1 /* 2 * QEMU VNC display driver 3 * 4 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws> 5 * Copyright (C) 2006 Fabrice Bellard 6 * Copyright (C) 2009 Red Hat, Inc 7 * 8 * Permission is hereby granted, free of charge, to any person obtaining a copy 9 * of this software and associated documentation files (the "Software"), to deal 10 * in the Software without restriction, including without limitation the rights 11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 12 * copies of the Software, and to permit persons to whom the Software is 13 * furnished to do so, subject to the following conditions: 14 * 15 * The above copyright notice and this permission notice shall be included in 16 * all copies or substantial portions of the Software. 17 * 18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 24 * THE SOFTWARE. 25 */ 26 27 #include "qemu/osdep.h" 28 #include "vnc.h" 29 #include "vnc-jobs.h" 30 #include "trace.h" 31 #include "sysemu/sysemu.h" 32 #include "qemu/error-report.h" 33 #include "qemu/sockets.h" 34 #include "qemu/timer.h" 35 #include "qemu/acl.h" 36 #include "qemu/config-file.h" 37 #include "qapi/qmp/qerror.h" 38 #include "qapi/qmp/types.h" 39 #include "qmp-commands.h" 40 #include "ui/input.h" 41 #include "qapi-event.h" 42 #include "crypto/hash.h" 43 #include "crypto/tlscredsanon.h" 44 #include "crypto/tlscredsx509.h" 45 #include "qom/object_interfaces.h" 46 #include "qemu/cutils.h" 47 #include "io/dns-resolver.h" 48 49 #define VNC_REFRESH_INTERVAL_BASE GUI_REFRESH_INTERVAL_DEFAULT 50 #define VNC_REFRESH_INTERVAL_INC 50 51 #define VNC_REFRESH_INTERVAL_MAX GUI_REFRESH_INTERVAL_IDLE 52 static const struct timeval VNC_REFRESH_STATS = { 0, 500000 }; 53 static const struct timeval VNC_REFRESH_LOSSY = { 2, 0 }; 54 55 #include "vnc_keysym.h" 56 #include "crypto/cipher.h" 57 58 static QTAILQ_HEAD(, VncDisplay) vnc_displays = 59 QTAILQ_HEAD_INITIALIZER(vnc_displays); 60 61 static int vnc_cursor_define(VncState *vs); 62 static void vnc_release_modifiers(VncState *vs); 63 64 static void vnc_set_share_mode(VncState *vs, VncShareMode mode) 65 { 66 #ifdef _VNC_DEBUG 67 static const char *mn[] = { 68 [0] = "undefined", 69 [VNC_SHARE_MODE_CONNECTING] = "connecting", 70 [VNC_SHARE_MODE_SHARED] = "shared", 71 [VNC_SHARE_MODE_EXCLUSIVE] = "exclusive", 72 [VNC_SHARE_MODE_DISCONNECTED] = "disconnected", 73 }; 74 fprintf(stderr, "%s/%p: %s -> %s\n", __func__, 75 vs->ioc, mn[vs->share_mode], mn[mode]); 76 #endif 77 78 switch (vs->share_mode) { 79 case VNC_SHARE_MODE_CONNECTING: 80 vs->vd->num_connecting--; 81 break; 82 case VNC_SHARE_MODE_SHARED: 83 vs->vd->num_shared--; 84 break; 85 case VNC_SHARE_MODE_EXCLUSIVE: 86 vs->vd->num_exclusive--; 87 break; 88 default: 89 break; 90 } 91 92 vs->share_mode = mode; 93 94 switch (vs->share_mode) { 95 case VNC_SHARE_MODE_CONNECTING: 96 vs->vd->num_connecting++; 97 break; 98 case VNC_SHARE_MODE_SHARED: 99 vs->vd->num_shared++; 100 break; 101 case VNC_SHARE_MODE_EXCLUSIVE: 102 vs->vd->num_exclusive++; 103 break; 104 default: 105 break; 106 } 107 } 108 109 110 static void vnc_init_basic_info(SocketAddress *addr, 111 VncBasicInfo *info, 112 Error **errp) 113 { 114 switch (addr->type) { 115 case SOCKET_ADDRESS_TYPE_INET: 116 info->host = g_strdup(addr->u.inet.host); 117 info->service = g_strdup(addr->u.inet.port); 118 if (addr->u.inet.ipv6) { 119 info->family = NETWORK_ADDRESS_FAMILY_IPV6; 120 } else { 121 info->family = NETWORK_ADDRESS_FAMILY_IPV4; 122 } 123 break; 124 125 case SOCKET_ADDRESS_TYPE_UNIX: 126 info->host = g_strdup(""); 127 info->service = g_strdup(addr->u.q_unix.path); 128 info->family = NETWORK_ADDRESS_FAMILY_UNIX; 129 break; 130 131 case SOCKET_ADDRESS_TYPE_VSOCK: 132 case SOCKET_ADDRESS_TYPE_FD: 133 error_setg(errp, "Unsupported socket address type %s", 134 SocketAddressType_str(addr->type)); 135 break; 136 default: 137 abort(); 138 } 139 140 return; 141 } 142 143 static void vnc_init_basic_info_from_server_addr(QIOChannelSocket *ioc, 144 VncBasicInfo *info, 145 Error **errp) 146 { 147 SocketAddress *addr = NULL; 148 149 if (!ioc) { 150 error_setg(errp, "No listener socket available"); 151 return; 152 } 153 154 addr = qio_channel_socket_get_local_address(ioc, errp); 155 if (!addr) { 156 return; 157 } 158 159 vnc_init_basic_info(addr, info, errp); 160 qapi_free_SocketAddress(addr); 161 } 162 163 static void vnc_init_basic_info_from_remote_addr(QIOChannelSocket *ioc, 164 VncBasicInfo *info, 165 Error **errp) 166 { 167 SocketAddress *addr = NULL; 168 169 addr = qio_channel_socket_get_remote_address(ioc, errp); 170 if (!addr) { 171 return; 172 } 173 174 vnc_init_basic_info(addr, info, errp); 175 qapi_free_SocketAddress(addr); 176 } 177 178 static const char *vnc_auth_name(VncDisplay *vd) { 179 switch (vd->auth) { 180 case VNC_AUTH_INVALID: 181 return "invalid"; 182 case VNC_AUTH_NONE: 183 return "none"; 184 case VNC_AUTH_VNC: 185 return "vnc"; 186 case VNC_AUTH_RA2: 187 return "ra2"; 188 case VNC_AUTH_RA2NE: 189 return "ra2ne"; 190 case VNC_AUTH_TIGHT: 191 return "tight"; 192 case VNC_AUTH_ULTRA: 193 return "ultra"; 194 case VNC_AUTH_TLS: 195 return "tls"; 196 case VNC_AUTH_VENCRYPT: 197 switch (vd->subauth) { 198 case VNC_AUTH_VENCRYPT_PLAIN: 199 return "vencrypt+plain"; 200 case VNC_AUTH_VENCRYPT_TLSNONE: 201 return "vencrypt+tls+none"; 202 case VNC_AUTH_VENCRYPT_TLSVNC: 203 return "vencrypt+tls+vnc"; 204 case VNC_AUTH_VENCRYPT_TLSPLAIN: 205 return "vencrypt+tls+plain"; 206 case VNC_AUTH_VENCRYPT_X509NONE: 207 return "vencrypt+x509+none"; 208 case VNC_AUTH_VENCRYPT_X509VNC: 209 return "vencrypt+x509+vnc"; 210 case VNC_AUTH_VENCRYPT_X509PLAIN: 211 return "vencrypt+x509+plain"; 212 case VNC_AUTH_VENCRYPT_TLSSASL: 213 return "vencrypt+tls+sasl"; 214 case VNC_AUTH_VENCRYPT_X509SASL: 215 return "vencrypt+x509+sasl"; 216 default: 217 return "vencrypt"; 218 } 219 case VNC_AUTH_SASL: 220 return "sasl"; 221 } 222 return "unknown"; 223 } 224 225 static VncServerInfo *vnc_server_info_get(VncDisplay *vd) 226 { 227 VncServerInfo *info; 228 Error *err = NULL; 229 230 if (!vd->nlsock) { 231 return NULL; 232 } 233 234 info = g_malloc0(sizeof(*info)); 235 vnc_init_basic_info_from_server_addr(vd->lsock[0], 236 qapi_VncServerInfo_base(info), &err); 237 info->has_auth = true; 238 info->auth = g_strdup(vnc_auth_name(vd)); 239 if (err) { 240 qapi_free_VncServerInfo(info); 241 info = NULL; 242 error_free(err); 243 } 244 return info; 245 } 246 247 static void vnc_client_cache_auth(VncState *client) 248 { 249 if (!client->info) { 250 return; 251 } 252 253 if (client->tls) { 254 client->info->x509_dname = 255 qcrypto_tls_session_get_peer_name(client->tls); 256 client->info->has_x509_dname = 257 client->info->x509_dname != NULL; 258 } 259 #ifdef CONFIG_VNC_SASL 260 if (client->sasl.conn && 261 client->sasl.username) { 262 client->info->has_sasl_username = true; 263 client->info->sasl_username = g_strdup(client->sasl.username); 264 } 265 #endif 266 } 267 268 static void vnc_client_cache_addr(VncState *client) 269 { 270 Error *err = NULL; 271 272 client->info = g_malloc0(sizeof(*client->info)); 273 vnc_init_basic_info_from_remote_addr(client->sioc, 274 qapi_VncClientInfo_base(client->info), 275 &err); 276 if (err) { 277 qapi_free_VncClientInfo(client->info); 278 client->info = NULL; 279 error_free(err); 280 } 281 } 282 283 static void vnc_qmp_event(VncState *vs, QAPIEvent event) 284 { 285 VncServerInfo *si; 286 287 if (!vs->info) { 288 return; 289 } 290 291 si = vnc_server_info_get(vs->vd); 292 if (!si) { 293 return; 294 } 295 296 switch (event) { 297 case QAPI_EVENT_VNC_CONNECTED: 298 qapi_event_send_vnc_connected(si, qapi_VncClientInfo_base(vs->info), 299 &error_abort); 300 break; 301 case QAPI_EVENT_VNC_INITIALIZED: 302 qapi_event_send_vnc_initialized(si, vs->info, &error_abort); 303 break; 304 case QAPI_EVENT_VNC_DISCONNECTED: 305 qapi_event_send_vnc_disconnected(si, vs->info, &error_abort); 306 break; 307 default: 308 break; 309 } 310 311 qapi_free_VncServerInfo(si); 312 } 313 314 static VncClientInfo *qmp_query_vnc_client(const VncState *client) 315 { 316 VncClientInfo *info; 317 Error *err = NULL; 318 319 info = g_malloc0(sizeof(*info)); 320 321 vnc_init_basic_info_from_remote_addr(client->sioc, 322 qapi_VncClientInfo_base(info), 323 &err); 324 if (err) { 325 error_free(err); 326 qapi_free_VncClientInfo(info); 327 return NULL; 328 } 329 330 info->websocket = client->websocket; 331 332 if (client->tls) { 333 info->x509_dname = qcrypto_tls_session_get_peer_name(client->tls); 334 info->has_x509_dname = info->x509_dname != NULL; 335 } 336 #ifdef CONFIG_VNC_SASL 337 if (client->sasl.conn && client->sasl.username) { 338 info->has_sasl_username = true; 339 info->sasl_username = g_strdup(client->sasl.username); 340 } 341 #endif 342 343 return info; 344 } 345 346 static VncDisplay *vnc_display_find(const char *id) 347 { 348 VncDisplay *vd; 349 350 if (id == NULL) { 351 return QTAILQ_FIRST(&vnc_displays); 352 } 353 QTAILQ_FOREACH(vd, &vnc_displays, next) { 354 if (strcmp(id, vd->id) == 0) { 355 return vd; 356 } 357 } 358 return NULL; 359 } 360 361 static VncClientInfoList *qmp_query_client_list(VncDisplay *vd) 362 { 363 VncClientInfoList *cinfo, *prev = NULL; 364 VncState *client; 365 366 QTAILQ_FOREACH(client, &vd->clients, next) { 367 cinfo = g_new0(VncClientInfoList, 1); 368 cinfo->value = qmp_query_vnc_client(client); 369 cinfo->next = prev; 370 prev = cinfo; 371 } 372 return prev; 373 } 374 375 VncInfo *qmp_query_vnc(Error **errp) 376 { 377 VncInfo *info = g_malloc0(sizeof(*info)); 378 VncDisplay *vd = vnc_display_find(NULL); 379 SocketAddress *addr = NULL; 380 381 if (vd == NULL || !vd->nlsock) { 382 info->enabled = false; 383 } else { 384 info->enabled = true; 385 386 /* for compatibility with the original command */ 387 info->has_clients = true; 388 info->clients = qmp_query_client_list(vd); 389 390 if (vd->lsock == NULL) { 391 return info; 392 } 393 394 addr = qio_channel_socket_get_local_address(vd->lsock[0], errp); 395 if (!addr) { 396 goto out_error; 397 } 398 399 switch (addr->type) { 400 case SOCKET_ADDRESS_TYPE_INET: 401 info->host = g_strdup(addr->u.inet.host); 402 info->service = g_strdup(addr->u.inet.port); 403 if (addr->u.inet.ipv6) { 404 info->family = NETWORK_ADDRESS_FAMILY_IPV6; 405 } else { 406 info->family = NETWORK_ADDRESS_FAMILY_IPV4; 407 } 408 break; 409 410 case SOCKET_ADDRESS_TYPE_UNIX: 411 info->host = g_strdup(""); 412 info->service = g_strdup(addr->u.q_unix.path); 413 info->family = NETWORK_ADDRESS_FAMILY_UNIX; 414 break; 415 416 case SOCKET_ADDRESS_TYPE_VSOCK: 417 case SOCKET_ADDRESS_TYPE_FD: 418 error_setg(errp, "Unsupported socket address type %s", 419 SocketAddressType_str(addr->type)); 420 goto out_error; 421 default: 422 abort(); 423 } 424 425 info->has_host = true; 426 info->has_service = true; 427 info->has_family = true; 428 429 info->has_auth = true; 430 info->auth = g_strdup(vnc_auth_name(vd)); 431 } 432 433 qapi_free_SocketAddress(addr); 434 return info; 435 436 out_error: 437 qapi_free_SocketAddress(addr); 438 qapi_free_VncInfo(info); 439 return NULL; 440 } 441 442 443 static void qmp_query_auth(int auth, int subauth, 444 VncPrimaryAuth *qmp_auth, 445 VncVencryptSubAuth *qmp_vencrypt, 446 bool *qmp_has_vencrypt); 447 448 static VncServerInfo2List *qmp_query_server_entry(QIOChannelSocket *ioc, 449 bool websocket, 450 int auth, 451 int subauth, 452 VncServerInfo2List *prev) 453 { 454 VncServerInfo2List *list; 455 VncServerInfo2 *info; 456 Error *err = NULL; 457 SocketAddress *addr; 458 459 addr = qio_channel_socket_get_local_address(ioc, &err); 460 if (!addr) { 461 error_free(err); 462 return prev; 463 } 464 465 info = g_new0(VncServerInfo2, 1); 466 vnc_init_basic_info(addr, qapi_VncServerInfo2_base(info), &err); 467 qapi_free_SocketAddress(addr); 468 if (err) { 469 qapi_free_VncServerInfo2(info); 470 error_free(err); 471 return prev; 472 } 473 info->websocket = websocket; 474 475 qmp_query_auth(auth, subauth, &info->auth, 476 &info->vencrypt, &info->has_vencrypt); 477 478 list = g_new0(VncServerInfo2List, 1); 479 list->value = info; 480 list->next = prev; 481 return list; 482 } 483 484 static void qmp_query_auth(int auth, int subauth, 485 VncPrimaryAuth *qmp_auth, 486 VncVencryptSubAuth *qmp_vencrypt, 487 bool *qmp_has_vencrypt) 488 { 489 switch (auth) { 490 case VNC_AUTH_VNC: 491 *qmp_auth = VNC_PRIMARY_AUTH_VNC; 492 break; 493 case VNC_AUTH_RA2: 494 *qmp_auth = VNC_PRIMARY_AUTH_RA2; 495 break; 496 case VNC_AUTH_RA2NE: 497 *qmp_auth = VNC_PRIMARY_AUTH_RA2NE; 498 break; 499 case VNC_AUTH_TIGHT: 500 *qmp_auth = VNC_PRIMARY_AUTH_TIGHT; 501 break; 502 case VNC_AUTH_ULTRA: 503 *qmp_auth = VNC_PRIMARY_AUTH_ULTRA; 504 break; 505 case VNC_AUTH_TLS: 506 *qmp_auth = VNC_PRIMARY_AUTH_TLS; 507 break; 508 case VNC_AUTH_VENCRYPT: 509 *qmp_auth = VNC_PRIMARY_AUTH_VENCRYPT; 510 *qmp_has_vencrypt = true; 511 switch (subauth) { 512 case VNC_AUTH_VENCRYPT_PLAIN: 513 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_PLAIN; 514 break; 515 case VNC_AUTH_VENCRYPT_TLSNONE: 516 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_NONE; 517 break; 518 case VNC_AUTH_VENCRYPT_TLSVNC: 519 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_VNC; 520 break; 521 case VNC_AUTH_VENCRYPT_TLSPLAIN: 522 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_PLAIN; 523 break; 524 case VNC_AUTH_VENCRYPT_X509NONE: 525 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_NONE; 526 break; 527 case VNC_AUTH_VENCRYPT_X509VNC: 528 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_VNC; 529 break; 530 case VNC_AUTH_VENCRYPT_X509PLAIN: 531 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_PLAIN; 532 break; 533 case VNC_AUTH_VENCRYPT_TLSSASL: 534 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_SASL; 535 break; 536 case VNC_AUTH_VENCRYPT_X509SASL: 537 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_SASL; 538 break; 539 default: 540 *qmp_has_vencrypt = false; 541 break; 542 } 