Easy start script: remove obsolete code

This reverts commit b8fd6a28a4.

.ci/detect_os_arch_package_format

@@ -0,0 +1,20 @@
+#!/usr/bin/ruby
+
+package_name = ARGV.first
+
+DEB_PACKAGE_REGEX = %r!(?<os>[^/]+)/kasmvncserver_.+?_(?<arch>.+?).(?<format>deb)!
+RPM_PACKAGE_REGEX = %r!(?<os>[^/]+)/kasmvncserver-.+?\.(?<arch>[^.]+).(?<format>rpm)!
+
+if matches = package_name.match(DEB_PACKAGE_REGEX)
+else matches = package_name.match(RPM_PACKAGE_REGEX)
+end
+
+os = matches["os"]
+arch = matches["arch"]
+package_format = matches["format"]
+
+puts <<-EXPORT
+  export PACKAGE_OS=#{os}
+  export OS_ARCH=#{arch}
+  export PACKAGE_FORMAT=#{package_format}
+EXPORT

.ci/next_release_version

@@ -0,0 +1,25 @@
+#!/bin/bash
+
+set -e
+
+version_from_tags() {
+  git tag | sort -r | head -1 | sed -e 's/^v//' -e 's/\-.\+//' | awk -F. -v OFS=. 'NF==1{print ++$NF}; NF>1{if(length($NF+1)>length($NF))$(NF-1)++; $NF=sprintf("%0*d", length($NF), ($NF+1)%(10^length($NF))); print}'
+}
+
+branch_name="$1"
+if [ -z "$branch_name" ]; then
+  echo >&2 "Usage: `basename $0` <branch_name>"
+  exit 1
+fi
+
+if echo "$branch_name" | grep -Pq '^release/([\d.]+)$'; then
+  RELEASE_BRANCH=1
+fi
+
+if [ -n "$RELEASE_BRANCH" ]; then
+  RELEASE_VERSION=$(echo "$branch_name" | sed 's!release/!!');
+else
+  RELEASE_VERSION="$(version_from_tags)"
+fi
+
+echo "$RELEASE_VERSION"

.ci/upload.sh

@@ -0,0 +1,40 @@
+#!/bin/bash
+
+function prepare_upload_filename() {
+  local package="$1";
+
+  .ci/detect_os_arch_package_format "$package" > /tmp/os_arch_package_format;
+  source /tmp/os_arch_package_format;
+  detect_release_branch
+  if [ -n "$RELEASE_BRANCH" ]; then
+    export upload_filename="kasmvncserver_${PACKAGE_OS}_${RELEASE_VERSION}_${OS_ARCH}.${PACKAGE_FORMAT}";
+  else
+    export SANITIZED_BRANCH="$(echo $CI_COMMIT_REF_NAME | sed 's/\//_/g')";
+    export upload_filename="kasmvncserver_${PACKAGE_OS}_${RELEASE_VERSION}_${SANITIZED_BRANCH}_${CI_COMMIT_SHA:0:6}_${OS_ARCH}.${PACKAGE_FORMAT}";
+  fi
+};
+
+function upload_to_s3() {
+  local package="$1";
+  local upload_filename="$2";
+
+  # Transfer to S3
+  python3 amazon-s3-bitbucket-pipelines-python/s3_upload.py "${S3_BUCKET}" "$package" "${S3_BUILD_DIRECTORY}/${upload_filename}";
+  # Use the Gitlab API to tell Gitlab where the artifact was stored
+  export S3_URL="https://${S3_BUCKET}.s3.amazonaws.com/${S3_BUILD_DIRECTORY}/${upload_filename}";
+  export BUILD_STATUS="{\"key\":\"doc\", \"state\":\"SUCCESSFUL\", \"name\":\"${upload_filename}\", \"url\":\"${S3_URL}\"}";
+  curl --request POST --header "PRIVATE-TOKEN:${GITLAB_API_TOKEN}" "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/statuses/${CI_COMMIT_SHA}?state=success&name=build-url&target_url=${S3_URL}";
+};
+function prepare_to_run_scripts_and_s3_uploads() {
+  export DEBIAN_FRONTEND=noninteractive;
+  apt-get update;
+  apt-get install -y ruby2.7 git;
+  apt-get install -y python3 python3-pip python3-boto3 curl pkg-config libxmlsec1-dev;
+  git clone https://bitbucket.org/awslabs/amazon-s3-bitbucket-pipelines-python.git;
+};
+
+detect_release_branch() {
+  if echo $CI_COMMIT_REF_NAME | grep -Pq '^release/([\d.]+)$'; then
+    export RELEASE_BRANCH=1;
+  fi
+}

.dockerignore

@@ -0,0 +1 @@
+builder/build

.gitignore

@@ -0,0 +1,23 @@
+*.[ao]
+*.mo
+*.la
+*.lo
+.deps
+.libs
+
+CMakeFiles
+CMakeCache.txt
+*.cmake
+Makefile
+Makefile.in
+config.h
+
+builder/build/
+builder/www/
+
+# Deb building artefacts
+debian/.debhelper/
+debian/files
+debian/kasmvncserver.substvars
+debian/kasmvncserver/
+.pc

.gitlab-ci.yml

@@ -0,0 +1,111 @@
+image: docker
+services:
+  - docker:dind
+
+variables:
+  GITLAB_SHARED_DIND_DIR: /builds/$CI_PROJECT_PATH/shared
+  GIT_SUBMODULE_STRATEGY: normal
+  GIT_FETCH_EXTRA_FLAGS: --tags
+
+stages:
+  - build
+  - upload
+
+.prepare_build: &prepare_build
+  - ls -l
+  - pwd
+  - apk add bash
+  - mkdir -p "$GITLAB_SHARED_DIND_DIR" && chmod 777 "$GITLAB_SHARED_DIND_DIR"
+
+.prepare_artfacts: &prepare_artfacts
+  - mkdir output
+  - cp -r builder/build/* output/
+  - rm output/*.tar.gz
+
+build_ubuntu_bionic:
+  stage: build
+  before_script:
+    - *prepare_build
+  after_script:
+    - *prepare_artfacts
+  script:
+    - bash builder/build-package ubuntu bionic
+  artifacts:
+    paths:
+      - output/
+
+build_ubuntu_focal:
+  stage: build
+  before_script:
+    - *prepare_build
+  after_script:
+    - *prepare_artfacts
+  script:
+    - bash builder/build-package ubuntu focal;
+  artifacts:
+    paths:
+      - output/
+
+build_debian_buster:
+  stage: build
+  before_script:
+    - *prepare_build
+  after_script:
+    - *prepare_artfacts
+  script:
+    - bash builder/build-package debian buster;
+  artifacts:
+    paths:
+      - output/
+
+build_debian_bullseye:
+  stage: build
+  before_script:
+    - *prepare_build
+  after_script:
+    - *prepare_artfacts
+  script:
+    - bash builder/build-package debian bullseye;
+  artifacts:
+    paths:
+      - output/
+
+build_kali_rolling:
+  stage: build
+  before_script:
+    - *prepare_build
+  after_script:
+    - *prepare_artfacts
+  script:
+    - bash builder/build-package kali kali-rolling;
+  artifacts:
+    paths:
+      - output/
+
+build_centos7:
+  stage: build
+  before_script:
+    - *prepare_build
+  after_script:
+    - *prepare_artfacts
+  script:
+    - bash builder/build-package centos core
+  artifacts:
+    paths:
+      - output/
+
+upload:
+  stage: upload
+  image: ubuntu:focal
+  before_script:
+    - . .ci/upload.sh
+  script:
+    - export S3_BUILD_DIRECTORY="kasmvnc/${CI_COMMIT_SHA}"
+    - prepare_to_run_scripts_and_s3_uploads
+    - export RELEASE_VERSION=$(.ci/next_release_version "$CI_COMMIT_REF_NAME")
+    - for package in `find output/ -type f -name 'kasmvncserver_*.deb' -or -name '*.rpm'`; do
+        prepare_upload_filename "$package";
+        echo;
+        echo "File to upload $upload_filename";
+        upload_to_s3 "$package" "$upload_filename";
+      done

.gitmodules

@@ -0,0 +1,4 @@
+[submodule "kasmweb"]
+	path = kasmweb
+	url = https://github.com/kasmtech/noVNC.git
+	branch = master

ACKNOWLEDGEMENTS.md

@@ -0,0 +1,108 @@
+### License & Legal
+
+Incomplete and generally out of date copyright list::
+
+        Copyright (C) 2020 Kasm Technologies LLC
+        Copyright (C) 1999 AT&T Laboratories Cambridge
+        Copyright (C) 2002-2005 RealVNC Ltd.
+        Copyright (C) 2000-2006 TightVNC Group
+        Copyright (C) 2005-2006 Martin Koegler
+        Copyright (C) 2005-2006 Sun Microsystems, Inc.
+        Copyright (C) 2006 OCCAM Financial Technology
+        Copyright (C) 2000-2008 Constantin Kaplinsky
+        Copyright (C) 2004-2017 Peter Astrand for Cendio AB
+        Copyright (C) 2010 Antoine Martin
+        Copyright (C) 2010 m-privacy GmbH
+        Copyright (C) 2009-2011 D. R. Commander
+        Copyright (C) 2009-2011 Pierre Ossman for Cendio AB
+        Copyright (C) 2004, 2009-2011 Red Hat, Inc.
+        Copyright (C) 2009-2018 TigerVNC Team
+        All Rights Reserved.
+
+This software is distributed under the GNU General Public Licence as published
+by the Free Software Foundation.  See the file LICENSE.TXT for the conditions
+under which this software is made available.  KasmVNC also contains code from
+other sources.  See the Acknowledgements section below, and the individual
+source files, for details of the conditions under which they are made
+available.
+
+
+### Acknowledgements
+This distribution contains zlib compression software.  This is:
+
+  Copyright (C) 1995-2002 Jean-loup Gailly and Mark Adler
+
+  This software is provided 'as-is', without any express or implied
+  warranty.  In no event will the authors be held liable for any damages
+  arising from the use of this software.
+
+  Permission is granted to anyone to use this software for any purpose,
+  including commercial applications, and to alter it and redistribute it
+  freely, subject to the following restrictions:
+
+  1. The origin of this software must not be misrepresented; you must not
+     claim that you wrote the original software. If you use this software
+     in a product, an acknowledgment in the product documentation would be
+     appreciated but is not required.
+  2. Altered source versions must be plainly marked as such, and must not be
+     misrepresented as being the original software.
+  3. This notice may not be removed or altered from any source distribution.
+
+  Jean-loup Gailly        Mark Adler
+  jloup@gzip.org          madler@alumni.caltech.edu
+
+  The data format used by the zlib library is described by RFCs (Request for
+  Comments) 1950 to 1952 in the files ftp://ds.internic.net/rfc/rfc1950.txt
+  (zlib format), rfc1951.txt (deflate format) and rfc1952.txt (gzip format).
+
+
+This distribution contains public domain DES software by Richard Outerbridge.
+This is:
+
+Copyright (c) 1988,1989,1990,1991,1992 by Richard Outerbridge.
+(GEnie : OUTER; CIS : [71755,204]) Graven Imagery, 1992.
+
+
+This distribution contains software from the X Window System.  This is:
+
+ Copyright 1987, 1988, 1998  The Open Group
+
+ Permission to use, copy, modify, distribute, and sell this software and its
+ documentation for any purpose is hereby granted without fee, provided that
+ the above copyright notice appear in all copies and that both that
+ copyright notice and this permission notice appear in supporting
+ documentation.
+
+ The above copyright notice and this permission notice shall be included in
+ all copies or substantial portions of the Software.
+
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
+ OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+ Except as contained in this notice, the name of The Open Group shall not be
+ used in advertising or otherwise to promote the sale, use or other dealings
+ in this Software without prior written authorization from The Open Group.
+
+
+ Copyright 1987, 1988 by Digital Equipment Corporation, Maynard, Massachusetts.
+ All Rights Reserved
+
+ Permission to use, copy, modify, and distribute this software and its
+ documentation for any purpose and without fee is hereby granted,
+ provided that the above copyright notice appear in all copies and that
+ both that copyright notice and this permission notice appear in
+ supporting documentation, and that the name of Digital not be
+ used in advertising or publicity pertaining to distribution of the
+ software without specific, written prior permission.
+
+ DIGITAL DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING
+ ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL
+ DIGITAL BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR
+ ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
+ WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
+ ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ SOFTWARE.

CMakeLists.txt

@@ -103,9 +103,9 @@ if(NOT DEFINED BUILD_WINVNC)
   set(BUILD_WINVNC 1)
 endif()
 
-# Minimum version is Windows Vista/2008 (6.0)
+# Minimum version is Windows 7
 if(WIN32)
-  add_definitions(-D_WIN32_WINNT=0x0600)
+  add_definitions(-D_WIN32_WINNT=0x0601)
 endif()
 
 if(CMAKE_SIZEOF_VOID_P MATCHES 8)

LICENCE.TXT

@@ -1,340 +0,0 @@
-		    GNU GENERAL PUBLIC LICENSE
-		       Version 2, June 1991
-
-	  Copyright (C) 1989, 1991 Free Software Foundation, Inc.
-	 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
-			    Preamble
-
-  The licenses for most software are designed to take away your
-freedom to share and change it.  By contrast, the GNU General Public
-License is intended to guarantee your freedom to share and change free
-software--to make sure the software is free for all its users.  This
-General Public License applies to most of the Free Software
-Foundation's software and to any other program whose authors commit to
-using it.  (Some other Free Software Foundation software is covered by
-the GNU Library General Public License instead.)  You can apply it to
-your programs, too.
-
-  When we speak of free software, we are referring to freedom, not
-price.  Our General Public Licenses are designed to make sure that you
-have the freedom to distribute copies of free software (and charge for
-this service if you wish), that you receive source code or can get it
-if you want it, that you can change the software or use pieces of it
-in new free programs; and that you know you can do these things.
-
-  To protect your rights, we need to make restrictions that forbid
-anyone to deny you these rights or to ask you to surrender the rights.
-These restrictions translate to certain responsibilities for you if you
-distribute copies of the software, or if you modify it.
-
-  For example, if you distribute copies of such a program, whether
-gratis or for a fee, you must give the recipients all the rights that
-you have.  You must make sure that they, too, receive or can get the
-source code.  And you must show them these terms so they know their
-rights.
-
-  We protect your rights with two steps: (1) copyright the software, and
-(2) offer you this license which gives you legal permission to copy,
-distribute and/or modify the software.
-
-  Also, for each author's protection and ours, we want to make certain
-that everyone understands that there is no warranty for this free
-software.  If the software is modified by someone else and passed on, we
-want its recipients to know that what they have is not the original, so
-that any problems introduced by others will not reflect on the original
-authors' reputations.
-
-  Finally, any free program is threatened constantly by software
-patents.  We wish to avoid the danger that redistributors of a free
-program will individually obtain patent licenses, in effect making the
-program proprietary.  To prevent this, we have made it clear that any
-patent must be licensed for everyone's free use or not licensed at all.
-
-  The precise terms and conditions for copying, distribution and
-modification follow.
-
-		    GNU GENERAL PUBLIC LICENSE
-   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
-
-  0. This License applies to any program or other work which contains
-a notice placed by the copyright holder saying it may be distributed
-under the terms of this General Public License.  The "Program", below,
-refers to any such program or work, and a "work based on the Program"
-means either the Program or any derivative work under copyright law:
-that is to say, a work containing the Program or a portion of it,
-either verbatim or with modifications and/or translated into another
-language.  (Hereinafter, translation is included without limitation in
-the term "modification".)  Each licensee is addressed as "you".
-
-Activities other than copying, distribution and modification are not
-covered by this License; they are outside its scope.  The act of
-running the Program is not restricted, and the output from the Program
-is covered only if its contents constitute a work based on the
-Program (independent of having been made by running the Program).
-Whether that is true depends on what the Program does.
-
-  1. You may copy and distribute verbatim copies of the Program's
-source code as you receive it, in any medium, provided that you
-conspicuously and appropriately publish on each copy an appropriate
-copyright notice and disclaimer of warranty; keep intact all the
-notices that refer to this License and to the absence of any warranty;
-and give any other recipients of the Program a copy of this License
-along with the Program.
-
-You may charge a fee for the physical act of transferring a copy, and
-you may at your option offer warranty protection in exchange for a fee.
-
-  2. You may modify your copy or copies of the Program or any portion
-of it, thus forming a work based on the Program, and copy and
-distribute such modifications or work under the terms of Section 1
-above, provided that you also meet all of these conditions:
-
-    a) You must cause the modified files to carry prominent notices
-    stating that you changed the files and the date of any change.
-
-    b) You must cause any work that you distribute or publish, that in
-    whole or in part contains or is derived from the Program or any
-    part thereof, to be licensed as a whole at no charge to all third
-    parties under the terms of this License.
-
-    c) If the modified program normally reads commands interactively
-    when run, you must cause it, when started running for such
-    interactive use in the most ordinary way, to print or display an
-    announcement including an appropriate copyright notice and a
-    notice that there is no warranty (or else, saying that you provide
-    a warranty) and that users may redistribute the program under
-    these conditions, and telling the user how to view a copy of this
-    License.  (Exception: if the Program itself is interactive but
-    does not normally print such an announcement, your work based on
-    the Program is not required to print an announcement.)
-
-These requirements apply to the modified work as a whole.  If
-identifiable sections of that work are not derived from the Program,
-and can be reasonably considered independent and separate works in
-themselves, then this License, and its terms, do not apply to those
-sections when you distribute them as separate works.  But when you
-distribute the same sections as part of a whole which is a work based
-on the Program, the distribution of the whole must be on the terms of
-this License, whose permissions for other licensees extend to the
-entire whole, and thus to each and every part regardless of who wrote it.
-
-Thus, it is not the intent of this section to claim rights or contest
-your rights to work written entirely by you; rather, the intent is to
-exercise the right to control the distribution of derivative or
-collective works based on the Program.
-
-In addition, mere aggregation of another work not based on the Program
-with the Program (or with a work based on the Program) on a volume of
-a storage or distribution medium does not bring the other work under
-the scope of this License.
-
-  3. You may copy and distribute the Program (or a work based on it,
-under Section 2) in object code or executable form under the terms of
-Sections 1 and 2 above provided that you also do one of the following:
-
-    a) Accompany it with the complete corresponding machine-readable
-    source code, which must be distributed under the terms of Sections
-    1 and 2 above on a medium customarily used for software interchange; or,
-
-    b) Accompany it with a written offer, valid for at least three
-    years, to give any third party, for a charge no more than your
-    cost of physically performing source distribution, a complete
-    machine-readable copy of the corresponding source code, to be
-    distributed under the terms of Sections 1 and 2 above on a medium
-    customarily used for software interchange; or,
-
-    c) Accompany it with the information you received as to the offer
-    to distribute corresponding source code.  (This alternative is
-    allowed only for noncommercial distribution and only if you
-    received the program in object code or executable form with such
-    an offer, in accord with Subsection b above.)
-
-The source code for a work means the preferred form of the work for
-making modifications to it.  For an executable work, complete source
-code means all the source code for all modules it contains, plus any
-associated interface definition files, plus the scripts used to
-control compilation and installation of the executable.  However, as a
-special exception, the source code distributed need not include
-anything that is normally distributed (in either source or binary
-form) with the major components (compiler, kernel, and so on) of the
-operating system on which the executable runs, unless that component
-itself accompanies the executable.
-
-If distribution of executable or object code is made by offering
-access to copy from a designated place, then offering equivalent
-access to copy the source code from the same place counts as
-distribution of the source code, even though third parties are not
-compelled to copy the source along with the object code.
-
-  4. You may not copy, modify, sublicense, or distribute the Program
-except as expressly provided under this License.  Any attempt
-otherwise to copy, modify, sublicense or distribute the Program is
-void, and will automatically terminate your rights under this License.
-However, parties who have received copies, or rights, from you under
-this License will not have their licenses terminated so long as such
-parties remain in full compliance.
-
-  5. You are not required to accept this License, since you have not
-signed it.  However, nothing else grants you permission to modify or
-distribute the Program or its derivative works.  These actions are
-prohibited by law if you do not accept this License.  Therefore, by
-modifying or distributing the Program (or any work based on the
-Program), you indicate your acceptance of this License to do so, and
-all its terms and conditions for copying, distributing or modifying
-the Program or works based on it.
-
-  6. Each time you redistribute the Program (or any work based on the
-Program), the recipient automatically receives a license from the
-original licensor to copy, distribute or modify the Program subject to
-these terms and conditions.  You may not impose any further
-restrictions on the recipients' exercise of the rights granted herein.
-You are not responsible for enforcing compliance by third parties to
-this License.
-
-  7. If, as a consequence of a court judgment or allegation of patent
-infringement or for any other reason (not limited to patent issues),
-conditions are imposed on you (whether by court order, agreement or
-otherwise) that contradict the conditions of this License, they do not
-excuse you from the conditions of this License.  If you cannot
-distribute so as to satisfy simultaneously your obligations under this
-License and any other pertinent obligations, then as a consequence you
-may not distribute the Program at all.  For example, if a patent
-license would not permit royalty-free redistribution of the Program by
-all those who receive copies directly or indirectly through you, then
-the only way you could satisfy both it and this License would be to
-refrain entirely from distribution of the Program.
-
-If any portion of this section is held invalid or unenforceable under
-any particular circumstance, the balance of the section is intended to
-apply and the section as a whole is intended to apply in other
-circumstances.
-
-It is not the purpose of this section to induce you to infringe any
-patents or other property right claims or to contest validity of any
-such claims; this section has the sole purpose of protecting the
-integrity of the free software distribution system, which is
-implemented by public license practices.  Many people have made
-generous contributions to the wide range of software distributed
-through that system in reliance on consistent application of that
-system; it is up to the author/donor to decide if he or she is willing
-to distribute software through any other system and a licensee cannot
-impose that choice.
-
-This section is intended to make thoroughly clear what is believed to
-be a consequence of the rest of this License.
-
-  8. If the distribution and/or use of the Program is restricted in
-certain countries either by patents or by copyrighted interfaces, the
-original copyright holder who places the Program under this License
-may add an explicit geographical distribution limitation excluding
-those countries, so that distribution is permitted only in or among
-countries not thus excluded.  In such case, this License incorporates
-the limitation as if written in the body of this License.
-
-  9. The Free Software Foundation may publish revised and/or new versions
-of the General Public License from time to time.  Such new versions will
-be similar in spirit to the present version, but may differ in detail to
-address new problems or concerns.
-
-Each version is given a distinguishing version number.  If the Program
-specifies a version number of this License which applies to it and "any
-later version", you have the option of following the terms and conditions
-either of that version or of any later version published by the Free
-Software Foundation.  If the Program does not specify a version number of
-this License, you may choose any version ever published by the Free Software
-Foundation.
-
-  10. If you wish to incorporate parts of the Program into other free
-programs whose distribution conditions are different, write to the author
-to ask for permission.  For software which is copyrighted by the Free
-Software Foundation, write to the Free Software Foundation; we sometimes
-make exceptions for this.  Our decision will be guided by the two goals
-of preserving the free status of all derivatives of our free software and
-of promoting the sharing and reuse of software generally.
-
-			    NO WARRANTY
-
-  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
-FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
-OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
-PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
-OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
-TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
-PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
-REPAIR OR CORRECTION.
-
-  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
-REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
-INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
-OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
-TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
-YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
-PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
-POSSIBILITY OF SUCH DAMAGES.
-
-		     END OF TERMS AND CONDITIONS
-
-	Appendix: How to Apply These Terms to Your New Programs
-
-  If you develop a new program, and you want it to be of the greatest
-possible use to the public, the best way to achieve this is to make it
-free software which everyone can redistribute and change under these terms.
-
-  To do so, attach the following notices to the program.  It is safest
-to attach them to the start of each source file to most effectively
-convey the exclusion of warranty; and each file should have at least
-the "copyright" line and a pointer to where the full notice is found.
-
-    <one line to give the program's name and a brief idea of what it does.>
-    Copyright (C) 19yy  <name of author>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307,
-    USA.
-
-Also add information on how to contact you by electronic and paper mail.
-
-If the program is interactive, make it output a short notice like this
-when it starts in an interactive mode:
-
-    Gnomovision version 69, Copyright (C) 19yy name of author
-    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
-    This is free software, and you are welcome to redistribute it
-    under certain conditions; type `show c' for details.
-
-The hypothetical commands `show w' and `show c' should show the appropriate
-parts of the General Public License.  Of course, the commands you use may
-be called something other than `show w' and `show c'; they could even be
-mouse-clicks or menu items--whatever suits your program.
-
-You should also get your employer (if you work as a programmer) or your
-school, if any, to sign a "copyright disclaimer" for the program, if
-necessary.  Here is a sample; alter the names:
-
-  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
-  `Gnomovision' (which makes passes at compilers) written by James Hacker.
-
-  <signature of Ty Coon>, 1 April 1989
-  Ty Coon, President of Vice
-
-This General Public License does not permit incorporating your program into
-proprietary programs.  If your program is a subroutine library, you may
-consider it more useful to permit linking proprietary applications with the
-library.  If this is what you want to do, use the GNU Library General
-Public License instead of this License.

README.md

@@ -1,11 +1,11 @@
 # KasmVNC - Linux Web Remote Desktop
 
-[![Kasm Technologies](https://kasm-static-content.s3.amazonaws.com/368_kasm_logo_.jpg "Kasm Logo")](https://kasmweb.com)
-
-[Kasm Technologies LLC](https://www.kasmweb.com) developed Kasm Server, a Containerized Desktop Infrastructure (CDI) solution. Kasm started with TigerVNC and eventually forked it to create KasmVNC. KasmVNC is used within the overal Kasm CDI infrastructure, however, you can use KasmVNC for individual servers. KasmVNC has different goals than TigerVNC:
+<a href="https://kasmweb.com"><img src="https://kasm-static-content.s3.amazonaws.com/logo_kasm.png" width="300"><a/>
+  
+[Kasm Technologies](https://www.kasmweb.com) developed Kasm Workspaces, the Containerized Streaming Platform. Kasm has open-sourced the Workspace docker images, which include containerized [full desktops and apps](https://github.com/kasmtech/workspaces-images) and [base images](https://github.com/kasmtech/workspaces-core-images) intended for developers to create custimized streaming containers. These containers can be used standalone or within the [Kasm Workspaces Platform](https://www.kasmweb.com) which provides a full Enterprise feature set. KasmVNC is used as the streaming tech for our container images, however, you can use KasmVNC for individual servers. While the term VNC is in the name, KasmVNC is not intended to remain compliant with the RFB spec and has different goals than other VNC projects:
 
   - Web-based - KasmVNC is designed to provide a web accessible remote desktop. It comes with a web server and websocket server built in. There is no need to install other components. Simply run and navigate to your desktop's URL on the port you specify. While you can still tun on the legacy VNC port, it is disabled by default.
-  - Security - KasmVNC defaults to HTTPS and allows for HTTP Basic Auth. VNC Password authentication is limited by specification to 8 characters and is not suffecient for use on an internet accessible remote desktop. Our goal is to create a by default secure, web based experience.
+  - Security - The RFB specification (VNC) limits the password field to 8 characters, so while the client may take a longer password, only the first 8 characters are sent. KasmVNC defaults to HTTPS with HTTP Basic Auth and disables the legacy VNC authentication method which is not sufficiently secure for internet accessible systems.
   - Simplicity - KasmVNC aims at being simple to deploy and configure.
 
