/* * QEMU VNC display driver: Websockets support * * Copyright (C) 2010 Joel Martin * Copyright (C) 2012 Tim Hardeck * * This is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * This software is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this software; if not, see <http://www.gnu.org/licenses/>. */ #include "vnc.h" #include "qemu/main-loop.h" #ifdef CONFIG_VNC_TLS #include "qemu/sockets.h" static void vncws_tls_handshake_io(void *opaque); static int vncws_start_tls_handshake(struct VncState *vs) { int ret = gnutls_handshake(vs->ws_tls.session); if (ret < 0) { if (!gnutls_error_is_fatal(ret)) { VNC_DEBUG("Handshake interrupted (blocking)\n"); if (!gnutls_record_get_direction(vs->ws_tls.session)) { qemu_set_fd_handler(vs->csock, vncws_tls_handshake_io, NULL, vs); } else { qemu_set_fd_handler(vs->csock, NULL, vncws_tls_handshake_io, vs); } return 0; } VNC_DEBUG("Handshake failed %s\n", gnutls_strerror(ret)); vnc_client_error(vs); return -1; } VNC_DEBUG("Handshake done, switching to TLS data mode\n"); vs->ws_tls.wiremode = VNC_WIREMODE_TLS; qemu_set_fd_handler2(vs->csock, NULL, vncws_handshake_read, NULL, vs); return 0; } static void vncws_tls_handshake_io(void *opaque) { struct VncState *vs = (struct VncState *)opaque; VNC_DEBUG("Handshake IO continue\n"); vncws_start_tls_handshake(vs); } void vncws_tls_handshake_peek(void *opaque) { VncState *vs = opaque; long ret; if (!vs->ws_tls.session) { char peek[4]; ret = qemu_recv(vs->csock, peek, sizeof(peek), MSG_PEEK); if (ret && (strncmp(peek, "\x16", 1) == 0 || strncmp(peek, "\x80", 1) == 0)) { VNC_DEBUG("TLS Websocket connection recognized"); vnc_tls_client_setup(vs, 1); vncws_start_tls_handshake(vs); } else { vncws_handshake_read(vs); } } else { qemu_set_fd_handler2(vs->csock, NULL, vncws_handshake_read, NULL, vs); } } #endif /* CONFIG_VNC_TLS */ void vncws_handshake_read(void *opaque) { VncState *vs = opaque; uint8_t *handshake_end; long ret; buffer_reserve(&vs->ws_input, 4096); ret = vnc_client_read_buf(vs, buffer_end(&vs->ws_input), 4096); if (!ret) { if (vs->csock == -1) { vnc_disconnect_finish(vs); } return; } vs->ws_input.offset += ret; handshake_end = (uint8_t *)g_strstr_len((char *)vs->ws_input.buffer, vs->ws_input.offset, WS_HANDSHAKE_END); if (handshake_end) { qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs); vncws_process_handshake(vs, vs->ws_input.buffer, vs->ws_input.offset); buffer_advance(&vs->ws_input, handshake_end - vs->ws_input.buffer + strlen(WS_HANDSHAKE_END)); } } long vnc_client_read_ws(VncState *vs) { int ret, err; uint8_t *payload; size_t payload_size, frame_size; VNC_DEBUG("Read websocket %p size %zd offset %zd\n", vs->ws_input.buffer, vs->ws_input.capacity, vs->ws_input.offset); buffer_reserve(&vs->ws_input, 4096); ret = vnc_client_read_buf(vs, buffer_end(&vs->ws_input), 4096); if (!ret) { return 0; } vs->ws_input.offset += ret; /* make sure that nothing is left in the ws_input buffer */ do { err = vncws_decode_frame(&vs->ws_input, &payload, &payload_size, &frame_size); if (err <= 0) { return err; } buffer_reserve(&vs->input, payload_size); buffer_append(&vs->input, payload, payload_size); buffer_advance(&vs->ws_input, frame_size); } while (vs->ws_input.offset > 0); return ret; } long vnc_client_write_ws(VncState *vs) { long ret; VNC_DEBUG("Write WS: Pending output %p size %zd offset %zd\n", vs->output.buffer, vs->output.capacity, vs->output.offset); vncws_encode_frame(&vs->ws_output, vs->output.buffer, vs->output.offset); buffer_reset(&vs->output); ret = vnc_client_write_buf(vs, vs->ws_output.buffer, vs->ws_output.offset); if (!ret) { return 0; } buffer_advance(&vs->ws_output, ret); if (vs->ws_output.offset == 0) { qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs); } return ret; } static char *vncws_extract_handshake_entry(const char *handshake, size_t handshake_len, const char *name) { char *begin, *end, *ret = NULL; char *line = g_strdup_printf("%s%s: ", WS_HANDSHAKE_DELIM, name); begin = g_strstr_len(handshake, handshake_len, line); if (begin != NULL) { begin += strlen(line); end = g_strstr_len(begin, handshake_len - (begin - handshake), WS_HANDSHAKE_DELIM); if (end != NULL) { ret = g_strndup(begin, end - begin); } } g_free(line); return ret; } static void vncws_send_handshake_response(VncState *vs, const char* key) { char combined_key[WS_CLIENT_KEY_LEN + WS_GUID_LEN + 1]; unsigned char hash[SHA1_DIGEST_LEN]; size_t hash_size = sizeof(hash); char *accept = NULL, *response = NULL; gnutls_datum_t in; int ret; g_strlcpy(combined_key, key, WS_CLIENT_KEY_LEN + 1); g_strlcat(combined_key, WS_GUID, WS_CLIENT_KEY_LEN + WS_GUID_LEN + 1); /* hash and encode it */ in.data = (void *)combined_key; in.size = WS_CLIENT_KEY_LEN + WS_GUID_LEN; ret = gnutls_fingerprint(GNUTLS_DIG_SHA1, &in, hash, &hash_size); if (ret == GNUTLS_E_SUCCESS && hash_size <= SHA1_DIGEST_LEN) { accept = g_base64_encode(hash, hash_size); } if (accept == NULL) { VNC_DEBUG("Hashing Websocket combined key failed\n"); vnc_client_error(vs); return; } response = g_strdup_printf(WS_HANDSHAKE, accept); vnc_write(vs, response, strlen(response)); vnc_flush(vs); g_free(accept); g_free(response); vs->encode_ws = 1; vnc_init_state(vs); } void vncws_process_handshake(VncState *vs, uint8_t *line, size_t size) { char *protocols = vncws_extract_handshake_entry((const char *)line, size, "Sec-WebSocket-Protocol"); char *version = vncws_extract_handshake_entry((const char *)line, size, "Sec-WebSocket-Version"); char *key = vncws_extract_handshake_entry((const char *)line, size, "Sec-WebSocket-Key"); if (protocols && version && key && g_strrstr(protocols, "binary") && !strcmp(version, WS_SUPPORTED_VERSION) && strlen(key) == WS_CLIENT_KEY_LEN) { vncws_send_handshake_response(vs, key); } else { VNC_DEBUG("Defective Websockets header or unsupported protocol\n"); vnc_client_error(vs); } g_free(protocols); g_free(version); g_free(key); } void vncws_encode_frame(Buffer *output, const void *payload, const size_t payload_size) { size_t header_size = 0; unsigned char opcode = WS_OPCODE_BINARY_FRAME; union { char buf[WS_HEAD_MAX_LEN]; WsHeader ws; } header; if (!payload_size) { return; } header.ws.b0 = 0x80 | (opcode & 0x0f); if (payload_size <= 125) { header.ws.b1 = (uint8_t)payload_size; header_size = 2; } else if (payload_size < 65536) { header.ws.b1 = 0x7e; header.ws.u.s16.l16 = cpu_to_be16((uint16_t)payload_size); header_size = 4; } else { header.ws.b1 = 0x7f; header.ws.u.s64.l64 = cpu_to_be64(payload_size); header_size = 10; } buffer_reserve(output, header_size + payload_size); buffer_append(output, header.buf, header_size); buffer_append(output, payload, payload_size); } int vncws_decode_frame(Buffer *input, uint8_t **payload, size_t *payload_size, size_t *frame_size) { unsigned char opcode = 0, fin = 0, has_mask = 0; size_t header_size = 0; uint32_t *payload32; WsHeader *header = (WsHeader *)input->buffer; WsMask mask; int i; if (input->offset < WS_HEAD_MIN_LEN + 4) { /* header not complete */ return 0; } fin = (header->b0 & 0x80) >> 7; opcode = header->b0 & 0x0f; has_mask = (header->b1 & 0x80) >> 7; *payload_size = header->b1 & 0x7f; if (opcode == WS_OPCODE_CLOSE) { /* disconnect */ return -1; } /* Websocket frame sanity check: * * Websocket fragmentation is not supported. * * All websockets frames sent by a client have to be masked. * * Only binary encoding is supported. */ if (!fin || !has_mask || opcode != WS_OPCODE_BINARY_FRAME) { VNC_DEBUG("Received faulty/unsupported Websocket frame\n"); return -2; } if (*payload_size < 126) { header_size = 6; mask = header->u.m; } else if (*payload_size == 126 && input->offset >= 8) { *payload_size = be16_to_cpu(header->u.s16.l16); header_size = 8; mask = header->u.s16.m16; } else if (*payload_size == 127 && input->offset >= 14) { *payload_size = be64_to_cpu(header->u.s64.l64); header_size = 14; mask = header->u.s64.m64; } else { /* header not complete */ return 0; } *frame_size = header_size + *payload_size; if (input->offset < *frame_size) { /* frame not complete */ return 0; } *payload = input->buffer + header_size; /* unmask frame */ /* process 1 frame (32 bit op) */ payload32 = (uint32_t *)(*payload); for (i = 0; i < *payload_size / 4; i++) { payload32[i] ^= mask.u; } /* process the remaining bytes (if any) */ for (i *= 4; i < *payload_size; i++) { (*payload)[i] ^= mask.c[i % 4]; } return 1; }