xref: /freebsd/usr.sbin/bhyve/rfb.c (revision 1171c633fb097a19e1da87128604190bc6d27341)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3  *
4  * Copyright (c) 2015 Tycho Nightingale <tycho.nightingale@pluribusnetworks.com>
5  * Copyright (c) 2015 Leon Dang
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  */
29 
30 #include <sys/cdefs.h>
31 __FBSDID("$FreeBSD$");
32 
33 #include <sys/param.h>
34 #ifndef WITHOUT_CAPSICUM
35 #include <sys/capsicum.h>
36 #endif
37 #include <sys/endian.h>
38 #include <sys/socket.h>
39 #include <sys/select.h>
40 #include <sys/time.h>
41 #include <arpa/inet.h>
42 #include <machine/cpufunc.h>
43 #include <machine/specialreg.h>
44 #include <netinet/in.h>
45 #include <netdb.h>
46 
47 #include <assert.h>
48 #ifndef WITHOUT_CAPSICUM
49 #include <capsicum_helpers.h>
50 #endif
51 #include <err.h>
52 #include <errno.h>
53 #include <pthread.h>
54 #include <pthread_np.h>
55 #include <signal.h>
56 #include <stdbool.h>
57 #include <stdlib.h>
58 #include <stdio.h>
59 #include <string.h>
60 #include <sysexits.h>
61 #include <unistd.h>
62 
63 #include <zlib.h>
64 
65 #include "bhyvegc.h"
66 #include "debug.h"
67 #include "console.h"
68 #include "rfb.h"
69 #include "sockstream.h"
70 
71 #ifndef NO_OPENSSL
72 #include <openssl/des.h>
73 #endif
74 
75 static int rfb_debug = 0;
76 #define	DPRINTF(params) if (rfb_debug) PRINTLN params
77 #define	WPRINTF(params) PRINTLN params
78 
79 #define AUTH_LENGTH	16
80 #define PASSWD_LENGTH	8
81 
82 #define SECURITY_TYPE_NONE	1
83 #define SECURITY_TYPE_VNC_AUTH	2
84 
85 #define AUTH_FAILED_UNAUTH	1
86 #define AUTH_FAILED_ERROR	2
87 
88 struct rfb_softc {
89 	int		sfd;
90 	pthread_t	tid;
91 
92 	int		cfd;
93 
94 	int		width, height;
95 
96 	char		*password;
97 
98 	bool	enc_raw_ok;
99 	bool	enc_zlib_ok;
100 	bool	enc_resize_ok;
101 
102 	z_stream	zstream;
103 	uint8_t		*zbuf;
104 	int		zbuflen;
105 
106 	int		conn_wait;
107 	int		sending;
108 	pthread_mutex_t mtx;
109 	pthread_cond_t  cond;
110 
111 	int		hw_crc;
112 	uint32_t	*crc;		/* WxH crc cells */
113 	uint32_t	*crc_tmp;	/* buffer to store single crc row */
114 	int		crc_width, crc_height;
115 };
116 
117 struct rfb_pixfmt {
118 	uint8_t		bpp;
119 	uint8_t		depth;
120 	uint8_t		bigendian;
121 	uint8_t		truecolor;
122 	uint16_t	red_max;
123 	uint16_t	green_max;
124 	uint16_t	blue_max;
125 	uint8_t		red_shift;
126 	uint8_t		green_shift;
127 	uint8_t		blue_shift;
128 	uint8_t		pad[3];
129 };
130 
131 struct rfb_srvr_info {
132 	uint16_t		width;
133 	uint16_t		height;
134 	struct rfb_pixfmt	pixfmt;
135 	uint32_t		namelen;
136 };
137 
138 struct rfb_pixfmt_msg {
139 	uint8_t			type;
140 	uint8_t			pad[3];
141 	struct rfb_pixfmt	pixfmt;
142 };
143 
144 #define	RFB_ENCODING_RAW		0
145 #define	RFB_ENCODING_ZLIB		6
146 #define	RFB_ENCODING_RESIZE		-223
147 
148 #define	RFB_MAX_WIDTH			2000
149 #define	RFB_MAX_HEIGHT			1200
150 #define	RFB_ZLIB_BUFSZ			RFB_MAX_WIDTH*RFB_MAX_HEIGHT*4
151 
152 /* percentage changes to screen before sending the entire screen */
153 #define	RFB_SEND_ALL_THRESH		25
154 
155 struct rfb_enc_msg {
156 	uint8_t		type;
157 	uint8_t		pad;
158 	uint16_t	numencs;
159 };
160 
161 struct rfb_updt_msg {
162 	uint8_t		type;
163 	uint8_t		incremental;
164 	uint16_t	x;
165 	uint16_t	y;
166 	uint16_t	width;
167 	uint16_t	height;
168 };
169 
170 struct rfb_key_msg {
171 	uint8_t		type;
172 	uint8_t		down;
173 	uint16_t	pad;
174 	uint32_t	code;
175 };
176 
177 struct rfb_ptr_msg {
178 	uint8_t		type;
179 	uint8_t		button;
180 	uint16_t	x;
181 	uint16_t	y;
182 };
183 
184 struct rfb_srvr_updt_msg {
185 	uint8_t		type;