 # New Features!
@@ -13,182 +13,94 @@
   - Webp image compression for better bandwidth usage
   - Automatic mixing of webp and jpeg based on CPU availability on server
   - Multi-threaded image encoding for smoother frame rate for servers with more cores
-  - Full screen video detection, goes into configurable video mode for better full screen videoo playback performance.
-  - Dynamic jpeg/webp image coompression quality settings based on screen change rates
-  - Seemless clipboard support
+  - [Full screen video detection](https://github.com/kasmtech/KasmVNC/wiki/Video-Rendering-Options#video-mode), goes into configurable video mode for better full screen videoo playback performance.
+  - [Dynamic jpeg/webp image coompression](https://github.com/kasmtech/KasmVNC/wiki/Video-Rendering-Options#dynamic-image-quality) quality settings based on screen change rates
+  - Seemless clipboard support (on Chromium based browsers)
   - Allow client to set/change most configuration settings
-  - Data Loss Prevention features
+  - [Data Loss Prevention features](https://github.com/kasmtech/KasmVNC/wiki/Data-Loss-Prevention)
     - Key stroke logging
     - Clipboard logging
     - Max clipboard transfer size up and down
     - Min time between clipboard operations required
     - Keyboard input rate limit
-
-
+    - Screen region selection
+  - Deb packages for Debian, Ubuntu, and Kali Linux included in release.
+  - RPM packages for CentOS, Fedora. RPM packages are currently not updatable and not released, though you can build and install them. See build documentation.
+  - Web [API](https://github.com/kasmtech/KasmVNC/wiki/API) added for remotely controlling and getting information from KasmVNC
+  - Multi-User with ability to pass control to other users.
+  - Web UI uses a webpack for faster load times.
+  - Network and CPU bottleneck statistics
 
 
 Future Goals:
 
   - Support uploads and downloads
-  - Json configuration file
   - Pre-build Packages for all major Linux distributions
-  - CI pipelines to create releases
 
 ### Installation
-We are currently developing releasable packages for major operating sytems. The install script available with releases will install dependencies, compile webp, and pull down and install the pre-compiled KasmVNC tarball. Currently, only Ubuntu 18.04 LTS is pre-compiled.
 
-This installer assumes you already have a desktop environment installed, but have never configured a VNC server.
+#### Debian-based
 
 ```sh
-# download install script from releases
-sudo ./install.sh
+wget -qO- https://github.com/kasmtech/KasmVNC/releases/download/v0.9.1-beta/kasmvncserver_0.9.1~beta-1_amd64.deb
 
-# change owner of pre-installed cert to your user
-sudo chown $USER /usr/local/share/kasmvnc/certs/self.pem
+sudo dpkg -i kasmvncserver_0.9.1~beta-1_amd64.deb
+sudo apt-get -f install
 
-# create required files
-touch ~/.Xresources
-# start kasmvnc to generate the required files and then kill it
-# it will prompt to set the vnc password
-vncserver :1 -interface 0.0.0.0
-vncserver -kill :1
+# We provide an example script to run KasmVNC at #
+# /usr/share/doc/kasmvncserver/examples/kasmvncserver-easy-start. It runs a VNC
+# server on display :10 and on interface 0.0.0.0. If you're happy with those
+# defaults you can just use it as is:
+sudo ln -s /usr/share/doc/kasmvncserver/examples/kasmvncserver-easy-start /usr/bin/
 
-# overwrite the VNC password to nothing. KasmVNC uses HTTPS basic authentication
-echo '' | vncpasswd -f > $HOME/.vnc/passwd
+# Add your user to the ssl-cert group
+sudo addgroup $USER ssl-cert
+# You will need to re-connect in order to pick up the group change
 
-# modify vncstartup to launch your environment of choice, in this example LXDE
+# Create ~/.vnc directory and corresponding files.
+kasmvncserver-easy-start -d && kasmvncserver-easy-start -kill
+
+# Modify vncstartup to launch your environment of choice, in this example LXDE
+# This may be optional depending on your system configuration
 echo '/usr/bin/lxsession -s LXDE &' >> ~/.vnc/xstartup
 
-# launch KasmVNC
-vncserver $DISPLAY -depth 24 -geometry 1280x1050 -basicAuth kasm_user:password -websocketPort 8443 -cert /usr/local/share/kasmvnc/certs/self.pem -sslOnly -FrameRate=24 -interface 0.0.0.0
+# Start KasmVNC with debug logging:
+kasmvncserver-easy-start -d
+
+# Tail the logs
+tail -f ~/.vnc/`hostname`:10.log
 ```
 
-The options for vncserver in the example above:
+Now navigate to your system at https://[ip-address]:8443/
+
+To stop a running KasmVNC:
+
+```sh
+kasmvncserver-easy-start -kill
+```
+
+The options for vncserver:
 
 | Argument | Description |
 | -------- | ----------- |
 | depth | Color depth, for jpeg/webp should be 24bit |
 | geometry | Screensize, this will automatically be adjusted when the client connects. |
-| basicAuth | Username and password seperated by a semi-colon. |
 | websocketPort | The port to use for the web socket. Use a high port to avoid having to run as root. |
 | cert | SSL cert to use for HTTPS |
 | sslOnly | Disable HTTP |
 | interface | Which interface to bind the web server to. |
 
 ### Development
-Would you like to contribute to KasmVNC? Please reachout to us at info@kasmweb.com
+Would you like to contribute to KasmVNC? Please reachout to us at info@kasmweb.com. We have investigated or are working on the following, if you have experience in these fields and would like to help please let us know.
 
-We need help, especially in packaging KasmVNC for various operating systems. We would love to have standard debian or RMP packages and host our own repo, however, that all requires a lot of experience, proper testing, and pipeline development for automated builds.
+Real-time H264 encoding using NVIDIA and Intel encoding technology.
 
-We also need help with Windows, which is not currently supported. While KasmVNC can technically be built for Windows 10, it is unusably slow, due to all the changes that occured in Windows since the original Windows support was added in the chain of VNC forked projects.
+Windows version of KasmVNC. We have been able to get it to compile for Windows and increased the performance, but still not releasable. Experienced Windows developers with a background in cross compiling would help.
+  
+ARM version of KasmVNC, we have had requests for this and at one point we did have an ARM build of KasmVNC but it takes dev cycles to mainain and bring it back to life.
 
 ### Compiling From Source
-See the builder/README.md. We containerize our build systems to ensure highly repeatable builds. 
+See the [builder/README.md](https://github.com/kasmtech/KasmVNC/blob/master/builder/README.md). We containerize our build systems to ensure highly repeatable builds.
 
-License & Legal
-----
-Incomplete and generally out of date copyright list::
-
-        Copyright (C) 2020 Kasm Technologies LLC
-        Copyright (C) 1999 AT&T Laboratories Cambridge
-        Copyright (C) 2002-2005 RealVNC Ltd.
-        Copyright (C) 2000-2006 TightVNC Group
-        Copyright (C) 2005-2006 Martin Koegler
-        Copyright (C) 2005-2006 Sun Microsystems, Inc.
-        Copyright (C) 2006 OCCAM Financial Technology
-        Copyright (C) 2000-2008 Constantin Kaplinsky
-        Copyright (C) 2004-2017 Peter Astrand for Cendio AB
-        Copyright (C) 2010 Antoine Martin
-        Copyright (C) 2010 m-privacy GmbH
-        Copyright (C) 2009-2011 D. R. Commander
-        Copyright (C) 2009-2011 Pierre Ossman for Cendio AB
-        Copyright (C) 2004, 2009-2011 Red Hat, Inc.
-        Copyright (C) 2009-2018 TigerVNC Team
-        All Rights Reserved.
-
-This software is distributed under the GNU General Public Licence as published
-by the Free Software Foundation.  See the file LICENCE.TXT for the conditions
-under which this software is made available.  KasmVNC also contains code from
-other sources.  See the Acknowledgements section below, and the individual
-source files, for details of the conditions under which they are made
-available.
-
-### Acknoledgements
-This distribution contains zlib compression software.  This is:
-
-  Copyright (C) 1995-2002 Jean-loup Gailly and Mark Adler
-
-  This software is provided 'as-is', without any express or implied
-  warranty.  In no event will the authors be held liable for any damages
-  arising from the use of this software.
-
-  Permission is granted to anyone to use this software for any purpose,
-  including commercial applications, and to alter it and redistribute it
-  freely, subject to the following restrictions:
-
-  1. The origin of this software must not be misrepresented; you must not
-     claim that you wrote the original software. If you use this software
-     in a product, an acknowledgment in the product documentation would be
-     appreciated but is not required.
-  2. Altered source versions must be plainly marked as such, and must not be
-     misrepresented as being the original software.
-  3. This notice may not be removed or altered from any source distribution.
-
-  Jean-loup Gailly        Mark Adler
-  jloup@gzip.org          madler@alumni.caltech.edu
-
-  The data format used by the zlib library is described by RFCs (Request for
-  Comments) 1950 to 1952 in the files ftp://ds.internic.net/rfc/rfc1950.txt
-  (zlib format), rfc1951.txt (deflate format) and rfc1952.txt (gzip format).
-
-
-This distribution contains public domain DES software by Richard Outerbridge.
-This is:
-
-Copyright (c) 1988,1989,1990,1991,1992 by Richard Outerbridge.
-(GEnie : OUTER; CIS : [71755,204]) Graven Imagery, 1992.
-
-
-This distribution contains software from the X Window System.  This is:
-
- Copyright 1987, 1988, 1998  The Open Group
- 
- Permission to use, copy, modify, distribute, and sell this software and its
- documentation for any purpose is hereby granted without fee, provided that
- the above copyright notice appear in all copies and that both that
- copyright notice and this permission notice appear in supporting
- documentation.
- 
- The above copyright notice and this permission notice shall be included in
- all copies or substantial portions of the Software.
- 
- THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
- OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
- AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
- CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
- 
- Except as contained in this notice, the name of The Open Group shall not be
- used in advertising or otherwise to promote the sale, use or other dealings
- in this Software without prior written authorization from The Open Group.
- 
- 
- Copyright 1987, 1988 by Digital Equipment Corporation, Maynard, Massachusetts.
- All Rights Reserved
- 
- Permission to use, copy, modify, and distribute this software and its 
- documentation for any purpose and without fee is hereby granted, 
- provided that the above copyright notice appear in all copies and that
- both that copyright notice and this permission notice appear in 
- supporting documentation, and that the name of Digital not be
- used in advertising or publicity pertaining to distribution of the
- software without specific, written prior permission.  
- 
- DIGITAL DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING
- ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL
- DIGITAL BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR
- ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
- WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
- ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
- SOFTWARE.
+### License and Acknowledgements
+See the [LICENSE.TXT](https://github.com/kasmtech/KasmVNC/blob/master/LICENSE.TXT) and [ACKNOWLEDGEMENTS.MD](https://github.com/kasmtech/KasmVNC/blob/master/LICENSE.TXT)

bitbucket-pipelines.yml

@@ -1,30 +0,0 @@
-image: ubuntu:xenial
-pipelines:
-  default:
-    - step:
-        name: Build and Package
-        services:
-          - docker
-        script:
-          - export BASE_DIR="$(readlink -f .)"
-          - export RELEASE_VERSION=1.9
-          - export BUILD_FILE="kasmvnc_${RELEASE_VERSION}.${BITBUCKET_COMMIT}.tar.gz"
-          - export S3_BUILD_DIRECTORY="kasmvnc/${BITBUCKET_COMMIT}"
-          - export SANITIZED_BRANCH="$(echo $BITBUCKET_BRANCH | sed 's/\//_/g')"
-          - apt-get update
-          - apt-get install -y git python3 python3-pip python3-boto3 curl
-          - echo $SANITIZED_BRANCH
-          - docker build -t kasmvncbuilder:latest -f builder/dockerfile.build .
-          - docker run -v $BITBUCKET_CLONE_DIR:/build  kasmvncbuilder:latest
-          - ls -la $BITBUCKET_CLONE_DIR
-          - ls -la $BITBUCKET_CLONE_DIR/kasmvnc-Linux-x86_64-*.tar.gz
-          - git clone https://bitbucket.org/awslabs/amazon-s3-bitbucket-pipelines-python.git
-          - python3 amazon-s3-bitbucket-pipelines-python/s3_upload.py "${S3_BUCKET}" $BITBUCKET_CLONE_DIR/kasmvnc-Linux-x86_64-*.tar.gz "${S3_BUILD_DIRECTORY}/${BUILD_FILE}"
-          - export S3_URL="https://${S3_BUCKET}.s3.amazonaws.com/${S3_BUILD_DIRECTORY}/${BUILD_FILE}"
-          - export BUILD_STATUS="{\"key\":\"doc\", \"state\":\"SUCCESSFUL\", \"name\":\"${BUILD_FILE}\", \"url\":\"${S3_URL}\"}"
-          - echo ${BITBUCKET_REPO_OWNER}
-          - echo ${BITBUCKET_REPO_SLUG}
-          - echo ${BITBUCKET_COMMIT}
-          - echo ${BB_AUTH_STRING}
-          - echo ${BUILD_STATUS}
-          - curl -H "Content-Type:application/json" -X POST --user "${BB_AUTH_STRING}" -d "${BUILD_STATUS}" "https://api.bitbucket.org/2.0/repositories/${BITBUCKET_REPO_OWNER}/${BITBUCKET_REPO_SLUG}/commit/${BITBUCKET_COMMIT}/statuses/build"

builder/README.md

@@ -1,22 +1,72 @@
-REQIUREMENTS
+## REQIUREMENTS
 Docker CE
 
-# build the docker image
-    cd /src_code_root
-    sudo docker build -t kasmvncbuilder:18.04 -f builder/dockerfile.build .
+# Build a deb/rpm package
+```
+# builder/build-package <os> <os_codename>
+# os_codename is what "lsb_release -c" outputs, e.g. buster, focal.
+# Packages will be placed under builder/build/
 
-# run the builder
-    sudo docker run -v /tmp:/build  kasmvncbuilder:18.04
+builder/build-package ubuntu bionic
+builder/build-package ubuntu focal
+builder/build-package debian buster
+builder/build-package debian bullseye
+builder/build-package kali kali-rolling
+builder/build-package centos core # CentOS 7
+builder/build-package fedora thirtythree
+```
 
-# tar will be on /tmp of host
-    cp /tmp/kasmvnc*.tar.gz builder/
+# Build and test a package
+```
+builder/build-and-test-deb ubuntu focal
+builder/build-and-test-rpm centos core
+```
 
-# build test desktop container with new binary installed
-    cd builder
-    sudo docker build -t kasmvnctester:18.04 -f dockerfile.test .
-    
-# run an instance of the new destkop
-    sudo docker run -d -p 80:6901 -p 5901:5901 -e VNCOPTIONS="-detectScrolling -PreferBandwidth -DynamicQualityMin=0" kasmvnctester:latest
+Open browser and point to https://localhost:443/ or https://\<ip-address\>:443/
 
-open browser and point to http://IPAddress/vnc_lite.html
-default password is "vncpassword" or use a VNC client
+3 default users are created:
+* 'foo' with default password 'foobar'. It can use mouse and keyboard.
+* 'foo-ro' with default password 'foobar'. It can only view.
+* 'foo-owner' with default password 'foobar'. It can manage other users.
+
+# Test a package
+
+If you want to test deb/rpm package you've already built, please use this:
+```
+builder/test-deb ubuntu focal
+```
+It will install the package inside a new container and run KasmVNC.
+
+Open browser and point to https://localhost:443/ or https://\<ip-address\>:443/
+
+# Package development
+
+## deb/rpm package building and testing
+
+First, a tarball is built, and then its files are copied to deb/rpm package as
+it is being built.
+Package testing stage installs the deb/rpm package in a fresh docker container
+and runs KasmVNC.
+
+```
+builder/build-tarball debian buster
+builder/build-deb debian buster
+builder/test-deb debian buster
+```
+
+Use `build-and-test-deb` to perform the whole dev lifecycle, but to iterate
+quickly, you'll need to skip building the tarball (which takes a long time), and
+just build your deb/rpm with `build-deb` and test with `test-deb`.
+
+`build-rpm` and `test-rpm` are also available.
+
+## Ensuring packages have all dependencies they need.
+
+If you're working on a deb/rpm package, testing that it has all the necessary
+dependencies is done via testing in a barebones environment (read: no XFCE). In
+this way we can be sure that runtime dependencies aren't met accidentally by
+packages installed with XFCE.
+
+```
+builder/test-deb-barebones ubuntu focal
+```

builder/build-and-test-deb

@@ -0,0 +1,16 @@
+#!/bin/bash
+
+set -e
+
+os="$1"
+codename="$2"
+
+if [[ -z "$os" ]] || [[ -z "$codename" ]]; then
+  echo "Usage: $0 <os> <codename>" >&2
+  exit 1
+fi
+
+cd "$(dirname "$0")"
+
+./build-tarball "$os" "$codename" && ./build-deb "$os" "$codename" && \
+  ./test-deb "$os" "$codename"

builder/build-and-test-rpm

@@ -0,0 +1,16 @@
+#!/bin/bash
+
+set -e
+
+os="$1"
+codename="$2"
+
+if [[ -z "$os" ]] || [[ -z "$codename" ]]; then
+  echo "Usage: $0 <os> <codename>" >&2
+  exit 1
+fi
+
+cd "$(dirname "$0")"
+
+./build-tarball "$os" "$codename" && ./build-rpm "$os" "$codename" && \
+  ./test-rpm "$os" "$codename"

builder/build-deb

@@ -0,0 +1,16 @@
+#!/bin/bash
+
+set -e
+
+cd "$(dirname "$0")/.."
+. builder/os_ver_cli.sh
+
+docker build -t debbuilder_${os}:${os_codename} -f \
+  builder/dockerfile.${os}_${os_codename}.deb.build .
+
+deb_output_dir=$(cd .. && echo $PWD)
+L_UID=$(id -u) #Ubuntu already has UID env var, but this should work on all Linix systems
+L_GID=$(id -g)
+docker run --rm -v "$deb_output_dir":/src --user $L_UID:$L_GID \
+  debbuilder_${os}:${os_codename} /bin/bash -c \
+  '/src/*/builder/build-deb-inside-docker'

builder/build-deb-inside-docker

@@ -0,0 +1,14 @@
+#!/bin/bash
+
+set -e
+
+cd "$(dirname "$0")/.."
+
+os=$(lsb_release -is | tr '[:upper:]' '[:lower:]')
+os_codename=$(lsb_release -cs)
+os_dir="builder/build/${os_codename}"
+
+dpkg-buildpackage -us -uc -b
+mkdir -p "$os_dir"
+cp ../*.deb "$os_dir"
+lintian ../*.deb || true

builder/build-package

@@ -0,0 +1,19 @@
+#!/bin/bash
+
+set -e
+
+os="$1"
+codename="$2"
+
+detect_package_format() {
+  package_format=rpm
+  if ls builder/dockerfile*"$os"* | grep -q .deb.build; then
+    package_format=deb
+  fi
+}
+
+cd "$(dirname "$0")/.."
+
+detect_package_format
+builder/build-tarball "$os" "$codename"
+builder/build-${package_format} "$os" "$codename"

builder/build-rpm

@@ -0,0 +1,16 @@
+#!/bin/bash
+
+set -e
+
+cd "$(dirname "$0")/.."
+. builder/os_ver_cli.sh
+
+docker build -t kasmvnc_rpmbuilder_${os}:${os_codename} -f \
+  builder/dockerfile.${os}_${os_codename}.rpm.build .
+
+source_dir=$(echo $PWD)
+L_UID=$(id -u) #Ubuntu already has UID env var, but this should work on all Linix systems
+L_GID=$(id -g)
+docker run --rm -v "$source_dir":/src --user $L_UID:$L_GID \
+  kasmvnc_rpmbuilder_${os}:${os_codename} /bin/bash -c \
+  '/src/builder/build-rpm-inside-docker'

builder/build-rpm-inside-docker

@@ -0,0 +1,30 @@
+#!/bin/bash
+
+set -e
+
+prepare_build_env() {
+  rpmdev-setuptree
+  copy_spec_and_tar_with_binaries
+}
+
+copy_spec_and_tar_with_binaries() {
+  cp /src/centos/kasmvncserver.spec ~/rpmbuild/SPECS/
+  cp /src/builder/build/kasmvnc.${os}_${os_codename}.tar.gz \
+    ~/rpmbuild/SOURCES/
+}
+
+copy_rpm_to_build_dir() {
+  cd /src/builder && \
+    mkdir -p "$os_dir" && cp ~/rpmbuild/RPMS/*/*.rpm ${os_dir}
+}
+
+cd "$(dirname "$0")/.."
+
+os=$(lsb_release -is | tr '[:upper:]' '[:lower:]')
+os_codename=$(lsb_release -cs | tr '[:upper:]' '[:lower:]')
+os_dir="build/${os}_${os_codename}"
+
+prepare_build_env
+rpmbuild -ba ~/rpmbuild/SPECS/kasmvncserver.spec
+copy_rpm_to_build_dir
+rpmlint "$os_dir"/*.rpm || true

builder/build-tarball

@@ -0,0 +1,31 @@
+#!/bin/bash
+
+set -e
+
+build_www_dir() {
+  local webpacked_www=$PWD/builder/www
+  local src_www=kasmweb
+
+  if [ "$src_www" -nt "$webpacked_www" ]; then
+    docker build -t kasmweb/www -f builder/dockerfile.www.build .
+    docker run --rm -v $PWD/builder/www:/build kasmweb/www:latest
+  fi
+}
+
+shared_with_docker_dir=${GITLAB_SHARED_DIND_DIR:-/tmp}
+
+cd "$(dirname "$0")/.."
+. builder/os_ver_cli.sh
+
+build_www_dir
+
+docker build -t kasmvncbuilder:$os_codename \
+  -f builder/dockerfile.${os}_${os_codename}.build .
+mkdir -p builder/build
+docker run -v $shared_with_docker_dir:/build --rm kasmvncbuilder:$os_codename
+
+L_GID=$(id -g)
+L_UID=$(id -u)
+tarball_name="kasmvnc.${os}_${os_codename}.tar.gz"
+chown $L_UID:$L_GID $shared_with_docker_dir/$tarball_name
+mv $shared_with_docker_dir/$tarball_name $PWD/builder/build/

builder/build.sh

@@ -1,5 +1,12 @@
 #!/bin/sh -e
 
+detect_quilt() {
+  if which quilt 1>/dev/null; then
+    QUILT_PRESENT=1
+    export QUILT_PATCHES=debian/patches
+  fi
+}
+
 # For build-dep to work, the apt sources need to have the source server
 #sudo apt-get build-dep xorg-server
 
@@ -7,7 +14,10 @@
 
 # Ubuntu applies a million patches, but here we use upstream to simplify matters
 cd /tmp
-wget https://www.x.org/archive//individual/xserver/xorg-server-1.18.4.tar.bz2
+# default to the version of x in Ubuntu 18.04, otherwise caller will need to specify
+XORG_VER=${XORG_VER:-"1.19.6"}
+XORG_PATCH=$(echo "$XORG_VER" | grep -Po '^\d.\d+' | sed 's#\.##')
+wget https://www.x.org/archive/individual/xserver/xorg-server-${XORG_VER}.tar.bz2
 
 #git clone https://kasmweb@bitbucket.org/kasmtech/kasmvnc.git
 #cd kasmvnc
@@ -20,13 +30,17 @@ sed -i -e '/find_package(FLTK/s@^@#@' \
 	-e '/add_subdirectory(tests/s@^@#@' \
 	CMakeLists.txt
 
-cmake .
+cmake -D CMAKE_BUILD_TYPE=RelWithDebInfo .
 make -j5
 
-tar -C unix/xserver -xvf /tmp/xorg-server-1.18.4.tar.bz2 --strip-components=1
+tar -C unix/xserver -xvf /tmp/xorg-server-${XORG_VER}.tar.bz2 --strip-components=1
 
 cd unix/xserver
-patch -Np1 -i ../xserver118.patch
+patch -Np1 -i ../xserver${XORG_PATCH}.patch
+if [[ $XORG_VER =~ ^1\.20\..*$ ]]; then
+  patch -Np1 -i ../xserver120.7.patch
+fi
+
 autoreconf -i
 # Configuring Xorg is long and has many distro-specific paths.
 # The distro paths start after prefix and end with the font path,
@@ -37,7 +51,8 @@ autoreconf -i
 	--with-xkb-output=/var/lib/xkb \
 	--with-xkb-bin-directory=/usr/bin \
 	--with-default-font-path="/usr/share/fonts/X11/misc,/usr/share/fonts/X11/cyrillic,/usr/share/fonts/X11/100dpi/:unscaled,/usr/share/fonts/X11/75dpi/:unscaled,/usr/share/fonts/X11/Type1,/usr/share/fonts/X11/100dpi,/usr/share/fonts/X11/75dpi,built-ins" \
-	--with-pic --without-dtrace --disable-static --disable-dri \
+	--with-pic --without-dtrace --disable-dri \
+        --disable-static \
 	--disable-xinerama --disable-xvfb --disable-xnest --disable-xorg \
 	--disable-dmx --disable-xwin --disable-xephyr --disable-kdrive \
 	--disable-config-hal --disable-config-udev \
@@ -52,15 +67,20 @@ ln -s /src/unix/xserver/hw/vnc/Xvnc Xvnc
 cd ..
 mkdir -p man/man1
 touch man/man1/Xserver.1
-touch man/man1/Xvnc.1
+cp /src/unix/xserver/hw/vnc/Xvnc.man man/man1/Xvnc.1
 mkdir lib
 cd lib
-ln -s /usr/lib/x86_64-linux-gnu/dri dri
+if [ -d /usr/lib/x86_64-linux-gnu/dri ]; then
+  ln -s /usr/lib/x86_64-linux-gnu/dri dri
+else
+  ln -s /usr/lib64/dri dri
+fi
 cd /src
-sed  $'s#pushd $TMPDIR/inst#CWD=$(pwd)\\\ncd $TMPDIR/inst#' release/maketarball > release/maketarball2
-sed  $'s#popd#cd $CWD#' release/maketarball2 > release/maketarball3
-mv release/maketarball3 release/maketarball
 
