ret; 1474 } 1475 1476 static void vnc_jobs_bh(void *opaque) 1477 { 1478 VncState *vs = opaque; 1479 1480 vnc_jobs_consume_buffer(vs); 1481 } 1482 1483 /* 1484 * First function called whenever there is more data to be read from 1485 * the client socket. Will delegate actual work according to whether 1486 * SASL SSF layers are enabled (thus requiring decryption calls) 1487 * Returns 0 on success, -1 if client disconnected 1488 */ 1489 static int vnc_client_read(VncState *vs) 1490 { 1491 size_t ret; 1492 1493 #ifdef CONFIG_VNC_SASL 1494 if (vs->sasl.conn && vs->sasl.runSSF) 1495 ret = vnc_client_read_sasl(vs); 1496 else 1497 #endif /* CONFIG_VNC_SASL */ 1498 ret = vnc_client_read_plain(vs); 1499 if (!ret) { 1500 if (vs->disconnecting) { 1501 vnc_disconnect_finish(vs); 1502 return -1; 1503 } 1504 return 0; 1505 } 1506 1507 while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) { 1508 size_t len = vs->read_handler_expect; 1509 int ret; 1510 1511 ret = vs->read_handler(vs, vs->input.buffer, len); 1512 if (vs->disconnecting) { 1513 vnc_disconnect_finish(vs); 1514 return -1; 1515 } 1516 1517 if (!ret) { 1518 buffer_advance(&vs->input, len); 1519 } else { 1520 vs->read_handler_expect = ret; 1521 } 1522 } 1523 return 0; 1524 } 1525 1526 gboolean vnc_client_io(QIOChannel *ioc G_GNUC_UNUSED, 1527 GIOCondition condition, void *opaque) 1528 { 1529 VncState *vs = opaque; 1530 if (condition & G_IO_IN) { 1531 if (vnc_client_read(vs) < 0) { 1532 goto end; 1533 } 1534 } 1535 if (condition & G_IO_OUT) { 1536 vnc_client_write(vs); 1537 } 1538 end: 1539 if (vs->disconnecting) { 1540 if (vs->ioc_tag != 0) { 1541 g_source_remove(vs->ioc_tag); 1542 } 1543 vs->ioc_tag = 0; 1544 } 1545 return TRUE; 1546 } 1547 1548 1549 /* 1550 * Scale factor to apply to vs->throttle_output_offset when checking for 1551 * hard limit. Worst case normal usage could be x2, if we have a complete 1552 * incremental update and complete forced update in the output buffer. 1553 * So x3 should be good enough, but we pick x5 to be conservative and thus 1554 * (hopefully) never trigger incorrectly. 1555 */ 1556 #define VNC_THROTTLE_OUTPUT_LIMIT_SCALE 5 1557 1558 void vnc_write(VncState *vs, const void *data, size_t len) 1559 { 1560 if (vs->disconnecting) { 1561 return; 1562 } 1563 /* Protection against malicious client/guest to prevent our output 1564 * buffer growing without bound if client stops reading data. This 1565 * should rarely trigger, because we have earlier throttling code 1566 * which stops issuing framebuffer updates and drops audio data 1567 * if the throttle_output_offset value is exceeded. So we only reach 1568 * this higher level if a huge number of pseudo-encodings get 1569 * triggered while data can't be sent on the socket. 1570 * 1571 * NB throttle_output_offset can be zero during early protocol 1572 * handshake, or from the job thread's VncState clone 1573 */ 1574 if (vs->throttle_output_offset != 0 && 1575 (vs->output.offset / VNC_THROTTLE_OUTPUT_LIMIT_SCALE) > 1576 vs->throttle_output_offset) { 1577 trace_vnc_client_output_limit(vs, vs->ioc, vs->output.offset, 1578 vs->throttle_output_offset); 1579 vnc_disconnect_start(vs); 1580 return; 1581 } 1582 buffer_reserve(&vs->output, len); 1583 1584 if (vs->ioc != NULL && buffer_empty(&vs->output)) { 1585 if (vs->ioc_tag) { 1586 g_source_remove(vs->ioc_tag); 1587 } 1588 vs->ioc_tag = qio_channel_add_watch( 1589 vs->ioc, G_IO_IN | G_IO_OUT, vnc_client_io, vs, NULL); 1590 } 1591 1592 buffer_append(&vs->output, data, len); 1593 } 1594 1595 void vnc_write_s32(VncState *vs, int32_t value) 1596 { 1597 vnc_write_u32(vs, *(uint32_t *)&value); 1598 } 1599 1600 void vnc_write_u32(VncState *vs, uint32_t value) 1601 { 1602 uint8_t buf[4]; 1603 1604 buf[0] = (value >> 24) & 0xFF; 1605 buf[1] = (value >> 16) & 0xFF; 1606 buf[2] = (value >> 8) & 0xFF; 1607 buf[3] = value & 0xFF; 1608 1609 vnc_write(vs, buf, 4); 1610 } 1611 1612 void vnc_write_u16(VncState *vs, uint16_t value) 1613 { 1614 uint8_t buf[2]; 1615 1616 buf[0] = (value >> 8) & 0xFF; 1617 buf[1] = value & 0xFF; 1618 1619 vnc_write(vs, buf, 2); 1620 } 1621 1622 void vnc_write_u8(VncState *vs, uint8_t value) 1623 { 1624 vnc_write(vs, (char *)&value, 1); 1625 } 1626 1627 void vnc_flush(VncState *vs) 1628 { 1629 vnc_lock_output(vs); 1630 if (vs->ioc != NULL && vs->output.offset) { 1631 vnc_client_write_locked(vs); 1632 } 1633 if (vs->disconnecting) { 1634 if (vs->ioc_tag != 0) { 1635 g_source_remove(vs->ioc_tag); 1636 } 1637 vs->ioc_tag = 0; 1638 } 1639 vnc_unlock_output(vs); 1640 } 1641 1642 static uint8_t read_u8(uint8_t *data, size_t offset) 1643 { 1644 return data[offset]; 1645 } 1646 1647 static uint16_t read_u16(uint8_t *data, size_t offset) 1648 { 1649 return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF); 1650 } 1651 1652 static int32_t read_s32(uint8_t *data, size_t offset) 1653 { 1654 return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) | 1655 (data[offset + 2] << 8) | data[offset + 3]); 1656 } 1657 1658 uint32_t read_u32(uint8_t *data, size_t offset) 1659 { 1660 return ((data[offset] << 24) | (data[offset + 1] << 16) | 1661 (data[offset + 2] << 8) | data[offset + 3]); 1662 } 1663 1664 static void client_cut_text(VncState *vs, size_t len, uint8_t *text) 1665 { 1666 } 1667 1668 static void check_pointer_type_change(Notifier *notifier, void *data) 1669 { 1670 VncState *vs = container_of(notifier, VncState, mouse_mode_notifier); 1671 int absolute = qemu_input_is_absolute(); 1672 1673 if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) { 1674 vnc_lock_output(vs); 1675 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 1676 vnc_write_u8(vs, 0); 1677 vnc_write_u16(vs, 1); 1678 vnc_framebuffer_update(vs, absolute, 0, 1679 pixman_image_get_width(vs->vd->server), 1680 pixman_image_get_height(vs->vd->server), 1681 VNC_ENCODING_POINTER_TYPE_CHANGE); 1682 vnc_unlock_output(vs); 1683 vnc_flush(vs); 1684 } 1685 vs->absolute = absolute; 1686 } 1687 1688 static void pointer_event(VncState *vs, int button_mask, int x, int y) 1689 { 1690 static uint32_t bmap[INPUT_BUTTON__MAX] = { 1691 [INPUT_BUTTON_LEFT] = 0x01, 1692 [INPUT_BUTTON_MIDDLE] = 0x02, 1693 [INPUT_BUTTON_RIGHT] = 0x04, 1694 [INPUT_BUTTON_WHEEL_UP] = 0x08, 1695 [INPUT_BUTTON_WHEEL_DOWN] = 0x10, 1696 }; 1697 QemuConsole *con = vs->vd->dcl.con; 1698 int width = pixman_image_get_width(vs->vd->server); 1699 int height = pixman_image_get_height(vs->vd->server); 1700 1701 if (vs->last_bmask != button_mask) { 1702 qemu_input_update_buttons(con, bmap, vs->last_bmask, button_mask); 1703 vs->last_bmask = button_mask; 1704 } 1705 1706 if (vs->absolute) { 1707 qemu_input_queue_abs(con, INPUT_AXIS_X, x, 0, width); 1708 qemu_input_queue_abs(con, INPUT_AXIS_Y, y, 0, height); 1709 } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) { 1710 qemu_input_queue_rel(con, INPUT_AXIS_X, x - 0x7FFF); 1711 qemu_input_queue_rel(con, INPUT_AXIS_Y, y - 0x7FFF); 1712 } else { 1713 if (vs->last_x != -1) { 1714 qemu_input_queue_rel(con, INPUT_AXIS_X, x - vs->last_x); 1715 qemu_input_queue_rel(con, INPUT_AXIS_Y, y - vs->last_y); 1716 } 1717 vs->last_x = x; 1718 vs->last_y = y; 1719 } 1720 qemu_input_event_sync(); 1721 } 1722 1723 static void reset_keys(VncState *vs) 1724 { 1725 int i; 1726 for(i = 0; i < 256; i++) { 1727 if (vs->modifiers_state[i]) { 1728 qemu_input_event_send_key_number(vs->vd->dcl.con, i, false); 1729 qemu_input_event_send_key_delay(vs->vd->key_delay_ms); 1730 vs->modifiers_state[i] = 0; 1731 } 1732 } 1733 } 1734 1735 static void press_key(VncState *vs, int keysym) 1736 { 1737 int keycode = keysym2scancode(vs->vd->kbd_layout, keysym) & SCANCODE_KEYMASK; 1738 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, true); 1739 qemu_input_event_send_key_delay(vs->vd->key_delay_ms); 1740 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, false); 1741 qemu_input_event_send_key_delay(vs->vd->key_delay_ms); 1742 } 1743 1744 static void vnc_led_state_change(VncState *vs) 1745 { 1746 if (!vnc_has_feature(vs, VNC_FEATURE_LED_STATE)) { 1747 return; 1748 } 1749 1750 vnc_lock_output(vs); 1751 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 1752 vnc_write_u8(vs, 0); 1753 vnc_write_u16(vs, 1); 1754 vnc_framebuffer_update(vs, 0, 0, 1, 1, VNC_ENCODING_LED_STATE); 1755 vnc_write_u8(vs, vs->vd->ledstate); 1756 vnc_unlock_output(vs); 1757 vnc_flush(vs); 1758 } 1759 1760 static void kbd_leds(void *opaque, int ledstate) 1761 { 1762 VncDisplay *vd = opaque; 1763 VncState *client; 1764 1765 trace_vnc_key_guest_leds((ledstate & QEMU_CAPS_LOCK_LED), 1766 (ledstate & QEMU_NUM_LOCK_LED), 1767 (ledstate & QEMU_SCROLL_LOCK_LED)); 1768 1769 if (ledstate == vd->ledstate) { 1770 return; 1771 } 1772 1773 vd->ledstate = ledstate; 1774 1775 QTAILQ_FOREACH(client, &vd->clients, next) { 1776 vnc_led_state_change(client); 1777 } 1778 } 1779 1780 static void do_key_event(VncState *vs, int down, int keycode, int sym) 1781 { 1782 /* QEMU console switch */ 1783 switch(keycode) { 1784 case 0x2a: /* Left Shift */ 1785 case 0x36: /* Right Shift */ 1786 case 0x1d: /* Left CTRL */ 1787 case 0x9d: /* Right CTRL */ 1788 case 0x38: /* Left ALT */ 1789 case 0xb8: /* Right ALT */ 1790 if (down) 1791 vs->modifiers_state[keycode] = 1; 1792 else 1793 vs->modifiers_state[keycode] = 0; 1794 break; 1795 case 0x02 ... 