[qemu.git] / ui / vnc-ws.c

/*
 * QEMU VNC display driver: Websockets support
 *
 * Copyright (C) 2010 Joel Martin
 * Copyright (C) 2012 Tim Hardeck
 *
 * This is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This software is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this software; if not, see <http://www.gnu.org/licenses/>.
 */

#include "vnc.h"
#include "qemu/main-loop.h"
#include "crypto/hash.h"

static void vncws_handshake_read(VncState *vs);

static void vncws_tls_handshake_done(Object *source,
                                     Error *err,
                                     gpointer user_data)
{
    VncState *vs = user_data;

    if (err) {
        VNC_DEBUG("Handshake failed %s\n", error_get_pretty(err));
        vnc_client_error(vs);
    } else {
        vs->ioc_tag = qio_channel_add_watch(
            QIO_CHANNEL(vs->ioc), G_IO_IN, vncws_handshake_io, vs, NULL);
    }
}


gboolean vncws_tls_handshake_io(QIOChannel *ioc G_GNUC_UNUSED,
                                GIOCondition condition G_GNUC_UNUSED,
                                void *opaque)
{
    VncState *vs = opaque;
    QIOChannelTLS *tls;
    Error *err = NULL;

    VNC_DEBUG("TLS Websocket connection required\n");
    if (vs->ioc_tag) {
        g_source_remove(vs->ioc_tag);
        vs->ioc_tag = 0;
    }

    tls = qio_channel_tls_new_server(
        vs->ioc,
        vs->vd->tlscreds,
        vs->vd->tlsaclname,
        &err);
    if (!tls) {
        VNC_DEBUG("Failed to setup TLS %s\n", error_get_pretty(err));
        error_free(err);
        vnc_client_error(vs);
        return TRUE;
    }

    VNC_DEBUG("Start TLS WS handshake process\n");
    object_unref(OBJECT(vs->ioc));
    vs->ioc = QIO_CHANNEL(tls);
    vs->tls = qio_channel_tls_get_session(tls);

    qio_channel_tls_handshake(tls,
                              vncws_tls_handshake_done,
                              vs,
                              NULL);

    return TRUE;
}

static void vncws_handshake_read(VncState *vs)
{
    uint8_t *handshake_end;
    long ret;
    /* Typical HTTP headers from novnc are 512 bytes, so limiting
     * total header size to 4096 is easily enough. */
    size_t want = 4096 - vs->ws_input.offset;
    buffer_reserve(&vs->ws_input, want);
    ret = vnc_client_read_buf(vs, buffer_end(&vs->ws_input), want);

    if (!ret) {
        if (vs->disconnecting) {
            vnc_disconnect_finish(vs);
        }
        return;
    }
    vs->ws_input.offset += ret;

    handshake_end = (uint8_t *)g_strstr_len((char *)vs->ws_input.buffer,
            vs->ws_input.offset, WS_HANDSHAKE_END);
    if (handshake_end) {
        if (vs->ioc_tag) {
            g_source_remove(vs->ioc_tag);
        }
        vs->ioc_tag = qio_channel_add_watch(
            vs->ioc, G_IO_IN, vnc_client_io, vs, NULL);
        vncws_process_handshake(vs, vs->ws_input.buffer, vs->ws_input.offset);
        buffer_advance(&vs->ws_input, handshake_end - vs->ws_input.buffer +
                strlen(WS_HANDSHAKE_END));
    } else if (vs->ws_input.offset >= 4096) {
        VNC_DEBUG("End of headers not found in first 4096 bytes\n");
        vnc_client_error(vs);
    }
}


gboolean vncws_handshake_io(QIOChannel *ioc G_GNUC_UNUSED,
                            GIOCondition condition G_GNUC_UNUSED,
                            void *opaque)
{
    VncState *vs = opaque;
    vncws_handshake_read(vs);
    return TRUE;
}

long vnc_client_read_ws(VncState *vs)
{
    int ret, err;
    uint8_t *payload;
    size_t payload_size, header_size;
    VNC_DEBUG("Read websocket %p size %zd offset %zd\n", vs->ws_input.buffer,
            vs->ws_input.capacity, vs->ws_input.offset);
    buffer_reserve(&vs->ws_input, 4096);
    ret = vnc_client_read_buf(vs, buffer_end(&vs->ws_input), 4096);
    if (!ret) {
        return 0;
    }
    vs->ws_input.offset += ret;