543 break; 544 case VNC_AUTH_SASL: 545 *qmp_auth = VNC_PRIMARY_AUTH_SASL; 546 break; 547 case VNC_AUTH_NONE: 548 default: 549 *qmp_auth = VNC_PRIMARY_AUTH_NONE; 550 break; 551 } 552 } 553 554 VncInfo2List *qmp_query_vnc_servers(Error **errp) 555 { 556 VncInfo2List *item, *prev = NULL; 557 VncInfo2 *info; 558 VncDisplay *vd; 559 DeviceState *dev; 560 size_t i; 561 562 QTAILQ_FOREACH(vd, &vnc_displays, next) { 563 info = g_new0(VncInfo2, 1); 564 info->id = g_strdup(vd->id); 565 info->clients = qmp_query_client_list(vd); 566 qmp_query_auth(vd->auth, vd->subauth, &info->auth, 567 &info->vencrypt, &info->has_vencrypt); 568 if (vd->dcl.con) { 569 dev = DEVICE(object_property_get_link(OBJECT(vd->dcl.con), 570 "device", NULL)); 571 info->has_display = true; 572 info->display = g_strdup(dev->id); 573 } 574 for (i = 0; i < vd->nlsock; i++) { 575 info->server = qmp_query_server_entry( 576 vd->lsock[i], false, vd->auth, vd->subauth, info->server); 577 } 578 for (i = 0; i < vd->nlwebsock; i++) { 579 info->server = qmp_query_server_entry( 580 vd->lwebsock[i], true, vd->ws_auth, 581 vd->ws_subauth, info->server); 582 } 583 584 item = g_new0(VncInfo2List, 1); 585 item->value = info; 586 item->next = prev; 587 prev = item; 588 } 589 return prev; 590 } 591 592 /* TODO 593 1) Get the queue working for IO. 594 2) there is some weirdness when using the -S option (the screen is grey 595 and not totally invalidated 596 3) resolutions > 1024 597 */ 598 599 static int vnc_update_client(VncState *vs, int has_dirty, bool sync); 600 static void vnc_disconnect_start(VncState *vs); 601 602 static void vnc_colordepth(VncState *vs); 603 static void framebuffer_update_request(VncState *vs, int incremental, 604 int x_position, int y_position, 605 int w, int h); 606 static void vnc_refresh(DisplayChangeListener *dcl); 607 static int vnc_refresh_server_surface(VncDisplay *vd); 608 609 static int vnc_width(VncDisplay *vd) 610 { 611 return MIN(VNC_MAX_WIDTH, ROUND_UP(surface_width(vd->ds), 612 VNC_DIRTY_PIXELS_PER_BIT)); 613 } 614 615 static int vnc_height(VncDisplay *vd) 616 { 617 return MIN(VNC_MAX_HEIGHT, surface_height(vd->ds)); 618 } 619 620 static void vnc_set_area_dirty(DECLARE_BITMAP(dirty[VNC_MAX_HEIGHT], 621 VNC_MAX_WIDTH / VNC_DIRTY_PIXELS_PER_BIT), 622 VncDisplay *vd, 623 int x, int y, int w, int h) 624 { 625 int width = vnc_width(vd); 626 int height = vnc_height(vd); 627 628 /* this is needed this to ensure we updated all affected 629 * blocks if x % VNC_DIRTY_PIXELS_PER_BIT != 0 */ 630 w += (x % VNC_DIRTY_PIXELS_PER_BIT); 631 x -= (x % VNC_DIRTY_PIXELS_PER_BIT); 632 633 x = MIN(x, width); 634 y = MIN(y, height); 635 w = MIN(x + w, width) - x; 636 h = MIN(y + h, height); 637 638 for (; y < h; y++) { 639 bitmap_set(dirty[y], x / VNC_DIRTY_PIXELS_PER_BIT, 640 DIV_ROUND_UP(w, VNC_DIRTY_PIXELS_PER_BIT)); 641 } 642 } 643 644 static void vnc_dpy_update(DisplayChangeListener *dcl, 645 int x, int y, int w, int h) 646 { 647 VncDisplay *vd = container_of(dcl, VncDisplay, dcl); 648 struct VncSurface *s = &vd->guest; 649 650 vnc_set_area_dirty(s->dirty, vd, x, y, w, h); 651 } 652 653 void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h, 654 int32_t encoding) 655 { 656 vnc_write_u16(vs, x); 657 vnc_write_u16(vs, y); 658 vnc_write_u16(vs, w); 659 vnc_write_u16(vs, h); 660 661 vnc_write_s32(vs, encoding); 662 } 663 664 665 static void vnc_desktop_resize(VncState *vs) 666 { 667 if (vs->ioc == NULL || !vnc_has_feature(vs, VNC_FEATURE_RESIZE)) { 668 return; 669 } 670 if (vs->client_width == pixman_image_get_width(vs->vd->server) && 671 vs->client_height == pixman_image_get_height(vs->vd->server)) { 672 return; 673 } 674 vs->client_width = pixman_image_get_width(vs->vd->server); 675 vs->client_height = pixman_image_get_height(vs->vd->server); 676 vnc_lock_output(vs); 677 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 678 vnc_write_u8(vs, 0); 679 vnc_write_u16(vs, 1); /* number of rects */ 680 vnc_framebuffer_update(vs, 0, 0, vs->client_width, vs->client_height, 681 VNC_ENCODING_DESKTOPRESIZE); 682 vnc_unlock_output(vs); 683 vnc_flush(vs); 684 } 685 686 static void vnc_abort_display_jobs(VncDisplay *vd) 687 { 688 VncState *vs; 689 690 QTAILQ_FOREACH(vs, &vd->clients, next) { 691 vnc_lock_output(vs); 692 vs->abort = true; 693 vnc_unlock_output(vs); 694 } 695 QTAILQ_FOREACH(vs, &vd->clients, next) { 696 vnc_jobs_join(vs); 697 } 698 QTAILQ_FOREACH(vs, &vd->clients, next) { 699 vnc_lock_output(vs); 700 vs->abort = false; 701 vnc_unlock_output(vs); 702 } 703 } 704 705 int vnc_server_fb_stride(VncDisplay *vd) 706 { 707 return pixman_image_get_stride(vd->server); 708 } 709 710 void *vnc_server_fb_ptr(VncDisplay *vd, int x, int y) 711 { 712 uint8_t *ptr; 713 714 ptr = (uint8_t *)pixman_image_get_data(vd->server); 715 ptr += y * vnc_server_fb_stride(vd); 716 ptr += x * VNC_SERVER_FB_BYTES; 717 return ptr; 718 } 719 720 static void vnc_update_server_surface(VncDisplay *vd) 721 { 722 int width, height; 723 724 qemu_pixman_image_unref(vd->server); 725 vd->server = NULL; 726 727 if (QTAILQ_EMPTY(&vd->clients)) { 728 return; 729 } 730 731 width = vnc_width(vd); 732 height = vnc_height(vd); 733 vd->server = pixman_image_create_bits(VNC_SERVER_FB_FORMAT, 734 width, height, 735 NULL, 0); 736 737 memset(vd->guest.dirty, 0x00, sizeof(vd->guest.dirty)); 738 vnc_set_area_dirty(vd->guest.dirty, vd, 0, 0, 739 width, height); 740 } 741 742 static void vnc_dpy_switch(DisplayChangeListener *dcl, 743 DisplaySurface *surface) 744 { 745 VncDisplay *vd = container_of(dcl, VncDisplay, dcl); 746 VncState *vs; 747 748 vnc_abort_display_jobs(vd); 749 vd->ds = surface; 750 751 /* server surface */ 752 vnc_update_server_surface(vd); 753 754 /* guest surface */ 755 qemu_pixman_image_unref(vd->guest.fb); 756 vd->guest.fb = pixman_image_ref(surface->image); 757 vd->guest.format = surface->format; 758 759 QTAILQ_FOREACH(vs, &vd->clients, next) { 760 vnc_colordepth(vs); 761 vnc_desktop_resize(vs); 762 if (vs->vd->cursor) { 763 vnc_cursor_define(vs); 764 } 765 memset(vs->dirty, 0x00, sizeof(vs->dirty)); 766 vnc_set_area_dirty(vs->dirty, vd, 0, 0, 767 vnc_width(vd), 768 vnc_height(vd)); 769 } 770 } 771 772 /* fastest code */ 773 static void vnc_write_pixels_copy(VncState *vs, 774 void *pixels, int size) 775 { 776 vnc_write(vs, pixels, size); 777 } 778 779 /* slowest but generic code. */ 780 void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v) 781 { 782 uint8_t r, g, b; 783 784 #if VNC_SERVER_FB_FORMAT == PIXMAN_FORMAT(32, PIXMAN_TYPE_ARGB, 0, 8, 8, 8) 785 r = (((v & 0x00ff0000) >> 16) << vs->client_pf.rbits) >> 8; 786 g = (((v & 0x0000ff00) >> 8) << vs->client_pf.gbits) >> 8; 787 b = (((v & 0x000000ff) >> 0) << vs->client_pf.bbits) >> 8; 788 #else 789 # error need some bits here if you change VNC_SERVER_FB_FORMAT 790 #endif 791 v = (r << vs->client_pf.rshift) | 792 (g << vs->client_pf.gshift) | 793 (b << vs->client_pf.bshift); 794 switch (vs->client_pf.bytes_per_pixel) { 795 case 1: 796 buf[0] = v; 797 break; 798 case 2: 799 if (vs->client_be) { 800 buf[0] = v >> 8; 801 buf[1] = v; 802 } else { 803 buf[1] = v >> 8; 804 buf[0] = v; 805 } 806 break; 807 default: 808 case 4: 809 if (vs->client_be) { 810 buf[0] = v >> 24; 811 buf[1] = v >> 16; 812 buf[2] = v >> 8; 813 buf[3] = v; 814 } else { 815 buf[3] = v >> 24; 816 buf[2] = v >> 16; 817 buf[1] = v >> 8; 818 buf[0] = v; 819 } 820 break; 821 } 822 } 823 824 static void vnc_write_pixels_generic(VncState *vs, 825 void *pixels1, int size) 826 { 827 uint8_t buf[4]; 828 829 if (VNC_SERVER_FB_BYTES == 4) { 830 uint32_t *pixels = pixels1; 831 int n, i; 832 n = size >> 2; 833 for (i = 0; i < n; i++) { 834 vnc_convert_pixel(vs, buf, pixels[i]); 835 vnc_write(vs, buf, vs->client_pf.bytes_per_pixel); 836 } 837 } 838 } 839 840 int vnc_raw_send_framebuffer_update(VncState *vs, int x, int y, int w, int h) 841 { 842 int i; 843 uint8_t *row; 844 VncDisplay *vd = vs->vd; 845 846 row = vnc_server_fb_ptr(vd, x, y); 847 for (i = 0; i < h; i++) { 848 vs->write_pixels(vs, row, w * VNC_SERVER_FB_BYTES); 849 row += vnc_server_fb_stride(vd); 850 } 851 return 1; 852 } 853 854 int vnc_send_framebuffer_update(VncState *vs, int x, int y, int w, int h) 855 { 856 int n = 0; 857 bool encode_raw = false; 858 size_t saved_offs = vs->output.offset; 859 860 switch(vs->vnc_encoding) { 861 case VNC_ENCODING_ZLIB: 862 n = vnc_zlib_send_framebuffer_update(vs, x, y, w, h); 863 break; 864 case VNC_ENCODING_HEXTILE: 865 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE); 866 n = vnc_hextile_send_framebuffer_update(vs, x, y, w, h); 867 break; 868 case VNC_ENCODING_TIGHT: 869 n = vnc_tight_send_framebuffer_update(vs, x, y, w, h); 870 break; 871 case VNC_ENCODING_TIGHT_PNG: 872 n = vnc_tight_png_send_framebuffer_update(vs, x, y, w, h); 873 break; 874 case VNC_ENCODING_ZRLE: 875 n = vnc_zrle_send_framebuffer_update(vs, x, y, w, h); 876 break; 877 case VNC_ENCODING_ZYWRLE: 878 n = vnc_zywrle_send_framebuffer_update(vs, x, y, w, h); 879 break; 880 default: 881 encode_raw = true; 882 break; 883 } 884 885 /* If the client has the same pixel format as our internal buffer and 886 * a RAW encoding would need less space fall back to RAW encoding to 887 * save bandwidth and processing power in the client. */ 888 if (!encode_raw && vs->write_pixels == vnc_write_pixels_copy && 889 12 + h * w * VNC_SERVER_FB_BYTES <= (vs->output.offset - saved_offs)) { 890 vs->output.offset = saved_offs; 891 encode_raw = true; 892 } 893 894 if (encode_raw) { 895 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW); 896 n = vnc_raw_send_framebuffer_update(vs, x, y, w, h); 897 } 898 899 return n; 900 } 901 902 static void vnc_mouse_set(DisplayChangeListener *dcl, 903 int x, int y, int visible) 904 { 905 /* can we ask the client(s) to move the pointer ??? */ 906 } 907 908 static int vnc_cursor_define(VncState *vs) 909 { 910 QEMUCursor *c = vs->vd->cursor; 911 int isize; 912 913 if (vnc_has_feature(vs, VNC_FEATURE_RICH_CURSOR)) { 914 vnc_lock_output(vs); 915 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 916 vnc_write_u8(vs, 0); /* padding */ 917 vnc_write_u16(vs, 1); /* # of rects */ 918 vnc_framebuffer_update(vs, c->hot_x, c->hot_y, c->width, c->height, 919 VNC_ENCODING_RICH_CURSOR); 920 isize = c->width * c->height * vs->client_pf.bytes_per_pixel; 921 vnc_write_pixels_generic(vs, c->data, isize); 922 vnc_write(vs, vs->vd->cursor_mask, vs->vd->cursor_msize); 923 vnc_unlock_output(vs); 924 return 0; 925 } 926 return -1; 927 } 928 929 static void vnc_dpy_cursor_define(DisplayChangeListener *dcl, 930 QEMUCursor *c) 931 { 932 VncDisplay *vd = container_of(dcl, VncDisplay, dcl); 933 VncState *vs; 934 935 cursor_put(vd->cursor); 936 g_free(vd->cursor_mask); 937 938 vd->cursor = c; 939 cursor_get(vd->cursor); 940 vd->cursor_msize = cursor_get_mono_bpl(c) * c->height; 941 vd->cursor_mask = g_malloc0(vd->cursor_msize); 942 cursor_get_mono_mask(c, 0, vd->cursor_mask); 943 944 QTAILQ_FOREACH(vs, &vd->clients, next) { 945 vnc_cursor_define(vs); 946 } 947 } 948 949 static int find_and_clear_dirty_height(VncState *vs, 950 int y, int last_x, int x, int height) 951 { 952 int h; 953 954 for (h = 1; h < (height - y); h++) { 955 if (!test_bit(last_x, vs->dirty[y + h])) { 956 break; 957 } 958 bitmap_clear(vs->dirty[y + h], last_x, x - last_x); 959 } 960 961 return h; 962 } 963 964 static int vnc_update_client(VncState *vs, int has_dirty, bool sync) 965 { 966 if (vs->disconnecting) { 967 vnc_disconnect_finish(vs); 968 return 0; 969 } 970 971 vs->has_dirty += has_dirty; 972 if (vs->need_update && !vs->disconnecting) { 973 VncDisplay *vd = vs->vd; 974 VncJob *job; 975 int y; 976 int height, width; 977 int n = 0; 978 979 if (vs->output.offset && !vs->audio_cap && !vs->force_update) 980 /* kernel send buffers are full -> drop frames to throttle */ 981 return 0; 982 983 if (!vs->has_dirty && !vs->audio_cap && !vs->force_update) 984 return 0; 985 986 /* 987 * Send screen updates to the vnc client using the server 988 * surface and server dirty map. guest surface updates 989 * happening in parallel don't disturb us, the next pass will 990 * send them to the client. 