0x0a: /* '1' to '9' keys */ 1796 if (vs->vd->dcl.con == NULL && 1797 down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) { 1798 /* Reset the modifiers sent to the current console */ 1799 reset_keys(vs); 1800 console_select(keycode - 0x02); 1801 return; 1802 } 1803 break; 1804 case 0x3a: /* CapsLock */ 1805 case 0x45: /* NumLock */ 1806 if (down) 1807 vs->modifiers_state[keycode] ^= 1; 1808 break; 1809 } 1810 1811 /* Turn off the lock state sync logic if the client support the led 1812 state extension. 1813 */ 1814 if (down && vs->vd->lock_key_sync && 1815 !vnc_has_feature(vs, VNC_FEATURE_LED_STATE) && 1816 keycode_is_keypad(vs->vd->kbd_layout, keycode)) { 1817 /* If the numlock state needs to change then simulate an additional 1818 keypress before sending this one. This will happen if the user 1819 toggles numlock away from the VNC window. 1820 */ 1821 if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) { 1822 if (!vs->modifiers_state[0x45]) { 1823 trace_vnc_key_sync_numlock(true); 1824 vs->modifiers_state[0x45] = 1; 1825 press_key(vs, 0xff7f); 1826 } 1827 } else { 1828 if (vs->modifiers_state[0x45]) { 1829 trace_vnc_key_sync_numlock(false); 1830 vs->modifiers_state[0x45] = 0; 1831 press_key(vs, 0xff7f); 1832 } 1833 } 1834 } 1835 1836 if (down && vs->vd->lock_key_sync && 1837 !vnc_has_feature(vs, VNC_FEATURE_LED_STATE) && 1838 ((sym >= 'A' && sym <= 'Z') || (sym >= 'a' && sym <= 'z'))) { 1839 /* If the capslock state needs to change then simulate an additional 1840 keypress before sending this one. This will happen if the user 1841 toggles capslock away from the VNC window. 1842 */ 1843 int uppercase = !!(sym >= 'A' && sym <= 'Z'); 1844 int shift = !!(vs->modifiers_state[0x2a] | vs->modifiers_state[0x36]); 1845 int capslock = !!(vs->modifiers_state[0x3a]); 1846 if (capslock) { 1847 if (uppercase == shift) { 1848 trace_vnc_key_sync_capslock(false); 1849 vs->modifiers_state[0x3a] = 0; 1850 press_key(vs, 0xffe5); 1851 } 1852 } else { 1853 if (uppercase != shift) { 1854 trace_vnc_key_sync_capslock(true); 1855 vs->modifiers_state[0x3a] = 1; 1856 press_key(vs, 0xffe5); 1857 } 1858 } 1859 } 1860 1861 if (qemu_console_is_graphic(NULL)) { 1862 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, down); 1863 qemu_input_event_send_key_delay(vs->vd->key_delay_ms); 1864 } else { 1865 bool numlock = vs->modifiers_state[0x45]; 1866 bool control = (vs->modifiers_state[0x1d] || 1867 vs->modifiers_state[0x9d]); 1868 /* QEMU console emulation */ 1869 if (down) { 1870 switch (keycode) { 1871 case 0x2a: /* Left Shift */ 1872 case 0x36: /* Right Shift */ 1873 case 0x1d: /* Left CTRL */ 1874 case 0x9d: /* Right CTRL */ 1875 case 0x38: /* Left ALT */ 1876 case 0xb8: /* Right ALT */ 1877 break; 1878 case 0xc8: 1879 kbd_put_keysym(QEMU_KEY_UP); 1880 break; 1881 case 0xd0: 1882 kbd_put_keysym(QEMU_KEY_DOWN); 1883 break; 1884 case 0xcb: 1885 kbd_put_keysym(QEMU_KEY_LEFT); 1886 break; 1887 case 0xcd: 1888 kbd_put_keysym(QEMU_KEY_RIGHT); 1889 break; 1890 case 0xd3: 1891 kbd_put_keysym(QEMU_KEY_DELETE); 1892 break; 1893 case 0xc7: 1894 kbd_put_keysym(QEMU_KEY_HOME); 1895 break; 1896 case 0xcf: 1897 kbd_put_keysym(QEMU_KEY_END); 1898 break; 1899 case 0xc9: 1900 kbd_put_keysym(QEMU_KEY_PAGEUP); 1901 break; 1902 case 0xd1: 1903 kbd_put_keysym(QEMU_KEY_PAGEDOWN); 1904 break; 1905 1906 case 0x47: 1907 kbd_put_keysym(numlock ? '7' : QEMU_KEY_HOME); 1908 break; 1909 case 0x48: 1910 kbd_put_keysym(numlock ? '8' : QEMU_KEY_UP); 1911 break; 1912 case 0x49: 1913 kbd_put_keysym(numlock ? '9' : QEMU_KEY_PAGEUP); 1914 break; 1915 case 0x4b: 1916 kbd_put_keysym(numlock ? '4' : QEMU_KEY_LEFT); 1917 break; 1918 case 0x4c: 1919 kbd_put_keysym('5'); 1920 break; 1921 case 0x4d: 1922 kbd_put_keysym(numlock ? '6' : QEMU_KEY_RIGHT); 1923 break; 1924 case 0x4f: 1925 kbd_put_keysym(numlock ? '1' : QEMU_KEY_END); 1926 break; 1927 case 0x50: 1928 kbd_put_keysym(numlock ? '2' : QEMU_KEY_DOWN); 1929 break; 1930 case 0x51: 1931 kbd_put_keysym(numlock ? '3' : QEMU_KEY_PAGEDOWN); 1932 break; 1933 case 0x52: 1934 kbd_put_keysym('0'); 1935 break; 1936 case 0x53: 1937 kbd_put_keysym(numlock ? '.' : QEMU_KEY_DELETE); 1938 break; 1939 1940 case 0xb5: 1941 kbd_put_keysym('/'); 1942 break; 1943 case 0x37: 1944 kbd_put_keysym('*'); 1945 break; 1946 case 0x4a: 1947 kbd_put_keysym('-'); 1948 break; 1949 case 0x4e: 1950 kbd_put_keysym('+'); 1951 break; 1952 case 0x9c: 1953 kbd_put_keysym('\n'); 1954 break; 1955 1956 default: 1957 if (control) { 1958 kbd_put_keysym(sym & 0x1f); 1959 } else { 1960 kbd_put_keysym(sym); 1961 } 1962 break; 1963 } 1964 } 1965 } 1966 } 1967 1968 static void vnc_release_modifiers(VncState *vs) 1969 { 1970 static const int keycodes[] = { 1971 /* shift, control, alt keys, both left & right */ 1972 0x2a, 0x36, 0x1d, 0x9d, 0x38, 0xb8, 1973 }; 1974 int i, keycode; 1975 1976 if (!qemu_console_is_graphic(NULL)) { 1977 return; 1978 } 1979 for (i = 0; i < ARRAY_SIZE(keycodes); i++) { 1980 keycode = keycodes[i]; 1981 if (!vs->modifiers_state[keycode]) { 1982 continue; 1983 } 1984 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, false); 1985 qemu_input_event_send_key_delay(vs->vd->key_delay_ms); 1986 } 1987 } 1988 1989 static const char *code2name(int keycode) 1990 { 1991 return QKeyCode_str(qemu_input_key_number_to_qcode(keycode)); 1992 } 1993 1994 static void key_event(VncState *vs, int down, uint32_t sym) 1995 { 1996 int keycode; 1997 int lsym = sym; 1998 1999 if (lsym >= 'A' && lsym <= 'Z' && qemu_console_is_graphic(NULL)) { 2000 lsym = lsym - 'A' + 'a'; 2001 } 2002 2003 keycode = keysym2scancode(vs->vd->kbd_layout, lsym & 0xFFFF) & SCANCODE_KEYMASK; 2004 trace_vnc_key_event_map(down, sym, keycode, code2name(keycode)); 2005 do_key_event(vs, down, keycode, sym); 2006 } 2007 2008 static void ext_key_event(VncState *vs, int down, 2009 uint32_t sym, uint16_t keycode) 2010 { 2011 /* if the user specifies a keyboard layout, always use it */ 2012 if (keyboard_layout) { 2013 key_event(vs, down, sym); 2014 } else { 2015 trace_vnc_key_event_ext(down, sym, keycode, code2name(keycode)); 2016 do_key_event(vs, down, keycode, sym); 2017 } 2018 } 2019 2020 static void framebuffer_update_request(VncState *vs, int incremental, 2021 int x, int y, int w, int h) 2022 { 2023 if (incremental) { 2024 if (vs->update != VNC_STATE_UPDATE_FORCE) { 2025 vs->update = VNC_STATE_UPDATE_INCREMENTAL; 2026 } 2027 } else { 2028 vs->update = VNC_STATE_UPDATE_FORCE; 2029 vnc_set_area_dirty(vs->dirty, vs->vd, x, y, w, h); 2030 } 2031 } 2032 2033 static void send_ext_key_event_ack(VncState *vs) 2034 { 2035 vnc_lock_output(vs); 2036 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 2037 vnc_write_u8(vs, 0); 2038 vnc_write_u16(vs, 1); 2039 vnc_framebuffer_update(vs, 0, 0, 2040 pixman_image_get_width(vs->vd->server), 2041 pixman_image_get_height(vs->vd->server), 2042 VNC_ENCODING_EXT_KEY_EVENT); 2043 vnc_unlock_output(vs); 2044 vnc_flush(vs); 2045 } 2046 2047 static void send_ext_audio_ack(VncState *vs) 2048 { 2049 vnc_lock_output(vs); 2050 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 2051 vnc_write_u8(vs, 0); 2052 vnc_write_u16(vs, 1); 2053 vnc_framebuffer_update(vs, 0, 0, 2054 pixman_image_get_width(vs->vd->server), 2055 pixman_image_get_height(vs->vd->server), 2056 VNC_ENCODING_AUDIO); 2057 vnc_unlock_output(vs); 2058 vnc_flush(vs); 2059 } 2060 2061 static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings) 2062 { 2063 int i; 2064 unsigned int enc = 0; 2065 2066 vs->features = 0; 2067 vs->vnc_encoding = 0; 2068 vs->tight.compression = 9; 2069 vs->tight.quality = -1; /* Lossless by default */ 2070 vs->absolute = -1; 2071 2072 /* 2073 * Start from the end because the encodings are sent in order of preference. 2074 * This way the preferred encoding (first encoding defined in the array) 2075 * will be set at the end of the loop. 2076 */ 2077 for (i = n_encodings - 1; i >= 0; i--) { 2078 enc = encodings[i]; 2079 switch (enc) { 2080 case VNC_ENCODING_RAW: 2081 vs->vnc_encoding = enc; 2082 break; 2083 case VNC_ENCODING_COPYRECT: 2084 vs->features |= VNC_FEATURE_COPYRECT_MASK; 2085 break; 2086 case VNC_ENCODING_HEXTILE: 2087 vs->features |= VNC_FEATURE_HEXTILE_MASK; 2088 vs->vnc_encoding = enc; 2089 break; 2090 case VNC_ENCODING_TIGHT: 2091 vs->features |= VNC_FEATURE_TIGHT_MASK; 2092 vs->vnc_encoding = enc; 2093 break; 2094 #ifdef CONFIG_VNC_PNG 2095 case VNC_ENCODING_TIGHT_PNG: 2096 vs->features |= VNC_FEATURE_TIGHT_PNG_MASK; 2097 vs->vnc_encoding = enc; 2098 break; 2099 #endif 2100 case VNC_ENCODING_ZLIB: 2101 vs->features |= VNC_FEATURE_ZLIB_MASK; 2102 vs->vnc_encoding = enc; 2103 break; 2104 case VNC_ENCODING_ZRLE: 2105 vs->features |= VNC_FEATURE_ZRLE_MASK; 2106 vs->vnc_encoding = enc; 2107 break; 2108 case VNC_ENCODING_ZYWRLE: 2109 vs->features |= VNC_FEATURE_ZYWRLE_MASK; 2110 vs->vnc_encoding = enc; 2111 break; 2112 case VNC_ENCODING_DESKTOPRESIZE: 2113 vs->features |= VNC_FEATURE_RESIZE_MASK; 2114 break; 2115 case VNC_ENCODING_POINTER_TYPE_CHANGE: 2116 vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK; 2117 break; 2118 case VNC_ENCODING_RICH_CURSOR: 2119 vs->features |= VNC_FEATURE_RICH_CURSOR_MASK; 2120 if (vs->vd->cursor) { 2121 vnc_cursor_define(vs); 2122 } 2123 break; 2124 case VNC_ENCODING_EXT_KEY_EVENT: 2125 send_ext_key_event_ack(vs); 2126 break; 2127 case VNC_ENCODING_AUDIO: 2128 send_ext_audio_ack(vs); 2129 break; 2130 