aboutsummaryrefslogtreecommitdiff
path: root/ui
AgeCommit message (Collapse)AuthorFilesLines
2015-04-27spice: set pointer position on hotspotMarc-André Lureau1-4/+6
The Spice protocol uses cursor position on hotspot: the client is applying hotspot offset when drawing the cursor. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-04-27spice: fix mouse cursor positionMarc-André Lureau1-1/+1
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-04-27spice: fix simple display on bigendian hostsGerd Hoffmann1-1/+1
Denis Kirjanov is busy getting spice run on ppc64 and trapped into this one. Spice wire format is little endian, so we have to explicitly say we want little endian when letting pixman convert the data for us. Reported-by: Denis Kirjanov <kirjanov@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-04-27monitor: Make client_migrate_info synchronousMarkus Armbruster1-21/+5
Live migration with spice works like this today: (1) client_migrate_info monitor cmd (2) spice server notifies client, client connects to target host. (3) qemu waits until spice client connect is finished. (4) send over vmstate (i.e. main part of live migration). (5) spice handover to target host. (3) is implemented by making client_migrate_info a async monitor command. This is the only async monitor command we have. The original reason to implement this dance was that qemu did not accept new tcp connections while the incoming migration was running, so (2) and (4) could not be done in parallel. That issue was fixed long ago though. Qemu version 1.3.0 (released Dec 2012) and newer happily accept tcp connects while the incoming migration runs. Time to drop step (3). This patch does exactly that, by making the monitor command synchronous and removing the code needed to handle the async monitor command in ui/spice-core.c Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-04-01CVE-2015-1779: limit size of HTTP headers from websockets clientsDaniel P. Berrange1-2/+8
The VNC server websockets decoder will read and buffer data from websockets clients until it sees the end of the HTTP headers, as indicated by \r\n\r\n. In theory this allows a malicious to trick QEMU into consuming an arbitrary amount of RAM. In practice, because QEMU runs g_strstr_len() across the buffered header data, it will spend increasingly long burning CPU time searching for the substring match and less & less time reading data. So while this does cause arbitrary memory growth, the bigger problem is that QEMU will be burning 100% of available CPU time. A novnc websockets client typically sends headers of around 512 bytes in length. As such it is reasonable to place a 4096 byte limit on the amount of data buffered while searching for the end of HTTP headers. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-04-01CVE-2015-1779: incrementally decode websocket framesDaniel P. Berrange3-36/+80
The logic for decoding websocket frames wants to fully decode the frame header and payload, before allowing the VNC server to see any of the payload data. There is no size limit on websocket payloads, so this allows a malicious network client to consume 2^64 bytes in memory in QEMU. It can trigger this denial of service before the VNC server even performs any authentication. The fix is to decode the header, and then incrementally decode the payload data as it is needed. With this fix the websocket decoder will allow at most 4k of data to be buffered before decoding and processing payload. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> [ kraxel: fix frequent spurious disconnects, suggested by Peter Maydell ] @@ -361,7 +361,7 @@ int vncws_decode_frame_payload(Buffer *input, - *payload_size = input->offset; + *payload_size = *payload_remain; [ kraxel: fix 32bit build ] @@ -306,7 +306,7 @@ struct VncState - uint64_t ws_payload_remain; + size_t ws_payload_remain; Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-26gtk: do not call gtk_widget_get_window if drawing area is not initializedHervé Poussineau1-0/+12
This prevents gtk_widget_get_window to return a NULL pointer. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-18ui: ensure VNC websockets server checks the ACL if requestedDaniel P. Berrange1-0/+10
If the x509verify option is requested, the VNC websockets server was failing to validate that the websockets client provided an x509 certificate matching the ACL rules. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-18ui: remove separate gnutls_session for websockets serverDaniel P. Berrange4-62/+33
The previous change to the auth scheme handling guarantees we can never have nested TLS sessions in the VNC websockets server. Thus we can remove the separate gnutls_session instance. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-18ui: enforce TLS when using websockets serverDaniel P. Berrange3-26/+9