186 	uint8_t		pad;
187 	uint16_t	numrects;
188 };
189 
190 struct rfb_srvr_rect_hdr {
191 	uint16_t	x;
192 	uint16_t	y;
193 	uint16_t	width;
194 	uint16_t	height;
195 	uint32_t	encoding;
196 };
197 
198 struct rfb_cuttext_msg {
199 	uint8_t		type;
200 	uint8_t		padding[3];
201 	uint32_t	length;
202 };
203 
204 
205 static void
206 rfb_send_server_init_msg(int cfd)
207 {
208 	struct bhyvegc_image *gc_image;
209 	struct rfb_srvr_info sinfo;
210 
211 	gc_image = console_get_image();
212 
213 	sinfo.width = htons(gc_image->width);
214 	sinfo.height = htons(gc_image->height);
215 	sinfo.pixfmt.bpp = 32;
216 	sinfo.pixfmt.depth = 32;
217 	sinfo.pixfmt.bigendian = 0;
218 	sinfo.pixfmt.truecolor = 1;
219 	sinfo.pixfmt.red_max = htons(255);
220 	sinfo.pixfmt.green_max = htons(255);
221 	sinfo.pixfmt.blue_max = htons(255);
222 	sinfo.pixfmt.red_shift = 16;
223 	sinfo.pixfmt.green_shift = 8;
224 	sinfo.pixfmt.blue_shift = 0;
225 	sinfo.namelen = htonl(strlen("bhyve"));
226 	(void)stream_write(cfd, &sinfo, sizeof(sinfo));
227 	(void)stream_write(cfd, "bhyve", strlen("bhyve"));
228 }
229 
230 static void
231 rfb_send_resize_update_msg(struct rfb_softc *rc, int cfd)
232 {
233 	struct rfb_srvr_updt_msg supdt_msg;
234 	struct rfb_srvr_rect_hdr srect_hdr;
235 
236 	/* Number of rectangles: 1 */
237 	supdt_msg.type = 0;
238 	supdt_msg.pad = 0;
239 	supdt_msg.numrects = htons(1);
240 	stream_write(cfd, &supdt_msg, sizeof(struct rfb_srvr_updt_msg));
241 
242 	/* Rectangle header */
243 	srect_hdr.x = htons(0);
244 	srect_hdr.y = htons(0);
245 	srect_hdr.width = htons(rc->width);
246 	srect_hdr.height = htons(rc->height);
247 	srect_hdr.encoding = htonl(RFB_ENCODING_RESIZE);
248 	stream_write(cfd, &srect_hdr, sizeof(struct rfb_srvr_rect_hdr));
249 }
250 
251 static void
252 rfb_recv_set_pixfmt_msg(struct rfb_softc *rc, int cfd)
253 {
254 	struct rfb_pixfmt_msg pixfmt_msg;
255 
256 	(void)stream_read(cfd, ((void *)&pixfmt_msg)+1, sizeof(pixfmt_msg)-1);
257 }
258 
259 
260 static void
261 rfb_recv_set_encodings_msg(struct rfb_softc *rc, int cfd)
262 {
263 	struct rfb_enc_msg enc_msg;
264 	int i;
265 	uint32_t encoding;
266 
267 	assert((sizeof(enc_msg) - 1) == 3);
268 	(void)stream_read(cfd, ((void *)&enc_msg)+1, sizeof(enc_msg)-1);
269 
270 	for (i = 0; i < htons(enc_msg.numencs); i++) {
271 		(void)stream_read(cfd, &encoding, sizeof(encoding));
272 		switch (htonl(encoding)) {
273 		case RFB_ENCODING_RAW:
274 			rc->enc_raw_ok = true;
275 			break;
276 		case RFB_ENCODING_ZLIB:
277 			if (!rc->enc_zlib_ok) {
278 				deflateInit(&rc->zstream, Z_BEST_SPEED);
279 				rc->enc_zlib_ok = true;
280 			}
281 			break;
282 		case RFB_ENCODING_RESIZE:
283 			rc->enc_resize_ok = true;
284 			break;
285 		}
286 	}
287 }
288 
289 /*
290  * Calculate CRC32 using SSE4.2; Intel or AMD Bulldozer+ CPUs only
291  */
292 static __inline uint32_t
293 fast_crc32(void *buf, int len, uint32_t crcval)
294 {
295 	uint32_t q = len / sizeof(uint32_t);
296 	uint32_t *p = (uint32_t *)buf;
297 
298 	while (q--) {
299 		asm volatile (
300 			".byte 0xf2, 0xf, 0x38, 0xf1, 0xf1;"
301 			:"=S" (crcval)
302 			:"0" (crcval), "c" (*p)
303 		);
304 		p++;
305 	}
306 
307 	return (crcval);
308 }
309 
310 
311 static int
312 rfb_send_rect(struct rfb_softc *rc, int cfd, struct bhyvegc_image *gc,
313               int x, int y, int w, int h)
314 {
315 	struct rfb_srvr_updt_msg supdt_msg;
316 	struct rfb_srvr_rect_hdr srect_hdr;
317 	unsigned long zlen;
318 	ssize_t nwrite, total;
319 	int err;
320 	uint32_t *p;
321 	uint8_t *zbufp;
322 
323 	/*
324 	 * Send a single rectangle of the given x, y, w h dimensions.
