| 1 | /* |
| 2 | * QEMU VNC display driver -- clipboard support |
| 3 | * |
| 4 | * Copyright (C) 2021 Gerd Hoffmann <kraxel@redhat.com> |
| 5 | * |
| 6 | * Permission is hereby granted, free of charge, to any person obtaining a copy |
| 7 | * of this software and associated documentation files (the "Software"), to deal |
| 8 | * in the Software without restriction, including without limitation the rights |
| 9 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell |
| 10 | * copies of the Software, and to permit persons to whom the Software is |
| 11 | * furnished to do so, subject to the following conditions: |
| 12 | * |
| 13 | * The above copyright notice and this permission notice shall be included in |
| 14 | * all copies or substantial portions of the Software. |
| 15 | * |
| 16 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR |
| 17 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, |
| 18 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL |
| 19 | * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER |
| 20 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, |
| 21 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN |
| 22 | * THE SOFTWARE. |
| 23 | */ |
| 24 | |
| 25 | #include "qemu/osdep.h" |
| 26 | #include "qemu/error-report.h" |
| 27 | #include "vnc.h" |
| 28 | #include "vnc-jobs.h" |
| 29 | |
| 30 | static uint8_t *inflate_buffer(uint8_t *in, uint32_t in_len, uint32_t *size) |
| 31 | { |
| 32 | z_stream stream = { |
| 33 | .next_in = in, |
| 34 | .avail_in = in_len, |
| 35 | .zalloc = Z_NULL, |
| 36 | .zfree = Z_NULL, |
| 37 | }; |
| 38 | uint32_t out_len = 8; |
| 39 | uint8_t *out = g_malloc(out_len); |
| 40 | int ret; |
| 41 | |
| 42 | stream.next_out = out + stream.total_out; |
| 43 | stream.avail_out = out_len - stream.total_out; |
| 44 | |
| 45 | ret = inflateInit(&stream); |
| 46 | if (ret != Z_OK) { |
| 47 | goto err; |
| 48 | } |
| 49 | |
| 50 | while (stream.avail_in) { |
| 51 | ret = inflate(&stream, Z_FINISH); |
| 52 | switch (ret) { |
| 53 | case Z_OK: |
| 54 | break; |
| 55 | case Z_STREAM_END: |
| 56 | *size = stream.total_out; |
| 57 | inflateEnd(&stream); |
| 58 | return out; |
| 59 | case Z_BUF_ERROR: |
| 60 | out_len <<= 1; |
| 61 | if (out_len > (1 << 20)) { |
| 62 | goto err_end; |
| 63 | } |
| 64 | out = g_realloc(out, out_len); |
| 65 | stream.next_out = out + stream.total_out; |
| 66 | stream.avail_out = out_len - stream.total_out; |
| 67 | break; |
| 68 | default: |
| 69 | goto err_end; |
| 70 | } |
| 71 | } |
| 72 | |
| 73 | *size = stream.total_out; |
| 74 | inflateEnd(&stream); |
| 75 | |
| 76 | return out; |
| 77 | |
| 78 | err_end: |
| 79 | inflateEnd(&stream); |
| 80 | err: |
| 81 | g_free(out); |
| 82 | return NULL; |
| 83 | } |
| 84 | |
| 85 | static uint8_t *deflate_buffer(uint8_t *in, uint32_t in_len, uint32_t *size) |
