xref: /freebsd/usr.sbin/bhyve/rfb.c (revision d0b2dbfa0ecf2bbc9709efc5e20baf8e4b44bbbf)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause
3  *
4  * Copyright (c) 2015 Tycho Nightingale <tycho.nightingale@pluribusnetworks.com>
5  * Copyright (c) 2015 Leon Dang
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  */
29 
30 #include <sys/cdefs.h>
31 #include <sys/param.h>
32 #ifndef WITHOUT_CAPSICUM
33 #include <sys/capsicum.h>
34 #endif
35 #include <sys/endian.h>
36 #include <sys/socket.h>
37 #include <sys/select.h>
38 #include <sys/time.h>
39 #include <arpa/inet.h>
40 #include <stdatomic.h>
41 #include <machine/cpufunc.h>
42 #include <machine/specialreg.h>
43 #include <netinet/in.h>
44 #include <netdb.h>
45 
46 #include <assert.h>
47 #ifndef WITHOUT_CAPSICUM
48 #include <capsicum_helpers.h>
49 #endif
50 #include <err.h>
51 #include <errno.h>
52 #include <pthread.h>
53 #include <pthread_np.h>
54 #include <signal.h>
55 #include <stdbool.h>
56 #include <stdlib.h>
57 #include <stdio.h>
58 #include <string.h>
59 #include <sysexits.h>
60 #include <unistd.h>
61 
62 #include <zlib.h>
63 
64 #include "bhyvegc.h"
65 #include "debug.h"
66 #include "console.h"
67 #include "rfb.h"
68 #include "sockstream.h"
69 
70 #ifndef NO_OPENSSL
71 #include <openssl/des.h>
72 #endif
73 
74 /* Delays in microseconds */
75 #define	CFD_SEL_DELAY	10000
76 #define	SCREEN_REFRESH_DELAY	33300	/* 30Hz */
77 #define	SCREEN_POLL_DELAY	(SCREEN_REFRESH_DELAY / 2)
78 
79 static int rfb_debug = 0;
80 #define	DPRINTF(params) if (rfb_debug) PRINTLN params
81 #define	WPRINTF(params) PRINTLN params
82 
83 #define VERSION_LENGTH	12
84 #define AUTH_LENGTH	16
85 #define PASSWD_LENGTH	8
86 
87 /* Protocol versions */
88 #define CVERS_3_3	'3'
89 #define CVERS_3_7	'7'
90 #define CVERS_3_8	'8'
91 
92 /* Client-to-server msg types */
93 #define CS_SET_PIXEL_FORMAT	0
94 #define CS_SET_ENCODINGS	2
95 #define CS_UPDATE_MSG		3
96 #define CS_KEY_EVENT		4
97 #define CS_POINTER_EVENT	5
98 #define CS_CUT_TEXT		6
99 #define CS_MSG_CLIENT_QEMU	255
100 
101 #define SECURITY_TYPE_NONE	1
102 #define SECURITY_TYPE_VNC_AUTH	2
103 
104 #define AUTH_FAILED_UNAUTH	1
105 #define AUTH_FAILED_ERROR	2
106 
107 struct rfb_softc {
108 	int		sfd;
109 	pthread_t	tid;
110 
111 	int		cfd;
112 
113 	int		width, height;
114 
115 	const char	*password;
116 
117 	bool		enc_raw_ok;
118 	bool		enc_zlib_ok;
119 	bool		enc_resize_ok;
120 	bool		enc_extkeyevent_ok;
121 
122 	bool		enc_extkeyevent_send;
123 
124 	z_stream	zstream;
125 	uint8_t		*zbuf;
126 	int		zbuflen;
127 
128 	int		conn_wait;
129 	int		wrcount;
130 
131 	atomic_bool	sending;
132 	atomic_bool	pending;
133 	atomic_bool	update_all;
134 	atomic_bool	input_detected;
135 
136 	pthread_mutex_t mtx;
137 	pthread_cond_t  cond;
138 
139 	int		hw_crc;
140 	uint32_t	*crc;		/* WxH crc cells */
141 	uint32_t	*crc_tmp;	/* buffer to store single crc row */
142 	int		crc_width, crc_height;
143 };
144 
145 struct rfb_pixfmt {
146 	uint8_t		bpp;
147 	uint8_t		depth;
148 	uint8_t		bigendian;
149 	uint8_t		truecolor;
150 	uint16_t	red_max;
151 	uint16_t	green_max;
152 	uint16_t	blue_max;
153 	uint8_t		red_shift;
154 	uint8_t		green_shift;
155 	uint8_t		blue_shift;
156 	uint8_t		pad[3];
157 };
158 
159 struct rfb_srvr_info {
160 	uint16_t		width;
161 	uint16_t		height;
162 	struct rfb_pixfmt	pixfmt;
163 	uint32_t		namelen;
164 };
165 
166 struct rfb_pixfmt_msg {
167 	uint8_t			type;
168 	uint8_t			pad[3];
169 	struct rfb_pixfmt	pixfmt;
170 };
171 
172 #define	RFB_ENCODING_RAW		0
173 #define	RFB_ENCODING_ZLIB		6
174 #define	RFB_ENCODING_RESIZE		-223
175 #define	RFB_ENCODING_EXT_KEYEVENT	-258
176 
177 #define	RFB_CLIENTMSG_EXT_KEYEVENT	0
178 
179 #define	RFB_MAX_WIDTH			2000
180 #define	RFB_MAX_HEIGHT			1200
181 #define	RFB_ZLIB_BUFSZ			RFB_MAX_WIDTH*RFB_MAX_HEIGHT*4
182 
183 /* percentage changes to screen before sending the entire screen */
184 #define	RFB_SEND_ALL_THRESH		25
185 
186 struct rfb_enc_msg {
187 	uint8_t		type;
188 	uint8_t		pad;
189 	uint16_t	numencs;
190 };
191 