+detect_quilt
+if [ -n "$QUILT_PRESENT" ]; then
+  quilt push -a
+fi
 make servertarball
 
-cp kasmvnc*.tar.gz /build/
+cp kasmvnc*.tar.gz /build/kasmvnc.${KASMVNC_BUILD_OS}_${KASMVNC_BUILD_OS_CODENAME}.tar.gz

builder/build_www.sh

@@ -0,0 +1,18 @@
+#!/bin/bash
+
+# clear previous build
+rm -rf /build/*
+
+# build webpack
+npm run build
+# remove node stuff from directory
+rm -rf node_modules/
+# copy all to build dir
+cp -R ./* /build/
+
+# remove unneccesary files
+cd /build
+rm *.md
+rm AUTHORS
+rm vnc.html
+rm vnc_lite.html

builder/dockerfile.build

@@ -1,29 +0,0 @@
-FROM ubuntu:18.04
-
-RUN sed -i 's$# deb-src$deb-src$' /etc/apt/sources.list
-
-RUN apt-get update && \
-      apt-get -y install sudo
-
-RUN apt-get -y build-dep xorg-server libxfont-dev
-RUN apt-get -y install cmake git libjpeg-dev libgnutls28-dev vim wget tightvncserver
-RUN apt-get -y install libjpeg-dev libpng-dev libtiff-dev libgif-dev libavcodec-dev libssl-dev
-
-# Additions for webp
-RUN cd /tmp && wget https://storage.googleapis.com/downloads.webmproject.org/releases/webp/libwebp-1.0.2.tar.gz
-RUN cd /tmp && tar -xzvf /tmp/libwebp-*
-RUN cd /tmp/libwebp-1.0.2 && ./configure && make && make install
-
-# Fix for older required libs
-RUN cd /tmp && wget http://launchpadlibrarian.net/347526424/libxfont1-dev_1.5.2-4ubuntu2_amd64.deb && \
-    wget http://launchpadlibrarian.net/347526425/libxfont1_1.5.2-4ubuntu2_amd64.deb && \
-    dpkg -i libxfont1_1.5.2-4ubuntu2_amd64.deb && \
-    dpkg -i libxfont1-dev_1.5.2-4ubuntu2_amd64.deb
-
-RUN useradd -m docker && echo "docker:docker" | chpasswd && adduser docker sudo
-
-COPY . /src
-RUN chown -R docker:docker /src
-
-USER docker
-ENTRYPOINT ["/src/builder/build.sh"]

builder/dockerfile.centos_core.barebones.rpm.test

@@ -0,0 +1,18 @@
+FROM centos:centos7
+
+RUN yum install -y xterm
+RUN yum install -y vim less
+RUN yum install -y redhat-lsb-core
+
+ARG KASMVNC_PACKAGE_DIR
+COPY $KASMVNC_PACKAGE_DIR/*.rpm /tmp
+RUN yum localinstall -y /tmp/*.rpm
+
+RUN useradd -m foo
+
+USER foo:kasmvnc-cert
+
+RUN mkdir ~/.vnc && echo '/usr/bin/xterm &' >> ~/.vnc/xstartup && \
+  chmod +x ~/.vnc/xstartup
+
+ENTRYPOINT bash -c "echo -e \"$VNC_PW\n$VNC_PW\n\" | kasmvncpasswd -w -u \"$VNC_USER\" && vncserver :1 -interface 0.0.0.0 && vncserver -kill :1 && vncserver :1 -depth 24 -geometry 1280x1050 -websocketPort 8443 -cert /etc/pki/tls/private/kasmvnc.pem -sslOnly -FrameRate=24 -interface 0.0.0.0 -httpd /usr/share/kasmvnc/www && tail -f $HOME/.vnc/*.log "

builder/dockerfile.centos_core.build

@@ -0,0 +1,29 @@
+FROM centos:centos7
+
+ENV KASMVNC_BUILD_OS centos
+ENV KASMVNC_BUILD_OS_CODENAME core
+
+RUN yum install -y build-dep xorg-server libxfont-dev sudo
+RUN yum install -y gcc cmake git libjpeg-dev libgnutls28-dev vim wget tightvncserver
+RUN yum install -y libjpeg-dev libpng-dev libtiff-dev libgif-dev libavcodec-dev openssl-devel
+RUN yum install -y make
+RUN yum group install -y "Development Tools"
+RUN yum install -y xorg-x11-server-devel zlib-devel libjpeg-turbo-devel
+RUN yum install -y libxkbfile-devel libXfont2-devel xorg-x11-font-utils \
+  xorg-x11-xtrans-devel xorg-x11-xkb-utils-devel
+RUN yum install -y mesa-dri-drivers
+
+# Additions for webp
+RUN cd /tmp && wget https://storage.googleapis.com/downloads.webmproject.org/releases/webp/libwebp-1.0.2.tar.gz
+RUN cd /tmp && tar -xzvf /tmp/libwebp-*
+RUN cd /tmp/libwebp-1.0.2 && \
+    ./configure --enable-static --disable-shared && \
+    make && make install
+
+RUN useradd -m docker && echo "docker:docker" | chpasswd
+
+COPY . /src
+RUN chown -R docker:docker /src
+
+USER docker
+ENTRYPOINT ["/src/builder/build.sh"]

builder/dockerfile.centos_core.rpm.build

@@ -0,0 +1,12 @@
+FROM centos:centos7
+
+RUN yum install -y rpm* gpg* rng-tools rpmlint
+RUN yum install -y tree vim less
+RUN yum install -y redhat-lsb-core
+
+COPY centos/*.spec /tmp
+RUN yum-builddep -y /tmp/*.spec
+
+RUN useradd -m docker && echo "docker:docker" | chpasswd
+
+USER docker

builder/dockerfile.centos_core.rpm.test

@@ -0,0 +1,61 @@
+FROM centos:centos7
+
+ENV DISPLAY=:1 \
+    VNC_PORT=8443 \
+    VNC_RESOLUTION=1280x720 \
+    MAX_FRAME_RATE=24 \
+    VNCOPTIONS="-PreferBandwidth -DynamicQualityMin=4 -DynamicQualityMax=7" \
+    HOME=/home/user \
+    TERM=xterm \
+    STARTUPDIR=/dockerstartup \
+    INST_SCRIPTS=/dockerstartup/install \
+    KASM_RX_HOME=/dockerstartup/kasmrx \
+    DEBIAN_FRONTEND=noninteractive \
+    VNC_COL_DEPTH=24 \
+    VNC_RESOLUTION=1280x1024 \
+    VNC_PW=vncpassword \
+    VNC_USER=user \
+    VNC_VIEW_ONLY_PW=vncviewonlypassword \
+    LD_LIBRARY_PATH=/usr/local/lib/ \
+    OMP_WAIT_POLICY=PASSIVE \
+    SHELL=/bin/bash \
+    SINGLE_APPLICATION=0 \
+    KASMVNC_BUILD_OS=centos \
+    KASMVNC_BUILD_OS_CODENAME=core
+
+EXPOSE $VNC_PORT
+
+WORKDIR $HOME
+
+### REQUIRED STUFF ###
+
+RUN yum install -y openssl xterm gettext wget
+RUN yum install -y centos-release-scl-rh && yum install -y nss_wrapper
+RUN yum install -y xorg-x11-server xorg-x11-xauth xorg-x11-xkb-utils \
+  xkeyboard-config xorg-x11-server-utils
+RUN yum install -y epel-release && yum groupinstall xfce -y
+RUN yum erase -y pm-utils xscreensaver*
+RUN yum install -y redhat-lsb-core
+RUN yum install -y vim less
+
+RUN echo 'source $STARTUPDIR/generate_container_user' >> $HOME/.bashrc
+
+RUN mkdir -p $STARTUPDIR
+COPY startup/ $STARTUPDIR
+
+### START CUSTOM STUFF ####
+
+ARG KASMVNC_PACKAGE_DIR
+COPY $KASMVNC_PACKAGE_DIR/*.rpm /tmp
+RUN yum localinstall -y /tmp/*.rpm
+
+### END CUSTOM STUFF ###
+
+RUN chown -R 1000:0 $HOME
+USER 1000:kasmvnc-cert
+WORKDIR $HOME
+
+RUN mkdir ~/.vnc && echo '/usr/bin/xfce4-session &' >> ~/.vnc/xstartup && \
+  chmod +x ~/.vnc/xstartup
+
+ENTRYPOINT [ "/dockerstartup/vnc_startup.sh" ]

builder/dockerfile.debian_bullseye.build

@@ -0,0 +1,31 @@
+FROM debian:bullseye-slim
+
+ENV KASMVNC_BUILD_OS debian
+ENV KASMVNC_BUILD_OS_CODENAME bullseye
+ENV XORG_VER 1.20.10
+ENV DEBIAN_FRONTEND noninteractive
+
+RUN grep '^deb'  /etc/apt/sources.list | sed 's#^deb#deb-src#' >> /etc/apt/sources.list
+
+RUN apt-get update && \
+      apt-get -y install sudo
+
+RUN DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends tzdata
+RUN apt-get update && apt-get -y build-dep xorg-server libxfont-dev
+RUN apt-get update && apt-get -y install cmake git libjpeg-dev libgnutls28-dev vim wget tightvncserver
+RUN apt-get update && apt-get -y install libjpeg-dev libpng-dev libtiff-dev libgif-dev libavcodec-dev libssl-dev
+
+# Additions for webp
+RUN cd /tmp && wget https://storage.googleapis.com/downloads.webmproject.org/releases/webp/libwebp-1.0.2.tar.gz
+RUN cd /tmp && tar -xzvf /tmp/libwebp-*
+RUN cd /tmp/libwebp-1.0.2 && \
+    ./configure --enable-static --disable-shared && \
+    make && make install
+
+RUN useradd -m docker && echo "docker:docker" | chpasswd && adduser docker sudo
+
+COPY . /src
+RUN chown -R docker:docker /src
+
+USER docker
+ENTRYPOINT ["/src/builder/build.sh"]

builder/dockerfile.debian_bullseye.deb.build

@@ -0,0 +1,12 @@
+FROM debian:bullseye
+
+ENV DEBIAN_FRONTEND noninteractive
+
+RUN apt-get update && \
+      apt-get -y install vim build-essential devscripts equivs
+
+# Install build-deps for the package.
+COPY ./debian/control /tmp
+RUN apt-get update && echo YYY | mk-build-deps --install --remove /tmp/control
+
+USER 1000

builder/dockerfile.debian_bullseye.deb.test

@@ -0,0 +1,54 @@
+FROM debian:bullseye-slim
+
+ENV DISPLAY=:1 \
+    VNC_PORT=8443 \
+    VNC_RESOLUTION=1280x720 \
+    MAX_FRAME_RATE=24 \
+    VNCOPTIONS="-PreferBandwidth -DynamicQualityMin=4 -DynamicQualityMax=7" \
+    HOME=/home/user \
+    TERM=xterm \
+    STARTUPDIR=/dockerstartup \
+    INST_SCRIPTS=/dockerstartup/install \
+    KASM_RX_HOME=/dockerstartup/kasmrx \
+    DEBIAN_FRONTEND=noninteractive \
+    VNC_COL_DEPTH=24 \
+    VNC_RESOLUTION=1280x1024 \
+    VNC_PW=vncpassword \
+    VNC_USER=user \
+    VNC_VIEW_ONLY_PW=vncviewonlypassword \
+    LD_LIBRARY_PATH=/usr/local/lib/ \
+    OMP_WAIT_POLICY=PASSIVE \
+    SHELL=/bin/bash \
+    SINGLE_APPLICATION=0 \
+    KASMVNC_BUILD_OS=debian \
+    KASMVNC_BUILD_OS_CODENAME=buster
+
+EXPOSE $VNC_PORT
+
+WORKDIR $HOME
+
+### REQUIRED STUFF ###
+
+RUN apt-get update && apt-get install -y supervisor xfce4 xfce4-terminal dbus-x11 xterm libnss-wrapper gettext wget
+RUN apt-get purge -y pm-utils xscreensaver*
+RUN apt-get update && apt-get install -y vim less
+RUN apt-get update && apt-get -y install lsb-release
+
+RUN echo 'source $STARTUPDIR/generate_container_user' >> $HOME/.bashrc
+
+RUN mkdir -p $STARTUPDIR
+COPY startup/ $STARTUPDIR
+
+### START CUSTOM STUFF ####
+
+ARG KASMVNC_PACKAGE_DIR
+COPY $KASMVNC_PACKAGE_DIR/kasmvncserver_*.deb /tmp
+RUN dpkg -i /tmp/*.deb; apt-get -yf install
+
+### END CUSTOM STUFF ###
+
+RUN chown -R 1000:0 $HOME
+USER 1000:ssl-cert
+WORKDIR $HOME
+
+ENTRYPOINT [ "/dockerstartup/vnc_startup.sh" ]

builder/dockerfile.debian_buster.barebones.deb.test

@@ -0,0 +1,19 @@
+FROM debian:buster-slim
+
+ARG KASMVNC_PACKAGE_DIR
+COPY $KASMVNC_PACKAGE_DIR/kasmvncserver_*.deb /tmp
+RUN apt-get update && dpkg -i /tmp/*.deb; apt-get -yf install
+RUN apt-get update && apt-get -y install xterm
+
+COPY startup/deb/kasmvncserver-easy-start /usr/local/bin
+
+RUN useradd -m foo
+
+USER foo:ssl-cert
+
+RUN mkdir ~/.vnc && echo '/usr/bin/xterm &' >> ~/.vnc/xstartup && \
+  chmod +x ~/.vnc/xstartup
+
+ENTRYPOINT bash -c "echo -e \"$VNC_PW\n$VNC_PW\n\" | \
+  kasmvncpasswd -w -u $VNC_USER $HOME/.kasmpasswd && \
+  kasmvncserver-easy-start && tail -f $HOME/.vnc/*.log"

builder/dockerfile.debian_buster.build

@@ -0,0 +1,31 @@
+FROM debian:buster
+
+ENV KASMVNC_BUILD_OS debian
+ENV KASMVNC_BUILD_OS_CODENAME buster
+ENV XORG_VER 1.20.10
+ENV DEBIAN_FRONTEND noninteractive
+
+RUN grep '^deb'  /etc/apt/sources.list | sed 's#^deb#deb-src#' >> /etc/apt/sources.list
+
+RUN apt-get update && \
+      apt-get -y install sudo
+
+RUN DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends tzdata
+RUN apt-get update && apt-get -y build-dep xorg-server libxfont-dev
+RUN apt-get update && apt-get -y install cmake git libjpeg-dev libgnutls28-dev vim wget tightvncserver
+RUN apt-get update && apt-get -y install libjpeg-dev libpng-dev libtiff-dev libgif-dev libavcodec-dev libssl-dev
+
+# Additions for webp
+RUN cd /tmp && wget https://storage.googleapis.com/downloads.webmproject.org/releases/webp/libwebp-1.0.2.tar.gz
+RUN cd /tmp && tar -xzvf /tmp/libwebp-*
+RUN cd /tmp/libwebp-1.0.2 && \
+    ./configure --enable-static --disable-shared && \
+    make && make install
+
+RUN useradd -m docker && echo "docker:docker" | chpasswd && adduser docker sudo
+
+COPY . /src
+RUN chown -R docker:docker /src
+
+USER docker
+ENTRYPOINT ["/src/builder/build.sh"]

builder/dockerfile.debian_buster.deb.build

@@ -0,0 +1,12 @@
+FROM debian:buster
+
+ENV DEBIAN_FRONTEND noninteractive
+
+RUN apt-get update && \
+      apt-get -y install vim build-essential devscripts equivs
+
+# Install build-deps for the package.
+COPY ./debian/control /tmp
+RUN apt-get update && echo YYY | mk-build-deps --install --remove /tmp/control
+
+USER 1000

builder/dockerfile.debian_buster.deb.test

@@ -0,0 +1,62 @@
+FROM debian:buster-slim
+
+ENV DISPLAY=:1 \
+    VNC_PORT=8443 \
+    VNC_RESOLUTION=1280x720 \
+    MAX_FRAME_RATE=24 \
+    VNCOPTIONS="-PreferBandwidth -DynamicQualityMin=4 -DynamicQualityMax=7" \
+    HOME=/home/user \
+    TERM=xterm \
+    STARTUPDIR=/dockerstartup \
+    INST_SCRIPTS=/dockerstartup/install \
+    KASM_RX_HOME=/dockerstartup/kasmrx \
+    DEBIAN_FRONTEND=noninteractive \
+    VNC_COL_DEPTH=24 \
+    VNC_RESOLUTION=1280x1024 \
+    VNC_PW=vncpassword \
+    VNC_USER=user \
+    VNC_VIEW_ONLY_PW=vncviewonlypassword \
+    LD_LIBRARY_PATH=/usr/local/lib/ \
+    OMP_WAIT_POLICY=PASSIVE \
+    SHELL=/bin/bash \
+    SINGLE_APPLICATION=0 \
+    KASMVNC_BUILD_OS=debian \
+    KASMVNC_BUILD_OS_CODENAME=buster
+
+EXPOSE $VNC_PORT
+
+WORKDIR $HOME
+
+### REQUIRED STUFF ###
+
+RUN apt-get update && apt-get install -y supervisor xfce4 xfce4-terminal xterm libnss-wrapper gettext wget
+RUN apt-get purge -y pm-utils xscreensaver*
+RUN apt-get update && apt-get install -y vim less
+RUN apt-get update && apt-get -y install lsb-release
+
+RUN apt-get update && apt-get install -y task-cinnamon-desktop
+RUN apt-get update && apt-get install -y task-gnome-desktop
+RUN mkdir -p /usr/share/man/man1
+RUN apt-get update && apt-get install -y apt-utils openjdk-11-jre
+RUN apt-get update && apt-get install -y task-lxde-desktop
+RUN apt-get update && apt-get install -y task-mate-desktop
+RUN apt-get update && apt-get install -y task-kde-desktop
+
+RUN echo 'source $STARTUPDIR/generate_container_user' >> $HOME/.bashrc
+
+RUN mkdir -p $STARTUPDIR
+COPY startup/ $STARTUPDIR
+
+### START CUSTOM STUFF ####
+
+ARG KASMVNC_PACKAGE_DIR
+COPY $KASMVNC_PACKAGE_DIR/kasmvncserver_*.deb /tmp
+RUN dpkg -i /tmp/*.deb; apt-get -yf install
+
+### END CUSTOM STUFF ###
+
+RUN chown -R 1000:0 $HOME
+USER 1000:ssl-cert
+WORKDIR $HOME
+
+ENTRYPOINT [ "/dockerstartup/vnc_startup.sh" ]

builder/dockerfile.fedora_thirtythree.barebones.rpm.test

@@ -0,0 +1,18 @@
+FROM fedora:33
+
+RUN dnf install -y xterm
+RUN dnf install -y vim less
+RUN yum install -y redhat-lsb-core
+
+ARG KASMVNC_PACKAGE_DIR
+COPY $KASMVNC_PACKAGE_DIR/*.rpm /tmp
+RUN dnf localinstall -y /tmp/*.rpm
+
+RUN useradd -m foo
+
+USER foo:kasmvnc-cert
+
+RUN mkdir ~/.vnc && echo '/usr/bin/xterm &' >> ~/.vnc/xstartup && \
+  chmod +x ~/.vnc/xstartup
+
+ENTRYPOINT bash -c "echo -e \"$VNC_PW\n$VNC_PW\n\" | kasmvncpasswd -w -u \"$VNC_USER\" && vncserver :1 -interface 0.0.0.0 && vncserver -kill :1 && vncserver :1 -depth 24 -geometry 1280x1050 -websocketPort 8443 -cert /etc/pki/tls/private/kasmvnc.pem -sslOnly -FrameRate=24 -interface 0.0.0.0 -httpd /usr/share/kasmvnc/www && tail -f $HOME/.vnc/*.log "

builder/dockerfile.fedora_thirtythree.build

@@ -0,0 +1,38 @@
+FROM fedora:33
+
+ENV KASMVNC_BUILD_OS fedora
+ENV KASMVNC_BUILD_OS_CODENAME thirtythree
+ENV XORG_VER 1.20.10
+
+# RUN dnf install -y build-dep xorg-server libxfont-dev sudo
+RUN dnf install -y gcc cmake git gnutls-devel vim wget
+#tightvncserver
+RUN dnf install -y libjpeg-turbo-devel libpng-devel libtiff-devel giflib-devel openssl-devel
+
+#libavcodec-dev
+RUN dnf -y install https://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm
+RUN dnf -y install https://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm
+RUN dnf -y install ffmpeg-devel
+
+RUN dnf install -y make
+RUN dnf group install -y "Development Tools"
+RUN dnf install -y xorg-x11-server-devel zlib-devel libjpeg-turbo-devel
+RUN dnf install -y libxkbfile-devel libXfont2-devel xorg-x11-font-utils \
+  xorg-x11-xtrans-devel xorg-x11-xkb-utils-devel
+RUN dnf install -y mesa-dri-drivers
+RUN dnf install -y bzip2 redhat-lsb-core
+
+# Additions for webp
+RUN cd /tmp && wget https://storage.googleapis.com/downloads.webmproject.org/releases/webp/libwebp-1.0.2.tar.gz
+RUN cd /tmp && tar -xzvf /tmp/libwebp-*
+RUN cd /tmp/libwebp-1.0.2 && \
+    ./configure --enable-static --disable-shared && \
+    make && make install
+
+RUN useradd -m docker && echo "docker:docker" | chpasswd
+
+COPY . /src
+RUN chown -R docker:docker /src
+
+USER docker
+ENTRYPOINT ["/src/builder/build.sh"]

builder/dockerfile.fedora_thirtythree.rpm.build

@@ -0,0 +1,13 @@
+FROM fedora:33
+
+RUN dnf install -y fedora-packager fedora-review
+RUN dnf install -y tree vim less
+RUN dnf install -y redhat-lsb-core
+RUN dnf install -y dnf-plugins-core
+
+COPY centos/*.spec /tmp
+RUN dnf builddep -y /tmp/*.spec
+
+RUN useradd -m docker && echo "docker:docker" | chpasswd
+
+USER docker

builder/dockerfile.fedora_thirtythree.rpm.test

@@ -0,0 +1,64 @@
+FROM fedora:33
+
+ENV DISPLAY=:1 \
+    VNC_PORT=8443 \
+    VNC_RESOLUTION=1280x720 \
+    MAX_FRAME_RATE=24 \
+    VNCOPTIONS="-PreferBandwidth -DynamicQualityMin=4 -DynamicQualityMax=7" \
+    HOME=/home/user \
+    TERM=xterm \
+    STARTUPDIR=/dockerstartup \
+    INST_SCRIPTS=/dockerstartup/install \
+    KASM_RX_HOME=/dockerstartup/kasmrx \
+    DEBIAN_FRONTEND=noninteractive \
+    VNC_COL_DEPTH=24 \
+    VNC_RESOLUTION=1280x1024 \
+    VNC_PW=vncpassword \
+    VNC_USER=user \
+    VNC_VIEW_ONLY_PW=vncviewonlypassword \
+    LD_LIBRARY_PATH=/usr/local/lib/ \
+    OMP_WAIT_POLICY=PASSIVE \
+    SHELL=/bin/bash \
+    SINGLE_APPLICATION=0 \
+    KASMVNC_BUILD_OS=fedora \
+    KASMVNC_BUILD_OS_CODENAME=thirtythree
+
+EXPOSE $VNC_PORT
+
+WORKDIR $HOME
+
+### REQUIRED STUFF ###
+
+RUN dnf install -y openssl xterm gettext wget
+RUN dnf install -y nss_wrapper
+RUN dnf install -y xorg-x11-xauth xorg-x11-xkb-utils \
+  xkeyboard-config xorg-x11-server-utils
+# xorg-x11-server-Xorg
+# RUN dnf install -y @xfce-desktop-environment
+RUN dnf group install -y lxde-desktop
+RUN dnf erase -y pm-utils xscreensaver*
+RUN dnf install -y redhat-lsb-core
+RUN dnf install -y vim less
+
+RUN echo 'source $STARTUPDIR/generate_container_user' >> $HOME/.bashrc
+
+RUN mkdir -p $STARTUPDIR
+COPY startup/ $STARTUPDIR
+
+### START CUSTOM STUFF ####
+
+ARG KASMVNC_PACKAGE_DIR
+COPY $KASMVNC_PACKAGE_DIR/*.rpm /tmp
+# RUN dnf remove -y tigervnc-server-minimal
+RUN dnf localinstall -y --allowerasing /tmp/*.rpm
+
+### END CUSTOM STUFF ###
+
+RUN chown -R 1000:0 $HOME
+USER 1000:kasmvnc-cert
+WORKDIR $HOME
+
+RUN mkdir ~/.vnc && echo '/usr/bin/lxsession -s LXDE &' >> ~/.vnc/xstartup && \
+  chmod +x ~/.vnc/xstartup
+
+ENTRYPOINT [ "/dockerstartup/vnc_startup.sh" ]

