1 /* 2 * QEMU VNC display driver 3 * 4 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws> 5 * Copyright (C) 2006 Fabrice Bellard 6 * Copyright (C) 2009 Red Hat, Inc 7 * 8 * Permission is hereby granted, free of charge, to any person obtaining a copy 9 * of this software and associated documentation files (the "Software"), to deal 10 * in the Software without restriction, including without limitation the rights 11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 12 * copies of the Software, and to permit persons to whom the Software is 13 * furnished to do so, subject to the following conditions: 14 * 15 * The above copyright notice and this permission notice shall be included in 16 * all copies or substantial portions of the Software. 17 * 18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 24 * THE SOFTWARE. 25 */ 26 27 #include "qemu/osdep.h" 28 #include "vnc.h" 29 #include "vnc-jobs.h" 30 #include "trace.h" 31 #include "sysemu/sysemu.h" 32 #include "qemu/error-report.h" 33 #include "qemu/sockets.h" 34 #include "qemu/timer.h" 35 #include "qemu/acl.h" 36 #include "qemu/config-file.h" 37 #include "qapi/error.h" 38 #include "qmp-commands.h" 39 #include "ui/input.h" 40 #include "qapi-event.h" 41 #include "crypto/hash.h" 42 #include "crypto/tlscredsanon.h" 43 #include "crypto/tlscredsx509.h" 44 #include "qom/object_interfaces.h" 45 #include "qemu/cutils.h" 46 #include "io/dns-resolver.h" 47 48 #define VNC_REFRESH_INTERVAL_BASE GUI_REFRESH_INTERVAL_DEFAULT 49 #define VNC_REFRESH_INTERVAL_INC 50 50 #define VNC_REFRESH_INTERVAL_MAX GUI_REFRESH_INTERVAL_IDLE 51 static const struct timeval VNC_REFRESH_STATS = { 0, 500000 }; 52 static const struct timeval VNC_REFRESH_LOSSY = { 2, 0 }; 53 54 #include "vnc_keysym.h" 55 #include "crypto/cipher.h" 56 57 static QTAILQ_HEAD(, VncDisplay) vnc_displays = 58 QTAILQ_HEAD_INITIALIZER(vnc_displays); 59 60 static int vnc_cursor_define(VncState *vs); 61 static void vnc_release_modifiers(VncState *vs); 62 static void vnc_update_throttle_offset(VncState *vs); 63 64 static void vnc_set_share_mode(VncState *vs, VncShareMode mode) 65 { 66 #ifdef _VNC_DEBUG 67 static const char *mn[] = { 68 [0] = "undefined", 69 [VNC_SHARE_MODE_CONNECTING] = "connecting", 70 [VNC_SHARE_MODE_SHARED] = "shared", 71 [VNC_SHARE_MODE_EXCLUSIVE] = "exclusive", 72 [VNC_SHARE_MODE_DISCONNECTED] = "disconnected", 73 }; 74 fprintf(stderr, "%s/%p: %s -> %s\n", __func__, 75 vs->ioc, mn[vs->share_mode], mn[mode]); 76 #endif 77 78 switch (vs->share_mode) { 79 case VNC_SHARE_MODE_CONNECTING: 80 vs->vd->num_connecting--; 81 break; 82 case VNC_SHARE_MODE_SHARED: 83 vs->vd->num_shared--; 84 break; 85 case VNC_SHARE_MODE_EXCLUSIVE: 86 vs->vd->num_exclusive--; 87 break; 88 default: 89 break; 90 } 91 92 vs->share_mode = mode; 93 94 switch (vs->share_mode) { 95 case VNC_SHARE_MODE_CONNECTING: 96 vs->vd->num_connecting++; 97 break; 98 case VNC_SHARE_MODE_SHARED: 99 vs->vd->num_shared++; 100 break; 101 case VNC_SHARE_MODE_EXCLUSIVE: 102 vs->vd->num_exclusive++; 103 break; 104 default: 105 break; 106 } 107 } 108 109 110 static void vnc_init_basic_info(SocketAddress *addr, 111 VncBasicInfo *info, 112 Error **errp) 113 { 114 switch (addr->type) { 115 case SOCKET_ADDRESS_TYPE_INET: 116 info->host = g_strdup(addr->u.inet.host); 117 info->service = g_strdup(addr->u.inet.port); 118 if (addr->u.inet.ipv6) { 119 info->family = NETWORK_ADDRESS_FAMILY_IPV6; 120 } else { 121 info->family = NETWORK_ADDRESS_FAMILY_IPV4; 122 } 123 break; 124 125 case SOCKET_ADDRESS_TYPE_UNIX: 126 info->host = g_strdup(""); 127 info->service = g_strdup(addr->u.q_unix.path); 128 info->family = NETWORK_ADDRESS_FAMILY_UNIX; 129 break; 130 131 case SOCKET_ADDRESS_TYPE_VSOCK: 132 case SOCKET_ADDRESS_TYPE_FD: 133 error_setg(errp, "Unsupported socket address type %s", 134 SocketAddressType_str(addr->type)); 135 break; 136 default: 137 abort(); 138 } 139 140 return; 141 } 142 143 static void vnc_init_basic_info_from_server_addr(QIOChannelSocket *ioc, 144 VncBasicInfo *info, 145 Error **errp) 146 { 147 SocketAddress *addr = NULL; 148 149 if (!ioc) { 150 error_setg(errp, "No listener socket available"); 151 return; 152 } 153 154 addr = qio_channel_socket_get_local_address(ioc, errp); 155 if (!addr) { 156 return; 157 } 158 159 vnc_init_basic_info(addr, info, errp); 160 qapi_free_SocketAddress(addr); 161 } 162 163 static void vnc_init_basic_info_from_remote_addr(QIOChannelSocket *ioc, 164 VncBasicInfo *info, 165 Error **errp) 166 { 167 SocketAddress *addr = NULL; 168 169 addr = qio_channel_socket_get_remote_address(ioc, errp); 170 if (!addr) { 171 return; 172 } 173 174 vnc_init_basic_info(addr, info, errp); 175 qapi_free_SocketAddress(addr); 176 } 177 178 static const char *vnc_auth_name(VncDisplay *vd) { 179 switch (vd->auth) { 180 case VNC_AUTH_INVALID: 181 return "invalid"; 182 case VNC_AUTH_NONE: 183 return "none"; 184 case VNC_AUTH_VNC: 185 return "vnc"; 186 case VNC_AUTH_RA2: 187 return "ra2"; 188 case VNC_AUTH_RA2NE: 189 return "ra2ne"; 190 case VNC_AUTH_TIGHT: 191 return "tight"; 192 case VNC_AUTH_ULTRA: 193 return "ultra"; 194 case VNC_AUTH_TLS: 195 return "tls"; 196 case VNC_AUTH_VENCRYPT: 197 switch (vd->subauth) { 198 case VNC_AUTH_VENCRYPT_PLAIN: 199 return "vencrypt+plain"; 200 case VNC_AUTH_VENCRYPT_TLSNONE: 201 return "vencrypt+tls+none"; 202 case VNC_AUTH_VENCRYPT_TLSVNC: 203 return "vencrypt+tls+vnc"; 204 case VNC_AUTH_VENCRYPT_TLSPLAIN: 205 return "vencrypt+tls+plain"; 206 case VNC_AUTH_VENCRYPT_X509NONE: 207 return "vencrypt+x509+none"; 208 case VNC_AUTH_VENCRYPT_X509VNC: 209 return "vencrypt+x509+vnc"; 210 case VNC_AUTH_VENCRYPT_X509PLAIN: 211 return "vencrypt+x509+plain"; 212 case VNC_AUTH_VENCRYPT_TLSSASL: 213 return "vencrypt+tls+sasl"; 214 case VNC_AUTH_VENCRYPT_X509SASL: 215 return "vencrypt+x509+sasl"; 216 default: 217 return "vencrypt"; 218 } 219 case VNC_AUTH_SASL: 220 return "sasl"; 221 } 222 return "unknown"; 223 } 224 225 static VncServerInfo *vnc_server_info_get(VncDisplay *vd) 226 { 227 VncServerInfo *info; 228 Error *err = NULL; 229 230 if (!vd->listener || !vd->listener->nsioc) { 231 return NULL; 232 } 233 234 info = g_malloc0(sizeof(*info)); 235 vnc_init_basic_info_from_server_addr(vd->listener->sioc[0], 236 qapi_VncServerInfo_base(info), &err); 237 info->has_auth = true; 238 info->auth = g_strdup(vnc_auth_name(vd)); 239 if (err) { 240 qapi_free_VncServerInfo(info); 241 info = NULL; 242 error_free(err); 243 } 244 return info; 245 } 246 247 static void vnc_client_cache_auth(VncState *client) 248 { 249 if (!client->info) { 250 return; 251 } 252 253 if (client->tls) { 254 client->info->x509_dname = 255 qcrypto_tls_session_get_peer_name(client->tls); 256 client->info->has_x509_dname = 257 client->info->x509_dname != NULL; 258 } 259 #ifdef CONFIG_VNC_SASL 260 if (client->sasl.conn && 261 client->sasl.username) { 262 client->info->has_sasl_username = true; 263 client->info->sasl_username = g_strdup(client->sasl.username); 264 } 265 #endif 266 } 267 268 static void vnc_client_cache_addr(VncState *client) 269 { 270 Error *err = NULL; 271 272 client->info = g_malloc0(sizeof(*client->info)); 273 vnc_init_basic_info_from_remote_addr(client->sioc, 274 qapi_VncClientInfo_base(client->info), 275 &err); 276 if (err) { 277 qapi_free_VncClientInfo(client->info); 278 client->info = NULL; 279 error_free(err); 280 } 281 } 282 283 static void vnc_qmp_event(VncState *vs, QAPIEvent event) 284 { 285 VncServerInfo *si; 286 287 if (!vs->info) { 288 return; 289 } 290 291 si = vnc_server_info_get(vs->vd); 292 if (!si) { 293 return; 294 } 295 296 switch (event) { 297 case QAPI_EVENT_VNC_CONNECTED: 298 qapi_event_send_vnc_connected(si, qapi_VncClientInfo_base(vs->info), 299 &error_abort); 300 break; 301 case QAPI_EVENT_VNC_INITIALIZED: 302 qapi_event_send_vnc_initialized(si, vs->info, &error_abort); 303 break; 304 case QAPI_EVENT_VNC_DISCONNECTED: 305 qapi_event_send_vnc_disconnected(si, vs->info, &error_abort); 306 break; 307 default: 308 break; 309 } 310 311 qapi_free_VncServerInfo(si); 312 } 313 314 static VncClientInfo *qmp_query_vnc_client(const VncState *client) 315 { 316 VncClientInfo *info; 317 Error *err = NULL; 318 319 info = g_malloc0(sizeof(*info)); 320 321 vnc_init_basic_info_from_remote_addr(client->sioc, 322 qapi_VncClientInfo_base(info), 323 &err); 324 if (err) { 325 error_free(err); 326 qapi_free_VncClientInfo(info); 327 return NULL; 328 } 329 330 info->websocket = client->websocket; 331 332 if (client->tls) { 333 info->x509_dname = qcrypto_tls_session_get_peer_name(client->tls); 334 info->has_x509_dname = info->x509_dname != NULL; 335 } 336 #ifdef CONFIG_VNC_SASL 337 if (client->sasl.conn && client->sasl.username) { 338 info->has_sasl_username = true; 339 info->sasl_username = g_strdup(client->sasl.username); 340 } 341 #endif 342 343 return info; 344 } 345 346 static VncDisplay *vnc_display_find(const char *id) 347 { 348 VncDisplay *vd; 349 350 if (id == NULL) { 351 return QTAILQ_FIRST(&vnc_displays); 352 } 353 QTAILQ_FOREACH(vd, &vnc_displays, next) { 354 if (strcmp(id, vd->id) == 0) { 355 return vd; 356 } 357 } 358 return NULL; 359 } 360 361 static VncClientInfoList *qmp_query_client_list(VncDisplay *vd) 362 { 363 VncClientInfoList *cinfo, *prev = NULL; 364 VncState *client; 365 366 QTAILQ_FOREACH(client, &vd->clients, next) { 367 cinfo = g_new0(VncClientInfoList, 1); 368 cinfo->value = qmp_query_vnc_client(client); 369 cinfo->next = prev; 370 prev = cinfo; 371 } 372 return prev; 373 } 374 375 VncInfo *qmp_query_vnc(Error **errp) 376 { 377 VncInfo *info = g_malloc0(sizeof(*info)); 378 VncDisplay *vd = vnc_display_find(NULL); 379 SocketAddress *addr = NULL; 380 381 if (vd == NULL || !vd->listener || !vd->listener->nsioc) { 382 info->enabled = false; 383 } else { 384 info->enabled = true; 385 386 /* for compatibility with the original command */ 387 info->has_clients = true; 388 info->clients = qmp_query_client_list(vd); 389 390 addr = qio_channel_socket_get_local_address(vd->listener->sioc[0], 391 errp); 392 if (!addr) { 393 goto out_error; 394 } 395 396 switch (addr->type) { 397 case SOCKET_ADDRESS_TYPE_INET: 398 info->host = g_strdup(addr->u.inet.host); 399 info->service = g_strdup(addr->u.inet.port); 400 if (addr->u.inet.ipv6) { 401 info->family = NETWORK_ADDRESS_FAMILY_IPV6; 402 } else { 403 info->family = NETWORK_ADDRESS_FAMILY_IPV4; 404 } 405 break; 406 407 case SOCKET_ADDRESS_TYPE_UNIX: 408 info->host = g_strdup(""); 409 info->service = g_strdup(addr->u.q_unix.path); 410 info->family = NETWORK_ADDRESS_FAMILY_UNIX; 411 break; 412 413 case SOCKET_ADDRESS_TYPE_VSOCK: 414 case SOCKET_ADDRESS_TYPE_FD: 415 error_setg(errp, "Unsupported socket address type %s", 416 SocketAddressType_str(addr->type)); 417 goto out_error; 418 default: 419 abort(); 420 } 421 422 info->has_host = true; 423 info->has_service = true; 424 info->has_family = true; 425 426 info->has_auth = true; 427 info->auth = g_strdup(vnc_auth_name(vd)); 428 } 429 430 qapi_free_SocketAddress(addr); 431 return info; 432 433 out_error: 434 qapi_free_SocketAddress(addr); 435 qapi_free_VncInfo(info); 436 return NULL; 437 } 438 439 440 static void qmp_query_auth(int auth, int subauth, 441 VncPrimaryAuth *qmp_auth, 442 VncVencryptSubAuth *qmp_vencrypt, 443 bool *qmp_has_vencrypt); 444 445 static VncServerInfo2List *qmp_query_server_entry(QIOChannelSocket *ioc, 446 bool websocket, 447 int auth, 448 int subauth, 449 VncServerInfo2List *prev) 450 { 451 VncServerInfo2List *list; 452 VncServerInfo2 *info; 453 Error *err = NULL; 454 SocketAddress *addr; 455 456 addr = qio_channel_socket_get_local_address(ioc, &err); 457 if (!addr) { 458 error_free(err); 459 return prev; 460 } 461 462 info = g_new0(VncServerInfo2, 1); 463 vnc_init_basic_info(addr, qapi_VncServerInfo2_base(info), &err); 464 qapi_free_SocketAddress(addr); 465 if (err) { 466 qapi_free_VncServerInfo2(info); 467 error_free(err); 468 return prev; 469 } 470 info->websocket = websocket; 471 472 qmp_query_auth(auth, subauth, &info->auth, 473 &info->vencrypt, &info->has_vencrypt); 474 475 list = g_new0(VncServerInfo2List, 1); 476 list->value = info; 477 list->next = prev; 478 return list; 479 } 480 481 static void qmp_query_auth(int auth, int subauth, 482 VncPrimaryAuth *qmp_auth, 483 VncVencryptSubAuth *qmp_vencrypt, 484 bool *qmp_has_vencrypt) 485 { 486 switch (auth) { 487 case VNC_AUTH_VNC: 488 *qmp_auth = VNC_PRIMARY_AUTH_VNC; 489 break; 490 case VNC_AUTH_RA2: 491 *qmp_auth = VNC_PRIMARY_AUTH_RA2; 492 break; 493 case VNC_AUTH_RA2NE: 494 *qmp_auth = VNC_PRIMARY_AUTH_RA2NE; 495 break; 496 case VNC_AUTH_TIGHT: 497 *qmp_auth = VNC_PRIMARY_AUTH_TIGHT; 498 break; 499 case VNC_AUTH_ULTRA: 500 *qmp_auth = VNC_PRIMARY_AUTH_ULTRA; 501 break; 502 case VNC_AUTH_TLS: 503 *qmp_auth = VNC_PRIMARY_AUTH_TLS; 504 break; 505 case VNC_AUTH_VENCRYPT: 506 *qmp_auth = VNC_PRIMARY_AUTH_VENCRYPT; 507 *qmp_has_vencrypt = true; 508 switch (subauth) { 509 case VNC_AUTH_VENCRYPT_PLAIN: 510 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_PLAIN; 511 break; 512 case VNC_AUTH_VENCRYPT_TLSNONE: 513 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_NONE; 514 break; 515 case VNC_AUTH_VENCRYPT_TLSVNC: 516 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_VNC; 517 break; 518 case VNC_AUTH_VENCRYPT_TLSPLAIN: 519 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_PLAIN; 520 break; 521 case VNC_AUTH_VENCRYPT_X509NONE: 522 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_NONE; 523 break; 524 case VNC_AUTH_VENCRYPT_X509VNC: 525 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_VNC; 526 break; 527 case VNC_AUTH_VENCRYPT_X509PLAIN: 528 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_PLAIN; 529 break; 530 case VNC_AUTH_VENCRYPT_TLSSASL: 531 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_SASL; 532 break; 533 case VNC_AUTH_VENCRYPT_X509SASL: 534 *qmp_vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_SASL; 535 break; 536 default: 537 *qmp_has_vencrypt = false; 538 break; 539 } 540 break; 541 case VNC_AUTH_SASL: 542 *qmp_auth = VNC_PRIMARY_AUTH_SASL; 543 break; 544 case VNC_AUTH_NONE: 545 default: 546 *qmp_auth = VNC_PRIMARY_AUTH_NONE; 547 break; 548 } 549 } 550 551 VncInfo2List *qmp_query_vnc_servers(Error **errp) 552 { 553 VncInfo2List *item, *prev = NULL; 554 VncInfo2 *info; 555 VncDisplay *vd; 556 DeviceState *dev; 557 size_t i; 558 559 QTAILQ_FOREACH(vd, &vnc_displays, next) { 560 info = g_new0(VncInfo2, 1); 561 info->id = g_strdup(vd->id); 562 info->clients = qmp_query_client_list(vd); 563 qmp_query_auth(vd->auth, vd->subauth, &info->auth, 564 &info->vencrypt, &info->has_vencrypt); 565 if (vd->dcl.con) { 566 dev = DEVICE(object_property_get_link(OBJECT(vd->dcl.con), 567 "device", NULL)); 568 info->has_display = true; 569 info->display = g_strdup(dev->id); 570 } 571 for (i = 0; vd->listener != NULL && i < vd->listener->nsioc; i++) { 572 info->server = qmp_query_server_entry( 573 vd->listener->sioc[i], false, vd->auth, vd->subauth, 574 info->server); 575 } 576 for (i = 0; vd->wslistener != NULL && i < vd->wslistener->nsioc; i++) { 577 info->server = qmp_query_server_entry( 578 vd->wslistener->sioc[i], true, vd->ws_auth, 579 vd->ws_subauth, info->server); 580 } 581 582 item = g_new0(VncInfo2List, 1); 583 item->value = info; 584 item->next = prev; 585 prev = item; 586 } 587 return prev; 588 } 589 590 /* TODO 591 1) Get the queue working for IO. 592 2) there is some weirdness when using the -S option (the screen is grey 593 and not totally invalidated 594 3) resolutions > 1024 595 */ 596 597 static int vnc_update_client(VncState *vs, int has_dirty); 598 static void vnc_disconnect_start(VncState *vs); 599 600 static void vnc_colordepth(VncState *vs); 601 static void framebuffer_update_request(VncState *vs, int incremental, 602 int x_position, int y_position, 603 int w, int h); 604 static void vnc_refresh(DisplayChangeListener *dcl); 605 static int vnc_refresh_server_surface(VncDisplay *vd); 606 607 static int vnc_width(VncDisplay *vd) 608 { 609 return MIN(VNC_MAX_WIDTH, ROUND_UP(surface_width(vd->ds), 610 VNC_DIRTY_PIXELS_PER_BIT)); 611 } 612 613 static int vnc_height(VncDisplay *vd) 614 { 615 return MIN(VNC_MAX_HEIGHT, surface_height(vd->ds)); 616 } 617 618 static void vnc_set_area_dirty(DECLARE_BITMAP(dirty[VNC_MAX_HEIGHT], 619 VNC_MAX_WIDTH / VNC_DIRTY_PIXELS_PER_BIT), 620 VncDisplay *vd, 621 int x, int y, int w, int h) 622 { 623 int width = vnc_width(vd); 624 int height = vnc_height(vd); 625 626 /* this is needed this to ensure we updated all affected 627 * blocks if x % VNC_DIRTY_PIXELS_PER_BIT != 0 */ 628 w += (x % VNC_DIRTY_PIXELS_PER_BIT); 629 x -= (x % VNC_DIRTY_PIXELS_PER_BIT); 630 631 x = MIN(x, width); 632 y = MIN(y, height); 633 w = MIN(x + w, width) - x; 634 h = MIN(y + h, height); 635 636 for (; y < h; y++) { 637 bitmap_set(dirty[y], x / VNC_DIRTY_PIXELS_PER_BIT, 638 DIV_ROUND_UP(w, VNC_DIRTY_PIXELS_PER_BIT)); 639 } 640 } 641 642 static void vnc_dpy_update(DisplayChangeListener *dcl, 643 int x, int y, int w, int h) 644 { 645 VncDisplay *vd = container_of(dcl, VncDisplay, dcl); 646 struct VncSurface *s = &vd->guest; 647 648 vnc_set_area_dirty(s->dirty, vd, x, y, w, h); 649 } 650 651 void vnc_framebuffer_update(VncState *vs, int x, int y, int w, int h, 652 int32_t encoding) 653 { 654 vnc_write_u16(vs, x); 655 vnc_write_u16(vs, y); 656 vnc_write_u16(vs, w); 657 vnc_write_u16(vs, h); 658 659 vnc_write_s32(vs, encoding); 660 } 661 662 663 static void vnc_desktop_resize(VncState *vs) 664 { 665 if (vs->ioc == NULL || !vnc_has_feature(vs, VNC_FEATURE_RESIZE)) { 666 return; 667 } 668 if (vs->client_width == pixman_image_get_width(vs->vd->server) && 669 vs->client_height == pixman_image_get_height(vs->vd->server)) { 670 return; 671 } 672 673 assert(pixman_image_get_width(vs->vd->server) < 65536 && 674 pixman_image_get_width(vs->vd->server) >= 0); 675 assert(pixman_image_get_height(vs->vd->server) < 65536 && 676 pixman_image_get_height(vs->vd->server) >= 0); 677 vs->client_width = pixman_image_get_width(vs->vd->server); 678 vs->client_height = pixman_image_get_height(vs->vd->server); 679 vnc_lock_output(vs); 680 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 681 vnc_write_u8(vs, 0); 682 vnc_write_u16(vs, 1); /* number of rects */ 683 vnc_framebuffer_update(vs, 0, 0, vs->client_width, vs->client_height, 684 VNC_ENCODING_DESKTOPRESIZE); 685 vnc_unlock_output(vs); 686 vnc_flush(vs); 687 } 688 689 static void vnc_abort_display_jobs(VncDisplay *vd) 690 { 691 VncState *vs; 692 693 QTAILQ_FOREACH(vs, &vd->clients, next) { 694 vnc_lock_output(vs); 695 vs->abort = true; 696 vnc_unlock_output(vs); 697 } 698 QTAILQ_FOREACH(vs, &vd->clients, next) { 699 vnc_jobs_join(vs); 700 } 701 QTAILQ_FOREACH(vs, &vd->clients, next) { 702 vnc_lock_output(vs); 703 vs->abort = false; 704 vnc_unlock_output(vs); 705 } 706 } 707 708 int vnc_server_fb_stride(VncDisplay *vd) 709 { 710 return pixman_image_get_stride(vd->server); 711 } 712 713 void *vnc_server_fb_ptr(VncDisplay *vd, int x, int y) 714 { 715 uint8_t *ptr; 716 717 ptr = (uint8_t *)pixman_image_get_data(vd->server); 718 ptr += y * vnc_server_fb_stride(vd); 719 ptr += x * VNC_SERVER_FB_BYTES; 720 return ptr; 721 } 722 723 static void vnc_update_server_surface(VncDisplay *vd) 724 { 725 int width, height; 726 727 qemu_pixman_image_unref(vd->server); 728 vd->server = NULL; 729 730 if (QTAILQ_EMPTY(&vd->clients)) { 731 return; 732 } 733 734 width = vnc_width(vd); 735 height = vnc_height(vd); 736 vd->server = pixman_image_create_bits(VNC_SERVER_FB_FORMAT, 737 width, height, 738 NULL, 0); 739 740 memset(vd->guest.dirty, 0x00, sizeof(vd->guest.dirty)); 741 vnc_set_area_dirty(vd->guest.dirty, vd, 0, 0, 742 width, height); 743 } 744 745 static void vnc_dpy_switch(DisplayChangeListener *dcl, 746 DisplaySurface *surface) 747 { 748 VncDisplay *vd = container_of(dcl, VncDisplay, dcl); 749 VncState *vs; 750 751 vnc_abort_display_jobs(vd); 752 vd->ds = surface; 753 754 /* server surface */ 755 vnc_update_server_surface(vd); 756 757 /* guest surface */ 758 qemu_pixman_image_unref(vd->guest.fb); 759 vd->guest.fb = pixman_image_ref(surface->image); 760 vd->guest.format = surface->format; 761 762 QTAILQ_FOREACH(vs, &vd->clients, next) { 763 vnc_colordepth(vs); 764 vnc_desktop_resize(vs); 765 if (vs->vd->cursor) { 766 vnc_cursor_define(vs); 767 } 768 memset(vs->dirty, 0x00, sizeof(vs->dirty)); 769 vnc_set_area_dirty(vs->dirty, vd, 0, 0, 770 vnc_width(vd), 771 vnc_height(vd)); 772 vnc_update_throttle_offset(vs); 773 } 774 } 775 776 /* fastest code */ 777 static void vnc_write_pixels_copy(VncState *vs, 778 void *pixels, int size) 779 { 780 vnc_write(vs, pixels, size); 781 } 782 783 /* slowest but generic code. */ 784 void vnc_convert_pixel(VncState *vs, uint8_t *buf, uint32_t v) 785 { 786 uint8_t r, g, b; 787 788 #if VNC_SERVER_FB_FORMAT == PIXMAN_FORMAT(32, PIXMAN_TYPE_ARGB, 0, 8, 8, 8) 789 r = (((v & 0x00ff0000) >> 16) << vs->client_pf.rbits) >> 8; 790 g = (((v & 0x0000ff00) >> 8) << vs->client_pf.gbits) >> 8; 791 b = (((v & 0x000000ff) >> 0) << vs->client_pf.bbits) >> 8; 792 #else 793 # error need some bits here if you change VNC_SERVER_FB_FORMAT 794 #endif 795 v = (r << vs->client_pf.rshift) | 796 (g << vs->client_pf.gshift) | 797 (b << vs->client_pf.bshift); 798 switch (vs->client_pf.bytes_per_pixel) { 799 case 1: 800 buf[0] = v; 801 break; 802 case 2: 803 if (vs->client_be) { 804 buf[0] = v >> 8; 805 buf[1] = v; 806 } else { 807 buf[1] = v >> 8; 808 buf[0] = v; 809 } 810 break; 811 default: 812 case 4: 813 if (vs->client_be) { 814 buf[0] = v >> 24; 815 buf[1] = v >> 16; 816 buf[2] = v >> 8; 817 buf[3] = v; 818 } else { 819 buf[3] = v >> 24; 820 buf[2] = v >> 16; 821 buf[1] = v >> 8; 822 buf[0] = v; 823 } 824 break; 825 } 826 } 827 828 static void vnc_write_pixels_generic(VncState *vs, 829 void *pixels1, int size) 830 { 831 uint8_t buf[4]; 832 833 if (VNC_SERVER_FB_BYTES == 4) { 834 uint32_t *pixels = pixels1; 835 int n, i; 836 n = size >> 2; 837 for (i = 0; i < n; i++) { 838 vnc_convert_pixel(vs, buf, pixels[i]); 839 vnc_write(vs, buf, vs->client_pf.bytes_per_pixel); 840 } 841 } 842 } 843 844 int vnc_raw_send_framebuffer_update(VncState *vs, int x, int y, int w, int h) 845 { 846 int i; 847 uint8_t *row; 848 VncDisplay *vd = vs->vd; 849 850 row = vnc_server_fb_ptr(vd, x, y); 851 for (i = 0; i < h; i++) { 852 vs->write_pixels(vs, row, w * VNC_SERVER_FB_BYTES); 853 row += vnc_server_fb_stride(vd); 854 } 855 return 1; 856 } 857 858 int vnc_send_framebuffer_update(VncState *vs, int x, int y, int w, int h) 859 { 860 int n = 0; 861 bool encode_raw = false; 862 size_t saved_offs = vs->output.offset; 863 864 switch(vs->vnc_encoding) { 865 case VNC_ENCODING_ZLIB: 866 n = vnc_zlib_send_framebuffer_update(vs, x, y, w, h); 867 break; 868 case VNC_ENCODING_HEXTILE: 869 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_HEXTILE); 870 n = vnc_hextile_send_framebuffer_update(vs, x, y, w, h); 871 break; 872 case VNC_ENCODING_TIGHT: 873 n = vnc_tight_send_framebuffer_update(vs, x, y, w, h); 874 break; 875 case VNC_ENCODING_TIGHT_PNG: 876 n = vnc_tight_png_send_framebuffer_update(vs, x, y, w, h); 877 break; 878 case VNC_ENCODING_ZRLE: 879 n = vnc_zrle_send_framebuffer_update(vs, x, y, w, h); 880 break; 881 case VNC_ENCODING_ZYWRLE: 882 n = vnc_zywrle_send_framebuffer_update(vs, x, y, w, h); 883 break; 884 default: 885 encode_raw = true; 886 break; 887 } 888 889 /* If the client has the same pixel format as our internal buffer and 890 * a RAW encoding would need less space fall back to RAW encoding to 891 * save bandwidth and processing power in the client. */ 892 if (!encode_raw && vs->write_pixels == vnc_write_pixels_copy && 893 12 + h * w * VNC_SERVER_FB_BYTES <= (vs->output.offset - saved_offs)) { 894 vs->output.offset = saved_offs; 895 encode_raw = true; 896 } 897 898 if (encode_raw) { 899 vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW); 900 n = vnc_raw_send_framebuffer_update(vs, x, y, w, h); 901 } 902 903 return n; 904 } 905 906 static void vnc_mouse_set(DisplayChangeListener *dcl, 907 int x, int y, int visible) 908 { 909 /* can we ask the client(s) to move the pointer ??? */ 910 } 911 912 static int vnc_cursor_define(VncState *vs) 913 { 914 QEMUCursor *c = vs->vd->cursor; 915 int isize; 916 917 if (vnc_has_feature(vs, VNC_FEATURE_RICH_CURSOR)) { 918 vnc_lock_output(vs); 919 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 920 vnc_write_u8(vs, 0); /* padding */ 921 vnc_write_u16(vs, 1); /* # of rects */ 922 vnc_framebuffer_update(vs, c->hot_x, c->hot_y, c->width, c->height, 923 VNC_ENCODING_RICH_CURSOR); 924 isize = c->width * c->height * vs->client_pf.bytes_per_pixel; 925 vnc_write_pixels_generic(vs, c->data, isize); 926 vnc_write(vs, vs->vd->cursor_mask, vs->vd->cursor_msize); 927 vnc_unlock_output(vs); 928 return 0; 929 } 930 return -1; 931 } 932 933 static void vnc_dpy_cursor_define(DisplayChangeListener *dcl, 934 QEMUCursor *c) 935 { 936 VncDisplay *vd = container_of(dcl, VncDisplay, dcl); 937 VncState *vs; 938 939 cursor_put(vd->cursor); 940 g_free(vd->cursor_mask); 941 942 vd->cursor = c; 943 cursor_get(vd->cursor); 944 vd->cursor_msize = cursor_get_mono_bpl(c) * c->height; 945 vd->cursor_mask = g_malloc0(vd->cursor_msize); 946 cursor_get_mono_mask(c, 0, vd->cursor_mask); 947 948 QTAILQ_FOREACH(vs, &vd->clients, next) { 949 vnc_cursor_define(vs); 950 } 951 } 952 953 static int find_and_clear_dirty_height(VncState *vs, 954 int y, int last_x, int x, int height) 955 { 956 int h; 957 958 for (h = 1; h < (height - y); h++) { 959 if (!test_bit(last_x, vs->dirty[y + h])) { 960 break; 961 } 962 bitmap_clear(vs->dirty[y + h], last_x, x - last_x); 963 } 964 965 return h; 966 } 967 968 /* 969 * Figure out how much pending data we should allow in the output 970 * buffer before we throttle incremental display updates, and/or 971 * drop audio samples. 972 * 973 * We allow for equiv of 1 full display's worth of FB updates, 974 * and 1 second of audio samples. If audio backlog was larger 975 * than that the client would already suffering awful audio 976 * glitches, so dropping samples is no worse really). 977 */ 978 static void vnc_update_throttle_offset(VncState *vs) 979 { 980 size_t offset = 981 vs->client_width * vs->client_height * vs->client_pf.bytes_per_pixel; 982 983 if (vs->audio_cap) { 984 int freq = vs->as.freq; 985 /* We don't limit freq when reading settings from client, so 986 * it could be upto MAX_INT in size. 48khz is a sensible 987 * upper bound for trustworthy clients */ 988 int bps; 989 if (freq > 48000) { 990 freq = 48000; 991 } 992 switch (vs->as.fmt) { 993 default: 994 case AUD_FMT_U8: 995 case AUD_FMT_S8: 996 bps = 1; 997 break; 998 case AUD_FMT_U16: 999 case AUD_FMT_S16: 1000 bps = 2; 1001 break; 1002 case AUD_FMT_U32: 1003 case AUD_FMT_S32: 1004 bps = 4; 1005 break; 1006 } 1007 offset += freq * bps * vs->as.nchannels; 1008 } 1009 1010 /* Put a floor of 1MB on offset, so that if we have a large pending 1011 * buffer and the display is resized to a small size & back again 1012 * we don't suddenly apply a tiny send limit 1013 */ 1014 offset = MAX(offset, 1024 * 1024); 1015 1016 if (vs->throttle_output_offset != offset) { 1017 trace_vnc_client_throttle_threshold( 1018 vs, vs->ioc, vs->throttle_output_offset, offset, vs->client_width, 1019 vs->client_height, vs->client_pf.bytes_per_pixel, vs->audio_cap); 1020 } 1021 1022 vs->throttle_output_offset = offset; 1023 } 1024 1025 static bool vnc_should_update(VncState *vs) 1026 { 1027 switch (vs->update) { 1028 case VNC_STATE_UPDATE_NONE: 1029 break; 1030 case VNC_STATE_UPDATE_INCREMENTAL: 1031 /* Only allow incremental updates if the pending send queue 1032 * is less than the permitted threshold, and the job worker 1033 * is completely idle. 1034 */ 1035 if (vs->output.offset < vs->throttle_output_offset && 1036 vs->job_update == VNC_STATE_UPDATE_NONE) { 1037 return true; 1038 } 1039 trace_vnc_client_throttle_incremental( 1040 vs, vs->ioc, vs->job_update, vs->output.offset); 1041 break; 1042 case VNC_STATE_UPDATE_FORCE: 1043 /* Only allow forced updates if the pending send queue 1044 * does not contain a previous forced update, and the 1045 * job worker is completely idle. 1046 * 1047 * Note this means we'll queue a forced update, even if 1048 * the output buffer size is otherwise over the throttle 1049 * output limit. 