    ret = 0;
    /* consume as much of ws_input buffer as possible */
    do {
        if (vs->ws_payload_remain == 0) {
            err = vncws_decode_frame_header(&vs->ws_input,
                                            &header_size,
                                            &vs->ws_payload_remain,
                                            &vs->ws_payload_mask);
            if (err <= 0) {
                return err;
            }

            buffer_advance(&vs->ws_input, header_size);
        }
        if (vs->ws_payload_remain != 0) {
            err = vncws_decode_frame_payload(&vs->ws_input,
                                             &vs->ws_payload_remain,
                                             &vs->ws_payload_mask,
                                             &payload,
                                             &payload_size);
            if (err < 0) {
                return err;
            }
            if (err == 0) {
                return ret;
            }
            ret += err;

            buffer_reserve(&vs->input, payload_size);
            buffer_append(&vs->input, payload, payload_size);

            buffer_advance(&vs->ws_input, payload_size);
        }
    } while (vs->ws_input.offset > 0);

    return ret;
}

long vnc_client_write_ws(VncState *vs)
{
    long ret;
    VNC_DEBUG("Write WS: Pending output %p size %zd offset %zd\n",
              vs->output.buffer, vs->output.capacity, vs->output.offset);
    vncws_encode_frame(&vs->ws_output, vs->output.buffer, vs->output.offset);
    buffer_reset(&vs->output);
    ret = vnc_client_write_buf(vs, vs->ws_output.buffer, vs->ws_output.offset);
    if (!ret) {
        return 0;
    }

    buffer_advance(&vs->ws_output, ret);

    if (vs->ws_output.offset == 0) {
        if (vs->ioc_tag) {
            g_source_remove(vs->ioc_tag);
        }
        vs->ioc_tag = qio_channel_add_watch(
            vs->ioc, G_IO_IN, vnc_client_io, vs, NULL);
    }

    return ret;
}

static char *vncws_extract_handshake_entry(const char *handshake,
        size_t handshake_len, const char *name)
{
    char *begin, *end, *ret = NULL;
    char *line = g_strdup_printf("%s%s: ", WS_HANDSHAKE_DELIM, name);
    begin = g_strstr_len(handshake, handshake_len, line);
    if (begin != NULL) {
        begin += strlen(line);
        end = g_strstr_len(begin, handshake_len - (begin - handshake),
                WS_HANDSHAKE_DELIM);
        if (end != NULL) {
            ret = g_strndup(begin, end - begin);
        }
    }
    g_free(line);
    return ret;
}

static void vncws_send_handshake_response(VncState *vs, const char* key)
{
    char combined_key[WS_CLIENT_KEY_LEN + WS_GUID_LEN + 1];
    char *accept = NULL, *response = NULL;
    Error *err = NULL;

    g_strlcpy(combined_key, key, WS_CLIENT_KEY_LEN + 1);
    g_strlcat(combined_key, WS_GUID, WS_CLIENT_KEY_LEN + WS_GUID_LEN + 1);

    /* hash and encode it */
    if (qcrypto_hash_base64(QCRYPTO_HASH_ALG_SHA1,
                            combined_key,
                            WS_CLIENT_KEY_LEN + WS_GUID_LEN,
                            &accept,
                            &err) < 0) {
        VNC_DEBUG("Hashing Websocket combined key failed %s\n",
                  error_get_pretty(err));
        error_free(err);
        vnc_client_error(vs);
        return;
    }

    response = g_strdup_printf(WS_HANDSHAKE, accept);
    vnc_client_write_buf(vs, (const uint8_t *)response, strlen(response));

    g_free(accept);
    g_free(response);

    vs->encode_ws = 1;
    vnc_init_state(vs);
}

void vncws_process_handshake(VncState *vs, uint8_t *line, size_t size)
{
    char *protocols = vncws_extract_handshake_entry((const char *)line, size,
            "Sec-WebSocket-Protocol");
    char *version = vncws_extract_handshake_entry((const char *)line, size,
            "Sec-WebSocket-Version");
    char *key = vncws_extract_handshake_entry((const char *)line, size,
            "Sec-WebSocket-Key");