case VNC_ENCODING_WMVi: 2131 vs->features |= VNC_FEATURE_WMVI_MASK; 2132 break; 2133 case VNC_ENCODING_LED_STATE: 2134 vs->features |= VNC_FEATURE_LED_STATE_MASK; 2135 break; 2136 case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9: 2137 vs->tight.compression = (enc & 0x0F); 2138 break; 2139 case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9: 2140 if (vs->vd->lossy) { 2141 vs->tight.quality = (enc & 0x0F); 2142 } 2143 break; 2144 default: 2145 VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc); 2146 break; 2147 } 2148 } 2149 vnc_desktop_resize(vs); 2150 check_pointer_type_change(&vs->mouse_mode_notifier, NULL); 2151 vnc_led_state_change(vs); 2152 } 2153 2154 static void set_pixel_conversion(VncState *vs) 2155 { 2156 pixman_format_code_t fmt = qemu_pixman_get_format(&vs->client_pf); 2157 2158 if (fmt == VNC_SERVER_FB_FORMAT) { 2159 vs->write_pixels = vnc_write_pixels_copy; 2160 vnc_hextile_set_pixel_conversion(vs, 0); 2161 } else { 2162 vs->write_pixels = vnc_write_pixels_generic; 2163 vnc_hextile_set_pixel_conversion(vs, 1); 2164 } 2165 } 2166 2167 static void send_color_map(VncState *vs) 2168 { 2169 int i; 2170 2171 vnc_write_u8(vs, VNC_MSG_SERVER_SET_COLOUR_MAP_ENTRIES); 2172 vnc_write_u8(vs, 0); /* padding */ 2173 vnc_write_u16(vs, 0); /* first color */ 2174 vnc_write_u16(vs, 256); /* # of colors */ 2175 2176 for (i = 0; i < 256; i++) { 2177 PixelFormat *pf = &vs->client_pf; 2178 2179 vnc_write_u16(vs, (((i >> pf->rshift) & pf->rmax) << (16 - pf->rbits))); 2180 vnc_write_u16(vs, (((i >> pf->gshift) & pf->gmax) << (16 - pf->gbits))); 2181 vnc_write_u16(vs, (((i >> pf->bshift) & pf->bmax) << (16 - pf->bbits))); 2182 } 2183 } 2184 2185 static void set_pixel_format(VncState *vs, int bits_per_pixel, 2186 int big_endian_flag, int true_color_flag, 2187 int red_max, int green_max, int blue_max, 2188 int red_shift, int green_shift, int blue_shift) 2189 { 2190 if (!true_color_flag) { 2191 /* Expose a reasonable default 256 color map */ 2192 bits_per_pixel = 8; 2193 red_max = 7; 2194 green_max = 7; 2195 blue_max = 3; 2196 red_shift = 0; 2197 green_shift = 3; 2198 blue_shift = 6; 2199 } 2200 2201 switch (bits_per_pixel) { 2202 case 8: 2203 case 16: 2204 case 32: 2205 break; 2206 default: 2207 vnc_client_error(vs); 2208 return; 2209 } 2210 2211 vs->client_pf.rmax = red_max ? red_max : 0xFF; 2212 vs->client_pf.rbits = ctpopl(red_max); 2213 vs->client_pf.rshift = red_shift; 2214 vs->client_pf.rmask = red_max << red_shift; 2215 vs->client_pf.gmax = green_max ? green_max : 0xFF; 2216 vs->client_pf.gbits = ctpopl(green_max); 2217 vs->client_pf.gshift = green_shift; 2218 vs->client_pf.gmask = green_max << green_shift; 2219 vs->client_pf.bmax = blue_max ? blue_max : 0xFF; 2220 vs->client_pf.bbits = ctpopl(blue_max); 2221 vs->client_pf.bshift = blue_shift; 2222 vs->client_pf.bmask = blue_max << blue_shift; 2223 vs->client_pf.bits_per_pixel = bits_per_pixel; 2224 vs->client_pf.bytes_per_pixel = bits_per_pixel / 8; 2225 vs->client_pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel; 2226 vs->client_be = big_endian_flag; 2227 2228 if (!true_color_flag) { 2229 send_color_map(vs); 2230 } 2231 2232 set_pixel_conversion(vs); 2233 2234 graphic_hw_invalidate(vs->vd->dcl.con); 2235 graphic_hw_update(vs->vd->dcl.con); 2236 } 2237 2238 static void pixel_format_message (VncState *vs) { 2239 char pad[3] = { 0, 0, 0 }; 2240 2241 vs->client_pf = qemu_default_pixelformat(32); 2242 2243 vnc_write_u8(vs, vs->client_pf.bits_per_pixel); /* bits-per-pixel */ 2244 vnc_write_u8(vs, vs->client_pf.depth); /* depth */ 2245 2246 #ifdef HOST_WORDS_BIGENDIAN 2247 vnc_write_u8(vs, 1); /* big-endian-flag */ 2248 #else 2249 vnc_write_u8(vs, 0); /* big-endian-flag */ 2250 #endif 2251 vnc_write_u8(vs, 1); /* true-color-flag */ 2252 vnc_write_u16(vs, vs->client_pf.rmax); /* red-max */ 2253 vnc_write_u16(vs, vs->client_pf.gmax); /* green-max */ 2254 vnc_write_u16(vs, vs->client_pf.bmax); /* blue-max */ 2255 vnc_write_u8(vs, vs->client_pf.rshift); /* red-shift */ 2256 vnc_write_u8(vs, vs->client_pf.gshift); /* green-shift */ 2257 vnc_write_u8(vs, vs->client_pf.bshift); /* blue-shift */ 2258 vnc_write(vs, pad, 3); /* padding */ 2259 2260 vnc_hextile_set_pixel_conversion(vs, 0); 2261 vs->write_pixels = vnc_write_pixels_copy; 2262 } 2263 2264 static void vnc_colordepth(VncState *vs) 2265 { 2266 if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) { 2267 /* Sending a WMVi message to notify the client*/ 2268 vnc_lock_output(vs); 2269 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 2270 vnc_write_u8(vs, 0); 2271 vnc_write_u16(vs, 1); /* number of rects */ 2272 vnc_framebuffer_update(vs, 0, 0, 2273 pixman_image_get_width(vs->vd->server), 2274 pixman_image_get_height(vs->vd->server), 2275 VNC_ENCODING_WMVi); 2276 pixel_format_message(vs); 2277 vnc_unlock_output(vs); 2278 vnc_flush(vs); 2279 } else { 2280 set_pixel_conversion(vs); 2281 } 2282 } 2283 2284 static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len) 2285 { 2286 int i; 2287 uint16_t limit; 2288 uint32_t freq; 2289 VncDisplay *vd = vs->vd; 2290 2291 if (data[0] > 3) { 2292 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE); 2293 } 2294 2295 switch (data[0]) { 2296 case VNC_MSG_CLIENT_SET_PIXEL_FORMAT: 2297 if (len == 1) 2298 return 20; 2299 2300 set_pixel_format(vs, read_u8(data, 4), 2301 read_u8(data, 6), read_u8(data, 7), 2302 read_u16(data, 8), read_u16(data, 10), 2303 read_u16(data, 12), read_u8(data, 14), 2304 read_u8(data, 15), read_u8(data, 16)); 2305 break; 2306 case VNC_MSG_CLIENT_SET_ENCODINGS: 2307 if (len == 1) 2308 return 4; 2309 2310 if (len == 4) { 2311 limit = read_u16(data, 2); 2312 if (limit > 0) 2313 return 4 + (limit * 4); 2314 } else 2315 limit = read_u16(data, 2); 2316 2317 for (i = 0; i < limit; i++) { 2318 int32_t val = read_s32(data, 4 + (i * 4)); 2319 memcpy(data + 4 + (i * 4), &val, sizeof(val)); 2320 } 2321 2322 set_encodings(vs, (int32_t *)(data + 4), limit); 2323 break; 2324 case VNC_MSG_CLIENT_FRAMEBUFFER_UPDATE_REQUEST: 2325 if (len == 1) 2326 return 10; 2327 2328 framebuffer_update_request(vs, 2329 read_u8(data, 1), read_u16(data, 2), read_u16(data, 4), 2330 read_u16(data, 6), read_u16(data, 8)); 2331 break; 2332 case VNC_MSG_CLIENT_KEY_EVENT: 2333 if (len == 1) 2334 return 8; 2335 2336 key_event(vs, read_u8(data, 1), read_u32(data, 4)); 2337 break; 2338 case VNC_MSG_CLIENT_POINTER_EVENT: 2339 if (len == 1) 2340 return 6; 2341 2342 pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4)); 2343 break; 2344 case VNC_MSG_CLIENT_CUT_TEXT: 2345 if (len == 1) { 2346 return 8; 2347 } 2348 if (len == 8) { 2349 uint32_t dlen = read_u32(data, 4); 2350 if (dlen > (1 << 20)) { 2351 error_report("vnc: client_cut_text msg payload has %u bytes" 2352 " which exceeds our limit of 1MB.", dlen); 2353 vnc_client_error(vs); 2354 break; 2355 } 2356 if (dlen > 0) { 2357 return 8 + dlen; 2358 } 2359 } 2360 2361 client_cut_text(vs, read_u32(data, 4), data + 8); 2362 break; 2363 case VNC_MSG_CLIENT_QEMU: 2364 if (len == 1) 2365 return 2; 2366 2367 switch (read_u8(data, 1)) { 2368 case VNC_MSG_CLIENT_QEMU_EXT_KEY_EVENT: 2369 if (len == 2) 2370 return 12; 2371 2372 ext_key_event(vs, read_u16(data, 2), 2373 read_u32(data, 4), read_u32(data, 8)); 2374 break; 2375 case VNC_MSG_CLIENT_QEMU_AUDIO: 2376 if (len == 2) 2377 return 4; 2378 2379 switch (read_u16 (data, 2)) { 2380 case VNC_MSG_CLIENT_QEMU_AUDIO_ENABLE: 2381 audio_add(vs); 2382 break; 2383 case VNC_MSG_CLIENT_QEMU_AUDIO_DISABLE: 2384 audio_del(vs); 2385 break; 2386 case VNC_MSG_CLIENT_QEMU_AUDIO_SET_FORMAT: 2387 if (len == 4) 2388 return 10; 2389 switch (read_u8(data, 4)) { 2390 case 0: vs->as.fmt = AUD_FMT_U8; break; 2391 case 1: vs->as.fmt = AUD_FMT_S8; break; 2392 case 2: vs->as.fmt = AUD_FMT_U16; break; 2393 case 3: vs->as.fmt = AUD_FMT_S16; break; 2394 case 4: vs->as.fmt = AUD_FMT_U32; break; 2395 case 5: vs->as.fmt = AUD_FMT_S32; break; 2396 default: 2397 VNC_DEBUG("Invalid audio format %d\n", read_u8(data, 4)); 2398 vnc_client_error(vs); 2399 break; 2400 } 2401 vs->as.nchannels = read_u8(data, 5); 2402 if (vs->as.nchannels != 1 && vs->as.nchannels != 2) { 2403 VNC_DEBUG("Invalid audio channel count %d\n", 2404 read_u8(data, 5)); 2405 vnc_client_error(vs); 2406 break; 2407 } 2408 freq = read_u32(data, 6); 2409 /* No official limit for protocol, but 48khz is a sensible 2410 * upper bound for trustworthy clients, and this limit 2411 * protects calculations involving 'vs->as.freq' later. 2412 */ 2413 if (freq > 48000) { 2414 VNC_DEBUG("Invalid audio frequency %u > 48000", freq); 2415 vnc_client_error(vs); 2416 break; 2417 } 2418 vs->as.freq = freq; 2419 break; 2420 default: 2421 VNC_DEBUG("Invalid audio message %d\n", read_u8(data, 4)); 2422 vnc_client_error(vs); 2423 break; 2424 } 2425 break; 2426 2427 default: 2428 VNC_DEBUG("Msg: %d\n", read_u16(data, 0)); 2429 vnc_client_error(vs); 2430 break; 2431 } 2432 break; 2433 default: 2434 VNC_DEBUG("Msg: %d\n", data[0]); 2435 vnc_client_error(vs); 2436 break; 2437 } 2438 2439 vnc_update_throttle_offset(vs); 2440 vnc_read_when(vs, protocol_client_msg, 1); 2441 return 0; 2442 } 2443 2444 static int protocol_client_init(VncState *vs, uint8_t *data, size_t len) 2445 { 2446 char buf[1024]; 2447 VncShareMode mode; 2448 int size; 2449 2450 mode = data[0] ? VNC_SHARE_MODE_SHARED : VNC_SHARE_MODE_EXCLUSIVE; 2451 switch (vs->vd->share_policy) { 2452 case VNC_SHARE_POLICY_IGNORE: 2453 /* 2454 * Ignore the shared flag. Nothing to do here. 2455 * 2456 * Doesn't conform to the rfb spec but is traditional qemu 2457 * behavior, thus left here as option for compatibility 2458 * reasons. 