builder/dockerfile.kali_kali-rolling.build

@@ -0,0 +1,31 @@
+FROM kalilinux/kali-rolling:latest
+
+ENV KASMVNC_BUILD_OS kali
+ENV KASMVNC_BUILD_OS_CODENAME kali-rolling
+ENV XORG_VER 1.20.10
+ENV DEBIAN_FRONTEND noninteractive
+
+RUN grep '^deb'  /etc/apt/sources.list | sed 's#^deb#deb-src#' >> /etc/apt/sources.list
+
+RUN apt-get update && \
+      apt-get -y install sudo
+
+RUN DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends tzdata
+RUN apt-get update && apt-get -y build-dep xorg-server libxfont-dev
+RUN apt-get update && apt-get -y install cmake git libjpeg-dev libgnutls28-dev vim wget tightvncserver
+RUN apt-get update && apt-get -y install libjpeg-dev libpng-dev libtiff-dev libgif-dev libavcodec-dev libssl-dev
+
+# Additions for webp
+RUN cd /tmp && wget https://storage.googleapis.com/downloads.webmproject.org/releases/webp/libwebp-1.0.2.tar.gz
+RUN cd /tmp && tar -xzvf /tmp/libwebp-*
+RUN cd /tmp/libwebp-1.0.2 && \
+    ./configure --enable-static --disable-shared && \
+    make && make install
+
+RUN useradd -m docker && echo "docker:docker" | chpasswd && adduser docker sudo
+
+COPY . /src
+RUN chown -R docker:docker /src
+
+USER docker
+ENTRYPOINT ["/src/builder/build.sh"]

builder/dockerfile.kali_kali-rolling.deb.build

@@ -0,0 +1,12 @@
+FROM kalilinux/kali-rolling:latest
+
+ENV DEBIAN_FRONTEND noninteractive
+
+RUN apt-get update && \
+      apt-get -y install vim build-essential devscripts equivs
+
+# Install build-deps for the package.
+COPY ./debian/control /tmp
+RUN apt-get update && echo YYY | mk-build-deps --install --remove /tmp/control
+
+USER 1000

builder/dockerfile.kali_kali-rolling.deb.test

@@ -0,0 +1,54 @@
+FROM kalilinux/kali-rolling:latest
+
+ENV DISPLAY=:1 \
+    VNC_PORT=8443 \
+    VNC_RESOLUTION=1280x720 \
+    MAX_FRAME_RATE=24 \
+    VNCOPTIONS="-PreferBandwidth -DynamicQualityMin=4 -DynamicQualityMax=7" \
+    HOME=/home/user \
+    TERM=xterm \
+    STARTUPDIR=/dockerstartup \
+    INST_SCRIPTS=/dockerstartup/install \
+    KASM_RX_HOME=/dockerstartup/kasmrx \
+    DEBIAN_FRONTEND=noninteractive \
+    VNC_COL_DEPTH=24 \
+    VNC_RESOLUTION=1280x1024 \
+    VNC_PW=vncpassword \
+    VNC_USER=user \
+    VNC_VIEW_ONLY_PW=vncviewonlypassword \
+    LD_LIBRARY_PATH=/usr/local/lib/ \
+    OMP_WAIT_POLICY=PASSIVE \
+    SHELL=/bin/bash \
+    SINGLE_APPLICATION=0 \
+    KASMVNC_BUILD_OS=ubuntu \
+    KASMVNC_BUILD_OS_VER=18.04
+
+EXPOSE $VNC_PORT
+
+WORKDIR $HOME
+
+### REQUIRED STUFF ###
+
+RUN apt-get update && apt-get install -y supervisor xfce4 xfce4-terminal dbus-x11 xterm libnss-wrapper gettext wget
+RUN apt-get purge -y pm-utils xscreensaver*
+RUN apt-get update && apt-get install -y vim less
+RUN apt-get update && apt-get -y install lsb-release
+
+RUN echo 'source $STARTUPDIR/generate_container_user' >> $HOME/.bashrc
+
+RUN mkdir -p $STARTUPDIR
+COPY startup/ $STARTUPDIR
+
+### START CUSTOM STUFF ####
+
+ARG KASMVNC_PACKAGE_DIR
+COPY $KASMVNC_PACKAGE_DIR/kasmvncserver_*.deb /tmp
+RUN dpkg -i /tmp/*.deb; apt-get -yf install
+
+### END CUSTOM STUFF ###
+
+RUN chown -R 1000:0 $HOME
+USER 1000:ssl-cert
+WORKDIR $HOME
+
+ENTRYPOINT [ "/dockerstartup/vnc_startup.sh" ]

builder/dockerfile.test

@@ -1,12 +0,0 @@
-FROM kasmweb/desktop-deluxe:develop
-
-ENV VNCOPTIONS "-PreferBandwidth -DynamicQualityMin=3 -DynamicQualityMax=7 -detectScrolling"
-
-USER root
- 
-COPY kasmvnc-Linux-x86_64-*.tar.gz /tmp/
-RUN tar -xzvf /tmp/kasmvnc-Linux-x86_64-*.tar.gz --strip 1 -C /
-
-USER 1000
-
-CMD ["--tail-log"]

builder/dockerfile.ubuntu_bionic.build

@@ -0,0 +1,35 @@
+FROM ubuntu:18.04
+
+ENV KASMVNC_BUILD_OS ubuntu
+ENV KASMVNC_BUILD_OS_CODENAME bionic
+ENV XORG_VER 1.20.10
+
+RUN sed -i 's$# deb-src$deb-src$' /etc/apt/sources.list
+
+RUN apt-get update && \
+      apt-get -y install sudo
+
+RUN apt-get update && apt-get -y build-dep xorg-server libxfont-dev
+RUN apt-get update && apt-get -y install cmake git libjpeg-dev libgnutls28-dev vim wget tightvncserver
+RUN apt-get update && apt-get -y install libjpeg-dev libpng-dev libtiff-dev libgif-dev libavcodec-dev libssl-dev
+
+# Additions for webp
+RUN cd /tmp && wget https://storage.googleapis.com/downloads.webmproject.org/releases/webp/libwebp-1.0.2.tar.gz
+RUN cd /tmp && tar -xzvf /tmp/libwebp-*
+RUN cd /tmp/libwebp-1.0.2 && \
+    ./configure --enable-static --disable-shared && \
+    make && make install
+
+# Fix for older required libs
+#RUN cd /tmp && wget http://launchpadlibrarian.net/347526424/libxfont1-dev_1.5.2-4ubuntu2_amd64.deb && \
+#    wget http://launchpadlibrarian.net/347526425/libxfont1_1.5.2-4ubuntu2_amd64.deb && \
+#    dpkg -i libxfont1_1.5.2-4ubuntu2_amd64.deb && \
+#    dpkg -i libxfont1-dev_1.5.2-4ubuntu2_amd64.deb
+
+RUN useradd -m docker && echo "docker:docker" | chpasswd && adduser docker sudo
+
+COPY . /src
+RUN chown -R docker:docker /src
+
+USER docker
+ENTRYPOINT ["/src/builder/build.sh"]

builder/dockerfile.ubuntu_bionic.deb.build

@@ -0,0 +1,10 @@
+FROM ubuntu:bionic
+
+RUN apt-get update && \
+      apt-get -y install vim build-essential devscripts equivs
+
+# Install build-deps for the package.
+COPY ./debian/control /tmp
+RUN apt-get update && echo YYY | mk-build-deps --install --remove /tmp/control
+
+USER 1000

builder/dockerfile.ubuntu_bionic.deb.test

@@ -0,0 +1,54 @@
+FROM ubuntu:bionic
+
+ENV DISPLAY=:1 \
+    VNC_PORT=8443 \
+    VNC_RESOLUTION=1280x720 \
+    MAX_FRAME_RATE=24 \
+    VNCOPTIONS="-PreferBandwidth -DynamicQualityMin=4 -DynamicQualityMax=7" \
+    HOME=/home/user \
+    TERM=xterm \
+    STARTUPDIR=/dockerstartup \
+    INST_SCRIPTS=/dockerstartup/install \
+    KASM_RX_HOME=/dockerstartup/kasmrx \
+    DEBIAN_FRONTEND=noninteractive \
+    VNC_COL_DEPTH=24 \
+    VNC_RESOLUTION=1280x1024 \
+    VNC_PW=vncpassword \
+    VNC_USER=user \
+    VNC_VIEW_ONLY_PW=vncviewonlypassword \
+    LD_LIBRARY_PATH=/usr/local/lib/ \
+    OMP_WAIT_POLICY=PASSIVE \
+    SHELL=/bin/bash \
+    SINGLE_APPLICATION=0 \
+    KASMVNC_BUILD_OS=ubuntu \
+    KASMVNC_BUILD_OS_CODENAME=bionic
+
+EXPOSE $VNC_PORT
+
+WORKDIR $HOME
+
+### REQUIRED STUFF ###
+
+RUN apt-get update && apt-get install -y supervisor xfce4 xfce4-terminal xterm libnss-wrapper gettext wget
+RUN apt-get purge -y pm-utils xscreensaver*
+RUN apt-get update && apt-get install -y vim less
+RUN apt-get update && apt-get -y install lsb-release
+
+RUN echo 'source $STARTUPDIR/generate_container_user' >> $HOME/.bashrc
+
+RUN mkdir -p $STARTUPDIR
+COPY startup/ $STARTUPDIR
+
+### START CUSTOM STUFF ####
+
+ARG KASMVNC_PACKAGE_DIR
+COPY $KASMVNC_PACKAGE_DIR/kasmvncserver_*.deb /tmp
+RUN dpkg -i /tmp/*.deb; apt-get -yf install
+
+### END CUSTOM STUFF ###
+
+RUN chown -R 1000:0 $HOME
+USER 1000:ssl-cert
+WORKDIR $HOME
+
+ENTRYPOINT [ "/dockerstartup/vnc_startup.sh" ]

builder/dockerfile.ubuntu_bionic.test

@@ -0,0 +1,51 @@
+FROM ubuntu:18.04
+
+ENV DISPLAY=:1 \
+    VNC_PORT=8443 \
+    VNC_RESOLUTION=1280x720 \
+    MAX_FRAME_RATE=24 \
+    VNCOPTIONS="-PreferBandwidth -DynamicQualityMin=4 -DynamicQualityMax=7" \
+    HOME=/home/user \
+    TERM=xterm \
+    STARTUPDIR=/dockerstartup \
+    INST_SCRIPTS=/dockerstartup/install \
+    KASM_RX_HOME=/dockerstartup/kasmrx \
+    DEBIAN_FRONTEND=noninteractive \
+    VNC_COL_DEPTH=24 \
+    VNC_RESOLUTION=1280x1024 \
+    VNC_PW=vncpassword \
+    VNC_USER=user \
+    VNC_VIEW_ONLY_PW=vncviewonlypassword \
+    LD_LIBRARY_PATH=/usr/local/lib/ \
+    OMP_WAIT_POLICY=PASSIVE \
+    SHELL=/bin/bash \
+    SINGLE_APPLICATION=0 \
+    KASMVNC_BUILD_OS=ubuntu \
+    KASMVNC_BUILD_OS_CODENAME=bionic
+
+EXPOSE $VNC_PORT
+
+WORKDIR $HOME
+
+### REQUIRED STUFF ###
+
+RUN apt-get update && apt-get install -y supervisor xfce4 xfce4-terminal xterm libnss-wrapper gettext libjpeg-dev wget
+RUN apt-get purge -y pm-utils xscreensaver*
+
+RUN echo 'source $STARTUPDIR/generate_container_user' >> $HOME/.bashrc
+
+RUN mkdir -p $STARTUPDIR
+COPY startup/ $STARTUPDIR
+
+### START CUSTOM STUFF ####
+
+COPY build/kasmvnc.${KASMVNC_BUILD_OS}_${KASMVNC_BUILD_OS_CODENAME}.tar.gz /tmp/
+RUN tar -xzvf /tmp/kasmvnc.${KASMVNC_BUILD_OS}_${KASMVNC_BUILD_OS_CODENAME}.tar.gz --strip 1 -C /
+
+### END CUSTOM STUFF ###
+
+RUN chown -R 1000:0 $HOME
+USER 1000
+WORKDIR $HOME
+
+ENTRYPOINT [ "/dockerstartup/vnc_startup.sh" ]

builder/dockerfile.ubuntu_focal.barebones.deb.test

@@ -0,0 +1,15 @@
+FROM ubuntu:focal
+
+ARG KASMVNC_PACKAGE_DIR
+COPY $KASMVNC_PACKAGE_DIR/kasmvncserver_*.deb /tmp
+RUN apt-get update && dpkg -i /tmp/*.deb; apt-get -yf install
+RUN apt-get update && apt-get -y install xterm lsb-release
+
+RUN useradd -m foo && addgroup foo ssl-cert
+
+USER foo
+
+RUN mkdir ~/.vnc && echo '/usr/bin/xterm &' >> ~/.vnc/xstartup && \
+  chmod +x ~/.vnc/xstartup
+
+ENTRYPOINT bash -c "echo -e \"$VNC_PW\n$VNC_PW\n\" | kasmvncpasswd -w -u \"$VNC_USER\" && vncserver :1 -interface 0.0.0.0 && vncserver -kill :1 && vncserver :1 -depth 24 -geometry 1280x1050 -websocketPort 8443 -cert /etc/ssl/certs/ssl-cert-snakeoil.pem -key /etc/ssl/private/ssl-cert-snakeoil.key -sslOnly -FrameRate=24 -interface 0.0.0.0 -httpd /usr/share/kasmvnc/www && tail -f $HOME/.vnc/*.log "

builder/dockerfile.ubuntu_focal.build

@@ -0,0 +1,31 @@
+FROM ubuntu:focal
+
+ENV KASMVNC_BUILD_OS ubuntu
+ENV KASMVNC_BUILD_OS_CODENAME focal
+ENV XORG_VER 1.20.8
+ENV DEBIAN_FRONTEND noninteractive
+
+RUN sed -i 's$# deb-src$deb-src$' /etc/apt/sources.list
+
+RUN apt-get update && \
+      apt-get -y install sudo
+
+RUN apt-get update && apt-get install -y --no-install-recommends tzdata
+RUN apt-get update && apt-get -y build-dep xorg-server libxfont-dev
+RUN apt-get update && apt-get -y install cmake git libjpeg-dev libgnutls28-dev vim wget tightvncserver
+RUN apt-get update && apt-get -y install libjpeg-dev libpng-dev libtiff-dev libgif-dev libavcodec-dev libssl-dev
+
+# Additions for webp
+RUN cd /tmp && wget https://storage.googleapis.com/downloads.webmproject.org/releases/webp/libwebp-1.0.2.tar.gz
+RUN cd /tmp && tar -xzvf /tmp/libwebp-*
+RUN cd /tmp/libwebp-1.0.2 && \
+    ./configure --enable-static --disable-shared && \
+    make && make install
+
+RUN useradd -m docker && echo "docker:docker" | chpasswd && adduser docker sudo
+
+COPY . /src
+RUN chown -R docker:docker /src
+
+USER docker
+ENTRYPOINT ["/src/builder/build.sh"]

builder/dockerfile.ubuntu_focal.deb.build

@@ -0,0 +1,12 @@
+FROM ubuntu:focal
+
+ENV DEBIAN_FRONTEND noninteractive
+
+RUN apt-get update && \
+      apt-get -y install vim build-essential devscripts equivs
+
+# Install build-deps for the package.
+COPY ./debian/control /tmp
+RUN apt-get update && echo YYY | mk-build-deps --install --remove /tmp/control
+
+USER 1000

builder/dockerfile.ubuntu_focal.deb.test

@@ -0,0 +1,57 @@
+FROM ubuntu:focal
+
+ENV DISPLAY=:1 \
+    VNC_PORT=8443 \
+    VNC_RESOLUTION=1280x720 \
+    MAX_FRAME_RATE=24 \
+    VNCOPTIONS="-PreferBandwidth -DynamicQualityMin=4 -DynamicQualityMax=7" \
+    HOME=/home/user \
+    TERM=xterm \
+    STARTUPDIR=/dockerstartup \
+    INST_SCRIPTS=/dockerstartup/install \
+    KASM_RX_HOME=/dockerstartup/kasmrx \
+    DEBIAN_FRONTEND=noninteractive \
+    VNC_COL_DEPTH=24 \
+    VNC_RESOLUTION=1280x1024 \
+    VNC_PW=vncpassword \
+    VNC_USER=user \
+    VNC_VIEW_ONLY_PW=vncviewonlypassword \
+    LD_LIBRARY_PATH=/usr/local/lib/ \
+    OMP_WAIT_POLICY=PASSIVE \
+    SHELL=/bin/bash \
+    SINGLE_APPLICATION=0 \
+    KASMVNC_BUILD_OS=ubuntu \
+    KASMVNC_BUILD_OS_CODENAME=bionic
+
+EXPOSE $VNC_PORT
+
+WORKDIR $HOME
+
+### REQUIRED STUFF ###
+
+RUN apt-get update && apt-get install -y supervisor xfce4 xfce4-terminal xterm libnss-wrapper gettext wget
+RUN apt-get purge -y pm-utils xscreensaver*
+RUN apt-get update && apt-get install -y vim less
+RUN apt-get update && apt-get -y install lsb-release
+
+RUN echo 'source $STARTUPDIR/generate_container_user' >> $HOME/.bashrc
+
+RUN mkdir -p $STARTUPDIR
+COPY startup/ $STARTUPDIR
+
+### START CUSTOM STUFF ####
+
+ARG KASMVNC_PACKAGE_DIR
+COPY $KASMVNC_PACKAGE_DIR/kasmvncserver_*.deb /tmp
+RUN dpkg -i /tmp/*.deb; apt-get -yf install
+
+RUN mkdir ~/.vnc && echo '/usr/bin/xfce4-session &' >> ~/.vnc/xstartup && \
+  chmod +x ~/.vnc/xstartup
+
+### END CUSTOM STUFF ###
+
+RUN chown -R 1000:0 $HOME
+USER 1000:ssl-cert
+WORKDIR $HOME
+
+ENTRYPOINT [ "/dockerstartup/vnc_startup.sh" ]

builder/dockerfile.ubuntu_focal.test

@@ -0,0 +1,51 @@
+FROM ubuntu:focal
+
+ENV DISPLAY=:1 \
+    VNC_PORT=8443 \
+    VNC_RESOLUTION=1280x720 \
+    MAX_FRAME_RATE=24 \
+    VNCOPTIONS="-PreferBandwidth -DynamicQualityMin=4 -DynamicQualityMax=7" \
+    HOME=/home/user \
+    TERM=xterm \
+    STARTUPDIR=/dockerstartup \
+    INST_SCRIPTS=/dockerstartup/install \
+    KASM_RX_HOME=/dockerstartup/kasmrx \
+    DEBIAN_FRONTEND=noninteractive \
+    VNC_COL_DEPTH=24 \
+    VNC_RESOLUTION=1280x1024 \
+    VNC_PW=vncpassword \
+    VNC_USER=user \
+    VNC_VIEW_ONLY_PW=vncviewonlypassword \
+    LD_LIBRARY_PATH=/usr/local/lib/ \
+    OMP_WAIT_POLICY=PASSIVE \
+    SHELL=/bin/bash \
+    SINGLE_APPLICATION=0 \
+    KASMVNC_BUILD_OS=ubuntu \
+    KASMVNC_BUILD_OS_CODENAME=focal
+
+EXPOSE $VNC_PORT
+
+WORKDIR $HOME
+
+### REQUIRED STUFF ###
+
+RUN apt-get update && apt-get install -y supervisor xfce4 xfce4-terminal xterm libnss-wrapper gettext libjpeg-dev wget
+RUN apt-get purge -y pm-utils xscreensaver*
+
+RUN echo 'source $STARTUPDIR/generate_container_user' >> $HOME/.bashrc
+
+RUN mkdir -p $STARTUPDIR
+COPY startup/ $STARTUPDIR
+
+### START CUSTOM STUFF ####
+
+COPY build/kasmvnc.${KASMVNC_BUILD_OS}_${KASMVNC_BUILD_OS_CODENAME}.tar.gz /tmp/
+RUN tar -xzvf /tmp/kasmvnc.${KASMVNC_BUILD_OS}_${KASMVNC_BUILD_OS_CODENAME}.tar.gz --strip 1 -C /
+
+### END CUSTOM STUFF ###
+
+RUN chown -R 1000:0 $HOME
+USER 1000
+WORKDIR $HOME
+
+ENTRYPOINT [ "/dockerstartup/vnc_startup.sh" ]

builder/dockerfile.www.build

@@ -0,0 +1,10 @@
+FROM node:12-buster
+
+COPY kasmweb/ /src/www/
+COPY builder/build_www.sh /src/
+
+WORKDIR /src/www
+
+RUN npm install
+
+ENTRYPOINT [ "/src/build_www.sh" ]

builder/install/install.sh

@@ -1,79 +0,0 @@
-set -e
-
-OS_ID='unknown'
-OS_VERSION_ID='unknown'
-SUPPORTED='false'
-
-if [[ $EUID -ne 0 ]]; then
-   echo "This script must ran with sudo"
-   exit 1
-fi
-
-function install_deps_ubuntu_18(){
-	# install deps and build tools
-	sudo apt-get update
-	sudo apt-get -y install libjpeg-dev libpng-dev libtiff-dev libgif-dev build-essential cmake libxfont-dev
-
-	wget http://launchpadlibrarian.net/347526424/libxfont1-dev_1.5.2-4ubuntu2_amd64.deb
-	wget http://launchpadlibrarian.net/347526425/libxfont1_1.5.2-4ubuntu2_amd64.deb
-	sudo dpkg -i libxfont1*.deb
-	rm /tmp/libxfont1*.deb
-}
-
-function build_webp(){
-	# build webp
-	wget https://storage.googleapis.com/downloads.webmproject.org/releases/webp/libwebp-1.0.2.tar.gz
-	tar -xzvf /tmp/libwebp-*
-	cd /tmp/libwebp-1.0.2
-	./configure
-	make
-	sudo make install
-	cd /
-	rm -rf /tmp/libwebp*
-	sudo ldconfig
-}
-
-function install_kasmvnc(){
-	# install kasmvnc
-	wget -qO- https://kasmweb-build-artifacts.s3.amazonaws.com/kasmvnc/c0ab0111ae47a39720f26a7dd7ac54a3681540f8/kasmvnc_1.9.c0ab0111ae47a39720f26a7dd7ac54a3681540f8.tar.gz | sudo tar xz --strip 1 -C /
-	#install cert
-	sudo mkdir /usr/local/share/kasmvnc/certs
-	sudo openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout /usr/local/share/kasmvnc/certs/self.pem -out /usr/local/share/kasmvnc/certs/self.pem -subj "/C=US/ST=VA/L=None/O=None/OU=DoFu/CN=kasm/emailAddress=none@none.none"
-}
-
-cd /tmp
-
-# Get the OS and version
-if [ -f /etc/os-release ] ; then
-    OS_ID="$(awk -F= '/^ID=/{print $2}' /etc/os-release)"
-    OS_VERSION_ID="$(awk -F= '/^VERSION_ID/{print $2}' /etc/os-release)"
-fi
-
-
-if [ "${OS_ID}" == "ubuntu" ] && ( [ "${OS_VERSION_ID}" == '"16.04"' ] || [ "${OS_VERSION_ID}" == '"18.04"' ] || [ "${OS_VERSION_ID}" == '"20.04"' ]) ; then
-   
-   if [ "${OS_VERSION_ID}" == '"18.04"' ] ; then
-   	 SUPPORTED='true'
-   	 install_deps_ubuntu_18
-   	 build_webp
-   	 install_kasmvnc
-   fi
-fi
-
-if [ "${OS_ID}" == "debian" ] && ( [ "${OS_VERSION_ID}" == '"9"' ] || [ "${OS_VERSION_ID}" == '"10"' ] ) ; then
-   #TODO: Add support for debian 
-   echo 'Debian is currently not supported'
-fi
-
-if [ "${OS_ID}" == '"centos"' ] && ( [ "${OS_VERSION_ID}" == '"7"' ] || [ "${OS_VERSION_ID}" == '"8"' ] ) ; then
-   #TODO: Add support for Centos
-   echo 'CentOS is currently not supported'
-fi
-
-if [ "${SUPPORTED}" == "false" ] ; then
-   echo "Installation Not Supported for this Operating System. You must compile KasmVNC from source."
-   exit -1
-fi
-
-echo "Installation is complete"
-echo "Follow the instructions to complete setup"

builder/os_ver_cli.sh

@@ -0,0 +1,8 @@
+default_os=ubuntu
+default_os_codename=bionic
+
+os=${1:-$default_os}
+os_codename=${2:-$default_os_codename}
+os_image="$os:$os_codename"
+
+echo "Building for $os_image"