192 struct rfb_updt_msg {
193 	uint8_t		type;
194 	uint8_t		incremental;
195 	uint16_t	x;
196 	uint16_t	y;
197 	uint16_t	width;
198 	uint16_t	height;
199 };
200 
201 struct rfb_key_msg {
202 	uint8_t		type;
203 	uint8_t		down;
204 	uint16_t	pad;
205 	uint32_t	sym;
206 };
207 
208 struct rfb_client_msg {
209 	uint8_t		type;
210 	uint8_t		subtype;
211 };
212 
213 struct rfb_extended_key_msg {
214 	uint8_t		type;
215 	uint8_t		subtype;
216 	uint16_t	down;
217 	uint32_t	sym;
218 	uint32_t	code;
219 };
220 
221 struct rfb_ptr_msg {
222 	uint8_t		type;
223 	uint8_t		button;
224 	uint16_t	x;
225 	uint16_t	y;
226 };
227 
228 struct rfb_srvr_updt_msg {
229 	uint8_t		type;
230 	uint8_t		pad;
231 	uint16_t	numrects;
232 };
233 
234 struct rfb_srvr_rect_hdr {
235 	uint16_t	x;
236 	uint16_t	y;
237 	uint16_t	width;
238 	uint16_t	height;
239 	uint32_t	encoding;
240 };
241 
242 struct rfb_cuttext_msg {
243 	uint8_t		type;
244 	uint8_t		padding[3];
245 	uint32_t	length;
246 };
247 
248 static void
249 rfb_send_server_init_msg(int cfd)
250 {
251 	struct bhyvegc_image *gc_image;
252 	struct rfb_srvr_info sinfo;
253 
254 	gc_image = console_get_image();
255 
256 	sinfo.width = htons(gc_image->width);
257 	sinfo.height = htons(gc_image->height);
258 	sinfo.pixfmt.bpp = 32;
259 	sinfo.pixfmt.depth = 32;
260 	sinfo.pixfmt.bigendian = 0;
261 	sinfo.pixfmt.truecolor = 1;
262 	sinfo.pixfmt.red_max = htons(255);
263 	sinfo.pixfmt.green_max = htons(255);
264 	sinfo.pixfmt.blue_max = htons(255);
265 	sinfo.pixfmt.red_shift = 16;
266 	sinfo.pixfmt.green_shift = 8;
267 	sinfo.pixfmt.blue_shift = 0;
268 	sinfo.pixfmt.pad[0] = 0;
269 	sinfo.pixfmt.pad[1] = 0;
270 	sinfo.pixfmt.pad[2] = 0;
271 	sinfo.namelen = htonl(strlen("bhyve"));
272 	(void)stream_write(cfd, &sinfo, sizeof(sinfo));
273 	(void)stream_write(cfd, "bhyve", strlen("bhyve"));
274 }
275 
276 static void
277 rfb_send_resize_update_msg(struct rfb_softc *rc, int cfd)
278 {
279 	struct rfb_srvr_updt_msg supdt_msg;
280 	struct rfb_srvr_rect_hdr srect_hdr;
281 
282 	/* Number of rectangles: 1 */
283 	supdt_msg.type = 0;
284 	supdt_msg.pad = 0;
285 	supdt_msg.numrects = htons(1);
286 	stream_write(cfd, &supdt_msg, sizeof(struct rfb_srvr_updt_msg));
287 
288 	/* Rectangle header */
289 	srect_hdr.x = htons(0);
290 	srect_hdr.y = htons(0);
291 	srect_hdr.width = htons(rc->width);
292 	srect_hdr.height = htons(rc->height);
293 	srect_hdr.encoding = htonl(RFB_ENCODING_RESIZE);
294 	stream_write(cfd, &srect_hdr, sizeof(struct rfb_srvr_rect_hdr));
295 }
296 
297 static void
298 rfb_send_extended_keyevent_update_msg(struct rfb_softc *rc, int cfd)
299 {
300 	struct rfb_srvr_updt_msg supdt_msg;
301 	struct rfb_srvr_rect_hdr srect_hdr;
302 
303 	/* Number of rectangles: 1 */
304 	supdt_msg.type = 0;
305 	supdt_msg.pad = 0;
306 	supdt_msg.numrects = htons(1);
307 	stream_write(cfd, &supdt_msg, sizeof(struct rfb_srvr_updt_msg));
308 
309 	/* Rectangle header */
310 	srect_hdr.x = htons(0);
311 	srect_hdr.y = htons(0);
312 	srect_hdr.width = htons(rc->width);
313 	srect_hdr.height = htons(rc->height);
314 	srect_hdr.encoding = htonl(RFB_ENCODING_EXT_KEYEVENT);
315 	stream_write(cfd, &srect_hdr, sizeof(struct rfb_srvr_rect_hdr));
316 }
317 
318 static void
319 rfb_recv_set_pixfmt_msg(struct rfb_softc *rc __unused, int cfd)
320 {
321 	struct rfb_pixfmt_msg pixfmt_msg;
322 
323 	(void)stream_read(cfd, (uint8_t *)&pixfmt_msg + 1,
324 	    sizeof(pixfmt_msg) - 1);
325 }
326 
327 static void
328 rfb_recv_set_encodings_msg(struct rfb_softc *rc, int cfd)
329 {
330 	struct rfb_enc_msg enc_msg;
331 	int i;
332 	uint32_t encoding;
333 
334 	(void)stream_read(cfd, (uint8_t *)&enc_msg + 1, sizeof(enc_msg) - 1);
335 
336 	for (i = 0; i < htons(enc_msg.numencs); i++) {
337 		(void)stream_read(cfd, &encoding, sizeof(encoding));
338 		switch (htonl(encoding)) {
339 		case RFB_ENCODING_RAW:
340 			rc->enc_raw_ok = true;
341 			break;
342 		case RFB_ENCODING_ZLIB:
343 			if (!rc->enc_zlib_ok) {
344 				deflateInit(&rc->zstream, Z_BEST_SPEED);
345 				rc->enc_zlib_ok = true;