When TLS is required, the primary VNC server considers it to be mandatory. ie the server admin decides whether or not TLS is used, and the client has to comply with this decision. The websockets server, however, treated it as optional, allowing non-TLS clients to connect to a server which had setup TLS. Thus enabling websockets lowers the security of the VNC server leaving the admin no way to enforce use of TLS. This removes the code that allows non-TLS fallback in the websockets server, so that if TLS is requested for VNC it is now mandatory for both the primary VNC server and the websockets VNC server. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-18ui: fix setup of VNC websockets auth scheme with TLSDaniel P. Berrange2-5/+52
The way the websockets TLS code was integrated into the VNC server made it essentially useless. The only time that the websockets TLS support could be used is if the primary VNC server had its existing TLS support disabled. ie QEMU had to be launched with: # qemu -vnc localhost:1,websockets=5902,x509=/path/to/certs Note the absence of the 'tls' flag. This is already a bug, because the docs indicate that 'x509' is ignored unless 'tls' is given. If the primary VNC server had TLS turned on via the 'tls' flag, then this prevented the websockets TLS support from being used, because it activates the VeNCrypt auth which would have resulted in TLS being run over a TLS session. Of course no websockets VNC client supported VeNCrypt so in practice, since the browser clients cannot setup a nested TLS session over the main HTTPS connection, so it would not even get past auth. This patch causes us to decide our auth scheme separately for the main VNC server vs the websockets VNC server. We take account of the fact that if TLS is enabled, then the websockets client will use https, so setting up VeNCrypt is thus redundant as it would lead to nested TLS sessions. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-18ui: split setup of VNC auth scheme into separate methodDaniel P. Berrange1-62/+91
The vnc_display_open method is quite long and complex, so move the VNC auth scheme decision logic into a separate method for clarity. Also update the comment to better describe what we are trying to achieve. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-18ui: report error if user requests VNC option that is unsupportedDaniel P. Berrange2-32/+23
If the VNC server is built without tls, sasl or websocket support and the user requests one of these features, they are just silently ignored. This is bad because it means the VNC server ends up running in a configuration that is less secure than the user asked for. It also leads to an tangled mass of preprocessor conditionals when configuring the VNC server. This ensures that the tls, sasl & websocket options are always processed and an error is reported back to the user if any of them were disabled at build time. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-18ui: replace printf() calls with VNC_DEBUGDaniel P. Berrange1-6/+6
Handling of VNC audio messages results in printfs to the console. This is of no use to anyone in production, so should be using the normal VNC_DEBUG macro instead. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-18ui: remove unused 'wiremode' variable in VncState structDaniel P. Berrange4-11/+0
Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-17vnc: Fix QMP change not to use funky error classMarkus Armbruster1-1/+1
Error classes are a leftover from the days of "rich" error objects. New code should always use ERROR_CLASS_GENERIC_ERROR. Commit 1d0d59f added a use of ERROR_CLASS_DEVICE_NOT_FOUND. Replace it. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-13Merge remote-tracking branch 'remotes/kraxel/tags/pull-sdl-20150312-2' into ↵Peter Maydell1-3/+24
staging misc ui patches, mostly sdl related. # gpg: Signature made Thu Mar 12 14:51:07 2015 GMT using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-sdl-20150312-2: pixman: add a bunch of PIXMAN_BE_* defines for 32bpp Allow the use of X11 from a non standard location. configure: opengl overhaul sdl: Fix crash when calling sdl_switch() with NULL surface sdl: Refresh debug statements Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-03-12sdl: Fix crash when calling sdl_switch() with NULL surfaceBenjamin Herrenschmidt1-1/+2
This happens for example when doing ctrl-alt-u and segfaults Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-12sdl: Refresh debug statementsBenjamin Herrenschmidt1-2/+22
Put them under a #define similar to the VGA model and make them actually compile. Add a couple too. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-12vnc: fix segmentation fault when invalid vnc parameters are specifiedGonglei1-1/+6
Reproducer: #./qemu-system-x86_64 -vnc :0,ip qemu-system-x86_64: -vnc :1,ip: Invalid parameter 'ip' Segmentation fault (core dumped) Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-12vnc: avoid possible file handler leakGonglei1-1/+1