    if (protocols && version && key
            && g_strrstr(protocols, "binary")
            && !strcmp(version, WS_SUPPORTED_VERSION)
            && strlen(key) == WS_CLIENT_KEY_LEN) {
        vncws_send_handshake_response(vs, key);
    } else {
        VNC_DEBUG("Defective Websockets header or unsupported protocol\n");
        vnc_client_error(vs);
    }

    g_free(protocols);
    g_free(version);
    g_free(key);
}

void vncws_encode_frame(Buffer *output, const void *payload,
        const size_t payload_size)
{
    size_t header_size = 0;
    unsigned char opcode = WS_OPCODE_BINARY_FRAME;
    union {
        char buf[WS_HEAD_MAX_LEN];
        WsHeader ws;
    } header;

    if (!payload_size) {
        return;
    }

    header.ws.b0 = 0x80 | (opcode & 0x0f);
    if (payload_size <= 125) {
        header.ws.b1 = (uint8_t)payload_size;
        header_size = 2;
    } else if (payload_size < 65536) {
        header.ws.b1 = 0x7e;
        header.ws.u.s16.l16 = cpu_to_be16((uint16_t)payload_size);
        header_size = 4;
    } else {
        header.ws.b1 = 0x7f;
        header.ws.u.s64.l64 = cpu_to_be64(payload_size);
        header_size = 10;
    }

    buffer_reserve(output, header_size + payload_size);
    buffer_append(output, header.buf, header_size);
    buffer_append(output, payload, payload_size);
}

int vncws_decode_frame_header(Buffer *input,
                              size_t *header_size,
                              size_t *payload_remain,
                              WsMask *payload_mask)
{
    unsigned char opcode = 0, fin = 0, has_mask = 0;
    size_t payload_len;
    WsHeader *header = (WsHeader *)input->buffer;

    if (input->offset < WS_HEAD_MIN_LEN + 4) {
        /* header not complete */
        return 0;
    }

    fin = (header->b0 & 0x80) >> 7;
    opcode = header->b0 & 0x0f;
    has_mask = (header->b1 & 0x80) >> 7;
    payload_len = header->b1 & 0x7f;

    if (opcode == WS_OPCODE_CLOSE) {
        /* disconnect */
        return -1;
    }

    /* Websocket frame sanity check:
     * * Websocket fragmentation is not supported.
     * * All  websockets frames sent by a client have to be masked.
     * * Only binary encoding is supported.
     */
    if (!fin || !has_mask || opcode != WS_OPCODE_BINARY_FRAME) {
        VNC_DEBUG("Received faulty/unsupported Websocket frame\n");
        return -2;
    }

    if (payload_len < 126) {
        *payload_remain = payload_len;
        *header_size = 6;
        *payload_mask = header->u.m;
    } else if (payload_len == 126 && input->offset >= 8) {
        *payload_remain = be16_to_cpu(header->u.s16.l16);
        *header_size = 8;
        *payload_mask = header->u.s16.m16;
    } else if (payload_len == 127 && input->offset >= 14) {
        *payload_remain = be64_to_cpu(header->u.s64.l64);
        *header_size = 14;
        *payload_mask = header->u.s64.m64;
    } else {
        /* header not complete */
        return 0;
    }

    return 1;
}

int vncws_decode_frame_payload(Buffer *input,
                               size_t *payload_remain, WsMask *payload_mask,
                               uint8_t **payload, size_t *payload_size)
{
    size_t i;
    uint32_t *payload32;

    *payload = input->buffer;
    /* If we aren't at the end of the payload, then drop
     * off the last bytes, so we're always multiple of 4
     * for purpose of unmasking, except at end of payload
     */
    if (input->offset < *payload_remain) {
        *payload_size = input->offset - (input->offset % 4);
    } else {
        *payload_size = *payload_remain;
    }
    if (*payload_size == 0) {
        return 0;
    }
    *payload_remain -= *payload_size;