346 			}
347 			break;
348 		case RFB_ENCODING_RESIZE:
349 			rc->enc_resize_ok = true;
350 			break;
351 		case RFB_ENCODING_EXT_KEYEVENT:
352 			rc->enc_extkeyevent_ok = true;
353 			break;
354 		}
355 	}
356 }
357 
358 /*
359  * Calculate CRC32 using SSE4.2; Intel or AMD Bulldozer+ CPUs only
360  */
361 static __inline uint32_t
362 fast_crc32(void *buf, int len, uint32_t crcval)
363 {
364 	uint32_t q = len / sizeof(uint32_t);
365 	uint32_t *p = (uint32_t *)buf;
366 
367 	while (q--) {
368 		asm volatile (
369 			".byte 0xf2, 0xf, 0x38, 0xf1, 0xf1;"
370 			:"=S" (crcval)
371 			:"0" (crcval), "c" (*p)
372 		);
373 		p++;
374 	}
375 
376 	return (crcval);
377 }
378 
379 static int
380 rfb_send_update_header(struct rfb_softc *rc __unused, int cfd, int numrects)
381 {
382 	struct rfb_srvr_updt_msg supdt_msg;
383 
384 	supdt_msg.type = 0;
385 	supdt_msg.pad = 0;
386 	supdt_msg.numrects = htons(numrects);
387 
388 	return stream_write(cfd, &supdt_msg,
389 	    sizeof(struct rfb_srvr_updt_msg));
390 }
391 
392 static int
393 rfb_send_rect(struct rfb_softc *rc, int cfd, struct bhyvegc_image *gc,
394               int x, int y, int w, int h)
395 {
396 	struct rfb_srvr_rect_hdr srect_hdr;
397 	unsigned long zlen;
398 	ssize_t nwrite, total;
399 	int err;
400 	uint32_t *p;
401 	uint8_t *zbufp;
402 
403 	/*
404 	 * Send a single rectangle of the given x, y, w h dimensions.
405 	 */
406 
407 	/* Rectangle header */
408 	srect_hdr.x = htons(x);
409 	srect_hdr.y = htons(y);
410 	srect_hdr.width = htons(w);
411 	srect_hdr.height = htons(h);
412 
413 	h = y + h;
414 	w *= sizeof(uint32_t);
415 	if (rc->enc_zlib_ok) {
416 		zbufp = rc->zbuf;
417 		rc->zstream.total_in = 0;
418 		rc->zstream.total_out = 0;
419 		for (p = &gc->data[y * gc->width + x]; y < h; y++) {
420 			rc->zstream.next_in = (Bytef *)p;
421 			rc->zstream.avail_in = w;
422 			rc->zstream.next_out = (Bytef *)zbufp;
423 			rc->zstream.avail_out = RFB_ZLIB_BUFSZ + 16 -
424 			                        rc->zstream.total_out;
425 			rc->zstream.data_type = Z_BINARY;
426 
427 			/* Compress with zlib */
428 			err = deflate(&rc->zstream, Z_SYNC_FLUSH);
429 			if (err != Z_OK) {
430 				WPRINTF(("zlib[rect] deflate err: %d", err));
431 				rc->enc_zlib_ok = false;
432 				deflateEnd(&rc->zstream);
433 				goto doraw;
434 			}
435 			zbufp = rc->zbuf + rc->zstream.total_out;
436 			p += gc->width;
437 		}
438 		srect_hdr.encoding = htonl(RFB_ENCODING_ZLIB);
439 		nwrite = stream_write(cfd, &srect_hdr,
440 		                      sizeof(struct rfb_srvr_rect_hdr));
441 		if (nwrite <= 0)
442 			return (nwrite);
443 
444 		zlen = htonl(rc->zstream.total_out);
445 		nwrite = stream_write(cfd, &zlen, sizeof(uint32_t));
446 		if (nwrite <= 0)
447 			return (nwrite);
448 		return (stream_write(cfd, rc->zbuf, rc->zstream.total_out));
449 	}
450 
451 doraw:
452 
453 	total = 0;
454 	zbufp = rc->zbuf;
455 	for (p = &gc->data[y * gc->width + x]; y < h; y++) {
456 		memcpy(zbufp, p, w);
457 		zbufp += w;
458 		total += w;
459 		p += gc->width;
460 	}
461 
462 	srect_hdr.encoding = htonl(RFB_ENCODING_RAW);
463 	nwrite = stream_write(cfd, &srect_hdr,
464 	                      sizeof(struct rfb_srvr_rect_hdr));
465 	if (nwrite <= 0)
466 		return (nwrite);
467 
468 	total = stream_write(cfd, rc->zbuf, total);
469 
470 	return (total);
471 }
472 
473 static int
474 rfb_send_all(struct rfb_softc *rc, int cfd, struct bhyvegc_image *gc)
475 {
476 	struct rfb_srvr_updt_msg supdt_msg;
477         struct rfb_srvr_rect_hdr srect_hdr;
478 	ssize_t nwrite;
479 	unsigned long zlen;
480 	int err;
481 
482 	/*
483 	 * Send the whole thing
484 	 */
485 
486 	/* Number of rectangles: 1 */
487 	supdt_msg.type = 0;
488 	supdt_msg.pad = 0;
489 	supdt_msg.numrects = htons(1);
490 	nwrite = stream_write(cfd, &supdt_msg,
491 	                      sizeof(struct rfb_srvr_updt_msg));
492 	if (nwrite <= 0)
493 		return (nwrite);
494 
495 	/* Rectangle header */
496 	srect_hdr.x = 0;
497 	srect_hdr.y = 0;
498 	srect_hdr.width = htons(gc->width);