325 	 */
326 
327 	/* Number of rectangles: 1 */
328 	supdt_msg.type = 0;
329 	supdt_msg.pad = 0;
330 	supdt_msg.numrects = htons(1);
331 	nwrite = stream_write(cfd, &supdt_msg,
332 	                      sizeof(struct rfb_srvr_updt_msg));
333 	if (nwrite <= 0)
334 		return (nwrite);
335 
336 
337 	/* Rectangle header */
338 	srect_hdr.x = htons(x);
339 	srect_hdr.y = htons(y);
340 	srect_hdr.width = htons(w);
341 	srect_hdr.height = htons(h);
342 
343 	h = y + h;
344 	w *= sizeof(uint32_t);
345 	if (rc->enc_zlib_ok) {
346 		zbufp = rc->zbuf;
347 		rc->zstream.total_in = 0;
348 		rc->zstream.total_out = 0;
349 		for (p = &gc->data[y * gc->width + x]; y < h; y++) {
350 			rc->zstream.next_in = (Bytef *)p;
351 			rc->zstream.avail_in = w;
352 			rc->zstream.next_out = (Bytef *)zbufp;
353 			rc->zstream.avail_out = RFB_ZLIB_BUFSZ + 16 -
354 			                        rc->zstream.total_out;
355 			rc->zstream.data_type = Z_BINARY;
356 
357 			/* Compress with zlib */
358 			err = deflate(&rc->zstream, Z_SYNC_FLUSH);
359 			if (err != Z_OK) {
360 				WPRINTF(("zlib[rect] deflate err: %d", err));
361 				rc->enc_zlib_ok = false;
362 				deflateEnd(&rc->zstream);
363 				goto doraw;
364 			}
365 			zbufp = rc->zbuf + rc->zstream.total_out;
366 			p += gc->width;
367 		}
368 		srect_hdr.encoding = htonl(RFB_ENCODING_ZLIB);
369 		nwrite = stream_write(cfd, &srect_hdr,
370 		                      sizeof(struct rfb_srvr_rect_hdr));
371 		if (nwrite <= 0)
372 			return (nwrite);
373 
374 		zlen = htonl(rc->zstream.total_out);
375 		nwrite = stream_write(cfd, &zlen, sizeof(uint32_t));
376 		if (nwrite <= 0)
377 			return (nwrite);
378 		return (stream_write(cfd, rc->zbuf, rc->zstream.total_out));
379 	}
380 
381 doraw:
382 
383 	total = 0;
384 	zbufp = rc->zbuf;
385 	for (p = &gc->data[y * gc->width + x]; y < h; y++) {
386 		memcpy(zbufp, p, w);
387 		zbufp += w;
388 		total += w;
389 		p += gc->width;
390 	}
391 
392 	srect_hdr.encoding = htonl(RFB_ENCODING_RAW);
393 	nwrite = stream_write(cfd, &srect_hdr,
394 	                      sizeof(struct rfb_srvr_rect_hdr));
395 	if (nwrite <= 0)
396 		return (nwrite);
397 
398 	total = stream_write(cfd, rc->zbuf, total);
399 
400 	return (total);
401 }
402 
403 static int
404 rfb_send_all(struct rfb_softc *rc, int cfd, struct bhyvegc_image *gc)
405 {
406 	struct rfb_srvr_updt_msg supdt_msg;
407         struct rfb_srvr_rect_hdr srect_hdr;
408 	ssize_t nwrite;
409 	unsigned long zlen;
410 	int err;
411 
412 	/*
413 	 * Send the whole thing
414 	 */
415 
416 	/* Number of rectangles: 1 */
417 	supdt_msg.type = 0;
418 	supdt_msg.pad = 0;
419 	supdt_msg.numrects = htons(1);
420 	nwrite = stream_write(cfd, &supdt_msg,
421 	                      sizeof(struct rfb_srvr_updt_msg));
422 	if (nwrite <= 0)
423 		return (nwrite);
424 
425 	/* Rectangle header */
426 	srect_hdr.x = 0;
427 	srect_hdr.y = 0;
428 	srect_hdr.width = htons(gc->width);
429 	srect_hdr.height = htons(gc->height);
430 	if (rc->enc_zlib_ok) {
431 		rc->zstream.next_in = (Bytef *)gc->data;