2459 */ 2460 break; 2461 case VNC_SHARE_POLICY_ALLOW_EXCLUSIVE: 2462 /* 2463 * Policy: Allow clients ask for exclusive access. 2464 * 2465 * Implementation: When a client asks for exclusive access, 2466 * disconnect all others. Shared connects are allowed as long 2467 * as no exclusive connection exists. 2468 * 2469 * This is how the rfb spec suggests to handle the shared flag. 2470 */ 2471 if (mode == VNC_SHARE_MODE_EXCLUSIVE) { 2472 VncState *client; 2473 QTAILQ_FOREACH(client, &vs->vd->clients, next) { 2474 if (vs == client) { 2475 continue; 2476 } 2477 if (client->share_mode != VNC_SHARE_MODE_EXCLUSIVE && 2478 client->share_mode != VNC_SHARE_MODE_SHARED) { 2479 continue; 2480 } 2481 vnc_disconnect_start(client); 2482 } 2483 } 2484 if (mode == VNC_SHARE_MODE_SHARED) { 2485 if (vs->vd->num_exclusive > 0) { 2486 vnc_disconnect_start(vs); 2487 return 0; 2488 } 2489 } 2490 break; 2491 case VNC_SHARE_POLICY_FORCE_SHARED: 2492 /* 2493 * Policy: Shared connects only. 2494 * Implementation: Disallow clients asking for exclusive access. 2495 * 2496 * Useful for shared desktop sessions where you don't want 2497 * someone forgetting to say -shared when running the vnc 2498 * client disconnect everybody else. 2499 */ 2500 if (mode == VNC_SHARE_MODE_EXCLUSIVE) { 2501 vnc_disconnect_start(vs); 2502 return 0; 2503 } 2504 break; 2505 } 2506 vnc_set_share_mode(vs, mode); 2507 2508 if (vs->vd->num_shared > vs->vd->connections_limit) { 2509 vnc_disconnect_start(vs); 2510 return 0; 2511 } 2512 2513 assert(pixman_image_get_width(vs->vd->server) < 65536 && 2514 pixman_image_get_width(vs->vd->server) >= 0); 2515 assert(pixman_image_get_height(vs->vd->server) < 65536 && 2516 pixman_image_get_height(vs->vd->server) >= 0); 2517 vs->client_width = pixman_image_get_width(vs->vd->server); 2518 vs->client_height = pixman_image_get_height(vs->vd->server); 2519 vnc_write_u16(vs, vs->client_width); 2520 vnc_write_u16(vs, vs->client_height); 2521 2522 pixel_format_message(vs); 2523 2524 if (qemu_name) { 2525 size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name); 2526 if (size > sizeof(buf)) { 2527 size = sizeof(buf); 2528 } 2529 } else { 2530 size = snprintf(buf, sizeof(buf), "QEMU"); 2531 } 2532 2533 vnc_write_u32(vs, size); 2534 vnc_write(vs, buf, size); 2535 vnc_flush(vs); 2536 2537 vnc_client_cache_auth(vs); 2538 vnc_qmp_event(vs, QAPI_EVENT_VNC_INITIALIZED); 2539 2540 vnc_read_when(vs, protocol_client_msg, 1); 2541 2542 return 0; 2543 } 2544 2545 void start_client_init(VncState *vs) 2546 { 2547 vnc_read_when(vs, protocol_client_init, 1); 2548 } 2549 2550 static void make_challenge(VncState *vs) 2551 { 2552 int i; 2553 2554 srand(time(NULL)+getpid()+getpid()*987654+rand()); 2555 2556 for (i = 0 ; i < sizeof(vs->challenge) ; i++) 2557 vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0)); 2558 } 2559 2560 static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len) 2561 { 2562 unsigned char response[VNC_AUTH_CHALLENGE_SIZE]; 2563 size_t i, pwlen; 2564 unsigned char key[8]; 2565 time_t now = time(NULL); 2566 QCryptoCipher *cipher = NULL; 2567 Error *err = NULL; 2568 2569 if (!vs->vd->password) { 2570 trace_vnc_auth_fail(vs, vs->auth, "password is not set", ""); 2571 goto reject; 2572 } 2573 if (vs->vd->expires < now) { 2574 trace_vnc_auth_fail(vs, vs->auth, "password is expired", ""); 2575 goto reject; 2576 } 2577 2578 memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE); 2579 2580 /* Calculate the expected challenge response */ 2581 pwlen = strlen(vs->vd->password); 2582 for (i=0; i<sizeof(key); i++) 2583 key[i] = i<pwlen ? vs->vd->password[i] : 0; 2584 2585 cipher = qcrypto_cipher_new( 2586 QCRYPTO_CIPHER_ALG_DES_RFB, 2587 QCRYPTO_CIPHER_MODE_ECB, 2588 key, G_N_ELEMENTS(key), 2589 &err); 2590 if (!cipher) { 2591 trace_vnc_auth_fail(vs, vs->auth, "cannot create cipher", 2592 error_get_pretty(err)); 2593 error_free(err); 2594 goto reject; 2595 } 2596 2597 if (qcrypto_cipher_encrypt(cipher, 2598 vs->challenge, 2599 response, 2600 VNC_AUTH_CHALLENGE_SIZE, 2601 &err) < 0) { 2602 trace_vnc_auth_fail(vs, vs->auth, "cannot encrypt challenge response", 2603 error_get_pretty(err)); 2604 error_free(err); 2605 goto reject; 2606 } 2607 2608 /* Compare expected vs actual challenge response */ 2609 if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) { 2610 trace_vnc_auth_fail(vs, vs->auth, "mis-matched challenge response", ""); 2611 goto reject; 2612 } else { 2613 trace_vnc_auth_pass(vs, vs->auth); 2614 vnc_write_u32(vs, 0); /* Accept auth */ 2615 vnc_flush(vs); 2616 2617 start_client_init(vs); 2618 } 2619 2620 qcrypto_cipher_free(cipher); 2621 return 0; 2622 2623 reject: 2624 vnc_write_u32(vs, 1); /* Reject auth */ 2625 if (vs->minor >= 8) { 2626 static const char err[] = "Authentication failed"; 2627 vnc_write_u32(vs, sizeof(err)); 2628 vnc_write(vs, err, sizeof(err)); 2629 } 2630 vnc_flush(vs); 2631 vnc_client_error(vs); 2632 qcrypto_cipher_free(cipher); 2633 return 0; 2634 } 2635 2636 void start_auth_vnc(VncState *vs) 2637 { 2638 make_challenge(vs); 2639 /* Send client a 'random' challenge */ 2640 vnc_write(vs, vs->challenge, sizeof(vs->challenge)); 2641 vnc_flush(vs); 2642 2643 vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge)); 2644 } 2645 2646 2647 static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len) 2648 { 2649 /* We only advertise 1 auth scheme at a time, so client 2650 * must pick the one we sent. Verify this */ 2651 if (data[0] != vs->auth) { /* Reject auth */ 2652 trace_vnc_auth_reject(vs, vs->auth, (int)data[0]); 2653 vnc_write_u32(vs, 1); 2654 if (vs->minor >= 8) { 2655 static const char err[] = "Authentication failed"; 2656 vnc_write_u32(vs, sizeof(err)); 2657 vnc_write(vs, err, sizeof(err)); 2658 } 2659 vnc_client_error(vs); 2660 } else { /* Accept requested auth */ 2661 trace_vnc_auth_start(vs, vs->auth); 2662 switch (vs->auth) { 2663 case VNC_AUTH_NONE: 2664 if (vs->minor >= 8) { 2665 vnc_write_u32(vs, 0); /* Accept auth completion */ 2666 vnc_flush(vs); 2667 } 2668 trace_vnc_auth_pass(vs, vs->auth); 2669 start_client_init(vs); 2670 break; 2671 2672 case VNC_AUTH_VNC: 2673 start_auth_vnc(vs); 2674 break; 2675 2676 case VNC_AUTH_VENCRYPT: 2677 start_auth_vencrypt(vs); 2678 break; 2679 2680 #ifdef CONFIG_VNC_SASL 2681 case VNC_AUTH_SASL: 2682 start_auth_sasl(vs); 2683 break; 2684 #endif /* CONFIG_VNC_SASL */ 2685 2686 default: /* Should not be possible, but just in case */ 2687 trace_vnc_auth_fail(vs, vs->auth, "Unhandled auth method", ""); 2688 vnc_write_u8(vs, 1); 2689 if (vs->minor >= 8) { 2690 static const char err[] = "Authentication failed"; 2691 vnc_write_u32(vs, sizeof(err)); 2692 vnc_write(vs, err, sizeof(err)); 2693 } 2694 vnc_client_error(vs); 2695 } 2696 } 2697 return 0; 2698 } 2699 2700 static int protocol_version(VncState *vs, uint8_t *version, size_t len) 2701 { 2702 char local[13]; 2703 2704 memcpy(local, version, 12); 2705 local[12] = 0; 2706 2707 if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) { 2708 VNC_DEBUG("Malformed protocol version %s\n", local); 2709 vnc_client_error(vs); 2710 return 0; 2711 } 2712 VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor); 2713 if (vs->major != 3 || 2714 (vs->minor != 3 && 2715 vs->minor != 4 && 2716 vs->minor != 5 && 2717 vs->minor != 7 && 2718 vs->minor != 8)) { 2719 VNC_DEBUG("Unsupported client version\n"); 2720 vnc_write_u32(vs, VNC_AUTH_INVALID); 2721 vnc_flush(vs); 2722 vnc_client_error(vs); 2723 return 0; 2724 } 2725 /* Some broken clients report v3.4 or v3.5, which spec requires to be treated 2726 * as equivalent to v3.3 by servers 2727 */ 2728 if (vs->minor == 4 || vs->minor == 5) 2729 vs->minor = 3; 2730 2731 if (vs->minor == 3) { 2732 trace_vnc_auth_start(vs, vs->auth); 2733 if (vs->auth == VNC_AUTH_NONE) { 2734 vnc_write_u32(vs, vs->auth); 2735 vnc_flush(vs); 2736 trace_vnc_auth_pass(vs, vs->auth); 2737 start_client_init(vs); 2738 } else if (vs->auth == VNC_AUTH_VNC) { 2739 VNC_DEBUG("Tell client VNC auth\n"); 2740 vnc_write_u32(vs, vs->auth); 2741 vnc_flush(vs); 2742 start_auth_vnc(vs); 2743 } else { 2744 trace_vnc_auth_fail(vs, vs->auth, 2745 "Unsupported auth method for v3.3", ""); 2746 vnc_write_u32(vs, VNC_AUTH_INVALID); 2747 vnc_flush(vs); 2748 vnc_client_error(vs); 2749 } 2750 } else { 2751 vnc_write_u8(vs, 1); /* num auth */ 2752 vnc_write_u8(vs, vs->auth); 2753 vnc_read_when(vs, protocol_client_auth, 1); 2754 vnc_flush(vs); 2755 } 2756 2757 return 0; 2758 } 2759 2760 static VncRectStat *vnc_stat_rect(VncDisplay *vd, int x, int y) 2761 { 2762 struct VncSurface *vs = &vd->guest; 2763 2764 return &vs->stats[y / VNC_STAT_RECT][x / VNC_STAT_RECT]; 2765 } 2766 2767 void vnc_sent_lossy_rect(VncState *vs, int x, int y, int w, int h) 2768 { 2769 int i, j; 2770 2771 w = (x + w) / VNC_STAT_RECT; 2772 h = (y + h) / VNC_STAT_RECT; 2773 x /= VNC_STAT_RECT; 2774 y /= VNC_STAT_RECT; 2775 2776 for (j = y; j <= h; j++) { 2777 for (i = x; i <= w; i++) { 2778 vs->lossy_rect[j][i] = 1; 2779 } 2780 } 2781 } 2782 2783 static int vnc_refresh_lossy_rect(VncDisplay *vd, int x, int y) 2784 { 2785 VncState *vs; 2786 int sty = y / VNC_STAT_RECT; 2787 int stx = x / VNC_STAT_RECT; 2788 int has_dirty = 0; 2789 2790 y = QEMU_ALIGN_DOWN(y, VNC_STAT_RECT); 2791 x = QEMU_ALIGN_DOWN(x, VNC_STAT_RECT); 2792 2793 QTAILQ_FOREACH(vs, &vd->clients, next) { 2794 int j; 2795 2796 /* kernel send buffers are full -> refresh later */ 2797 if (vs->output.offset) { 2798 continue; 2799 } 2800 2801 if (!vs->lossy_rect[sty][stx]) { 2802 continue; 2803 } 2804 2805 vs->lossy_rect[sty][stx] = 0; 2806 for (j = 0; j < VNC_STAT_RECT; ++j) { 2807 bitmap_set(vs->dirty[y + j], 2808 x / VNC_DIRTY_PIXELS_PER_BIT, 2809 VNC_STAT_RECT / VNC_DIRTY_PIXELS_PER_BIT); 2810 } 2811 has_dirty++; 2812 } 2813 2814 return has_dirty; 2815 } 2816 2817 static int vnc_update_stats(VncDisplay *vd, struct timeval * tv) 2818 { 2819 int width = MIN(pixman_image_get_width(vd->guest.fb), 2820 pixman_image_get_width(vd->server)); 2821 int height = MIN(pixman_image_get_height(vd->guest.fb), 2822 pixman_image_get_height(vd->server)); 2823 int x, y; 2824 struct timeval res; 2825 int has_dirty = 0; 2826 2827 for (y = 0; y < height; y += VNC_STAT_RECT) { 2828 for (x = 0; x < width; x += VNC_STAT_RECT) { 2829 VncRectStat *rect = vnc_stat_rect(vd, x, y); 2830 2831 rect->updated = false; 2832 } 2833 } 2834 2835 qemu_timersub(tv, &VNC_REFRESH_STATS, &res); 2836 2837 if (timercmp(&vd->guest.last_freq_check, &res, >)) { 2838 return has_dirty; 2839 } 2840 vd->guest.last_freq_check = *tv; 2841 2842 for (y = 0; y < height; y += VNC_STAT_RECT) { 2843 for (x = 0; x < width; x += VNC_STAT_RECT) { 2844 VncRectStat *rect= vnc_stat_rect(vd, x, y); 2845 int count = ARRAY_SIZE(rect->times); 2846 struct timeval min, max; 2847 2848 if (!timerisset(&rect->times[count - 1])) { 2849 continue ; 2850 } 2851 2852 max = rect->times[(rect->idx + count - 1) % count]; 2853 qemu_timersub(tv, &max, &res); 2854 2855 if (timercmp(&res, &VNC_REFRESH_LOSSY, >)) { 2856 rect->freq = 0; 2857 has_dirty += vnc_refresh_lossy_rect(vd, x, y); 2858 memset(rect->times, 0, sizeof (rect->times)); 2859 continue ; 2860 } 2861 2862 min = rect->times[rect->idx]; 2863 max = rect->times[(rect->idx + count - 1) % count]; 2864 qemu_timersub(&max, &min, &res); 2865 2866 rect->freq = res.tv_sec + res.tv_usec / 1000000.; 2867 rect->freq /= count; 2868 rect->freq = 1. / rect->freq; 2869 } 2870 } 2871 return has_dirty; 2872 } 2873 2874 double vnc_update_freq(VncState *vs, int x, int y, int w, int h) 2875 { 2876 int i, j; 2877 double total = 0; 2878 int num = 0; 2879 2880 x = QEMU_ALIGN_DOWN(x, VNC_STAT_RECT); 2881 y = QEMU_ALIGN_DOWN(y, VNC_STAT_RECT); 2882 2883 for (j = y; j <= y + h; j += VNC_STAT_RECT) { 2884 for (i = x; i <= x + w; i += VNC_STAT_RECT) { 2885 total += vnc_stat_rect(vs->vd, i, j)->freq; 2886 num++; 2887 } 2888 } 2889 2890 if (num) { 2891 return total / num; 2892 } else { 2893 return 0; 2894 } 2895 } 2896 2897 static void vnc_rect_updated(VncDisplay *vd, int x, int y, struct timeval * tv) 2898 { 2899 VncRectStat *rect; 2900 2901 rect = vnc_stat_rect(vd, x, y); 2902 if (rect->updated) { 2903 return ; 2904 } 2905 rect->times[rect->idx] = *tv; 2906 rect->idx = (rect->idx + 1) % ARRAY_SIZE(rect->times); 2907 rect->updated = true; 2908 } 2909 2910 static int vnc_refresh_server_surface(VncDisplay *vd) 2911 { 2912 int width = MIN(pixman_image_get_width(vd->guest.fb), 2913 pixman_image_get_width(vd->server)); 2914 int height = MIN(pixman_image_get_height(vd->guest.fb), 2915 pixman_image_get_height(vd->server)); 2916 int cmp_bytes, server_stride, line_bytes, guest_ll, guest_stride, y = 0; 2917 uint8_t *guest_row0 = NULL, *server_row0; 2918 VncState *vs; 2919 int has_dirty = 0; 2920 pixman_image_t *tmpbuf = NULL; 2921 2922 struct timeval tv = { 0, 0 }; 2923 2924 if (!vd->non_adaptive) { 2925 gettimeofday(&tv, NULL); 2926 has_dirty = vnc_update_stats(vd, &tv); 2927 } 2928 2929 /* 2930 * Walk through the guest dirty map. 2931 * Check and copy modified bits from guest to server surface. 2932 * Update server dirty map. 2933 */ 2934 server_row0 = (uint8_t *)pixman_image_get_data(vd->server); 2935 server_stride = guest_stride = guest_ll = 2936 pixman_image_get_stride(vd->server); 2937 cmp_bytes = MIN(VNC_DIRTY_PIXELS_PER_BIT * VNC_SERVER_FB_BYTES, 2938 server_stride); 2939 if (vd->guest.format != VNC_SERVER_FB_FORMAT) { 2940 int width = pixman_image_get_width(vd->server); 2941 tmpbuf = qemu_pixman_linebuf_create(VNC_SERVER_FB_FORMAT, width); 2942 } else { 2943 int guest_bpp = 2944 PIXMAN_FORMAT_BPP(pixman_image_get_format(vd->guest.fb)); 2945 guest_row0 = (uint8_t *)pixman_image_get_data(vd->guest.fb); 2946 guest_stride = pixman_image_get_stride(vd->guest.fb); 2947 guest_ll = pixman_image_get_width(vd->guest.fb) * (DIV_ROUND_UP(guest_bpp, 8)); 2948 } 2949 line_bytes = MIN(server_stride, guest_ll); 2950 2951 for (;;) { 2952 int x; 2953 uint8_t *guest_ptr, *server_ptr; 2954 unsigned long offset = find_next_bit((unsigned long *) &vd->guest.dirty, 2955 height * VNC_DIRTY_BPL(&vd->guest), 2956 y * VNC_DIRTY_BPL(&vd->guest)); 2957 if (offset == height * VNC_DIRTY_BPL(&vd->guest)) { 2958 /* no more dirty bits */ 2959 break; 2960 } 2961 y = offset / VNC_DIRTY_BPL(&vd->guest); 2962 x = offset % VNC_DIRTY_BPL(&vd->guest); 2963 2964 server_ptr = server_row0 + y * server_stride + x * cmp_bytes; 2965 2966 if (vd->guest.format != VNC_SERVER_FB_FORMAT) { 2967 qemu_pixman_linebuf_fill(tmpbuf, vd->guest.fb, width, 0, y); 2968 guest_ptr = (uint8_t *)pixman_image_get_data(tmpbuf); 2969 } else { 2970 guest_ptr = guest_row0 + y * guest_stride; 2971 } 2972 guest_ptr += x * cmp_bytes; 2973 2974 for (; x < DIV_ROUND_UP(width, VNC_DIRTY_PIXELS_PER_BIT); 2975 x++, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) { 2976 int _cmp_bytes = cmp_bytes; 2977 if (!test_and_clear_bit(x, vd->guest.dirty[y])) { 2978 continue; 2979 } 2980 if ((x + 1) * cmp_bytes > line_bytes) { 2981 _cmp_bytes = line_bytes - x * cmp_bytes; 2982 } 2983 assert(_cmp_bytes >= 0); 2984 if (memcmp(server_ptr, guest_ptr, _cmp_bytes) == 0) { 2985 continue; 2986 } 2987 memcpy(server_ptr, guest_ptr, _cmp_bytes); 2988 if (!vd->non_adaptive) { 2989 vnc_rect_updated(vd, x * VNC_DIRTY_PIXELS_PER_BIT, 2990 y, &tv); 2991 } 2992 QTAILQ_FOREACH(vs, &vd->clients, next) { 2993 set_bit(x, vs->dirty[y]); 2994 } 2995 has_dirty++; 2996 } 2997 2998 y++; 2999 } 3000 qemu_pixman_image_unref(tmpbuf); 3001 return has_dirty; 3002 } 3003 3004 static void vnc_refresh(DisplayChangeListener *dcl) 3005 { 3006 VncDisplay *vd = container_of(dcl, VncDisplay, dcl); 3007 VncState *vs, *vn; 3008 int has_dirty, rects = 0; 3009 3010 if (QTAILQ_EMPTY(&vd->clients)) { 3011 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_MAX); 3012 return; 3013 } 3014 3015 graphic_hw_update(vd->dcl.con); 3016 3017 if (vnc_trylock_display(vd)) { 3018 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE); 3019 return; 3020 } 3021 3022 has_dirty = vnc_refresh_server_surface(vd); 3023 vnc_unlock_display(vd); 3024 3025 QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) { 3026 rects += vnc_update_client(vs, has_dirty); 3027 /* vs might be free()ed here */ 3028 } 3029 3030 if (has_dirty && rects) { 3031 vd->dcl.update_interval /= 2; 3032 if (vd->dcl.update_interval < VNC_REFRESH_INTERVAL_BASE) { 3033 vd->dcl.update_interval = VNC_REFRESH_INTERVAL_BASE; 3034 } 3035 } else { 3036 vd->dcl.update_interval += VNC_REFRESH_INTERVAL_INC; 3037 if (vd->dcl.update_interval > VNC_REFRESH_INTERVAL_MAX) { 3038 vd->dcl.update_interval = VNC_REFRESH_INTERVAL_MAX; 3039 } 3040 } 3041 } 3042 3043 static void vnc_connect(VncDisplay *vd, QIOChannelSocket *sioc, 3044 bool skipauth, bool websocket) 3045 { 3046 VncState *vs = g_new0(VncState, 1); 3047 bool first_client = QTAILQ_EMPTY(&vd->clients); 3048 int i; 3049 3050 trace_vnc_client_connect(vs, sioc); 3051 vs->sioc = sioc; 3052 object_ref(OBJECT(vs->sioc)); 3053 vs->ioc = QIO_CHANNEL(sioc); 3054 object_ref(OBJECT(vs->ioc)); 3055 vs->vd = vd; 3056 3057 buffer_init(&vs->input, "vnc-input/%p", sioc); 3058 buffer_init(&vs->output, "vnc-output/%p", sioc); 3059 buffer_init(&vs->jobs_buffer, "vnc-jobs_buffer/%p", sioc); 3060 3061 buffer_init(&vs->tight.tight, "vnc-tight/%p", sioc); 3062 buffer_init(&vs->tight.zlib, "vnc-tight-zlib/%p", sioc); 3063 buffer_init(&vs->tight.gradient, "vnc-tight-gradient/%p", sioc); 3064 #ifdef CONFIG_VNC_JPEG 3065 buffer_init(&vs->tight.jpeg, "vnc-tight-jpeg/%p", sioc); 3066 #endif 3067 #ifdef CONFIG_VNC_PNG 3068 buffer_init(&vs->tight.png, "vnc-tight-png/%p", sioc); 3069 #endif 3070 buffer_init(&vs->zlib.zlib, "vnc-zlib/%p", sioc); 3071 buffer_init(&vs->zrle.zrle, "vnc-zrle/%p", sioc); 3072 buffer_init(&vs->zrle.fb, "vnc-zrle-fb/%p", sioc); 3073 buffer_init(&vs->zrle.zlib, "vnc-zrle-zlib/%p", sioc); 3074 3075 if (skipauth) { 3076 vs->auth = VNC_AUTH_NONE; 3077 vs->subauth = VNC_AUTH_INVALID; 3078 } else { 3079 if (websocket) { 3080 vs->auth = vd->ws_auth; 3081 vs->subauth = VNC_AUTH_INVALID; 3082 } else { 3083 vs->auth = vd->auth; 3084 vs->subauth = vd->subauth; 3085 } 3086 } 3087 VNC_DEBUG("Client sioc=%p ws=%d auth=%d subauth=%d\n", 3088 sioc, websocket, vs->auth, vs->subauth); 3089 3090 vs->lossy_rect = g_malloc0(VNC_STAT_ROWS * sizeof (*vs->lossy_rect)); 3091 for (i = 0; i < VNC_STAT_ROWS; ++i) { 3092 vs->lossy_rect[i] = g_new0(uint8_t, VNC_STAT_COLS); 3093 } 3094 3095 