1050 */ 1051 if (vs->force_update_offset == 0 && 1052 vs->job_update == VNC_STATE_UPDATE_NONE) { 1053 return true; 1054 } 1055 trace_vnc_client_throttle_forced( 1056 vs, vs->ioc, vs->job_update, vs->force_update_offset); 1057 break; 1058 } 1059 return false; 1060 } 1061 1062 static int vnc_update_client(VncState *vs, int has_dirty) 1063 { 1064 VncDisplay *vd = vs->vd; 1065 VncJob *job; 1066 int y; 1067 int height, width; 1068 int n = 0; 1069 1070 if (vs->disconnecting) { 1071 vnc_disconnect_finish(vs); 1072 return 0; 1073 } 1074 1075 vs->has_dirty += has_dirty; 1076 if (!vnc_should_update(vs)) { 1077 return 0; 1078 } 1079 1080 if (!vs->has_dirty && vs->update != VNC_STATE_UPDATE_FORCE) { 1081 return 0; 1082 } 1083 1084 /* 1085 * Send screen updates to the vnc client using the server 1086 * surface and server dirty map. guest surface updates 1087 * happening in parallel don't disturb us, the next pass will 1088 * send them to the client. 1089 */ 1090 job = vnc_job_new(vs); 1091 1092 height = pixman_image_get_height(vd->server); 1093 width = pixman_image_get_width(vd->server); 1094 1095 y = 0; 1096 for (;;) { 1097 int x, h; 1098 unsigned long x2; 1099 unsigned long offset = find_next_bit((unsigned long *) &vs->dirty, 1100 height * VNC_DIRTY_BPL(vs), 1101 y * VNC_DIRTY_BPL(vs)); 1102 if (offset == height * VNC_DIRTY_BPL(vs)) { 1103 /* no more dirty bits */ 1104 break; 1105 } 1106 y = offset / VNC_DIRTY_BPL(vs); 1107 x = offset % VNC_DIRTY_BPL(vs); 1108 x2 = find_next_zero_bit((unsigned long *) &vs->dirty[y], 1109 VNC_DIRTY_BPL(vs), x); 1110 bitmap_clear(vs->dirty[y], x, x2 - x); 1111 h = find_and_clear_dirty_height(vs, y, x, x2, height); 1112 x2 = MIN(x2, width / VNC_DIRTY_PIXELS_PER_BIT); 1113 if (x2 > x) { 1114 n += vnc_job_add_rect(job, x * VNC_DIRTY_PIXELS_PER_BIT, y, 1115 (x2 - x) * VNC_DIRTY_PIXELS_PER_BIT, h); 1116 } 1117 if (!x && x2 == width / VNC_DIRTY_PIXELS_PER_BIT) { 1118 y += h; 1119 if (y == height) { 1120 break; 1121 } 1122 } 1123 } 1124 1125 vs->job_update = vs->update; 1126 vs->update = VNC_STATE_UPDATE_NONE; 1127 vnc_job_push(job); 1128 vs->has_dirty = 0; 1129 return n; 1130 } 1131 1132 /* audio */ 1133 static void audio_capture_notify(void *opaque, audcnotification_e cmd) 1134 { 1135 VncState *vs = opaque; 1136 1137 switch (cmd) { 1138 case AUD_CNOTIFY_DISABLE: 1139 vnc_lock_output(vs); 1140 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU); 1141 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO); 1142 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_END); 1143 vnc_unlock_output(vs); 1144 vnc_flush(vs); 1145 break; 1146 1147 case AUD_CNOTIFY_ENABLE: 1148 vnc_lock_output(vs); 1149 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU); 1150 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO); 1151 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_BEGIN); 1152 vnc_unlock_output(vs); 1153 vnc_flush(vs); 1154 break; 1155 } 1156 } 1157 1158 static void audio_capture_destroy(void *opaque) 1159 { 1160 } 1161 1162 static void audio_capture(void *opaque, void *buf, int size) 1163 { 1164 VncState *vs = opaque; 1165 1166 vnc_lock_output(vs); 1167 if (vs->output.offset < vs->throttle_output_offset) { 1168 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU); 1169 vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO); 1170 vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_DATA); 1171 vnc_write_u32(vs, size); 1172 vnc_write(vs, buf, size); 1173 } else { 1174 trace_vnc_client_throttle_audio(vs, vs->ioc, vs->output.offset); 1175 } 1176 vnc_unlock_output(vs); 1177 vnc_flush(vs); 1178 } 1179 1180 static void audio_add(VncState *vs) 1181 { 1182 struct audio_capture_ops ops; 1183 1184 if (vs->audio_cap) { 1185 error_report("audio already running"); 1186 return; 1187 } 1188 1189 ops.notify = audio_capture_notify; 1190 ops.destroy = audio_capture_destroy; 1191 ops.capture = audio_capture; 1192 1193 vs->audio_cap = AUD_add_capture(&vs->as, &ops, vs); 1194 if (!vs->audio_cap) { 1195 error_report("Failed to add audio capture"); 1196 } 1197 } 1198 1199 static void audio_del(VncState *vs) 1200 { 1201 if (vs->audio_cap) { 1202 AUD_del_capture(vs->audio_cap, vs); 1203 vs->audio_cap = NULL; 1204 } 1205 } 1206 1207 static void vnc_disconnect_start(VncState *vs) 1208 { 1209 if (vs->disconnecting) { 1210 return; 1211 } 1212 trace_vnc_client_disconnect_start(vs, vs->ioc); 1213 vnc_set_share_mode(vs, VNC_SHARE_MODE_DISCONNECTED); 1214 if (vs->ioc_tag) { 1215 g_source_remove(vs->ioc_tag); 1216 vs->ioc_tag = 0; 1217 } 1218 qio_channel_close(vs->ioc, NULL); 1219 vs->disconnecting = TRUE; 1220 } 1221 1222 void vnc_disconnect_finish(VncState *vs) 1223 { 1224 int i; 1225 1226 trace_vnc_client_disconnect_finish(vs, vs->ioc); 1227 1228 vnc_jobs_join(vs); /* Wait encoding jobs */ 1229 1230 vnc_lock_output(vs); 1231 vnc_qmp_event(vs, QAPI_EVENT_VNC_DISCONNECTED); 1232 1233 buffer_free(&vs->input); 1234 buffer_free(&vs->output); 1235 1236 qapi_free_VncClientInfo(vs->info); 1237 1238 vnc_zlib_clear(vs); 1239 vnc_tight_clear(vs); 1240 vnc_zrle_clear(vs); 1241 1242 #ifdef CONFIG_VNC_SASL 1243 vnc_sasl_client_cleanup(vs); 1244 #endif /* CONFIG_VNC_SASL */ 1245 audio_del(vs); 1246 vnc_release_modifiers(vs); 1247 1248 if (vs->mouse_mode_notifier.notify != NULL) { 1249 qemu_remove_mouse_mode_change_notifier(&vs->mouse_mode_notifier); 1250 } 1251 QTAILQ_REMOVE(&vs->vd->clients, vs, next); 1252 if (QTAILQ_EMPTY(&vs->vd->clients)) { 1253 /* last client gone */ 1254 vnc_update_server_surface(vs->vd); 1255 } 1256 1257 vnc_unlock_output(vs); 1258 1259 qemu_mutex_destroy(&vs->output_mutex); 1260 if (vs->bh != NULL) { 1261 qemu_bh_delete(vs->bh); 1262 } 1263 buffer_free(&vs->jobs_buffer); 1264 1265 for (i = 0; i < VNC_STAT_ROWS; ++i) { 1266 g_free(vs->lossy_rect[i]); 1267 } 1268 g_free(vs->lossy_rect); 1269 1270 object_unref(OBJECT(vs->ioc)); 1271 vs->ioc = NULL; 1272 object_unref(OBJECT(vs->sioc)); 1273 vs->sioc = NULL; 1274 g_free(vs); 1275 } 1276 1277 size_t vnc_client_io_error(VncState *vs, ssize_t ret, Error **errp) 1278 { 1279 if (ret <= 0) { 1280 if (ret == 0) { 1281 trace_vnc_client_eof(vs, vs->ioc); 1282 vnc_disconnect_start(vs); 1283 } else if (ret != QIO_CHANNEL_ERR_BLOCK) { 1284 trace_vnc_client_io_error(vs, vs->ioc, 1285 errp ? error_get_pretty(*errp) : 1286 "Unknown"); 1287 vnc_disconnect_start(vs); 1288 } 1289 1290 if (errp) { 1291 error_free(*errp); 1292 *errp = NULL; 1293 } 1294 return 0; 1295 } 1296 return ret; 1297 } 1298 1299 1300 void vnc_client_error(VncState *vs) 1301 { 1302 VNC_DEBUG("Closing down client sock: protocol error\n"); 1303 vnc_disconnect_start(vs); 1304 } 1305 1306 1307 /* 1308 * Called to write a chunk of data to the client socket. The data may 1309 * be the raw data, or may have already been encoded by SASL. 1310 * The data will be written either straight onto the socket, or 1311 * written via the GNUTLS wrappers, if TLS/SSL encryption is enabled 1312 * 1313 * NB, it is theoretically possible to have 2 layers of encryption, 1314 * both SASL, and this TLS layer. It is highly unlikely in practice 1315 * though, since SASL encryption will typically be a no-op if TLS 1316 * is active 1317 * 1318 * Returns the number of bytes written, which may be less than 1319 * the requested 'datalen' if the socket would block. Returns 1320 * 0 on I/O error, and disconnects the client socket. 1321 */ 1322 size_t vnc_client_write_buf(VncState *vs, const uint8_t *data, size_t datalen) 1323 { 1324 Error *err = NULL; 1325 ssize_t ret; 1326 ret = qio_channel_write( 1327 vs->ioc, (const char *)data, datalen, &err); 1328 VNC_DEBUG("Wrote wire %p %zd -> %ld\n", data, datalen, ret); 1329 return vnc_client_io_error(vs, ret, &err); 1330 } 1331 1332 1333 /* 1334 * Called to write buffered data to the client socket, when not 1335 * using any SASL SSF encryption layers. Will write as much data 1336 * as possible without blocking. If all buffered data is written, 1337 * will switch the FD poll() handler back to read monitoring. 1338 * 1339 * Returns the number of bytes written, which may be less than 1340 * the buffered output data if the socket would block. Returns 1341 * 0 on I/O error, and disconnects the client socket. 1342 */ 1343 static size_t vnc_client_write_plain(VncState *vs) 1344 { 1345 size_t offset; 1346 size_t ret; 1347 1348 #ifdef CONFIG_VNC_SASL 1349 VNC_DEBUG("Write Plain: Pending output %p size %zd offset %zd. Wait SSF %d\n", 1350 vs->output.buffer, vs->output.capacity, vs->output.offset, 1351 vs->sasl.waitWriteSSF); 1352 1353 if (vs->sasl.conn && 1354 vs->sasl.runSSF && 1355 vs->sasl.waitWriteSSF) { 1356 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->sasl.waitWriteSSF); 1357 if (ret) 1358 vs->sasl.waitWriteSSF -= ret; 1359 } else 1360 #endif /* CONFIG_VNC_SASL */ 1361 ret = vnc_client_write_buf(vs, vs->output.buffer, vs->output.offset); 1362 if (!ret) 1363 return 0; 1364 1365 if (ret >= vs->force_update_offset) { 1366 if (vs->force_update_offset != 0) { 1367 trace_vnc_client_unthrottle_forced(vs, vs->ioc); 1368 } 1369 vs->force_update_offset = 0; 1370 } else { 1371 vs->force_update_offset -= ret; 1372 } 1373 offset = vs->output.offset; 1374 buffer_advance(&vs->output, ret); 1375 if (offset >= vs->throttle_output_offset && 1376 vs->output.offset < vs->throttle_output_offset) { 1377 trace_vnc_client_unthrottle_incremental(vs, vs->ioc, vs->output.offset); 1378 } 1379 1380 if (vs->output.offset == 0) { 1381 if (vs->ioc_tag) { 1382 g_source_remove(vs->ioc_tag); 1383 } 1384 vs->ioc_tag = qio_channel_add_watch( 1385 vs->ioc, G_IO_IN, vnc_client_io, vs, NULL); 1386 } 1387 1388 return ret; 1389 } 1390 1391 1392 /* 1393 * First function called whenever there is data to be written to 1394 * the client socket. Will delegate actual work according to whether 1395 * SASL SSF layers are enabled (thus requiring encryption calls) 1396 */ 1397 static void vnc_client_write_locked(VncState *vs) 1398 { 1399 #ifdef CONFIG_VNC_SASL 1400 if (vs->sasl.conn && 1401 vs->sasl.runSSF && 1402 !vs->sasl.waitWriteSSF) { 1403 vnc_client_write_sasl(vs); 1404 } else 1405 #endif /* CONFIG_VNC_SASL */ 1406 { 1407 vnc_client_write_plain(vs); 1408 } 1409 } 1410 1411 static void vnc_client_write(VncState *vs) 1412 { 1413 1414 vnc_lock_output(vs); 1415 if (vs->output.offset) { 1416 vnc_client_write_locked(vs); 1417 } else if (vs->ioc != NULL) { 1418 if (vs->ioc_tag) { 1419 g_source_remove(vs->ioc_tag); 1420 } 1421 vs->ioc_tag = qio_channel_add_watch( 1422 vs->ioc, G_IO_IN, vnc_client_io, vs, NULL); 1423 } 1424 vnc_unlock_output(vs); 1425 } 1426 1427 void vnc_read_when(VncState *vs, VncReadEvent *func, size_t expecting) 1428 { 1429 vs->read_handler = func; 1430 vs->read_handler_expect = expecting; 1431 } 1432 1433 1434 /* 1435 * Called to read a chunk of data from the client socket. The data may 1436 * be the raw data, or may need to be further decoded by SASL. 1437 * The data will be read either straight from to the socket, or 1438 * read via the GNUTLS wrappers, if TLS/SSL encryption is enabled 1439 * 1440 * NB, it is theoretically possible to have 2 layers of encryption, 1441 * both SASL, and this TLS layer. It is highly unlikely in practice 1442 * though, since SASL encryption will typically be a no-op if TLS 1443 * is active 1444 * 1445 * Returns the number of bytes read, which may be less than 1446 * the requested 'datalen' if the socket would block. Returns 1447 * 0 on I/O error or EOF, and disconnects the client socket. 1448 */ 1449 size_t vnc_client_read_buf(VncState *vs, uint8_t *data, size_t datalen) 1450 { 1451 ssize_t ret; 1452 Error *err = NULL; 1453 ret = qio_channel_read( 1454 vs->ioc, (char *)data, datalen, &err); 1455 VNC_DEBUG("Read wire %p %zd -> %ld\n", data, datalen, ret); 1456 return vnc_client_io_error(vs, ret, &err); 1457 } 1458 1459 1460 /* 1461 * Called to read data from the client socket to the input buffer, 1462 * when not using any SASL SSF encryption layers. Will read as much 1463 * data as possible without blocking. 1464 * 1465 * Returns the number of bytes read, which may be less than 1466 * the requested 'datalen' if the socket would block. Returns 1467 * 0 on I/O error or EOF, and disconnects the client socket. 1468 */ 1469 static size_t vnc_client_read_plain(VncState *vs) 1470 { 1471 size_t ret; 1472 VNC_DEBUG("Read plain %p size %zd offset %zd\n", 1473 vs->input.buffer, vs->input.capacity, vs->input.offset); 1474 buffer_reserve(&vs->input, 4096); 1475 ret = vnc_client_read_buf(vs, buffer_end(&vs->input), 4096); 1476 if (!ret) 1477 return 0; 1478 vs->input.offset += ret; 1479 return ret; 1480 } 1481 1482 static void vnc_jobs_bh(void *opaque) 1483 { 1484 VncState *vs = opaque; 1485 1486 vnc_jobs_consume_buffer(vs); 1487 } 1488 1489 /* 1490 * First function called whenever there is more data to be read from 1491 * the client socket. Will delegate actual work according to whether 1492 * SASL SSF layers are enabled (thus requiring decryption calls) 1493 * Returns 0 on success, -1 if client disconnected 1494 */ 1495 static int vnc_client_read(VncState *vs) 1496 { 1497 size_t ret; 1498 1499 #ifdef CONFIG_VNC_SASL 1500 if (vs->sasl.conn && vs->sasl.runSSF) 1501 ret = vnc_client_read_sasl(vs); 1502 else 1503 #endif /* CONFIG_VNC_SASL */ 1504 ret = vnc_client_read_plain(vs); 1505 if (!ret) { 1506 if (vs->disconnecting) { 1507 vnc_disconnect_finish(vs); 1508 return -1; 1509 } 1510 return 0; 1511 } 1512 1513 while (vs->read_handler && vs->input.offset >= vs->read_handler_expect) { 1514 size_t len = vs->read_handler_expect; 1515 int ret; 1516 1517 ret = vs->read_handler(vs, vs->input.buffer, len); 1518 if (vs->disconnecting) { 1519 vnc_disconnect_finish(vs); 1520 return -1; 1521 } 1522 1523 if (!ret) { 1524 buffer_advance(&vs->input, len); 1525 } else { 1526 vs->read_handler_expect = ret; 1527 } 1528 } 1529 return 0; 1530 } 1531 1532 gboolean vnc_client_io(QIOChannel *ioc G_GNUC_UNUSED, 1533 GIOCondition condition, void *opaque) 1534 { 1535 VncState *vs = opaque; 1536 if (condition & G_IO_IN) { 1537 if (vnc_client_read(vs) < 0) { 1538 return TRUE; 1539 } 1540 } 1541 if (condition & G_IO_OUT) { 1542 vnc_client_write(vs); 1543 } 1544 return TRUE; 1545 } 1546 1547 1548 /* 1549 * Scale factor to apply to vs->throttle_output_offset when checking for 1550 * hard limit. Worst case normal usage could be x2, if we have a complete 1551 * incremental update and complete forced update in the output buffer. 1552 * So x3 should be good enough, but we pick x5 to be conservative and thus 1553 * (hopefully) never trigger incorrectly. 