Hi all,
this patch fixes another bug in vnc_refresh: calling vnc_update_client
might cause vs to be free()ed, in this case we cannot access vs->next
right after to examine the next item on the list.
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
It's emitted when a VNC client session is activated by QEMU,
client's information such as port, IP and auth ID (if the
session is authenticated) are provided.
Event example:
{ "event": "VNC_INITIALIZED",
"timestamp": {"seconds": 1263475302, "microseconds": 150772},
"data": {
"server": { "auth": "sasl", "family": "ipv4",
"service": "5901", "host": "0.0.0.0"},
"client": { "family": "ipv4", "service": "46089",
"host": "127.0.0.1", "sasl_username": "lcapitulino" } } }
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
It's emitted when a VNC client connects to QEMU, client's information
such as port and IP address are provided.
Note that this event is emitted right when the connection is
established. This means that it happens before authentication
procedure and session initialization.
Event example:
{ "event": "VNC_CONNECTED",
"timestamp": { "seconds": 1262976601, "microseconds": 975795 },
"data": {
"server": { "auth": "sasl", "family": "ipv4",
"service": "5901", "host": "0.0.0.0" },
"client": { "family": "ipv4", "service": "58425",
"host": "127.0.0.1" } } }
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
When a disconnection happens the client's socket on QEMU
side may become invalid, this way it won't be possible
to query it to get client information, which is going to
be needed by the future QMP VNC_DISCONNECTED event.
To always have this information available we query the
socket at connection time and cache the client info in
struct VncState.
Two function are introduced to perform this job.
vnc_client_cache_addr() is called right when the connection
is made, however the authentication information is not
available at that moment so vnc_client_cache_auth() is
called from protocol_client_init() to get auth info.
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
It contains the socket adress family name, like "ipv4" or
"ipv6".
This is useful for clients so that they can interpret the
'host' key reliably.
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
It's the SASL username, so it's better to call it 'sasl_username'
to be consistent.
Note that this change wouldn't be allowed if QMP were stable.
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
There is no reason to have it as optional and the code
in the server and client gets slightly simpler if the
key is mandatory.
While there also do some cleanup on how the server info is
collected.
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Currently the 'status' key is a string whose value can be
"disabled" or "enabled", change it to the QMP's standard
'enabled' key, which is a bool.
Note that 'status' in being dropped and this wouldn't be
allowed if QMP were stable.
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Hi all,
calling vnc_update_client in vnc_refresh might have the unlikely side
effect of setting vd->timer = NULL, if the last vnc client disconnected.
In this case we have to return from vnc_refresh without updating the
timer, otherwise we cause a segfault.
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Return a QDict with server information. Connected clients are returned
as a QList of QDicts.
The new functions (vnc_qdict_remote_addr(), vnc_qdict_local_addr() and
put_addr_qdict()) are used to insert 'host' and 'service' information
in the returned QDict.
This patch is big, but I don't see how to split it.
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
The capslock tracking logic added by commit
6b1325029d doesn't work correctly for vnc
clients without EXT_KEY_EVENT support. The reason is that qemu converts
keysyms for letters to lowercase for the keysym2scancode lookup. It
then also passes the lowercase value down to do_key_event(), but the
capslock tracking code needs it with the correct case to work properly.
This patch adds a new variable for the lowercase keysym so we'll keep
the unmodified value for do_key_event().
The keysym2scancode is not needed with EXT_KEY_EVENT capable clients
like any app based on the gtk-vnc widget, so I missed that case in
testing ...
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
We're leaking file descriptors to child processes. Set FD_CLOEXEC on file
descriptors that don't need to be passed to children to stop this misbehaviour.
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
When capslock is toggled while the vnc window hasn't the focus qemu
will miss the state change. Add sanity checks for the capslock state
and toggle it if needed, so hosts and guests idea of capslock state
stay in sync. Simliar logic for numlock is present in qemu already.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Without this patch, qemu on windows crashes as soon
as a vnc client connects.
Signed-off-by: Stefan Weil <weil@mail.berlios.de>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
After qemu_free, the pointers for input and output
buffers are no longer valid, so set them to NULL
(most other calls of qemu_free in vnc.c use this
pattern, too).
Signed-off-by: Stefan Weil <weil@mail.berlios.de>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
We are using the vs structure when it was just freed. Classic use after free,
fix it.
Signed-off-by: Glauber Costa <glommer@redhat.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
This patch introduces dynamic timer intervals: we slow down the refresh
rate when there in no much activity but we get back to a fast refresh
rate when the activity resume.