499 	srect_hdr.height = htons(gc->height);
500 	if (rc->enc_zlib_ok) {
501 		rc->zstream.next_in = (Bytef *)gc->data;
502 		rc->zstream.avail_in = gc->width * gc->height *
503 		                   sizeof(uint32_t);
504 		rc->zstream.next_out = (Bytef *)rc->zbuf;
505 		rc->zstream.avail_out = RFB_ZLIB_BUFSZ + 16;
506 		rc->zstream.data_type = Z_BINARY;
507 
508 		rc->zstream.total_in = 0;
509 		rc->zstream.total_out = 0;
510 
511 		/* Compress with zlib */
512 		err = deflate(&rc->zstream, Z_SYNC_FLUSH);
513 		if (err != Z_OK) {
514 			WPRINTF(("zlib deflate err: %d", err));
515 			rc->enc_zlib_ok = false;
516 			deflateEnd(&rc->zstream);
517 			goto doraw;
518 		}
519 
520 		srect_hdr.encoding = htonl(RFB_ENCODING_ZLIB);
521 		nwrite = stream_write(cfd, &srect_hdr,
522 		                      sizeof(struct rfb_srvr_rect_hdr));
523 		if (nwrite <= 0)
524 			return (nwrite);
525 
526 		zlen = htonl(rc->zstream.total_out);
527 		nwrite = stream_write(cfd, &zlen, sizeof(uint32_t));
528 		if (nwrite <= 0)
529 			return (nwrite);
530 		return (stream_write(cfd, rc->zbuf, rc->zstream.total_out));
531 	}
532 
533 doraw:
534 	srect_hdr.encoding = htonl(RFB_ENCODING_RAW);
535 	nwrite = stream_write(cfd, &srect_hdr,
536 	                      sizeof(struct rfb_srvr_rect_hdr));
537 	if (nwrite <= 0)
538 		return (nwrite);
539 
540 	nwrite = stream_write(cfd, gc->data,
541 	               gc->width * gc->height * sizeof(uint32_t));
542 
543 	return (nwrite);
544 }
545 
546 #define	PIX_PER_CELL	32
547 #define	PIXCELL_SHIFT	5
548 #define	PIXCELL_MASK	0x1F
549 
550 static int
551 rfb_send_screen(struct rfb_softc *rc, int cfd)
552 {
553 	struct bhyvegc_image *gc_image;
554 	ssize_t nwrite;
555 	int x, y;
556 	int celly, cellwidth;
557 	int xcells, ycells;
558 	int w, h;
559 	uint32_t *p;
560 	int rem_x, rem_y;   /* remainder for resolutions not x32 pixels ratio */
561 	int retval;
562 	uint32_t *crc_p, *orig_crc;
563 	int changes;
564 	bool expected;
565 
566 	/* Return if another thread sending */
567 	expected = false;
568 	if (atomic_compare_exchange_strong(&rc->sending, &expected, true) == false)
569 		return (1);
570 
571 	retval = 1;
572 
573 	/* Updates require a preceding update request */
574 	if (atomic_exchange(&rc->pending, false) == false)
575 		goto done;
576 
577 	console_refresh();
578 	gc_image = console_get_image();
579 
580 	/* Clear old CRC values when the size changes */
581 	if (rc->crc_width != gc_image->width ||
582 	    rc->crc_height != gc_image->height) {
583 		memset(rc->crc, 0, sizeof(uint32_t) *
584 		    howmany(RFB_MAX_WIDTH, PIX_PER_CELL) *
585 		    howmany(RFB_MAX_HEIGHT, PIX_PER_CELL));
586 		rc->crc_width = gc_image->width;
587 		rc->crc_height = gc_image->height;
588 	}
589 
590        /* A size update counts as an update in itself */
591        if (rc->width != gc_image->width ||
592            rc->height != gc_image->height) {
593                rc->width = gc_image->width;
594                rc->height = gc_image->height;
595                if (rc->enc_resize_ok) {
596                        rfb_send_resize_update_msg(rc, cfd);
597 		       rc->update_all = true;
598                        goto done;
599                }
600        }
601 
602        if (atomic_exchange(&rc->update_all, false) == true) {
603 	       retval = rfb_send_all(rc, cfd, gc_image);
604 	       goto done;
605        }
606 
607 	/*
608 	 * Calculate the checksum for each 32x32 cell. Send each that
609 	 * has changed since the last scan.
610 	 */
611 
612 	w = rc->crc_width;
613 	h = rc->crc_height;
614 	xcells = howmany(rc->crc_width, PIX_PER_CELL);
615 	ycells = howmany(rc->crc_height, PIX_PER_CELL);
616 
617 	rem_x = w & PIXCELL_MASK;
618 
619 	rem_y = h & PIXCELL_MASK;
620 	if (!rem_y)
621 		rem_y = PIX_PER_CELL;
622 
623 	p = gc_image->data;
624 
625 	/*
626 	 * Go through all cells and calculate crc. If significant number
627 	 * of changes, then send entire screen.
628 	 * crc_tmp is dual purpose: to store the new crc and to flag as
629 	 * a cell that has changed.