1554 */ 1555 #define VNC_THROTTLE_OUTPUT_LIMIT_SCALE 5 1556 1557 void vnc_write(VncState *vs, const void *data, size_t len) 1558 { 1559 if (vs->disconnecting) { 1560 return; 1561 } 1562 /* Protection against malicious client/guest to prevent our output 1563 * buffer growing without bound if client stops reading data. This 1564 * should rarely trigger, because we have earlier throttling code 1565 * which stops issuing framebuffer updates and drops audio data 1566 * if the throttle_output_offset value is exceeded. So we only reach 1567 * this higher level if a huge number of pseudo-encodings get 1568 * triggered while data can't be sent on the socket. 1569 * 1570 * NB throttle_output_offset can be zero during early protocol 1571 * handshake, or from the job thread's VncState clone 1572 */ 1573 if (vs->throttle_output_offset != 0 && 1574 vs->output.offset > (vs->throttle_output_offset * 1575 VNC_THROTTLE_OUTPUT_LIMIT_SCALE)) { 1576 trace_vnc_client_output_limit(vs, vs->ioc, vs->output.offset, 1577 vs->throttle_output_offset); 1578 vnc_disconnect_start(vs); 1579 return; 1580 } 1581 buffer_reserve(&vs->output, len); 1582 1583 if (vs->ioc != NULL && buffer_empty(&vs->output)) { 1584 if (vs->ioc_tag) { 1585 g_source_remove(vs->ioc_tag); 1586 } 1587 vs->ioc_tag = qio_channel_add_watch( 1588 vs->ioc, G_IO_IN | G_IO_OUT, vnc_client_io, vs, NULL); 1589 } 1590 1591 buffer_append(&vs->output, data, len); 1592 } 1593 1594 void vnc_write_s32(VncState *vs, int32_t value) 1595 { 1596 vnc_write_u32(vs, *(uint32_t *)&value); 1597 } 1598 1599 void vnc_write_u32(VncState *vs, uint32_t value) 1600 { 1601 uint8_t buf[4]; 1602 1603 buf[0] = (value >> 24) & 0xFF; 1604 buf[1] = (value >> 16) & 0xFF; 1605 buf[2] = (value >> 8) & 0xFF; 1606 buf[3] = value & 0xFF; 1607 1608 vnc_write(vs, buf, 4); 1609 } 1610 1611 void vnc_write_u16(VncState *vs, uint16_t value) 1612 { 1613 uint8_t buf[2]; 1614 1615 buf[0] = (value >> 8) & 0xFF; 1616 buf[1] = value & 0xFF; 1617 1618 vnc_write(vs, buf, 2); 1619 } 1620 1621 void vnc_write_u8(VncState *vs, uint8_t value) 1622 { 1623 vnc_write(vs, (char *)&value, 1); 1624 } 1625 1626 void vnc_flush(VncState *vs) 1627 { 1628 vnc_lock_output(vs); 1629 if (vs->ioc != NULL && vs->output.offset) { 1630 vnc_client_write_locked(vs); 1631 } 1632 vnc_unlock_output(vs); 1633 } 1634 1635 static uint8_t read_u8(uint8_t *data, size_t offset) 1636 { 1637 return data[offset]; 1638 } 1639 1640 static uint16_t read_u16(uint8_t *data, size_t offset) 1641 { 1642 return ((data[offset] & 0xFF) << 8) | (data[offset + 1] & 0xFF); 1643 } 1644 1645 static int32_t read_s32(uint8_t *data, size_t offset) 1646 { 1647 return (int32_t)((data[offset] << 24) | (data[offset + 1] << 16) | 1648 (data[offset + 2] << 8) | data[offset + 3]); 1649 } 1650 1651 uint32_t read_u32(uint8_t *data, size_t offset) 1652 { 1653 return ((data[offset] << 24) | (data[offset + 1] << 16) | 1654 (data[offset + 2] << 8) | data[offset + 3]); 1655 } 1656 1657 static void client_cut_text(VncState *vs, size_t len, uint8_t *text) 1658 { 1659 } 1660 1661 static void check_pointer_type_change(Notifier *notifier, void *data) 1662 { 1663 VncState *vs = container_of(notifier, VncState, mouse_mode_notifier); 1664 int absolute = qemu_input_is_absolute(); 1665 1666 if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE) && vs->absolute != absolute) { 1667 vnc_lock_output(vs); 1668 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 1669 vnc_write_u8(vs, 0); 1670 vnc_write_u16(vs, 1); 1671 vnc_framebuffer_update(vs, absolute, 0, 1672 pixman_image_get_width(vs->vd->server), 1673 pixman_image_get_height(vs->vd->server), 1674 VNC_ENCODING_POINTER_TYPE_CHANGE); 1675 vnc_unlock_output(vs); 1676 vnc_flush(vs); 1677 } 1678 vs->absolute = absolute; 1679 } 1680 1681 static void pointer_event(VncState *vs, int button_mask, int x, int y) 1682 { 1683 static uint32_t bmap[INPUT_BUTTON__MAX] = { 1684 [INPUT_BUTTON_LEFT] = 0x01, 1685 [INPUT_BUTTON_MIDDLE] = 0x02, 1686 [INPUT_BUTTON_RIGHT] = 0x04, 1687 [INPUT_BUTTON_WHEEL_UP] = 0x08, 1688 [INPUT_BUTTON_WHEEL_DOWN] = 0x10, 1689 }; 1690 QemuConsole *con = vs->vd->dcl.con; 1691 int width = pixman_image_get_width(vs->vd->server); 1692 int height = pixman_image_get_height(vs->vd->server); 1693 1694 if (vs->last_bmask != button_mask) { 1695 qemu_input_update_buttons(con, bmap, vs->last_bmask, button_mask); 1696 vs->last_bmask = button_mask; 1697 } 1698 1699 if (vs->absolute) { 1700 qemu_input_queue_abs(con, INPUT_AXIS_X, x, 0, width); 1701 qemu_input_queue_abs(con, INPUT_AXIS_Y, y, 0, height); 1702 } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) { 1703 qemu_input_queue_rel(con, INPUT_AXIS_X, x - 0x7FFF); 1704 qemu_input_queue_rel(con, INPUT_AXIS_Y, y - 0x7FFF); 1705 } else { 1706 if (vs->last_x != -1) { 1707 qemu_input_queue_rel(con, INPUT_AXIS_X, x - vs->last_x); 1708 qemu_input_queue_rel(con, INPUT_AXIS_Y, y - vs->last_y); 1709 } 1710 vs->last_x = x; 1711 vs->last_y = y; 1712 } 1713 qemu_input_event_sync(); 1714 } 1715 1716 static void reset_keys(VncState *vs) 1717 { 1718 int i; 1719 for(i = 0; i < 256; i++) { 1720 if (vs->modifiers_state[i]) { 1721 qemu_input_event_send_key_number(vs->vd->dcl.con, i, false); 1722 qemu_input_event_send_key_delay(vs->vd->key_delay_ms); 1723 vs->modifiers_state[i] = 0; 1724 } 1725 } 1726 } 1727 1728 static void press_key(VncState *vs, int keysym) 1729 { 1730 int keycode = keysym2scancode(vs->vd->kbd_layout, keysym) & SCANCODE_KEYMASK; 1731 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, true); 1732 qemu_input_event_send_key_delay(vs->vd->key_delay_ms); 1733 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, false); 1734 qemu_input_event_send_key_delay(vs->vd->key_delay_ms); 1735 } 1736 1737 static void vnc_led_state_change(VncState *vs) 1738 { 1739 if (!vnc_has_feature(vs, VNC_FEATURE_LED_STATE)) { 1740 return; 1741 } 1742 1743 vnc_lock_output(vs); 1744 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 1745 vnc_write_u8(vs, 0); 1746 vnc_write_u16(vs, 1); 1747 vnc_framebuffer_update(vs, 0, 0, 1, 1, VNC_ENCODING_LED_STATE); 1748 vnc_write_u8(vs, vs->vd->ledstate); 1749 vnc_unlock_output(vs); 1750 vnc_flush(vs); 1751 } 1752 1753 static void kbd_leds(void *opaque, int ledstate) 1754 { 1755 VncDisplay *vd = opaque; 1756 VncState *client; 1757 1758 trace_vnc_key_guest_leds((ledstate & QEMU_CAPS_LOCK_LED), 1759 (ledstate & QEMU_NUM_LOCK_LED), 1760 (ledstate & QEMU_SCROLL_LOCK_LED)); 1761 1762 if (ledstate == vd->ledstate) { 1763 return; 1764 } 1765 1766 vd->ledstate = ledstate; 1767 1768 QTAILQ_FOREACH(client, &vd->clients, next) { 1769 vnc_led_state_change(client); 1770 } 1771 } 1772 1773 static void do_key_event(VncState *vs, int down, int keycode, int sym) 1774 { 1775 /* QEMU console switch */ 1776 switch(keycode) { 1777 case 0x2a: /* Left Shift */ 1778 case 0x36: /* Right Shift */ 1779 case 0x1d: /* Left CTRL */ 1780 case 0x9d: /* Right CTRL */ 1781 case 0x38: /* Left ALT */ 1782 case 0xb8: /* Right ALT */ 1783 if (down) 1784 vs->modifiers_state[keycode] = 1; 1785 else 1786 vs->modifiers_state[keycode] = 0; 1787 break; 1788 case 0x02 ... 0x0a: /* '1' to '9' keys */ 1789 if (vs->vd->dcl.con == NULL && 1790 down && vs->modifiers_state[0x1d] && vs->modifiers_state[0x38]) { 1791 /* Reset the modifiers sent to the current console */ 1792 reset_keys(vs); 1793 console_select(keycode - 0x02); 1794 return; 1795 } 1796 break; 1797 case 0x3a: /* CapsLock */ 1798 case 0x45: /* NumLock */ 1799 if (down) 1800 vs->modifiers_state[keycode] ^= 1; 1801 break; 1802 } 1803 1804 /* Turn off the lock state sync logic if the client support the led 1805 state extension. 1806 */ 1807 if (down && vs->vd->lock_key_sync && 1808 !vnc_has_feature(vs, VNC_FEATURE_LED_STATE) && 1809 keycode_is_keypad(vs->vd->kbd_layout, keycode)) { 1810 /* If the numlock state needs to change then simulate an additional 1811 keypress before sending this one. This will happen if the user 1812 toggles numlock away from the VNC window. 1813 */ 1814 if (keysym_is_numlock(vs->vd->kbd_layout, sym & 0xFFFF)) { 1815 if (!vs->modifiers_state[0x45]) { 1816 trace_vnc_key_sync_numlock(true); 1817 vs->modifiers_state[0x45] = 1; 1818 press_key(vs, 0xff7f); 1819 } 1820 } else { 1821 if (vs->modifiers_state[0x45]) { 1822 trace_vnc_key_sync_numlock(false); 1823 vs->modifiers_state[0x45] = 0; 1824 press_key(vs, 0xff7f); 1825 } 1826 } 1827 } 1828 1829 if (down && vs->vd->lock_key_sync && 1830 !vnc_has_feature(vs, VNC_FEATURE_LED_STATE) && 1831 ((sym >= 'A' && sym <= 'Z') || (sym >= 'a' && sym <= 'z'))) { 1832 /* If the capslock state needs to change then simulate an additional 1833 keypress before sending this one. This will happen if the user 1834 toggles capslock away from the VNC window. 1835 */ 1836 int uppercase = !!(sym >= 'A' && sym <= 'Z'); 1837 int shift = !!(vs->modifiers_state[0x2a] | vs->modifiers_state[0x36]); 1838 int capslock = !!(vs->modifiers_state[0x3a]); 1839 if (capslock) { 1840 if (uppercase == shift) { 1841 trace_vnc_key_sync_capslock(false); 1842 vs->modifiers_state[0x3a] = 0; 1843 press_key(vs, 0xffe5); 1844 } 1845 } else { 1846 if (uppercase != shift) { 1847 trace_vnc_key_sync_capslock(true); 1848 vs->modifiers_state[0x3a] = 1; 1849 press_key(vs, 0xffe5); 1850 } 1851 } 1852 } 1853 1854 if (qemu_console_is_graphic(NULL)) { 1855 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, down); 1856 qemu_input_event_send_key_delay(vs->vd->key_delay_ms); 1857 } else { 1858 bool numlock = vs->modifiers_state[0x45]; 1859 bool control = (vs->modifiers_state[0x1d] || 1860 vs->modifiers_state[0x9d]); 1861 /* QEMU console emulation */ 1862 if (down) { 1863 switch (keycode) { 1864 case 0x2a: /* Left Shift */ 1865 case 0x36: /* Right Shift */ 1866 case 0x1d: /* Left CTRL */ 1867 case 0x9d: /* Right CTRL */ 1868 case 0x38: /* Left ALT */ 1869 case 0xb8: /* Right ALT */ 1870 break; 1871 case 0xc8: 1872 kbd_put_keysym(QEMU_KEY_UP); 1873 break; 1874 case 0xd0: 1875 kbd_put_keysym(QEMU_KEY_DOWN); 1876 break; 1877 case 0xcb: 1878 kbd_put_keysym(QEMU_KEY_LEFT); 1879 break; 1880 case 0xcd: 1881 kbd_put_keysym(QEMU_KEY_RIGHT); 1882 break; 1883 case 0xd3: 1884 kbd_put_keysym(QEMU_KEY_DELETE); 1885 break; 1886 case 0xc7: 1887 kbd_put_keysym(QEMU_KEY_HOME); 1888 break; 1889 case 0xcf: 1890 kbd_put_keysym(QEMU_KEY_END); 1891 break; 1892 case 0xc9: 1893 kbd_put_keysym(QEMU_KEY_PAGEUP); 1894 break; 1895 case 0xd1: 1896 kbd_put_keysym(QEMU_KEY_PAGEDOWN); 1897 break; 1898 1899 case 0x47: 1900 kbd_put_keysym(numlock ? '7' : QEMU_KEY_HOME); 1901 break; 1902 case 0x48: 1903 kbd_put_keysym(numlock ? '8' : QEMU_KEY_UP); 1904 break; 1905 case 0x49: 1906 kbd_put_keysym(numlock ? '9' : QEMU_KEY_PAGEUP); 1907 break; 1908 case 0x4b: 1909 kbd_put_keysym(numlock ? '4' : QEMU_KEY_LEFT); 1910 break; 1911 case 0x4c: 1912 kbd_put_keysym('5'); 1913 break; 1914 case 0x4d: 1915 kbd_put_keysym(numlock ? '6' : QEMU_KEY_RIGHT); 1916 break; 1917 case 0x4f: 1918 kbd_put_keysym(numlock ? '1' : QEMU_KEY_END); 1919 break; 1920 case 0x50: 1921 kbd_put_keysym(numlock ? '2' : QEMU_KEY_DOWN); 1922 break; 1923 case 0x51: 1924 kbd_put_keysym(numlock ? '3' : QEMU_KEY_PAGEDOWN); 1925 break; 1926 case 0x52: 1927 kbd_put_keysym('0'); 1928 break; 1929 case 0x53: 1930 kbd_put_keysym(numlock ? '.' : QEMU_KEY_DELETE); 1931 break; 1932 1933 case 0xb5: 1934 kbd_put_keysym('/'); 1935 break; 1936 case 0x37: 1937 kbd_put_keysym('*'); 1938 break; 1939 case 0x4a: 1940 kbd_put_keysym('-'); 1941 break; 1942 case 0x4e: 1943 kbd_put_keysym('+'); 1944 break; 1945 case 0x9c: 1946 kbd_put_keysym('\n'); 1947 break; 1948 1949 default: 1950 if (control) { 1951 kbd_put_keysym(sym & 0x1f); 1952 } else { 1953 kbd_put_keysym(sym); 1954 } 1955 break; 1956 } 1957 } 1958 } 1959 } 1960 1961 static void vnc_release_modifiers(VncState *vs) 1962 { 1963 static const int keycodes[] = { 1964 /* shift, control, alt keys, both left & right */ 1965 0x2a, 0x36, 0x1d, 0x9d, 0x38, 0xb8, 1966 }; 1967 int i, keycode; 1968 1969 if (!qemu_console_is_graphic(NULL)) { 1970 return; 1971 } 1972 for (i = 0; i < ARRAY_SIZE(keycodes); i++) { 1973 keycode = keycodes[i]; 1974 if (!vs->modifiers_state[keycode]) { 1975 continue; 1976 } 1977 qemu_input_event_send_key_number(vs->vd->dcl.con, keycode, false); 1978 qemu_input_event_send_key_delay(vs->vd->key_delay_ms); 1979 } 1980 } 1981 1982 static const char *code2name(int keycode) 1983 { 1984 return QKeyCode_str(qemu_input_key_number_to_qcode(keycode)); 1985 } 1986 1987 static void key_event(VncState *vs, int down, uint32_t sym) 1988 { 1989 int keycode; 1990 int lsym = sym; 1991 1992 if (lsym >= 'A' && lsym <= 'Z' && qemu_console_is_graphic(NULL)) { 1993 lsym = lsym - 'A' + 'a'; 1994 } 1995 1996 keycode = keysym2scancode(vs->vd->kbd_layout, lsym & 0xFFFF) & SCANCODE_KEYMASK; 1997 trace_vnc_key_event_map(down, sym, keycode, code2name(keycode)); 1998 do_key_event(vs, down, keycode, sym); 1999 } 2000 2001 static void ext_key_event(VncState *vs, int down, 2002 uint32_t sym, uint16_t keycode) 2003 { 2004 /* if the user specifies a keyboard layout, always use it */ 2005 if (keyboard_layout) { 2006 key_event(vs, down, sym); 2007 } else { 2008 trace_vnc_key_event_ext(down, sym, keycode, code2name(keycode)); 2009 do_key_event(vs, down, keycode, sym); 2010 } 2011 } 2012 2013 static void framebuffer_update_request(VncState *vs, int incremental, 2014 int x, int y, int w, int h) 2015 { 2016 if (incremental) { 2017 if (vs->update != VNC_STATE_UPDATE_FORCE) { 2018 vs->update = VNC_STATE_UPDATE_INCREMENTAL; 2019 } 2020 } else { 2021 vs->update = VNC_STATE_UPDATE_FORCE; 2022 vnc_set_area_dirty(vs->dirty, vs->vd, x, y, w, h); 2023 } 2024 } 2025 2026 static void send_ext_key_event_ack(VncState *vs) 2027 { 2028 vnc_lock_output(vs); 2029 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 2030 vnc_write_u8(vs, 0); 2031 vnc_write_u16(vs, 1); 2032 vnc_framebuffer_update(vs, 0, 0, 2033 pixman_image_get_width(vs->vd->server), 2034 pixman_image_get_height(vs->vd->server), 2035 VNC_ENCODING_EXT_KEY_EVENT); 2036 vnc_unlock_output(vs); 2037 vnc_flush(vs); 2038 } 2039 2040 static void send_ext_audio_ack(VncState *vs) 2041 { 2042 vnc_lock_output(vs); 2043 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 2044 vnc_write_u8(vs, 0); 2045 vnc_write_u16(vs, 1); 2046 vnc_framebuffer_update(vs, 0, 0, 2047 pixman_image_get_width(vs->vd->server), 2048 pixman_image_get_height(vs->vd->server), 2049 VNC_ENCODING_AUDIO); 2050 vnc_unlock_output(vs); 2051 vnc_flush(vs); 2052 } 2053 2054 static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings) 2055 { 2056 int i; 2057 unsigned int enc = 0; 2058 2059 vs->features = 0; 2060 vs->vnc_encoding = 0; 2061 vs->tight.compression = 9; 2062 vs->tight.quality = -1; /* Lossless by default */ 2063 vs->absolute = -1; 2064 2065 /* 2066 * Start from the end because the encodings are sent in order of preference. 