Please note that qemu_timer_expired is not an inline function any more
because I needed to call it from vnc.c however I don't think this change
should have any serious consequence.
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Message-Id:
This patch removes the server surface from VncState and adds a single
server surface to VncDisplay for all the possible clients connected.
Each client maintains a different dirty bitmap in VncState.
The guest surface is moved to VncDisplay as well because we don't need
to track guest updates in more than one place.
This patch has been updated to handle CopyRect correctly and efficiently.
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Message-Id:
This patch removes the timer per vnc client connected and adds a single
timer to update all the possible clients.
We call vga_hw_update only once in the timer handler.
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Message-Id:
When sending a copyrect command to the vnc client, we must also update
the local server surface. Otherwise the server's and the client's idea
of the screen content run out of sync and screen updates don't work
correctly.
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Reorganize qemu console emulation code. Make it look at the numlock
state and interpret numpad keys as arrow+friends (numlock off) or
digits (numlock on). While being at it also wind up the other numpad
keys.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Split socket closing and releasing of VncState into two steps. First
close the socket and set the variable to -1 to indicate shutdown in
progress. Do the actual release in a few places where we can be sure it
doesn't cause trouble in form of use-after-free. Add some checks for a
valid socket handle to make sure we don't try to use the closed socket.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Type casts removing the const attribute are bad because
they hide the fact that the argument remains const.
They also result in a compiler warning (at least with MS-C).
Signed-off-by: Stefan Weil <weil@mail.berlios.de>
Work around buffer and ioctlsocket argument type signedness problems
Suppress a prototype which is unused on mingw32
Expand a macro to avoid warnings from some GCC versions
Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Pointer vs addresses a VncDisplay structure,
so it is sufficient to allocate sizeof(VncDisplay)
or sizeof(*vs) bytes instead of the much larger
sizeof(VncState).
Maybe the misleading name should be fixed, too:
the code contains many places where vs is used,
sometimes it is a VncState *, sometimes it is a
VncDisplay *. vd would be a better name.
Signed-off-by: Stefan Weil <weil@mail.berlios.de>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
--disable-gfx-check predates VNC server support. It made sense back then
because the only thing you could do without SDL was use -nographic mode or
similar tricks. Since this is a very advanced mode of operation, gfx-check
provided a good safety net for casual users.
A casual user is very likely to use VNC to interact with a guest. In fact, it's
often frustrating to install QEMU on a server and have to specify
disable-gfx-check when you only want to use VNC.
This patch eliminates disable-gfx-check and makes SDL behave like every other
optional dependency. If SDL is not available, instead of failing ungracefully
if no special options are specified, we default to -vnc localhost:0,to=99.
When we do default to VNC, we also print a message to tell the user that we've
done this include which port we're currently listening on.
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Format must be identical to the guest surface, we can't work with
the 32 bpp used by the default surface allocator.
Without this patch vnc doesn't get the conversions right when sending
pixel data to the client. The bug triggers if
(a) the client doesn't support WMVi, and
(b) the guest screen depth is != 32 bpp.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Move down cmp_bytes initialization. Must be after vga_hw_update()
call, because that one might change the screen depth.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
In vnc.c in pixel_format_message, the code tries to clear the
QEMU_ALLOCATED_FLAG from the client display surface, however
it uses the wrong operator and ends up enabling all other
flags. Most notably this enables the big endian flag and
causes some chaos.
Signed-off-by: Brian Kress <kressb@moose.net>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@7022 c046a42c-6fe2-441c-8c8c-71466251a162
This patch makes the vnc server code skip screen refreshes in case
there is data in the output buffer. This reduces the refresh rate to
throttle the bandwidth needed in case the network link is saturated.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6862 c046a42c-6fe2-441c-8c8c-71466251a162
This patch killes the old_data hack in the qemu server and replaces
it with a clean separation of the guest-visible display surface and
the vnc server display surface. Both guest and server surface have
their own dirty bitmap for tracking screen updates.
Workflow is this:
(1) The guest writes to the guest surface. With shared buffers being
active the guest writes are directly visible to the vnc server code.
Note that this may happen in parallel to the vnc server code running
(today only in xenfb, once we have vcpu threads in qemu also for
other display adapters).
(2) vnc_update() callback tags the specified area in the guest dirty
map.
(3) vnc_update_client() will first walk through the guest dirty map. It
will compare guest and server surface for all regions tagged dirty
and in case the screen content really did change the server surface
and dirty map are updated.
Note: old code used old_data in a simliar way, so this does *not*
introduce an extra memcpy.
(4) Then vnc_update_cient() will send the updates to the vnc client
using the server surface and dirty map.