    /* unmask frame */
    /* process 1 frame (32 bit op) */
    payload32 = (uint32_t *)(*payload);
    for (i = 0; i < *payload_size / 4; i++) {
        payload32[i] ^= payload_mask->u;
    }
    /* process the remaining bytes (if any) */
    for (i *= 4; i < *payload_size; i++) {
        (*payload)[i] ^= payload_mask->c[i % 4];
    }

    return 1;
}
Commit	Line	Data
7536ee4b TH	1	/*
	2	* QEMU VNC display driver: Websockets support
	3	*
	4	* Copyright (C) 2010 Joel Martin
	5	* Copyright (C) 2012 Tim Hardeck
	6	*
	7	* This is free software; you can redistribute it and/or modify
	8	* it under the terms of the GNU General Public License as published by
	9	* the Free Software Foundation; either version 2 of the License, or
	10	* (at your option) any later version.
	11	*
	12	* This software is distributed in the hope that it will be useful,
	13	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	14	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	15	* GNU General Public License for more details.
	16	*
	17	* You should have received a copy of the GNU General Public License
	18	* along with this software; if not, see <http://www.gnu.org/licenses/>.
	19	*/
	20
	21	#include "vnc.h"
6a1751b7	22	#include "qemu/main-loop.h"
8e9b0d24	23	#include "crypto/hash.h"
7536ee4b	24
2cc45228	25	static void vncws_handshake_read(VncState *vs);
0057a0d5	26
2cc45228 DB	27	static void vncws_tls_handshake_done(Object *source,
	28	Error *err,
	29	gpointer user_data)
	30	{
	31	VncState *vs = user_data;
4a48aaa9	32
2cc45228 DB	33	if (err) {
	34	VNC_DEBUG("Handshake failed %s\n", error_get_pretty(err));
	35	vnc_client_error(vs);
	36	} else {
04d2529d	37	vs->ioc_tag = qio_channel_add_watch(
2cc45228	38	QIO_CHANNEL(vs->ioc), G_IO_IN, vncws_handshake_io, vs, NULL);
3e305e4a	39	}
0057a0d5 TH	40	}
0057a0d5 TH	41
2cc45228	42
04d2529d DB	43	gboolean vncws_tls_handshake_io(QIOChannel *ioc G_GNUC_UNUSED,
	44	GIOCondition condition G_GNUC_UNUSED,
	45	void *opaque)
0057a0d5	46	{
2cc45228 DB	47	VncState *vs = opaque;
2cc45228 DB	48	QIOChannelTLS *tls;
3e305e4a	49	Error *err = NULL;
0057a0d5	50
2cc45228 DB	51	VNC_DEBUG("TLS Websocket connection required\n");
	52	if (vs->ioc_tag) {
	53	g_source_remove(vs->ioc_tag);
	54	vs->ioc_tag = 0;
	55	}
	56
	57	tls = qio_channel_tls_new_server(
	58	vs->ioc,
	59	vs->vd->tlscreds,
	60	vs->vd->tlsaclname,
	61	&err);
	62	if (!tls) {
	63	VNC_DEBUG("Failed to setup TLS %s\n", error_get_pretty(err));
3e305e4a DB	64	error_free(err);
3e305e4a DB	65	vnc_client_error(vs);
04d2529d	66	return TRUE;
0057a0d5	67	}
3e305e4a	68
3e305e4a	69	VNC_DEBUG("Start TLS WS handshake process\n");
2cc45228 DB	70	object_unref(OBJECT(vs->ioc));
	71	vs->ioc = QIO_CHANNEL(tls);
	72	vs->tls = qio_channel_tls_get_session(tls);
	73
	74	qio_channel_tls_handshake(tls,
	75	vncws_tls_handshake_done,
	76	vs,
	77	NULL);
	78
04d2529d	79	return TRUE;
0057a0d5	80	}
0057a0d5	81
04d2529d	82	static void vncws_handshake_read(VncState *vs)
7536ee4b	83	{
7536ee4b TH	84	uint8_t *handshake_end;
7536ee4b TH	85	long ret;
2cdb5e14 DB	86	/* Typical HTTP headers from novnc are 512 bytes, so limiting
	87	* total header size to 4096 is easily enough. */
	88	size_t want = 4096 - vs->ws_input.offset;