991 */ 992 job = vnc_job_new(vs); 993 994 height = pixman_image_get_height(vd->server); 995 width = pixman_image_get_width(vd->server); 996 997 y = 0; 998 for (;;) { 999 int x, h; 1000 unsigned long x2; 1001 unsigned long offset = find_next_bit((unsigned long *) &vs->dirty, 1002 height * VNC_DIRTY_BPL(vs), 1003 y * VNC_DIRTY_BPL(vs)); 1004 if (offset == height * VNC_DIRTY_BPL(vs)) { 1005 /* no more dirty bits */ 1006 break; 1007 } 1008 y = offset / VNC_DIRTY_BPL(vs); 1009 x = offset % VNC_DIRTY_BPL(vs); 1010 x2 = find_next_zero_bit((unsigned long *) &vs->dirty[y], 1011 VNC_DIRTY_BPL(vs), x); 1012 bitmap_clear(vs->dirty[y], x, x2 - x); 1013 h = find_and_clear_dirty_height(vs, y, x, x2, height); 1014 x2 = MIN(x2, width / VNC_DIRTY_PIXELS_PER_BIT); 1015 if (x2 > x) { 1016 n += vnc_job_add_rect(job, x * VNC_DIRTY_PIXELS_PER_BIT, y, 1017 (x2 - x) * VNC_DIRTY_PIXELS_PER_BIT, h); 1018 } 1019 if (!x && x2 == width / VNC_DIRTY_PIXELS_PER_BIT) { 1020 y += h; 1021 if (y == height) { 1022 break; 1023 } 1024 } 1025 } 1026 1027 vnc_job_push(job); 1028 if (sync) { 1029 vnc_jobs_join(vs); 1030 } 1031 vs->force_update = 0; 1032 vs->has_dirty = 0; 1033 return n; 1034 } 1035 1036 if (vs->disconnecting) { 1037 vnc_disconnect_finish(vs); 1038 } else if (sync) { 1039 vnc_jobs_join(vs); 1040 } 1041 1042 return 0; 1043 } 1044 1045 /* audio */ 1046 static void audio_capture_notify(void *opaque, audcnotification_e cmd) 1047 { 1048 VncState *vs = opaque; 1049 1050 switch (cmd) { 1051 case AUD_CNOTIFY_DISABLE: 1052 vnc_lock_output(vs); 1053 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU); 1054 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO); 1055 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_END); 1056 vnc_unlock_output(vs); 1057 vnc_flush(vs); 1058 break; 1059 1060 case AUD_CNOTIFY_ENABLE: 1061 vnc_lock_output(vs); 1062 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU); 1063 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO); 1064 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_BEGIN); 1065 vnc_unlock_output(vs); 1066 vnc_flush(vs); 1067 break; 1068 } 1069 } 1070 1071 static void audio_capture_destroy(void *opaque) 1072 { 1073 } 1074 1075 static void audio_capture(void *opaque, void *buf, int size) 1076 { 1077 VncState *vs = opaque; 1078 1079 vnc_lock_output(vs); 1080 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU); 1081 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO); 1082 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_DATA); 1083 vnc_write_u32(vs, size); 1084 vnc_write(vs, buf, size); 1085 vnc_unlock_output(vs); 1086 vnc_flush(vs); 1087 } 1088 1089 static void audio_add(VncState *vs) 1090 { 1091 struct audio_capture_ops ops; 1092 1093 if (vs->audio_cap) { 1094 error_report("audio already running"); 1095 return; 1096 } 1097 1098 ops.notify = audio_capture_notify; 1099 ops.destroy = audio_capture_destroy; 1100 ops.capture = audio_capture; 1101 1102 vs->audio_cap = AUD_add_capture(&vs->as, &ops, vs); 1103 if (!vs->audio_cap) { 1104 error_report("Failed to add audio capture"); 1105 } 1106 } 1107 1108 static void audio_del(VncState *vs) 1109 { 1110 if (vs->audio_cap) { 1111 AUD_del_capture(vs->audio_cap, vs); 1112 vs->audio_cap = NULL; 1113 } 1114 } 1115 1116 static void vnc_disconnect_start(VncState *vs) 1117 { 1118 if (vs->disconnecting) { 1119 return; 1120 } 1121 trace_vnc_client_disconnect_start(vs, vs->ioc); 1122 vnc_set_share_mode(vs, VNC_SHARE_MODE_DISCONNECTED); 1123 if (vs->ioc_tag) { 1124 g_source_remove(vs->ioc_tag); 1125 vs->ioc_tag = 0; 1126 } 1127 qio_channel_close(vs->ioc, NULL); 1128 vs->disconnecting = TRUE; 1129 } 1130 1131 void vnc_disconnect_finish(VncState *vs) 1132 { 1133 int i; 1134 1135 trace_vnc_client_disconnect_finish(vs, vs->ioc); 1136 1137 vnc_jobs_join(vs); /* Wait encoding jobs */ 1138 1139 vnc_lock_output(vs); 1140 vnc_qmp_event(vs, QAPI_EVENT_VNC_DISCONNECTED); 1141 1142 buffer_free(&vs->input); 1143 buffer_free(&vs->output); 1144 1145 qapi_free_VncClientInfo(vs->info); 1146 1147 vnc_zlib_clear(vs); 1148 vnc_tight_clear(vs); 1149 vnc_zrle_clear(vs); 1150 1151 #ifdef CONFIG_VNC_SASL 1152 vnc_sasl_client_cleanup(vs); 1153 #endif /* CONFIG_VNC_SASL */ 1154 audio_del(vs); 1155 vnc_release_modifiers(vs); 1156 1157 if (vs->mouse_mode_notifier.notify != NULL) { 1158 qemu_remove_mouse_mode_change_notifier(&vs->mouse_mode_notifier); 1159 } 1160 QTAILQ_REMOVE(&vs->vd->clients, vs, next); 1161 if (QTAILQ_EMPTY(&vs->vd->clients)) { 1162 /* last client gone */ 1163 vnc_update_server_surface(vs->vd); 1164 } 1165 1166 vnc_unlock_output(vs); 1167 1168 qemu_mutex_destroy(&vs->output_mutex); 1169 if (vs->bh != NULL) { 1170 qemu_bh_delete(vs->bh); 1171 } 1172 buffer_free(&vs->jobs_buffer); 1173 1174 for (i = 0; i < VNC_STAT_ROWS; ++i) { 1175 g_free(vs->lossy_rect[i]); 1176 } 1177 g_free(vs->lossy_rect); 1178 1179 object_unref(OBJECT(vs->ioc)); 1180 vs->ioc = NULL; 1181 object_unref(OBJECT(vs->sioc)); 1182 vs->sioc = NULL; 1183 g_free(vs); 1184 } 1185 1186 ssize_t vnc_client_io_error(VncState *vs, ssize_t ret, Error **errp) 1187 { 1188 if (ret <= 0) { 1189 if (ret == 0) { 1190 trace_vnc_client_eof(vs, vs->ioc); 1191 vnc_disconnect_start(vs); 1192 } else if (ret != QIO_CHANNEL_ERR_BLOCK) { 1193 trace_vnc_client_io_error(vs, vs->ioc, 1194 errp ? error_get_pretty(*errp) : 1195 "Unknown"); 1196 vnc_disconnect_start(vs); 1197 } 1198 1199 if (errp) { 1200 error_free(*errp); 1201 *errp = NULL; 1202 } 1203 return 0; 1204 } 1205 return ret; 1206 } 1207 1208 1209 void vnc_client_error(VncState *vs) 1210 { 1211 VNC_DEBUG("Closing down client sock: protocol error\n"); 1212 vnc_disconnect_start(vs); 1213 } 1214 1215 1216 /* 1217 * Called to write a chunk of data to the client socket. The data may 1218 * be the raw data, or may have already been encoded by SASL. 1219 * The data will be written either straight onto the socket, or 1220 * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled 1221 * 1222 * NB, it is theoretically possible to have 2 layers of encryption, 1223 * both SASL, and this TLS layer. It is highly unlikely in practice 1224 * though, since SASL encryption will typically be a no-op if TLS 1225 * is active 1226 * 1227 * Returns the number of bytes written, which may be less than 1228 * the requested 'datalen' if the socket would block. Returns 1229 * -1 on error, and disconnects the client socket. 1230 */ 1231 ssize_t vnc_client_write_buf(VncState *vs, const uint8_t *data, size_t datalen) 1232 { 1233 Error *err = NULL; 1234 ssize_t ret; 1235 ret = qio_channel_write( 1236 vs->ioc, (const char *)data, datalen, &err); 1237 VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data, datalen, ret); 1238 return vnc_client_io_error(vs, ret, &err); 1239 } 1240 1241 1242 /* 1243 * Called to write buffered data to the client socket, when not 1244 * using any SASL SSF encryption layers. Will write as much data 1245 * as possible without blocking. If all buffered data is written, 1246 * will switch the FD poll() handler back to read monitoring. 1247 * 1248 * Returns the number of bytes written, which may be less than 1249 * the buffered output data if the socket would block. Returns 1250 * -1 on error, and disconnects the client socket. 1251 */ 1252 static ssize_t vnc_client_write_plain(VncState *vs) 1253 { 1254 ssize_t ret; 1255 1256 #ifdef CONFIG_VNC_SASL 1257 VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n", 1258 vs->output.buffer, vs->output.capacity, vs->output.offset, 1259 vs->sasl.waitWriteSSF); 1260 1261 if (vs->sasl.conn && 1262 vs->sasl.runSSF && 1263 vs->sasl.waitWriteSSF) { 1264 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF); 1265 if (ret) 1266 vs->sasl.waitWriteSSF -= ret; 1267 } else 1268 #endif /* CONFIG_VNC_SASL */ 1269 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset); 1270 if (!ret) 1271 return 0; 1272 1273 buffer_advance(&vs->output, ret); 1274 1275 if (vs->output.offset == 0) { 1276 if (vs->ioc_tag) { 1277 g_source_remove(vs->ioc_tag); 1278 } 1279 vs->ioc_tag = qio_channel_add_watch( 1280 vs->ioc, G_IO_IN, vnc_client_io, vs, NULL); 1281 } 1282 1283 return ret; 1284 } 1285 1286 1287 /* 1288 * First function called whenever there is data to be written to 1289 * the client socket. Will delegate actual work according to whether 1290 * SASL SSF layers are enabled (thus requiring encryption calls) 1291 */ 1292 static void vnc_client_write_locked(VncState *vs) 1293 { 1294 #ifdef CONFIG_VNC_SASL 1295 if (vs->sasl.conn && 1296 vs->sasl.runSSF && 1297 !vs->sasl.waitWriteSSF) { 1298 vnc_client_write_sasl(vs); 1299 } else 1300 #endif /* CONFIG_VNC_SASL */ 1301 { 1302 vnc_client_write_plain(vs); 1303 } 1304 } 1305 1306 static void vnc_client_write(VncState *vs) 1307 { 1308 1309 vnc_lock_output(vs); 1310 if (vs->output.offset) { 1311 vnc_client_write_locked(vs); 1312 } else if (vs->ioc != NULL) { 1313 if (vs->ioc_tag) { 1314 g_source_remove(vs->ioc_tag); 1315 } 1316 vs->ioc_tag = qio_channel_add_watch( 1317 vs->ioc, G_IO_IN, vnc_client_io, vs, NULL); 1318 } 1319 vnc_unlock_output(vs); 1320 } 1321 1322 void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting) 1323 { 1324 vs->read_handler = func; 1325 vs->read_handler_expect = expecting; 1326 } 1327 1328 1329 /* 1330 * Called to read a chunk of data from the client socket. The data may 1331 * be the raw data, or may need to be further decoded by SASL. 1332 * The data will be read either straight from to the socket, or 1333 * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled 1334 * 1335 * NB, it is theoretically possible to have 2 layers of encryption, 1336 * both SASL, and this TLS layer. It is highly unlikely in practice 1337 * though, since SASL encryption will typically be a no-op if TLS 1338 * is active 1339 * 1340 * Returns the number of bytes read, which may be less than 1341 * the requested 'datalen' if the socket would block. Returns 1342 * -1 on error, and disconnects the client socket. 1343 */ 1344 ssize_t vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen) 1345 { 1346 ssize_t ret; 1347 Error *err = NULL; 1348 ret = qio_channel_read( 1349 vs->ioc, (char *)data, datalen, &err); 1350 VNC_DEBUG("Read wire %p %zd -> %ld\n", data, datalen, ret); 1351 return vnc_client_io_error(vs, ret, &err); 1352 } 1353 1354 1355 /* 1356 * Called to read data from the client socket to the input buffer, 1357 * when not using any SASL SSF encryption layers. Will read as much 1358 * data as possible without blocking. 1359 * 1360 * Returns the number of bytes read. Returns -1 on error, and 1361 * disconnects the client socket. 1362 */ 1363 static ssize_t vnc_client_read_plain(VncState *vs) 1364 { 1365 ssize_t ret; 1366 VNC_DEBUG("Read plain %p size %zd offset %zd\n", 1367 vs->input.buffer, vs->input.capacity, vs->input.offset); 1368 buffer_reserve(&vs->input, 4096); 1369 ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096); 1370 if (!ret) 1371 return 0; 1372 vs->input.offset += ret; 1373 return ret; 1374 } 1375 1376 static void vnc_jobs_bh(void *opaque) 1377 { 1378 VncState *vs = opaque; 1379 1380 vnc_jobs_consume_buffer(vs); 1381 } 1382 1383 /* 1384 * First function called whenever there is more data to be read from 1385 * the client socket. Will delegate actual work according to whether 1386 * SASL SSF layers are enabled (thus requiring decryption calls) 1387 * Returns 0 on success, -1 if client disconnected 1388 */ 1389 static int vnc_client_read(VncState *vs) 1390 { 1391 ssize_t ret; 1392 1393 #ifdef CONFIG_VNC_SASL 1394 if (vs->sasl.conn && vs->sasl.runSSF) 1395 ret = vnc_client_read_sasl(vs); 1396 else 1397 #endif /* CONFIG_VNC_SASL */ 1398 ret = vnc_client_read_plain(vs); 1399 if (!ret) { 1400 if (vs->disconnecting) { 1401 vnc_disconnect_finish(vs); 1402 return -1; 1403 } 1404 return 0; 1405 } 1406 1407 while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) { 1408 size_t len = vs->read_handler_expect; 1409 int ret; 1410 1411 ret = vs->read_handler(vs, vs->input.buffer, len); 1412 if (vs->disconnecting) { 1413 vnc_disconnect_finish(vs); 1414 return -1; 1415 } 1416 1417 if (!ret) { 1418 buffer_advance(&vs->input, len); 1419 } else { 1420 vs->read_handler_expect = ret; 1421 } 1422 } 1423 return 0; 1424 } 1425 1426 gboolean vnc_client_io(QIOChannel *ioc G_GNUC_UNUSED, 1427 GIOCondition condition, void *opaque) 1428 { 1429 VncState *vs = opaque; 1430 if (condition & G_IO_IN) { 1431 if (vnc_client_read(vs) < 0) { 1432 return TRUE; 1433 } 1434 } 1435 if (condition & G_IO_OUT) { 1436 vnc_client_write(vs); 1437 } 1438 return TRUE; 1439 } 1440 1441 1442 void vnc_write(VncState *vs, const void *data, size_t len) 1443 { 1444 buffer_reserve(&vs->output, len); 1445 1446 if (vs->ioc != NULL && buffer_empty(&vs->output)) { 1447 if (vs->ioc_tag) { 1448 g_source_remove(vs->ioc_tag); 1449 } 1450 vs->ioc_tag = qio_channel_add_watch( 1451 vs->ioc, G_IO_IN | G_IO_OUT, vnc_client_io, vs, NULL); 1452 } 1453 1454 buffer_append(&vs->output, data, len); 1455 } 1456 1457 void vnc_write_s32(VncState *vs, int32_t value) 1458 { 1459 vnc_write_u32(vs, *(uint32_t *)&value); 1460 } 1461 1462 void vnc_write_u32(VncState *vs, uint32_t value) 1463 { 1464 uint8_t buf[4]; 1465 1466 buf[0] = (value >> 24) & 0xFF; 1467 buf[1] = (value >> 16) & 0xFF; 1468 buf[2] = (value >> 8) & 0xFF; 1469 buf[3] = value & 0xFF; 1470 1471 vnc_write(vs, buf, 4); 1472 } 1473 1474 void vnc_write_u16(VncState *vs, uint16_t value) 1475 { 1476 uint8_t buf[2]; 1477 1478 buf[0] = (value >> 8) & 0xFF; 1479 buf[1] = value & 0xFF; 1480 1481 vnc_write(vs, buf, 2); 1482 } 1483 1484 void vnc_write_u8(VncState *vs, uint8_t value) 1485 { 1486 vnc_write(vs, (char *)&value, 1); 1487 } 1488 1489 void vnc_flush(VncState *vs) 1490 { 1491 vnc_lock_output(vs); 1492 if (vs->ioc != NULL && vs->output.offset) { 1493 vnc_client_write_locked(vs); 1494 } 1495 vnc_unlock_output(vs); 1496 } 1497 1498 static uint8_t read_u8(uint8_t *data, size_t offset) 1499 { 1500 return data[offset]; 1501 } 1502 1503 static uint16_t read_u16(uint8_t *data, size_t offset) 1504 { 1505 return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF); 1506 } 1507 1508 static int32_t read_s32(uint8_t *data, size_t offset) 1509 { 1510 return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) | 1511 (data[offset + 2] << 8) | data[offset + 3]); 1512 } 1513 1514 uint32_t read_u32(uint8_t *data, size_t offset) 1515 { 1516 return ((data[offset] << 24) | (data[offset + 1] << 16) | 1517 (data[offset + 2] << 8) | data[offset + 3]); 1518 } 1519 1520 static void client_cut_text(VncState *vs, size_t len, uint8_t *text) 1521 { 1522 } 1523 1524 static void check_pointer_type_change(Notifier *notifier, void *data) 1525 { 1526 VncState *vs = container_of(notifier, VncState, mouse_mode_notifier); 1527 int absolute = qemu_input_is_absolute(); 1528 1529 if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) { 1530 vnc_lock_output(vs); 1531 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 1532 vnc_write_u8(vs, 0); 1533 vnc_write_u16(vs, 1); 1534 vnc_framebuffer_update(vs, absolute, 0, 1535 pixman_image_get_width(vs->vd->server), 1536 pixman_image_get_height(vs->vd->server), 1537 VNC_ENCODING_POINTER_TYPE_CHANGE); 1538 vnc_unlock_output(vs); 1539 vnc_flush(vs); 1540 } 1541 vs->absolute = absolute; 1542 } 1543 1544 static void pointer_event(VncState *vs, int button_mask, int x, int y) 1545 { 1546 static uint32_t bmap[INPUT_BUTTON__MAX] = { 1547 [INPUT_BUTTON_LEFT] = 0x01, 1548 [INPUT_BUTTON_MIDDLE] = 0x02, 1549 [INPUT_BUTTON_RIGHT] = 0x04, 1550 [INPUT_BUTTON_WHEEL_UP] = 0x08, 1551 [INPUT_BUTTON_WHEEL_DOWN] = 0x10, 1552 }; 1553 QemuConsole *con = vs->vd->dcl.con; 1554 int width = pixman_image_get_width(vs->vd->server); 1555 int height = pixman_image_get_height(vs->vd->server); 