vs->lsock may equal to 0, modify the check condition, avoid possible vs->lsock leak. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-12ui/console: fix OVERFLOW_BEFORE_WIDENGonglei1-2/+2
Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-12ui: fix regression in x509verify parameter for VNC serverDaniel P. Berrange1-2/+7
The 'x509verify' parameter is documented as taking a path to the x509 certificates, ie the same syntax as the 'x509' parameter. commit 4db14629c38611061fc19ec6927405923de84f08 Author: Gerd Hoffmann <kraxel@redhat.com> Date: Tue Sep 16 12:33:03 2014 +0200 vnc: switch to QemuOpts, allow multiple servers caused a regression by turning 'x509verify' into a boolean parameter instead. This breaks setup from libvirt and is not consistent with the docs. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-12vnc: switch to inet_listen_optsGerd Hoffmann1-34/+41
Use inet_listen_opts instead of inet_listen. Allows us to drop some pointless indirection: Format strings just to parse them again later on. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Tested-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Gonglei <arei.gonglei@huawei.com>
2015-03-12vnc: remove dead codeGerd Hoffmann1-7/+2
If vs->ws_enabled is set ws_display is non-NULL. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Gonglei <arei.gonglei@huawei.com>
2015-03-12vnc: drop display+ws_display from VncDisplayGerd Hoffmann3-35/+27
Nobody cares about those strings, they are only used to check whenever the vnc server / websocket support is enabled or not. Add bools for this and drop the strings. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Gonglei <arei.gonglei@huawei.com>
2015-03-10Merge remote-tracking branch 'remotes/kraxel/tags/pull-vnc-20150310-1' into ↵Peter Maydell2-12/+13
staging vnc bugfixes. # gpg: Signature made Tue Mar 10 10:37:51 2015 GMT using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-vnc-20150310-1: Fix crash when connecting to VNC through websocket vnc: -readconfig fix vnc: set id at parse time not init time Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-03-10Fix crash when connecting to VNC through websocketJorge Acereda Maciá1-2/+1
Connecting to VNC through websocket crashes in vnc_flush() when trying to acquire a mutex that hasn't been initialized (vnc_init_state(vs) hasn't been called at this point). Signed-off-by: Jorge Acereda Macia <jacereda@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-10vnc: set id at parse time not init timeGerd Hoffmann1-10/+12
This way the generated id will be stored in -writeconfig cfg files. Also we can make vnc_auto_assign_id() local to vnc.c. Tested-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-10qemu-char: add cyrillic characters 'numerosign' to VNC keysymsWang Xin1-0/+1
This patch adds missing cyrillic character 'numerosign' to the VNC keysym table, it's needed by Russian keyboard. And I get the keysym from '<X11/keysymdef.h>', the current keysym table in Qemu was generated from it. Signed-off-by: Wang xin <wangxinxin.wang@huawei.com> Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-03-10ui/vnc: Remove vnc_stop_worker_thread()Thomas Huth2-14/+0
This function is not used anymore, let's remove it. Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-03-10ui: Removed unused functionsThomas Huth4-33/+0
Remove qemu_console_displaystate(), qemu_remove_kbd_event_handler(), qemu_different_endianness_pixelformat() and cpkey(), since they are completely unused. Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-02-25Merge remote-tracking branch 'remotes/armbru/tags/pull-monitor-2015-02-18' ↵Peter Maydell1-1/+1
into staging hmp: Normalize HMP command handler names # gpg: Signature made Wed Feb 18 10:59:44 2015 GMT using RSA key ID EB918653 # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" * remotes/armbru/tags/pull-monitor-2015-02-18: hmp: Name HMP info handler functions hmp_info_SUBCOMMAND() hmp: Name HMP command handler functions hmp_COMMAND() hmp: Clean up declarations for long-gone info handlers Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-02-18hmp: Name HMP command handler functions hmp_COMMAND()Markus Armbruster1-1/+1
Some are called do_COMMAND() (old ones, usually), some hmp_COMMAND(), and sometimes COMMAND pointlessly differs in spelling. Normalize to hmp_COMMAND(), where COMMAND is exactly the command name with '-' replaced by '_'. Exceptions: * do_device_add() and client_migrate_info() *not* renamed to hmp_device_add(), hmp_client_migrate_info(), because they're also QMP handlers. They still need to be converted to QAPI. * do_memory_dump(), do_physical_memory_dump(), do_ioport_read(), do_ioport_write() renamed do hmp_* instead of hmp_x(), hmp_xp(), hmp_i(), hmp_o(), because those names are too cryptic for my taste. * do_info_help() renamed to hmp_info_help() instead of hmp_info(), because it only covers help. Signed-off-by: Markus Armbruster <armbru@redhat.com>
2015-02-16vnc: fix coverity warningGerd Hoffmann1-0/+1