VNC_DEBUG("New client on socket %p\n", vs->sioc); 3096 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE); 3097 qio_channel_set_blocking(vs->ioc, false, NULL); 3098 if (vs->ioc_tag) { 3099 g_source_remove(vs->ioc_tag); 3100 } 3101 if (websocket) { 3102 vs->websocket = 1; 3103 if (vd->tlscreds) { 3104 vs->ioc_tag = qio_channel_add_watch( 3105 vs->ioc, G_IO_IN, vncws_tls_handshake_io, vs, NULL); 3106 } else { 3107 vs->ioc_tag = qio_channel_add_watch( 3108 vs->ioc, G_IO_IN, vncws_handshake_io, vs, NULL); 3109 } 3110 } else { 3111 vs->ioc_tag = qio_channel_add_watch( 3112 vs->ioc, G_IO_IN, vnc_client_io, vs, NULL); 3113 } 3114 3115 vnc_client_cache_addr(vs); 3116 vnc_qmp_event(vs, QAPI_EVENT_VNC_CONNECTED); 3117 vnc_set_share_mode(vs, VNC_SHARE_MODE_CONNECTING); 3118 3119 vs->last_x = -1; 3120 vs->last_y = -1; 3121 3122 vs->as.freq = 44100; 3123 vs->as.nchannels = 2; 3124 vs->as.fmt = AUD_FMT_S16; 3125 vs->as.endianness = 0; 3126 3127 qemu_mutex_init(&vs->output_mutex); 3128 vs->bh = qemu_bh_new(vnc_jobs_bh, vs); 3129 3130 QTAILQ_INSERT_TAIL(&vd->clients, vs, next); 3131 if (first_client) { 3132 vnc_update_server_surface(vd); 3133 } 3134 3135 graphic_hw_update(vd->dcl.con); 3136 3137 if (!vs->websocket) { 3138 vnc_start_protocol(vs); 3139 } 3140 3141 if (vd->num_connecting > vd->connections_limit) { 3142 QTAILQ_FOREACH(vs, &vd->clients, next) { 3143 if (vs->share_mode == VNC_SHARE_MODE_CONNECTING) { 3144 vnc_disconnect_start(vs); 3145 return; 3146 } 3147 } 3148 } 3149 } 3150 3151 void vnc_start_protocol(VncState *vs) 3152 { 3153 vnc_write(vs, "RFB 003.008\n", 12); 3154 vnc_flush(vs); 3155 vnc_read_when(vs, protocol_version, 12); 3156 3157 vs->mouse_mode_notifier.notify = check_pointer_type_change; 3158 qemu_add_mouse_mode_change_notifier(&vs->mouse_mode_notifier); 3159 } 3160 3161 static void vnc_listen_io(QIONetListener *listener, 3162 QIOChannelSocket *cioc, 3163 void *opaque) 3164 { 3165 VncDisplay *vd = opaque; 3166 bool isWebsock = listener == vd->wslistener; 3167 3168 qio_channel_set_name(QIO_CHANNEL(cioc), 3169 isWebsock ? "vnc-ws-server" : "vnc-server"); 3170 qio_channel_set_delay(QIO_CHANNEL(cioc), false); 3171 vnc_connect(vd, cioc, false, isWebsock); 3172 } 3173 3174 static const DisplayChangeListenerOps dcl_ops = { 3175 .dpy_name = "vnc", 3176 .dpy_refresh = vnc_refresh, 3177 .dpy_gfx_update = vnc_dpy_update, 3178 .dpy_gfx_switch = vnc_dpy_switch, 3179 .dpy_gfx_check_format = qemu_pixman_check_format, 3180 .dpy_mouse_set = vnc_mouse_set, 3181 .dpy_cursor_define = vnc_dpy_cursor_define, 3182 }; 3183 3184 void vnc_display_init(const char *id) 3185 { 3186 VncDisplay *vd; 3187 3188 if (vnc_display_find(id) != NULL) { 3189 return; 3190 } 3191 vd = g_malloc0(sizeof(*vd)); 3192 3193 vd->id = strdup(id); 3194 QTAILQ_INSERT_TAIL(&vnc_displays, vd, next); 3195 3196 QTAILQ_INIT(&vd->clients); 3197 vd->expires = TIME_MAX; 3198 3199 if (keyboard_layout) { 3200 trace_vnc_key_map_init(keyboard_layout); 3201 vd->kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout); 3202 } else { 3203 vd->kbd_layout = init_keyboard_layout(name2keysym, "en-us"); 3204 } 3205 3206 if (!vd->kbd_layout) { 3207 exit(1); 3208 } 3209 3210 vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE; 3211 vd->connections_limit = 32; 3212 3213 qemu_mutex_init(&vd->mutex); 3214 vnc_start_worker_thread(); 3215 3216 vd->dcl.ops = &dcl_ops; 3217 register_displaychangelistener(&vd->dcl); 3218 } 3219 3220 3221 static void vnc_display_close(VncDisplay *vd) 3222 { 3223 if (!vd) { 3224 return; 3225 } 3226 vd->is_unix = false; 3227 3228 if (vd->listener) { 3229 qio_net_listener_disconnect(vd->listener); 3230 object_unref(OBJECT(vd->listener)); 3231 } 3232 vd->listener = NULL; 3233 3234 if (vd->wslistener) { 3235 qio_net_listener_disconnect(vd->wslistener); 3236 object_unref(OBJECT(vd->wslistener)); 3237 } 3238 vd->wslistener = NULL; 3239 3240 vd->auth = VNC_AUTH_INVALID; 3241 vd->subauth = VNC_AUTH_INVALID; 3242 if (vd->tlscreds) { 3243 object_unparent(OBJECT(vd->tlscreds)); 3244 vd->tlscreds = NULL; 3245 } 3246 g_free(vd->tlsaclname); 3247 vd->tlsaclname = NULL; 3248 if (vd->lock_key_sync) { 3249 qemu_remove_led_event_handler(vd->led); 3250 vd->led = NULL; 3251 } 3252 } 3253 3254 int vnc_display_password(const char *id, const char *password) 3255 { 3256 VncDisplay *vd = vnc_display_find(id); 3257 3258 if (!vd) { 3259 return -EINVAL; 3260 } 3261 if (vd->auth == VNC_AUTH_NONE) { 3262 error_printf_unless_qmp("If you want use passwords please enable " 3263 "password auth using '-vnc ${dpy},password'.\n"); 3264 return -EINVAL; 3265 } 3266 3267 g_free(vd->password); 3268 vd->password = g_strdup(password); 3269 3270 return 0; 3271 } 3272 3273 int vnc_display_pw_expire(const char *id, time_t expires) 3274 { 3275 VncDisplay *vd = vnc_display_find(id); 3276 3277 if (!vd) { 3278 return -EINVAL; 3279 } 3280 3281 vd->expires = expires; 3282 return 0; 3283 } 3284 3285 static void vnc_display_print_local_addr(VncDisplay *vd) 3286 { 3287 SocketAddress *addr; 3288 Error *err = NULL; 3289 3290 if (!vd->listener || !vd->listener->nsioc) { 3291 return; 3292 } 3293 3294 addr = qio_channel_socket_get_local_address(vd->listener->sioc[0], &err); 3295 if (!addr) { 3296 return; 3297 } 3298 3299 if (addr->type != SOCKET_ADDRESS_TYPE_INET) { 3300 qapi_free_SocketAddress(addr); 3301 return; 3302 } 3303 error_printf_unless_qmp("VNC server running on %s:%s\n", 3304 addr->u.inet.host, 3305 addr->u.inet.port); 3306 qapi_free_SocketAddress(addr); 3307 } 3308 3309 static QemuOptsList qemu_vnc_opts = { 3310 .name = "vnc", 3311 .head = QTAILQ_HEAD_INITIALIZER(qemu_vnc_opts.head), 3312 .implied_opt_name = "vnc", 3313 .desc = { 3314 { 3315 .name = "vnc", 3316 .type = QEMU_OPT_STRING, 3317 },{ 3318 .name = "websocket", 3319 .type = QEMU_OPT_STRING, 3320 },{ 3321 .name = "tls-creds", 3322 .type = QEMU_OPT_STRING, 3323 },{ 3324 /* Deprecated in favour of tls-creds */ 3325 .name = "x509", 3326 .type = QEMU_OPT_STRING, 3327 },{ 3328 .name = "share", 3329 .type = QEMU_OPT_STRING, 3330 },{ 3331 .name = "display", 3332 .type = QEMU_OPT_STRING, 3333 },{ 3334 .name = "head", 3335 .type = QEMU_OPT_NUMBER, 3336 },{ 3337 .name = "connections", 3338 .type = QEMU_OPT_NUMBER, 3339 },{ 3340 .name = "to", 3341 .type = QEMU_OPT_NUMBER, 3342 },{ 3343 .name = "ipv4", 3344 .type = QEMU_OPT_BOOL, 3345 },{ 3346 .name = "ipv6", 3347 .type = QEMU_OPT_BOOL, 3348 },{ 3349 .name = "password", 3350 .type = QEMU_OPT_BOOL, 3351 },{ 3352 .name = "reverse", 3353 .type = QEMU_OPT_BOOL, 3354 },{ 3355 .name = "lock-key-sync", 3356 .type = QEMU_OPT_BOOL, 3357 },{ 3358 .name = "key-delay-ms", 3359 .type = QEMU_OPT_NUMBER, 3360 },{ 3361 .name = "sasl", 3362 .type = QEMU_OPT_BOOL, 3363 },{ 3364 /* Deprecated in favour of tls-creds */ 3365 .name = "tls", 3366 .type = QEMU_OPT_BOOL, 3367 },{ 3368 /* Deprecated in favour of tls-creds */ 3369 .name = "x509verify", 3370 .type = QEMU_OPT_STRING, 3371 },{ 3372 .name = "acl", 3373 .type = QEMU_OPT_BOOL, 3374 },{ 3375 .name = "lossy", 3376 .type = QEMU_OPT_BOOL, 3377 },{ 3378 .name = "non-adaptive", 3379 .type = QEMU_OPT_BOOL, 3380 }, 3381 { /* end of list */ } 3382 }, 3383 }; 3384 3385 3386 static int 3387 vnc_display_setup_auth(int *auth, 3388 int *subauth, 3389 QCryptoTLSCreds *tlscreds, 3390 bool password, 3391 bool sasl, 3392 bool websocket, 3393 Error **errp) 3394 { 3395 /* 3396 * We have a choice of 3 authentication options 3397 * 3398 * 1. none 3399 * 2. vnc 3400 * 3. sasl 3401 * 3402 * The channel can be run in 2 modes 3403 * 3404 * 1. clear 3405 * 2. tls 3406 * 3407 * And TLS can use 2 types of credentials 3408 * 3409 * 1. anon 3410 * 2. x509 3411 * 3412 * We thus have 9 possible logical combinations 3413 * 3414 * 1. clear + none 3415 * 2. clear + vnc 3416 * 3. clear + sasl 3417 * 4. tls + anon + none 3418 * 5. tls + anon + vnc 3419 * 6. tls + anon + sasl 3420 * 7. tls + x509 + none 3421 * 8. tls + x509 + vnc 3422 * 9. tls + x509 + sasl 3423 * 3424 * These need to be mapped into the VNC auth schemes 3425 * in an appropriate manner. In regular VNC, all the 3426 * TLS options get mapped into VNC_AUTH_VENCRYPT 3427 * sub-auth types. 3428 * 3429 * In websockets, the https:// protocol already provides 3430 * TLS support, so there is no need to make use of the 3431 * VeNCrypt extension. Furthermore, websockets browser 3432 * clients could not use VeNCrypt even if they wanted to, 3433 * as they cannot control when the TLS handshake takes 3434 * place. Thus there is no option but to rely on https://, 3435 * meaning combinations 4->6 and 7->9 will be mapped to 3436 * VNC auth schemes in the same way as combos 1->3. 3437 * 3438 * Regardless of fact that we have a different mapping to 3439 * VNC auth mechs for plain VNC vs websockets VNC, the end 3440 * result has the same security characteristics. 