1556 1557 if (vs->last_bmask != button_mask) { 1558 qemu_input_update_buttons(con, bmap, vs->last_bmask, button_mask); 1559 vs->last_bmask = button_mask; 1560 } 1561 1562 if (vs->absolute) { 1563 qemu_input_queue_abs(con, INPUT_AXIS_X, x, 0, width); 1564 qemu_input_queue_abs(con, INPUT_AXIS_Y, y, 0, height); 1565 } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) { 1566 qemu_input_queue_rel(con, INPUT_AXIS_X, x - 0x7FFF); 1567 qemu_input_queue_rel(con, INPUT_AXIS_Y, y - 0x7FFF); 1568 } else { 1569 if (vs->last_x != -1) { 1570 qemu_input_queue_rel(con, INPUT_AXIS_X, x - vs->last_x); 1571 qemu_input_queue_rel(con, INPUT_AXIS_Y, y - vs->last_y); 1572 } 1573 vs->last_x = x; 1574 vs->last_y = y; 1575 } 1576 qemu_input_event_sync(); 1577 } 1578 1579 static void reset_keys(VncState *vs) 1580 { 1581 int i; 1582 for(i = 0; i < 256; i++) { 1583 if (vs->modifiers_state[i]) { 1584 qemu_input_event_send_key_number(vs->vd->dcl.con, i, false); 1585 qemu_input_event_send_key_delay(vs->vd->key_delay_ms); 1586 vs->modifiers_state[i] = 0; 1587 } 1588 } 1589 } 1590 1591 static void press_key(VncState *vs, int keysym) 1592 { 1593 int keycode = keysym2scancode(vs->vd->kbd_layout, keysym) & SCANCODE_KEYMASK; 1594 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, true); 1595 qemu_input_event_send_key_delay(vs->vd->key_delay_ms); 1596 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, false); 1597 qemu_input_event_send_key_delay(vs->vd->key_delay_ms); 1598 } 1599 1600 static void vnc_led_state_change(VncState *vs) 1601 { 1602 if (!vnc_has_feature(vs, VNC_FEATURE_LED_STATE)) { 1603 return; 1604 } 1605 1606 vnc_lock_output(vs); 1607 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 1608 vnc_write_u8(vs, 0); 1609 vnc_write_u16(vs, 1); 1610 vnc_framebuffer_update(vs, 0, 0, 1, 1, VNC_ENCODING_LED_STATE); 1611 vnc_write_u8(vs, vs->vd->ledstate); 1612 vnc_unlock_output(vs); 1613 vnc_flush(vs); 1614 } 1615 1616 static void kbd_leds(void *opaque, int ledstate) 1617 { 1618 VncDisplay *vd = opaque; 1619 VncState *client; 1620 1621 trace_vnc_key_guest_leds((ledstate & QEMU_CAPS_LOCK_LED), 1622 (ledstate & QEMU_NUM_LOCK_LED), 1623 (ledstate & QEMU_SCROLL_LOCK_LED)); 1624 1625 if (ledstate == vd->ledstate) { 1626 return; 1627 } 1628 1629 vd->ledstate = ledstate; 1630 1631 QTAILQ_FOREACH(client, &vd->clients, next) { 1632 vnc_led_state_change(client); 1633 } 1634 } 1635 1636 static void do_key_event(VncState *vs, int down, int keycode, int sym) 1637 { 1638 /* QEMU console switch */ 1639 switch(keycode) { 1640 case 0x2a: /* Left Shift */ 1641 case 0x36: /* Right Shift */ 1642 case 0x1d: /* Left CTRL */ 1643 case 0x9d: /* Right CTRL */ 1644 case 0x38: /* Left ALT */ 1645 case 0xb8: /* Right ALT */ 1646 if (down) 1647 vs->modifiers_state[keycode] = 1; 1648 else 1649 vs->modifiers_state[keycode] = 0; 1650 break; 1651 case 0x02 ... 0x0a: /* '1' to '9' keys */ 1652 if (vs->vd->dcl.con == NULL && 1653 down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) { 1654 /* Reset the modifiers sent to the current console */ 1655 reset_keys(vs); 1656 console_select(keycode - 0x02); 1657 return; 1658 } 1659 break; 1660 case 0x3a: /* CapsLock */ 1661 case 0x45: /* NumLock */ 1662 if (down) 1663 vs->modifiers_state[keycode] ^= 1; 1664 break; 1665 } 1666 1667 /* Turn off the lock state sync logic if the client support the led 1668 state extension. 1669 */ 1670 if (down && vs->vd->lock_key_sync && 1671 !vnc_has_feature(vs, VNC_FEATURE_LED_STATE) && 1672 keycode_is_keypad(vs->vd->kbd_layout, keycode)) { 1673 /* If the numlock state needs to change then simulate an additional 1674 keypress before sending this one. This will happen if the user 1675 toggles numlock away from the VNC window. 1676 */ 1677 if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) { 1678 if (!vs->modifiers_state[0x45]) { 1679 trace_vnc_key_sync_numlock(true); 1680 vs->modifiers_state[0x45] = 1; 1681 press_key(vs, 0xff7f); 1682 } 1683 } else { 1684 if (vs->modifiers_state[0x45]) { 1685 trace_vnc_key_sync_numlock(false); 1686 vs->modifiers_state[0x45] = 0; 1687 press_key(vs, 0xff7f); 1688 } 1689 } 1690 } 1691 1692 if (down && vs->vd->lock_key_sync && 1693 !vnc_has_feature(vs, VNC_FEATURE_LED_STATE) && 1694 ((sym >= 'A' && sym <= 'Z') || (sym >= 'a' && sym <= 'z'))) { 1695 /* If the capslock state needs to change then simulate an additional 1696 keypress before sending this one. This will happen if the user 1697 toggles capslock away from the VNC window. 1698 */ 1699 int uppercase = !!(sym >= 'A' && sym <= 'Z'); 1700 int shift = !!(vs->modifiers_state[0x2a] | vs->modifiers_state[0x36]); 1701 int capslock = !!(vs->modifiers_state[0x3a]); 1702 if (capslock) { 1703 if (uppercase == shift) { 1704 trace_vnc_key_sync_capslock(false); 1705 vs->modifiers_state[0x3a] = 0; 1706 press_key(vs, 0xffe5); 1707 } 1708 } else { 1709 if (uppercase != shift) { 1710 trace_vnc_key_sync_capslock(true); 1711 vs->modifiers_state[0x3a] = 1; 1712 press_key(vs, 0xffe5); 1713 } 1714 } 1715 } 1716 1717 if (qemu_console_is_graphic(NULL)) { 1718 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, down); 1719 qemu_input_event_send_key_delay(vs->vd->key_delay_ms); 1720 } else { 1721 bool numlock = vs->modifiers_state[0x45]; 1722 bool control = (vs->modifiers_state[0x1d] || 1723 vs->modifiers_state[0x9d]); 1724 /* QEMU console emulation */ 1725 if (down) { 1726 switch (keycode) { 1727 case 0x2a: /* Left Shift */ 1728 case 0x36: /* Right Shift */ 1729 case 0x1d: /* Left CTRL */ 1730 case 0x9d: /* Right CTRL */ 1731 case 0x38: /* Left ALT */ 1732 case 0xb8: /* Right ALT */ 1733 break; 1734 case 0xc8: 1735 kbd_put_keysym(QEMU_KEY_UP); 1736 break; 1737 case 0xd0: 1738 kbd_put_keysym(QEMU_KEY_DOWN); 1739 break; 1740 case 0xcb: 1741 kbd_put_keysym(QEMU_KEY_LEFT); 1742 break; 1743 case 0xcd: 1744 kbd_put_keysym(QEMU_KEY_RIGHT); 1745 break; 1746 case 0xd3: 1747 kbd_put_keysym(QEMU_KEY_DELETE); 1748 break; 1749 case 0xc7: 1750 kbd_put_keysym(QEMU_KEY_HOME); 1751 break; 1752 case 0xcf: 1753 kbd_put_keysym(QEMU_KEY_END); 1754 break; 1755 case 0xc9: 1756 kbd_put_keysym(QEMU_KEY_PAGEUP); 1757 break; 1758 case 0xd1: 1759 kbd_put_keysym(QEMU_KEY_PAGEDOWN); 1760 break; 1761 1762 case 0x47: 1763 kbd_put_keysym(numlock ? '7' : QEMU_KEY_HOME); 1764 break; 1765 case 0x48: 1766 kbd_put_keysym(numlock ? '8' : QEMU_KEY_UP); 1767 break; 1768 case 0x49: 1769 kbd_put_keysym(numlock ? '9' : QEMU_KEY_PAGEUP); 1770 break; 1771 case 0x4b: 1772 kbd_put_keysym(numlock ? '4' : QEMU_KEY_LEFT); 1773 break; 1774 case 0x4c: 1775 kbd_put_keysym('5'); 1776 break; 1777 case 0x4d: 1778 kbd_put_keysym(numlock ? '6' : QEMU_KEY_RIGHT); 1779 break; 1780 case 0x4f: 1781 kbd_put_keysym(numlock ? '1' : QEMU_KEY_END); 1782 break; 1783 case 0x50: 1784 kbd_put_keysym(numlock ? '2' : QEMU_KEY_DOWN); 1785 break; 1786 case 0x51: 1787 kbd_put_keysym(numlock ? '3' : QEMU_KEY_PAGEDOWN); 1788 break; 1789 case 0x52: 1790 kbd_put_keysym('0'); 1791 break; 1792 case 0x53: 1793 kbd_put_keysym(numlock ? '.' : QEMU_KEY_DELETE); 1794 break; 1795 1796 case 0xb5: 1797 kbd_put_keysym('/'); 1798 break; 1799 case 0x37: 1800 kbd_put_keysym('*'); 1801 break; 1802 case 0x4a: 1803 kbd_put_keysym('-'); 1804 break; 1805 case 0x4e: 1806 kbd_put_keysym('+'); 1807 break; 1808 case 0x9c: 1809 kbd_put_keysym('\n'); 1810 break; 1811 1812 default: 1813 if (control) { 1814 kbd_put_keysym(sym & 0x1f); 1815 } else { 1816 kbd_put_keysym(sym); 1817 } 1818 break; 1819 } 1820 } 1821 } 1822 } 1823 1824 static void vnc_release_modifiers(VncState *vs) 1825 { 1826 static const int keycodes[] = { 1827 /* shift, control, alt keys, both left & right */ 1828 0x2a, 0x36, 0x1d, 0x9d, 0x38, 0xb8, 1829 }; 1830 int i, keycode; 1831 1832 if (!qemu_console_is_graphic(NULL)) { 1833 return; 1834 } 1835 for (i = 0; i < ARRAY_SIZE(keycodes); i++) { 1836 keycode = keycodes[i]; 1837 if (!vs->modifiers_state[keycode]) { 1838 continue; 1839 } 1840 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, false); 1841 qemu_input_event_send_key_delay(vs->vd->key_delay_ms); 1842 } 1843 } 1844 1845 static const char *code2name(int keycode) 1846 { 1847 return QKeyCode_str(qemu_input_key_number_to_qcode(keycode)); 1848 } 1849 1850 static void key_event(VncState *vs, int down, uint32_t sym) 1851 { 1852 int keycode; 1853 int lsym = sym; 1854 1855 if (lsym >= 'A' && lsym <= 'Z' && qemu_console_is_graphic(NULL)) { 1856 lsym = lsym - 'A' + 'a'; 1857 } 1858 1859 keycode = keysym2scancode(vs->vd->kbd_layout, lsym & 0xFFFF) & SCANCODE_KEYMASK; 1860 trace_vnc_key_event_map(down, sym, keycode, code2name(keycode)); 1861 do_key_event(vs, down, keycode, sym); 1862 } 1863 1864 static void ext_key_event(VncState *vs, int down, 1865 uint32_t sym, uint16_t keycode) 1866 { 1867 /* if the user specifies a keyboard layout, always use it */ 1868 if (keyboard_layout) { 1869 key_event(vs, down, sym); 1870 } else { 1871 trace_vnc_key_event_ext(down, sym, keycode, code2name(keycode)); 1872 do_key_event(vs, down, keycode, sym); 1873 } 1874 } 1875 1876 static void framebuffer_update_request(VncState *vs, int incremental, 1877 int x, int y, int w, int h) 1878 { 1879 vs->need_update = 1; 1880 1881 if (incremental) { 1882 return; 1883 } 1884 1885 vs->force_update = 1; 1886 vnc_set_area_dirty(vs->dirty, vs->vd, x, y, w, h); 1887 } 1888 1889 static void send_ext_key_event_ack(VncState *vs) 1890 { 1891 vnc_lock_output(vs); 1892 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 1893 vnc_write_u8(vs, 0); 1894 vnc_write_u16(vs, 1); 1895 vnc_framebuffer_update(vs, 0, 0, 1896 pixman_image_get_width(vs->vd->server), 1897 pixman_image_get_height(vs->vd->server), 1898 VNC_ENCODING_EXT_KEY_EVENT); 1899 vnc_unlock_output(vs); 1900 vnc_flush(vs); 1901 } 1902 1903 static void send_ext_audio_ack(VncState *vs) 1904 { 1905 vnc_lock_output(vs); 1906 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 1907 vnc_write_u8(vs, 0); 1908 vnc_write_u16(vs, 1); 1909 vnc_framebuffer_update(vs, 0, 0, 1910 pixman_image_get_width(vs->vd->server), 1911 pixman_image_get_height(vs->vd->server), 1912 VNC_ENCODING_AUDIO); 1913 vnc_unlock_output(vs); 1914 vnc_flush(vs); 1915 } 1916 1917 static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings) 1918 { 1919 int i; 1920 unsigned int enc = 0; 1921 1922 vs->features = 0; 1923 vs->vnc_encoding = 0; 1924 vs->tight.compression = 9; 1925 vs->tight.quality = -1; /* Lossless by default */ 1926 vs->absolute = -1; 1927 1928 /* 1929 * Start from the end because the encodings are sent in order of preference. 1930 * This way the preferred encoding (first encoding defined in the array) 1931 * will be set at the end of the loop. 1932 */ 1933 for (i = n_encodings - 1; i >= 0; i--) { 1934 enc = encodings[i]; 1935 switch (enc) { 1936 case VNC_ENCODING_RAW: 1937 vs->vnc_encoding = enc; 1938 break; 1939 case VNC_ENCODING_COPYRECT: 1940 vs->features |= VNC_FEATURE_COPYRECT_MASK; 1941 break; 1942 case VNC_ENCODING_HEXTILE: 1943 vs->features |= VNC_FEATURE_HEXTILE_MASK; 1944 vs->vnc_encoding = enc; 1945 break; 1946 case VNC_ENCODING_TIGHT: 1947 vs->features |= VNC_FEATURE_TIGHT_MASK; 1948 vs->vnc_encoding = enc; 1949 break; 1950 #ifdef CONFIG_VNC_PNG 1951 case VNC_ENCODING_TIGHT_PNG: 1952 vs->features |= VNC_FEATURE_TIGHT_PNG_MASK; 1953 vs->vnc_encoding = enc; 1954 break; 1955 #endif 1956 case VNC_ENCODING_ZLIB: 1957 vs->features |= VNC_FEATURE_ZLIB_MASK; 1958 vs->vnc_encoding = enc; 1959 break; 1960 case VNC_ENCODING_ZRLE: 1961 vs->features |= VNC_FEATURE_ZRLE_MASK; 1962 vs->vnc_encoding = enc; 1963 break; 1964 case VNC_ENCODING_ZYWRLE: 1965 vs->features |= VNC_FEATURE_ZYWRLE_MASK; 1966 vs->vnc_encoding = enc; 1967 break; 1968 case VNC_ENCODING_DESKTOPRESIZE: 1969 vs->features |= VNC_FEATURE_RESIZE_MASK; 1970 break; 1971 case VNC_ENCODING_POINTER_TYPE_CHANGE: 1972 vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK; 1973 break; 1974 case VNC_ENCODING_RICH_CURSOR: 1975 vs->features |= VNC_FEATURE_RICH_CURSOR_MASK; 1976 if (vs->vd->cursor) { 1977 vnc_cursor_define(vs); 1978 } 1979 break; 1980 case VNC_ENCODING_EXT_KEY_EVENT: 1981 send_ext_key_event_ack(vs); 1982 break; 1983 case VNC_ENCODING_AUDIO: 1984 send_ext_audio_ack(vs); 1985 break; 1986 case VNC_ENCODING_WMVi: 1987 vs->features |= VNC_FEATURE_WMVI_MASK; 1988 break; 1989 case VNC_ENCODING_LED_STATE: 1990 vs->features |= VNC_FEATURE_LED_STATE_MASK; 1991 break; 1992 case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9: 1993 vs->tight.compression = (enc & 0x0F); 1994 break; 1995 case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9: 1996 if (vs->vd->lossy) { 1997 vs->tight.quality = (enc & 0x0F); 1998 } 1999 break; 2000 default: 2001 VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc); 2002 break; 2003 } 2004 } 2005 vnc_desktop_resize(vs); 2006 check_pointer_type_change(&vs->mouse_mode_notifier, NULL); 2007 vnc_led_state_change(vs); 2008 } 2009 2010 static void set_pixel_conversion(VncState *vs) 2011 { 2012 pixman_format_code_t fmt = qemu_pixman_get_format(&vs->client_pf); 2013 2014 if (fmt == VNC_SERVER_FB_FORMAT) { 2015 vs->write_pixels = vnc_write_pixels_copy; 2016 vnc_hextile_set_pixel_conversion(vs, 0); 2017 } else { 2018 vs->write_pixels = vnc_write_pixels_generic; 2019 vnc_hextile_set_pixel_conversion(vs, 1); 2020 } 2021 } 2022 2023 static void send_color_map(VncState *vs) 2024 { 2025 int i; 2026 2027 vnc_write_u8(vs, VNC_MSG_SERVER_SET_COLOUR_MAP_ENTRIES); 2028 vnc_write_u8(vs, 0); /* padding */ 2029 vnc_write_u16(vs, 0); /* first color */ 2030 vnc_write_u16(vs, 256); /* # of colors */ 2031 2032 for (i = 0; i < 256; i++) { 2033 PixelFormat *pf = &vs->client_pf; 2034 2035 vnc_write_u16(vs, (((i >> pf->rshift) & pf->rmax) << (16 - pf->rbits))); 2036 vnc_write_u16(vs, (((i >> pf->gshift) & pf->gmax) << (16 - pf->gbits))); 2037 vnc_write_u16(vs, (((i >> pf->bshift) & pf->bmax) << (16 - pf->bbits))); 2038 } 2039 } 2040 2041 static void set_pixel_format(VncState *vs, int