432 		rc->zstream.avail_in = gc->width * gc->height *
433 		                   sizeof(uint32_t);
434 		rc->zstream.next_out = (Bytef *)rc->zbuf;
435 		rc->zstream.avail_out = RFB_ZLIB_BUFSZ + 16;
436 		rc->zstream.data_type = Z_BINARY;
437 
438 		rc->zstream.total_in = 0;
439 		rc->zstream.total_out = 0;
440 
441 		/* Compress with zlib */
442 		err = deflate(&rc->zstream, Z_SYNC_FLUSH);
443 		if (err != Z_OK) {
444 			WPRINTF(("zlib deflate err: %d", err));
445 			rc->enc_zlib_ok = false;
446 			deflateEnd(&rc->zstream);
447 			goto doraw;
448 		}
449 
450 		srect_hdr.encoding = htonl(RFB_ENCODING_ZLIB);
451 		nwrite = stream_write(cfd, &srect_hdr,
452 		                      sizeof(struct rfb_srvr_rect_hdr));
453 		if (nwrite <= 0)
454 			return (nwrite);
455 
456 		zlen = htonl(rc->zstream.total_out);
457 		nwrite = stream_write(cfd, &zlen, sizeof(uint32_t));
458 		if (nwrite <= 0)
459 			return (nwrite);
460 		return (stream_write(cfd, rc->zbuf, rc->zstream.total_out));
461 	}
462 
463 doraw:
464 	srect_hdr.encoding = htonl(RFB_ENCODING_RAW);
465 	nwrite = stream_write(cfd, &srect_hdr,
466 	                      sizeof(struct rfb_srvr_rect_hdr));
467 	if (nwrite <= 0)
468 		return (nwrite);
469 
470 	nwrite = stream_write(cfd, gc->data,
471 	               gc->width * gc->height * sizeof(uint32_t));
472 
473 	return (nwrite);
474 }
475 
476 #define	PIX_PER_CELL	32
477 #define	PIXCELL_SHIFT	5
478 #define	PIXCELL_MASK	0x1F
479 
480 static int
481 rfb_send_screen(struct rfb_softc *rc, int cfd, int all)
482 {
483 	struct bhyvegc_image *gc_image;
484 	ssize_t nwrite;
485 	int x, y;
486 	int celly, cellwidth;
487 	int xcells, ycells;
488 	int w, h;
489 	uint32_t *p;
490 	int rem_x, rem_y;   /* remainder for resolutions not x32 pixels ratio */
491 	int retval;
492 	uint32_t *crc_p, *orig_crc;
493 	int changes;
494 
495 	console_refresh();
496 	gc_image = console_get_image();
497 
498 	pthread_mutex_lock(&rc->mtx);
499 	if (rc->sending) {
500 		pthread_mutex_unlock(&rc->mtx);
501 		return (1);
502 	}
503 	rc->sending = 1;
504 	pthread_mutex_unlock(&rc->mtx);
505 
506 	retval = 0;
507 
508 	if (all) {
509 		retval = rfb_send_all(rc, cfd, gc_image);
510 		goto done;
511 	}
512 
513 	/*
514 	 * Calculate the checksum for each 32x32 cell. Send each that
515 	 * has changed since the last scan.
516 	 */
517 
518 	/* Resolution changed */
519 
520 	rc->crc_width = gc_image->width;
521 	rc->crc_height = gc_image->height;
522 
523 	w = rc->crc_width;
524 	h = rc->crc_height;
525 	xcells = howmany(rc->crc_width, PIX_PER_CELL);
526 	ycells = howmany(rc->crc_height, PIX_PER_CELL);
527 
528 	rem_x = w & PIXCELL_MASK;
529 
530 	rem_y = h & PIXCELL_MASK;
531 	if (!rem_y)
532 		rem_y = PIX_PER_CELL;
533 
534 	p = gc_image->data;
535 
536 	/*
537 	 * Go through all cells and calculate crc. If significant number
538 	 * of changes, then send entire screen.
539 	 * crc_tmp is dual purpose: to store the new crc and to flag as
540 	 * a cell that has changed.