	89	buffer_reserve(&vs->ws_input, want);
	90	ret = vnc_client_read_buf(vs, buffer_end(&vs->ws_input), want);
7536ee4b TH	91
7536ee4b TH	92	if (!ret) {
04d2529d	93	if (vs->disconnecting) {
7536ee4b TH	94	vnc_disconnect_finish(vs);
	95	}
	96	return;
	97	}
	98	vs->ws_input.offset += ret;
	99
	100	handshake_end = (uint8_t )g_strstr_len((char )vs->ws_input.buffer,
	101	vs->ws_input.offset, WS_HANDSHAKE_END);
	102	if (handshake_end) {
04d2529d DB	103	if (vs->ioc_tag) {
	104	g_source_remove(vs->ioc_tag);
	105	}
	106	vs->ioc_tag = qio_channel_add_watch(
	107	vs->ioc, G_IO_IN, vnc_client_io, vs, NULL);
7536ee4b TH	108	vncws_process_handshake(vs, vs->ws_input.buffer, vs->ws_input.offset);
	109	buffer_advance(&vs->ws_input, handshake_end - vs->ws_input.buffer +
	110	strlen(WS_HANDSHAKE_END));
2cdb5e14 DB	111	} else if (vs->ws_input.offset >= 4096) {
	112	VNC_DEBUG("End of headers not found in first 4096 bytes\n");
	113	vnc_client_error(vs);
7536ee4b TH	114	}
	115	}
	116
	117
04d2529d DB	118	gboolean vncws_handshake_io(QIOChannel *ioc G_GNUC_UNUSED,
	119	GIOCondition condition G_GNUC_UNUSED,
	120	void *opaque)
	121	{
	122	VncState *vs = opaque;
	123	vncws_handshake_read(vs);
	124	return TRUE;
	125	}
	126
7536ee4b TH	127	long vnc_client_read_ws(VncState *vs)
	128	{
	129	int ret, err;
	130	uint8_t *payload;
a2bebfd6	131	size_t payload_size, header_size;
7536ee4b TH	132	VNC_DEBUG("Read websocket %p size %zd offset %zd\n", vs->ws_input.buffer,
	133	vs->ws_input.capacity, vs->ws_input.offset);
	134	buffer_reserve(&vs->ws_input, 4096);
	135	ret = vnc_client_read_buf(vs, buffer_end(&vs->ws_input), 4096);
	136	if (!ret) {
	137	return 0;
	138	}
	139	vs->ws_input.offset += ret;
	140
a2bebfd6 DB	141	ret = 0;
a2bebfd6 DB	142	/* consume as much of ws_input buffer as possible */
7536ee4b	143	do {
a2bebfd6 DB	144	if (vs->ws_payload_remain == 0) {
	145	err = vncws_decode_frame_header(&vs->ws_input,
	146	&header_size,
	147	&vs->ws_payload_remain,
	148	&vs->ws_payload_mask);
	149	if (err <= 0) {
	150	return err;
	151	}
	152
	153	buffer_advance(&vs->ws_input, header_size);
7536ee4b	154	}
a2bebfd6 DB	155	if (vs->ws_payload_remain != 0) {
	156	err = vncws_decode_frame_payload(&vs->ws_input,
	157	&vs->ws_payload_remain,
	158	&vs->ws_payload_mask,
	159	&payload,
	160	&payload_size);
	161	if (err < 0) {
	162	return err;
	163	}
	164	if (err == 0) {
	165	return ret;
	166	}
	167	ret += err;
7536ee4b	168
a2bebfd6 DB	169	buffer_reserve(&vs->input, payload_size);
a2bebfd6 DB	170	buffer_append(&vs->input, payload, payload_size);
7536ee4b	171
a2bebfd6 DB	172	buffer_advance(&vs->ws_input, payload_size);
a2bebfd6 DB	173	}
7536ee4b TH	174	} while (vs->ws_input.offset > 0);
	175
	176	return ret;
	177	}
	178
	179	long vnc_client_write_ws(VncState *vs)
	180	{
	181	long ret;
	182	VNC_DEBUG("Write WS: Pending output %p size %zd offset %zd\n",
	183	vs->output.buffer, vs->output.capacity, vs->output.offset);
	184	vncws_encode_frame(&vs->ws_output, vs->output.buffer, vs->output.offset);
	185	buffer_reset(&vs->output);
	186	ret = vnc_client_write_buf(vs, vs->ws_output.buffer, vs->ws_output.offset);
	187	if (!ret) {
	188	return 0;
	189	}
	190
	191	buffer_advance(&vs->ws_output, ret);