2067 * This way the preferred encoding (first encoding defined in the array) 2068 * will be set at the end of the loop. 2069 */ 2070 for (i = n_encodings - 1; i >= 0; i--) { 2071 enc = encodings[i]; 2072 switch (enc) { 2073 case VNC_ENCODING_RAW: 2074 vs->vnc_encoding = enc; 2075 break; 2076 case VNC_ENCODING_COPYRECT: 2077 vs->features |= VNC_FEATURE_COPYRECT_MASK; 2078 break; 2079 case VNC_ENCODING_HEXTILE: 2080 vs->features |= VNC_FEATURE_HEXTILE_MASK; 2081 vs->vnc_encoding = enc; 2082 break; 2083 case VNC_ENCODING_TIGHT: 2084 vs->features |= VNC_FEATURE_TIGHT_MASK; 2085 vs->vnc_encoding = enc; 2086 break; 2087 #ifdef CONFIG_VNC_PNG 2088 case VNC_ENCODING_TIGHT_PNG: 2089 vs->features |= VNC_FEATURE_TIGHT_PNG_MASK; 2090 vs->vnc_encoding = enc; 2091 break; 2092 #endif 2093 case VNC_ENCODING_ZLIB: 2094 vs->features |= VNC_FEATURE_ZLIB_MASK; 2095 vs->vnc_encoding = enc; 2096 break; 2097 case VNC_ENCODING_ZRLE: 2098 vs->features |= VNC_FEATURE_ZRLE_MASK; 2099 vs->vnc_encoding = enc; 2100 break; 2101 case VNC_ENCODING_ZYWRLE: 2102 vs->features |= VNC_FEATURE_ZYWRLE_MASK; 2103 vs->vnc_encoding = enc; 2104 break; 2105 case VNC_ENCODING_DESKTOPRESIZE: 2106 vs->features |= VNC_FEATURE_RESIZE_MASK; 2107 break; 2108 case VNC_ENCODING_POINTER_TYPE_CHANGE: 2109 vs->features |= VNC_FEATURE_POINTER_TYPE_CHANGE_MASK; 2110 break; 2111 case VNC_ENCODING_RICH_CURSOR: 2112 vs->features |= VNC_FEATURE_RICH_CURSOR_MASK; 2113 if (vs->vd->cursor) { 2114 vnc_cursor_define(vs); 2115 } 2116 break; 2117 case VNC_ENCODING_EXT_KEY_EVENT: 2118 send_ext_key_event_ack(vs); 2119 break; 2120 case VNC_ENCODING_AUDIO: 2121 send_ext_audio_ack(vs); 2122 break; 2123 case VNC_ENCODING_WMVi: 2124 vs->features |= VNC_FEATURE_WMVI_MASK; 2125 break; 2126 case VNC_ENCODING_LED_STATE: 2127 vs->features |= VNC_FEATURE_LED_STATE_MASK; 2128 break; 2129 case VNC_ENCODING_COMPRESSLEVEL0 ... VNC_ENCODING_COMPRESSLEVEL0 + 9: 2130 vs->tight.compression = (enc & 0x0F); 2131 break; 2132 case VNC_ENCODING_QUALITYLEVEL0 ... VNC_ENCODING_QUALITYLEVEL0 + 9: 2133 if (vs->vd->lossy) { 2134 vs->tight.quality = (enc & 0x0F); 2135 } 2136 break; 2137 default: 2138 VNC_DEBUG("Unknown encoding: %d (0x%.8x): %d\n", i, enc, enc); 2139 break; 2140 } 2141 } 2142 vnc_desktop_resize(vs); 2143 check_pointer_type_change(&vs->mouse_mode_notifier, NULL); 2144 vnc_led_state_change(vs); 2145 } 2146 2147 static void set_pixel_conversion(VncState *vs) 2148 { 2149 pixman_format_code_t fmt = qemu_pixman_get_format(&vs->client_pf); 2150 2151 if (fmt == VNC_SERVER_FB_FORMAT) { 2152 vs->write_pixels = vnc_write_pixels_copy; 2153 vnc_hextile_set_pixel_conversion(vs, 0); 2154 } else { 2155 vs->write_pixels = vnc_write_pixels_generic; 2156 vnc_hextile_set_pixel_conversion(vs, 1); 2157 } 2158 } 2159 2160 static void send_color_map(VncState *vs) 2161 { 2162 int i; 2163 2164 vnc_write_u8(vs, VNC_MSG_SERVER_SET_COLOUR_MAP_ENTRIES); 2165 vnc_write_u8(vs, 0); /* padding */ 2166 vnc_write_u16(vs, 0); /* first color */ 2167 vnc_write_u16(vs, 256); /* # of colors */ 2168 2169 for (i = 0; i < 256; i++) { 2170 PixelFormat *pf = &vs->client_pf; 2171 2172 vnc_write_u16(vs, (((i >> pf->rshift) & pf->rmax) << (16 - pf->rbits))); 2173 vnc_write_u16(vs, (((i >> pf->gshift) & pf->gmax) << (16 - pf->gbits))); 2174 vnc_write_u16(vs, (((i >> pf->bshift) & pf->bmax) << (16 - pf->bbits))); 2175 } 2176 } 2177 2178 static void set_pixel_format(VncState *vs, int bits_per_pixel, 2179 int big_endian_flag, int true_color_flag, 2180 int red_max, int green_max, int blue_max, 2181 int red_shift, int green_shift, int blue_shift) 2182 { 2183 if (!true_color_flag) { 2184 /* Expose a reasonable default 256 color map */ 2185 bits_per_pixel = 8; 2186 red_max = 7; 2187 green_max = 7; 2188 blue_max = 3; 2189 red_shift = 0; 2190 green_shift = 3; 2191 blue_shift = 6; 2192 } 2193 2194 switch (bits_per_pixel) { 2195 case 8: 2196 case 16: 2197 case 32: 2198 break; 2199 default: 2200 vnc_client_error(vs); 2201 return; 2202 } 2203 2204 vs->client_pf.rmax = red_max ? red_max : 0xFF; 2205 vs->client_pf.rbits = ctpopl(red_max); 2206 vs->client_pf.rshift = red_shift; 2207 vs->client_pf.rmask = red_max << red_shift; 2208 vs->client_pf.gmax = green_max ? green_max : 0xFF; 2209 vs->client_pf.gbits = ctpopl(green_max); 2210 vs->client_pf.gshift = green_shift; 2211 vs->client_pf.gmask = green_max << green_shift; 2212 vs->client_pf.bmax = blue_max ? blue_max : 0xFF; 2213 vs->client_pf.bbits = ctpopl(blue_max); 2214 vs->client_pf.bshift = blue_shift; 2215 vs->client_pf.bmask = blue_max << blue_shift; 2216 vs->client_pf.bits_per_pixel = bits_per_pixel; 2217 vs->client_pf.bytes_per_pixel = bits_per_pixel / 8; 2218 vs->client_pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel; 2219 vs->client_be = big_endian_flag; 2220 2221 if (!true_color_flag) { 2222 send_color_map(vs); 2223 } 2224 2225 set_pixel_conversion(vs); 2226 2227 graphic_hw_invalidate(vs->vd->dcl.con); 2228 graphic_hw_update(vs->vd->dcl.con); 2229 } 2230 2231 static void pixel_format_message (VncState *vs) { 2232 char pad[3] = { 0, 0, 0 }; 2233 2234 vs->client_pf = qemu_default_pixelformat(32); 2235 2236 vnc_write_u8(vs, vs->client_pf.bits_per_pixel); /* bits-per-pixel */ 2237 vnc_write_u8(vs, vs->client_pf.depth); /* depth */ 2238 2239 #ifdef HOST_WORDS_BIGENDIAN 2240 vnc_write_u8(vs, 1); /* big-endian-flag */ 2241 #else 2242 vnc_write_u8(vs, 0); /* big-endian-flag */ 2243 #endif 2244 vnc_write_u8(vs, 1); /* true-color-flag */ 2245 vnc_write_u16(vs, vs->client_pf.rmax); /* red-max */ 2246 vnc_write_u16(vs, vs->client_pf.gmax); /* green-max */ 2247 vnc_write_u16(vs, vs->client_pf.bmax); /* blue-max */ 2248 vnc_write_u8(vs, vs->client_pf.rshift); /* red-shift */ 2249 vnc_write_u8(vs, vs->client_pf.gshift); /* green-shift */ 2250 vnc_write_u8(vs, vs->client_pf.bshift); /* blue-shift */ 2251 vnc_write(vs, pad, 3); /* padding */ 2252 2253 vnc_hextile_set_pixel_conversion(vs, 0); 2254 vs->write_pixels = vnc_write_pixels_copy; 2255 } 2256 2257 static void vnc_colordepth(VncState *vs) 2258 { 2259 if (vnc_has_feature(vs, VNC_FEATURE_WMVI)) { 2260 /* Sending a WMVi message to notify the client*/ 2261 vnc_lock_output(vs); 2262 vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE); 2263 vnc_write_u8(vs, 0); 2264 vnc_write_u16(vs, 1); /* number of rects */ 2265 vnc_framebuffer_update(vs, 0, 0, 2266 pixman_image_get_width(vs->vd->server), 2267 pixman_image_get_height(vs->vd->server), 2268 VNC_ENCODING_WMVi); 2269 pixel_format_message(vs); 2270 vnc_unlock_output(vs); 2271 vnc_flush(vs); 2272 } else { 2273 set_pixel_conversion(vs); 2274 } 2275 } 2276 2277 static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len) 2278 { 2279 int i; 2280 uint16_t limit; 2281 VncDisplay *vd = vs->vd; 2282 2283 if (data[0] > 3) { 2284 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE); 2285 } 2286 2287 switch (data[0]) { 2288 case VNC_MSG_CLIENT_SET_PIXEL_FORMAT: 2289 if (len == 1) 2290 return 20; 2291 2292 set_pixel_format(vs, read_u8(data, 4), 2293 read_u8(data, 6), read_u8(data, 7), 2294 read_u16(data, 8), read_u16(data, 10), 2295 read_u16(data, 12), read_u8(data, 14), 2296 read_u8(data, 15), read_u8(data, 16)); 2297 break; 2298 case VNC_MSG_CLIENT_SET_ENCODINGS: 2299 if (len == 1) 2300 return 4; 2301 2302 if (len == 4) { 2303 limit = read_u16(data, 2); 2304 if (limit > 0) 2305 return 4 + (limit * 4); 2306 } else 2307 limit = read_u16(data, 2); 2308 2309 for (i = 0; i < limit; i++) { 2310 int32_t val = read_s32(data, 4 + (i * 4)); 2311 memcpy(data + 4 + (i * 4), &val, sizeof(val)); 2312 } 2313 2314 set_encodings(vs, (int32_t *)(data + 4), limit); 2315 break; 2316 case VNC_MSG_CLIENT_FRAMEBUFFER_UPDATE_REQUEST: 2317 if (len == 1) 2318 return 10; 2319 2320 framebuffer_update_request(vs, 2321 read_u8(data, 1), read_u16(data, 2), read_u16(data, 4), 2322 read_u16(data, 6), read_u16(data, 8)); 2323 break; 2324 case VNC_MSG_CLIENT_KEY_EVENT: 2325 if (len == 1) 2326 return 8; 2327 2328 key_event(vs, read_u8(data, 1), read_u32(data, 4)); 2329 break; 2330 case VNC_MSG_CLIENT_POINTER_EVENT: 2331 if (len == 1) 2332 return 6; 2333 2334 pointer_event(vs, read_u8(data, 1), read_u16(data, 2), read_u16(data, 4)); 2335 break; 2336 case VNC_MSG_CLIENT_CUT_TEXT: 2337 if (len == 1) { 2338 return 8; 2339 } 2340 if (len == 8) { 2341 uint32_t dlen = read_u32(data, 4); 2342 if (dlen > (1 << 20)) { 2343 error_report("vnc: client_cut_text msg payload has %u bytes" 2344 " which exceeds our limit of 1MB.", dlen); 2345 vnc_client_error(vs); 2346 break; 2347 } 2348 if (dlen > 0) { 2349 return 8 + dlen; 2350 } 2351 } 2352 2353 client_cut_text(vs, read_u32(data, 4), data + 8); 2354 break; 2355 case VNC_MSG_CLIENT_QEMU: 2356 if (len == 1) 2357 return 2; 2358 2359 switch (read_u8(data, 1)) { 2360 case VNC_MSG_CLIENT_QEMU_EXT_KEY_EVENT: 2361 if (len == 2) 2362 return 12; 2363 2364 ext_key_event(vs, read_u16(data, 2), 2365 read_u32(data, 4), read_u32(data, 8)); 2366 break; 2367 case VNC_MSG_CLIENT_QEMU_AUDIO: 2368 if (len == 2) 2369 return 4; 2370 2371 switch (read_u16 (data, 2)) { 2372 case VNC_MSG_CLIENT_QEMU_AUDIO_ENABLE: 2373 audio_add(vs); 2374 break; 2375 case VNC_MSG_CLIENT_QEMU_AUDIO_DISABLE: 2376 audio_del(vs); 2377 break; 2378 case VNC_MSG_CLIENT_QEMU_AUDIO_SET_FORMAT: 2379 if (len == 4) 2380 return 10; 2381 switch (read_u8(data, 4)) { 2382 case 0: vs->as.fmt = AUD_FMT_U8; break; 2383 case 1: vs->as.fmt = AUD_FMT_S8; break; 2384 case 2: vs->as.fmt = AUD_FMT_U16; break; 2385 case 3: vs->as.fmt = AUD_FMT_S16; break; 2386 case 4: vs->as.fmt = AUD_FMT_U32; break; 2387 case 5: vs->as.fmt = AUD_FMT_S32; break; 2388 default: 2389 VNC_DEBUG("Invalid audio format %d\n", read_u8(data, 4)); 2390 vnc_client_error(vs); 2391 break; 2392 } 2393 vs->as.nchannels = read_u8(data, 5); 2394 if (vs->as.nchannels != 1 && vs->as.nchannels != 2) { 2395 VNC_DEBUG("Invalid audio channel count %d\n", 2396 read_u8(data, 5)); 2397 vnc_client_error(vs); 2398 break; 2399 } 2400 vs->as.freq = read_u32(data, 6); 2401 break; 2402 default: 2403 VNC_DEBUG("Invalid audio message %d\n", read_u8(data, 4)); 2404 vnc_client_error(vs); 2405 break; 2406 } 2407 break; 2408 2409 default: 2410 VNC_DEBUG("Msg: %d\n", read_u16(data, 0)); 2411 vnc_client_error(vs); 2412 break; 2413 } 2414 break; 2415 default: 2416 VNC_DEBUG("Msg: %d\n", data[0]); 2417 vnc_client_error(vs); 2418 break; 2419 } 2420 2421 vnc_update_throttle_offset(vs); 2422 vnc_read_when(vs, protocol_client_msg, 1); 2423 return 0; 2424 } 2425 2426 static int protocol_client_init(VncState *vs, uint8_t *data, size_t len) 2427 { 2428 char buf[1024]; 2429 VncShareMode mode; 2430 int size; 2431 2432 mode = data[0] ? VNC_SHARE_MODE_SHARED : VNC_SHARE_MODE_EXCLUSIVE; 2433 switch (vs->vd->share_policy) { 2434 case VNC_SHARE_POLICY_IGNORE: 2435 /* 2436 * Ignore the shared flag. Nothing to do here. 2437 * 2438 * Doesn't conform to the rfb spec but is traditional qemu 2439 * behavior, thus left here as option for compatibility 2440 * reasons. 2441 */ 2442 break; 2443 case VNC_SHARE_POLICY_ALLOW_EXCLUSIVE: 2444 /* 2445 * Policy: Allow clients ask for exclusive access. 2446 * 2447 * Implementation: When a client asks for exclusive access, 2448 * disconnect all others. Shared connects are allowed as long 2449 * as no exclusive connection exists. 2450 * 2451 * This is how the rfb spec suggests to handle the shared flag. 2452 */ 2453 if (mode == VNC_SHARE_MODE_EXCLUSIVE) { 2454 VncState *client; 2455 QTAILQ_FOREACH(client, &vs->vd->clients, next) { 2456 if (vs == client) { 2457 continue; 2458 } 2459 if (client->share_mode != VNC_SHARE_MODE_EXCLUSIVE && 2460 client->share_mode != VNC_SHARE_MODE_SHARED) { 2461 continue; 2462 } 2463 vnc_disconnect_start(client); 2464 } 2465 } 2466 if (mode == VNC_SHARE_MODE_SHARED) { 2467 if (vs->vd->num_exclusive > 0) { 2468 vnc_disconnect_start(vs); 2469 return 0; 2470 } 2471 } 2472 break; 2473 case VNC_SHARE_POLICY_FORCE_SHARED: 2474 /* 2475 * Policy: Shared connects only. 2476 * Implementation: Disallow clients asking for exclusive access. 2477 * 2478 * Useful for shared desktop sessions where you don't want 2479 * someone forgetting to say -shared when running the vnc 2480 * client disconnect everybody else. 2481 */ 2482 if (mode == VNC_SHARE_MODE_EXCLUSIVE) { 2483 vnc_disconnect_start(vs); 2484 return 0; 2485 } 2486 break; 2487 } 2488 vnc_set_share_mode(vs, mode); 2489 2490 if (vs->vd->num_shared > vs->vd->connections_limit) { 2491 vnc_disconnect_start(vs); 2492 return 0; 2493 } 2494 2495 assert(pixman_image_get_width(vs->vd->server) < 65536 && 2496 pixman_image_get_width(vs->vd->server) >= 0); 2497 assert(pixman_image_get_height(vs->vd->server) < 65536 && 2498 pixman_image_get_height(vs->vd->server) >= 0); 2499 vs->client_width = pixman_image_get_width(vs->vd->server); 2500 vs->client_height = pixman_image_get_height(vs->vd->server); 2501 vnc_write_u16(vs, vs->client_width); 2502 vnc_write_u16(vs, vs->client_height); 2503 2504 pixel_format_message(vs); 2505 2506 if (qemu_name) { 2507 size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name); 2508 if (size > sizeof(buf)) { 2509 size = sizeof(buf); 2510 } 2511 } else { 2512 size = snprintf(buf, sizeof(buf), "QEMU"); 2513 } 2514 2515 vnc_write_u32(vs, size); 2516 vnc_write(vs, buf, size); 2517 vnc_flush(vs); 2518 2519 vnc_client_cache_auth(vs); 2520 vnc_qmp_event(vs, QAPI_EVENT_VNC_INITIALIZED); 2521 2522 vnc_read_when(vs, protocol_client_msg, 1); 2523 2524 return 0; 2525 } 2526 2527 void start_client_init(VncState *vs) 2528 { 2529 vnc_read_when(vs, protocol_client_init, 1); 2530 } 2531 2532 static void make_challenge(VncState *vs) 2533 { 2534 int i; 2535 2536 srand(time(NULL)+getpid()+getpid()*987654+rand()); 2537 2538 for (i = 0 ; i < sizeof(vs->challenge) ; i++) 2539 vs->challenge[i] = (int) (256.0*rand()/(RAND_MAX+1.0)); 2540 } 2541 2542 static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len) 2543 { 2544 unsigned char response[VNC_AUTH_CHALLENGE_SIZE]; 2545 size_t i, pwlen; 2546 unsigned char key[8]; 2547 time_t now = time(NULL); 2548 QCryptoCipher *cipher = NULL; 2549 Error *err = NULL; 2550 2551 if (!vs->vd->password) { 2552 trace_vnc_auth_fail(vs, vs->auth, "password is not set", ""); 2553 goto reject; 2554 } 2555 if (vs->vd->expires < now) { 2556 