builder/startup/deb/kasmvncserver-easy-start

@@ -0,0 +1,209 @@
+#!/bin/bash
+
+set -e
+
+display=:10
+interface=0.0.0.0
+cert_group=ssl-cert
+xstartup_script=~/.vnc/xstartup
+de_was_selected_file="$HOME/.vnc/.kasmvncserver-easy-start-de-was-selected"
+
+action=start
+
+manual_xstartup_choice="Manually edit xstartup"
+declare -A all_desktop_environments=(
+  [Cinnamon]=cinnamon-session
+  [Mate]="XDG_CURRENT_DESKTOP=MATE dbus-launch --exit-with-session mate-session"
+  [LXDE]=lxsession [Lxqt]=startlxqt
+  [KDE]=startkde
+  [Gnome]="XDG_CURRENT_DESKTOP=GNOME dbus-launch --exit-with-session /usr/bin/gnome-session"
+  [XFCE]=xfce4-session)
+
+readarray -t sorted_desktop_environments < <(for de in "${!all_desktop_environments[@]}"; do echo "$de"; done | sort)
+
+all_desktop_environments[$manual_xstartup_choice]=""
+sorted_desktop_environments+=("$manual_xstartup_choice")
+
+detected_desktop_environments=()
+declare -A numbered_desktop_environments
+
+debug() {
+  if [ -z "$debug" ]; then return; fi
+
+  echo "$@"
+}
+
+print_detected_desktop_environments() {
+  declare -i i=1
+
+  echo "Please choose Desktop Environment to run:"
+  for detected_de in "${detected_desktop_environments[@]}"; do
+    echo "[$i] $detected_de"
+    numbered_desktop_environments[$i]=$detected_de
+    i+=1
+  done
+}
+
+detect_desktop_environments() {
+  for de_name in "${sorted_desktop_environments[@]}"; do
+    if [[ "$de_name" = "$manual_xstartup_choice" ]]; then
+      detected_desktop_environments+=("$de_name")
+      continue;
+    fi
+
+    local executable=${all_desktop_environments[$de_name]}
+    executable=($executable)
+    executable=${executable[-1]}
+
+    if detect_desktop_environment "$de_name" "$executable"; then
+      detected_desktop_environments+=("$de_name")
+    fi
+  done
+}
+
+ask_user_to_choose_de() {
+  while : ; do
+    print_detected_desktop_environments
+    read -r de_number_to_run
+    de_name_from_number "$de_number_to_run"
+    if [[ -n "$de_name" ]]; then
+      break;
+    fi
+
+    echo "Incorrect number: $de_number_to_run"
+    echo
+  done
+}
+
+remember_de_choice() {
+  touch "$de_was_selected_file"
+}
+
+de_was_selected_on_previous_run() {
+  [[ -f "$de_was_selected_file" ]]
+}
+
+detect_desktop_environment() {
+  local de_name="$1"
+  local executable="$2"
+
+  if command -v "$executable" &>/dev/null; then
+    return 0
+  fi
+
+  return 1
+}
+
+did_user_forbid_replacing_xstartup() {
+  grep -q -v KasmVNC-safe-to-replace-this-file "$xstartup_script"
+}
+
+de_cmd_from_name() {
+  de_cmd=${all_desktop_environments[$de_name]}
+}
+
+de_name_from_number() {
+  local de_number_to_run="$1"
+
+  de_name=${numbered_desktop_environments[$de_number_to_run]}
+}
+
+warn_xstartup_will_be_overwriten() {
+  echo -n "WARNING: $xstartup_script will be overwritten y/N?"
+  read -r do_overwrite_xstartup
+  if [[ "$do_overwrite_xstartup" = "y" || "$do_overwrite_xstartup" = "Y" ]]; then
+    return 0
+  fi
+
+  return 1
+}
+
+setup_de_to_run_via_xstartup() {
+  warn_xstartup_will_be_overwriten
+  generate_xstartup "$de_name"
+}
+
+generate_xstartup() {
+  local de_name="$1"
+
+  de_cmd_from_name
+
+  cat <<-SCRIPT > "$xstartup_script"
+    #!/bin/sh
+    exec $de_cmd
+SCRIPT
+  chmod +x "$xstartup_script"
+}
+
+enable_debug() {
+  debug=1
+  log_option="-log *:stderr:100"
+}
+
+kill_vnc_server() {
+  vncserver -kill $display
+}
+
+process_cli_options() {
+  for option in "$@"; do
+    case "$option" in
+      --help)
+        show_help
+        exit
+        ;;
+      -d)
+        enable_debug
+        ;;
+      -kill)
+        kill_vnc_server
+        exit
+        ;;
+      -select-de)
+        action=select-de-and-start
+        ;;
+      *)
+        echo >&2 "Unsupported argument: $option"
+        exit 1
+    esac
+  done
+}
+
+user_asked_to_select_de() {
+  [[ "$action" = "select-de-and-start" ]]
+}
+show_help() {
+  cat >&2 <<-USAGE
+Usage: `basename $0` [options]
+  -d          Debug output
+  -kill       Kill vncserver
+  -select-de  Select desktop environent to run
+  --help      show this help
+USAGE
+}
+
+process_cli_options "$@"
+
+if groups | grep -qvw ssl-cert; then
+  cat <<-EOF
+    Can't access TLS certificate.
+    Please add your user to $cert_group via 'addgroup <user> ssl-cert'
+EOF
+  exit 1
+fi
+
+if user_asked_to_select_de || ! de_was_selected_on_previous_run; then
+  detect_desktop_environments
+  ask_user_to_choose_de
+  debug "You selected $de_name desktop environment"
+  if [[ "$de_name" != "$manual_xstartup_choice" ]]; then
+    setup_de_to_run_via_xstartup
+  fi
+  remember_de_choice
+fi
+
+vncserver $display -interface $interface
+vncserver -kill $display
+vncserver $display -depth 24 -geometry 1280x1050 -websocketPort 8443 \
+  -cert /etc/ssl/certs/ssl-cert-snakeoil.pem \
+  -key /etc/ssl/private/ssl-cert-snakeoil.key -sslOnly -FrameRate=24 \
+  -interface $interface -httpd /usr/share/kasmvnc/www $log_option

builder/startup/generate_container_user

@@ -0,0 +1,46 @@
+detect_libnss_wrapper() {
+  if $(which dpkg &>/dev/null); then
+    libnss_wrapper_file=$(dpkg -S libnss_wrapper.so | awk -F' ' '{ print $2 }')
+    return
+  fi
+
+  if [ -r /usr/lib/libnss_wrapper.so ]; then
+      libnss_wrapper_file=/usr/lib/libnss_wrapper.so
+  elif [ -r /usr/lib64/libnss_wrapper.so ]; then
+      libnss_wrapper_file=/usr/lib64/libnss_wrapper.so
+  else
+      echo "no libnss_wrapper.so installed!"
+      exit 1
+  fi
+}
+
+# Set current user in nss_wrapper
+USER_ID=$(id -u)
+GROUP_ID=$(id -g)
+echo "USER_ID: $USER_ID, GROUP_ID: $GROUP_ID"
+
+# Attempt to set the username to the kasm username
+USERNAME=${VNC_USER:-default}
+# Make the username posix compliant
+USERNAME=$(echo "$USERNAME" | sed -r 's#[^a-zA-Z0-9\._\-]#_#g')
+if ! echo "$USERNAME" | grep -qP "^[a-zA-Z0-9_\.][a-zA-Z0-9_\-\.]*"; then
+    USERNAME="default"
+fi
+export PS1="$USERNAME:\w\$ "
+
+if [ x"$USER_ID" != x"0" ]; then
+
+    NSS_WRAPPER_PASSWD=/tmp/passwd
+    NSS_WRAPPER_GROUP=/etc/group
+
+    cat /etc/passwd > $NSS_WRAPPER_PASSWD
+
+    echo "${USERNAME}:x:${USER_ID}:${GROUP_ID}:Default Application User:${HOME}:/bin/bash" >> $NSS_WRAPPER_PASSWD
+
+    export NSS_WRAPPER_PASSWD
+    export NSS_WRAPPER_GROUP
+
+    detect_libnss_wrapper
+    echo "nss_wrapper location: $libnss_wrapper_file"
+    export LD_PRELOAD="$libnss_wrapper_file"
+fi

builder/startup/vnc_startup.sh

@@ -0,0 +1,114 @@
+#!/bin/bash
+### every exit != 0 fails the script
+set -e
+
+# should also source $STARTUPDIR/generate_container_user
+source $HOME/.bashrc
+
+## correct forwarding of shutdown signal
+cleanup () {
+    kill -s SIGTERM $!
+    exit 0
+}
+trap cleanup SIGINT SIGTERM
+
+detect_www_dir() {
+  local package_www_dir="/usr/share/kasmvnc/www"
+  if [[ -d "$package_www_dir" ]]; then
+    package_www_dir_option="-httpd $package_www_dir"
+  fi
+}
+
+detect_cert_location() {
+  local tarball_cert="$HOME/.vnc/self.pem"
+  local deb_cert="/etc/ssl/certs/ssl-cert-snakeoil.pem"
+  local deb_key="/etc/ssl/private/ssl-cert-snakeoil.key"
+  local rpm_cert="/etc/pki/tls/private/kasmvnc.pem"
+
+  if [[ -f "$deb_cert" ]]; then
+    cert_option="-cert $deb_cert -key $deb_key"
+  elif [[ -f "$rpm_cert" ]]; then
+    cert_option="-cert $rpm_cert"
+  else
+    cert_option="-cert $tarball_cert"
+  fi
+}
+
+add_vnc_user() {
+  local username="$1"
+  local password="$2"
+  local permission_option="$3"
+
+  echo "Adding user $username"
+  echo -e "$password\n$password" | kasmvncpasswd $permission_option \
+    -u "$username" $HOME/.kasmpasswd
+}
+
+## resolve_vnc_connection
+VNC_IP=$(hostname -i)
+
+# first entry is control, second is view (if only one is valid for both)
+mkdir -p "$HOME/.vnc"
+PASSWD_PATH="$HOME/.vnc/passwd"
+add_vnc_user "$VNC_USER" "$VNC_PW" "-w"
+add_vnc_user "$VNC_USER-ro" "$VNC_PW"
+add_vnc_user "$VNC_USER-owner" "$VNC_PW" "-o"
+add_vnc_user "$VNC_USER-to-delete" "$VNC_PW"
+
+kasmvncpasswd -n -u "$VNC_USER-owner" -w -o $HOME/.kasmpasswd
+kasmvncpasswd -d -u "$VNC_USER-to-delete" $HOME/.kasmpasswd
+
+chmod 0600 $HOME/.kasmpasswd
+openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout $HOME/.vnc/self.pem -out $HOME/.vnc/self.pem -subj "/C=US/ST=VA/L=None/O=None/OU=DoFu/CN=kasm/emailAddress=none@none.none"
+
+exec /bin/bash
+
+vncserver :1 -interface 0.0.0.0
+vncserver -kill :1
+
+if [[ -f $PASSWD_PATH ]]; then
+    rm -f $PASSWD_PATH
+fi
+
+#echo "$VNC_PW" | vncpasswd -f > $PASSWD_PATH
+#echo "$VNC_VIEW_ONLY_PW" | vncpasswd -f >> $PASSWD_PATH
+#chmod 600 $PASSWD_PATH
+
+unset VNC_VIEW_ONLY_PW
+unset VNC_PW
+
+if [[ $DEBUG == true ]]; then
+  echo -e "\n------------------ start VNC server ------------------------"
+  echo "remove old vnc locks to be a reattachable container"
+fi
+vncserver -kill $DISPLAY &> $HOME/.vnc/vnc_startup.log \
+    || rm -rfv /tmp/.X*-lock /tmp/.X11-unix &> $HOME/.vnc/vnc_startup.log \
+    || echo "no locks present"
+
+
+detect_www_dir
+detect_cert_location
+[ -n "$KASMVNC_VERBOSE_LOGGING" ] && verbose_logging_option="-log *:stderr:100"
+
+echo -e "start vncserver with param: VNC_COL_DEPTH=$VNC_COL_DEPTH, VNC_RESOLUTION=$VNC_RESOLUTION\n..."
+vncserver $DISPLAY -depth $VNC_COL_DEPTH -geometry $VNC_RESOLUTION -FrameRate=$MAX_FRAME_RATE -websocketPort $VNC_PORT $cert_option -sslOnly -interface 0.0.0.0 $VNCOPTIONS $package_www_dir_option $verbose_logging_option #&> $STARTUPDIR/no_vnc_startup.log
+
+PID_SUN=$!
+
+echo -e "start window manager\n..."
+$STARTUPDIR/window_manager_startup.sh #&> $STARTUPDIR/window_manager_startup.log
+
+## log connect options
+echo -e "\n\n------------------ VNC environment started ------------------"
+echo -e "\nVNCSERVER started on DISPLAY= $DISPLAY \n\t=> connect via VNC viewer with $VNC_IP:$VNC_PORT"
+echo -e "\nnoVNC HTML client started:\n\t=> connect via http://$VNC_IP:$NO_VNC_PORT/?password=...\n"
+echo "WEB PID: $PID_SUB"
+
+# tail vncserver logs
+tail -f $HOME/.vnc/*$DISPLAY.log &
+
+eval "$@"
+
+wait $PID_SUB
+
+echo "Exiting Kasm container"

builder/startup/window_manager_startup.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+set -e
+
+echo -e "\n------------------ Xfce4 window manager startup------------------"
+
+### disable screen saver and power management
+xset -dpms &
+xset s noblank &
+xset s off &
+
+if [ "$SINGLE_APPLICATION" -eq "1" ]; then
+    echo "Configured of Single Application Mode"
+    sed -i "s/O|SHMC/|/g" $HOME/.config/xfce4/xfconf/xfce-perchannel-xml/xfwm4.xml
+    #xfwm4 --daemon
+fi

builder/test-deb

@@ -0,0 +1,14 @@
+#!/bin/bash
+
+set -e
+
+cd "$(dirname "$0")"
+. ./os_ver_cli.sh
+
+docker build --build-arg KASMVNC_PACKAGE_DIR="build/${os_codename}" \
+  -t kasmvnctester_${os}:$os_codename \
+  -f dockerfile.${os}_${os_codename}.deb.test .
+  docker run -it -v $(realpath ${PWD}/..):/src -p 8443:8443 --rm \
+  -e KASMVNC_VERBOSE_LOGGING=$KASMVNC_VERBOSE_LOGGING \
+  -e "VNC_USER=foo" -e "VNC_PW=foobar" \
+  kasmvnctester_${os}:$os_codename

builder/test-deb-barebones

@@ -0,0 +1,14 @@
+#!/bin/bash
+
+set -e
+
+cd "$(dirname "$0")"
+os="${1:-debian}"
+os_codename="${2:-buster}"
+
+docker build --build-arg KASMVNC_PACKAGE_DIR="build/${os_codename}" \
+  -t kasmvnctester_barebones_${os}:$os_codename \
+  -f dockerfile.${os}_${os_codename}.barebones.deb.test .
+echo
+docker run -it -p 443:8443 --rm -e "VNC_USER=foo" -e "VNC_PW=foobar" \
+  kasmvnctester_barebones_${os}:$os_codename

builder/test-rpm

@@ -0,0 +1,17 @@
+#!/bin/bash
+
+set -e
+
+cd "$(dirname "$0")"
+. ./os_ver_cli.sh
+
+echo kasmvnctester_${os}:$os_codename
+docker build --build-arg \
+  KASMVNC_PACKAGE_DIR="build/${os}_${os_codename}" \
+  -t kasmvnctester_${os}:$os_codename \
+  -f dockerfile.${os}_${os_codename}.rpm.test .
+
+docker run -it -p 443:8443 --rm \
+  -e KASMVNC_VERBOSE_LOGGING=$KASMVNC_VERBOSE_LOGGING \
+  -e "VNC_USER=foo" -e "VNC_PW=foobar" \
+  kasmvnctester_${os}:$os_codename

builder/test-rpm-barebones

@@ -0,0 +1,13 @@
+#!/bin/bash
+
+set -e
+
+cd "$(dirname "$0")"
+os="${1:-centos}"
+os_codename="${2:-core}"
+
+docker build --build-arg KASMVNC_PACKAGE_DIR="build/${os}_${os_codename}" \
+  -t kasmvnctester_barebones_${os}:$os_codename \
+  -f dockerfile.${os}_${os_codename}.barebones.rpm.test .
+docker run -it -p 443:8443 --rm -e "VNC_USER=foo" -e "VNC_PW=foobar" \
+  kasmvnctester_barebones_${os}:$os_codename

centos/kasmvncserver.spec

@@ -0,0 +1,104 @@
+Name:           kasmvncserver
+Version:        0.9.1~beta
+Release:        1%{?dist}
+Summary:        VNC server accessible from a web browser
+
+License: GPLv2+
+URL: https://github.com/kasmtech/KasmVNC
+
+BuildRequires: rsync
+Requires: xorg-x11-xauth, xorg-x11-xkb-utils, xkeyboard-config, xorg-x11-server-utils, openssl, perl
+Conflicts: tigervnc-server, tigervnc-server-minimal
+
+%description
+VNC stands for Virtual Network Computing. It is, in essence, a remote
+display system which allows you to view a computing `desktop' environment
+not only on the machine where it is running, but from anywhere on the
+Internet and from a wide variety of machine architectures.
+
+KasmVNC has different goals than TigerVNC:
+
+Web-based - KasmVNC is designed to provide a web accessible remote desktop.
+It comes with a web server and web-socket server built in. There is no need to
+install other components. Simply run and navigate to your desktop's URL on the
+port you specify. While you can still tun on the legacy VNC port, it is
+disabled by default.
+
+Security - KasmVNC defaults to HTTPS and allows for HTTP Basic Auth. VNC
+Password authentication is limited by specification to 8 characters and is not
+sufficient for use on an internet accessible remote desktop. Our goal is to
+create a by default secure, web based experience.
+
+Simplicity - KasmVNC aims at being simple to deploy and configure.
+
+%prep
+
+%install
+rm -rf $RPM_BUILD_ROOT
+
+TARGET_OS=$(lsb_release -is | tr '[:upper:]' '[:lower:]')
+TARGET_OS_CODENAME=$(lsb_release -cs | tr '[:upper:]' '[:lower:]')
+TARBALL=$RPM_SOURCE_DIR/kasmvnc.${TARGET_OS}_${TARGET_OS_CODENAME}.tar.gz
+TAR_DATA=$(mktemp -d)
+tar -xzf "$TARBALL" -C "$TAR_DATA"
+
+SRC=$TAR_DATA/usr/local
+SRC_BIN=$SRC/bin
+DESTDIR=$RPM_BUILD_ROOT
+DST_MAN=$DESTDIR/usr/share/man/man1
+
+mkdir -p $DESTDIR/usr/bin $DESTDIR/usr/share/man/man1 \
+  $DESTDIR/usr/share/doc/kasmvncserver
+cp $SRC_BIN/Xvnc $DESTDIR/usr/bin;
+cp $SRC_BIN/vncserver $DESTDIR/usr/bin;
+cp $SRC_BIN/vncconfig $DESTDIR/usr/bin;
+cp $SRC_BIN/kasmvncpasswd $DESTDIR/usr/bin;
+cd $DESTDIR/usr/bin && ln -s kasmvncpasswd vncpasswd;
+cp -r $SRC/share/doc/kasmvnc*/* $DESTDIR/usr/share/doc/kasmvncserver/
+rsync -r --exclude '.git*' --exclude po2js --exclude xgettext-html \
+  --exclude www/utils/ --exclude .eslintrc \
+  $SRC/share/kasmvnc $DESTDIR/usr/share
+cp $SRC/man/man1/Xvnc.1 $DESTDIR/usr/share/man/man1/;
+cp $SRC/share/man/man1/vncserver.1 $DST_MAN;
+cp $SRC/share/man/man1/vncconfig.1 $DST_MAN;
+cp $SRC/share/man/man1/vncpasswd.1 $DST_MAN;
+cd $DST_MAN && ln -s vncpasswd.1 kasmvncpasswd.1;
+
+%files
+/usr/bin/*
+/usr/share/man/man1/*
+/usr/share/kasmvnc/www
+
+%license /usr/share/doc/kasmvncserver/LICENSE.TXT
+%doc /usr/share/doc/kasmvncserver/README.md
+
+%changelog
+* Fri Feb 12 2021 KasmTech <info@kasmweb.com> - 0.9.1~beta-1
+- Initial release of the rpm package.
+
+%post
+  kasmvnc_group="kasmvnc-cert"
+
+  create_kasmvnc_group() {
+    if ! getent group "$kasmvnc_group" >/dev/null; then
+	    groupadd --system "$kasmvnc_group"
+    fi
+  }
+
+  make_self_signed_certificate() {
+    local cert_file=/etc/pki/tls/private/kasmvnc.pem
+    [ -f "$cert_file" ] && return 0
+
+    openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
+      -keyout "$cert_file" \
+      -out "$cert_file" -subj \
+      "/C=US/ST=VA/L=None/O=None/OU=DoFu/CN=kasm/emailAddress=none@none.none"
+    chgrp "$kasmvnc_group" "$cert_file"
+    chmod 640 "$cert_file"
+  }
+
+  create_kasmvnc_group
+  make_self_signed_certificate
+
+%postun
+  rm -f /etc/pki/tls/private/kasmvnc.pem

cmake/BuildPackages.cmake

@@ -62,11 +62,11 @@ configure_file(release/maketarball.in release/maketarball)
 
 set(TARBALL_DEPENDS vncpasswd vncconfig)
 
-add_custom_target(tarball sh release/maketarball
+add_custom_target(tarball bash release/maketarball
   DEPENDS ${TARBALL_DEPENDS}
   SOURCES release/maketarball)
 
-add_custom_target(servertarball sh release/maketarball server
+add_custom_target(servertarball bash release/maketarball server
   DEPENDS ${TARBALL_DEPENDS}
   SOURCES release/maketarball)
 
@@ -76,5 +76,5 @@ endif() #UNIX
 # Common
 #
 
-install(FILES ${CMAKE_SOURCE_DIR}/LICENCE.TXT DESTINATION ${DOC_DIR})
+install(FILES ${CMAKE_SOURCE_DIR}/LICENSE.TXT DESTINATION ${DOC_DIR})
 install(FILES ${CMAKE_SOURCE_DIR}/README.md DESTINATION ${DOC_DIR})

cmake/StaticBuild.cmake

@@ -27,6 +27,9 @@ if(BUILD_STATIC)
   # gettext is included in libc on many unix systems
   if(NOT LIBC_HAS_DGETTEXT)
     set(GETTEXT_LIBRARIES "-Wl,-Bstatic -lintl -liconv -Wl,-Bdynamic")
+    if(APPLE)
+      set(GETTEXT_LIBRARIES "${GETTEXT_LIBRARIES} -framework Carbon")
+    endif()
   endif()
 
   if(GNUTLS_FOUND)
@@ -44,7 +47,7 @@ if(BUILD_STATIC)
       set(GNUTLS_LIBRARIES "${GNUTLS_LIBRARIES} -ltasn1")
     endif()
     if(NETTLE_LIBRARY)
-      set(GNUTLS_LIBRARIES "${GNUTLS_LIBRARIES} -lnettle -lhogweed -lgmp")
+      set(GNUTLS_LIBRARIES "${GNUTLS_LIBRARIES} -lhogweed -lnettle -lgmp")
     endif()
     if(GCRYPT_LIBRARY)
       set(GNUTLS_LIBRARIES "${GNUTLS_LIBRARIES} -lgcrypt -lgpg-error")
@@ -118,7 +121,7 @@ endif()
 if(BUILD_STATIC_GCC)
   # This ensures that we don't depend on libstdc++ or libgcc_s
   set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -nodefaultlibs")
-  set(STATIC_BASE_LIBRARIES "-Wl,-Bstatic -lstdc++ -Wl,-Bdynamic")
+  set(STATIC_BASE_LIBRARIES "")
   if(ENABLE_ASAN AND NOT WIN32 AND NOT APPLE)
     set(STATIC_BASE_LIBRARIES "${STATIC_BASE_LIBRARIES} -Wl,-Bstatic -lasan -Wl,-Bdynamic -ldl -lm -lpthread")
   endif()
@@ -136,7 +139,8 @@ if(BUILD_STATIC_GCC)
     # these things again
     set(STATIC_BASE_LIBRARIES "${STATIC_BASE_LIBRARIES} -lmingw32 -lgcc_eh -lgcc -lmoldname -lmingwex -lmsvcrt")
   else()
-    set(STATIC_BASE_LIBRARIES "${STATIC_BASE_LIBRARIES} -lgcc -lgcc_eh -lc")
+    set(STATIC_BASE_LIBRARIES "${STATIC_BASE_LIBRARIES} -lm -lgcc -lgcc_eh -lc")
   endif()
-  set(CMAKE_CXX_LINK_EXECUTABLE "${CMAKE_CXX_LINK_EXECUTABLE} ${STATIC_BASE_LIBRARIES}")
+  set(CMAKE_C_LINK_EXECUTABLE "${CMAKE_C_LINK_EXECUTABLE} ${STATIC_BASE_LIBRARIES}")
+  set(CMAKE_CXX_LINK_EXECUTABLE "${CMAKE_CXX_LINK_EXECUTABLE} -Wl,-Bstatic -lstdc++ -Wl,-Bdynamic ${STATIC_BASE_LIBRARIES}")
 endif()

common/network/CMakeLists.txt

@@ -1,10 +1,12 @@
-include_directories(${CMAKE_SOURCE_DIR}/common)
+include_directories(${CMAKE_SOURCE_DIR}/common ${CMAKE_SOURCE_DIR}/unix/kasmvncpasswd)
 
 set(NETWORK_SOURCES
+  GetAPIMessager.cxx
   Socket.cxx
   TcpSocket.cxx
   websocket.c
-  websockify.c)
+  websockify.c
+  ${CMAKE_SOURCE_DIR}/unix/kasmvncpasswd/kasmpasswd.c)
 
 if(NOT WIN32)
   set(NETWORK_SOURCES ${NETWORK_SOURCES} UnixSocket.cxx)

common/network/GetAPI.h

@@ -0,0 +1,75 @@
+/* Copyright (C) 2021 Kasm
+ *
+ * This is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this software; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307,
+ * USA.
+ */
+
+#ifndef __NETWORK_GET_API_H__
+#define __NETWORK_GET_API_H__
+
+#include <kasmpasswd.h>
+#include <pthread.h>
+#include <rfb/PixelBuffer.h>
+#include <rfb/PixelFormat.h>
+#include <stdint.h>
+#include <vector>
+
+namespace network {
+
+  class GetAPIMessager {
+  public:
+    GetAPIMessager(const char *passwdfile_);
+
+    // from main thread
+    void mainUpdateScreen(rfb::PixelBuffer *pb);
+
+    // from network threads
+    uint8_t *netGetScreenshot(uint16_t w, uint16_t h,
+                              const uint8_t q, const bool dedup,
+                              uint32_t &len, uint8_t *staging);
+    uint8_t netAddUser(const char name[], const char pw[], const bool write);
+    uint8_t netRemoveUser(const char name[]);
+    uint8_t netGiveControlTo(const char name[]);
+
+    enum USER_ACTION {
+      //USER_ADD, - handled locally for interactivity
+      USER_REMOVE,
+      USER_GIVE_CONTROL,
+    };
+
+    struct action_data {
+      enum USER_ACTION action;
+      kasmpasswd_entry_t data;
+    };
+
+    pthread_mutex_t userMutex;
+    std::vector<action_data> actionQueue;
+
+  private:
+    const char *passwdfile;
+
+    pthread_mutex_t screenMutex;
+    rfb::ManagedPixelBuffer screenPb;
+    uint16_t screenW, screenH;
+    uint64_t screenHash;
+
+    std::vector<uint8_t> cachedJpeg;
+    uint16_t cachedW, cachedH;
+    uint8_t cachedQ;
+  };
+
+}
+
+#endif // __NETWORK_GET_API_H__