630 	 */
631 	crc_p = rc->crc_tmp - xcells;
632 	orig_crc = rc->crc - xcells;
633 	changes = 0;
634 	memset(rc->crc_tmp, 0, sizeof(uint32_t) * xcells * ycells);
635 	for (y = 0; y < h; y++) {
636 		if ((y & PIXCELL_MASK) == 0) {
637 			crc_p += xcells;
638 			orig_crc += xcells;
639 		}
640 
641 		for (x = 0; x < xcells; x++) {
642 			if (x == (xcells - 1) && rem_x > 0)
643 				cellwidth = rem_x;
644 			else
645 				cellwidth = PIX_PER_CELL;
646 
647 			if (rc->hw_crc)
648 				crc_p[x] = fast_crc32(p,
649 				             cellwidth * sizeof(uint32_t),
650 				             crc_p[x]);
651 			else
652 				crc_p[x] = (uint32_t)crc32(crc_p[x],
653 				             (Bytef *)p,
654 				             cellwidth * sizeof(uint32_t));
655 
656 			p += cellwidth;
657 
658 			/* check for crc delta if last row in cell */
659 			if ((y & PIXCELL_MASK) == PIXCELL_MASK || y == (h-1)) {
660 				if (orig_crc[x] != crc_p[x]) {
661 					orig_crc[x] = crc_p[x];
662 					crc_p[x] = 1;
663 					changes++;
664 				} else {
665 					crc_p[x] = 0;
666 				}
667 			}
668 		}
669 	}
670 
671        /*
672 	* We only send the update if there are changes.
673 	* Restore the pending flag since it was unconditionally cleared
674 	* above.
675 	*/
676 	if (!changes) {
677 		rc->pending = true;
678 		goto done;
679 	}
680 
681 	/* If number of changes is > THRESH percent, send the whole screen */
682 	if (((changes * 100) / (xcells * ycells)) >= RFB_SEND_ALL_THRESH) {
683 		retval = rfb_send_all(rc, cfd, gc_image);
684 		goto done;
685 	}
686 
687 	rfb_send_update_header(rc, cfd, changes);
688 
689 	/* Go through all cells, and send only changed ones */
690 	crc_p = rc->crc_tmp;
691 	for (y = 0; y < h; y += PIX_PER_CELL) {
692 		/* previous cell's row */
693 		celly = (y >> PIXCELL_SHIFT);
694 
695 		/* Delta check crc to previous set */
696 		for (x = 0; x < xcells; x++) {
697 			if (*crc_p++ == 0)
698 				continue;
699 
700 			if (x == (xcells - 1) && rem_x > 0)
701 				cellwidth = rem_x;
702 			else
703 				cellwidth = PIX_PER_CELL;
704 			nwrite = rfb_send_rect(rc, cfd,
705 				gc_image,
706 				x * PIX_PER_CELL,
707 				celly * PIX_PER_CELL,
708 			        cellwidth,
709 				y + PIX_PER_CELL >= h ? rem_y : PIX_PER_CELL);
710 			if (nwrite <= 0) {
711 				retval = nwrite;
712 				goto done;
713 			}
714 		}
715 	}
716 
717 done:
718 	rc->sending = false;
719 
720 	return (retval);
721 }
722 
723 
724 static void
725 rfb_recv_update_msg(struct rfb_softc *rc, int cfd)
726 {
727 	struct rfb_updt_msg updt_msg;
728 
729 	(void)stream_read(cfd, (uint8_t *)&updt_msg + 1 , sizeof(updt_msg) - 1);
730 
731 	if (rc->enc_extkeyevent_ok && (!rc->enc_extkeyevent_send)) {
732 		rfb_send_extended_keyevent_update_msg(rc, cfd);
733 		rc->enc_extkeyevent_send = true;
734 	}
735 
736 	rc->pending = true;
737 	if (!updt_msg.incremental)
738 		rc->update_all = true;
739 }
740 
741 static void
742 rfb_recv_key_msg(struct rfb_softc *rc, int cfd)
743 {
744 	struct rfb_key_msg key_msg;
745 
746 	(void)stream_read(cfd, (uint8_t *)&key_msg + 1, sizeof(key_msg) - 1);
747 
748 	console_key_event(key_msg.down, htonl(key_msg.sym), htonl(0));
749 	rc->input_detected = true;
750 }
751 
752 static void
753 rfb_recv_client_msg(struct rfb_softc *rc, int cfd)
754 {
755 	struct rfb_client_msg client_msg;
756 	struct rfb_extended_key_msg extkey_msg;
757 
758 	(void)stream_read(cfd, (uint8_t *)&client_msg + 1,
759 	    sizeof(client_msg) - 1);
760 
761 	if (client_msg.subtype == RFB_CLIENTMSG_EXT_KEYEVENT) {
762 		(void)stream_read(cfd, (uint8_t *)&extkey_msg + 2,
763 		    sizeof(extkey_msg) - 2);
764 		console_key_event((int)extkey_msg.down, htonl(extkey_msg.sym), htonl(extkey_msg.code));
765 		rc->input_detected = true;
766 	}
767 }
768 
769 static void
770 rfb_recv_ptr_msg(struct rfb_softc *rc, int cfd)
771 {
772 	struct rfb_ptr_msg ptr_msg;
773 
774 	(void)stream_read(cfd, (uint8_t *)&ptr_msg + 1, sizeof(ptr_msg) - 1);
775 
776 	console_ptr_event(ptr_msg.button, htons(ptr_msg.x), htons(ptr_msg.y));
777 	rc->input_detected = true;
778 }
779 
780 static void
781 rfb_recv_cuttext_msg(struct rfb_softc *rc __unused, int cfd)
782 {
783 	struct rfb_cuttext_msg ct_msg;
784 	unsigned char buf[32];
785 	int len;
786 
787 	len = stream_read(cfd, (uint8_t *)&ct_msg + 1, sizeof(ct_msg) - 1);
788 	ct_msg.length = htonl(ct_msg.length);
789 	while (ct_msg.length > 0) {
790 		len = stream_read(cfd, buf, ct_msg.length > sizeof(buf) ?