	192
	193	if (vs->ws_output.offset == 0) {
04d2529d DB	194	if (vs->ioc_tag) {
	195	g_source_remove(vs->ioc_tag);
	196	}
	197	vs->ioc_tag = qio_channel_add_watch(
	198	vs->ioc, G_IO_IN, vnc_client_io, vs, NULL);
7536ee4b TH	199	}
	200
	201	return ret;
	202	}
	203
	204	static char vncws_extract_handshake_entry(const char handshake,
	205	size_t handshake_len, const char *name)
	206	{
	207	char begin, end, *ret = NULL;
	208	char *line = g_strdup_printf("%s%s: ", WS_HANDSHAKE_DELIM, name);
	209	begin = g_strstr_len(handshake, handshake_len, line);
	210	if (begin != NULL) {
	211	begin += strlen(line);
	212	end = g_strstr_len(begin, handshake_len - (begin - handshake),
	213	WS_HANDSHAKE_DELIM);
	214	if (end != NULL) {
	215	ret = g_strndup(begin, end - begin);
	216	}
	217	}
	218	g_free(line);
	219	return ret;
	220	}
	221
	222	static void vncws_send_handshake_response(VncState vs, const char key)
	223	{
	224	char combined_key[WS_CLIENT_KEY_LEN + WS_GUID_LEN + 1];
7536ee4b	225	char accept = NULL, response = NULL;
8e9b0d24	226	Error *err = NULL;
7536ee4b TH	227
	228	g_strlcpy(combined_key, key, WS_CLIENT_KEY_LEN + 1);
	229	g_strlcat(combined_key, WS_GUID, WS_CLIENT_KEY_LEN + WS_GUID_LEN + 1);
	230
	231	/* hash and encode it */
8e9b0d24 DB	232	if (qcrypto_hash_base64(QCRYPTO_HASH_ALG_SHA1,
	233	combined_key,
	234	WS_CLIENT_KEY_LEN + WS_GUID_LEN,
	235	&accept,
	236	&err) < 0) {
	237	VNC_DEBUG("Hashing Websocket combined key failed %s\n",
	238	error_get_pretty(err));
	239	error_free(err);
7536ee4b TH	240	vnc_client_error(vs);
	241	return;
	242	}
	243
	244	response = g_strdup_printf(WS_HANDSHAKE, accept);
b57489cf	245	vnc_client_write_buf(vs, (const uint8_t *)response, strlen(response));
7536ee4b TH	246
	247	g_free(accept);
	248	g_free(response);
	249
	250	vs->encode_ws = 1;
	251	vnc_init_state(vs);
	252	}
	253
	254	void vncws_process_handshake(VncState vs, uint8_t line, size_t size)
	255	{
	256	char protocols = vncws_extract_handshake_entry((const char )line, size,
	257	"Sec-WebSocket-Protocol");
	258	char version = vncws_extract_handshake_entry((const char )line, size,
	259	"Sec-WebSocket-Version");
	260	char key = vncws_extract_handshake_entry((const char )line, size,
	261	"Sec-WebSocket-Key");
	262
	263	if (protocols && version && key
	264	&& g_strrstr(protocols, "binary")
	265	&& !strcmp(version, WS_SUPPORTED_VERSION)
	266	&& strlen(key) == WS_CLIENT_KEY_LEN) {
	267	vncws_send_handshake_response(vs, key);
	268	} else {
	269	VNC_DEBUG("Defective Websockets header or unsupported protocol\n");
	270	vnc_client_error(vs);
	271	}
	272
	273	g_free(protocols);
	274	g_free(version);
	275	g_free(key);
	276	}
	277
	278	void vncws_encode_frame(Buffer output, const void payload,
	279	const size_t payload_size)
	280	{
	281	size_t header_size = 0;
	282	unsigned char opcode = WS_OPCODE_BINARY_FRAME;
	283	union {
	284	char buf[WS_HEAD_MAX_LEN];
	285	WsHeader ws;
	286	} header;
	287
	288	if (!payload_size) {
	289	return;
	290	}
	291
	292	header.ws.b0 = 0x80 \| (opcode & 0x0f);
	293	if (payload_size <= 125) {
	294	header.ws.b1 = (uint8_t)payload_size;
	295	header_size = 2;
	296	} else if (payload_size < 65536) {
	297	header.ws.b1 = 0x7e;