bits_per_pixel, 2042 int big_endian_flag, int true_color_flag, 2043 int red_max, int green_max, int blue_max, 2044 int red_shift, int green_shift, int blue_shift) 2045 { 2046 if (!true_color_flag) { 2047 /* Expose a reasonable default 256 color map */ 2048 bits_per_pixel = 8; 2049 red_max = 7; 2050 green_max = 7; 2051 blue_max = 3; 2052 red_shift = 0; 2053 green_shift = 3; 2054 blue_shift = 6; 2055 } 2056 2057 switch (bits_per_pixel) { 2058 case 8: 2059 case 16: 2060 case 32: 2061 break; 2062 default: 2063 vnc_client_error(vs); 2064 return; 2065 } 2066 2067 vs->client_pf.rmax = red_max ? red_max : 0xFF; 2068 vs->client_pf.rbits = ctpopl(red_max); 2069 vs->client_pf.rshift = red_shift; 2070 vs->client_pf.rmask = red_max << red_shift; 2071 vs->client_pf.gmax = green_max ? green_max : 0xFF; 2072 vs->client_pf.gbits = ctpopl(green_max); 2073 vs->client_pf.gshift = green_shift; 2074 vs->client_pf.gmask = green_max << green_shift; 2075 vs->client_pf.bmax = blue_max ? blue_max : 0xFF; 2076 vs->client_pf.bbits = ctpopl(blue_max); 2077 vs->client_pf.bshift = blue_shift; 2078 vs->client_pf.bmask = blue_max << blue_shift; 2079 vs->client_pf.bits_per_pixel = bits_per_pixel; 2080 vs->client_pf.bytes_per_pixel = bits_per_pixel / 8; 2081 vs->client_pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel; 2082 vs->client_be = big_endian_flag; 2083 2084 if (!true_color_flag) { 2085 send_color_map(vs); 2086 } 2087 2088 set_pixel_conversion(vs); 2089 2090 graphic_hw_invalidate(vs->vd->dcl.con); 2091 graphic_hw_update(vs->vd->dcl.con); 2092 } 2093 2094 static void pixel_format_message (VncState *vs) { 2095 char pad[3] = { 0, 0, 0 }; 2096 2097 vs->client_pf = qemu_default_pixelformat(32); 2098 2099 vnc_write_u8(vs, vs->client_pf.bits_per_pixel); /* bits-per-pixel */ 2100 vnc_write_u8(vs, vs->client_pf.depth); /* depth */ 2101 2102 #ifdef HOST_WORDS_BIGENDIAN 2103 vnc_write_u8(vs, 1); /* big-endian-flag */ 2104 #else 2105 vnc_write_u8(vs, 0); /* big-endian-flag */ 2106 #endif 2107 vnc_write_u8(vs, 1); /* true-color-flag */ 2108 vnc_write_u16(vs, vs->client_pf.rmax); /* red-max */ 2109 vnc_write_u16(vs, vs->client_pf.gmax); /* green-max */ 2110 vnc_write_u16(vs, vs->client_pf.bmax); /* blue-max */ 2111 vnc_write_u8(vs, vs->client_pf.rshift); /* red-shift */ 2112 vnc_write_u8(vs, vs->client_pf.gshift); /* green-shift */ 2113 vnc_write_u8(vs, vs->client_pf.bshift); /* blue-shift */ 2114 vnc_write(vs, pad, 3); /* padding */ 2115 2116 vnc_hextile_set_pixel_conversion(vs, 0); 2117 vs->write_pixels = vnc_write_pixels_copy; 2118 } 2119 2120 static void vnc_colordepth(VncState *vs) 2121 { 2122 if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) { 2123 /* Sending a WMVi message to notify the client*/ 2124 vnc_lock_output(vs); 2125 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 2126 vnc_write_u8(vs, 0); 2127 vnc_write_u16(vs, 1); /* number of rects */ 2128 vnc_framebuffer_update(vs, 0, 0, 2129 pixman_image_get_width(vs->vd->server), 2130 pixman_image_get_height(vs->vd->server), 2131 VNC_ENCODING_WMVi); 2132 pixel_format_message(vs); 2133 vnc_unlock_output(vs); 2134 vnc_flush(vs); 2135 } else { 2136 set_pixel_conversion(vs); 2137 } 2138 } 2139 2140 static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len) 2141 { 2142 int i; 2143 uint16_t limit; 2144 VncDisplay *vd = vs->vd; 2145 2146 if (data[0] > 3) { 2147 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE); 2148 } 2149 2150 switch (data[0]) { 2151 case VNC_MSG_CLIENT_SET_PIXEL_FORMAT: 2152 if (len == 1) 2153 return 20; 2154 2155 set_pixel_format(vs, read_u8(data, 4), 2156 read_u8(data, 6), read_u8(data, 7), 2157 read_u16(data, 8), read_u16(data, 10), 2158 read_u16(data, 12), read_u8(data, 14), 2159 read_u8(data, 15), read_u8(data, 16)); 2160 break; 2161 case VNC_MSG_CLIENT_SET_ENCODINGS: 2162 if (len == 1) 2163 return 4; 2164 2165 if (len == 4) { 2166 limit = read_u16(data, 2); 2167 if (limit > 0) 2168 return 4 + (limit * 4); 2169 } else 2170 limit = read_u16(data, 2); 2171 2172 for (i = 0; i < limit; i++) { 2173 int32_t val = read_s32(data, 4 + (i * 4)); 2174 memcpy(data + 4 + (i * 4), &val, sizeof(val)); 2175 } 2176 2177 set_encodings(vs, (int32_t *)(data + 4), limit); 2178 break; 2179 case VNC_MSG_CLIENT_FRAMEBUFFER_UPDATE_REQUEST: 2180 if (len == 1) 2181 return 10; 2182 2183 framebuffer_update_request(vs, 2184 read_u8(data, 1), read_u16(data, 2), read_u16(data, 4), 2185 read_u16(data, 6), read_u16(data, 8)); 2186 break; 2187 case VNC_MSG_CLIENT_KEY_EVENT: 2188 if (len == 1) 2189 return 8; 2190 2191 key_event(vs, read_u8(data, 1), read_u32(data, 4)); 2192 break; 2193 case VNC_MSG_CLIENT_POINTER_EVENT: 2194 if (len == 1) 2195 return 6; 2196 2197 pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4)); 2198 break; 2199 case VNC_MSG_CLIENT_CUT_TEXT: 2200 if (len == 1) { 2201 return 8; 2202 } 2203 if (len == 8) { 2204 uint32_t dlen = read_u32(data, 4); 2205 if (dlen > (1 << 20)) { 2206 error_report("vnc: client_cut_text msg payload has %u bytes" 2207 " which exceeds our limit of 1MB.", dlen); 2208 vnc_client_error(vs); 2209 break; 2210 } 2211 if (dlen > 0) { 2212 return 8 + dlen; 2213 } 2214 } 2215 2216 client_cut_text(vs, read_u32(data, 4), data + 8); 2217 break; 2218 case VNC_MSG_CLIENT_QEMU: 2219 if (len == 1) 2220 return 2; 2221 2222 switch (read_u8(data, 1)) { 2223 case VNC_MSG_CLIENT_QEMU_EXT_KEY_EVENT: 2224 if (len == 2) 2225 return 12; 2226 2227 ext_key_event(vs, read_u16(data, 2), 2228 read_u32(data, 4), read_u32(data, 8)); 2229 break; 2230 case VNC_MSG_CLIENT_QEMU_AUDIO: 2231 if (len == 2) 2232 return 4; 2233 2234 switch (read_u16 (data, 2)) { 2235 case VNC_MSG_CLIENT_QEMU_AUDIO_ENABLE: 2236 audio_add(vs); 2237 break; 2238 case VNC_MSG_CLIENT_QEMU_AUDIO_DISABLE: 2239 audio_del(vs); 2240 break; 2241 case VNC_MSG_CLIENT_QEMU_AUDIO_SET_FORMAT: 2242 if (len == 4) 2243 return 10; 2244 switch (read_u8(data, 4)) { 2245 case 0: vs->as.fmt = AUD_FMT_U8; break; 2246 case 1: vs->as.fmt = AUD_FMT_S8; break; 2247 case 2: vs->as.fmt = AUD_FMT_U16; break; 2248 case 3: vs->as.fmt = AUD_FMT_S16; break; 2249 case 4: vs->as.fmt = AUD_FMT_U32; break; 2250 case 5: vs->as.fmt = AUD_FMT_S32; break; 2251 default: 2252 VNC_DEBUG("Invalid audio format %d\n", read_u8(data, 4)); 2253 vnc_client_error(vs); 2254 break; 2255 } 2256 vs->as.nchannels = read_u8(data, 5); 2257 if (vs->as.nchannels != 1 && vs->as.nchannels != 2) { 2258 VNC_DEBUG("Invalid audio channel coount %d\n", 2259 read_u8(data, 5)); 2260 vnc_client_error(vs); 2261 break; 2262 } 2263 vs->as.freq = read_u32(data, 6); 2264 break; 2265 default: 2266 VNC_DEBUG("Invalid audio message %d\n", read_u8(data, 4)); 2267 vnc_client_error(vs); 2268 break; 2269 } 2270 break; 2271 2272 default: 2273 VNC_DEBUG("Msg: %d\n", read_u16(data, 0)); 2274 vnc_client_error(vs); 2275 break; 2276 } 2277 break; 2278 default: 2279 VNC_DEBUG("Msg: %d\n", data[0]); 2280 vnc_client_error(vs); 2281 break; 2282 } 2283 2284 vnc_read_when(vs, protocol_client_msg, 1); 2285 return 0; 2286 } 2287 2288 static int protocol_client_init(VncState *vs, uint8_t *data, size_t len) 2289 { 2290 char buf[1024]; 2291 VncShareMode mode; 2292 int size; 2293 2294 mode = data[0] ? VNC_SHARE_MODE_SHARED : VNC_SHARE_MODE_EXCLUSIVE; 2295 switch (vs->vd->share_policy) { 2296 case VNC_SHARE_POLICY_IGNORE: 2297 /* 2298 * Ignore the shared flag. Nothing to do here. 2299 * 2300 * Doesn't conform to the rfb spec but is traditional qemu 2301 * behavior, thus left here as option for compatibility 2302 * reasons. 2303 */ 2304 break; 2305 case VNC_SHARE_POLICY_ALLOW_EXCLUSIVE: 2306 /* 2307 * Policy: Allow clients ask for exclusive access. 2308 * 2309 * Implementation: When a client asks for exclusive access, 2310 * disconnect all others. Shared connects are allowed as long 2311 * as no exclusive connection exists. 2312 * 2313 * This is how the rfb spec suggests to handle the shared flag. 2314 */ 2315 if (mode == VNC_SHARE_MODE_EXCLUSIVE) { 2316 VncState *client; 2317 QTAILQ_FOREACH(client, &vs->vd->clients, next) { 2318 if (vs == client) { 2319 continue; 2320 } 2321 if (client->share_mode != VNC_SHARE_MODE_EXCLUSIVE && 2322 client->share_mode != VNC_SHARE_MODE_SHARED) { 2323 continue; 2324 } 2325 vnc_disconnect_start(client); 2326 } 2327 } 2328 if (mode == VNC_SHARE_MODE_SHARED) { 2329 if (vs->vd->num_exclusive > 0) { 2330 vnc_disconnect_start(vs); 2331 return 0; 2332 } 2333 } 2334 break; 2335 case VNC_SHARE_POLICY_FORCE_SHARED: 2336 /* 2337 * Policy: Shared connects only. 2338 * Implementation: Disallow clients asking for exclusive access. 2339 * 2340 * Useful for shared desktop sessions where you don't want 2341 * someone forgetting to say -shared when running the vnc 2342 * client disconnect everybody else. 2343 */ 2344 if (mode == VNC_SHARE_MODE_EXCLUSIVE) { 2345 vnc_disconnect_start(vs); 2346 return 0; 2347 } 2348 break; 2349 } 2350 vnc_set_share_mode(vs, mode); 2351 2352 if (vs->vd->num_shared > vs->vd->connections_limit) { 2353 vnc_disconnect_start(vs); 2354 return 0; 2355 } 2356 2357 vs->client_width = pixman_image_get_width(vs->vd->server); 2358 vs->client_height = pixman_image_get_height(vs->vd->server); 2359 vnc_write_u16(vs, vs->client_width); 2360 vnc_write_u16(vs, vs->client_height); 2361 2362 pixel_format_message(vs); 2363 2364 if (qemu_name) { 2365 size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name); 2366 if (size > sizeof(buf)) { 2367 size = sizeof(buf); 2368 } 2369 } else { 2370 size = snprintf(buf, sizeof(buf), "QEMU"); 2371 } 2372 2373 vnc_write_u32(vs, size); 2374 vnc_write(vs, buf, size); 2375 vnc_flush(vs); 2376 2377 vnc_client_cache_auth(vs); 2378 vnc_qmp_event(vs, QAPI_EVENT_VNC_INITIALIZED); 2379 2380 vnc_read_when(vs, protocol_client_msg, 1); 2381 2382 return 0; 2383 } 2384 2385 void start_client_init(VncState *vs) 2386 { 2387 vnc_read_when(vs, protocol_client_init, 1); 2388 } 2389 2390 static void make_challenge(VncState *vs) 2391 { 2392 int i; 2393 2394 srand(time(NULL)+getpid()+getpid()*987654+rand()); 2395 2396 for (i = 0 ; i < sizeof(vs->challenge) ; i++) 2397 vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0)); 2398 } 2399 2400 static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len) 2401 { 2402 unsigned char response[VNC_AUTH_CHALLENGE_SIZE]; 2403 size_t i, pwlen; 2404 unsigned char key[8]; 2405 time_t now = time(NULL); 2406 QCryptoCipher *cipher = NULL; 2407 Error *err = NULL; 2408 2409 if (!vs->vd->password) { 2410 trace_vnc_auth_fail(vs, vs->auth, "password is not set", ""); 2411 goto reject; 2412 } 2413 if (vs->vd->expires < now) { 2414 trace_vnc_auth_fail(vs, vs->auth, "password is expired", ""); 2415 goto reject; 2416 } 2417 2418 memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE); 2419 2420 /* Calculate the expected challenge response */ 2421 pwlen = strlen(vs->vd->password); 2422 for (i=0; i<sizeof(key); i++) 2423 key[i] = i<pwlen ? vs->vd->password[i] : 0; 2424 2425 cipher = qcrypto_cipher_new( 2426 QCRYPTO_CIPHER_ALG_DES_RFB, 2427 QCRYPTO_CIPHER_MODE_ECB, 2428 key, G_N_ELEMENTS(key), 2429 &err); 2430 if (!cipher) { 2431 trace_vnc_auth_fail(vs, vs->auth, "cannot create cipher", 2432 error_get_pretty(err)); 2433 error_free(err); 2434 goto reject; 2435 } 2436 2437 if (qcrypto_cipher_encrypt(cipher, 2438 vs->challenge, 2439 response, 2440 VNC_AUTH_CHALLENGE_SIZE, 2441 &err) < 0) { 2442 trace_vnc_auth_fail(vs, vs->auth, "cannot encrypt challenge response", 2443 error_get_pretty(err)); 2444 error_free(err); 2445 goto reject; 2446 } 2447 2448 /* Compare expected vs actual challenge response */ 2449 if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) { 2450 trace_vnc_auth_fail(vs, vs->auth, "mis-matched challenge response", ""); 2451 goto reject; 2452 } else { 2453 trace_vnc_auth_pass(vs, vs->auth); 2454 vnc_write_u32(vs, 0); /* Accept auth */ 2455 vnc_flush(vs); 2456 2457 start_client_init(vs); 2458 } 2459 2460 qcrypto_cipher_free(cipher); 2461 return 0; 2462 2463 reject: 2464 vnc_write_u32(vs, 1); /* Reject auth */ 2465 if (vs->minor >= 8) { 2466 static const char err[] = "Authentication failed"; 2467 vnc_write_u32(vs, sizeof(err)); 2468 vnc_write(vs, err, sizeof(err)); 2469 } 2470 vnc_flush(vs); 2471 vnc_client_error(vs); 2472 qcrypto_cipher_free(cipher); 2473 return 0; 2474 } 2475 2476 void start_auth_vnc(VncState *vs) 2477 { 2478 make_challenge(vs); 2479 /* Send client a 'random' challenge */ 2480 vnc_write(vs, vs->challenge, sizeof(vs->challenge)); 2481 vnc_flush(vs); 2482 2483 vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge)); 2484 } 2485 2486 2487 static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len) 2488 { 2489 /* We only advertise 1 auth scheme at a time, so client 2490 * must pick the one we sent. Verify this */ 2491 if (data[0] != vs->auth) { /* Reject auth */ 2492 trace_vnc_auth_reject(vs, vs->auth, (int)data[0]); 2493 vnc_write_u32(vs, 1); 2494 if (vs->minor >= 8) { 2495 static const char err[] = "Authentication failed"; 2496 vnc_write_u32(vs, sizeof(err)); 2497 vnc_write(vs, err, sizeof(err)); 2498 } 2499 vnc_client_error(vs); 2500 } else { /* Accept requested auth */ 2501 trace_vnc_auth_start(vs, vs->auth); 2502 switch (vs->auth) { 2503 case VNC_AUTH_NONE: 2504 if (vs->minor >= 8) { 2505 vnc_write_u32(vs, 0); /* Accept auth completion */ 2506 vnc_flush(vs); 2507 } 2508 trace_vnc_auth_pass(vs, vs->auth); 2509 start_client_init(vs); 2510 break; 2511 2512 case VNC_AUTH_VNC: 2513 start_auth_vnc(vs); 2514 break; 2515 2516 case VNC_AUTH_VENCRYPT: 2517 start_auth_vencrypt(vs); 2518 break; 2519 2520 #ifdef CONFIG_VNC_SASL 2521 case VNC_AUTH_SASL: 2522 start_auth_sasl(vs); 2523 break; 2524 #endif /* CONFIG_VNC_SASL */ 2525 2526 default: /* Should not be possible, but just in case */ 2527 trace_vnc_auth_fail(vs, vs->auth, "Unhandled auth method", ""); 2528 vnc_write_u8(vs, 1); 2529 if (vs->minor >= 8) { 2530 static const char err[] = "Authentication failed"; 2531 vnc_write_u32(vs, sizeof(err)); 