common/network/GetAPIMessager.cxx

@@ -0,0 +1,288 @@
+/* Copyright (C) 2021 Kasm
+ *
+ * This is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this software; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307,
+ * USA.
+ */
+
+#define __STDC_FORMAT_MACROS
+
+#include <inttypes.h>
+#include <network/GetAPI.h>
+#include <rfb/ConnParams.h>
+#include <rfb/LogWriter.h>
+#include <rfb/JpegCompressor.h>
+#include <rfb/xxhash.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+using namespace network;
+using namespace rfb;
+
+static LogWriter vlog("GetAPIMessager");
+
+PixelBuffer *progressiveBilinearScale(const PixelBuffer *pb,
+					const uint16_t tgtw, const uint16_t tgth,
+					const float tgtdiff);
+
+struct TightJPEGConfiguration {
+    int quality;
+    int subsampling;
+};
+
+static const struct TightJPEGConfiguration conf[10] = {
+  {  15, subsample4X }, // 0
+  {  29, subsample4X }, // 1
+  {  41, subsample4X }, // 2
+  {  42, subsample2X }, // 3
+  {  62, subsample2X }, // 4
+  {  77, subsample2X }, // 5
+  {  79, subsampleNone }, // 6
+  {  86, subsampleNone }, // 7
+  {  92, subsampleNone }, // 8
+  { 100, subsampleNone }  // 9
+};
+
+GetAPIMessager::GetAPIMessager(const char *passwdfile_): passwdfile(passwdfile_),
+					screenW(0), screenH(0), screenHash(0),
+					cachedW(0), cachedH(0), cachedQ(0) {
+
+	pthread_mutex_init(&screenMutex, NULL);
+	pthread_mutex_init(&userMutex, NULL);
+}
+
+// from main thread
+void GetAPIMessager::mainUpdateScreen(rfb::PixelBuffer *pb) {
+	if (pthread_mutex_trylock(&screenMutex))
+		return;
+
+	int stride;
+	const rdr::U8 * const buf = pb->getBuffer(pb->getRect(), &stride);
+
+	if (pb->width() != screenW || pb->height() != screenH) {
+		screenHash = 0;
+		screenW = pb->width();
+		screenH = pb->height();
+		screenPb.setPF(pb->getPF());
+		screenPb.setSize(screenW, screenH);
+
+		cachedW = cachedH = cachedQ = 0;
+		cachedJpeg.clear();
+	}
+
+	const uint64_t newHash = XXH64(buf, pb->area() * 4, 0);
+	if (newHash != screenHash) {
+		cachedW = cachedH = cachedQ = 0;
+		cachedJpeg.clear();
+
+		screenHash = newHash;
+		rdr::U8 *rw = screenPb.getBufferRW(screenPb.getRect(), &stride);
+		memcpy(rw, buf, screenW * screenH * 4);
+		screenPb.commitBufferRW(screenPb.getRect());
+	}
+
+	pthread_mutex_unlock(&screenMutex);
+}
+
+// from network threads
+uint8_t *GetAPIMessager::netGetScreenshot(uint16_t w, uint16_t h,
+	const uint8_t q, const bool dedup,
+	uint32_t &len, uint8_t *staging) {
+
+	uint8_t *ret = NULL;
+	len = 0;
+
+	if (w > screenW)
+		w = screenW;
+	if (h > screenH)
+		h = screenH;
+
+	if (!screenW || !screenH)
+		vlog.error("Screenshot requested but no screenshot exists (screen hasn't been viewed)");
+
+	if (!w || !h || q > 9 || !staging)
+		return NULL;
+
+	if (pthread_mutex_lock(&screenMutex))
+		return NULL;
+
+	if (w == cachedW && h == cachedH && q == cachedQ) {
+		if (dedup) {
+			// Return the hash of the unchanged image
+			sprintf((char *) staging, "%" PRIx64, screenHash);
+			ret = staging;
+			len = 16;
+		} else {
+			// Return the cached image
+			len = cachedJpeg.size();
+			ret = staging;
+			memcpy(ret, &cachedJpeg[0], len);
+
+			vlog.info("Returning cached screenshot");
+		}
+	} else {
+		// Encode the new JPEG, cache it
+		JpegCompressor jc;
+		int quality, subsampling;
+
+		quality = conf[q].quality;
+		subsampling = conf[q].subsampling;
+
+		jc.clear();
+		int stride;
+
+		if (w != screenW || h != screenH) {
+			float xdiff = w / (float) screenW;
+			float ydiff = h / (float) screenH;
+			const float diff = xdiff < ydiff ? xdiff : ydiff;
+
+			const uint16_t neww = screenW * diff;
+			const uint16_t newh = screenH * diff;
+
+			const PixelBuffer *scaled = progressiveBilinearScale(&screenPb, neww, newh, diff);
+			const rdr::U8 * const buf = scaled->getBuffer(scaled->getRect(), &stride);
+
+			jc.compress(buf, stride, scaled->getRect(),
+					scaled->getPF(), quality, subsampling);
+
+			cachedJpeg.resize(jc.length());
+			memcpy(&cachedJpeg[0], jc.data(), jc.length());
+
+			delete scaled;
+
+			vlog.info("Returning scaled screenshot");
+		} else {
+			const rdr::U8 * const buf = screenPb.getBuffer(screenPb.getRect(), &stride);
+
+			jc.compress(buf, stride, screenPb.getRect(),
+					screenPb.getPF(), quality, subsampling);
+
+			cachedJpeg.resize(jc.length());
+			memcpy(&cachedJpeg[0], jc.data(), jc.length());
+
+			vlog.info("Returning normal screenshot");
+		}
+
+		cachedQ = q;
+		cachedW = w;
+		cachedH = h;
+
+		len = cachedJpeg.size();
+		ret = staging;
+		memcpy(ret, &cachedJpeg[0], len);
+	}
+
+	pthread_mutex_unlock(&screenMutex);
+
+	return ret;
+}
+
+#define USERNAME_LEN sizeof(((struct kasmpasswd_entry_t *)0)->user)
+#define PASSWORD_LEN sizeof(((struct kasmpasswd_entry_t *)0)->password)
+
+uint8_t GetAPIMessager::netAddUser(const char name[], const char pw[], const bool write) {
+	if (strlen(name) >= USERNAME_LEN) {
+		vlog.error("Username too long");
+		return 0;
+	}
+
+	if (strlen(pw) >= PASSWORD_LEN) {
+		vlog.error("Password too long");
+		return 0;
+	}
+
+	if (!passwdfile)
+		return 0;
+
+	action_data act;
+
+	memcpy(act.data.user, name, USERNAME_LEN);
+	act.data.user[USERNAME_LEN - 1] = '\0';
+	memcpy(act.data.password, pw, PASSWORD_LEN);
+	act.data.password[PASSWORD_LEN - 1] = '\0';
+	act.data.owner = 0;
+	act.data.write = write;
+
+	if (pthread_mutex_lock(&userMutex))
+		return 0;
+
+        // This needs to be handled locally for proper interactivity
+        // (consider adding users when nobody is connected).
+        // The mutex and atomic rename keep things in sync.
+
+        struct kasmpasswd_t *set = readkasmpasswd(passwdfile);
+        unsigned s;
+        for (s = 0; s < set->num; s++) {
+          if (!strcmp(set->entries[s].user, act.data.user)) {
+            vlog.error("Can't create user %s, already exists", act.data.user);
+            goto out;
+          }
+        }
+
+        s = set->num++;
+        set->entries = (struct kasmpasswd_entry_t *) realloc(set->entries,
+                                                                 set->num * sizeof(struct kasmpasswd_entry_t));
+        set->entries[s] = act.data;
+
+        writekasmpasswd(passwdfile, set);
+        vlog.info("User %s created", act.data.user);
+out:
+	pthread_mutex_unlock(&userMutex);
+
+	return 1;
+}
+
+uint8_t GetAPIMessager::netRemoveUser(const char name[]) {
+	if (strlen(name) >= USERNAME_LEN) {
+		vlog.error("Username too long");
+		return 0;
+	}
+
+	action_data act;
+	act.action = USER_REMOVE;
+
+	memcpy(act.data.user, name, USERNAME_LEN);
+	act.data.user[USERNAME_LEN - 1] = '\0';
+
+	if (pthread_mutex_lock(&userMutex))
+		return 0;
+
+	actionQueue.push_back(act);
+
+	pthread_mutex_unlock(&userMutex);
+
+	return 1;
+}
+
+uint8_t GetAPIMessager::netGiveControlTo(const char name[]) {
+	if (strlen(name) >= USERNAME_LEN) {
+		vlog.error("Username too long");
+		return 0;
+	}
+
+	action_data act;
+	act.action = USER_GIVE_CONTROL;
+
+	memcpy(act.data.user, name, USERNAME_LEN);
+	act.data.user[USERNAME_LEN - 1] = '\0';
+
+	if (pthread_mutex_lock(&userMutex))
+		return 0;
+
+	actionQueue.push_back(act);
+
+	pthread_mutex_unlock(&userMutex);
+
+	return 1;
+}

common/network/Socket.cxx

@@ -25,6 +25,9 @@
 #include <winsock2.h>
 #include <ws2tcpip.h>
 #define errorNumber WSAGetLastError()
+#define SHUT_RD SD_RECEIVE
+#define SHUT_WR SD_SEND
+#define SHUT_RDWR SD_BOTH
 #else
 #define errorNumber errno
 #define closesocket close
@@ -94,7 +97,7 @@ Socket::~Socket()
 void Socket::shutdown()
 {
   isShutdown_ = true;
-  ::shutdown(getFd(), 2);
+  ::shutdown(getFd(), SHUT_RDWR);
 }
 
 bool Socket::isShutdown() const
@@ -149,7 +152,7 @@ void SocketListener::shutdown()
   closesocket(fd);
   fd = -1;
 #else
-  ::shutdown(fd, 2);
+  ::shutdown(fd, SHUT_RDWR);
 #endif
 }
 

common/network/Socket.h

@@ -74,6 +74,8 @@ namespace network {
     virtual ~ConnectionFilter() {}
   };
 
+  class GetAPIMessager;
+
   class SocketListener {
   public:
     SocketListener(int fd);
@@ -93,6 +95,8 @@ namespace network {
     void setFilter(ConnectionFilter* f) {filter = f;}
     int getFd() {return fd;}
 
+    virtual GetAPIMessager *getMessager() { return NULL; }
+
   protected:
     SocketListener();
 

common/network/TcpSocket.cxx

@@ -1,15 +1,15 @@
 /* Copyright (C) 2002-2005 RealVNC Ltd.  All Rights Reserved.
- * 
+ *
  * This is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 2 of the License, or
  * (at your option) any later version.
- * 
+ *
  * This software is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- * 
+ *
  * You should have received a copy of the GNU General Public License
  * along with this software; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307,
@@ -38,11 +38,15 @@
 #include <sys/un.h>
 #include <stdlib.h>
 #include <unistd.h>
+#include <pthread.h>
+#include <wordexp.h>
 #include "websocket.h"
 
+#include <network/GetAPI.h>
 #include <network/TcpSocket.h>
 #include <rfb/LogWriter.h>
 #include <rfb/Configuration.h>
+#include <rfb/ServerCore.h>
 
 #ifdef WIN32
 #include <os/winerrno.h>
@@ -121,11 +125,20 @@ WebSocket::WebSocket(int sock) : Socket(sock)
 }
 
 char* WebSocket::getPeerAddress() {
-  return rfb::strDup("websocket");
+  struct sockaddr_un addr;
+  socklen_t len = sizeof(struct sockaddr_un);
+  if (getpeername(getFd(), (struct sockaddr *) &addr, &len) != 0) {
+    vlog.error("unable to get peer name for socket");
+    return rfb::strDup("websocket");
+  }
+  return rfb::strDup(addr.sun_path + 1);
 }
 
 char* WebSocket::getPeerEndpoint() {
-  return rfb::strDup("websocket");
+  char buf[1024];
+  sprintf(buf, "%s::websocket", getPeerAddress());
+
+  return rfb::strDup(buf);
 }
 
 // -=- TcpSocket
@@ -151,8 +164,7 @@ TcpSocket::TcpSocket(const char *host, int port)
   hints.ai_next = NULL;
 
   if ((result = getaddrinfo(host, NULL, &hints, &ai)) != 0) {
-    throw Exception("unable to resolve host by name: %s",
-                    gai_strerror(result));
+    throw GAIException("unable to resolve host by name", result);
   }
 
   sock = -1;
@@ -220,7 +232,7 @@ TcpSocket::TcpSocket(const char *host, int port)
     if (err == 0)
       throw Exception("No useful address for host");
     else
-      throw SocketException("unable connect to socket", err);
+      throw SocketException("unable to connect to socket", err);
   }
 
   // Take proper ownership of the socket
@@ -420,10 +432,37 @@ int TcpListener::getMyPort() {
 
 extern settings_t settings;
 
+static uint8_t *screenshotCb(void *messager, uint16_t w, uint16_t h, const uint8_t q,
+                             const uint8_t dedup,
+                             uint32_t *len, uint8_t *staging)
+{
+  GetAPIMessager *msgr = (GetAPIMessager *) messager;
+  return msgr->netGetScreenshot(w, h, q, dedup, *len, staging);
+}
+
+static uint8_t adduserCb(void *messager, const char name[], const char pw[],
+                          const uint8_t write)
+{
+  GetAPIMessager *msgr = (GetAPIMessager *) messager;
+  return msgr->netAddUser(name, pw, write);
+}
+
+static uint8_t removeCb(void *messager, const char name[])
+{
+  GetAPIMessager *msgr = (GetAPIMessager *) messager;
+  return msgr->netRemoveUser(name);
+}
+
+static uint8_t givecontrolCb(void *messager, const char name[])
+{
+  GetAPIMessager *msgr = (GetAPIMessager *) messager;
+  return msgr->netGiveControlTo(name);
+}
+
 WebsocketListener::WebsocketListener(const struct sockaddr *listenaddr,
                          socklen_t listenaddrlen,
-                         bool sslonly, const char *cert,
-                         const char *basicauth,
+                         bool sslonly, const char *cert, const char *certkey,
+                         bool disablebasicauth,
                          const char *httpdir)
 {
   int one = 1;
@@ -486,9 +525,16 @@ WebsocketListener::WebsocketListener(const struct sockaddr *listenaddr,
 
   listen(internalSocket);
 
-  settings.basicauth = basicauth;
+  settings.passwdfile = NULL;
+
+  wordexp_t wexp;
+  if (!wordexp(rfb::Server::kasmPasswordFile, &wexp, WRDE_NOCMD))
+    settings.passwdfile = strdup(wexp.we_wordv[0]);
+  wordfree(&wexp);
+
+  settings.disablebasicauth = disablebasicauth;
   settings.cert = cert;
-  settings.key = "";
+  settings.key = certkey;
   settings.ssl_only = sslonly;
   settings.verbose = vlog.getLevel() >= vlog.LEVEL_DEBUG;
   settings.httpdir = NULL;
@@ -497,6 +543,12 @@ WebsocketListener::WebsocketListener(const struct sockaddr *listenaddr,
 
   settings.listen_sock = sock;
 
+  settings.messager = messager = new GetAPIMessager(settings.passwdfile);
+  settings.screenshotCb = screenshotCb;
+  settings.adduserCb = adduserCb;
+  settings.removeCb = removeCb;
+  settings.givecontrolCb = givecontrolCb;
+
   pthread_t tid;
   pthread_create(&tid, NULL, start_server, NULL);
 }
@@ -603,8 +655,7 @@ void network::createTcpListeners(std::list<SocketListener*> *listeners,
   snprintf (service, sizeof (service) - 1, "%d", port);
   service[sizeof (service) - 1] = '\0';
   if ((result = getaddrinfo(addr, service, &hints, &ai)) != 0)
-    throw rdr::Exception("unable to resolve listening address: %s",
-                         gai_strerror(result));
+    throw GAIException("unable to resolve listening address", result);
 
   try {
     createTcpListeners(listeners, ai);
@@ -612,6 +663,8 @@ void network::createTcpListeners(std::list<SocketListener*> *listeners,
     freeaddrinfo(ai);
     throw;
   }
+
+  freeaddrinfo(ai);
 }
 
 void network::createTcpListeners(std::list<SocketListener*> *listeners,
@@ -664,8 +717,8 @@ void network::createTcpListeners(std::list<SocketListener*> *listeners,
 
 void network::createWebsocketListeners(std::list<SocketListener*> *listeners,
                                  const struct addrinfo *ai,
-                                 bool sslonly, const char *cert,
-                                 const char *basicauth,
+                                 bool sslonly, const char *cert, const char *certkey,
+                                 bool disablebasicauth,
                                  const char *httpdir)
 {
   const struct addrinfo *current;
@@ -692,7 +745,7 @@ void network::createWebsocketListeners(std::list<SocketListener*> *listeners,
     try {
       new_listeners.push_back(new WebsocketListener(current->ai_addr,
                                               current->ai_addrlen,
-                                              sslonly, cert, basicauth,
+                                              sslonly, cert, certkey, disablebasicauth,
                                               httpdir));
     } catch (SocketException& e) {
       // Ignore this if it is due to lack of address family support on
@@ -720,7 +773,8 @@ void network::createWebsocketListeners(std::list<SocketListener*> *listeners,
                                  const char *addr,
                                  bool sslonly,
                                  const char *cert,
-                                 const char *basicauth,
+                                 const char *certkey,
+                                 bool disablebasicauth,
                                  const char *httpdir)
 {
   if (addr && !strcmp(addr, "local")) {
@@ -748,7 +802,7 @@ void network::createWebsocketListeners(std::list<SocketListener*> *listeners,
     ai[1].ai_addrlen = sizeof(sa[1].u.sin6);
     ai[1].ai_next = NULL;
 
-    createWebsocketListeners(listeners, ai, sslonly, cert, basicauth, httpdir);
+    createWebsocketListeners(listeners, ai, sslonly, cert, certkey, disablebasicauth, httpdir);
   } else {
     struct addrinfo *ai, hints;
     char service[16];
@@ -771,7 +825,7 @@ void network::createWebsocketListeners(std::list<SocketListener*> *listeners,
                            gai_strerror(result));
 
     try {
-      createWebsocketListeners(listeners, ai, sslonly, cert, basicauth, httpdir);
+      createWebsocketListeners(listeners, ai, sslonly, cert, certkey, disablebasicauth, httpdir);
     } catch(...) {
       freeaddrinfo(ai);
       throw;
@@ -913,8 +967,7 @@ TcpFilter::Pattern TcpFilter::parsePattern(const char* p) {
     }
 
     if ((result = getaddrinfo (p, NULL, &hints, &ai)) != 0) {
-      throw Exception("unable to resolve host by name: %s",
-                      gai_strerror(result));
+      throw GAIException("unable to resolve host by name", result);
     }
 
     memcpy (&pattern.address.u.sa, ai->ai_addr, ai->ai_addrlen);

common/network/TcpSocket.h

@@ -90,7 +90,8 @@ namespace network {
   class WebsocketListener : public SocketListener {
   public:
     WebsocketListener(const struct sockaddr *listenaddr, socklen_t listenaddrlen,
-                      bool sslonly, const char *cert, const char *basicauth,
+                      bool sslonly, const char *cert, const char *certkey,
+                      bool disablebasicauth,
                       const char *httpdir);
 
     virtual int getMyPort();
@@ -99,8 +100,12 @@ namespace network {
 
     int internalSocket;
 
+    virtual GetAPIMessager *getMessager() { return messager; }
+
   protected:
     virtual Socket* createSocket(int fd);
+  private:
+    GetAPIMessager *messager;
   };
 
   void createLocalTcpListeners(std::list<SocketListener*> *listeners,
@@ -110,7 +115,8 @@ namespace network {
                           const char *addr,
                           bool sslonly,
                           const char *cert,
-                          const char *basicauth,
+                          const char *certkey,
+                          bool disablebasicauth,
                           const char *httpdir);
   void createTcpListeners(std::list<SocketListener*> *listeners,
                           const char *addr,
@@ -121,7 +127,8 @@ namespace network {
                           const struct addrinfo *ai,
                           bool sslonly,
                           const char *cert,
-                          const char *basicauth,
+                          const char *certkey,
+                          bool disablebasicauth,
                           const char *httpdir);
 
   typedef struct vnc_sockaddr {

common/network/UnixSocket.cxx

@@ -69,7 +69,7 @@ UnixSocket::UnixSocket(const char *path)
   }
 
   if (result == -1)
-    throw SocketException("unable connect to socket", err);
+    throw SocketException("unable to connect to socket", err);
 
   setFd(sock);
 }

common/network/websocket.c

@@ -9,8 +9,10 @@
  */
 #define _GNU_SOURCE
 
+#include <ctype.h>
 #include <pthread.h>
 #include <unistd.h>
+#include <crypt.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <errno.h>
@@ -29,6 +31,7 @@
 #include <openssl/md5.h> /* md5 hash */
 #include <openssl/sha.h> /* sha1 hash */
 #include "websocket.h"
+#include "kasmpasswd.h"
 
 /*
  * Global state
@@ -58,29 +61,78 @@ void fatal(char *msg)
     exit(1);
 }
 
-/* resolve host with also IP address parsing */ 
-int resolve_host(struct in_addr *sin_addr, const char *hostname) 
-{ 
-    if (!inet_aton(hostname, sin_addr)) { 
-        struct addrinfo *ai, *cur; 
-        struct addrinfo hints; 
-        memset(&hints, 0, sizeof(hints)); 
-        hints.ai_family = AF_INET; 
-        if (getaddrinfo(hostname, NULL, &hints, &ai)) 
-            return -1; 
-        for (cur = ai; cur; cur = cur->ai_next) { 
-            if (cur->ai_family == AF_INET) { 
-                *sin_addr = ((struct sockaddr_in *)cur->ai_addr)->sin_addr; 
-                freeaddrinfo(ai); 
-                return 0; 
-            } 
-        } 
-        freeaddrinfo(ai); 
-        return -1; 
-    } 
-    return 0; 
-} 
+/* resolve host with also IP address parsing */
+int resolve_host(struct in_addr *sin_addr, const char *hostname)
+{
+    if (!inet_aton(hostname, sin_addr)) {
+        struct addrinfo *ai, *cur;
+        struct addrinfo hints;
+        memset(&hints, 0, sizeof(hints));
+        hints.ai_family = AF_INET;
+        if (getaddrinfo(hostname, NULL, &hints, &ai))
+            return -1;
+        for (cur = ai; cur; cur = cur->ai_next) {
+            if (cur->ai_family == AF_INET) {
+                *sin_addr = ((struct sockaddr_in *)cur->ai_addr)->sin_addr;
+                freeaddrinfo(ai);
+                return 0;
+            }
+        }
+        freeaddrinfo(ai);
+        return -1;
+    }
+    return 0;
+}
 
+static const char *parse_get(const char * const in, const char * const opt, unsigned *len) {
+	const char *start = in;
+	const char *end = strchrnul(start, '&');
+	const unsigned optlen = strlen(opt);
+	*len = 0;
+
+	while (1) {
+		if (!strncmp(start, opt, optlen)) {
+			const char *arg = strchr(start, '=');
+			if (!arg)
+				return "";
+			arg++;
+			*len = end - arg;
+			return arg;
+		}
+
+		if (!*end)
+			break;
+
+		end++;
+		start = end;
+		end = strchrnul(start, '&');
+	}
+
+	return "";
+}
+
+static void percent_decode(const char *src, char *dst) {
+	while (1) {
+		if (!*src)
+			break;
+		if (*src != '%') {
+			*dst++ = *src++;
+		} else {
+			src++;
+			if (!src[0] || !src[1])
+				break;
+			char hex[3];
+			hex[0] = src[0];
+			hex[1] = src[1];
+			hex[2] = '\0';
+
+			src += 2;
+			*dst++ = strtol(hex, NULL, 16);
+		}
+	}
+
+	*dst = '\0';
+}
 
 /*
  * SSL Wrapper Code
@@ -106,7 +158,7 @@ ssize_t ws_send(ws_ctx_t *ctx, const void *buf, size_t len) {
 
 ws_ctx_t *alloc_ws_ctx() {
     ws_ctx_t *ctx;
-    if (! (ctx = malloc(sizeof(ws_ctx_t))) )
+    if (! (ctx = calloc(sizeof(ws_ctx_t), 1)) )
         { fatal("malloc()"); }
 
     if (! (ctx->cin_buf = malloc(BUFSIZE)) )
@@ -160,12 +212,14 @@ ws_ctx_t *ws_socket_ssl(ws_ctx_t *ctx, int socket, char * certfile, char * keyfi
 
     }
 
-    ctx->ssl_ctx = SSL_CTX_new(TLSv1_server_method());
+    ctx->ssl_ctx = SSL_CTX_new(SSLv23_server_method());
     if (ctx->ssl_ctx == NULL) {
         ERR_print_errors_fp(stderr);
         fatal("Failed to configure SSL context");
     }
 
+    SSL_CTX_set_options(ctx->ssl_ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3);
+
     if (SSL_CTX_use_PrivateKey_file(ctx->ssl_ctx, use_keyfile,
                                     SSL_FILETYPE_PEM) <= 0) {
         sprintf(msg, "Unable to load private key file %s\n", use_keyfile);
@@ -305,7 +359,7 @@ int decode_hixie(char *src, size_t srclength,
     *left = srclength;
 
     if (srclength == 2 &&
-        (src[0] == '\xff') && 
+        (src[0] == '\xff') &&
         (src[1] == '\x00')) {
         // client sent orderly close frame
         *opcode = 0x8; // Close frame
@@ -323,7 +377,7 @@ int decode_hixie(char *src, size_t srclength,
             return len;
         }
         retlen += len;
-        start = end + 2; // Skip '\xff' end and '\x00' start 
+        start = end + 2; // Skip '\xff' end and '\x00' start
         framecount++;
     } while (end < (src+srclength-1));
     if (framecount > 1) {
@@ -396,7 +450,7 @@ int decode_hybi(unsigned char *src, size_t srclength,
     int i = 0, len, framecount = 0;
     size_t remaining = 0;
     unsigned int target_offset = 0, hdr_length = 0, payload_length = 0;
-    
+
     *left = srclength;
     frame = src;
 