	298	header.ws.u.s16.l16 = cpu_to_be16((uint16_t)payload_size);
	299	header_size = 4;
	300	} else {
	301	header.ws.b1 = 0x7f;
	302	header.ws.u.s64.l64 = cpu_to_be64(payload_size);
	303	header_size = 10;
	304	}
	305
	306	buffer_reserve(output, header_size + payload_size);
	307	buffer_append(output, header.buf, header_size);
	308	buffer_append(output, payload, payload_size);
	309	}
310
a2bebfd6 DB	311	int vncws_decode_frame_header(Buffer *input,
	312	size_t *header_size,
	313	size_t *payload_remain,
	314	WsMask *payload_mask)
7536ee4b TH	315	{
7536ee4b TH	316	unsigned char opcode = 0, fin = 0, has_mask = 0;
a2bebfd6	317	size_t payload_len;
7536ee4b	318	WsHeader header = (WsHeader )input->buffer;
7536ee4b TH	319
	320	if (input->offset < WS_HEAD_MIN_LEN + 4) {
	321	/* header not complete */
	322	return 0;
	323	}
	324
	325	fin = (header->b0 & 0x80) >> 7;
	326	opcode = header->b0 & 0x0f;
	327	has_mask = (header->b1 & 0x80) >> 7;
a2bebfd6	328	payload_len = header->b1 & 0x7f;
7536ee4b TH	329
	330	if (opcode == WS_OPCODE_CLOSE) {
	331	/* disconnect */
	332	return -1;
	333	}
	334
	335	/* Websocket frame sanity check:
	336	* * Websocket fragmentation is not supported.
	337	* * All websockets frames sent by a client have to be masked.
	338	* * Only binary encoding is supported.
	339	*/
	340	if (!fin \|\| !has_mask \|\| opcode != WS_OPCODE_BINARY_FRAME) {
	341	VNC_DEBUG("Received faulty/unsupported Websocket frame\n");
	342	return -2;
	343	}
	344
a2bebfd6 DB	345	if (payload_len < 126) {
	346	*payload_remain = payload_len;
	347	*header_size = 6;
	348	*payload_mask = header->u.m;
	349	} else if (payload_len == 126 && input->offset >= 8) {
	350	*payload_remain = be16_to_cpu(header->u.s16.l16);
	351	*header_size = 8;
	352	*payload_mask = header->u.s16.m16;
	353	} else if (payload_len == 127 && input->offset >= 14) {
	354	*payload_remain = be64_to_cpu(header->u.s64.l64);
	355	*header_size = 14;
	356	*payload_mask = header->u.s64.m64;
7536ee4b TH	357	} else {
	358	/* header not complete */
	359	return 0;
	360	}
	361
a2bebfd6 DB	362	return 1;
	363	}
	364
	365	int vncws_decode_frame_payload(Buffer *input,
	366	size_t payload_remain, WsMask payload_mask,
	367	uint8_t *payload, size_t payload_size)
	368	{
	369	size_t i;
	370	uint32_t *payload32;
7536ee4b	371
a2bebfd6 DB	372	*payload = input->buffer;
	373	/* If we aren't at the end of the payload, then drop
	374	* off the last bytes, so we're always multiple of 4
	375	* for purpose of unmasking, except at end of payload
	376	*/
	377	if (input->offset < *payload_remain) {
	378	*payload_size = input->offset - (input->offset % 4);
	379	} else {
	380	payload_size = payload_remain;
	381	}
	382	if (*payload_size == 0) {
7536ee4b TH	383	return 0;
7536ee4b TH	384	}
a2bebfd6	385	payload_remain -= payload_size;
7536ee4b TH	386
	387	/* unmask frame */
	388	/* process 1 frame (32 bit op) */
	389	payload32 = (uint32_t )(payload);
	390	for (i = 0; i < *payload_size / 4; i++) {
a2bebfd6	391	payload32[i] ^= payload_mask->u;
7536ee4b TH	392	}
	393	/* process the remaining bytes (if any) */
	394	for (i = 4; i < payload_size; i++) {
a2bebfd6	395	(*payload)[i] ^= payload_mask->c[i % 4];
7536ee4b TH	396	}
	397
	398	return 1;
	399	}