541 	 */
542 	crc_p = rc->crc_tmp - xcells;
543 	orig_crc = rc->crc - xcells;
544 	changes = 0;
545 	memset(rc->crc_tmp, 0, sizeof(uint32_t) * xcells * ycells);
546 	for (y = 0; y < h; y++) {
547 		if ((y & PIXCELL_MASK) == 0) {
548 			crc_p += xcells;
549 			orig_crc += xcells;
550 		}
551 
552 		for (x = 0; x < xcells; x++) {
553 			if (x == (xcells - 1) && rem_x > 0)
554 				cellwidth = rem_x;
555 			else
556 				cellwidth = PIX_PER_CELL;
557 
558 			if (rc->hw_crc)
559 				crc_p[x] = fast_crc32(p,
560 				             cellwidth * sizeof(uint32_t),
561 				             crc_p[x]);
562 			else
563 				crc_p[x] = (uint32_t)crc32(crc_p[x],
564 				             (Bytef *)p,
565 				             cellwidth * sizeof(uint32_t));
566 
567 			p += cellwidth;
568 
569 			/* check for crc delta if last row in cell */
570 			if ((y & PIXCELL_MASK) == PIXCELL_MASK || y == (h-1)) {
571 				if (orig_crc[x] != crc_p[x]) {
572 					orig_crc[x] = crc_p[x];
573 					crc_p[x] = 1;
574 					changes++;
575 				} else {
576 					crc_p[x] = 0;
577 				}
578 			}
579 		}
580 	}
581 
582 	/* If number of changes is > THRESH percent, send the whole screen */
583 	if (((changes * 100) / (xcells * ycells)) >= RFB_SEND_ALL_THRESH) {
584 		retval = rfb_send_all(rc, cfd, gc_image);
585 		goto done;
586 	}
587 
588 	/* Go through all cells, and send only changed ones */
589 	crc_p = rc->crc_tmp;
590 	for (y = 0; y < h; y += PIX_PER_CELL) {
591 		/* previous cell's row */
592 		celly = (y >> PIXCELL_SHIFT);
593 
594 		/* Delta check crc to previous set */
595 		for (x = 0; x < xcells; x++) {
596 			if (*crc_p++ == 0)
597 				continue;
598 
599 			if (x == (xcells - 1) && rem_x > 0)
600 				cellwidth = rem_x;
601 			else
602 				cellwidth = PIX_PER_CELL;
603 			nwrite = rfb_send_rect(rc, cfd,
604 				gc_image,
605 				x * PIX_PER_CELL,
606 				celly * PIX_PER_CELL,
607 			        cellwidth,
608 				y + PIX_PER_CELL >= h ? rem_y : PIX_PER_CELL);
609 			if (nwrite <= 0) {
610 				retval = nwrite;
611 				goto done;
612 			}
613 		}
614 	}
615 	retval = 1;
616 
617 done:
618 	pthread_mutex_lock(&rc->mtx);
619 	rc->sending = 0;
620 	pthread_mutex_unlock(&rc->mtx);
621 
622 	return (retval);
623 }
624 
625 
626 static void
627 rfb_recv_update_msg(struct rfb_softc *rc, int cfd, int discardonly)
628 {
629 	struct rfb_updt_msg updt_msg;
630 	struct bhyvegc_image *gc_image;
631 
632 	(void)stream_read(cfd, ((void *)&updt_msg) + 1 , sizeof(updt_msg) - 1);
633 
634 	console_refresh();
635 	gc_image = console_get_image();
636 
637 	updt_msg.x = htons(updt_msg.x);
638 	updt_msg.y = htons(updt_msg.y);
639 	updt_msg.width = htons(updt_msg.width);
640 	updt_msg.height = htons(updt_msg.height);
641 
642 	if (updt_msg.width != gc_image->width ||
643 	    updt_msg.height != gc_image->height) {
644 		rc->width = gc_image->width;
645 		rc->height = gc_image->height;
646 		if (rc->enc_resize_ok)
647 			rfb_send_resize_update_msg(rc, cfd);
648 	}
649 
650 	if (discardonly)
651 		return;
652 
653 	rfb_send_screen(rc, cfd, 1);
654 }
655 
656 static void
657 rfb_recv_key_msg(struct rfb_softc *rc, int cfd)
658 {
659 	struct rfb_key_msg key_msg;
660 
661 	(void)stream_read(cfd, ((void *)&key_msg) + 1, sizeof(key_msg) - 1);
662 
663 	console_key_event(key_msg.down, htonl(key_msg.code));
664 }
665 
666 static void
667 rfb_recv_ptr_msg(struct rfb_softc *rc, int cfd)
668 {
669 	struct rfb_ptr_msg ptr_msg;
670 
671 	(void)stream_read(cfd, ((void *)&ptr_msg) + 1, sizeof(ptr_msg) - 1);
672 
673 	console_ptr_event(ptr_msg.button, htons(ptr_msg.x), htons(ptr_msg.y));
674 }
675 
676 static void
677 rfb_recv_cuttext_msg(struct rfb_softc *rc, int cfd)
678 {
679 	struct rfb_cuttext_msg ct_msg;
680 	unsigned char buf[32];
681 	int len;
682 
683 	len = stream_read(cfd, ((void *)&ct_msg) + 1, sizeof(ct_msg) - 1);
684 	ct_msg.length = htonl(ct_msg.length);
685 	while (ct_msg.length > 0) {
686 		len = stream_read(cfd, buf, ct_msg.length > sizeof(buf) ?