| 86 | { |
| 87 | z_stream stream = { |
| 88 | .next_in = in, |
| 89 | .avail_in = in_len, |
| 90 | .zalloc = Z_NULL, |
| 91 | .zfree = Z_NULL, |
| 92 | }; |
| 93 | uint32_t out_len = 8; |
| 94 | uint8_t *out = g_malloc(out_len); |
| 95 | int ret; |
| 96 | |
| 97 | stream.next_out = out + stream.total_out; |
| 98 | stream.avail_out = out_len - stream.total_out; |
| 99 | |
| 100 | ret = deflateInit(&stream, Z_DEFAULT_COMPRESSION); |
| 101 | if (ret != Z_OK) { |
| 102 | goto err; |
| 103 | } |
| 104 | |
| 105 | while (ret != Z_STREAM_END) { |
| 106 | ret = deflate(&stream, Z_FINISH); |
| 107 | switch (ret) { |
| 108 | case Z_OK: |
| 109 | case Z_STREAM_END: |
| 110 | break; |
| 111 | case Z_BUF_ERROR: |
| 112 | out_len <<= 1; |
| 113 | if (out_len > (1 << 20)) { |
| 114 | goto err_end; |
| 115 | } |
| 116 | out = g_realloc(out, out_len); |
| 117 | stream.next_out = out + stream.total_out; |
| 118 | stream.avail_out = out_len - stream.total_out; |
| 119 | break; |
| 120 | default: |
| 121 | goto err_end; |
| 122 | } |
| 123 | } |
| 124 | |
| 125 | *size = stream.total_out; |
| 126 | deflateEnd(&stream); |
| 127 | |
| 128 | return out; |
| 129 | |
| 130 | err_end: |
| 131 | deflateEnd(&stream); |
| 132 | err: |
| 133 | g_free(out); |
| 134 | return NULL; |
| 135 | } |
| 136 | |
| 137 | static void vnc_clipboard_send(VncState *vs, uint32_t count, uint32_t *dwords) |
| 138 | { |
| 139 | int i; |
| 140 | |
| 141 | vnc_lock_output(vs); |
| 142 | vnc_write_u8(vs, VNC_MSG_SERVER_CUT_TEXT); |
| 143 | vnc_write_u8(vs, 0); |
| 144 | vnc_write_u8(vs, 0); |
| 145 | vnc_write_u8(vs, 0); |
| 146 | vnc_write_s32(vs, -(count * sizeof(uint32_t))); /* -(message length) */ |
| 147 | for (i = 0; i < count; i++) { |
| 148 | vnc_write_u32(vs, dwords[i]); |
| 149 | } |
| 150 | vnc_unlock_output(vs); |
| 151 | vnc_flush(vs); |
| 152 | } |
| 153 | |
| 154 | static void vnc_clipboard_provide(VncState *vs, |
| 155 | QemuClipboardInfo *info, |
| 156 | QemuClipboardType type) |
| 157 | { |
| 158 | uint32_t flags = 0; |
| 159 | g_autofree uint8_t *buf = NULL; |
| 160 | g_autofree void *zbuf = NULL; |
| 161 | uint32_t zsize; |
| 162 | |
| 163 | switch (type) { |
| 164 | case QEMU_CLIPBOARD_TYPE_TEXT: |
| 165 | flags |= VNC_CLIPBOARD_TEXT; |
| 166 | break; |
| 167 | default: |
| 168 | return; |
| 169 | } |
| 170 | flags |= VNC_CLIPBOARD_PROVIDE; |
| 171 | |
| 172 | buf = g_malloc(info->types[type].size + 4); |
| 173 | buf[0] = (info->types[type].size >> 24) & 0xff; |
| 174 | buf[1] = (info->types[type].size >> 16) & 0xff; |
| 175 | buf[2] = (info->types[type].size >> 8) & 0xff; |
| 176 | buf[3] = (info->types[type].size >> 0) & 0xff; |
| 177 | memcpy(buf + 4, info->types[type].data, info->types[type].size); |
| 178 | zbuf = deflate_buffer(buf, info->types[type].size + 4, &zsize); |