vnc_display_local_addr will not be called with an invalid display id. Add assert() to silence coverity warning about a null pointer dereference. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-02-16ui/vnc: optimize full scanline updatesPeter Lieven1-0/+6
in case we send and update for a complete scanline increment the y offset to avoid running to find_next_bit for that lines twice. Signed-off-by: Peter Lieven <pl@kamp.de> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-02-16vnc: introduce an wrapper for auto assign vnc idGonglei1-7/+15
Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-02-16vnc: using bool type instead of int for QEMU_OPT_BOOLGonglei1-5/+5
Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-02-16vnc: correct missing property about vnc_displayGonglei1-3/+23
Missing three property for vnc socket connection, revalue display variable with correct way. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-02-16vnc: fix qemu crash when not configure vnc optionGonglei1-0/+9
Add missing vnc options: to, ipv4, ipv6 and fix qemu crash. Reproducer: $ x86_64-softmmu/qemu-system-x86_64 qemu-system-x86_64: Invalid parameter 'to' Segmentation fault (core dumped) BTW the patch fix the below bug: https://bugs.launchpad.net/qemu/+bug/1414222 Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Don Slutz <dslutz@verizon.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-02-10vnc: g_realloc() can't fail, bury dead error handlingMarkus Armbruster1-4/+0
Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-01-22Merge remote-tracking branch 'remotes/spice/tags/pull-spice-20150122-1' into ↵Peter Maydell2-3/+12
staging spice: fix coverity defect, add unix address support # gpg: Signature made Thu 22 Jan 2015 11:17:24 GMT using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/spice/tags/pull-spice-20150122-1: spice: fix coverity reported defect in display code spice: add unix address support Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-01-22monitor: add vnc websocketsGerd Hoffmann1-3/+12
Add websockets bool to VncBasicInfo, report websocket server sockets, flag websocket client connections. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-01-22monitor: add query-vnc-servers commandGerd Hoffmann1-0/+133
Add new query vnc qmp command, for the lack of better ideas just name it "query-vnc-servers". Changes over query-vnc: * It returns a list of vnc servers, so multiple vnc server instances are covered. * Each vnc server returns a list of server sockets. Followup patch will use that to also report websockets. In case we add support for multiple server sockets server sockets (to better support ipv4+ipv6 dualstack) we can add them to the list too. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-01-22vnc: factor out qmp_query_client_listGerd Hoffmann1-15/+15
so we can reuse it for the new vnc query command. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-01-22vnc: track & limit connectionsGerd Hoffmann2-3/+46
Also track the number of connections in "connecting" and "shared" state (in addition to the "exclusive" state). Apply a configurable limit to these connections. The logic to apply the limit to connections in "shared" state is pretty simple: When the limit is reached no new connections are allowed. The logic to apply the limit to connections in "connecting" state (this is the state you are in *before* successful authentication) is slightly different: A new connect kicks out the oldest client which is still in "connecting" state. This avoids a easy DoS by unauthenticated users by simply opening connections until the limit is reached. Cc: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-01-22vnc: allow binding servers to qemu consolesGerd Hoffmann1-7/+43
This patch adds a display= parameter to the vnc options. This allows to bind a vnc server instance to a specific display, allowing to create a multiseat setup with a vnc server for each seat. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-01-22vnc: switch to QemuOpts, allow multiple serversGerd Hoffmann1-101/+169
This patch switches vnc over to QemuOpts, and it (more or less as side effect) allows multiple vnc server instances. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-01-22vnc: add display id to acl namesGerd Hoffmann1-2/+20
In case the display id is "default" (which is the one you get if you don't explicitly assign one) we keep the old name scheme, without display, for backward compatibility reasons. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Gonglei <arei.gonglei@huawei.com>
2015-01-22vnc: remove unused DisplayState parameter, add id instead.Gerd Hoffmann1-15/+14
DisplayState isn't used anywhere, drop it. Add the vnc server ID as parameter instead, so it is possible to specify the server instance. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Gonglei <arei.gonglei@huawei.com>
generated by cgit v1.1 at 2024-12-26 15:53:59 +0000