2532 vnc_write(vs, err, sizeof(err)); 2533 } 2534 vnc_client_error(vs); 2535 } 2536 } 2537 return 0; 2538 } 2539 2540 static int protocol_version(VncState *vs, uint8_t *version, size_t len) 2541 { 2542 char local[13]; 2543 2544 memcpy(local, version, 12); 2545 local[12] = 0; 2546 2547 if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) { 2548 VNC_DEBUG("Malformed protocol version %s\n", local); 2549 vnc_client_error(vs); 2550 return 0; 2551 } 2552 VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor); 2553 if (vs->major != 3 || 2554 (vs->minor != 3 && 2555 vs->minor != 4 && 2556 vs->minor != 5 && 2557 vs->minor != 7 && 2558 vs->minor != 8)) { 2559 VNC_DEBUG("Unsupported client version\n"); 2560 vnc_write_u32(vs, VNC_AUTH_INVALID); 2561 vnc_flush(vs); 2562 vnc_client_error(vs); 2563 return 0; 2564 } 2565 /* Some broken clients report v3.4 or v3.5, which spec requires to be treated 2566 * as equivalent to v3.3 by servers 2567 */ 2568 if (vs->minor == 4 || vs->minor == 5) 2569 vs->minor = 3; 2570 2571 if (vs->minor == 3) { 2572 trace_vnc_auth_start(vs, vs->auth); 2573 if (vs->auth == VNC_AUTH_NONE) { 2574 vnc_write_u32(vs, vs->auth); 2575 vnc_flush(vs); 2576 trace_vnc_auth_pass(vs, vs->auth); 2577 start_client_init(vs); 2578 } else if (vs->auth == VNC_AUTH_VNC) { 2579 VNC_DEBUG("Tell client VNC auth\n"); 2580 vnc_write_u32(vs, vs->auth); 2581 vnc_flush(vs); 2582 start_auth_vnc(vs); 2583 } else { 2584 trace_vnc_auth_fail(vs, vs->auth, 2585 "Unsupported auth method for v3.3", ""); 2586 vnc_write_u32(vs, VNC_AUTH_INVALID); 2587 vnc_flush(vs); 2588 vnc_client_error(vs); 2589 } 2590 } else { 2591 vnc_write_u8(vs, 1); /* num auth */ 2592 vnc_write_u8(vs, vs->auth); 2593 vnc_read_when(vs, protocol_client_auth, 1); 2594 vnc_flush(vs); 2595 } 2596 2597 return 0; 2598 } 2599 2600 static VncRectStat *vnc_stat_rect(VncDisplay *vd, int x, int y) 2601 { 2602 struct VncSurface *vs = &vd->guest; 2603 2604 return &vs->stats[y / VNC_STAT_RECT][x / VNC_STAT_RECT]; 2605 } 2606 2607 void vnc_sent_lossy_rect(VncState *vs, int x, int y, int w, int h) 2608 { 2609 int i, j; 2610 2611 w = (x + w) / VNC_STAT_RECT; 2612 h = (y + h) / VNC_STAT_RECT; 2613 x /= VNC_STAT_RECT; 2614 y /= VNC_STAT_RECT; 2615 2616 for (j = y; j <= h; j++) { 2617 for (i = x; i <= w; i++) { 2618 vs->lossy_rect[j][i] = 1; 2619 } 2620 } 2621 } 2622 2623 static int vnc_refresh_lossy_rect(VncDisplay *vd, int x, int y) 2624 { 2625 VncState *vs; 2626 int sty = y / VNC_STAT_RECT; 2627 int stx = x / VNC_STAT_RECT; 2628 int has_dirty = 0; 2629 2630 y = QEMU_ALIGN_DOWN(y, VNC_STAT_RECT); 2631 x = QEMU_ALIGN_DOWN(x, VNC_STAT_RECT); 2632 2633 QTAILQ_FOREACH(vs, &vd->clients, next) { 2634 int j; 2635 2636 /* kernel send buffers are full -> refresh later */ 2637 if (vs->output.offset) { 2638 continue; 2639 } 2640 2641 if (!vs->lossy_rect[sty][stx]) { 2642 continue; 2643 } 2644 2645 vs->lossy_rect[sty][stx] = 0; 2646 for (j = 0; j < VNC_STAT_RECT; ++j) { 2647 bitmap_set(vs->dirty[y + j], 2648 x / VNC_DIRTY_PIXELS_PER_BIT, 2649 VNC_STAT_RECT / VNC_DIRTY_PIXELS_PER_BIT); 2650 } 2651 has_dirty++; 2652 } 2653 2654 return has_dirty; 2655 } 2656 2657 static int vnc_update_stats(VncDisplay *vd, struct timeval * tv) 2658 { 2659 int width = MIN(pixman_image_get_width(vd->guest.fb), 2660 pixman_image_get_width(vd->server)); 2661 int height = MIN(pixman_image_get_height(vd->guest.fb), 2662 pixman_image_get_height(vd->server)); 2663 int x, y; 2664 struct timeval res; 2665 int has_dirty = 0; 2666 2667 for (y = 0; y < height; y += VNC_STAT_RECT) { 2668 for (x = 0; x < width; x += VNC_STAT_RECT) { 2669 VncRectStat *rect = vnc_stat_rect(vd, x, y); 2670 2671 rect->updated = false; 2672 } 2673 } 2674 2675 qemu_timersub(tv, &VNC_REFRESH_STATS, &res); 2676 2677 if (timercmp(&vd->guest.last_freq_check, &res, >)) { 2678 return has_dirty; 2679 } 2680 vd->guest.last_freq_check = *tv; 2681 2682 for (y = 0; y < height; y += VNC_STAT_RECT) { 2683 for (x = 0; x < width; x += VNC_STAT_RECT) { 2684 VncRectStat *rect= vnc_stat_rect(vd, x, y); 2685 int count = ARRAY_SIZE(rect->times); 2686 struct timeval min, max; 2687 2688 if (!timerisset(&rect->times[count - 1])) { 2689 continue ; 2690 } 2691 2692 max = rect->times[(rect->idx + count - 1) % count]; 2693 qemu_timersub(tv, &max, &res); 2694 2695 if (timercmp(&res, &VNC_REFRESH_LOSSY, >)) { 2696 rect->freq = 0; 2697 has_dirty += vnc_refresh_lossy_rect(vd, x, y); 2698 memset(rect->times, 0, sizeof (rect->times)); 2699 continue ; 2700 } 2701 2702 min = rect->times[rect->idx]; 2703 max = rect->times[(rect->idx + count - 1) % count]; 2704 qemu_timersub(&max, &min, &res); 2705 2706 rect->freq = res.tv_sec + res.tv_usec / 1000000.; 2707 rect->freq /= count; 2708 rect->freq = 1. / rect->freq; 2709 } 2710 } 2711 return has_dirty; 2712 } 2713 2714 double vnc_update_freq(VncState *vs, int x, int y, int w, int h) 2715 { 2716 int i, j; 2717 double total = 0; 2718 int num = 0; 2719 2720 x = QEMU_ALIGN_DOWN(x, VNC_STAT_RECT); 2721 y = QEMU_ALIGN_DOWN(y, VNC_STAT_RECT); 2722 2723 for (j = y; j <= y + h; j += VNC_STAT_RECT) { 2724 for (i = x; i <= x + w; i += VNC_STAT_RECT) { 2725 total += vnc_stat_rect(vs->vd, i, j)->freq; 2726 num++; 2727 } 2728 } 2729 2730 if (num) { 2731 return total / num; 2732 } else { 2733 return 0; 2734 } 2735 } 2736 2737 static void vnc_rect_updated(VncDisplay *vd, int x, int y, struct timeval * tv) 2738 { 2739 VncRectStat *rect; 2740 2741 rect = vnc_stat_rect(vd, x, y); 2742 if (rect->updated) { 2743 return ; 2744 } 2745 rect->times[rect->idx] = *tv; 2746 rect->idx = (rect->idx + 1) % ARRAY_SIZE(rect->times); 2747 rect->updated = true; 2748 } 2749 2750 static int vnc_refresh_server_surface(VncDisplay *vd) 2751 { 2752 int width = MIN(pixman_image_get_width(vd->guest.fb), 2753 pixman_image_get_width(vd->server)); 2754 int height = MIN(pixman_image_get_height(vd->guest.fb), 2755 pixman_image_get_height(vd->server)); 2756 int cmp_bytes, server_stride, line_bytes, guest_ll, guest_stride, y = 0; 2757 uint8_t *guest_row0 = NULL, *server_row0; 2758 VncState *vs; 2759 int has_dirty = 0; 2760 pixman_image_t *tmpbuf = NULL; 2761 2762 struct timeval tv = { 0, 0 }; 2763 2764 if (!vd->non_adaptive) { 2765 gettimeofday(&tv, NULL); 2766 has_dirty = vnc_update_stats(vd, &tv); 2767 } 2768 2769 /* 2770 * Walk through the guest dirty map. 2771 * Check and copy modified bits from guest to server surface. 2772 * Update server dirty map. 2773 */ 2774 server_row0 = (uint8_t *)pixman_image_get_data(vd->server); 2775 server_stride = guest_stride = guest_ll = 2776 pixman_image_get_stride(vd->server); 2777 cmp_bytes = MIN(VNC_DIRTY_PIXELS_PER_BIT * VNC_SERVER_FB_BYTES, 2778 server_stride); 2779 if (vd->guest.format != VNC_SERVER_FB_FORMAT) { 2780 int width = pixman_image_get_width(vd->server); 2781 tmpbuf = qemu_pixman_linebuf_create(VNC_SERVER_FB_FORMAT, width); 2782 } else { 2783 int guest_bpp = 2784 PIXMAN_FORMAT_BPP(pixman_image_get_format(vd->guest.fb)); 2785 guest_row0 = (uint8_t *)pixman_image_get_data(vd->guest.fb); 2786 guest_stride = pixman_image_get_stride(vd->guest.fb); 2787 guest_ll = pixman_image_get_width(vd->guest.fb) * (DIV_ROUND_UP(guest_bpp, 8)); 2788 } 2789 line_bytes = MIN(server_stride, guest_ll); 2790 2791 for (;;) { 2792 int x; 2793 uint8_t *guest_ptr, *server_ptr; 2794 unsigned long offset = find_next_bit((unsigned long *) &vd->guest.dirty, 2795 height * VNC_DIRTY_BPL(&vd->guest), 2796 y * VNC_DIRTY_BPL(&vd->guest)); 2797 if (offset == height * VNC_DIRTY_BPL(&vd->guest)) { 2798 /* no more dirty bits */ 2799 break; 2800 } 2801 y = offset / VNC_DIRTY_BPL(&vd->guest); 2802 x = offset % VNC_DIRTY_BPL(&vd->guest); 2803 2804 server_ptr = server_row0 + y * server_stride + x * cmp_bytes; 2805 2806 if (vd->guest.format != VNC_SERVER_FB_FORMAT) { 2807 qemu_pixman_linebuf_fill(tmpbuf, vd->guest.fb, width, 0, y); 2808 guest_ptr = (uint8_t *)pixman_image_get_data(tmpbuf); 2809 } else { 2810 guest_ptr = guest_row0 + y * guest_stride; 2811 } 2812 guest_ptr += x * cmp_bytes; 2813 2814 for (; x < DIV_ROUND_UP(width, VNC_DIRTY_PIXELS_PER_BIT); 2815 x++, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) { 2816 int _cmp_bytes = cmp_bytes; 2817 if (!test_and_clear_bit(x, vd->guest.dirty[y])) { 2818 continue; 2819 } 2820 if ((x + 1) * cmp_bytes > line_bytes) { 2821 _cmp_bytes = line_bytes - x * cmp_bytes; 2822 } 2823 assert(_cmp_bytes >= 0); 2824 if (memcmp(server_ptr, guest_ptr, _cmp_bytes) == 0) { 2825 continue; 2826 } 2827 memcpy(server_ptr, guest_ptr, _cmp_bytes); 2828 if (!vd->non_adaptive) { 2829 vnc_rect_updated(vd, x * VNC_DIRTY_PIXELS_PER_BIT, 2830 y, &tv); 2831 } 2832 QTAILQ_FOREACH(vs, &vd->clients, next) { 2833 set_bit(x, vs->dirty[y]); 2834 } 2835 has_dirty++; 2836 } 2837 2838 y++; 2839 } 2840 qemu_pixman_image_unref(tmpbuf); 2841 return has_dirty; 2842 } 2843 2844 static void vnc_refresh(DisplayChangeListener *dcl) 2845 { 2846 VncDisplay *vd = container_of(dcl, VncDisplay, dcl); 2847 VncState *vs, *vn; 2848 int has_dirty, rects = 0; 2849 2850 if (QTAILQ_EMPTY(&vd->clients)) { 2851 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_MAX); 2852 return; 2853 } 2854 2855 graphic_hw_update(vd->dcl.con); 2856 2857 if (vnc_trylock_display(vd)) { 2858 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE); 2859 return; 2860 } 2861 2862 has_dirty = vnc_refresh_server_surface(vd); 2863 vnc_unlock_display(vd); 2864 2865 QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) { 2866 rects += vnc_update_client(vs, has_dirty, false); 2867 /* vs might be free()ed here */ 2868 } 2869 2870 if (has_dirty && rects) { 2871 vd->dcl.update_interval /= 2; 2872 if (vd->dcl.update_interval < VNC_REFRESH_INTERVAL_BASE) { 2873 vd->dcl.update_interval = VNC_REFRESH_INTERVAL_BASE; 2874 } 2875 } else { 2876 vd->dcl.update_interval += VNC_REFRESH_INTERVAL_INC; 2877 if (vd->dcl.update_interval > VNC_REFRESH_INTERVAL_MAX) { 2878 vd->dcl.update_interval = VNC_REFRESH_INTERVAL_MAX; 2879 } 2880 } 2881 } 2882 2883 static void vnc_connect(VncDisplay *vd, QIOChannelSocket *sioc, 2884 bool skipauth, bool websocket) 2885 { 2886 VncState *vs = g_new0(VncState, 1); 2887 bool first_client = QTAILQ_EMPTY(&vd->clients); 2888 int i; 2889 2890 trace_vnc_client_connect(vs, sioc); 2891 vs->sioc = sioc; 2892 object_ref(OBJECT(vs->sioc)); 2893 vs->ioc = QIO_CHANNEL(sioc); 2894 object_ref(OBJECT(vs->ioc)); 2895 vs->vd = vd; 2896 2897 buffer_init(&vs->input, "vnc-input/%p", sioc); 2898 buffer_init(&vs->output, "vnc-output/%p", sioc); 2899 buffer_init(&vs->jobs_buffer, "vnc-jobs_buffer/%p", sioc); 2900 2901 buffer_init(&vs->tight.tight, "vnc-tight/%p", sioc); 2902 buffer_init(&vs->tight.zlib, "vnc-tight-zlib/%p", sioc); 2903 buffer_init(&vs->tight.gradient, "vnc-tight-gradient/%p", sioc); 2904 #ifdef CONFIG_VNC_JPEG 2905 buffer_init(&vs->tight.jpeg, "vnc-tight-jpeg/%p", sioc); 2906 #endif 2907 #ifdef CONFIG_VNC_PNG 2908 buffer_init(&vs->tight.png, "vnc-tight-png/%p", sioc); 2909 #endif 2910 buffer_init(&vs->zlib.zlib, "vnc-zlib/%p", sioc); 2911 buffer_init(&vs->zrle.zrle, "vnc-zrle/%p", sioc); 2912 buffer_init(&vs->zrle.fb, "vnc-zrle-fb/%p", sioc); 2913 buffer_init(&vs->zrle.zlib, "vnc-zrle-zlib/%p", sioc); 2914 2915 if (skipauth) { 2916 vs->auth = VNC_AUTH_NONE; 2917 vs->subauth = VNC_AUTH_INVALID; 2918 } else { 2919 if (websocket) { 2920 vs->auth = vd->ws_auth; 2921 vs->subauth = VNC_AUTH_INVALID; 2922 } else { 2923 vs->auth = vd->auth; 2924 vs->subauth = vd->subauth; 2925 } 2926 } 2927 VNC_DEBUG("Client sioc=%p ws=%d auth=%d subauth=%d\n", 2928 sioc, websocket, vs->auth, vs->subauth); 2929 2930 vs->lossy_rect = g_malloc0(VNC_STAT_ROWS * sizeof (*vs->lossy_rect)); 2931 for (i = 0; i < VNC_STAT_ROWS; ++i) { 2932 vs->lossy_rect[i] = g_new0(uint8_t, VNC_STAT_COLS); 2933 } 2934 2935 VNC_DEBUG("New client on socket %p\n", vs->sioc); 2936 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE); 2937 qio_channel_set_blocking(vs->ioc, false, NULL); 2938 if (vs->ioc_tag) { 2939 g_source_remove(vs->ioc_tag); 2940 } 2941 if (websocket) { 2942 vs->websocket = 1; 2943 if (vd->tlscreds) { 2944 vs->ioc_tag = qio_channel_add_watch( 2945 vs->ioc, G_IO_IN, vncws_tls_handshake_io, vs, NULL); 2946 } else { 2947 vs->ioc_tag = qio_channel_add_watch( 2948 vs->ioc, G_IO_IN, vncws_handshake_io, vs, NULL); 2949 } 2950 } else { 2951 vs->ioc_tag = qio_channel_add_watch( 2952 vs->ioc, G_IO_IN, vnc_client_io, vs, NULL); 2953 } 2954 2955 vnc_client_cache_addr(vs); 2956 vnc_qmp_event(vs, QAPI_EVENT_VNC_CONNECTED); 2957 vnc_set_share_mode(vs, VNC_SHARE_MODE_CONNECTING); 2958 2959 vs->last_x = -1; 2960 vs->last_y = -1; 2961 2962 vs->as.freq = 44100; 2963 vs->as.nchannels = 2; 2964 vs->as.fmt = AUD_FMT_S16; 2965 vs->as.endianness = 0; 2966 2967 qemu_mutex_init(&vs->output_mutex); 2968 vs->bh = qemu_bh_new(vnc_jobs_bh, vs); 2969 2970 QTAILQ_INSERT_TAIL(&vd->clients, vs, next); 2971 if (first_client) { 2972 vnc_update_server_surface(vd); 2973 } 2974 2975 graphic_hw_update(vd->dcl.con); 2976 2977 if (!vs->websocket) { 2978 vnc_start_protocol(vs); 2979 } 2980 2981 if (vd->num_connecting > vd->connections_limit) { 2982 QTAILQ_FOREACH(vs, &vd->clients, next) { 2983 if (vs->share_mode == VNC_SHARE_MODE_CONNECTING) { 2984 vnc_disconnect_start(vs); 2985 return; 2986 } 2987 } 2988 } 2989 } 2990 2991 void vnc_start_protocol(VncState *vs) 2992 { 2993 vnc_write(vs, "RFB 003.008\n", 12); 2994 vnc_flush(vs); 2995 vnc_read_when(vs, protocol_version, 12); 2996 2997 vs->mouse_mode_notifier.notify = check_pointer_type_change; 2998 qemu_add_mouse_mode_change_notifier(&vs->mouse_mode_notifier); 2999 } 3000 3001 static gboolean vnc_listen_io(QIOChannel *ioc, 3002 GIOCondition condition, 3003 void *opaque) 3004 { 3005 VncDisplay *vd = opaque; 3006 QIOChannelSocket *sioc = NULL; 3007 Error *err = NULL; 3008 bool isWebsock = false; 3009 size_t i; 3010 3011 for (i = 0; i < vd->nlwebsock; i++) { 3012 if (ioc == QIO_CHANNEL(vd->lwebsock[i])) { 3013 isWebsock = true; 3014 break; 3015 } 3016 } 3017 3018 sioc = qio_channel_socket_accept(QIO_CHANNEL_SOCKET(ioc), &err); 3019 if (sioc != NULL) { 3020 qio_channel_set_name(QIO_CHANNEL(sioc), 3021 isWebsock ? "vnc-ws-server" : "vnc-server"); 3022 qio_channel_set_delay(QIO_CHANNEL(sioc), false); 3023 vnc_connect(vd, sioc, false, isWebsock); 3024 object_unref(OBJECT(sioc)); 3025 } else { 3026 /* client probably closed connection before we got there */ 3027 error_free(err); 3028 } 3029 3030 return TRUE; 3031 } 3032 3033 static const DisplayChangeListenerOps dcl_ops = { 3034 .dpy_name = "vnc", 3035 .dpy_refresh = vnc_refresh, 3036 .dpy_gfx_update = vnc_dpy_update, 3037 .dpy_gfx_switch = vnc_dpy_switch, 3038 .dpy_gfx_check_format = qemu_pixman_check_format, 3039 .dpy_mouse_set = vnc_mouse_set, 3040 .dpy_cursor_define = vnc_dpy_cursor_define, 3041 }; 3042 3043 void vnc_display_init(const char *id) 3044 { 3045 VncDisplay *vd; 3046 3047 if (vnc_display_find(id) != NULL) { 3048 return; 3049 } 3050 vd = g_malloc0(sizeof(*vd)); 3051 3052 vd->id = strdup(id); 3053 QTAILQ_INSERT_TAIL(&vnc_displays, vd, next); 3054 3055 QTAILQ_INIT(&vd->clients); 3056 vd->expires = TIME_MAX; 3057 3058 if (keyboard_layout) { 3059 trace_vnc_key_map_init(keyboard_layout); 3060 vd->kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout); 3061 } else { 3062 vd->kbd_layout = init_keyboard_layout(name2keysym, "en-us"); 3063 } 3064 3065 if (!vd->kbd_layout) { 3066 exit(1); 3067 } 3068 3069 vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE; 3070 vd->connections_limit = 32; 3071 3072 qemu_mutex_init(&vd->mutex); 3073 vnc_start_worker_thread(); 3074 3075 vd->dcl.ops = &dcl_ops; 3076 register_displaychangelistener(&vd->dcl); 3077 } 3078 3079 3080 static void vnc_display_close(VncDisplay *vd) 3081 { 3082 size_t i; 3083 if (!vd) { 3084 return; 3085 } 3086 vd->is_unix = false; 3087 for (i = 0; i < vd->nlsock; i++) { 3088 if (vd->lsock_tag[i]) { 3089 g_source_remove(vd->lsock_tag[i]); 3090 } 3091 object_unref(OBJECT(vd->lsock[i])); 3092 } 3093 g_free(vd->lsock); 3094 g_free(vd->lsock_tag); 3095 vd->lsock = NULL; 3096 vd->lsock_tag = NULL; 3097 vd->nlsock = 0; 3098 3099 for (i = 0; i < vd->nlwebsock; i++) { 3100 if (vd->lwebsock_tag[i]) { 3101 g_source_remove(vd->lwebsock_tag[i]); 3102 } 3103 object_unref(OBJECT(vd->lwebsock[i])); 3104 } 3105 g_free(vd->lwebsock); 3106 g_free(vd->lwebsock_tag); 3107 vd->lwebsock = NULL; 3108 vd->lwebsock_tag = NULL; 3109 vd->nlwebsock = 0; 3110 3111 vd->auth = VNC_AUTH_INVALID; 3112 vd->subauth = VNC_AUTH_INVALID; 3113 if (vd->tlscreds) { 3114 object_unparent(OBJECT(vd->tlscreds)); 3115 vd->tlscreds = NULL; 3116 } 3117 g_free(vd->tlsaclname); 3118 vd->tlsaclname = NULL; 3119 if (vd->lock_key_sync) { 3120 qemu_remove_led_event_handler(vd->led); 3121 vd->led = NULL; 3122 } 3123 } 3124 3125 int vnc_display_password(const char *id, const char *password) 3126 { 3127 VncDisplay *vd = vnc_display_find(id); 3128 3129 if (!vd) { 3130 return -EINVAL; 3131 } 3132 if (vd->auth == VNC_AUTH_NONE) { 3133 error_printf_unless_qmp("If you want use passwords please enable " 3134 "password auth using '-vnc ${dpy},password'.\n"); 3135 return -EINVAL; 3136 } 3137 3138 g_free(vd->password); 3139 vd->password = g_strdup(password); 3140 3141 return 0; 3142 } 3143 3144 int vnc_display_pw_expire(const char *id, time_t expires) 3145 { 3146 VncDisplay *vd = vnc_display_find(id); 3147 3148 if (!vd) { 3149 return -EINVAL; 3150 } 3151 3152 vd->expires = expires; 3153 return 0; 3154 } 3155 3156 static void vnc_display_print_local_addr(VncDisplay *vd) 3157 { 3158 SocketAddress *addr; 3159 Error *err = NULL; 3160 3161 if (!vd->nlsock) { 3162 return; 3163 } 3164 3165 addr = qio_channel_socket_get_local_address(vd->lsock[0], &err); 3166 if (!addr) { 3167 return; 3168 } 3169 3170 if (addr->type != SOCKET_ADDRESS_TYPE_INET) { 3171 qapi_free_SocketAddress(addr); 3172 return; 3173 } 3174 error_printf_unless_qmp("VNC server running on %s:%s\n", 3175 addr->u.inet.host, 3176 addr->u.inet.port); 3177 qapi_free_SocketAddress(addr); 3178 } 3179 3180 static QemuOptsList qemu_vnc_opts = { 3181 .name = "vnc", 3182 .head = QTAILQ_HEAD_INITIALIZER(qemu_vnc_opts.head), 3183 .implied_opt_name = "vnc", 3184 .desc = { 3185 { 3186 .name = "vnc", 3187 .type = QEMU_OPT_STRING, 3188 },{ 3189 .name = "websocket", 3190 .type = QEMU_OPT_STRING, 3191 },{ 3192 .name = "tls-creds", 3193 .type = QEMU_OPT_STRING, 3194 },{ 3195 /* Deprecated in favour of tls-creds */ 3196 .name = "x509", 3197 .type = QEMU_OPT_STRING, 3198 },{ 3199 .name = "share", 3200 .type = QEMU_OPT_STRING, 3201 },{ 3202 .name = "display", 3203 .type = QEMU_OPT_STRING, 3204 },{ 3205 .name = "head", 3206 .type = QEMU_OPT_NUMBER, 3207 },{ 3208 .name = "connections", 3209 .type = QEMU_OPT_NUMBER, 3210 },{ 3211 .name = "to", 3212 .type = QEMU_OPT_NUMBER, 3213 },{ 3214 .name = "ipv4", 3215 .type = QEMU_OPT_BOOL, 3216 },{ 3217 .name = "ipv6", 3218 .type = QEMU_OPT_BOOL, 3219 },{ 3220 .name = "password", 3221 .type = QEMU_OPT_BOOL, 3222 },{ 3223 .name = "reverse", 3224 .type = QEMU_OPT_BOOL, 3225 },{ 3226 .name = "lock-key-sync", 3227 .type = QEMU_OPT_BOOL, 3228 },{ 3229 .name = "key-delay-ms", 3230 .type = QEMU_OPT_NUMBER, 3231 },{ 3232 .name = "sasl", 3233 .type = QEMU_OPT_BOOL, 3234 },{ 3235 /* Deprecated in favour of tls-creds */ 3236 .name = "tls", 3237 .type = QEMU_OPT_BOOL, 3238 },{ 3239 /* Deprecated in favour of tls-creds */ 3240 .name = "x509verify", 3241 .type = QEMU_OPT_STRING, 3242 },{ 3243 .name = "acl", 3244 .type = QEMU_OPT_BOOL, 3245 },{ 3246 .name = "lossy", 3247 .type = QEMU_OPT_BOOL, 3248 },{ 3249 .name = "non-adaptive", 3250 .type = QEMU_OPT_BOOL, 3251 }, 3252 { /* end of list */ } 3253 }, 3254 }; 3255 3256 3257 static int 3258 vnc_display_setup_auth(int *auth, 3259 int *subauth, 3260 QCryptoTLSCreds *tlscreds, 3261 bool password, 3262 bool sasl, 3263 bool websocket, 3264 Error **errp) 3265 { 3266 /* 3267 * We have a choice of 3 authentication options 3268 * 3269 * 1. none 3270 * 2. vnc 3271 * 3. sasl 3272 * 3273 * The channel can be run in 2 modes 3274 * 3275 * 1. clear 3276 * 2. tls 3277 * 3278 * And TLS can use 2 types of credentials 3279 * 3280 * 1. anon 3281 * 2. x509 3282 * 3283 * We thus have 9 possible logical combinations 3284 * 3285 * 1. clear + none 3286 * 2. clear + vnc 3287 * 3. clear + sasl 3288 * 4. tls + anon + none 3289 * 5. tls + anon + vnc 3290 * 6. tls + anon + sasl 3291 * 7. tls + x509 + none 3292 * 8. tls + x509 + vnc 3293 * 9. tls + x509 + sasl 3294 * 3295 * These need to be mapped into the VNC auth schemes 3296 * in an appropriate manner. In regular VNC, all the 3297 * TLS options get mapped into VNC_AUTH_VENCRYPT 3298 * sub-auth types. 3299 * 3300 * In websockets, the https:// protocol already provides 3301 * TLS support, so there is no need to make use of the 3302 * VeNCrypt extension. Furthermore, websockets browser 3303 * clients could not use VeNCrypt even if they wanted to, 3304 * as they cannot control when the TLS handshake takes 3305 * place. Thus there is no option but to rely on https://, 3306 * meaning combinations 4->6 and 7->9 will be mapped to 3307 * VNC auth schemes in the same way as combos 1->3. 3308 * 3309 * Regardless of fact that we have a different mapping to 3310 * VNC auth mechs for plain VNC vs websockets VNC, the end 3311 * result has the same security characteristics. 3312 */ 3313 if (websocket || !tlscreds) { 3314 if (password) { 3315 VNC_DEBUG("Initializing VNC server with password auth\n"); 3316 *auth = VNC_AUTH_VNC; 3317 } else if (sasl) { 3318 VNC_DEBUG("Initializing VNC server with SASL auth\n"); 3319 *auth = VNC_AUTH_SASL; 3320 } else { 3321 VNC_DEBUG("Initializing VNC server with no auth\n"); 3322 *auth = VNC_AUTH_NONE; 3323 } 3324 *subauth = VNC_AUTH_INVALID; 3325 } else { 3326 bool is_x509 = object_dynamic_cast(OBJECT(tlscreds), 3327 TYPE_QCRYPTO_TLS_CREDS_X509) != NULL; 3328 bool is_anon = object_dynamic_cast(OBJECT(tlscreds), 3329 TYPE_QCRYPTO_TLS_CREDS_ANON) != NULL; 3330 3331 if (!is_x509 && !is_anon) { 3332 error_setg(errp, 3333 "Unsupported TLS cred type %s", 3334 object_get_typename(OBJECT(tlscreds))); 3335 return -1; 3336 } 3337 *auth = VNC_AUTH_VENCRYPT; 3338 if (password) { 3339 if (is_x509) { 3340 VNC_DEBUG("Initializing VNC server with x509 password auth\n"); 3341 *subauth = VNC_AUTH_VENCRYPT_X509VNC; 3342 } else { 3343 VNC_DEBUG("Initializing VNC server with TLS password auth\n"); 3344 *subauth = VNC_AUTH_VENCRYPT_TLSVNC; 3345 } 3346 3347 } else if (sasl) { 3348 if (is_x509) { 3349 VNC_DEBUG("Initializing VNC server with x509 SASL auth\n"); 3350 *subauth = VNC_AUTH_VENCRYPT_X509SASL; 3351 } else { 3352 VNC_DEBUG("Initializing VNC server with TLS SASL auth\n"); 3353 *subauth = VNC_AUTH_VENCRYPT_TLSSASL; 3354 } 3355 } else { 3356 if (is_x509) { 3357 VNC_DEBUG("Initializing VNC server with x509 no auth\n"); 3358 *subauth = VNC_AUTH_VENCRYPT_X509NONE; 3359 } else { 3360 VNC_DEBUG("Initializing VNC server with TLS no auth\n"); 3361 *subauth = VNC_AUTH_VENCRYPT_TLSNONE; 3362 } 3363 } 3364 } 3365 return 0; 3366 } 3367 3368 3369 /* 3370 * Handle back compat with old CLI syntax by creating some 3371 * suitable QCryptoTLSCreds objects 3372 */ 3373 static QCryptoTLSCreds * 3374 vnc_display_create_creds(bool x509, 3375 bool x509verify, 3376 const char *dir, 3377 const char *id, 3378 Error **errp) 3379 { 3380 gchar *credsid = g_strdup_printf("tlsvnc%s", id); 3381 Object *parent = object_get_objects_root(); 3382 Object *creds; 3383 Error *err = NULL; 3384 3385 if (x509) { 3386 creds = object_new_with_props(TYPE_QCRYPTO_TLS_CREDS_X509, 3387 parent, 3388 credsid, 3389 &err, 3390 "endpoint", "server", 3391 "dir", dir, 3392 "verify-peer", x509verify ? "yes" : "no", 3393 NULL); 3394 } else { 3395 creds = object_new_with_props(TYPE_QCRYPTO_TLS_CREDS_ANON, 3396 parent, 3397 credsid, 3398 &err, 3399 "endpoint", "server", 3400 NULL); 3401 } 3402 3403 g_free(credsid); 3404 3405 if (err) { 3406 error_propagate(errp, err); 3407 return NULL; 3408 } 3409 3410 return QCRYPTO_TLS_CREDS(creds); 3411 } 3412 3413 3414 static int vnc_display_get_address(const char *addrstr, 3415 bool websocket, 3416 bool reverse, 3417 int displaynum, 3418 int to, 3419 bool has_ipv4, 3420 bool has_ipv6, 3421 bool ipv4, 3422 bool ipv6, 3423 SocketAddress **retaddr, 3424 Error **errp) 3425 { 3426 int ret = -1; 3427 SocketAddress *addr = NULL; 3428 3429 addr = g_new0(SocketAddress, 1); 3430 3431 if (strncmp(addrstr, "unix:", 5) == 0) { 3432 addr->type = SOCKET_ADDRESS_TYPE_UNIX; 3433 addr->u.q_unix.path = g_strdup(addrstr + 5); 3434 3435 if (websocket) { 3436 error_setg(errp, "UNIX sockets not supported with websock"); 3437 goto cleanup; 3438 } 3439 3440 if (to) { 3441 error_setg(errp, "Port range not support with UNIX socket"); 3442 goto cleanup; 3443 } 3444 ret = 0; 3445 } else { 3446 const char *port; 3447 size_t hostlen; 3448 unsigned long long baseport = 0; 3449 InetSocketAddress *inet; 3450 3451 port = strrchr(addrstr, ':'); 3452 if (!port) { 3453 if (websocket) { 3454 hostlen = 0; 3455 port = addrstr; 3456 } else { 3457 error_setg(errp, "no vnc port specified"); 3458 goto cleanup; 3459 } 3460 } else { 3461 hostlen = port - addrstr; 3462 port++; 3463 if (*port == '\0') { 3464 error_setg(errp, "vnc port cannot be empty"); 3465 goto cleanup; 3466 } 3467 } 3468 3469 addr->type = SOCKET_ADDRESS_TYPE_INET; 3470 inet = &addr->u.inet; 3471 if (addrstr[0] == '[' && addrstr[hostlen - 1] == ']') { 3472 inet->host = g_strndup(addrstr + 1, hostlen - 2); 3473 } else { 3474 inet->host = g_strndup(addrstr, hostlen); 3475 } 3476 /* plain VNC port is just an offset, for websocket 3477 * port is absolute */ 3478 if (websocket) { 3479 if (g_str_equal(addrstr, "") || 3480 g_str_equal(addrstr, "on")) { 3481 if (displaynum == -1) { 3482 error_setg(errp, "explicit websocket port is required"); 3483 goto cleanup; 3484 } 3485 inet->port = g_strdup_printf( 3486 "%d", displaynum + 5700); 3487 if (to) { 3488 inet->has_to = true; 3489 inet->to = to + 5700; 3490 } 3491 } else { 3492 inet->port = g_strdup(port); 3493 } 3494 } else { 3495 int offset = reverse ? 