687 			sizeof(buf) : ct_msg.length);
688 		ct_msg.length -= len;
689 	}
690 }
691 
692 static int64_t
693 timeval_delta(struct timeval *prev, struct timeval *now)
694 {
695 	int64_t n1, n2;
696 	n1 = now->tv_sec * 1000000 + now->tv_usec;
697 	n2 = prev->tv_sec * 1000000 + prev->tv_usec;
698 	return (n1 - n2);
699 }
700 
701 static void *
702 rfb_wr_thr(void *arg)
703 {
704 	struct rfb_softc *rc;
705 	fd_set rfds;
706 	struct timeval tv;
707 	struct timeval prev_tv;
708 	int64_t tdiff;
709 	int cfd;
710 	int err;
711 
712 	rc = arg;
713 	cfd = rc->cfd;
714 
715 	prev_tv.tv_sec = 0;
716 	prev_tv.tv_usec = 0;
717 	while (rc->cfd >= 0) {
718 		FD_ZERO(&rfds);
719 		FD_SET(cfd, &rfds);
720 		tv.tv_sec = 0;
721 		tv.tv_usec = 10000;
722 
723 		err = select(cfd+1, &rfds, NULL, NULL, &tv);
724 		if (err < 0)
725 			return (NULL);
726 
727 		/* Determine if its time to push screen; ~24hz */
728 		gettimeofday(&tv, NULL);
729 		tdiff = timeval_delta(&prev_tv, &tv);
730 		if (tdiff > 40000) {
731 			prev_tv.tv_sec = tv.tv_sec;
732 			prev_tv.tv_usec = tv.tv_usec;
733 			if (rfb_send_screen(rc, cfd, 0) <= 0) {
734 				return (NULL);
735 			}
736 		} else {
737 			/* sleep */
738 			usleep(40000 - tdiff);
739 		}
740 	}
741 
742 	return (NULL);
743 }
744 
745 void
746 rfb_handle(struct rfb_softc *rc, int cfd)
747 {
748 	const char *vbuf = "RFB 003.008\n";
749 	unsigned char buf[80];
750 	unsigned char *message = NULL;
751 
752 #ifndef NO_OPENSSL
753 	unsigned char challenge[AUTH_LENGTH];
754 	unsigned char keystr[PASSWD_LENGTH];
755 	unsigned char crypt_expected[AUTH_LENGTH];
756 
757 	DES_key_schedule ks;
758 	int i;
759 #endif
760 
761 	pthread_t tid;
762 	uint32_t sres = 0;
763 	int len;
764 	int perror = 1;
765 
766 	rc->cfd = cfd;
767 
768 	/* 1a. Send server version */
769 	stream_write(cfd, vbuf, strlen(vbuf));
770 
771 	/* 1b. Read client version */
772 	len = read(cfd, buf, sizeof(buf));
773 
774 	/* 2a. Send security type */
775 	buf[0] = 1;
776 #ifndef NO_OPENSSL
777 	if (rc->password)
778 		buf[1] = SECURITY_TYPE_VNC_AUTH;
779 	else
780 		buf[1] = SECURITY_TYPE_NONE;
781 #else
782 	buf[1] = SECURITY_TYPE_NONE;
783 #endif
784 
785 	stream_write(cfd, buf, 2);
786 
787 	/* 2b. Read agreed security type */
788 	len = stream_read(cfd, buf, 1);
789 
790 	/* 2c. Do VNC authentication */
791 	switch (buf[0]) {
792 	case SECURITY_TYPE_NONE:
793 		sres = 0;
794 		break;
795 	case SECURITY_TYPE_VNC_AUTH:
796 		/*
797 		 * The client encrypts the challenge with DES, using a password
798 		 * supplied by the user as the key.
799 		 * To form the key, the password is truncated to
800 		 * eight characters, or padded with null bytes on the right.
801 		 * The client then sends the resulting 16-bytes response.
802 		 */
803 #ifndef NO_OPENSSL
804 		strncpy(keystr, rc->password, PASSWD_LENGTH);
805 
806 		/* VNC clients encrypts the challenge with all the bit fields
807 		 * in each byte of the password mirrored.
808 		 * Here we flip each byte of the keystr.