trace_vnc_auth_fail(vs, vs->auth, "password is expired", ""); 2557 goto reject; 2558 } 2559 2560 memcpy(response, vs->challenge, VNC_AUTH_CHALLENGE_SIZE); 2561 2562 /* Calculate the expected challenge response */ 2563 pwlen = strlen(vs->vd->password); 2564 for (i=0; i<sizeof(key); i++) 2565 key[i] = i<pwlen ? vs->vd->password[i] : 0; 2566 2567 cipher = qcrypto_cipher_new( 2568 QCRYPTO_CIPHER_ALG_DES_RFB, 2569 QCRYPTO_CIPHER_MODE_ECB, 2570 key, G_N_ELEMENTS(key), 2571 &err); 2572 if (!cipher) { 2573 trace_vnc_auth_fail(vs, vs->auth, "cannot create cipher", 2574 error_get_pretty(err)); 2575 error_free(err); 2576 goto reject; 2577 } 2578 2579 if (qcrypto_cipher_encrypt(cipher, 2580 vs->challenge, 2581 response, 2582 VNC_AUTH_CHALLENGE_SIZE, 2583 &err) < 0) { 2584 trace_vnc_auth_fail(vs, vs->auth, "cannot encrypt challenge response", 2585 error_get_pretty(err)); 2586 error_free(err); 2587 goto reject; 2588 } 2589 2590 /* Compare expected vs actual challenge response */ 2591 if (memcmp(response, data, VNC_AUTH_CHALLENGE_SIZE) != 0) { 2592 trace_vnc_auth_fail(vs, vs->auth, "mis-matched challenge response", ""); 2593 goto reject; 2594 } else { 2595 trace_vnc_auth_pass(vs, vs->auth); 2596 vnc_write_u32(vs, 0); /* Accept auth */ 2597 vnc_flush(vs); 2598 2599 start_client_init(vs); 2600 } 2601 2602 qcrypto_cipher_free(cipher); 2603 return 0; 2604 2605 reject: 2606 vnc_write_u32(vs, 1); /* Reject auth */ 2607 if (vs->minor >= 8) { 2608 static const char err[] = "Authentication failed"; 2609 vnc_write_u32(vs, sizeof(err)); 2610 vnc_write(vs, err, sizeof(err)); 2611 } 2612 vnc_flush(vs); 2613 vnc_client_error(vs); 2614 qcrypto_cipher_free(cipher); 2615 return 0; 2616 } 2617 2618 void start_auth_vnc(VncState *vs) 2619 { 2620 make_challenge(vs); 2621 /* Send client a 'random' challenge */ 2622 vnc_write(vs, vs->challenge, sizeof(vs->challenge)); 2623 vnc_flush(vs); 2624 2625 vnc_read_when(vs, protocol_client_auth_vnc, sizeof(vs->challenge)); 2626 } 2627 2628 2629 static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len) 2630 { 2631 /* We only advertise 1 auth scheme at a time, so client 2632 * must pick the one we sent. Verify this */ 2633 if (data[0] != vs->auth) { /* Reject auth */ 2634 trace_vnc_auth_reject(vs, vs->auth, (int)data[0]); 2635 vnc_write_u32(vs, 1); 2636 if (vs->minor >= 8) { 2637 static const char err[] = "Authentication failed"; 2638 vnc_write_u32(vs, sizeof(err)); 2639 vnc_write(vs, err, sizeof(err)); 2640 } 2641 vnc_client_error(vs); 2642 } else { /* Accept requested auth */ 2643 trace_vnc_auth_start(vs, vs->auth); 2644 switch (vs->auth) { 2645 case VNC_AUTH_NONE: 2646 if (vs->minor >= 8) { 2647 vnc_write_u32(vs, 0); /* Accept auth completion */ 2648 vnc_flush(vs); 2649 } 2650 trace_vnc_auth_pass(vs, vs->auth); 2651 start_client_init(vs); 2652 break; 2653 2654 case VNC_AUTH_VNC: 2655 start_auth_vnc(vs); 2656 break; 2657 2658 case VNC_AUTH_VENCRYPT: 2659 start_auth_vencrypt(vs); 2660 break; 2661 2662 #ifdef CONFIG_VNC_SASL 2663 case VNC_AUTH_SASL: 2664 start_auth_sasl(vs); 2665 break; 2666 #endif /* CONFIG_VNC_SASL */ 2667 2668 default: /* Should not be possible, but just in case */ 2669 trace_vnc_auth_fail(vs, vs->auth, "Unhandled auth method", ""); 2670 vnc_write_u8(vs, 1); 2671 if (vs->minor >= 8) { 2672 static const char err[] = "Authentication failed"; 2673 vnc_write_u32(vs, sizeof(err)); 2674 vnc_write(vs, err, sizeof(err)); 2675 } 2676 vnc_client_error(vs); 2677 } 2678 } 2679 return 0; 2680 } 2681 2682 static int protocol_version(VncState *vs, uint8_t *version, size_t len) 2683 { 2684 char local[13]; 2685 2686 memcpy(local, version, 12); 2687 local[12] = 0; 2688 2689 if (sscanf(local, "RFB %03d.%03d\n", &vs->major, &vs->minor) != 2) { 2690 VNC_DEBUG("Malformed protocol version %s\n", local); 2691 vnc_client_error(vs); 2692 return 0; 2693 } 2694 VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor); 2695 if (vs->major != 3 || 2696 (vs->minor != 3 && 2697 vs->minor != 4 && 2698 vs->minor != 5 && 2699 vs->minor != 7 && 2700 vs->minor != 8)) { 2701 VNC_DEBUG("Unsupported client version\n"); 2702 vnc_write_u32(vs, VNC_AUTH_INVALID); 2703 vnc_flush(vs); 2704 vnc_client_error(vs); 2705 return 0; 2706 } 2707 /* Some broken clients report v3.4 or v3.5, which spec requires to be treated 2708 * as equivalent to v3.3 by servers 2709 */ 2710 if (vs->minor == 4 || vs->minor == 5) 2711 vs->minor = 3; 2712 2713 if (vs->minor == 3) { 2714 trace_vnc_auth_start(vs, vs->auth); 2715 if (vs->auth == VNC_AUTH_NONE) { 2716 vnc_write_u32(vs, vs->auth); 2717 vnc_flush(vs); 2718 trace_vnc_auth_pass(vs, vs->auth); 2719 start_client_init(vs); 2720 } else if (vs->auth == VNC_AUTH_VNC) { 2721 VNC_DEBUG("Tell client VNC auth\n"); 2722 vnc_write_u32(vs, vs->auth); 2723 vnc_flush(vs); 2724 start_auth_vnc(vs); 2725 } else { 2726 trace_vnc_auth_fail(vs, vs->auth, 2727 "Unsupported auth method for v3.3", ""); 2728 vnc_write_u32(vs, VNC_AUTH_INVALID); 2729 vnc_flush(vs); 2730 vnc_client_error(vs); 2731 } 2732 } else { 2733 vnc_write_u8(vs, 1); /* num auth */ 2734 vnc_write_u8(vs, vs->auth); 2735 vnc_read_when(vs, protocol_client_auth, 1); 2736 vnc_flush(vs); 2737 } 2738 2739 return 0; 2740 } 2741 2742 static VncRectStat *vnc_stat_rect(VncDisplay *vd, int x, int y) 2743 { 2744 struct VncSurface *vs = &vd->guest; 2745 2746 return &vs->stats[y / VNC_STAT_RECT][x / VNC_STAT_RECT]; 2747 } 2748 2749 void vnc_sent_lossy_rect(VncState *vs, int x, int y, int w, int h) 2750 { 2751 int i, j; 2752 2753 w = (x + w) / VNC_STAT_RECT; 2754 h = (y + h) / VNC_STAT_RECT; 2755 x /= VNC_STAT_RECT; 2756 y /= VNC_STAT_RECT; 2757 2758 for (j = y; j <= h; j++) { 2759 for (i = x; i <= w; i++) { 2760 vs->lossy_rect[j][i] = 1; 2761 } 2762 } 2763 } 2764 2765 static int vnc_refresh_lossy_rect(VncDisplay *vd, int x, int y) 2766 { 2767 VncState *vs; 2768 int sty = y / VNC_STAT_RECT; 2769 int stx = x / VNC_STAT_RECT; 2770 int has_dirty = 0; 2771 2772 y = QEMU_ALIGN_DOWN(y, VNC_STAT_RECT); 2773 x = QEMU_ALIGN_DOWN(x, VNC_STAT_RECT); 2774 2775 QTAILQ_FOREACH(vs, &vd->clients, next) { 2776 int j; 2777 2778 /* kernel send buffers are full -> refresh later */ 2779 if (vs->output.offset) { 2780 continue; 2781 } 2782 2783 if (!vs->lossy_rect[sty][stx]) { 2784 continue; 2785 } 2786 2787 vs->lossy_rect[sty][stx] = 0; 2788 for (j = 0; j < VNC_STAT_RECT; ++j) { 2789 bitmap_set(vs->dirty[y + j], 2790 x / VNC_DIRTY_PIXELS_PER_BIT, 2791 VNC_STAT_RECT / VNC_DIRTY_PIXELS_PER_BIT); 2792 } 2793 has_dirty++; 2794 } 2795 2796 return has_dirty; 2797 } 2798 2799 static int vnc_update_stats(VncDisplay *vd, struct timeval * tv) 2800 { 2801 int width = MIN(pixman_image_get_width(vd->guest.fb), 2802 pixman_image_get_width(vd->server)); 2803 int height = MIN(pixman_image_get_height(vd->guest.fb), 2804 pixman_image_get_height(vd->server)); 2805 int x, y; 2806 struct timeval res; 2807 int has_dirty = 0; 2808 2809 for (y = 0; y < height; y += VNC_STAT_RECT) { 2810 for (x = 0; x < width; x += VNC_STAT_RECT) { 2811 VncRectStat *rect = vnc_stat_rect(vd, x, y); 2812 2813 rect->updated = false; 2814 } 2815 } 2816 2817 qemu_timersub(tv, &VNC_REFRESH_STATS, &res); 2818 2819 if (timercmp(&vd->guest.last_freq_check, &res, >)) { 2820 return has_dirty; 2821 } 2822 vd->guest.last_freq_check = *tv; 2823 2824 for (y = 0; y < height; y += VNC_STAT_RECT) { 2825 for (x = 0; x < width; x += VNC_STAT_RECT) { 2826 VncRectStat *rect= vnc_stat_rect(vd, x, y); 2827 int count = ARRAY_SIZE(rect->times); 2828 struct timeval min, max; 2829 2830 if (!timerisset(&rect->times[count - 1])) { 2831 continue ; 2832 } 2833 2834 max = rect->times[(rect->idx + count - 1) % count]; 2835 qemu_timersub(tv, &max, &res); 2836 2837 if (timercmp(&res, &VNC_REFRESH_LOSSY, >)) { 2838 rect->freq = 0; 2839 has_dirty += vnc_refresh_lossy_rect(vd, x, y); 2840 memset(rect->times, 0, sizeof (rect->times)); 2841 continue ; 2842 } 2843 2844 min = rect->times[rect->idx]; 2845 max = rect->times[(rect->idx + count - 1) % count]; 2846 qemu_timersub(&max, &min, &res); 2847 2848 rect->freq = res.tv_sec + res.tv_usec / 1000000.; 2849 rect->freq /= count; 2850 rect->freq = 1. / rect->freq; 2851 } 2852 } 2853 return has_dirty; 2854 } 2855 2856 double vnc_update_freq(VncState *vs, int x, int y, int w, int h) 2857 { 2858 int i, j; 2859 double total = 0; 2860 int num = 0; 2861 2862 x = QEMU_ALIGN_DOWN(x, VNC_STAT_RECT); 2863 y = QEMU_ALIGN_DOWN(y, VNC_STAT_RECT); 2864 2865 for (j = y; j <= y + h; j += VNC_STAT_RECT) { 2866 for (i = x; i <= x + w; i += VNC_STAT_RECT) { 2867 total += vnc_stat_rect(vs->vd, i, j)->freq; 2868 num++; 2869 } 2870 } 2871 2872 if (num) { 2873 return total / num; 2874 } else { 2875 return 0; 2876 } 2877 } 2878 2879 static void vnc_rect_updated(VncDisplay *vd, int x, int y, struct timeval * tv) 2880 { 2881 VncRectStat *rect; 2882 2883 rect = vnc_stat_rect(vd, x, y); 2884 if (rect->updated) { 2885 return ; 2886 } 2887 rect->times[rect->idx] = *tv; 2888 rect->idx = (rect->idx + 1) % ARRAY_SIZE(rect->times); 2889 rect->updated = true; 2890 } 2891 2892 static int vnc_refresh_server_surface(VncDisplay *vd) 2893 { 2894 int width = MIN(pixman_image_get_width(vd->guest.fb), 2895 pixman_image_get_width(vd->server)); 2896 int height = MIN(pixman_image_get_height(vd->guest.fb), 2897 pixman_image_get_height(vd->server)); 2898 int cmp_bytes, server_stride, line_bytes, guest_ll, guest_stride, y = 0; 2899 uint8_t *guest_row0 = NULL, *server_row0; 2900 VncState *vs; 2901 int has_dirty = 0; 2902 pixman_image_t *tmpbuf = NULL; 2903 2904 struct timeval tv = { 0, 0 }; 2905 2906 if (!vd->non_adaptive) { 2907 gettimeofday(&tv, NULL); 2908 has_dirty = vnc_update_stats(vd, &tv); 2909 } 2910 2911 /* 2912 * Walk through the guest dirty map. 2913 * Check and copy modified bits from guest to server surface. 2914 * Update server dirty map. 2915 */ 2916 server_row0 = (uint8_t *)pixman_image_get_data(vd->server); 2917 server_stride = guest_stride = guest_ll = 2918 pixman_image_get_stride(vd->server); 2919 cmp_bytes = MIN(VNC_DIRTY_PIXELS_PER_BIT * VNC_SERVER_FB_BYTES, 2920 server_stride); 2921 if (vd->guest.format != VNC_SERVER_FB_FORMAT) { 2922 int width = pixman_image_get_width(vd->server); 2923 tmpbuf = qemu_pixman_linebuf_create(VNC_SERVER_FB_FORMAT, width); 2924 } else { 2925 int guest_bpp = 2926 PIXMAN_FORMAT_BPP(pixman_image_get_format(vd->guest.fb)); 2927 guest_row0 = (uint8_t *)pixman_image_get_data(vd->guest.fb); 2928 guest_stride = pixman_image_get_stride(vd->guest.fb); 2929 guest_ll = pixman_image_get_width(vd->guest.fb) * (DIV_ROUND_UP(guest_bpp, 8)); 2930 } 2931 line_bytes = MIN(server_stride, guest_ll); 2932 2933 for (;;) { 2934 int x; 2935 uint8_t *guest_ptr, *server_ptr; 2936 unsigned long offset = find_next_bit((unsigned long *) &vd->guest.dirty, 2937 height * VNC_DIRTY_BPL(&vd->guest), 2938 y * VNC_DIRTY_BPL(&vd->guest)); 2939 if (offset == height * VNC_DIRTY_BPL(&vd->guest)) { 2940 /* no more dirty bits */ 2941 break; 2942 } 2943 y = offset / VNC_DIRTY_BPL(&vd->guest); 2944 x = offset % VNC_DIRTY_BPL(&vd->guest); 2945 2946 server_ptr = server_row0 + y * server_stride + x * cmp_bytes; 2947 2948 if (vd->guest.format != VNC_SERVER_FB_FORMAT) { 2949 qemu_pixman_linebuf_fill(tmpbuf, vd->guest.fb, width, 0, y); 2950 guest_ptr = (uint8_t *)pixman_image_get_data(tmpbuf); 2951 } else { 2952 guest_ptr = guest_row0 + y * guest_stride; 2953 } 2954 guest_ptr += x * cmp_bytes; 2955 2956 for (; x < DIV_ROUND_UP(width, VNC_DIRTY_PIXELS_PER_BIT); 2957 x++, guest_ptr += cmp_bytes, server_ptr += cmp_bytes) { 2958 int _cmp_bytes = cmp_bytes; 2959 if (!test_and_clear_bit(x, vd->guest.dirty[y])) { 2960 continue; 2961 } 2962 if ((x + 1) * cmp_bytes > line_bytes) { 2963 _cmp_bytes = line_bytes - x * cmp_bytes; 2964 } 2965 assert(_cmp_bytes >= 0); 2966 if (memcmp(server_ptr, guest_ptr, _cmp_bytes) == 0) { 2967 continue; 2968 } 2969 memcpy(server_ptr, guest_ptr, _cmp_bytes); 2970 if (!vd->non_adaptive) { 2971 vnc_rect_updated(vd, x * VNC_DIRTY_PIXELS_PER_BIT, 2972 y, &tv); 2973 } 2974 QTAILQ_FOREACH(vs, &vd->clients, next) { 2975 set_bit(x, vs->dirty[y]); 2976 } 2977 has_dirty++; 2978 } 2979 2980 y++; 2981 } 2982 qemu_pixman_image_unref(tmpbuf); 2983 return has_dirty; 2984 } 2985 2986 static void vnc_refresh(DisplayChangeListener *dcl) 2987 { 2988 VncDisplay *vd = container_of(dcl, VncDisplay, dcl); 2989 VncState *vs, *vn; 2990 int has_dirty, rects = 0; 2991 2992 if (QTAILQ_EMPTY(&vd->clients)) { 2993 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_MAX); 2994 return; 2995 } 2996 2997 graphic_hw_update(vd->dcl.con); 2998 2999 if (vnc_trylock_display(vd)) { 3000 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE); 3001 return; 3002 } 3003 3004 has_dirty = vnc_refresh_server_surface(vd); 3005 vnc_unlock_display(vd); 3006 3007 QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) { 3008 rects += vnc_update_client(vs, has_dirty); 3009 /* vs might be free()ed here */ 3010 } 3011 3012 if (has_dirty && rects) { 3013 vd->dcl.update_interval /= 2; 3014 if (vd->dcl.update_interval < VNC_REFRESH_INTERVAL_BASE) { 3015 vd->dcl.update_interval = VNC_REFRESH_INTERVAL_BASE; 3016 } 3017 } else { 3018 vd->dcl.update_interval += VNC_REFRESH_INTERVAL_INC; 3019 if (vd->dcl.update_interval > VNC_REFRESH_INTERVAL_MAX) { 3020 vd->dcl.update_interval = VNC_REFRESH_INTERVAL_MAX; 3021 } 3022 } 3023 } 3024 3025 static void vnc_connect(VncDisplay *vd, QIOChannelSocket *sioc, 3026 bool skipauth, bool websocket) 3027 { 3028 VncState *vs = g_new0(VncState, 1); 3029 bool first_client = QTAILQ_EMPTY(&vd->clients); 3030 int i; 3031 3032 trace_vnc_client_connect(vs, sioc); 3033 vs->sioc = sioc; 3034 object_ref(OBJECT(vs->sioc)); 3035 vs->ioc = QIO_CHANNEL(sioc); 3036 object_ref(OBJECT(vs->ioc)); 3037 vs->vd = vd; 3038 3039 buffer_init(&vs->input, "vnc-input/%p", sioc); 3040 buffer_init(&vs->output, "vnc-output/%p", sioc); 3041 buffer_init(&vs->jobs_buffer, "vnc-jobs_buffer/%p", sioc); 3042 3043 buffer_init(&vs->tight.tight, "vnc-tight/%p", sioc); 3044 buffer_init(&vs->tight.zlib, "vnc-tight-zlib/%p", sioc); 3045 buffer_init(&vs->tight.gradient, "vnc-tight-gradient/%p", sioc); 3046 #ifdef CONFIG_VNC_JPEG 3047 buffer_init(&vs->tight.jpeg, "vnc-tight-jpeg/%p", sioc); 3048 #endif 3049 #ifdef CONFIG_VNC_PNG 3050 buffer_init(&vs->tight.png, "vnc-tight-png/%p", sioc); 3051 #endif 3052 buffer_init(&vs->zlib.zlib, "vnc-zlib/%p", sioc); 3053 buffer_init(&vs->zrle.zrle, "vnc-zrle/%p", sioc); 