0 : 5900; 3496 if (parse_uint_full(port, &baseport, 10) < 0) { 3497 error_setg(errp, "can't convert to a number: %s", port); 3498 goto cleanup; 3499 } 3500 if (baseport > 65535 || 3501 baseport + offset > 65535) { 3502 error_setg(errp, "port %s out of range", port); 3503 goto cleanup; 3504 } 3505 inet->port = g_strdup_printf( 3506 "%d", (int)baseport + offset); 3507 3508 if (to) { 3509 inet->has_to = true; 3510 inet->to = to + offset; 3511 } 3512 } 3513 3514 inet->ipv4 = ipv4; 3515 inet->has_ipv4 = has_ipv4; 3516 inet->ipv6 = ipv6; 3517 inet->has_ipv6 = has_ipv6; 3518 3519 ret = baseport; 3520 } 3521 3522 *retaddr = addr; 3523 3524 cleanup: 3525 if (ret < 0) { 3526 qapi_free_SocketAddress(addr); 3527 } 3528 return ret; 3529 } 3530 3531 static void vnc_free_addresses(SocketAddress ***retsaddr, 3532 size_t *retnsaddr) 3533 { 3534 size_t i; 3535 3536 for (i = 0; i < *retnsaddr; i++) { 3537 qapi_free_SocketAddress((*retsaddr)[i]); 3538 } 3539 g_free(*retsaddr); 3540 3541 *retsaddr = NULL; 3542 *retnsaddr = 0; 3543 } 3544 3545 static int vnc_display_get_addresses(QemuOpts *opts, 3546 bool reverse, 3547 SocketAddress ***retsaddr, 3548 size_t *retnsaddr, 3549 SocketAddress ***retwsaddr, 3550 size_t *retnwsaddr, 3551 Error **errp) 3552 { 3553 SocketAddress *saddr = NULL; 3554 SocketAddress *wsaddr = NULL; 3555 QemuOptsIter addriter; 3556 const char *addr; 3557 int to = qemu_opt_get_number(opts, "to", 0); 3558 bool has_ipv4 = qemu_opt_get(opts, "ipv4"); 3559 bool has_ipv6 = qemu_opt_get(opts, "ipv6"); 3560 bool ipv4 = qemu_opt_get_bool(opts, "ipv4", false); 3561 bool ipv6 = qemu_opt_get_bool(opts, "ipv6", false); 3562 int displaynum = -1; 3563 int ret = -1; 3564 3565 *retsaddr = NULL; 3566 *retnsaddr = 0; 3567 *retwsaddr = NULL; 3568 *retnwsaddr = 0; 3569 3570 addr = qemu_opt_get(opts, "vnc"); 3571 if (addr == NULL || g_str_equal(addr, "none")) { 3572 ret = 0; 3573 goto cleanup; 3574 } 3575 if (qemu_opt_get(opts, "websocket") && 3576 !qcrypto_hash_supports(QCRYPTO_HASH_ALG_SHA1)) { 3577 error_setg(errp, 3578 "SHA1 hash support is required for websockets"); 3579 goto cleanup; 3580 } 3581 3582 qemu_opt_iter_init(&addriter, opts, "vnc"); 3583 while ((addr = qemu_opt_iter_next(&addriter)) != NULL) { 3584 int rv; 3585 rv = vnc_display_get_address(addr, false, reverse, 0, to, 3586 has_ipv4, has_ipv6, 3587 ipv4, ipv6, 3588 &saddr, errp); 3589 if (rv < 0) { 3590 goto cleanup; 3591 } 3592 /* Historical compat - first listen address can be used 3593 * to set the default websocket port 3594 */ 3595 if (displaynum == -1) { 3596 displaynum = rv; 3597 } 3598 *retsaddr = g_renew(SocketAddress *, *retsaddr, *retnsaddr + 1); 3599 (*retsaddr)[(*retnsaddr)++] = saddr; 3600 } 3601 3602 /* If we had multiple primary displays, we don't do defaults 3603 * for websocket, and require explicit config instead. */ 3604 if (*retnsaddr > 1) { 3605 displaynum = -1; 3606 } 3607 3608 qemu_opt_iter_init(&addriter, opts, "websocket"); 3609 while ((addr = qemu_opt_iter_next(&addriter)) != NULL) { 3610 if (vnc_display_get_address(addr, true, reverse, displaynum, to, 3611 has_ipv4, has_ipv6, 3612 ipv4, ipv6, 3613 &wsaddr, errp) < 0) { 3614 goto cleanup; 3615 } 3616 3617 /* Historical compat - if only a single listen address was 3618 * provided, then this is used to set the default listen 3619 * address for websocket too 3620 */ 3621 if (*retnsaddr == 1 && 3622 (*retsaddr)[0]->type == SOCKET_ADDRESS_TYPE_INET && 3623 wsaddr->type == SOCKET_ADDRESS_TYPE_INET && 3624 g_str_equal(wsaddr->u.inet.host, "") && 3625 !g_str_equal((*retsaddr)[0]->u.inet.host, "")) { 3626 g_free(wsaddr->u.inet.host); 3627 wsaddr->u.inet.host = g_strdup((*retsaddr)[0]->u.inet.host); 3628 } 3629 3630 *retwsaddr = g_renew(SocketAddress *, *retwsaddr, *retnwsaddr + 1); 3631 (*retwsaddr)[(*retnwsaddr)++] = wsaddr; 3632 } 3633 3634 ret = 0; 3635 cleanup: 3636 if (ret < 0) { 3637 vnc_free_addresses(retsaddr, retnsaddr); 3638 vnc_free_addresses(retwsaddr, retnwsaddr); 3639 } 3640 return ret; 3641 } 3642 3643 static int vnc_display_connect(VncDisplay *vd, 3644 SocketAddress **saddr, 3645 size_t nsaddr, 3646 SocketAddress **wsaddr, 3647 size_t nwsaddr, 3648 Error **errp) 3649 { 3650 /* connect to viewer */ 3651 QIOChannelSocket *sioc = NULL; 3652 if (nwsaddr != 0) { 3653 error_setg(errp, "Cannot use websockets in reverse mode"); 3654 return -1; 3655 } 3656 if (nsaddr != 1) { 3657 error_setg(errp, "Expected a single address in reverse mode"); 3658 return -1; 3659 } 3660 /* TODO SOCKET_ADDRESS_TYPE_FD when fd has AF_UNIX */ 3661 vd->is_unix = saddr[0]->type == SOCKET_ADDRESS_TYPE_UNIX; 3662 sioc = qio_channel_socket_new(); 3663 qio_channel_set_name(QIO_CHANNEL(sioc), "vnc-reverse"); 3664 if (qio_channel_socket_connect_sync(sioc, saddr[0], errp) < 0) { 3665 return -1; 3666 } 3667 vnc_connect(vd, sioc, false, false); 3668 object_unref(OBJECT(sioc)); 3669 return 0; 3670 } 3671 3672 3673 static int vnc_display_listen_addr(VncDisplay *vd, 3674 SocketAddress *addr, 3675 const char *name, 3676 QIOChannelSocket ***lsock, 3677 guint **lsock_tag, 3678 size_t *nlsock, 3679 Error **errp) 3680 { 3681 QIODNSResolver *resolver = qio_dns_resolver_get_instance(); 3682 SocketAddress **rawaddrs = NULL; 3683 size_t nrawaddrs = 0; 3684 Error *listenerr = NULL; 3685 bool listening = false; 3686 size_t i; 3687 3688 if (qio_dns_resolver_lookup_sync(resolver, addr, &nrawaddrs, 3689 &rawaddrs, errp) < 0) { 3690 return -1; 3691 } 3692 3693 for (i = 0; i < nrawaddrs; i++) { 3694 QIOChannelSocket *sioc = qio_channel_socket_new(); 3695 3696 qio_channel_set_name(QIO_CHANNEL(sioc), name); 3697 if (qio_channel_socket_listen_sync( 3698 sioc, rawaddrs[i], listenerr == NULL ? &listenerr : NULL) < 0) { 3699 object_unref(OBJECT(sioc)); 3700 continue; 3701 } 3702 listening = true; 3703 (*nlsock)++; 3704 *lsock = g_renew(QIOChannelSocket *, *lsock, *nlsock); 3705 *lsock_tag = g_renew(guint, *lsock_tag, *nlsock); 3706 3707 (*lsock)[*nlsock - 1] = sioc; 3708 (*lsock_tag)[*nlsock - 1] = 0; 3709 } 3710 3711 for (i = 0; i < nrawaddrs; i++) { 3712 qapi_free_SocketAddress(rawaddrs[i]); 3713 } 3714 g_free(rawaddrs); 3715 3716 if (listenerr) { 3717 if (!listening) { 3718 error_propagate(errp, listenerr); 3719 return -1; 3720 } else { 3721 error_free(listenerr); 3722 } 3723 } 3724 3725 for (i = 0; i < *nlsock; i++) { 3726 (*lsock_tag)[i] = qio_channel_add_watch( 3727 QIO_CHANNEL((*lsock)[i]), 3728 G_IO_IN, vnc_listen_io, vd, NULL); 3729 } 3730 3731 return 0; 3732 } 3733 3734 3735 static int vnc_display_listen(VncDisplay *vd, 3736 SocketAddress **saddr, 3737 size_t nsaddr, 3738 SocketAddress **wsaddr, 3739 size_t nwsaddr, 3740 Error **errp) 3741 { 3742 size_t i; 3743 3744 for (i = 0; i < nsaddr; i++) { 3745 if (vnc_display_listen_addr(vd, saddr[i], 3746 "vnc-listen", 3747 &vd->lsock, 3748 &vd->lsock_tag, 3749 &vd->nlsock, 3750 errp) < 0) { 3751 return -1; 3752 } 3753 } 3754 for (i = 0; i < nwsaddr; i++) { 3755 if (vnc_display_listen_addr(vd, wsaddr[i], 3756 "vnc-ws-listen", 3757 &vd->lwebsock, 3758 &vd->lwebsock_tag, 3759 &vd->nlwebsock, 3760 errp) < 0) { 3761 return -1; 3762 } 3763 } 3764 3765 return 0; 3766 } 3767 3768 3769 void vnc_display_open(const char *id, Error **errp) 3770 { 3771 VncDisplay *vd = vnc_display_find(id); 3772 QemuOpts *opts = qemu_opts_find(&qemu_vnc_opts, id); 3773 SocketAddress **saddr = NULL, **wsaddr = NULL; 3774 size_t nsaddr, nwsaddr; 3775 const char *share, *device_id; 3776 QemuConsole *con; 3777 bool password = false; 3778 bool reverse = false; 3779 const char *credid; 3780 bool sasl = false; 3781 #ifdef CONFIG_VNC_SASL 3782 int saslErr; 3783 #endif 3784 int acl = 0; 3785 int lock_key_sync = 1; 3786 int key_delay_ms; 3787 3788 if (!vd) { 3789 error_setg(errp, "VNC display not active"); 3790 return; 3791 } 3792 vnc_display_close(vd); 3793 3794 if (!opts) { 3795 return; 3796 } 3797 3798 reverse = qemu_opt_get_bool(opts, "reverse", false); 3799 if (vnc_display_get_addresses(opts, reverse, &saddr, &nsaddr, 3800 &wsaddr, &nwsaddr, errp) < 0) { 3801 goto fail; 3802 } 3803 3804 password = qemu_opt_get_bool(opts, "password", false); 3805 if (password) { 3806 if (fips_get_state()) { 3807 error_setg(errp, 3808 "VNC password auth disabled due to FIPS mode, " 3809 "consider using the VeNCrypt or SASL authentication " 3810 "methods as an alternative"); 3811 goto fail; 3812 } 3813 if (!qcrypto_cipher_supports( 3814 QCRYPTO_CIPHER_ALG_DES_RFB, QCRYPTO_CIPHER_MODE_ECB)) { 3815 error_setg(errp, 3816 "Cipher backend does not support DES RFB algorithm"); 3817 goto fail; 3818 } 3819 } 3820 3821 lock_key_sync = qemu_opt_get_bool(opts, "lock-key-sync", true); 3822 key_delay_ms = qemu_opt_get_number(opts, "key-delay-ms", 10); 3823 sasl = qemu_opt_get_bool(opts, "sasl", false); 3824 #ifndef CONFIG_VNC_SASL 3825 if (sasl) { 3826 error_setg(errp, "VNC SASL auth requires cyrus-sasl support"); 3827 goto fail; 3828 } 3829 #endif /* CONFIG_VNC_SASL */ 3830 credid = qemu_opt_get(opts, "tls-creds"); 3831 if (credid) { 3832 Object *creds; 3833 if (qemu_opt_get(opts, "tls") || 3834 qemu_opt_get(opts, "x509") || 3835 qemu_opt_get(opts, "x509verify")) { 3836 error_setg(errp, 3837 "'tls-creds' parameter is mutually exclusive with " 3838 "'tls', 'x509' and 'x509verify' parameters"); 3839 goto fail; 3840 } 3841 3842 creds = object_resolve_path_component( 3843 object_get_objects_root(), credid); 3844 if (!creds) { 3845 error_setg(errp, "No TLS credentials with id '%s'", 3846 credid); 3847 goto fail; 3848 } 3849 vd->tlscreds = (QCryptoTLSCreds *) 3850 object_dynamic_cast(creds, 3851 TYPE_QCRYPTO_TLS_CREDS); 3852 if (!vd->tlscreds) { 3853 error_setg(errp, "Object with id '%s' is not TLS credentials", 3854 credid); 3855 goto fail; 3856 } 3857 object_ref(OBJECT(vd->tlscreds)); 3858 3859 if (vd->tlscreds->endpoint != QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) { 3860 error_setg(errp, 3861 "Expecting TLS credentials with a server endpoint"); 3862 goto fail; 3863 } 3864 } else { 3865 const char *path; 3866 bool tls = false, x509 = false, x509verify = false; 3867 tls = qemu_opt_get_bool(opts, "tls", false); 3868 if (tls) { 3869 path = qemu_opt_get(opts, "x509"); 3870 3871 if (path) { 3872 x509 = true; 3873 } else { 3874 path = qemu_opt_get(opts, "x509verify"); 3875 if (path) { 3876 x509 = true; 3877 x509verify = true; 3878 } 3879 } 3880 vd->tlscreds = vnc_display_create_creds(x509, 3881 x509verify, 3882 path, 3883 vd->id, 3884 errp); 3885 if (!vd->tlscreds) { 3886 goto fail; 3887 } 3888 } 3889 } 3890 acl = qemu_opt_get_bool(opts, "acl", false); 3891 3892 share = qemu_opt_get(opts, "share"); 3893 if (share) { 3894 if (strcmp(share, "ignore") == 0) { 3895 vd->share_policy = VNC_SHARE_POLICY_IGNORE; 3896 } else if (strcmp(share, "allow-exclusive") == 0) { 3897 vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE; 3898 } else if (strcmp(share, "force-shared") == 0) { 3899 vd->share_policy = VNC_SHARE_POLICY_FORCE_SHARED; 3900 } else { 3901 error_setg(errp, "unknown vnc share= option"); 3902 goto fail; 3903 } 3904 } else { 3905 vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE; 3906 } 3907 vd->connections_limit = qemu_opt_get_number(opts, "connections", 32); 3908 3909 #ifdef CONFIG_VNC_JPEG 3910 vd->lossy = qemu_opt_get_bool(opts, "lossy", false); 3911 #endif 3912 vd->non_adaptive = qemu_opt_get_bool(opts, "non-adaptive", false); 3913 /* adaptive updates are only used with tight encoding and 3914 * if lossy updates are enabled so we can disable all the 3915 * calculations otherwise */ 3916 if (!vd->lossy) { 3917 vd->non_adaptive = true; 3918 } 3919 3920 if (acl) { 3921 if (strcmp(vd->id, "default") == 0) { 3922 vd->tlsaclname = g_strdup("vnc.x509dname"); 3923 } else { 3924 vd->tlsaclname = g_strdup_printf("vnc.%s.x509dname", vd->id); 3925 } 3926 qemu_acl_init(vd->tlsaclname); 3927 } 3928 #ifdef CONFIG_VNC_SASL 3929 if (acl && sasl) { 3930 char *aclname; 3931 3932 if (strcmp(vd->id, "default") == 0) { 3933 aclname = g_strdup("vnc.username"); 3934 } else { 3935 aclname = g_strdup_printf("vnc.%s.username", vd->id); 3936 } 3937 vd->sasl.acl = qemu_acl_init(aclname); 3938 g_free(aclname); 3939 } 3940 #endif 3941 3942 if (vnc_display_setup_auth(&vd->auth, &vd->subauth, 3943 vd->tlscreds, password, 3944 sasl, false, errp) < 0) { 3945 goto fail; 3946 } 3947 trace_vnc_auth_init(vd, 0, vd->auth, vd->subauth); 3948 3949 if (vnc_display_setup_auth(&vd->ws_auth, &vd->ws_subauth, 3950 vd->tlscreds, password, 3951 sasl, true, errp) < 0) { 3952 goto fail; 3953 } 3954 trace_vnc_auth_init(vd, 1, vd->ws_auth, vd->ws_subauth); 3955 3956 #ifdef CONFIG_VNC_SASL 3957 if ((saslErr = sasl_server_init(NULL, "qemu")) != SASL_OK) { 3958 error_setg(errp, "Failed to initialize SASL auth: %s", 3959 sasl_errstring(saslErr, NULL, NULL)); 3960 goto fail; 3961 } 3962 #endif 3963 vd->lock_key_sync = lock_key_sync; 3964 if (lock_key_sync) { 3965 vd->led = qemu_add_led_event_handler(kbd_leds, vd); 3966 } 3967 vd->ledstate = 0; 3968 vd->key_delay_ms = key_delay_ms; 3969 3970 device_id = qemu_opt_get(opts, "display"); 3971 if (device_id) { 3972 int head = qemu_opt_get_number(opts, "head", 0); 3973 Error *err = NULL; 3974 3975 con = qemu_console_lookup_by_device_name(device_id, head, &err); 3976 if (err) { 3977 error_propagate(errp, err); 3978 goto fail; 3979 } 3980 } else { 3981 con = NULL; 3982 } 3983 3984 if (con != vd->dcl.con) { 3985 unregister_displaychangelistener(&vd->dcl); 3986 vd->dcl.con = con; 3987 register_displaychangelistener(&vd->dcl); 3988 } 3989 3990 if (saddr == NULL) { 3991 goto cleanup; 3992 } 3993 3994 if (reverse) { 3995 if (vnc_display_connect(vd, saddr, nsaddr, wsaddr, nwsaddr, errp) < 0) { 3996 goto fail; 3997 } 3998 } else { 3999 if (vnc_display_listen(vd, saddr, nsaddr, wsaddr, nwsaddr, errp) < 0) { 4000 goto fail; 4001 } 4002 } 4003 4004 if (qemu_opt_get(opts, "to")) { 4005 vnc_display_print_local_addr(vd); 4006 } 4007 4008 cleanup: 4009 vnc_free_addresses(&saddr, &nsaddr); 4010 vnc_free_addresses(&wsaddr, &nwsaddr); 4011 return; 4012 4013 fail: 4014 vnc_display_close(vd); 4015 goto cleanup; 4016 } 4017 4018 void vnc_display_add_client(const char *id, int csock, bool skipauth) 4019 { 4020 VncDisplay *vd = vnc_display_find(id); 4021 QIOChannelSocket *sioc; 4022 4023 if (!vd) { 4024 return; 4025 } 4026 4027 sioc = qio_channel_socket_new_fd(csock, NULL); 4028 if (sioc) { 4029 qio_channel_set_name(QIO_CHANNEL(sioc), "vnc-server"); 4030 vnc_connect(vd, sioc, skipauth, false); 4031 object_unref(OBJECT(sioc)); 4032 } 4033 } 4034 4035 static void vnc_auto_assign_id(QemuOptsList *olist, QemuOpts *opts) 4036 { 4037 int i = 2; 4038 char *id; 4039 4040 id = g_strdup("default"); 4041 while (qemu_opts_find(olist, id)) { 4042 g_free(id); 4043 id = g_strdup_printf("vnc%d", i++); 4044 } 4045 qemu_opts_set_id(opts, id); 4046 } 4047 4048 QemuOpts *vnc_parse(const char *str, Error **errp) 4049 { 4050 QemuOptsList *olist = qemu_find_opts("vnc"); 4051 QemuOpts *opts = qemu_opts_parse(olist, str, true, errp); 4052 const char *id; 4053 4054 if (!opts) { 4055 return NULL; 4056 } 4057 4058 id = qemu_opts_id(opts); 4059 if (!id) { 4060 /* auto-assign id if not present */ 4061 vnc_auto_assign_id(olist, opts); 4062 } 4063 return opts; 4064 } 4065 4066 int vnc_init_func(void *opaque, QemuOpts *opts, Error **errp) 4067 { 4068 Error *local_err = NULL; 4069 char *id = (char *)qemu_opts_id(opts); 4070 4071 assert(id); 4072 vnc_display_init(id); 4073 vnc_display_open(id, &local_err); 4074 if (local_err != NULL) { 4075 error_reportf_err(local_err, "Failed to start VNC server: "); 4076 exit(1); 4077 } 4078 return 0; 4079 } 4080 4081 static void vnc_register_config(void) 4082 { 4083 qemu_add_opts(&qemu_vnc_opts); 4084 } 4085 opts_init(vnc_register_config); 4086