791 			sizeof(buf) : ct_msg.length);
792 		ct_msg.length -= len;
793 	}
794 }
795 
796 static int64_t
797 timeval_delta(struct timeval *prev, struct timeval *now)
798 {
799 	int64_t n1, n2;
800 	n1 = now->tv_sec * 1000000 + now->tv_usec;
801 	n2 = prev->tv_sec * 1000000 + prev->tv_usec;
802 	return (n1 - n2);
803 }
804 
805 static void *
806 rfb_wr_thr(void *arg)
807 {
808 	struct rfb_softc *rc;
809 	fd_set rfds;
810 	struct timeval tv;
811 	struct timeval prev_tv;
812 	int64_t tdiff;
813 	int cfd;
814 	int err;
815 
816 	rc = arg;
817 	cfd = rc->cfd;
818 
819 	prev_tv.tv_sec = 0;
820 	prev_tv.tv_usec = 0;
821 	while (rc->cfd >= 0) {
822 		FD_ZERO(&rfds);
823 		FD_SET(cfd, &rfds);
824 		tv.tv_sec = 0;
825 		tv.tv_usec = CFD_SEL_DELAY;
826 
827 		err = select(cfd+1, &rfds, NULL, NULL, &tv);
828 		if (err < 0)
829 			return (NULL);
830 
831 		/* Determine if its time to push screen; ~24hz */
832 		gettimeofday(&tv, NULL);
833 		tdiff = timeval_delta(&prev_tv, &tv);
834 		if (tdiff >= SCREEN_POLL_DELAY) {
835 			bool input;
836 			prev_tv.tv_sec = tv.tv_sec;
837 			prev_tv.tv_usec = tv.tv_usec;
838 			input = atomic_exchange(&rc->input_detected, false);
839 			/*
840 			 * Refresh the screen on every second trip through the loop,
841 			 * or if keyboard/mouse input has been detected.
842 			 */
843 			if ((++rc->wrcount & 1) || input) {
844 				if (rfb_send_screen(rc, cfd) <= 0) {
845 					return (NULL);
846 				}
847 			}
848 		} else {
849 			/* sleep */
850 			usleep(SCREEN_POLL_DELAY - tdiff);
851 		}
852 	}
853 
854 	return (NULL);
855 }
856 
857 static void
858 rfb_handle(struct rfb_softc *rc, int cfd)
859 {
860 	const char *vbuf = "RFB 003.008\n";
861 	unsigned char buf[80];
862 	unsigned const char *message;
863 
864 #ifndef NO_OPENSSL
865 	unsigned char challenge[AUTH_LENGTH];
866 	unsigned char keystr[PASSWD_LENGTH];
867 	unsigned char crypt_expected[AUTH_LENGTH];
868 
869 	DES_key_schedule ks;
870 	int i;
871 #endif
872 	uint8_t client_ver;
873 	uint8_t auth_type;
874 	pthread_t tid;
875 	uint32_t sres = 0;
876 	int len;
877 	int perror = 1;
878 
879 	rc->cfd = cfd;
880 
881 	/* 1a. Send server version */
882 	stream_write(cfd, vbuf, strlen(vbuf));
883 
884 	/* 1b. Read client version */
885 	len = stream_read(cfd, buf, VERSION_LENGTH);
886 	if (len != VERSION_LENGTH ||
887 	    strncmp(vbuf, buf, VERSION_LENGTH - 2) != 0) {
888 		goto done;
889 	}
890 
891 	client_ver = buf[VERSION_LENGTH - 2];
892 	if (client_ver != CVERS_3_8 && client_ver != CVERS_3_7) {
893 		/* only recognize 3.3, 3.7 & 3.8. Others dflt to 3.3 */
894 		client_ver = CVERS_3_3;
895 	}
896 
897 	/* 2a. Send security type */
898 	buf[0] = 1;
899 
900 	/* In versions 3.7 & 3.8, it's 2-way handshake */
901 	/* For version 3.3, server says what the authentication type must be */
902 #ifndef NO_OPENSSL
903 	if (rc->password) {
904 		auth_type = SECURITY_TYPE_VNC_AUTH;
905 	} else {
906 		auth_type = SECURITY_TYPE_NONE;
907 	}
908 #else
909 	auth_type = SECURITY_TYPE_NONE;
910 #endif
911 
912 	switch (client_ver) {
913 	case CVERS_3_7:
914 	case CVERS_3_8:
915 		buf[0] = 1;
916 		buf[1] = auth_type;
917 		stream_write(cfd, buf, 2);
918 
919 		/* 2b. Read agreed security type */
920 		len = stream_read(cfd, buf, 1);
921 		if (buf[0] != auth_type) {
922 			/* deny */
923 			sres = htonl(1);
924 			message = "Auth failed: authentication type mismatch";
925 			goto report_and_done;
926 		}
927 		break;
928 	case CVERS_3_3:
929 	default:
930 		be32enc(buf, auth_type);
931 		stream_write(cfd, buf, 4);
932 		break;
933 	}
934 
935 	/* 2c. Do VNC authentication */
936 	switch (auth_type) {
937 	case SECURITY_TYPE_NONE:
938 		break;
939 	case SECURITY_TYPE_VNC_AUTH:
940 		/*
941 		 * The client encrypts the challenge with DES, using a password
942 		 * supplied by the user as the key.