@@ -496,7 +550,7 @@ int decode_hybi(unsigned char *src, size_t srclength,
         snprintf(cntstr, 3, "%d", framecount);
         traffic(cntstr);
     }
-    
+
     *left = remaining;
     return target_offset;
 }
@@ -540,7 +594,7 @@ int parse_handshake(ws_ctx_t *ws_ctx, char *handshake) {
     end = strstr(start, "\r\n");
     strncpy(headers->origin, start, end-start);
     headers->origin[end-start] = '\0';
-   
+
     start = strstr(handshake, "\r\nSec-WebSocket-Version: ");
     if (start) {
         // HyBi/RFC 6455
@@ -557,14 +611,14 @@ int parse_handshake(ws_ctx_t *ws_ctx, char *handshake) {
         end = strstr(start, "\r\n");
         strncpy(headers->key1, start, end-start);
         headers->key1[end-start] = '\0';
-   
+
         start = strstr(handshake, "\r\nConnection: ");
         if (!start) { return 0; }
         start += 14;
         end = strstr(start, "\r\n");
         strncpy(headers->connection, start, end-start);
         headers->connection[end-start] = '\0';
-   
+
         start = strstr(handshake, "\r\nSec-WebSocket-Protocol: ");
         if (!start) { return 0; }
         start += 26;
@@ -589,7 +643,7 @@ int parse_handshake(ws_ctx_t *ws_ctx, char *handshake) {
             end = strstr(start, "\r\n");
             strncpy(headers->key1, start, end-start);
             headers->key1[end-start] = '\0';
-        
+
             start = strstr(handshake, "\r\nSec-WebSocket-Key2: ");
             if (!start) { return 0; }
             start += 22;
@@ -725,7 +779,13 @@ static void dirlisting(ws_ctx_t *ws_ctx, const char fullpath[], const char path[
         if (!strcmp(names[i]->d_name, ".") || !strcmp(names[i]->d_name, ".."))
             continue;
 
-        sprintf(buf, "<li><a href=\"%s\">%s</a></li>", names[i]->d_name, names[i]->d_name);
+        if (names[i]->d_type == DT_DIR)
+	        sprintf(buf, "<li><a href=\"%s/\">%s/</a></li>", names[i]->d_name,
+	                names[i]->d_name);
+        else
+	        sprintf(buf, "<li><a href=\"%s\">%s</a></li>", names[i]->d_name,
+	                names[i]->d_name);
+
         ws_send(ws_ctx, buf, strlen(buf));
     }
 
@@ -810,6 +870,226 @@ nope:
     ws_send(ws_ctx, buf, strlen(buf));
 }
 
+static uint8_t ownerapi(ws_ctx_t *ws_ctx, const char *in) {
+    char buf[4096], path[4096], args[4096] = "";
+    uint8_t ret = 0; // 0 = continue checking
+
+    if (strncmp(in, "GET ", 4)) {
+        wserr("non-GET request, rejecting\n");
+        return 0;
+    }
+    in += 4;
+    const char *end = strchr(in, ' ');
+    unsigned len = end - in;
+
+    if (len < 1 || len > 1024 || strstr(in, "../")) {
+        wserr("Request too long (%u) or attempted dir traversal attack, rejecting\n", len);
+        return 0;
+    }
+
+    end = memchr(in, '?', len);
+    if (end) {
+        len = end - in;
+        end++;
+
+        const char *argend = strchr(end, ' ');
+        strncpy(args, end, argend - end);
+        args[argend - end] = '\0';
+    }
+
+    memcpy(path, in, len);
+    path[len] = '\0';
+
+    if (strstr(args, "password=")) {
+        wserr("Requested owner api '%s' with args (skipped, includes password)\n", path);
+    } else {
+        wserr("Requested owner api '%s' with args '%s'\n", path, args);
+    }
+
+    #define entry(x) if (!strcmp(path, x))
+
+    const char *param;
+
+    entry("/api/get_screenshot") {
+        uint8_t q = 7, dedup = 0;
+        uint16_t w = 4096, h = 4096;
+
+        param = parse_get(args, "width", &len);
+        if (len && isdigit(param[0]))
+            w = atoi(param);
+
+        param = parse_get(args, "height", &len);
+        if (len && isdigit(param[0]))
+            h = atoi(param);
+
+        param = parse_get(args, "quality", &len);
+        if (len && isdigit(param[0]))
+            q = atoi(param);
+
+        param = parse_get(args, "deduplicate", &len);
+        if (len && isalpha(param[0])) {
+            if (!strncmp(param, "true", len))
+                dedup = 1;
+        }
+
+        uint8_t *staging = malloc(1024 * 1024 * 8);
+
+        settings.screenshotCb(settings.messager, w, h, q, dedup, &len, staging);
+
+        if (len == 16) {
+            sprintf(buf, "HTTP/1.1 200 OK\r\n"
+                     "Server: KasmVNC/4.0\r\n"
+                     "Connection: close\r\n"
+                     "Content-type: text/plain\r\n"
+                     "Content-length: %u\r\n"
+                     "\r\n", len);
+            ws_send(ws_ctx, buf, strlen(buf));
+            ws_send(ws_ctx, staging, len);
+
+            wserr("Screenshot hadn't changed and dedup was requested, sent hash\n");
+            ret = 1;
+        } else if (len) {
+            sprintf(buf, "HTTP/1.1 200 OK\r\n"
+                     "Server: KasmVNC/4.0\r\n"
+                     "Connection: close\r\n"
+                     "Content-type: image/jpeg\r\n"
+                     "Content-length: %u\r\n"
+                     "\r\n", len);
+            ws_send(ws_ctx, buf, strlen(buf));
+            ws_send(ws_ctx, staging, len);
+
+            wserr("Sent screenshot %u bytes\n", len);
+            ret = 1;
+        }
+
+        free(staging);
+
+        if (!len) {
+            wserr("Invalid params to screenshot\n");
+            goto nope;
+        }
+    } else entry("/api/create_user") {
+        char decname[1024] = "", decpw[1024] = "";
+        uint8_t write = 0;
+
+        param = parse_get(args, "name", &len);
+        if (len) {
+            memcpy(buf, param, len);
+            buf[len] = '\0';
+            percent_decode(buf, decname);
+        }
+
+        param = parse_get(args, "password", &len);
+        if (len) {
+            memcpy(buf, param, len);
+            buf[len] = '\0';
+            percent_decode(buf, decpw);
+
+            struct crypt_data cdata;
+            cdata.initialized = 0;
+
+            const char *encrypted = crypt_r(decpw, "$5$kasm$", &cdata);
+            strcpy(decpw, encrypted);
+        }
+
+        param = parse_get(args, "write", &len);
+        if (len && isalpha(param[0])) {
+            if (!strncmp(param, "true", len))
+                write = 1;
+        }
+
+        if (!decname[0] || !decpw[0])
+            goto nope;
+
+        if (!settings.adduserCb(settings.messager, decname, decpw, write)) {
+            wserr("Invalid params to create_user\n");
+            goto nope;
+        }
+
+        sprintf(buf, "HTTP/1.1 200 OK\r\n"
+                 "Server: KasmVNC/4.0\r\n"
+                 "Connection: close\r\n"
+                 "Content-type: text/plain\r\n"
+                 "Content-length: 6\r\n"
+                 "\r\n"
+                 "200 OK");
+        ws_send(ws_ctx, buf, strlen(buf));
+
+        ret = 1;
+    } else entry("/api/remove_user") {
+        char decname[1024] = "";
+
+        param = parse_get(args, "name", &len);
+        if (len) {
+            memcpy(buf, param, len);
+            buf[len] = '\0';
+            percent_decode(buf, decname);
+        }
+
+        if (!decname[0])
+            goto nope;
+
+        if (!settings.removeCb(settings.messager, decname)) {
+            wserr("Invalid params to remove_user\n");
+            goto nope;
+        }
+
+        sprintf(buf, "HTTP/1.1 200 OK\r\n"
+                 "Server: KasmVNC/4.0\r\n"
+                 "Connection: close\r\n"
+                 "Content-type: text/plain\r\n"
+                 "Content-length: 6\r\n"
+                 "\r\n"
+                 "200 OK");
+        ws_send(ws_ctx, buf, strlen(buf));
+
+        wserr("Passed remove_user request to main thread\n");
+        ret = 1;
+    } else entry("/api/give_control") {
+        char decname[1024] = "";
+
+        param = parse_get(args, "name", &len);
+        if (len) {
+            memcpy(buf, param, len);
+            buf[len] = '\0';
+            percent_decode(buf, decname);
+        }
+
+        if (!decname[0])
+            goto nope;
+
+        if (!settings.givecontrolCb(settings.messager, decname)) {
+            wserr("Invalid params to give_control\n");
+            goto nope;
+        }
+
+        sprintf(buf, "HTTP/1.1 200 OK\r\n"
+                 "Server: KasmVNC/4.0\r\n"
+                 "Connection: close\r\n"
+                 "Content-type: text/plain\r\n"
+                 "Content-length: 6\r\n"
+                 "\r\n"
+                 "200 OK");
+        ws_send(ws_ctx, buf, strlen(buf));
+
+        wserr("Passed give_control request to main thread\n");
+        ret = 1;
+    }
+
+    #undef entry
+
+    return ret;
+nope:
+    sprintf(buf, "HTTP/1.1 400 Bad Request\r\n"
+                 "Server: KasmVNC/4.0\r\n"
+                 "Connection: close\r\n"
+                 "Content-type: text/plain\r\n"
+                 "\r\n"
+                 "400 Bad Request");
+    ws_send(ws_ctx, buf, strlen(buf));
+    return 1;
+}
+
 ws_ctx_t *do_handshake(int sock) {
     char handshake[4096], response[4096], sha1[29], trailer[17];
     char *scheme, *pre;
@@ -878,9 +1158,11 @@ ws_ctx_t *do_handshake(int sock) {
         usleep(10);
     }
 
-    if (strchr(settings.basicauth, ':')) {
+    unsigned char owner = 0;
+    if (!settings.disablebasicauth) {
         const char *hdr = strstr(handshake, "Authorization: Basic ");
         if (!hdr) {
+            handler_emsg("BasicAuth required, but client didn't send any. 401 Unauth\n");
             sprintf(response, "HTTP/1.1 401 Unauthorized\r\n"
                               "WWW-Authenticate: Basic realm=\"Websockify\"\r\n"
                               "\r\n");
@@ -892,6 +1174,7 @@ ws_ctx_t *do_handshake(int sock) {
         hdr += sizeof("Authorization: Basic ") - 1;
         const char *end = strchr(hdr, '\r');
         if (!end || end - hdr > 256) {
+            handler_emsg("Client sent invalid BasicAuth, dropping connection\n");
             free_ws_ctx(ws_ctx);
             return NULL;
         }
@@ -901,22 +1184,99 @@ ws_ctx_t *do_handshake(int sock) {
         tmp[len] = '\0';
         len = ws_b64_pton(tmp, response, 256);
 
-        if (len <= 0 || strcmp(settings.basicauth, response)) {
+        char authbuf[4096] = "";
+
+        // Do we need to read it from the file?
+        char *resppw = strchr(response, ':');
+        if (resppw && *resppw)
+            resppw++;
+        if (settings.passwdfile) {
+            if (resppw && *resppw && resppw - response < 32) {
+                char pwbuf[4096];
+                struct kasmpasswd_t *set = readkasmpasswd(settings.passwdfile);
+                if (!set->num) {
+                    fprintf(stderr, " websocket %d: Error: BasicAuth configured to read password from file %s, but the file doesn't exist or has no valid users\n",
+                            wsthread_handler_id,
+                            settings.passwdfile);
+                } else {
+                    unsigned i;
+                    char inuser[32];
+                    unsigned char found = 0;
+                    memcpy(inuser, response, resppw - response - 1);
+                    inuser[resppw - response - 1] = '\0';
+
+                    for (i = 0; i < set->num; i++) {
+                        if (!strcmp(set->entries[i].user, inuser)) {
+                            found = 1;
+                            strcpy(ws_ctx->user, inuser);
+                            snprintf(authbuf, 4096, "%s:%s", set->entries[i].user,
+                                     set->entries[i].password);
+                            authbuf[4095] = '\0';
+
+                            if (set->entries[i].owner)
+                                owner = 1;
+                            break;
+                        }
+                    }
+
+                    if (!found)
+                        handler_emsg("BasicAuth user %s not found\n", inuser);
+                }
+                free(set->entries);
+                free(set);
+
+                struct crypt_data cdata;
+                cdata.initialized = 0;
+
+                const char *encrypted = crypt_r(resppw, "$5$kasm$", &cdata);
+                *resppw = '\0';
+
+                snprintf(pwbuf, 4096, "%s%s", response, encrypted);
+                pwbuf[4095] = '\0';
+                strcpy(response, pwbuf);
+            } else {
+                // Client tried an empty password, just fail them
+                response[0] = '\0';
+            }
+        }
+
+        if (len <= 0 || strcmp(authbuf, response)) {
+            handler_emsg("BasicAuth user/pw did not match\n");
             sprintf(response, "HTTP/1.1 401 Forbidden\r\n"
                               "\r\n");
             ws_send(ws_ctx, response, strlen(response));
             free_ws_ctx(ws_ctx);
             return NULL;
         }
+        handler_emsg("BasicAuth matched\n");
     }
 
     //handler_msg("handshake: %s\n", handshake);
     if (!parse_handshake(ws_ctx, handshake)) {
         handler_emsg("Invalid WS request, maybe a HTTP one\n");
 
+        if (strstr(handshake, "/api/")) {
+            handler_emsg("HTTP request under /api/\n");
+
+            if (owner) {
+                if (ownerapi(ws_ctx, handshake))
+                    goto done;
+            } else {
+                sprintf(response, "HTTP/1.1 401 Unauthorized\r\n"
+                        "Server: KasmVNC/4.0\r\n"
+                        "Connection: close\r\n"
+                        "Content-type: text/plain\r\n"
+                        "\r\n"
+                        "401 Unauthorized");
+                ws_send(ws_ctx, response, strlen(response));
+                goto done;
+            }
+        }
+
         if (settings.httpdir && settings.httpdir[0])
             servefile(ws_ctx, handshake);
 
+done:
         free_ws_ctx(ws_ctx);
         return NULL;
     }
@@ -950,7 +1310,7 @@ ws_ctx_t *do_handshake(int sock) {
         snprintf(response, sizeof(response), SERVER_HANDSHAKE_HIXIE, pre, headers->origin,
                  pre, scheme, headers->host, headers->path, pre, "base64", trailer);
     }
-    
+
     //handler_msg("response: %s\n", response);
     ws_send(ws_ctx, response, strlen(response));
 
@@ -967,7 +1327,6 @@ void *subthread(void *ptr) {
 
     const int csock = pass->csock;
     wsthread_handler_id = pass->id;
-    free((void *) pass);
 
     ws_ctx_t *ws_ctx;
 
@@ -977,11 +1336,14 @@ void *subthread(void *ptr) {
         goto out;   // Child process exits
     }
 
+    memcpy(ws_ctx->ip, pass->ip, sizeof(pass->ip));
+
     proxy_handler(ws_ctx);
     if (pipe_error) {
         handler_emsg("Closing due to SIGPIPE\n");
     }
 out:
+    free((void *) pass);
 
     if (ws_ctx) {
         ws_socket_free(ws_ctx);
@@ -1017,12 +1379,13 @@ void *start_server(void *unused) {
             error("ERROR on accept");
             continue;
         }
+        struct wspass_t *pass = calloc(1, sizeof(struct wspass_t));
+        inet_ntop(cli_addr.sin_family, &cli_addr.sin_addr, pass->ip, sizeof(pass->ip));
         fprintf(stderr, " websocket %d: got client connection from %s\n",
                     settings.handler_id,
-                    inet_ntoa(cli_addr.sin_addr));
+                    pass->ip);
 
         pthread_t tid;
-        struct wspass_t *pass = calloc(1, sizeof(struct wspass_t));
         pass->id = settings.handler_id;
         pass->csock = csock;
         pthread_create(&tid, NULL, subthread, pass);

common/network/websocket.h

@@ -1,4 +1,5 @@
 #include <openssl/ssl.h>
+#include <stdint.h>
 
 #define BUFSIZE 65536
 #define DBUFSIZE (BUFSIZE * 3) / 4 - 20
@@ -53,11 +54,15 @@ typedef struct {
     char      *cout_buf;
     char      *tin_buf;
     char      *tout_buf;
+
+    char      user[32];
+    char      ip[64];
 } ws_ctx_t;
 
 struct wspass_t {
     int csock;
     unsigned id;
+    char ip[64];
 };
 
 typedef struct {
@@ -66,9 +71,19 @@ typedef struct {
     unsigned int handler_id;
     const char *cert;
     const char *key;
-    const char *basicauth;
+    uint8_t disablebasicauth;
+    const char *passwdfile;
     int ssl_only;
     const char *httpdir;
+
+    void *messager;
+    uint8_t *(*screenshotCb)(void *messager, uint16_t w, uint16_t h, const uint8_t q,
+                             const uint8_t dedup,
+                             uint32_t *len, uint8_t *staging);
+    uint8_t (*adduserCb)(void *messager, const char name[], const char pw[],
+                          const uint8_t write);
+    uint8_t (*removeCb)(void *messager, const char name[]);
+    uint8_t (*givecontrolCb)(void *messager, const char name[]);
 } settings_t;
 
 #ifdef __cplusplus

common/network/websockify.c

@@ -20,6 +20,7 @@
 #include <fcntl.h>
 #include <unistd.h>
 #include <sys/stat.h>
+#include <sys/time.h>
 #include "websocket.h"
 
 /*
@@ -227,7 +228,17 @@ void proxy_handler(ws_ctx_t *ws_ctx) {
     strcpy(addr.sun_path, ".KasmVNCSock");
     addr.sun_path[0] = '\0';
 
+    struct timeval tv;
+    gettimeofday(&tv, NULL);
+
+    struct sockaddr_un myaddr;
+    myaddr.sun_family = AF_UNIX;
+    sprintf(myaddr.sun_path, ".%s@%s_%lu.%lu", ws_ctx->user, ws_ctx->ip,
+            tv.tv_sec, tv.tv_usec);
+    myaddr.sun_path[0] = '\0';
+
     int tsock = socket(AF_UNIX, SOCK_STREAM, 0);
+    bind(tsock, (struct sockaddr *) &myaddr, sizeof(struct sockaddr_un));
 
     handler_msg("connecting to VNC target\n");
 

common/rdr/BufferedInStream.cxx

@@ -0,0 +1,69 @@
+/* Copyright (C) 2002-2005 RealVNC Ltd.  All Rights Reserved.
+ * Copyright 2020 Pierre Ossman for Cendio AB
+ * 
+ * This is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ * 
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License
+ * along with this software; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307,
+ * USA.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <rdr/BufferedInStream.h>
+#include <rdr/Exception.h>
+
+using namespace rdr;
+
+static const size_t DEFAULT_BUF_SIZE = 8192;
+
+BufferedInStream::BufferedInStream()
+  : bufSize(DEFAULT_BUF_SIZE), offset(0)
+{
+  ptr = end = start = new U8[bufSize];
+}
+
+BufferedInStream::~BufferedInStream()
+{
+  delete [] start;
+}
+
+size_t BufferedInStream::pos()
+{
+  return offset + ptr - start;
+}
+
+bool BufferedInStream::overrun(size_t needed, bool wait)
+{
+  if (needed > bufSize)
+    throw Exception("BufferedInStream overrun: "
+                    "requested size of %lu bytes exceeds maximum of %lu bytes",
+                    (long unsigned)needed, (long unsigned)bufSize);
+
+  // Do we need to shuffle things around?
+  if ((bufSize - (ptr - start)) < needed) {
+    memmove(start, ptr, end - ptr);
+
+    offset += ptr - start;
+    end -= ptr - start;
+    ptr = start;
+  }
+
+  while (avail() < needed) {
+    if (!fillBuffer(start + bufSize - end, wait))
+      return false;
+  }
+
+  return true;
+}

common/rdr/BufferedInStream.h

@@ -1,4 +1,5 @@
 /* Copyright (C) 2002-2005 RealVNC Ltd.  All Rights Reserved.
+ * Copyright 2020 Pierre Ossman for Cendio AB
  * 
  * This is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -17,36 +18,37 @@
  */
 
 //
-// A FixedMemOutStream writes to a buffer of a fixed length.
+// Base class for input streams with a buffer
 //
 
-#ifndef __RDR_FIXEDMEMOUTSTREAM_H__
-#define __RDR_FIXEDMEMOUTSTREAM_H__
+#ifndef __RDR_BUFFEREDINSTREAM_H__
+#define __RDR_BUFFEREDINSTREAM_H__
 
-#include <rdr/OutStream.h>
-#include <rdr/Exception.h>
+#include <rdr/InStream.h>
 
 namespace rdr {
 
-  class FixedMemOutStream : public OutStream {
+  class BufferedInStream : public InStream {
 
   public:
+    virtual ~BufferedInStream();
 
-    FixedMemOutStream(void* buf, int len) {
-      ptr = start = (U8*)buf;
-      end = start + len;
-    }
-
-    int length() { return ptr - start; }
-    void reposition(int pos) { ptr = start + pos; }
-    const void* data() { return (const void*)start; }
+    virtual size_t pos();
 
   private:
+    virtual bool fillBuffer(size_t maxSize, bool wait) = 0;
 
-    int overrun(int itemSize, int nItems) { throw EndOfStream(); }
+    virtual bool overrun(size_t needed, bool wait);
+
+  private:
+    size_t bufSize;
+    size_t offset;
     U8* start;
+
+  protected:
+    BufferedInStream();
   };
 
-}
+} // end of namespace rdr
 
 #endif

common/rdr/BufferedOutStream.cxx

@@ -0,0 +1,108 @@
+/* Copyright (C) 2002-2005 RealVNC Ltd.  All Rights Reserved.
+ * Copyright 2011-2020 Pierre Ossman for Cendio AB
+ * Copyright 2017 Peter Astrand <astrand@cendio.se> for Cendio AB
+ * 
+ * This is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ * 
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License
+ * along with this software; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307,
+ * USA.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <rdr/BufferedOutStream.h>
+#include <rdr/Exception.h>
+
+
+using namespace rdr;
+
+static const size_t DEFAULT_BUF_SIZE = 16384;
+
+BufferedOutStream::BufferedOutStream()
+  : bufSize(DEFAULT_BUF_SIZE), offset(0)
+{
+  ptr = start = sentUpTo = new U8[bufSize];
+  end = start + bufSize;
+}
+
+BufferedOutStream::~BufferedOutStream()
+{
+  // FIXME: Complain about non-flushed buffer?
+  delete [] start;
+}
+
+size_t BufferedOutStream::length()
+{
+  return offset + ptr - sentUpTo;
+}
+
+size_t BufferedOutStream::bufferUsage()
+{
+  return ptr - sentUpTo;
+}
+
+void BufferedOutStream::flush()
+{
+  while (sentUpTo < ptr) {
+    size_t len;
+
+    len = bufferUsage();
+
+    if (!flushBuffer(false))
+      break;
+
+    offset += len - bufferUsage();
+  }
+
+  // Managed to flush everything?
+  if (sentUpTo == ptr)
+    ptr = sentUpTo = start;
+}
+
+void BufferedOutStream::overrun(size_t needed)
+{
+  if (needed > bufSize)
+    throw Exception("BufferedOutStream overrun: "
+                    "requested size of %lu bytes exceeds maximum of %lu bytes",
+                    (long unsigned)needed, (long unsigned)bufSize);
+
+  // First try to get rid of the data we have
+  flush();
+
+  // Still not enough space?
+  while (needed > avail()) {
+    // Can we shuffle things around?
+    // (don't do this if it gains us less than 25%)
+    if (((size_t)(sentUpTo - start) > bufSize / 4) &&
+        (needed < bufSize - (ptr - sentUpTo))) {
+      memmove(start, sentUpTo, ptr - sentUpTo);
+      ptr = start + (ptr - sentUpTo);
+      sentUpTo = start;
+    } else {
+      size_t len;
+
+      len = bufferUsage();
+
+      // Have to get rid of more data, so allow the flush to wait...
+      flushBuffer(true);
+
+      offset += len - bufferUsage();
+
+       // Managed to flush everything?
+      if (sentUpTo == ptr)
+        ptr = sentUpTo = start;
+    }
+  }
+}

common/rdr/BufferedOutStream.h

@@ -0,0 +1,65 @@
+/* Copyright (C) 2002-2005 RealVNC Ltd.  All Rights Reserved.
+ * Copyright 2011-2020 Pierre Ossman for Cendio AB
+ * 
+ * This is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ * 
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License
+ * along with this software; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307,
+ * USA.
+ */
+
+//
+// Base class for output streams with a buffer
+//
+
+#ifndef __RDR_BUFFEREDOUTSTREAM_H__
+#define __RDR_BUFFEREDOUTSTREAM_H__
+
+#include <rdr/OutStream.h>
+
+namespace rdr {
+
+  class BufferedOutStream : public OutStream {
+
+  public:
+    virtual ~BufferedOutStream();
+
+    virtual size_t length();
+    virtual void flush();
+
+    size_t bufferUsage();
+
+  private:
+    // flushBuffer() requests that the stream be flushed. Returns true if it is
+    // able to progress the output (which might still not mean any bytes
+    // actually moved) and can be called again. If wait is true then it will
+    // block until all data has been written.
+
+    virtual bool flushBuffer(bool wait) = 0;
+
+    virtual void overrun(size_t needed);
+
+  private:
+    size_t bufSize;
+    size_t offset;
+    U8* start;
+
+  protected:
+    U8* sentUpTo;
+
+  protected:
+    BufferedOutStream();
+  };
+
+}
+
+#endif

common/rdr/CMakeLists.txt

@@ -1,6 +1,8 @@
 include_directories(${CMAKE_SOURCE_DIR}/common ${ZLIB_INCLUDE_DIRS})
 
 add_library(rdr STATIC
+  BufferedInStream.cxx
+  BufferedOutStream.cxx
   Exception.cxx
   FdInStream.cxx
   FdOutStream.cxx

common/rdr/Exception.cxx

@@ -31,6 +31,9 @@
 #include <tchar.h>
 #include <winsock2.h>
 #include <windows.h>
+#include <ws2tcpip.h>
+#else
+#include <netdb.h>
 #endif
 
 #include <string.h>
@@ -49,38 +52,46 @@ Exception::Exception(const char *format, ...) {
 	va_end(ap);
 }
 