| 179 | if (!zbuf) { |
| 180 | return; |
| 181 | } |
| 182 | |
| 183 | vnc_lock_output(vs); |
| 184 | vnc_write_u8(vs, VNC_MSG_SERVER_CUT_TEXT); |
| 185 | vnc_write_u8(vs, 0); |
| 186 | vnc_write_u8(vs, 0); |
| 187 | vnc_write_u8(vs, 0); |
| 188 | vnc_write_s32(vs, -(sizeof(uint32_t) + zsize)); /* -(message length) */ |
| 189 | vnc_write_u32(vs, flags); |
| 190 | vnc_write(vs, zbuf, zsize); |
| 191 | vnc_unlock_output(vs); |
| 192 | vnc_flush(vs); |
| 193 | } |
| 194 | |
| 195 | static void vnc_clipboard_update_info(VncState *vs, QemuClipboardInfo *info) |
| 196 | { |
| 197 | QemuClipboardType type; |
| 198 | bool self_update = info->owner == &vs->cbpeer; |
| 199 | uint32_t flags = 0; |
| 200 | |
| 201 | if (info != vs->cbinfo) { |
| 202 | qemu_clipboard_info_unref(vs->cbinfo); |
| 203 | vs->cbinfo = qemu_clipboard_info_ref(info); |
| 204 | vs->cbpending = 0; |
| 205 | if (!self_update) { |
| 206 | if (info->types[QEMU_CLIPBOARD_TYPE_TEXT].available) { |
| 207 | flags |= VNC_CLIPBOARD_TEXT; |
| 208 | } |
| 209 | flags |= VNC_CLIPBOARD_NOTIFY; |
| 210 | vnc_clipboard_send(vs, 1, &flags); |
| 211 | } |
| 212 | return; |
| 213 | } |
| 214 | |
| 215 | if (self_update) { |
| 216 | return; |
| 217 | } |
| 218 | |
| 219 | for (type = 0; type < QEMU_CLIPBOARD_TYPE__COUNT; type++) { |
| 220 | if (vs->cbpending & (1 << type)) { |
| 221 | vs->cbpending &= ~(1 << type); |
| 222 | vnc_clipboard_provide(vs, info, type); |
| 223 | } |
| 224 | } |
| 225 | } |
| 226 | |
| 227 | static void vnc_clipboard_notify(Notifier *notifier, void *data) |
| 228 | { |
| 229 | VncState *vs = container_of(notifier, VncState, cbpeer.notifier); |
| 230 | QemuClipboardNotify *notify = data; |
| 231 | |
| 232 | switch (notify->type) { |
| 233 | case QEMU_CLIPBOARD_UPDATE_INFO: |
| 234 | vnc_clipboard_update_info(vs, notify->info); |
| 235 | return; |
| 236 | case QEMU_CLIPBOARD_RESET_SERIAL: |
| 237 | /* ignore */ |
| 238 | return; |
| 239 | } |
| 240 | } |
| 241 | |
| 242 | static void vnc_clipboard_request(QemuClipboardInfo *info, |
| 243 | QemuClipboardType type) |
| 244 | { |
| 245 | VncState *vs = container_of(info->owner, VncState, cbpeer); |
| 246 | uint32_t flags = 0; |
| 247 | |
| 248 | if (type == QEMU_CLIPBOARD_TYPE_TEXT) { |
| 249 | flags |= VNC_CLIPBOARD_TEXT; |
| 250 | } |
| 251 | if (!flags) { |
| 252 | return; |
| 253 | } |
| 254 | flags |= VNC_CLIPBOARD_REQUEST; |
| 255 | |
| 256 | vnc_clipboard_send(vs, 1, &flags); |
| 257 | } |
| 258 | |
| 259 | void vnc_client_cut_text_ext(VncState *vs, int32_t len, uint32_t flags, uint8_t *data) |
| 260 | { |
| 261 | if (flags & VNC_CLIPBOARD_CAPS) { |
| 262 | /* need store caps somewhere ? */ |
| 263 | return; |
| 264 | } |
| 265 | |
| 266 | if (flags & VNC_CLIPBOARD_NOTIFY) { |
| 267 | QemuClipboardInfo *info = |