3054 buffer_init(&vs->zrle.fb, "vnc-zrle-fb/%p", sioc); 3055 buffer_init(&vs->zrle.zlib, "vnc-zrle-zlib/%p", sioc); 3056 3057 if (skipauth) { 3058 vs->auth = VNC_AUTH_NONE; 3059 vs->subauth = VNC_AUTH_INVALID; 3060 } else { 3061 if (websocket) { 3062 vs->auth = vd->ws_auth; 3063 vs->subauth = VNC_AUTH_INVALID; 3064 } else { 3065 vs->auth = vd->auth; 3066 vs->subauth = vd->subauth; 3067 } 3068 } 3069 VNC_DEBUG("Client sioc=%p ws=%d auth=%d subauth=%d\n", 3070 sioc, websocket, vs->auth, vs->subauth); 3071 3072 vs->lossy_rect = g_malloc0(VNC_STAT_ROWS * sizeof (*vs->lossy_rect)); 3073 for (i = 0; i < VNC_STAT_ROWS; ++i) { 3074 vs->lossy_rect[i] = g_new0(uint8_t, VNC_STAT_COLS); 3075 } 3076 3077 VNC_DEBUG("New client on socket %p\n", vs->sioc); 3078 update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE); 3079 qio_channel_set_blocking(vs->ioc, false, NULL); 3080 if (vs->ioc_tag) { 3081 g_source_remove(vs->ioc_tag); 3082 } 3083 if (websocket) { 3084 vs->websocket = 1; 3085 if (vd->tlscreds) { 3086 vs->ioc_tag = qio_channel_add_watch( 3087 vs->ioc, G_IO_IN, vncws_tls_handshake_io, vs, NULL); 3088 } else { 3089 vs->ioc_tag = qio_channel_add_watch( 3090 vs->ioc, G_IO_IN, vncws_handshake_io, vs, NULL); 3091 } 3092 } else { 3093 vs->ioc_tag = qio_channel_add_watch( 3094 vs->ioc, G_IO_IN, vnc_client_io, vs, NULL); 3095 } 3096 3097 vnc_client_cache_addr(vs); 3098 vnc_qmp_event(vs, QAPI_EVENT_VNC_CONNECTED); 3099 vnc_set_share_mode(vs, VNC_SHARE_MODE_CONNECTING); 3100 3101 vs->last_x = -1; 3102 vs->last_y = -1; 3103 3104 vs->as.freq = 44100; 3105 vs->as.nchannels = 2; 3106 vs->as.fmt = AUD_FMT_S16; 3107 vs->as.endianness = 0; 3108 3109 qemu_mutex_init(&vs->output_mutex); 3110 vs->bh = qemu_bh_new(vnc_jobs_bh, vs); 3111 3112 QTAILQ_INSERT_TAIL(&vd->clients, vs, next); 3113 if (first_client) { 3114 vnc_update_server_surface(vd); 3115 } 3116 3117 graphic_hw_update(vd->dcl.con); 3118 3119 if (!vs->websocket) { 3120 vnc_start_protocol(vs); 3121 } 3122 3123 if (vd->num_connecting > vd->connections_limit) { 3124 QTAILQ_FOREACH(vs, &vd->clients, next) { 3125 if (vs->share_mode == VNC_SHARE_MODE_CONNECTING) { 3126 vnc_disconnect_start(vs); 3127 return; 3128 } 3129 } 3130 } 3131 } 3132 3133 void vnc_start_protocol(VncState *vs) 3134 { 3135 vnc_write(vs, "RFB 003.008\n", 12); 3136 vnc_flush(vs); 3137 vnc_read_when(vs, protocol_version, 12); 3138 3139 vs->mouse_mode_notifier.notify = check_pointer_type_change; 3140 qemu_add_mouse_mode_change_notifier(&vs->mouse_mode_notifier); 3141 } 3142 3143 static void vnc_listen_io(QIONetListener *listener, 3144 QIOChannelSocket *cioc, 3145 void *opaque) 3146 { 3147 VncDisplay *vd = opaque; 3148 bool isWebsock = listener == vd->wslistener; 3149 3150 qio_channel_set_name(QIO_CHANNEL(cioc), 3151 isWebsock ? "vnc-ws-server" : "vnc-server"); 3152 qio_channel_set_delay(QIO_CHANNEL(cioc), false); 3153 vnc_connect(vd, cioc, false, isWebsock); 3154 object_unref(OBJECT(cioc)); 3155 } 3156 3157 static const DisplayChangeListenerOps dcl_ops = { 3158 .dpy_name = "vnc", 3159 .dpy_refresh = vnc_refresh, 3160 .dpy_gfx_update = vnc_dpy_update, 3161 .dpy_gfx_switch = vnc_dpy_switch, 3162 .dpy_gfx_check_format = qemu_pixman_check_format, 3163 .dpy_mouse_set = vnc_mouse_set, 3164 .dpy_cursor_define = vnc_dpy_cursor_define, 3165 }; 3166 3167 void vnc_display_init(const char *id) 3168 { 3169 VncDisplay *vd; 3170 3171 if (vnc_display_find(id) != NULL) { 3172 return; 3173 } 3174 vd = g_malloc0(sizeof(*vd)); 3175 3176 vd->id = strdup(id); 3177 QTAILQ_INSERT_TAIL(&vnc_displays, vd, next); 3178 3179 QTAILQ_INIT(&vd->clients); 3180 vd->expires = TIME_MAX; 3181 3182 if (keyboard_layout) { 3183 trace_vnc_key_map_init(keyboard_layout); 3184 vd->kbd_layout = init_keyboard_layout(name2keysym, keyboard_layout); 3185 } else { 3186 vd->kbd_layout = init_keyboard_layout(name2keysym, "en-us"); 3187 } 3188 3189 if (!vd->kbd_layout) { 3190 exit(1); 3191 } 3192 3193 vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE; 3194 vd->connections_limit = 32; 3195 3196 qemu_mutex_init(&vd->mutex); 3197 vnc_start_worker_thread(); 3198 3199 vd->dcl.ops = &dcl_ops; 3200 register_displaychangelistener(&vd->dcl); 3201 } 3202 3203 3204 static void vnc_display_close(VncDisplay *vd) 3205 { 3206 if (!vd) { 3207 return; 3208 } 3209 vd->is_unix = false; 3210 3211 if (vd->listener) { 3212 qio_net_listener_disconnect(vd->listener); 3213 object_unref(OBJECT(vd->listener)); 3214 } 3215 vd->listener = NULL; 3216 3217 if (vd->wslistener) { 3218 qio_net_listener_disconnect(vd->wslistener); 3219 object_unref(OBJECT(vd->wslistener)); 3220 } 3221 vd->wslistener = NULL; 3222 3223 vd->auth = VNC_AUTH_INVALID; 3224 vd->subauth = VNC_AUTH_INVALID; 3225 if (vd->tlscreds) { 3226 object_unparent(OBJECT(vd->tlscreds)); 3227 vd->tlscreds = NULL; 3228 } 3229 g_free(vd->tlsaclname); 3230 vd->tlsaclname = NULL; 3231 if (vd->lock_key_sync) { 3232 qemu_remove_led_event_handler(vd->led); 3233 vd->led = NULL; 3234 } 3235 } 3236 3237 int vnc_display_password(const char *id, const char *password) 3238 { 3239 VncDisplay *vd = vnc_display_find(id); 3240 3241 if (!vd) { 3242 return -EINVAL; 3243 } 3244 if (vd->auth == VNC_AUTH_NONE) { 3245 error_printf_unless_qmp("If you want use passwords please enable " 3246 "password auth using '-vnc ${dpy},password'.\n"); 3247 return -EINVAL; 3248 } 3249 3250 g_free(vd->password); 3251 vd->password = g_strdup(password); 3252 3253 return 0; 3254 } 3255 3256 int vnc_display_pw_expire(const char *id, time_t expires) 3257 { 3258 VncDisplay *vd = vnc_display_find(id); 3259 3260 if (!vd) { 3261 return -EINVAL; 3262 } 3263 3264 vd->expires = expires; 3265 return 0; 3266 } 3267 3268 static void vnc_display_print_local_addr(VncDisplay *vd) 3269 { 3270 SocketAddress *addr; 3271 Error *err = NULL; 3272 3273 if (!vd->listener || !vd->listener->nsioc) { 3274 return; 3275 } 3276 3277 addr = qio_channel_socket_get_local_address(vd->listener->sioc[0], &err); 3278 if (!addr) { 3279 return; 3280 } 3281 3282 if (addr->type != SOCKET_ADDRESS_TYPE_INET) { 3283 qapi_free_SocketAddress(addr); 3284 return; 3285 } 3286 error_printf_unless_qmp("VNC server running on %s:%s\n", 3287 addr->u.inet.host, 3288 addr->u.inet.port); 3289 qapi_free_SocketAddress(addr); 3290 } 3291 3292 static QemuOptsList qemu_vnc_opts = { 3293 .name = "vnc", 3294 .head = QTAILQ_HEAD_INITIALIZER(qemu_vnc_opts.head), 3295 .implied_opt_name = "vnc", 3296 .desc = { 3297 { 3298 .name = "vnc", 3299 .type = QEMU_OPT_STRING, 3300 },{ 3301 .name = "websocket", 3302 .type = QEMU_OPT_STRING, 3303 },{ 3304 .name = "tls-creds", 3305 .type = QEMU_OPT_STRING, 3306 },{ 3307 /* Deprecated in favour of tls-creds */ 3308 .name = "x509", 3309 .type = QEMU_OPT_STRING, 3310 },{ 3311 .name = "share", 3312 .type = QEMU_OPT_STRING, 3313 },{ 3314 .name = "display", 3315 .type = QEMU_OPT_STRING, 3316 },{ 3317 .name = "head", 3318 .type = QEMU_OPT_NUMBER, 3319 },{ 3320 .name = "connections", 3321 .type = QEMU_OPT_NUMBER, 3322 },{ 3323 .name = "to", 3324 .type = QEMU_OPT_NUMBER, 3325 },{ 3326 .name = "ipv4", 3327 .type = QEMU_OPT_BOOL, 3328 },{ 3329 .name = "ipv6", 3330 .type = QEMU_OPT_BOOL, 3331 },{ 3332 .name = "password", 3333 .type = QEMU_OPT_BOOL, 3334 },{ 3335 .name = "reverse", 3336 .type = QEMU_OPT_BOOL, 3337 },{ 3338 .name = "lock-key-sync", 3339 .type = QEMU_OPT_BOOL, 3340 },{ 3341 .name = "key-delay-ms", 3342 .type = QEMU_OPT_NUMBER, 3343 },{ 3344 .name = "sasl", 3345 .type = QEMU_OPT_BOOL, 3346 },{ 3347 /* Deprecated in favour of tls-creds */ 3348 .name = "tls", 3349 .type = QEMU_OPT_BOOL, 3350 },{ 3351 /* Deprecated in favour of tls-creds */ 3352 .name = "x509verify", 3353 .type = QEMU_OPT_STRING, 3354 },{ 3355 .name = "acl", 3356 .type = QEMU_OPT_BOOL, 3357 },{ 3358 .name = "lossy", 3359 .type = QEMU_OPT_BOOL, 3360 },{ 3361 .name = "non-adaptive", 3362 .type = QEMU_OPT_BOOL, 3363 }, 3364 { /* end of list */ } 3365 }, 3366 }; 3367 3368 3369 static int 3370 vnc_display_setup_auth(int *auth, 3371 int *subauth, 3372 QCryptoTLSCreds *tlscreds, 3373 bool password, 3374 bool sasl, 3375 bool websocket, 3376 Error **errp) 3377 { 3378 /* 3379 * We have a choice of 3 authentication options 3380 * 3381 * 1. none 3382 * 2. vnc 3383 * 3. sasl 3384 * 3385 * The channel can be run in 2 modes 3386 * 3387 * 1. clear 3388 * 2. tls 3389 * 3390 * And TLS can use 2 types of credentials 3391 * 3392 * 1. anon 3393 * 2. x509 3394 * 3395 * We thus have 9 possible logical combinations 3396 * 3397 * 1. clear + none 3398 * 2. clear + vnc 3399 * 3. clear + sasl 3400 * 4. tls + anon + none 3401 * 5. tls + anon + vnc 3402 * 6. tls + anon + sasl 3403 * 7. tls + x509 + none 3404 * 8. tls + x509 + vnc 3405 * 9. tls + x509 + sasl 3406 * 3407 * These need to be mapped into the VNC auth schemes 3408 * in an appropriate manner. In regular VNC, all the 3409 * TLS options get mapped into VNC_AUTH_VENCRYPT 3410 * sub-auth types. 3411 * 3412 * In websockets, the https:// protocol already provides 3413 * TLS support, so there is no need to make use of the 3414 * VeNCrypt extension. Furthermore, websockets browser 3415 * clients could not use VeNCrypt even if they wanted to, 3416 * as they cannot control when the TLS handshake takes 3417 * place. Thus there is no option but to rely on https://, 3418 * meaning combinations 4->6 and 7->9 will be mapped to 3419 * VNC auth schemes in the same way as combos 1->3. 3420 * 3421 * Regardless of fact that we have a different mapping to 3422 * VNC auth mechs for plain VNC vs websockets VNC, the end 3423 * result has the same security characteristics. 3424 */ 3425 if (websocket || !tlscreds) { 3426 if (password) { 3427 VNC_DEBUG("Initializing VNC server with password auth\n"); 3428 *auth = VNC_AUTH_VNC; 3429 } else if (sasl) { 3430 VNC_DEBUG("Initializing VNC server with SASL auth\n"); 3431 *auth = VNC_AUTH_SASL; 3432 } else { 3433 VNC_DEBUG("Initializing VNC server with no auth\n"); 3434 *auth = VNC_AUTH_NONE; 3435 } 3436 *subauth = VNC_AUTH_INVALID; 3437 } else { 3438 bool is_x509 = object_dynamic_cast(OBJECT(tlscreds), 3439 TYPE_QCRYPTO_TLS_CREDS_X509) != NULL; 3440 bool is_anon = object_dynamic_cast(OBJECT(tlscreds), 3441 TYPE_QCRYPTO_TLS_CREDS_ANON) != NULL; 3442 3443 if (!is_x509 && !is_anon) { 3444 error_setg(errp, 3445 "Unsupported TLS cred type %s", 3446 object_get_typename(OBJECT(tlscreds))); 3447 return -1; 3448 } 3449 *auth = VNC_AUTH_VENCRYPT; 3450 if (password) { 3451 if (is_x509) { 3452 VNC_DEBUG("Initializing VNC server with x509 password auth\n"); 3453 *subauth = VNC_AUTH_VENCRYPT_X509VNC; 3454 } else { 3455 VNC_DEBUG("Initializing VNC server with TLS password auth\n"); 3456 *subauth = VNC_AUTH_VENCRYPT_TLSVNC; 3457 } 3458 3459 } else if (sasl) { 3460 if (is_x509) { 3461 VNC_DEBUG("Initializing VNC server with x509 SASL auth\n"); 3462 *subauth = VNC_AUTH_VENCRYPT_X509SASL; 3463 } else { 3464 VNC_DEBUG("Initializing VNC server with TLS SASL auth\n"); 3465 *subauth = VNC_AUTH_VENCRYPT_TLSSASL; 3466 } 3467 } else { 3468 if (is_x509) { 3469 VNC_DEBUG("Initializing VNC server with x509 no auth\n"); 3470 *subauth = VNC_AUTH_VENCRYPT_X509NONE; 3471 } else { 3472 VNC_DEBUG("Initializing VNC server with TLS no auth\n"); 3473 *subauth = VNC_AUTH_VENCRYPT_TLSNONE; 3474 } 3475 } 3476 } 3477 return 0; 3478 } 3479 3480 3481 /* 3482 * Handle back compat with old CLI syntax by creating some 3483 * suitable QCryptoTLSCreds objects 3484 */ 3485 static QCryptoTLSCreds * 3486 vnc_display_create_creds(bool x509, 3487 bool x509verify, 3488 const char *dir, 3489 const char *id, 3490 Error **errp) 3491 { 3492 gchar *credsid = g_strdup_printf("tlsvnc%s", id); 3493 Object *parent = object_get_objects_root(); 3494 Object *creds; 3495 Error *err = NULL; 3496 3497 if (x509) { 3498 creds = object_new_with_props(TYPE_QCRYPTO_TLS_CREDS_X509, 3499 parent, 3500 credsid, 3501 &err, 3502 "endpoint", "server", 3503 "dir", dir, 3504 "verify-peer", x509verify ? "yes" : "no", 3505 NULL); 3506 } else { 3507 creds = object_new_with_props(TYPE_QCRYPTO_TLS_CREDS_ANON, 3508 parent, 3509 credsid, 3510 &err, 3511 "endpoint", "server", 3512 NULL); 3513 } 3514 3515 g_free(credsid); 3516 3517 if (err) { 3518 error_propagate(errp, err); 3519 return NULL; 3520 } 3521 3522 return QCRYPTO_TLS_CREDS(creds); 3523 } 3524 3525 3526 static int vnc_display_get_address(const char *addrstr, 3527 bool websocket, 3528 bool reverse, 3529 int displaynum, 3530 int to, 3531 bool has_ipv4, 3532 bool has_ipv6, 3533 bool ipv4, 3534 bool ipv6, 3535 SocketAddress **retaddr, 3536 Error **errp) 3537 { 3538 int ret = -1; 3539 SocketAddress *addr = NULL; 3540 3541 addr = g_new0(SocketAddress, 1); 3542 3543 if (strncmp(addrstr, "unix:", 5) == 0) { 3544 addr->type = SOCKET_ADDRESS_TYPE_UNIX; 3545 addr->u.q_unix.path = g_strdup(addrstr + 5); 3546 3547 if (websocket) { 3548 error_setg(errp, "UNIX sockets not supported with websock"); 3549 goto cleanup; 3550 } 3551 3552 if (to) { 3553 error_setg(errp, "Port range not support with UNIX socket"); 3554 goto cleanup; 3555 } 3556 ret = 0; 3557 } else { 3558 const char *port; 3559 size_t hostlen; 3560 unsigned long long baseport = 0; 3561 InetSocketAddress *inet; 3562 3563 port = strrchr(addrstr, ':'); 3564 if (!port) { 3565 if (websocket) { 3566 hostlen = 0; 3567 port = addrstr; 3568 } else { 3569 error_setg(errp, "no vnc port specified"); 3570 goto cleanup; 3571 } 3572 } else { 3573 hostlen = port - addrstr; 3574 port++; 3575 if (*port == '\0') { 3576 error_setg(errp, "vnc port cannot be empty"); 3577 goto cleanup; 3578 } 3579 } 3580 3581 addr->type = SOCKET_ADDRESS_TYPE_INET; 3582 inet = &addr->u.inet; 3583 if (addrstr[0] == '[' && addrstr[hostlen - 1] == ']') { 3584 inet->host = g_strndup(addrstr + 1, hostlen - 2); 3585 } else { 3586 inet->host = g_strndup(addrstr, hostlen); 3587 } 3588 /* plain VNC port is just an offset, for websocket 3589 * port is absolute */ 3590 if (websocket) { 3591 if (g_str_equal(addrstr, "") || 3592 g_str_equal(addrstr, "on")) { 3593 if (displaynum == -1) { 3594 error_setg(errp, "explicit websocket port is required"); 3595 goto cleanup; 3596 } 3597 inet->port = g_strdup_printf( 3598 "%d", displaynum + 5700); 3599 if (to) { 3600 inet->has_to = true; 3601 inet->to = to + 5700; 3602 } 3603 } else { 3604 inet->port = g_strdup(port); 3605 } 3606 } else { 3607 int offset = reverse ? 