Note: old code used the guest-visible surface instead, causing
screen corruption in case of guest screen updates running in
parallel.
The separate dirty bitmap also has the nice effect that forced screen
updates can be done cleanly by simply tagging the area in both guest and
server dirty map. The old, hackish way was memset(old_data, 42, size)
to trick the code checking for screen changes.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6860 c046a42c-6fe2-441c-8c8c-71466251a162
As previously discussed, this patch removes the non-portable use of
asprintf(), replacing it with malloc+snprintf instead
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6843 c046a42c-6fe2-441c-8c8c-71466251a162
This patch introduces a generic internal API for access control lists
to be used by network servers in QEMU. It adds support for checking
these ACL in the VNC server, in two places. The first ACL is for the
SASL authentication mechanism, checking the SASL username. This ACL
is called 'vnc.username'. The second is for the TLS authentication
mechanism, when x509 client certificates are turned on, checking against
the Distinguished Name of the client. This ACL is called 'vnc.x509dname'
The internal API provides for an ACL with the following characteristics
- A unique name, eg vnc.username, and vnc.x509dname.
- A default policy, allow or deny
- An ordered series of match rules, with allow or deny policy
If none of the match rules apply, then the default policy is
used.
There is a monitor API to manipulate the ACLs, which I'll describe via
examples
(qemu) acl show vnc.username
policy: allow
(qemu) acl policy vnc.username denya
acl: policy set to 'deny'
(qemu) acl allow vnc.username fred
acl: added rule at position 1
(qemu) acl allow vnc.username bob
acl: added rule at position 2
(qemu) acl allow vnc.username joe 1
acl: added rule at position 1
(qemu) acl show vnc.username
policy: deny
0: allow fred
1: allow joe
2: allow bob
(qemu) acl show vnc.x509dname
policy: allow
(qemu) acl policy vnc.x509dname deny
acl: policy set to 'deny'
(qemu) acl allow vnc.x509dname C=GB,O=ACME,L=London,CN=*
acl: added rule at position 1
(qemu) acl allow vnc.x509dname C=GB,O=ACME,L=Boston,CN=bob
acl: added rule at position 2
(qemu) acl show vnc.x509dname
policy: deny
0: allow C=GB,O=ACME,L=London,CN=*
1: allow C=GB,O=ACME,L=Boston,CN=bob
By default the VNC server will not use any ACLs, allowing access to
the server if the user successfully authenticates. To enable use of
ACLs to restrict user access, the ',acl' flag should be given when
starting QEMU. The initial ACL activated will be a 'deny all' policy
and should be customized using monitor commands.
eg enable SASL auth and ACLs
qemu .... -vnc localhost:1,sasl,acl
The next patch will provide a way to load a pre-defined ACL when
starting up
Makefile | 6 +
b/acl.c | 185 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
b/acl.h | 74 ++++++++++++++++++++++
configure | 18 +++++
monitor.c | 95 ++++++++++++++++++++++++++++
qemu-doc.texi | 49 ++++++++++++++
vnc-auth-sasl.c | 16 +++-
vnc-auth-sasl.h | 7 ++
vnc-tls.c | 19 +++++
vnc-tls.h | 3
vnc.c | 21 ++++++
vnc.h | 3
12 files changed, 491 insertions(+), 5 deletions(-)
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6726 c046a42c-6fe2-441c-8c8c-71466251a162
This patch extends the 'info vnc' monitor output to include information
about the VNC client authentication credentials.
For clients authenticated using SASL, this will output the username.
For clients authenticated using x509 certificates, this will output
the x509 distinguished name.
Auth can be stacked, so both username & x509 dname may be shown.
Server:
address: 0.0.0.0:5902
auth: vencrypt+x509+sasl
Client:
address: 10.33.6.67:38621
x509 dname: C=GB,O=ACME,L=London,ST=London,CN=localhost
username: admin
Client:
address: 10.33.6.63:38620
x509 dname: C=GB,O=ACME,L=London,ST=London,CN=localhost
username: admin
vnc-tls.c | 17 +++++++++++++++++
vnc-tls.h | 3 +++
vnc.c | 19 +++++++++++++++++--
3 files changed, 37 insertions(+), 2 deletions(-)
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6725 c046a42c-6fe2-441c-8c8c-71466251a162
This patch adds the new SASL authentication protocol to the VNC server.