| 268 | qemu_clipboard_info_new(&vs->cbpeer, QEMU_CLIPBOARD_SELECTION_CLIPBOARD); |
| 269 | if (flags & VNC_CLIPBOARD_TEXT) { |
| 270 | info->types[QEMU_CLIPBOARD_TYPE_TEXT].available = true; |
| 271 | } |
| 272 | qemu_clipboard_update(info); |
| 273 | qemu_clipboard_info_unref(info); |
| 274 | return; |
| 275 | } |
| 276 | |
| 277 | if (flags & VNC_CLIPBOARD_PROVIDE && |
| 278 | vs->cbinfo && |
| 279 | vs->cbinfo->owner == &vs->cbpeer) { |
| 280 | uint32_t size = 0; |
| 281 | g_autofree uint8_t *buf = inflate_buffer(data, len - 4, &size); |
| 282 | if ((flags & VNC_CLIPBOARD_TEXT) && |
| 283 | buf && size >= 4) { |
| 284 | uint32_t tsize = read_u32(buf, 0); |
| 285 | uint8_t *tbuf = buf + 4; |
| 286 | if (tsize <= size - 4) { |
| 287 | qemu_clipboard_set_data(&vs->cbpeer, vs->cbinfo, |
| 288 | QEMU_CLIPBOARD_TYPE_TEXT, |
| 289 | tsize, tbuf, true); |
| 290 | } else { |
| 291 | error_report("vnc: malformed extended clipboard payload " |
| 292 | "with text length %u exceeding available %u", |
| 293 | tsize, size - 4); |
| 294 | vnc_client_error(vs); |
| 295 | return; |
| 296 | } |
| 297 | } |
| 298 | } |
| 299 | |
| 300 | if (flags & VNC_CLIPBOARD_REQUEST && |
| 301 | vs->cbinfo && |
| 302 | vs->cbinfo->owner != &vs->cbpeer) { |
| 303 | if ((flags & VNC_CLIPBOARD_TEXT) && |
| 304 | vs->cbinfo->types[QEMU_CLIPBOARD_TYPE_TEXT].available) { |
| 305 | if (vs->cbinfo->types[QEMU_CLIPBOARD_TYPE_TEXT].data) { |
| 306 | vnc_clipboard_provide(vs, vs->cbinfo, QEMU_CLIPBOARD_TYPE_TEXT); |
| 307 | } else { |
| 308 | vs->cbpending |= (1 << QEMU_CLIPBOARD_TYPE_TEXT); |
| 309 | qemu_clipboard_request(vs->cbinfo, QEMU_CLIPBOARD_TYPE_TEXT); |
| 310 | } |
| 311 | } |
| 312 | } |
| 313 | } |
| 314 | |
| 315 | void vnc_client_cut_text(VncState *vs, size_t len, uint8_t *text) |
| 316 | { |
| 317 | QemuClipboardInfo *info = |
| 318 | qemu_clipboard_info_new(&vs->cbpeer, QEMU_CLIPBOARD_SELECTION_CLIPBOARD); |
| 319 | |
| 320 | qemu_clipboard_set_data(&vs->cbpeer, info, QEMU_CLIPBOARD_TYPE_TEXT, |
| 321 | len, text, true); |
| 322 | qemu_clipboard_info_unref(info); |
| 323 | } |
| 324 | |
| 325 | void vnc_server_cut_text_caps(VncState *vs) |
| 326 | { |
| 327 | uint32_t caps[2]; |
| 328 | |
| 329 | if (!vnc_has_feature(vs, VNC_FEATURE_CLIPBOARD_EXT)) { |
| 330 | return; |
| 331 | } |
| 332 | |
| 333 | caps[0] = (VNC_CLIPBOARD_PROVIDE | |
| 334 | VNC_CLIPBOARD_NOTIFY | |
| 335 | VNC_CLIPBOARD_REQUEST | |
| 336 | VNC_CLIPBOARD_CAPS | |
| 337 | VNC_CLIPBOARD_TEXT); |
| 338 | caps[1] = 0; |
| 339 | vnc_clipboard_send(vs, 2, caps); |
| 340 | |
| 341 | if (!vs->cbpeer.notifier.notify) { |
| 342 | vs->cbpeer.name = "vnc"; |
| 343 | vs->cbpeer.notifier.notify = vnc_clipboard_notify; |
| 344 | vs->cbpeer.request = vnc_clipboard_request; |
| 345 | qemu_clipboard_peer_register(&vs->cbpeer); |
| 346 | } |
| 347 | } |