0 : 5900; 3608 if (parse_uint_full(port, &baseport, 10) < 0) { 3609 error_setg(errp, "can't convert to a number: %s", port); 3610 goto cleanup; 3611 } 3612 if (baseport > 65535 || 3613 baseport + offset > 65535) { 3614 error_setg(errp, "port %s out of range", port); 3615 goto cleanup; 3616 } 3617 inet->port = g_strdup_printf( 3618 "%d", (int)baseport + offset); 3619 3620 if (to) { 3621 inet->has_to = true; 3622 inet->to = to + offset; 3623 } 3624 } 3625 3626 inet->ipv4 = ipv4; 3627 inet->has_ipv4 = has_ipv4; 3628 inet->ipv6 = ipv6; 3629 inet->has_ipv6 = has_ipv6; 3630 3631 ret = baseport; 3632 } 3633 3634 *retaddr = addr; 3635 3636 cleanup: 3637 if (ret < 0) { 3638 qapi_free_SocketAddress(addr); 3639 } 3640 return ret; 3641 } 3642 3643 static void vnc_free_addresses(SocketAddress ***retsaddr, 3644 size_t *retnsaddr) 3645 { 3646 size_t i; 3647 3648 for (i = 0; i < *retnsaddr; i++) { 3649 qapi_free_SocketAddress((*retsaddr)[i]); 3650 } 3651 g_free(*retsaddr); 3652 3653 *retsaddr = NULL; 3654 *retnsaddr = 0; 3655 } 3656 3657 static int vnc_display_get_addresses(QemuOpts *opts, 3658 bool reverse, 3659 SocketAddress ***retsaddr, 3660 size_t *retnsaddr, 3661 SocketAddress ***retwsaddr, 3662 size_t *retnwsaddr, 3663 Error **errp) 3664 { 3665 SocketAddress *saddr = NULL; 3666 SocketAddress *wsaddr = NULL; 3667 QemuOptsIter addriter; 3668 const char *addr; 3669 int to = qemu_opt_get_number(opts, "to", 0); 3670 bool has_ipv4 = qemu_opt_get(opts, "ipv4"); 3671 bool has_ipv6 = qemu_opt_get(opts, "ipv6"); 3672 bool ipv4 = qemu_opt_get_bool(opts, "ipv4", false); 3673 bool ipv6 = qemu_opt_get_bool(opts, "ipv6", false); 3674 int displaynum = -1; 3675 int ret = -1; 3676 3677 *retsaddr = NULL; 3678 *retnsaddr = 0; 3679 *retwsaddr = NULL; 3680 *retnwsaddr = 0; 3681 3682 addr = qemu_opt_get(opts, "vnc"); 3683 if (addr == NULL || g_str_equal(addr, "none")) { 3684 ret = 0; 3685 goto cleanup; 3686 } 3687 if (qemu_opt_get(opts, "websocket") && 3688 !qcrypto_hash_supports(QCRYPTO_HASH_ALG_SHA1)) { 3689 error_setg(errp, 3690 "SHA1 hash support is required for websockets"); 3691 goto cleanup; 3692 } 3693 3694 qemu_opt_iter_init(&addriter, opts, "vnc"); 3695 while ((addr = qemu_opt_iter_next(&addriter)) != NULL) { 3696 int rv; 3697 rv = vnc_display_get_address(addr, false, reverse, 0, to, 3698 has_ipv4, has_ipv6, 3699 ipv4, ipv6, 3700 &saddr, errp); 3701 if (rv < 0) { 3702 goto cleanup; 3703 } 3704 /* Historical compat - first listen address can be used 3705 * to set the default websocket port 3706 */ 3707 if (displaynum == -1) { 3708 displaynum = rv; 3709 } 3710 *retsaddr = g_renew(SocketAddress *, *retsaddr, *retnsaddr + 1); 3711 (*retsaddr)[(*retnsaddr)++] = saddr; 3712 } 3713 3714 /* If we had multiple primary displays, we don't do defaults 3715 * for websocket, and require explicit config instead. */ 3716 if (*retnsaddr > 1) { 3717 displaynum = -1; 3718 } 3719 3720 qemu_opt_iter_init(&addriter, opts, "websocket"); 3721 while ((addr = qemu_opt_iter_next(&addriter)) != NULL) { 3722 if (vnc_display_get_address(addr, true, reverse, displaynum, to, 3723 has_ipv4, has_ipv6, 3724 ipv4, ipv6, 3725 &wsaddr, errp) < 0) { 3726 goto cleanup; 3727 } 3728 3729 /* Historical compat - if only a single listen address was 3730 * provided, then this is used to set the default listen 3731 * address for websocket too 3732 */ 3733 if (*retnsaddr == 1 && 3734 (*retsaddr)[0]->type == SOCKET_ADDRESS_TYPE_INET && 3735 wsaddr->type == SOCKET_ADDRESS_TYPE_INET && 3736 g_str_equal(wsaddr->u.inet.host, "") && 3737 !g_str_equal((*retsaddr)[0]->u.inet.host, "")) { 3738 g_free(wsaddr->u.inet.host); 3739 wsaddr->u.inet.host = g_strdup((*retsaddr)[0]->u.inet.host); 3740 } 3741 3742 *retwsaddr = g_renew(SocketAddress *, *retwsaddr, *retnwsaddr + 1); 3743 (*retwsaddr)[(*retnwsaddr)++] = wsaddr; 3744 } 3745 3746 ret = 0; 3747 cleanup: 3748 if (ret < 0) { 3749 vnc_free_addresses(retsaddr, retnsaddr); 3750 vnc_free_addresses(retwsaddr, retnwsaddr); 3751 } 3752 return ret; 3753 } 3754 3755 static int vnc_display_connect(VncDisplay *vd, 3756 SocketAddress **saddr, 3757 size_t nsaddr, 3758 SocketAddress **wsaddr, 3759 size_t nwsaddr, 3760 Error **errp) 3761 { 3762 /* connect to viewer */ 3763 QIOChannelSocket *sioc = NULL; 3764 if (nwsaddr != 0) { 3765 error_setg(errp, "Cannot use websockets in reverse mode"); 3766 return -1; 3767 } 3768 if (nsaddr != 1) { 3769 error_setg(errp, "Expected a single address in reverse mode"); 3770 return -1; 3771 } 3772 /* TODO SOCKET_ADDRESS_TYPE_FD when fd has AF_UNIX */ 3773 vd->is_unix = saddr[0]->type == SOCKET_ADDRESS_TYPE_UNIX; 3774 sioc = qio_channel_socket_new(); 3775 qio_channel_set_name(QIO_CHANNEL(sioc), "vnc-reverse"); 3776 if (qio_channel_socket_connect_sync(sioc, saddr[0], errp) < 0) { 3777 return -1; 3778 } 3779 vnc_connect(vd, sioc, false, false); 3780 object_unref(OBJECT(sioc)); 3781 return 0; 3782 } 3783 3784 3785 static int vnc_display_listen(VncDisplay *vd, 3786 SocketAddress **saddr, 3787 size_t nsaddr, 3788 SocketAddress **wsaddr, 3789 size_t nwsaddr, 3790 Error **errp) 3791 { 3792 size_t i; 3793 3794 if (nsaddr) { 3795 vd->listener = qio_net_listener_new(); 3796 qio_net_listener_set_name(vd->listener, "vnc-listen"); 3797 for (i = 0; i < nsaddr; i++) { 3798 if (qio_net_listener_open_sync(vd->listener, 3799 saddr[i], 3800 errp) < 0) { 3801 return -1; 3802 } 3803 } 3804 3805 qio_net_listener_set_client_func(vd->listener, 3806 vnc_listen_io, vd, NULL); 3807 } 3808 3809 if (nwsaddr) { 3810 vd->wslistener = qio_net_listener_new(); 3811 qio_net_listener_set_name(vd->wslistener, "vnc-ws-listen"); 3812 for (i = 0; i < nwsaddr; i++) { 3813 if (qio_net_listener_open_sync(vd->wslistener, 3814 wsaddr[i], 3815 errp) < 0) { 3816 return -1; 3817 } 3818 } 3819 3820 qio_net_listener_set_client_func(vd->wslistener, 3821 vnc_listen_io, vd, NULL); 3822 } 3823 3824 return 0; 3825 } 3826 3827 3828 void vnc_display_open(const char *id, Error **errp) 3829 { 3830 VncDisplay *vd = vnc_display_find(id); 3831 QemuOpts *opts = qemu_opts_find(&qemu_vnc_opts, id); 3832 SocketAddress **saddr = NULL, **wsaddr = NULL; 3833 size_t nsaddr, nwsaddr; 3834 const char *share, *device_id; 3835 QemuConsole *con; 3836 bool password = false; 3837 bool reverse = false; 3838 const char *credid; 3839 bool sasl = false; 3840 #ifdef CONFIG_VNC_SASL 3841 int saslErr; 3842 #endif 3843 int acl = 0; 3844 int lock_key_sync = 1; 3845 int key_delay_ms; 3846 3847 if (!vd) { 3848 error_setg(errp, "VNC display not active"); 3849 return; 3850 } 3851 vnc_display_close(vd); 3852 3853 if (!opts) { 3854 return; 3855 } 3856 3857 reverse = qemu_opt_get_bool(opts, "reverse", false); 3858 if (vnc_display_get_addresses(opts, reverse, &saddr, &nsaddr, 3859 &wsaddr, &nwsaddr, errp) < 0) { 3860 goto fail; 3861 } 3862 3863 password = qemu_opt_get_bool(opts, "password", false); 3864 if (password) { 3865 if (fips_get_state()) { 3866 error_setg(errp, 3867 "VNC password auth disabled due to FIPS mode, " 3868 "consider using the VeNCrypt or SASL authentication " 3869 "methods as an alternative"); 3870 goto fail; 3871 } 3872 if (!qcrypto_cipher_supports( 3873 QCRYPTO_CIPHER_ALG_DES_RFB, QCRYPTO_CIPHER_MODE_ECB)) { 3874 error_setg(errp, 3875 "Cipher backend does not support DES RFB algorithm"); 3876 goto fail; 3877 } 3878 } 3879 3880 lock_key_sync = qemu_opt_get_bool(opts, "lock-key-sync", true); 3881 key_delay_ms = qemu_opt_get_number(opts, "key-delay-ms", 10); 3882 sasl = qemu_opt_get_bool(opts, "sasl", false); 3883 #ifndef CONFIG_VNC_SASL 3884 if (sasl) { 3885 error_setg(errp, "VNC SASL auth requires cyrus-sasl support"); 3886 goto fail; 3887 } 3888 #endif /* CONFIG_VNC_SASL */ 3889 credid = qemu_opt_get(opts, "tls-creds"); 3890 if (credid) { 3891 Object *creds; 3892 if (qemu_opt_get(opts, "tls") || 3893 qemu_opt_get(opts, "x509") || 3894 qemu_opt_get(opts, "x509verify")) { 3895 error_setg(errp, 3896 "'tls-creds' parameter is mutually exclusive with " 3897 "'tls', 'x509' and 'x509verify' parameters"); 3898 goto fail; 3899 } 3900 3901 creds = object_resolve_path_component( 3902 object_get_objects_root(), credid); 3903 if (!creds) { 3904 error_setg(errp, "No TLS credentials with id '%s'", 3905 credid); 3906 goto fail; 3907 } 3908 vd->tlscreds = (QCryptoTLSCreds *) 3909 object_dynamic_cast(creds, 3910 TYPE_QCRYPTO_TLS_CREDS); 3911 if (!vd->tlscreds) { 3912 error_setg(errp, "Object with id '%s' is not TLS credentials", 3913 credid); 3914 goto fail; 3915 } 3916 object_ref(OBJECT(vd->tlscreds)); 3917 3918 if (vd->tlscreds->endpoint != QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) { 3919 error_setg(errp, 3920 "Expecting TLS credentials with a server endpoint"); 3921 goto fail; 3922 } 3923 } else { 3924 const char *path; 3925 bool tls = false, x509 = false, x509verify = false; 3926 tls = qemu_opt_get_bool(opts, "tls", false); 3927 if (tls) { 3928 path = qemu_opt_get(opts, "x509"); 3929 3930 if (path) { 3931 x509 = true; 3932 } else { 3933 path = qemu_opt_get(opts, "x509verify"); 3934 if (path) { 3935 x509 = true; 3936 x509verify = true; 3937 } 3938 } 3939 vd->tlscreds = vnc_display_create_creds(x509, 3940 x509verify, 3941 path, 3942 vd->id, 3943 errp); 3944 if (!vd->tlscreds) { 3945 goto fail; 3946 } 3947 } 3948 } 3949 acl = qemu_opt_get_bool(opts, "acl", false); 3950 3951 share = qemu_opt_get(opts, "share"); 3952 if (share) { 3953 if (strcmp(share, "ignore") == 0) { 3954 vd->share_policy = VNC_SHARE_POLICY_IGNORE; 3955 } else if (strcmp(share, "allow-exclusive") == 0) { 3956 vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE; 3957 } else if (strcmp(share, "force-shared") == 0) { 3958 vd->share_policy = VNC_SHARE_POLICY_FORCE_SHARED; 3959 } else { 3960 error_setg(errp, "unknown vnc share= option"); 3961 goto fail; 3962 } 3963 } else { 3964 vd->share_policy = VNC_SHARE_POLICY_ALLOW_EXCLUSIVE; 3965 } 3966 vd->connections_limit = qemu_opt_get_number(opts, "connections", 32); 3967 3968 #ifdef CONFIG_VNC_JPEG 3969 vd->lossy = qemu_opt_get_bool(opts, "lossy", false); 3970 #endif 3971 vd->non_adaptive = qemu_opt_get_bool(opts, "non-adaptive", false); 3972 /* adaptive updates are only used with tight encoding and 3973 * if lossy updates are enabled so we can disable all the 3974 * calculations otherwise */ 3975 if (!vd->lossy) { 3976 vd->non_adaptive = true; 3977 } 3978 3979 if (acl) { 3980 if (strcmp(vd->id, "default") == 0) { 3981 vd->tlsaclname = g_strdup("vnc.x509dname"); 3982 } else { 3983 vd->tlsaclname = g_strdup_printf("vnc.%s.x509dname", vd->id); 3984 } 3985 qemu_acl_init(vd->tlsaclname); 3986 } 3987 #ifdef CONFIG_VNC_SASL 3988 if (acl && sasl) { 3989 char *aclname; 3990 3991 if (strcmp(vd->id, "default") == 0) { 3992 aclname = g_strdup("vnc.username"); 3993 } else { 3994 aclname = g_strdup_printf("vnc.%s.username", vd->id); 3995 } 3996 vd->sasl.acl = qemu_acl_init(aclname); 3997 g_free(aclname); 3998 } 3999 #endif 4000 4001 if (vnc_display_setup_auth(&vd->auth, &vd->subauth, 4002 vd->tlscreds, password, 4003 sasl, false, errp) < 0) { 4004 goto fail; 4005 } 4006 trace_vnc_auth_init(vd, 0, vd->auth, vd->subauth); 4007 4008 if (vnc_display_setup_auth(&vd->ws_auth, &vd->ws_subauth, 4009 vd->tlscreds, password, 4010 sasl, true, errp) < 0) { 4011 goto fail; 4012 } 4013 trace_vnc_auth_init(vd, 1, vd->ws_auth, vd->ws_subauth); 4014 4015 #ifdef CONFIG_VNC_SASL 4016 if ((saslErr = sasl_server_init(NULL, "qemu")) != SASL_OK) { 4017 error_setg(errp, "Failed to initialize SASL auth: %s", 4018 sasl_errstring(saslErr, NULL, NULL)); 4019 goto fail; 4020 } 4021 #endif 4022 vd->lock_key_sync = lock_key_sync; 4023 if (lock_key_sync) { 4024 vd->led = qemu_add_led_event_handler(kbd_leds, vd); 4025 } 4026 vd->ledstate = 0; 4027 vd->key_delay_ms = key_delay_ms; 4028 4029 device_id = qemu_opt_get(opts, "display"); 4030 if (device_id) { 4031 int head = qemu_opt_get_number(opts, "head", 0); 4032 Error *err = NULL; 4033 4034 con = qemu_console_lookup_by_device_name(device_id, head, &err); 4035 if (err) { 4036 error_propagate(errp, err); 4037 goto fail; 4038 } 4039 } else { 4040 con = NULL; 4041 } 4042 4043 if (con != vd->dcl.con) { 4044 unregister_displaychangelistener(&vd->dcl); 4045 vd->dcl.con = con; 4046 register_displaychangelistener(&vd->dcl); 4047 } 4048 4049 if (saddr == NULL) { 4050 goto cleanup; 4051 } 4052 4053 if (reverse) { 4054 if (vnc_display_connect(vd, saddr, nsaddr, wsaddr, nwsaddr, errp) < 0) { 4055 goto fail; 4056 } 4057 } else { 4058 if (vnc_display_listen(vd, saddr, nsaddr, wsaddr, nwsaddr, errp) < 0) { 4059 goto fail; 4060 } 4061 } 4062 4063 if (qemu_opt_get(opts, "to")) { 4064 vnc_display_print_local_addr(vd); 4065 } 4066 4067 cleanup: 4068 vnc_free_addresses(&saddr, &nsaddr); 4069 vnc_free_addresses(&wsaddr, &nwsaddr); 4070 return; 4071 4072 fail: 4073 vnc_display_close(vd); 4074 goto cleanup; 4075 } 4076 4077 void vnc_display_add_client(const char *id, int csock, bool skipauth) 4078 { 4079 VncDisplay *vd = vnc_display_find(id); 4080 QIOChannelSocket *sioc; 4081 4082 if (!vd) { 4083 return; 4084 } 4085 4086 sioc = qio_channel_socket_new_fd(csock, NULL); 4087 if (sioc) { 4088 qio_channel_set_name(QIO_CHANNEL(sioc), "vnc-server"); 4089 vnc_connect(vd, sioc, skipauth, false); 4090 object_unref(OBJECT(sioc)); 4091 } 4092 } 4093 4094 static void vnc_auto_assign_id(QemuOptsList *olist, QemuOpts *opts) 4095 { 4096 int i = 2; 4097 char *id; 4098 4099 id = g_strdup("default"); 4100 while (qemu_opts_find(olist, id)) { 4101 g_free(id); 4102 id = g_strdup_printf("vnc%d", i++); 4103 } 4104 qemu_opts_set_id(opts, id); 4105 } 4106 4107 QemuOpts *vnc_parse(const char *str, Error **errp) 4108 { 4109 QemuOptsList *olist = qemu_find_opts("vnc"); 4110 QemuOpts *opts = qemu_opts_parse(olist, str, true, errp); 4111 const char *id; 4112 4113 if (!opts) { 4114 return NULL; 4115 } 4116 4117 id = qemu_opts_id(opts); 4118 if (!id) { 4119 /* auto-assign id if not present */ 4120 vnc_auto_assign_id(olist, opts); 4121 } 4122 return opts; 4123 } 4124 4125 int vnc_init_func(void *opaque, QemuOpts *opts, Error **errp) 4126 { 4127 Error *local_err = NULL; 4128 char *id = (char *)qemu_opts_id(opts); 4129 4130 assert(id); 4131 vnc_display_init(id); 4132 vnc_display_open(id, &local_err); 4133 if (local_err != NULL) { 4134 error_reportf_err(local_err, "Failed to start VNC server: "); 4135 exit(1); 4136 } 4137 return 0; 4138 } 4139 4140 static void vnc_register_config(void) 4141 { 4142 qemu_add_opts(&qemu_vnc_opts); 4143 } 4144 opts_init(vnc_register_config); 4145