It is enabled by setting the 'sasl' flag when launching VNC. SASL can
optionally provide encryption via its SSF layer, if a suitable mechanism
is configured (eg, GSSAPI/Kerberos, or Digest-MD5). If an SSF layer is
not available, then it should be combined with the x509 VNC authentication
protocol which provides encryption.
eg, if using GSSAPI
qemu -vnc localhost:1,sasl
eg if using TLS/x509 for encryption
qemu -vnc localhost:1,sasl,tls,x509
By default the Cyrus SASL library will look for its configuration in
the file /etc/sasl2/qemu.conf. For non-root users, this can be overridden
by setting the SASL_CONF_PATH environment variable, eg to make it look in
$HOME/.sasl2. NB unprivileged users may not have access to the full range
of SASL mechanisms, since some of them require some administrative privileges
to configure. The patch includes an example SASL configuration file which
illustrates config for GSSAPI and Digest-MD5, though it should be noted that
the latter is not really considered secure any more.
Most of the SASL authentication code is located in a separate source file,
vnc-auth-sasl.c. The main vnc.c file only contains minimal integration
glue, specifically parsing of command line flags / setup, and calls to
start the SASL auth process, to do encoding/decoding for data.
There are several possible stacks for reading & writing of data, depending
on the combo of VNC authentication methods in use
- Clear. read/write straight to socket
- TLS. read/write via GNUTLS helpers
- SASL. encode/decode via SASL SSF layer, then read/write to socket
- SASL+TLS. encode/decode via SASL SSF layer, then read/write via GNUTLS
Hence, the vnc_client_read & vnc_client_write methods have been refactored
a little.
vnc_client_read: main entry point for reading, calls either
- vnc_client_read_plain reading, with no intermediate decoding
- vnc_client_read_sasl reading, with SASL SSF decoding
These two methods, then call vnc_client_read_buf(). This decides
whether to write to the socket directly or write via GNUTLS.
The situation is the same for writing data. More extensive comments
have been added in the code / patch. The vnc_client_read_sasl and
vnc_client_write_sasl method implementations live in the separate
vnc-auth-sasl.c file.
The state required for the SASL auth mechanism is kept in a separate
VncStateSASL struct, defined in vnc-auth-sasl.h and included in the
main VncState.
The configure script probes for SASL and automatically enables it
if found, unless --disable-vnc-sasl was given to override it.
Makefile | 7
Makefile.target | 5
b/qemu.sasl | 34 ++
b/vnc-auth-sasl.c | 626 ++++++++++++++++++++++++++++++++++++++++++++++++++++
b/vnc-auth-sasl.h | 67 +++++
configure | 34 ++
qemu-doc.texi | 97 ++++++++
vnc-auth-vencrypt.c | 12
vnc.c | 249 ++++++++++++++++++--
vnc.h | 31 ++
10 files changed, 1129 insertions(+), 33 deletions(-)
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6724 c046a42c-6fe2-441c-8c8c-71466251a162
This patch refactors the existing TLS code to make the main VNC code
more managable. The code moves to two new files
- vnc-tls.c: generic helpers for TLS handshake & credential setup
- vnc-auth-vencrypt.c: the actual VNC TLS authentication mechanism.
The reason for this split is that there are other TLS based auth
mechanisms which we may like to use in the future. These can all
share the same vnc-tls.c routines. In addition this will facilitate
anyone who may want to port the vnc-tls.c file to allow for choice
of GNUTLS & NSS for impl.
The TLS state is moved out of the VncState struct, and into a separate
VncStateTLS struct, defined in vnc-tls.h. This is then referenced from
the main VncState. End size of the struct is the same, but it keeps
things a little more managable.
The vnc.h file gains a bunch more function prototypes, for functions
in vnc.c that were previously static, but now need to be accessed
from the separate auth code files.
The only TLS related code still in the main vl.c is the command line
argument handling / setup, and the low level I/O routines calling
gnutls_send/recv.
Makefile | 11
b/vnc-auth-vencrypt.c | 167 ++++++++++++++
b/vnc-auth-vencrypt.h | 33 ++
b/vnc-tls.c | 414 +++++++++++++++++++++++++++++++++++
b/vnc-tls.h | 70 ++++++
vnc.c | 581 +++-----------------------------------------------
vnc.h | 76 ++++--
7 files changed, 780 insertions(+), 572 deletions(-)
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6723 c046a42c-6fe2-441c-8c8c-71466251a162
This patch moves the definitions of VncState and VncDisplay structs
out into a vnc.h header file. This is to allow the code for TLS
and SASL auth mechanisms to be moved out of the main vnc.c file.
vnc.c | 109 ------------------------------------------------
vnc.h | 149 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++--
2 files changed, 148 insertions(+), 110 deletions(-)
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6722 c046a42c-6fe2-441c-8c8c-71466251a162