943 		 * To form the key, the password is truncated to
944 		 * eight characters, or padded with null bytes on the right.
945 		 * The client then sends the resulting 16-bytes response.
946 		 */
947 #ifndef NO_OPENSSL
948 		strncpy(keystr, rc->password, PASSWD_LENGTH);
949 
950 		/* VNC clients encrypts the challenge with all the bit fields
951 		 * in each byte of the password mirrored.
952 		 * Here we flip each byte of the keystr.
953 		 */
954 		for (i = 0; i < PASSWD_LENGTH; i++) {
955 			keystr[i] = (keystr[i] & 0xF0) >> 4
956 				  | (keystr[i] & 0x0F) << 4;
957 			keystr[i] = (keystr[i] & 0xCC) >> 2
958 				  | (keystr[i] & 0x33) << 2;
959 			keystr[i] = (keystr[i] & 0xAA) >> 1
960 				  | (keystr[i] & 0x55) << 1;
961 		}
962 
963 		/* Initialize a 16-byte random challenge */
964 		arc4random_buf(challenge, sizeof(challenge));
965 		stream_write(cfd, challenge, AUTH_LENGTH);
966 
967 		/* Receive the 16-byte challenge response */
968 		stream_read(cfd, buf, AUTH_LENGTH);
969 
970 		memcpy(crypt_expected, challenge, AUTH_LENGTH);
971 
972 		/* Encrypt the Challenge with DES */
973 		DES_set_key((const_DES_cblock *)keystr, &ks);
974 		DES_ecb_encrypt((const_DES_cblock *)challenge,
975 				(const_DES_cblock *)crypt_expected,
976 				&ks, DES_ENCRYPT);
977 		DES_ecb_encrypt((const_DES_cblock *)(challenge + PASSWD_LENGTH),
978 				(const_DES_cblock *)(crypt_expected +
979 				PASSWD_LENGTH),
980 				&ks, DES_ENCRYPT);
981 
982 		if (memcmp(crypt_expected, buf, AUTH_LENGTH) != 0) {
983 			message = "Auth Failed: Invalid Password.";
984 			sres = htonl(1);
985 		} else {
986 			sres = 0;
987 		}
988 #else
989 		sres = htonl(1);
990 		WPRINTF(("Auth not supported, no OpenSSL in your system"));
991 #endif
992 
993 		break;
994 	}
995 
996 	switch (client_ver) {
997 	case CVERS_3_7:
998 	case CVERS_3_8:
999 report_and_done:
1000 		/* 2d. Write back a status */
1001 		stream_write(cfd, &sres, 4);
1002 
1003 		if (sres) {
1004 			/* 3.7 does not want string explaining cause */
1005 			if (client_ver == CVERS_3_8) {
1006 				be32enc(buf, strlen(message));
1007 				stream_write(cfd, buf, 4);
1008 				stream_write(cfd, message, strlen(message));
1009 			}
1010 			goto done;
1011 		}
1012 		break;
1013 	case CVERS_3_3:
1014 	default:
1015 		/* for VNC auth case send status */
1016 		if (auth_type == SECURITY_TYPE_VNC_AUTH) {
1017 			/* 2d. Write back a status */
1018 			stream_write(cfd, &sres, 4);
1019 		}
1020 		if (sres) {
1021 			goto done;
1022 		}
1023 		break;
1024 	}
1025 	/* 3a. Read client shared-flag byte */
1026 	len = stream_read(cfd, buf, 1);
1027 
1028 	/* 4a. Write server-init info */
1029 	rfb_send_server_init_msg(cfd);
1030 
1031 	if (!rc->zbuf) {
1032 		rc->zbuf = malloc(RFB_ZLIB_BUFSZ + 16);
1033 		assert(rc->zbuf != NULL);
1034 	}
1035 
1036 	perror = pthread_create(&tid, NULL, rfb_wr_thr, rc);
1037 	if (perror == 0)
1038 		pthread_set_name_np(tid, "rfbout");
1039 
1040         /* Now read in client requests. 1st byte identifies type */
1041 	for (;;) {
1042 		len = read(cfd, buf, 1);
1043 		if (len <= 0) {
1044 			DPRINTF(("rfb client exiting"));
1045 			break;
1046 		}
1047 
1048 		switch (buf[0]) {
1049 		case CS_SET_PIXEL_FORMAT:
1050 			rfb_recv_set_pixfmt_msg(rc, cfd);
1051 			break;
1052 		case CS_SET_ENCODINGS:
1053 			rfb_recv_set_encodings_msg(rc, cfd);
1054 			break;
1055 		case CS_UPDATE_MSG:
1056 			rfb_recv_update_msg(rc, cfd);
1057 			break;
1058 		case CS_KEY_EVENT:
1059 			rfb_recv_key_msg(rc, cfd);
1060 			break;
1061 		case CS_POINTER_EVENT:
1062 			rfb_recv_ptr_msg(rc, cfd);
1063 			break;
1064 		case CS_CUT_TEXT:
1065 			rfb_recv_cuttext_msg(rc, cfd);
1066 			break;
1067 		case CS_MSG_CLIENT_QEMU:
1068 			rfb_recv_client_msg(rc, cfd);
1069 			break;
1070 		default:
1071 			WPRINTF(("rfb unknown cli-code %d!", buf[0] & 0xff));
1072 			goto done;
1073 		}
1074 	}
1075 done:
1076 	rc->cfd = -1;
1077 	if (perror == 0)
1078 		pthread_join(tid, NULL);