3441 */ 3442 if (websocket || !tlscreds) { 3443 if (password) { 3444 VNC_DEBUG("Initializing VNC server with password auth\n"); 3445 *auth = VNC_AUTH_VNC; 3446 } else if (sasl) { 3447 VNC_DEBUG("Initializing VNC server with SASL auth\n"); 3448 *auth = VNC_AUTH_SASL; 3449 } else { 3450 VNC_DEBUG("Initializing VNC server with no auth\n"); 3451 *auth = VNC_AUTH_NONE; 3452 } 3453 *subauth = VNC_AUTH_INVALID; 3454 } else { 3455 bool is_x509 = object_dynamic_cast(OBJECT(tlscreds), 3456 TYPE_QCRYPTO_TLS_CREDS_X509) != NULL; 3457 bool is_anon = object_dynamic_cast(OBJECT(tlscreds), 3458 TYPE_QCRYPTO_TLS_CREDS_ANON) != NULL; 3459 3460 if (!is_x509 && !is_anon) { 3461 error_setg(errp, 3462 "Unsupported TLS cred type %s", 3463 object_get_typename(OBJECT(tlscreds))); 3464 return -1; 3465 } 3466 *auth = VNC_AUTH_VENCRYPT; 3467 if (password) { 3468 if (is_x509) { 3469 VNC_DEBUG("Initializing VNC server with x509 password auth\n"); 3470 *subauth = VNC_AUTH_VENCRYPT_X509VNC; 3471 } else { 3472 VNC_DEBUG("Initializing VNC server with TLS password auth\n"); 3473 *subauth = VNC_AUTH_VENCRYPT_TLSVNC; 3474 } 3475 3476 } else if (sasl) { 3477 if (is_x509) { 3478 VNC_DEBUG("Initializing VNC server with x509 SASL auth\n"); 3479 *subauth = VNC_AUTH_VENCRYPT_X509SASL; 3480 } else { 3481 VNC_DEBUG("Initializing VNC server with TLS SASL auth\n"); 3482 *subauth = VNC_AUTH_VENCRYPT_TLSSASL; 3483 } 3484 } else { 3485 if (is_x509) { 3486 VNC_DEBUG("Initializing VNC server with x509 no auth\n"); 3487 *subauth = VNC_AUTH_VENCRYPT_X509NONE; 3488 } else { 3489 VNC_DEBUG("Initializing VNC server with TLS no auth\n"); 3490 *subauth = VNC_AUTH_VENCRYPT_TLSNONE; 3491 } 3492 } 3493 } 3494 return 0; 3495 } 3496 3497 3498 /* 3499 * Handle back compat with old CLI syntax by creating some 3500 * suitable QCryptoTLSCreds objects 3501 */ 3502 static QCryptoTLSCreds * 3503 vnc_display_create_creds(bool x509, 3504 bool x509verify, 3505 const char *dir, 3506 const char *id, 3507 Error **errp) 3508 { 3509 gchar *credsid = g_strdup_printf("tlsvnc%s", id); 3510 Object *parent = object_get_objects_root(); 3511 Object *creds; 3512 Error *err = NULL; 3513 3514 if (x509) { 3515 creds = object_new_with_props(TYPE_QCRYPTO_TLS_CREDS_X509, 3516 parent, 3517 credsid, 3518 &err, 3519 "endpoint", "server", 3520 "dir", dir, 3521 "verify-peer", x509verify ? "yes" : "no", 3522 NULL); 3523 } else { 3524 creds = object_new_with_props(TYPE_QCRYPTO_TLS_CREDS_ANON, 3525 parent, 3526 credsid, 3527 &err, 3528 "endpoint", "server", 3529 NULL); 3530 } 3531 3532 g_free(credsid); 3533 3534 if (err) { 3535 error_propagate(errp, err); 3536 return NULL; 3537 } 3538 3539 return QCRYPTO_TLS_CREDS(creds); 3540 } 3541 3542 3543 static int vnc_display_get_address(const char *addrstr, 3544 bool websocket, 3545 bool reverse, 3546 int displaynum, 3547 int to, 3548 bool has_ipv4, 3549 bool has_ipv6, 3550 bool ipv4, 3551 bool ipv6, 3552 SocketAddress **retaddr, 3553 Error **errp) 3554 { 3555 int ret = -1; 3556 SocketAddress *addr = NULL; 3557 3558 addr = g_new0(SocketAddress, 1); 3559 3560 if (strncmp(addrstr, "unix:", 5) == 0) { 3561 addr->type = SOCKET_ADDRESS_TYPE_UNIX; 3562 addr->u.q_unix.path = g_strdup(addrstr + 5); 3563 3564 if (websocket) { 3565 error_setg(errp, "UNIX sockets not supported with websock"); 3566 goto cleanup; 3567 } 3568 3569 if (to) { 3570 error_setg(errp, "Port range not support with UNIX socket"); 3571 goto cleanup; 3572 } 3573 ret = 0; 3574 } else { 3575 const char *port; 3576 size_t hostlen; 3577 unsigned long long baseport = 0; 3578 InetSocketAddress *inet; 3579 3580 port = strrchr(addrstr, ':'); 3581 if (!port) { 3582 if (websocket) { 3583 hostlen = 0; 3584 port = addrstr; 3585 } else { 3586 error_setg(errp, "no vnc port specified"); 3587 goto cleanup; 3588 } 3589 } else { 3590 hostlen = port - addrstr; 3591 port++; 3592 if (*port == '\0') { 3593 error_setg(errp, "vnc port cannot be empty"); 3594 goto cleanup; 3595 } 3596 } 3597 3598 addr->type = SOCKET_ADDRESS_TYPE_INET; 3599 inet = &addr->u.inet; 3600 if (addrstr[0] == '[' && addrstr[hostlen - 1] == ']') { 3601 inet->host = g_strndup(addrstr + 1, hostlen - 2); 3602 } else { 3603 inet->host = g_strndup(addrstr, hostlen); 3604 } 3605 /* plain VNC port is just an offset, for websocket 3606 * port is absolute */ 3607 if (websocket) { 3608 if (g_str_equal(addrstr, "") || 3609 g_str_equal(addrstr, "on")) { 3610 if (displaynum == -1) { 3611 error_setg(errp, "explicit websocket port is required"); 3612 goto cleanup; 3613 } 3614 inet->port = g_strdup_printf( 3615 "%d", displaynum + 5700); 3616 if (to) { 3617 inet->has_to = true; 3618 inet->to = to + 5700; 3619 } 3620 } else { 3621 inet->port = g_strdup(port); 3622 } 3623 } else { 3624 int offset = reverse ? 0 : 5900; 3625 if (parse_uint_full(port, &baseport, 10) < 0) { 3626 error_setg(errp, "can't convert to a number: %s", port); 3627 goto cleanup; 3628 } 3629 if (baseport > 65535 || 3630 baseport + offset > 65535) { 3631 error_setg(errp, "port %s out of range", port); 3632 goto cleanup; 3633 } 3634 inet->port = g_strdup_printf( 3635 "%d", (int)baseport + offset); 3636 3637 if (to) { 3638 inet->has_to = true; 3639 inet->to = to + offset; 3640 } 3641 } 3642 3643 inet->ipv4 = ipv4; 3644 inet->has_ipv4 = has_ipv4; 3645 inet->ipv6 = ipv6; 3646 inet->has_ipv6 = has_ipv6; 3647 3648 ret = baseport; 3649 } 3650 3651 *retaddr = addr; 3652 3653 cleanup: 3654 if (ret < 0) { 3655 qapi_free_SocketAddress(addr); 3656 } 3657 return ret; 3658 } 3659 3660 static void vnc_free_addresses(SocketAddress ***retsaddr, 3661 size_t *retnsaddr) 3662 { 3663 size_t i; 3664 3665 for (i = 0; i < *retnsaddr; i++) { 3666 qapi_free_SocketAddress((*retsaddr)[i]); 3667 } 3668 g_free(*retsaddr); 3669 3670 *retsaddr = NULL; 3671 *retnsaddr = 0; 3672 } 3673 3674 static int vnc_display_get_addresses(QemuOpts *opts, 3675 bool reverse, 3676 SocketAddress ***retsaddr, 3677 size_t *retnsaddr, 3678 SocketAddress ***retwsaddr, 3679 size_t *retnwsaddr, 3680 Error **errp) 3681 { 3682 SocketAddress *saddr = NULL; 3683 SocketAddress *wsaddr = NULL; 3684 QemuOptsIter addriter; 3685 const char *addr; 3686 int to = qemu_opt_get_number(opts, "to", 0); 3687 bool has_ipv4 = qemu_opt_get(opts, "ipv4"); 3688 bool has_ipv6 = qemu_opt_get(opts, "ipv6"); 3689 bool ipv4 = qemu_opt_get_bool(opts, "ipv4", false); 3690 bool ipv6 = qemu_opt_get_bool(opts, "ipv6", false); 3691 int displaynum = -1; 3692 int ret = -1; 3693 3694 *retsaddr = NULL; 3695 *retnsaddr = 0; 3696 *retwsaddr = NULL; 3697 *retnwsaddr = 0; 3698 3699 addr = qemu_opt_get(opts, "vnc"); 3700 if (addr == NULL || g_str_equal(addr, "none")) { 3701 ret = 0; 3702 goto cleanup; 3703 } 3704 if (qemu_opt_get(opts, "websocket") && 3705 !qcrypto_hash_supports(QCRYPTO_HASH_ALG_SHA1)) { 3706 error_setg(errp, 3707 "SHA1 hash support is required for websockets"); 3708 goto cleanup; 3709 } 3710 3711 qemu_opt_iter_init(&addriter, opts, "vnc"); 3712 while ((addr = qemu_opt_iter_next(&addriter)) != NULL) { 3713 int rv; 3714 rv = vnc_display_get_address(addr, false, reverse, 0, to, 3715 has_ipv4, has_ipv6, 3716 ipv4, ipv6, 3717 &saddr, errp); 3718 if (rv < 0) { 3719 goto cleanup; 3720 } 3721 /* Historical compat - first listen address can be used 3722 * to set the default websocket port 3723 */ 3724 if (displaynum == -1) { 3725 displaynum = rv; 3726 } 3727 *retsaddr = g_renew(SocketAddress *, *retsaddr, *retnsaddr + 1); 3728 (*retsaddr)[(*retnsaddr)++] = saddr; 3729 } 3730 3731 /* If we had multiple primary displays, we don't do defaults 3732 * for websocket, and require explicit config instead. */ 3733 if (*retnsaddr > 1) { 3734 displaynum = -1; 3735 } 3736 3737 qemu_opt_iter_init(&addriter, opts, "websocket"); 3738 while ((addr = qemu_opt_iter_next(&addriter)) != NULL) { 3739 if (vnc_display_get_address(addr, true, reverse, displaynum, to, 3740 has_ipv4, has_ipv6, 3741 ipv4, ipv6, 3742 &wsaddr, errp) < 0) { 3743 goto cleanup; 3744 } 3745 3746 /* Historical compat - if only a single listen address was 3747 * provided, then this is used to set the default listen 3748 * address for websocket too 3749 */ 3750 if (*retnsaddr == 1 && 3751 (*retsaddr)[0]->type == SOCKET_ADDRESS_TYPE_INET && 3752 wsaddr->type == SOCKET_ADDRESS_TYPE_INET && 3753 g_str_equal(wsaddr->u.inet.host, "") && 3754 !g_str_equal((*retsaddr)[0]->u.inet.host, "")) { 3755 g_free(wsaddr->u.inet.host); 3756 wsaddr->u.inet.host = g_strdup((*retsaddr)[0]->u.inet.host); 3757 } 3758 3759 *retwsaddr = g_renew(SocketAddress *, *retwsaddr, *retnwsaddr + 1); 3760 (*retwsaddr)[(*retnwsaddr)++] = wsaddr; 3761 } 3762 3763 ret = 0; 3764 cleanup: 3765 if (ret < 0) { 3766 vnc_free_addresses(retsaddr, retnsaddr); 3767 vnc_free_addresses(retwsaddr, retnwsaddr); 3768 } 3769 return ret; 3770 } 3771 3772 static int vnc_display_connect(VncDisplay *vd, 3773 SocketAddress **saddr, 3774 size_t nsaddr, 3775 SocketAddress **wsaddr, 3776 size_t nwsaddr, 3777 Error **errp) 3778 { 3779 /* connect to viewer */ 3780 QIOChannelSocket *sioc = NULL; 3781 if (nwsaddr != 0) { 3782 error_setg(errp, "Cannot use websockets in reverse mode"); 3783 return -1; 3784 } 3785 if (nsaddr != 1) { 3786 error_setg(errp, "Expected a single address in reverse mode"); 3787 return -1; 3788 } 3789 /* TODO SOCKET_ADDRESS_TYPE_FD when fd has AF_UNIX */ 3790 vd->is_unix = saddr[0]->type == SOCKET_ADDRESS_TYPE_UNIX; 3791 sioc = qio_channel_socket_new(); 3792 qio_channel_set_name(QIO_CHANNEL(sioc), "vnc-reverse"); 3793 if (qio_channel_socket_connect_sync(sioc, saddr[0], errp) < 0) { 3794 return -1; 3795 } 3796 vnc_connect(vd, sioc, false, false); 3797 object_unref(OBJECT(sioc)); 3798 return 0; 3799 } 3800 3801 3802 static int vnc_display_listen(VncDisplay *vd, 3803 SocketAddress **saddr, 3804 size_t nsaddr, 3805 SocketAddress **wsaddr, 3806 size_t nwsaddr, 3807 Error **errp) 3808 { 3809 size_t i; 3810 3811 if (nsaddr) { 3812 vd->listener = qio_net_listener_new(); 3813 qio_net_listener_set_name(vd->listener, "vnc-listen"); 3814 for (i = 0; i < nsaddr; i++) { 3815 if (qio_net_listener_open_sync(vd->listener, 3816 saddr[i], 3817 errp) < 0) { 3818 return -1; 3819 } 3820 } 3821 3822 qio_net_listener_set_client_func(vd->listener, 3823 vnc_listen_io, vd, NULL); 3824 } 3825 3826 if (nwsaddr) { 3827 vd->wslistener = qio_net_listener_new(); 3828 qio_net_listener_set_name(vd->wslistener, "vnc-ws-listen"); 3829 for (i = 0; i < nwsaddr; i++) { 3830 if (qio_net_listener_open_sync(vd->wslistener, 3831 wsaddr[i], 3832 errp) < 0) { 3833 return -1; 3834 } 3835 } 3836 3837 qio_net_listener_set_client_func(vd->wslistener, 3838 vnc_listen_io, vd, NULL); 3839 } 3840 3841 return 0; 3842 } 3843 3844 3845 void vnc_display_open(const char *id, Error **errp) 3846 { 3847 VncDisplay *vd = vnc_display_find(id); 3848 QemuOpts *opts = qemu_opts_find(&qemu_vnc_opts, id); 3849 SocketAddress **saddr = NULL, **wsaddr = NULL; 3850 size_t nsaddr, nwsaddr; 3851 const char *share, *device_id; 3852 QemuConsole *con; 3853 bool password = false; 3854 bool reverse = false; 3855 const char *credid; 3856 bool sasl = false; 3857 #ifdef CONFIG_VNC_SASL 3858 int saslErr; 3859 #endif 3860 int acl = 0; 3861 int lock_key_sync = 1; 3862 int key_delay_ms; 3863 3864 if (!vd) { 3865 error_setg(errp, "VNC display not active"); 3866 return; 3867 } 3868 vnc_display_close(vd); 3869 3870 if (!opts) { 3871 return; 3872 } 3873 3874 reverse = qemu_opt_get_bool(opts, "reverse", false); 3875 if (vnc_display_get_addresses(opts, reverse, &saddr, &nsaddr, 3876 &wsaddr, &nwsaddr, errp) < 0) { 3877 goto fail; 3878 } 3879 3880 password = qemu_opt_get_bool(opts, "password", false); 3881 if (password) { 3882 if (fips_get_state()) { 3883 error_setg(errp, 3884 "VNC password auth disabled due to FIPS mode, " 3885 "consider using the VeNCrypt or SASL authentication " 3886 "methods as an alternative"); 3887 goto fail; 3888 } 3889 if (!qcrypto_cipher_supports( 3890 QCRYPTO_CIPHER_ALG_DES_RFB, QCRYPTO_CIPHER_MODE_ECB)) { 3891 error_setg(errp, 3892 "Cipher backend does not support DES RFB algorithm"); 3893 goto fail; 3894 } 3895 } 3896 3897 lock_key_sync = qemu_opt_get_bool(opts, "lock-key-sync", true); 3898 key_delay_ms = qemu_opt_get_number(opts, "key-delay-ms", 10); 3899 sasl = qemu_opt_get_bool(opts, "sasl", false); 3900 #ifndef CONFIG_VNC_SASL 3901 if (sasl) { 3902 error_setg(errp, "VNC SASL auth requires cyrus-sasl support"); 3903 goto fail; 3904 } 3905 #endif /* CONFIG_VNC_SASL */ 3906 credid = qemu_opt_get(opts, "tls-creds"); 3907 if (credid) { 3908 Object *creds; 3909 if (qemu_opt_get(opts, "tls") || 3910 qemu_opt_get(opts, "x509") || 3911 qemu_opt_get(opts, "x509verify")) { 3912 error_setg(errp, 3913 "'tls-creds' parameter is mutually exclusive with " 3914 "'tls', 'x509' and 'x509verify' parameters"); 3915 goto fail; 3916 } 3917 3918 creds = object_resolve_path_component( 3919 object_get_objects_root(), credid); 3920 if (!creds) { 3921 error_setg(errp, "No TLS credentials with id '%s'", 3922 credid); 3923 goto fail; 3924 } 3925 vd->tlscreds = (QCryptoTLSCreds *) 3926 object_dynamic_cast(creds, 3927 TYPE_QCRYPTO_TLS_CREDS); 3928 if (!vd->tlscreds) { 3929 error_setg(errp, "Object with id '%s' is not TLS credentials", 3930 credid); 3931 goto fail; 3932 } 3933 object_ref(OBJECT(vd->tlscreds)); 3934 3935 if (vd->tlscreds->endpoint != QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) { 3936 error_setg(errp, 3937 "Expecting TLS credentials with a server endpoint"); 3938 goto fail; 3939 } 3940 } else { 3941 const char *path; 3942 bool tls = false, x509 = false, x509verify = false; 3943 tls = qemu_opt_get_bool(opts, "tls", false); 3944 if (tls) { 3945 path = qemu_opt_get(opts, "x509"); 3946 3947 if (path) { 3948 x509 = true; 3949 } else { 3950 path = qemu_opt_get(opts, "x509verify"); 3951 if (path) { 3952 x509 = true; 3953 x509verify = true; 3954 } 3955 } 3956 vd->tlscreds = vnc_display_create_creds(x509, 3957 x509verify, 3958 path, 3959 vd->id, 3960 errp); 3961 if (!vd->tlscreds) { 3962 goto fail; 3963 } 3964 } 3965 } 3966 acl = qemu_opt_get_bool(opts, "acl", false); 3967 3968 share = qemu_opt_get(opts, "share"); 3969 if (share) { 3970 if (strcmp(share, "ignore") == 0) { 3971 vd->share_policy = VNC_SHARE_POLICY_IGNORE; 3972 } else if (strcmp(share, "allow-exclusive") == 0) { 3973 vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE; 3974 } else if (strcmp(share, "force-shared") == 0) { 3975 vd->share_policy = VNC_SHARE_POLICY_FORCE_SHARED; 3976 } else { 3977 error_setg(errp, "unknown vnc share= option"); 3978 goto fail; 3979 } 3980 } else { 3981 vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE; 3982 } 3983 vd->connections_limit = qemu_opt_get_number(opts, "connections", 32); 3984 3985 #ifdef CONFIG_VNC_JPEG 3986 vd->lossy = qemu_opt_get_bool(opts, "lossy", false); 3987 #endif 3988 vd->non_adaptive = qemu_opt_get_bool(opts, "non-adaptive", false); 3989 /* adaptive updates are only used with tight encoding and 3990 * if lossy updates are enabled so we can disable all the 3991 * calculations otherwise */ 3992 if (!vd->lossy) { 3993 vd->non_adaptive = true; 3994 } 3995 3996 if (acl) { 3997 if (strcmp(vd->id, "default") == 0) { 3998 vd->tlsaclname = g_strdup("vnc.x509dname"); 3999 } else { 4000 vd->tlsaclname = g_strdup_printf("vnc.%s.x509dname", vd->id); 4001 } 4002 qemu_acl_init(vd->tlsaclname); 4003 } 4004 #ifdef CONFIG_VNC_SASL 4005 if (acl && sasl) { 4006 char *aclname; 4007 4008 if (strcmp(vd->id, "default") == 0) { 4009 aclname = g_strdup("vnc.username"); 4010 } else { 4011 aclname = g_strdup_printf("vnc.%s.username", vd->id); 4012 } 4013 vd->sasl.acl = qemu_acl_init(aclname); 4014 g_free(aclname); 4015 } 4016 #endif 4017 4018 if (vnc_display_setup_auth(&vd->auth, &vd->subauth, 4019 vd->tlscreds, password, 4020 sasl, false, errp) < 0) { 4021 goto fail; 4022 } 4023 trace_vnc_auth_init(vd, 0, vd->auth, vd->subauth); 4024 4025 if (vnc_display_setup_auth(&vd->ws_auth, &vd->ws_subauth, 4026 vd->tlscreds, password, 4027 sasl, true, errp) < 0) { 4028 goto fail; 4029 } 4030 trace_vnc_auth_init(vd, 1, vd->ws_auth, vd->ws_subauth); 4031 4032 #ifdef CONFIG_VNC_SASL 4033 if ((saslErr = sasl_server_init(NULL, "qemu")) != SASL_OK) { 4034 error_setg(errp, "Failed to initialize SASL auth: %s", 4035 sasl_errstring(saslErr, NULL, NULL)); 4036 goto fail; 4037 } 4038 #endif 4039 vd->lock_key_sync = lock_key_sync; 4040 if (lock_key_sync) { 4041 vd->led = qemu_add_led_event_handler(kbd_leds, vd); 4042 } 4043 vd->ledstate = 0; 4044 vd->key_delay_ms = key_delay_ms; 4045 4046 device_id = qemu_opt_get(opts, "display"); 4047 if (device_id) { 4048 int head = qemu_opt_get_number(opts, "head", 0); 4049 Error *err = NULL; 4050 4051 con = qemu_console_lookup_by_device_name(device_id, head, &err); 4052 if (err) { 4053 error_propagate(errp, err); 4054 goto fail; 4055 } 4056 } else { 4057 con = NULL; 4058 } 4059 4060 if (con != vd->dcl.con) { 4061 unregister_displaychangelistener(&vd->dcl); 4062 vd->dcl.con = con; 4063 register_displaychangelistener(&vd->dcl); 4064 } 4065 4066 if (saddr == NULL) { 4067 goto cleanup; 4068 } 4069 4070 if (reverse) { 4071 if (vnc_display_connect(vd, saddr, nsaddr, wsaddr, nwsaddr, errp) < 0) { 4072 goto fail; 4073 } 4074 } else { 4075 if (vnc_display_listen(vd, saddr, nsaddr, wsaddr, nwsaddr, errp) < 0) { 4076 goto fail; 4077 } 4078 } 4079 4080 if (qemu_opt_get(opts, "to")) { 4081 vnc_display_print_local_addr(vd); 4082 } 4083 4084 cleanup: 4085 vnc_free_addresses(&saddr, &nsaddr); 4086 vnc_free_addresses(&wsaddr, &nwsaddr); 4087 return; 4088 4089 fail: 4090 vnc_display_close(vd); 4091 goto cleanup; 4092 } 4093 4094 void vnc_display_add_client(const char *id, int csock, bool skipauth) 4095 { 4096 VncDisplay *vd = vnc_display_find(id); 4097 QIOChannelSocket *sioc; 4098 4099 if (!vd) { 4100 return; 4101 } 4102 4103 sioc = qio_channel_socket_new_fd(csock, NULL); 4104 if (sioc) { 4105 qio_channel_set_name(QIO_CHANNEL(sioc), "vnc-server"); 4106 vnc_connect(vd, sioc, skipauth, false); 4107 object_unref(OBJECT(sioc)); 4108 } 4109 } 4110 4111 static void vnc_auto_assign_id(QemuOptsList *olist, QemuOpts *opts) 4112 { 4113 int i = 2; 4114 char *id; 4115 4116 id = g_strdup("default"); 4117 while (qemu_opts_find(olist, id)) { 4118 g_free(id); 4119 id = g_strdup_printf("vnc%d", i++); 4120 } 4121 qemu_opts_set_id(opts, id); 4122 } 4123 4124 QemuOpts *vnc_parse(const char *str, Error **errp) 4125 { 4126 QemuOptsList *olist = qemu_find_opts("vnc"); 4127 QemuOpts *opts = qemu_opts_parse(olist, str, true, errp); 4128 const char *id; 4129 4130 if (!opts) { 4131 return NULL; 4132 } 4133 4134 id = qemu_opts_id(opts); 4135 if (!id) { 4136 /* auto-assign id if not present */ 4137 vnc_auto_assign_id(olist, opts); 4138 } 4139 return opts; 4140 } 4141 4142 int vnc_init_func(void *opaque, QemuOpts *opts, Error **errp) 4143 { 4144 Error *local_err = NULL; 4145 char *id = (char *)qemu_opts_id(opts); 4146 4147 assert(id); 4148 vnc_display_init(id); 4149 vnc_display_open(id, &local_err); 4150 if (local_err != NULL) { 4151 error_reportf_err(local_err, "Failed to start VNC server: "); 4152 exit(1); 4153 } 4154 return 0; 4155 } 4156 4157 static void vnc_register_config(void) 4158 { 4159 qemu_add_opts(&qemu_vnc_opts); 4160 } 4161 opts_init(vnc_register_config); 4162