809 		 */
810 		for (i = 0; i < PASSWD_LENGTH; i++) {
811 			keystr[i] = (keystr[i] & 0xF0) >> 4
812 				  | (keystr[i] & 0x0F) << 4;
813 			keystr[i] = (keystr[i] & 0xCC) >> 2
814 				  | (keystr[i] & 0x33) << 2;
815 			keystr[i] = (keystr[i] & 0xAA) >> 1
816 				  | (keystr[i] & 0x55) << 1;
817 		}
818 
819 		/* Initialize a 16-byte random challenge */
820 		arc4random_buf(challenge, sizeof(challenge));
821 		stream_write(cfd, challenge, AUTH_LENGTH);
822 
823 		/* Receive the 16-byte challenge response */
824 		stream_read(cfd, buf, AUTH_LENGTH);
825 
826 		memcpy(crypt_expected, challenge, AUTH_LENGTH);
827 
828 		/* Encrypt the Challenge with DES */
829 		DES_set_key((const_DES_cblock *)keystr, &ks);
830 		DES_ecb_encrypt((const_DES_cblock *)challenge,
831 				(const_DES_cblock *)crypt_expected,
832 				&ks, DES_ENCRYPT);
833 		DES_ecb_encrypt((const_DES_cblock *)(challenge + PASSWD_LENGTH),
834 				(const_DES_cblock *)(crypt_expected +
835 				PASSWD_LENGTH),
836 				&ks, DES_ENCRYPT);
837 
838 		if (memcmp(crypt_expected, buf, AUTH_LENGTH) != 0) {
839 			message = "Auth Failed: Invalid Password.";
840 			sres = htonl(1);
841 		} else
842 			sres = 0;
843 #else
844 		sres = 0;
845 		WPRINTF(("Auth not supported, no OpenSSL in your system"));
846 #endif
847 
848 		break;
849 	}
850 
851 	/* 2d. Write back a status */
852 	stream_write(cfd, &sres, 4);
853 
854 	if (sres) {
855 		be32enc(buf, strlen(message));
856 		stream_write(cfd, buf, 4);
857 		stream_write(cfd, message, strlen(message));
858 		goto done;
859 	}
860 
861 	/* 3a. Read client shared-flag byte */
862 	len = stream_read(cfd, buf, 1);
863 
864 	/* 4a. Write server-init info */
865 	rfb_send_server_init_msg(cfd);
866 
867 	if (!rc->zbuf) {
868 		rc->zbuf = malloc(RFB_ZLIB_BUFSZ + 16);
869 		assert(rc->zbuf != NULL);
870 	}
871 
872 	rfb_send_screen(rc, cfd, 1);
873 
874 	perror = pthread_create(&tid, NULL, rfb_wr_thr, rc);
875 	if (perror == 0)
876 		pthread_set_name_np(tid, "rfbout");
877 
878         /* Now read in client requests. 1st byte identifies type */
879 	for (;;) {
880 		len = read(cfd, buf, 1);
881 		if (len <= 0) {
882 			DPRINTF(("rfb client exiting"));
883 			break;
884 		}
885 
886 		switch (buf[0]) {
887 		case 0:
888 			rfb_recv_set_pixfmt_msg(rc, cfd);
889 			break;
890 		case 2:
891 			rfb_recv_set_encodings_msg(rc, cfd);
892 			break;
893 		case 3:
894 			rfb_recv_update_msg(rc, cfd, 1);
895 			break;
896 		case 4:
897 			rfb_recv_key_msg(rc, cfd);
898 			break;
899 		case 5:
900 			rfb_recv_ptr_msg(rc, cfd);
901 			break;
902 		case 6:
903 			rfb_recv_cuttext_msg(rc, cfd);
904 			break;
905 		default:
906 			WPRINTF(("rfb unknown cli-code %d!", buf[0] & 0xff));
907 			goto done;
908 		}
909 	}
910 done:
911 	rc->cfd = -1;
912 	if (perror == 0)
913 		pthread_join(tid, NULL);
914 	if (rc->enc_zlib_ok)
915 		deflateEnd(&rc->zstream);
916 }
917 
918 static void *
919 rfb_thr(void *arg)
920 {
921 	struct rfb_softc *rc;
922 	sigset_t set;
923 
924 	int cfd;
925 
926 	rc = arg;
927 
928 	sigemptyset(&set);
929 	sigaddset(&set, SIGPIPE);
930 	if (pthread_sigmask(SIG_BLOCK, &set, NULL) != 0) {
931 		perror("pthread_sigmask");
932 		return (NULL);
933 	}
934 
935 	for (;;) {
936 		rc->enc_raw_ok = false;
937 		rc->enc_zlib_ok = false;