1079 	if (rc->enc_zlib_ok)
1080 		deflateEnd(&rc->zstream);
1081 }
1082 
1083 static void *
1084 rfb_thr(void *arg)
1085 {
1086 	struct rfb_softc *rc;
1087 	sigset_t set;
1088 
1089 	int cfd;
1090 
1091 	rc = arg;
1092 
1093 	sigemptyset(&set);
1094 	sigaddset(&set, SIGPIPE);
1095 	if (pthread_sigmask(SIG_BLOCK, &set, NULL) != 0) {
1096 		perror("pthread_sigmask");
1097 		return (NULL);
1098 	}
1099 
1100 	for (;;) {
1101 		rc->enc_raw_ok = false;
1102 		rc->enc_zlib_ok = false;
1103 		rc->enc_resize_ok = false;
1104 		rc->enc_extkeyevent_ok = false;
1105 
1106 		rc->enc_extkeyevent_send = false;
1107 
1108 		cfd = accept(rc->sfd, NULL, NULL);
1109 		if (rc->conn_wait) {
1110 			pthread_mutex_lock(&rc->mtx);
1111 			pthread_cond_signal(&rc->cond);
1112 			pthread_mutex_unlock(&rc->mtx);
1113 			rc->conn_wait = 0;
1114 		}
1115 		rfb_handle(rc, cfd);
1116 		close(cfd);
1117 	}
1118 
1119 	/* NOTREACHED */
1120 	return (NULL);
1121 }
1122 
1123 static int
1124 sse42_supported(void)
1125 {
1126 	u_int cpu_registers[4], ecx;
1127 
1128 	do_cpuid(1, cpu_registers);
1129 
1130 	ecx = cpu_registers[2];
1131 
1132 	return ((ecx & CPUID2_SSE42) != 0);
1133 }
1134 
1135 int
1136 rfb_init(const char *hostname, int port, int wait, const char *password)
1137 {
1138 	int e;
1139 	char servname[6];
1140 	struct rfb_softc *rc;
1141 	struct addrinfo *ai = NULL;
1142 	struct addrinfo hints;
1143 	int on = 1;
1144 	int cnt;
1145 #ifndef WITHOUT_CAPSICUM
1146 	cap_rights_t rights;
1147 #endif
1148 
1149 	rc = calloc(1, sizeof(struct rfb_softc));
1150 
1151 	cnt = howmany(RFB_MAX_WIDTH, PIX_PER_CELL) *
1152 	    howmany(RFB_MAX_HEIGHT, PIX_PER_CELL);
1153 	rc->crc = calloc(cnt, sizeof(uint32_t));
1154 	rc->crc_tmp = calloc(cnt, sizeof(uint32_t));
1155 	rc->crc_width = RFB_MAX_WIDTH;
1156 	rc->crc_height = RFB_MAX_HEIGHT;
1157 	rc->sfd = -1;
1158 
1159 	rc->password = password;
1160 
1161 	snprintf(servname, sizeof(servname), "%d", port ? port : 5900);
1162 
1163 	if (!hostname || strlen(hostname) == 0)
1164 #if defined(INET)
1165 		hostname = "127.0.0.1";
1166 #elif defined(INET6)
1167 		hostname = "[::1]";
1168 #endif
1169 
1170 	memset(&hints, 0, sizeof(hints));
1171 	hints.ai_family = AF_UNSPEC;
1172 	hints.ai_socktype = SOCK_STREAM;
1173 	hints.ai_flags = AI_NUMERICHOST | AI_NUMERICSERV | AI_PASSIVE;
1174 
1175 	if ((e = getaddrinfo(hostname, servname, &hints, &ai)) != 0) {
1176 		EPRINTLN("getaddrinfo: %s", gai_strerror(e));
1177 		goto error;
1178 	}
1179 
1180 	rc->sfd = socket(ai->ai_family, ai->ai_socktype, 0);
1181 	if (rc->sfd < 0) {
1182 		perror("socket");
1183 		goto error;
1184 	}
1185 
1186 	setsockopt(rc->sfd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
1187 
1188 	if (bind(rc->sfd, ai->ai_addr, ai->ai_addrlen) < 0) {
1189 		perror("bind");
1190 		goto error;
1191 	}
1192 
1193 	if (listen(rc->sfd, 1) < 0) {
1194 		perror("listen");
1195 		goto error;
1196 	}
1197 
1198 #ifndef WITHOUT_CAPSICUM
1199 	cap_rights_init(&rights, CAP_ACCEPT, CAP_EVENT, CAP_READ, CAP_WRITE);
1200 	if (caph_rights_limit(rc->sfd, &rights) == -1)
1201 		errx(EX_OSERR, "Unable to apply rights for sandbox");
1202 #endif
1203 
1204 	rc->hw_crc = sse42_supported();
1205 
1206 	rc->conn_wait = wait;
1207 	if (wait) {
1208 		pthread_mutex_init(&rc->mtx, NULL);
1209 		pthread_cond_init(&rc->cond, NULL);
1210 	}
1211 
1212 	pthread_create(&rc->tid, NULL, rfb_thr, rc);
1213 	pthread_set_name_np(rc->tid, "rfb");
1214 
1215 	if (wait) {
1216 		DPRINTF(("Waiting for rfb client..."));
1217 		pthread_mutex_lock(&rc->mtx);
1218 		pthread_cond_wait(&rc->cond, &rc->mtx);
1219 		pthread_mutex_unlock(&rc->mtx);
1220 		DPRINTF(("rfb client connected"));
1221 	}
1222 
1223 	freeaddrinfo(ai);
1224 	return (0);
1225 
1226  error:
1227 	if (ai != NULL)
1228 		freeaddrinfo(ai);
1229 	if (rc->sfd != -1)
1230 		close(rc->sfd);
1231 	free(rc->crc);
1232 	free(rc->crc_tmp);
1233 	free(rc);
1234 	return (-1);
1235 }
1236