938 		rc->enc_resize_ok = false;
939 
940 		cfd = accept(rc->sfd, NULL, NULL);
941 		if (rc->conn_wait) {
942 			pthread_mutex_lock(&rc->mtx);
943 			pthread_cond_signal(&rc->cond);
944 			pthread_mutex_unlock(&rc->mtx);
945 			rc->conn_wait = 0;
946 		}
947 		rfb_handle(rc, cfd);
948 		close(cfd);
949 	}
950 
951 	/* NOTREACHED */
952 	return (NULL);
953 }
954 
955 static int
956 sse42_supported(void)
957 {
958 	u_int cpu_registers[4], ecx;
959 
960 	do_cpuid(1, cpu_registers);
961 
962 	ecx = cpu_registers[2];
963 
964 	return ((ecx & CPUID2_SSE42) != 0);
965 }
966 
967 int
968 rfb_init(char *hostname, int port, int wait, char *password)
969 {
970 	int e;
971 	char servname[6];
972 	struct rfb_softc *rc;
973 	struct addrinfo *ai = NULL;
974 	struct addrinfo hints;
975 	int on = 1;
976 #ifndef WITHOUT_CAPSICUM
977 	cap_rights_t rights;
978 #endif
979 
980 	rc = calloc(1, sizeof(struct rfb_softc));
981 
982 	rc->crc = calloc(howmany(RFB_MAX_WIDTH * RFB_MAX_HEIGHT, 32),
983 	                 sizeof(uint32_t));
984 	rc->crc_tmp = calloc(howmany(RFB_MAX_WIDTH * RFB_MAX_HEIGHT, 32),
985 	                     sizeof(uint32_t));
986 	rc->crc_width = RFB_MAX_WIDTH;
987 	rc->crc_height = RFB_MAX_HEIGHT;
988 	rc->sfd = -1;
989 
990 	rc->password = password;
991 
992 	snprintf(servname, sizeof(servname), "%d", port ? port : 5900);
993 
994 	if (!hostname || strlen(hostname) == 0)
995 #if defined(INET)
996 		hostname = "127.0.0.1";
997 #elif defined(INET6)
998 		hostname = "[::1]";
999 #endif
1000 
1001 	memset(&hints, 0, sizeof(hints));
1002 	hints.ai_family = AF_UNSPEC;
1003 	hints.ai_socktype = SOCK_STREAM;
1004 	hints.ai_flags = AI_NUMERICHOST | AI_NUMERICSERV | AI_PASSIVE;
1005 
1006 	if ((e = getaddrinfo(hostname, servname, &hints, &ai)) != 0) {
1007 		EPRINTLN("getaddrinfo: %s", gai_strerror(e));
1008 		goto error;
1009 	}
1010 
1011 	rc->sfd = socket(ai->ai_family, ai->ai_socktype, 0);
1012 	if (rc->sfd < 0) {
1013 		perror("socket");
1014 		goto error;
1015 	}
1016 
1017 	setsockopt(rc->sfd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
1018 
1019 	if (bind(rc->sfd, ai->ai_addr, ai->ai_addrlen) < 0) {
1020 		perror("bind");
1021 		goto error;
1022 	}
1023 
1024 	if (listen(rc->sfd, 1) < 0) {
1025 		perror("listen");
1026 		goto error;
1027 	}
1028 
1029 #ifndef WITHOUT_CAPSICUM
1030 	cap_rights_init(&rights, CAP_ACCEPT, CAP_EVENT, CAP_READ, CAP_WRITE);
1031 	if (caph_rights_limit(rc->sfd, &rights) == -1)
1032 		errx(EX_OSERR, "Unable to apply rights for sandbox");
1033 #endif
1034 
1035 	rc->hw_crc = sse42_supported();
1036 
1037 	rc->conn_wait = wait;
1038 	if (wait) {
1039 		pthread_mutex_init(&rc->mtx, NULL);
1040 		pthread_cond_init(&rc->cond, NULL);
1041 	}
1042 
1043 	pthread_create(&rc->tid, NULL, rfb_thr, rc);
1044 	pthread_set_name_np(rc->tid, "rfb");
1045 
1046 	if (wait) {
1047 		DPRINTF(("Waiting for rfb client..."));
1048 		pthread_mutex_lock(&rc->mtx);
1049 		pthread_cond_wait(&rc->cond, &rc->mtx);
1050 		pthread_mutex_unlock(&rc->mtx);
1051 	}
1052 
1053 	freeaddrinfo(ai);
1054 	return (0);
1055 
1056  error:
1057 	if (ai != NULL)
1058 		freeaddrinfo(ai);
1059 	if (rc->sfd != -1)
1060 		close(rc->sfd);
1061 	free(rc->crc);
1062 	free(rc->crc_tmp);
1063 	free(rc);
1064 	return (-1);
1065 }
1066