+GAIException::GAIException(const char* s, int err)
+  : Exception("%s", s)
+{
+  strncat(str_, ": ", len-1-strlen(str_));
+#ifdef _WIN32
+  wchar_t *currStr = new wchar_t[len-strlen(str_)];
+  wcsncpy(currStr, gai_strerrorW(err), len-1-strlen(str_));
+  WideCharToMultiByte(CP_UTF8, 0, currStr, -1, str_+strlen(str_),
+                      len-1-strlen(str_), 0, 0);
+  delete [] currStr;
+#else
+  strncat(str_, gai_strerror(err), len-1-strlen(str_));
+#endif
+  strncat(str_, " (", len-1-strlen(str_));
+  char buf[20];
+#ifdef WIN32
+  if (err < 0)
+    sprintf(buf, "%x", err);
+  else
+#endif
+    sprintf(buf,"%d",err);
+  strncat(str_, buf, len-1-strlen(str_));
+  strncat(str_, ")", len-1-strlen(str_));
+}
+
 SystemException::SystemException(const char* s, int err_)
   : Exception("%s", s), err(err_)
 {
   strncat(str_, ": ", len-1-strlen(str_));
 #ifdef _WIN32
-  // Windows error messages are crap, so use unix ones for common errors.
-  const char* msg = 0;
-  switch (err) {
-  case WSAECONNREFUSED: msg = "Connection refused";       break;
-  case WSAETIMEDOUT:    msg = "Connection timed out";     break;
-  case WSAECONNRESET:   msg = "Connection reset by peer"; break;
-  case WSAECONNABORTED: msg = "Connection aborted";       break;
-  }
-  if (msg) {
-    strncat(str_, msg, len-1-strlen(str_));
-  } else {
-#ifdef UNICODE
-    WCHAR* tmsg = new WCHAR[len-strlen(str_)];
-    FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS,
-                  0, err, 0, tmsg, len-1-strlen(str_), 0);
-    WideCharToMultiByte(CP_ACP, 0, tmsg, wcslen(tmsg)+1,
-		              str_+strlen(str_), len-strlen(str_), 0, 0);
-    delete [] tmsg;
-#else
-    char* currStr = str_+strlen(str_);
-    FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS,
-                  0, err, 0, currStr, len-1-strlen(str_), 0);
-#endif
-    int l = strlen(str_);
-    if ((l >= 2) && (str_[l-2] == '\r') && (str_[l-1] == '\n'))
+  wchar_t *currStr = new wchar_t[len-strlen(str_)];
+  FormatMessageW(FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS,
+                 0, err, 0, currStr, len-1-strlen(str_), 0);
+  WideCharToMultiByte(CP_UTF8, 0, currStr, -1, str_+strlen(str_),
+                      len-1-strlen(str_), 0, 0);
+  delete [] currStr;
+
+  int l = strlen(str_);
+  if ((l >= 2) && (str_[l-2] == '\r') && (str_[l-1] == '\n'))
       str_[l-2] = 0;
-  }
 
 #else
   strncat(str_, strerror(err), len-1-strlen(str_));

common/rdr/Exception.h

@@ -40,12 +40,17 @@ namespace rdr {
   struct SystemException : public Exception {
     int err;
     SystemException(const char* s, int err_);
-  }; 
+  };
+
+  struct GAIException : public Exception {
+    int err;
+    GAIException(const char* s, int err_);
+  };
 
   struct TimedOut : public Exception {
     TimedOut() : Exception("Timed out") {}
   };
- 
+
   struct EndOfStream : public Exception {
     EndOfStream() : Exception("End of stream") {}
   };

common/rdr/FdInStream.cxx

@@ -36,13 +36,6 @@
 #include <unistd.h>
 #endif
 
-#ifndef vncmin
-#define vncmin(a,b)            (((a) < (b)) ? (a) : (b))
-#endif
-#ifndef vncmax
-#define vncmax(a,b)            (((a) > (b)) ? (a) : (b))
-#endif
-
 /* Old systems have select() in sys/time.h */
 #ifdef HAVE_SYS_SELECT_H
 #include <sys/select.h>
@@ -53,31 +46,22 @@
 
 using namespace rdr;
 
-enum { DEFAULT_BUF_SIZE = 8192,
-       MIN_BULK_SIZE = 1024 };
+enum { DEFAULT_BUF_SIZE = 8192 };
 
-FdInStream::FdInStream(int fd_, int timeoutms_, int bufSize_,
+FdInStream::FdInStream(int fd_, int timeoutms_,
                        bool closeWhenDone_)
   : fd(fd_), closeWhenDone(closeWhenDone_),
-    timeoutms(timeoutms_), blockCallback(0),
-    timing(false), timeWaitedIn100us(5), timedKbits(0),
-    bufSize(bufSize_ ? bufSize_ : DEFAULT_BUF_SIZE), offset(0)
+    timeoutms(timeoutms_), blockCallback(0)
 {
-  ptr = end = start = new U8[bufSize];
 }
 
-FdInStream::FdInStream(int fd_, FdInStreamBlockCallback* blockCallback_,
-                       int bufSize_)
-  : fd(fd_), timeoutms(0), blockCallback(blockCallback_),
-    timing(false), timeWaitedIn100us(5), timedKbits(0),
-    bufSize(bufSize_ ? bufSize_ : DEFAULT_BUF_SIZE), offset(0)
+FdInStream::FdInStream(int fd_, FdInStreamBlockCallback* blockCallback_)
+  : fd(fd_), timeoutms(0), blockCallback(blockCallback_)
 {
-  ptr = end = start = new U8[bufSize];
 }
 
 FdInStream::~FdInStream()
 {
-  delete [] start;
   if (closeWhenDone) close(fd);
 }
 
@@ -92,70 +76,15 @@ void FdInStream::setBlockCallback(FdInStreamBlockCallback* blockCallback_)
   timeoutms = 0;
 }
 
-int FdInStream::pos()
+
+bool FdInStream::fillBuffer(size_t maxSize, bool wait)
 {
-  return offset + ptr - start;
-}
+  size_t n = readWithTimeoutOrCallback((U8*)end, maxSize, wait);
+  if (n == 0)
+    return false;
+  end += n;
 
-void FdInStream::readBytes(void* data, int length)
-{
-  if (length < MIN_BULK_SIZE) {
-    InStream::readBytes(data, length);
-    return;
-  }
-
-  U8* dataPtr = (U8*)data;
-
-  int n = end - ptr;
-  if (n > length) n = length;
-
-  memcpy(dataPtr, ptr, n);
-  dataPtr += n;
-  length -= n;
-  ptr += n;
-
-  while (length > 0) {
-    n = readWithTimeoutOrCallback(dataPtr, length);
-    dataPtr += n;
-    length -= n;
-    offset += n;
-  }
-}
-
-
-int FdInStream::overrun(int itemSize, int nItems, bool wait)
-{
-  if (itemSize > bufSize)
-    throw Exception("FdInStream overrun: max itemSize exceeded");
-
-  if (end - ptr != 0)
-    memmove(start, ptr, end - ptr);
-
-  offset += ptr - start;
-  end -= ptr - start;
-  ptr = start;
-
-  int bytes_to_read;
-  while (end < start + itemSize) {
-    bytes_to_read = start + bufSize - end;
-    if (!timing) {
-      // When not timing, we must be careful not to read too much
-      // extra data into the buffer. Otherwise, the line speed
-      // estimation might stay at zero for a long time: All reads
-      // during timing=1 can be satisfied without calling
-      // readWithTimeoutOrCallback. However, reading only 1 or 2 bytes
-      // bytes is ineffecient.
-      bytes_to_read = vncmin(bytes_to_read, vncmax(itemSize*nItems, 8));
-    }
-    int n = readWithTimeoutOrCallback((U8*)end, bytes_to_read, wait);
-    if (n == 0) return 0;
-    end += n;
-  }
-
-  if (itemSize * nItems > end - ptr)
-    nItems = (end - ptr) / itemSize;
-
-  return nItems;
+  return true;
 }
 
 //
@@ -171,12 +100,8 @@ int FdInStream::overrun(int itemSize, int nItems, bool wait)
 // returning EINTR.
 //
 
-int FdInStream::readWithTimeoutOrCallback(void* buf, int len, bool wait)
+size_t FdInStream::readWithTimeoutOrCallback(void* buf, size_t len, bool wait)
 {
-  struct timeval before, after;
-  if (timing)
-    gettimeofday(&before, 0);
-
   int n;
   while (true) {
     do {
@@ -213,48 +138,5 @@ int FdInStream::readWithTimeoutOrCallback(void* buf, int len, bool wait)
   if (n < 0) throw SystemException("read",errno);
   if (n == 0) throw EndOfStream();
 
-  if (timing) {
-    gettimeofday(&after, 0);
-    int newTimeWaited = ((after.tv_sec - before.tv_sec) * 10000 +
-                         (after.tv_usec - before.tv_usec) / 100);
-    int newKbits = n * 8 / 1000;
-
-    // limit rate to between 10kbit/s and 40Mbit/s
-
-    if (newTimeWaited > newKbits*1000) newTimeWaited = newKbits*1000;
-    if (newTimeWaited < newKbits/4)    newTimeWaited = newKbits/4;
-
-    timeWaitedIn100us += newTimeWaited;
-    timedKbits += newKbits;
-  }
-
   return n;
 }
-
-void FdInStream::startTiming()
-{
-  timing = true;
-
-  // Carry over up to 1s worth of previous rate for smoothing.
-
-  if (timeWaitedIn100us > 10000) {
-    timedKbits = timedKbits * 10000 / timeWaitedIn100us;
-    timeWaitedIn100us = 10000;
-  }
-}
-
-void FdInStream::stopTiming()
-{
-  timing = false; 
-  if (timeWaitedIn100us < timedKbits/2)
-    timeWaitedIn100us = timedKbits/2; // upper limit 20Mbit/s
-}
-
-unsigned int FdInStream::kbitsPerSecond()
-{
-  // The following calculation will overflow 32-bit arithmetic if we have
-  // received more than about 50Mbytes (400Mbits) since we started timing, so
-  // it should be OK for a single RFB update.
-
-  return timedKbits * 10000 / timeWaitedIn100us;
-}

common/rdr/FdInStream.h

@@ -23,7 +23,7 @@
 #ifndef __RDR_FDINSTREAM_H__
 #define __RDR_FDINSTREAM_H__
 
-#include <rdr/InStream.h>
+#include <rdr/BufferedInStream.h>
 
 namespace rdr {
 
@@ -33,43 +33,29 @@ namespace rdr {
     virtual ~FdInStreamBlockCallback() {}
   };
 
-  class FdInStream : public InStream {
+  class FdInStream : public BufferedInStream {
 
   public:
 
-    FdInStream(int fd, int timeoutms=-1, int bufSize=0,
-               bool closeWhenDone_=false);
-    FdInStream(int fd, FdInStreamBlockCallback* blockCallback, int bufSize=0);
+    FdInStream(int fd, int timeoutms=-1, bool closeWhenDone_=false);
+    FdInStream(int fd, FdInStreamBlockCallback* blockCallback);
     virtual ~FdInStream();
 
     void setTimeout(int timeoutms);
     void setBlockCallback(FdInStreamBlockCallback* blockCallback);
     int getFd() { return fd; }
-    int pos();
-    void readBytes(void* data, int length);
-
-    void startTiming();
-    void stopTiming();
-    unsigned int kbitsPerSecond();
-    unsigned int timeWaited() { return timeWaitedIn100us; }
-
-  protected:
-    int overrun(int itemSize, int nItems, bool wait);
 
   private:
-    int readWithTimeoutOrCallback(void* buf, int len, bool wait=true);
+    virtual bool fillBuffer(size_t maxSize, bool wait);
+
+    size_t readWithTimeoutOrCallback(void* buf, size_t len, bool wait=true);
 
     int fd;
     bool closeWhenDone;
     int timeoutms;
     FdInStreamBlockCallback* blockCallback;
 
-    bool timing;
-    unsigned int timeWaitedIn100us;
-    unsigned int timedKbits;
-
-    int bufSize;
-    int offset;
+    size_t offset;
     U8* start;
   };
 

common/rdr/FdOutStream.cxx

@@ -35,6 +35,8 @@
 #include <unistd.h>
 #include <sys/time.h>
 #include <sys/socket.h>
+#include <netinet/in.h>
+#include <netinet/tcp.h>
 #endif
 
 /* Old systems have select() in sys/time.h */
@@ -49,26 +51,19 @@
 
 using namespace rdr;
 
-enum { DEFAULT_BUF_SIZE = 16384 };
-
-FdOutStream::FdOutStream(int fd_, bool blocking_, int timeoutms_, int bufSize_)
-  : fd(fd_), blocking(blocking_), timeoutms(timeoutms_),
-    bufSize(bufSize_ ? bufSize_ : DEFAULT_BUF_SIZE), offset(0)
+FdOutStream::FdOutStream(int fd_, bool blocking_, int timeoutms_)
+  : fd(fd_), blocking(blocking_), timeoutms(timeoutms_)
 {
-  ptr = start = sentUpTo = new U8[bufSize];
-  end = start + bufSize;
-
   gettimeofday(&lastWrite, NULL);
 }
 
 FdOutStream::~FdOutStream()
 {
   try {
-    blocking = true;
-    flush();
+    while (sentUpTo != ptr)
+      flushBuffer(true);
   } catch (Exception&) {
   }
-  delete [] start;
 }
 
 void FdOutStream::setTimeout(int timeoutms_) {
@@ -79,81 +74,29 @@ void FdOutStream::setBlocking(bool blocking_) {
   blocking = blocking_;
 }
 
-int FdOutStream::length()
-{
-  return offset + ptr - sentUpTo;
-}
-
-int FdOutStream::bufferUsage()
-{
-  return ptr - sentUpTo;
-}
-
 unsigned FdOutStream::getIdleTime()
 {
   return rfb::msSince(&lastWrite);
 }
 
-void FdOutStream::flush()
+bool FdOutStream::flushBuffer(bool wait)
 {
-  while (sentUpTo < ptr) {
-    int n = writeWithTimeout((const void*) sentUpTo,
-                             ptr - sentUpTo,
-                             blocking? timeoutms : 0);
+  size_t n = writeWithTimeout((const void*) sentUpTo,
+                              ptr - sentUpTo,
+                              (blocking || wait)? timeoutms : 0);
 
-    // Timeout?
-    if (n == 0) {
-      // If non-blocking then we're done here
-      if (!blocking)
-        break;
+  // Timeout?
+  if (n == 0) {
+    // If non-blocking then we're done here
+    if (!blocking && !wait)
+      return false;
 
-      throw TimedOut();
-    }
-
-    sentUpTo += n;
-    offset += n;
+    throw TimedOut();
   }
 
-   // Managed to flush everything?
-  if (sentUpTo == ptr)
-    ptr = sentUpTo = start;
-}
+  sentUpTo += n;
 
-
-int FdOutStream::overrun(int itemSize, int nItems)
-{
-  if (itemSize > bufSize)
-    throw Exception("FdOutStream overrun: max itemSize exceeded");
-
-  // First try to get rid of the data we have
-  flush();
-
-  // Still not enough space?
-  if (itemSize > end - ptr) {
-    // Can we shuffle things around?
-    // (don't do this if it gains us less than 25%)
-    if ((sentUpTo - start > bufSize / 4) &&
-        (itemSize < bufSize - (ptr - sentUpTo))) {
-      memmove(start, sentUpTo, ptr - sentUpTo);
-      ptr = start + (ptr - sentUpTo);
-      sentUpTo = start;
-    } else {
-      // Have to get rid of more data, so turn off non-blocking
-      // for a bit...
-      bool realBlocking;
-
-      realBlocking = blocking;
-      blocking = true;
-      flush();
-      blocking = realBlocking;
-    }
-  }
-
-  // Can we fit all the items asked for?
-  if (itemSize * nItems > end - ptr)
-    nItems = (end - ptr) / itemSize;
-
-  return nItems;
+  return true;
 }
 
 //
@@ -166,7 +109,7 @@ int FdOutStream::overrun(int itemSize, int nItems)
 // select() and send() returning EINTR.
 //
 
-int FdOutStream::writeWithTimeout(const void* data, int length, int timeoutms)
+size_t FdOutStream::writeWithTimeout(const void* data, size_t length, int timeoutms)
 {
   int n;
 

common/rdr/FdOutStream.h

@@ -26,38 +26,29 @@
 
 #include <sys/time.h>
 
-#include <rdr/OutStream.h>
+#include <rdr/BufferedOutStream.h>
 
 namespace rdr {
 
-  class FdOutStream : public OutStream {
+  class FdOutStream : public BufferedOutStream {
 
   public:
 
-    FdOutStream(int fd, bool blocking=true, int timeoutms=-1, int bufSize=0);
+    FdOutStream(int fd, bool blocking=true, int timeoutms=-1);
     virtual ~FdOutStream();
 
     void setTimeout(int timeoutms);
     void setBlocking(bool blocking);
     int getFd() { return fd; }
 
-    void flush();
-    int length();
-
-    int bufferUsage();
-
     unsigned getIdleTime();
 
   private:
-    int overrun(int itemSize, int nItems);
-    int writeWithTimeout(const void* data, int length, int timeoutms);
+    virtual bool flushBuffer(bool wait);
+    size_t writeWithTimeout(const void* data, size_t length, int timeoutms);
     int fd;
     bool blocking;
     int timeoutms;
-    int bufSize;
-    int offset;
-    U8* start;
-    U8* sentUpTo;
     struct timeval lastWrite;
   };
 

common/rdr/FileInStream.cxx

@@ -30,7 +30,6 @@ FileInStream::FileInStream(const char *fileName)
   file = fopen(fileName, "rb");
   if (!file)
     throw SystemException("fopen", errno);
-  ptr = end = b;
 }
 
 FileInStream::~FileInStream(void) {
@@ -40,48 +39,17 @@ FileInStream::~FileInStream(void) {
   }
 }
 
-void FileInStream::reset(void) {
-  if (!file)
-    throw Exception("File is not open");
-  if (fseek(file, 0, SEEK_SET) != 0)
-    throw SystemException("fseek", errno);
-  ptr = end = b;
-}
-
-int FileInStream::pos()
+bool FileInStream::fillBuffer(size_t maxSize, bool wait)
 {
-  if (!file)
-    throw Exception("File is not open");
-
-  return ftell(file) + ptr - b;
-}
-
-int FileInStream::overrun(int itemSize, int nItems, bool wait)
-{
-  if (itemSize > (int)sizeof(b))
-    throw Exception("FileInStream overrun: max itemSize exceeded");
-
-  if (end - ptr != 0)
-    memmove(b, ptr, end - ptr);
-
-  end -= ptr - b;
-  ptr = b;
-
-
-  while (end < b + itemSize) {
-    size_t n = fread((U8 *)end, b + sizeof(b) - end, 1, file);
-    if (n == 0) {
-      if (ferror(file))
-        throw SystemException("fread", errno);
-      if (feof(file))
-        throw EndOfStream();
-      return 0;
-    }
-    end += b + sizeof(b) - end;
+  size_t n = fread((U8 *)end, 1, maxSize, file);
+  if (n == 0) {
+    if (ferror(file))
+      throw SystemException("fread", errno);
+    if (feof(file))
+      throw EndOfStream();
+    return false;
   }
+  end += n;
 
-  if (itemSize * nItems > end - ptr)
-    nItems = (end - ptr) / itemSize;
-
-  return nItems;
+  return true;
 }

common/rdr/FileInStream.h

@@ -22,26 +22,21 @@
 
 #include <stdio.h>
 
-#include <rdr/InStream.h>
+#include <rdr/BufferedInStream.h>
 
 namespace rdr {
 
-  class FileInStream : public InStream {
+  class FileInStream : public BufferedInStream {
 
   public:
 
     FileInStream(const char *fileName);
     ~FileInStream(void);
 
-    void reset(void);
-
-    int pos();
-
-  protected:
-    int overrun(int itemSize, int nItems, bool wait = true);
+  private:
+    virtual bool fillBuffer(size_t maxSize, bool wait);
 
   private:
-    U8 b[131072];
     FILE *file;
   };
 

common/rdr/HexInStream.cxx

@@ -24,18 +24,14 @@
 
 using namespace rdr;
 
-const int DEFAULT_BUF_LEN = 16384;
-
 static inline int min(int a, int b) {return a<b ? a : b;}
 
-HexInStream::HexInStream(InStream& is, int bufSize_)
-: bufSize(bufSize_ ? bufSize_ : DEFAULT_BUF_LEN), offset(0), in_stream(is)
+HexInStream::HexInStream(InStream& is)
+: in_stream(is)
 {
-  ptr = end = start = new U8[bufSize];
 }
 
 HexInStream::~HexInStream() {
-  delete [] start;
 }
 
 
@@ -50,8 +46,8 @@ bool HexInStream::readHexAndShift(char c, int* v) {
   return true;
 }
 
-bool HexInStream::hexStrToBin(const char* s, char** data, int* length) {
-  int l=strlen(s);
+bool HexInStream::hexStrToBin(const char* s, char** data, size_t* length) {
+  size_t l=strlen(s);
   if ((l % 2) == 0) {
     delete [] *data;
     *data = 0; *length = 0;
@@ -59,7 +55,7 @@ bool HexInStream::hexStrToBin(const char* s, char** data, int* length) {
       return true;
     *data = new char[l/2];
     *length = l/2;
-    for(int i=0;i<l;i+=2) {
+    for(size_t i=0;i<l;i+=2) {
       int byte = 0;
       if (!readHexAndShift(s[i], &byte) ||
         !readHexAndShift(s[i+1], &byte))
@@ -76,42 +72,24 @@ decodeError:
 }
 
 
-int HexInStream::pos() {
-  return offset + ptr - start;
-}
+bool HexInStream::fillBuffer(size_t maxSize, bool wait) {
+  if (!in_stream.check(2, wait))
+    return false;
 
-int HexInStream::overrun(int itemSize, int nItems, bool wait) {
-  if (itemSize > bufSize)
-    throw Exception("HexInStream overrun: max itemSize exceeded");
+  const U8* iptr = in_stream.getptr();
+  const U8* eptr = in_stream.getend();
+  size_t length = min((eptr - iptr)/2, maxSize);
 
-  if (end - ptr != 0)
-    memmove(start, ptr, end - ptr);
-
-  end -= ptr - start;
-  offset += ptr - start;
-  ptr = start;
-
-  while (end < ptr + itemSize) {
-    int n = in_stream.check(2, 1, wait);
-    if (n == 0) return 0;
-    const U8* iptr = in_stream.getptr();
-    const U8* eptr = in_stream.getend();
-    int length = min((eptr - iptr)/2, start + bufSize - end);
-
-    U8* optr = (U8*) end;
-    for (int i=0; i<length; i++) {
-      int v = 0;
-      readHexAndShift(iptr[i*2], &v);
-      readHexAndShift(iptr[i*2+1], &v);
-      optr[i] = v;
-    }
-
-    in_stream.setptr(iptr + length*2);
-    end += length;
+  U8* optr = (U8*) end;
+  for (size_t i=0; i<length; i++) {
+    int v = 0;
+    readHexAndShift(iptr[i*2], &v);
+    readHexAndShift(iptr[i*2+1], &v);
+    optr[i] = v;
   }
 
-  if (itemSize * nItems > end - ptr)
-    nItems = (end - ptr) / itemSize;
+  in_stream.setptr(iptr + length*2);
+  end += length;
 
-  return nItems;
+  return true;
 }

common/rdr/HexInStream.h

@@ -19,29 +19,23 @@
 #ifndef __RDR_HEX_INSTREAM_H__
 #define __RDR_HEX_INSTREAM_H__
 
-#include <rdr/InStream.h>
+#include <rdr/BufferedInStream.h>
 
 namespace rdr {
 
-  class HexInStream : public InStream {
+  class HexInStream : public BufferedInStream {
   public:
 
-    HexInStream(InStream& is, int bufSize=0);
+    HexInStream(InStream& is);
     virtual ~HexInStream();
 
-    int pos();
-
     static bool readHexAndShift(char c, int* v);
-    static bool hexStrToBin(const char* s, char** data, int* length);
-
-  protected:
-    int overrun(int itemSize, int nItems, bool wait);
+    static bool hexStrToBin(const char* s, char** data, size_t* length);
 
   private:
-    int bufSize;
-    U8* start;
-    int offset;
+    virtual bool fillBuffer(size_t maxSize, bool wait);
 
+  private:
     InStream& in_stream;
   };
 

common/rdr/HexOutStream.cxx

@@ -23,10 +23,10 @@ using namespace rdr;
 
 const int DEFAULT_BUF_LEN = 16384;
 
-static inline int min(int a, int b) {return a<b ? a : b;}
+static inline size_t min(size_t a, size_t b) {return a<b ? a : b;}
 
-HexOutStream::HexOutStream(OutStream& os, int buflen)
-: out_stream(os), offset(0), bufSize(buflen ? buflen : DEFAULT_BUF_LEN)
+HexOutStream::HexOutStream(OutStream& os)
+  : out_stream(os), offset(0), bufSize(DEFAULT_BUF_LEN)
 {
   if (bufSize % 2)
     bufSize--;
@@ -48,9 +48,9 @@ char HexOutStream::intToHex(int i) {
     throw rdr::Exception("intToHex failed");
 }
 
-char* HexOutStream::binToHexStr(const char* data, int length) {
+char* HexOutStream::binToHexStr(const char* data, size_t length) {
   char* buffer = new char[length*2+1];
-  for (int i=0; i<length; i++) {
+  for (size_t i=0; i<length; i++) {
     buffer[i*2] = intToHex((data[i] >> 4) & 15);
     buffer[i*2+1] = intToHex((data[i] & 15));
     if (!buffer[i*2] || !buffer[i*2+1]) {
@@ -70,9 +70,9 @@ HexOutStream::writeBuffer() {
     out_stream.check(2);
     U8* optr = out_stream.getptr();
     U8* oend = out_stream.getend();
-    int length = min(ptr-pos, (oend-optr)/2);
+    size_t length = min(ptr-pos, (oend-optr)/2);
 
-    for (int i=0; i<length; i++) {
+    for (size_t i=0; i<length; i++) {
       optr[i*2] = intToHex((pos[i] >> 4) & 0xf);
       optr[i*2+1] = intToHex(pos[i] & 0xf);
     }
@@ -84,7 +84,7 @@ HexOutStream::writeBuffer() {
   ptr = start;
 }
 
-int HexOutStream::length()
+size_t HexOutStream::length()
 {
   return offset + ptr - start;
 }
@@ -95,16 +95,10 @@ HexOutStream::flush() {
   out_stream.flush();
 }
 
-int
-HexOutStream::overrun(int itemSize, int nItems) {
-  if (itemSize > bufSize)
-    throw Exception("HexOutStream overrun: max itemSize exceeded");
+void HexOutStream::overrun(size_t needed) {
+  if (needed > bufSize)
+    throw Exception("HexOutStream overrun: buffer size exceeded");
 
   writeBuffer();
-
-  if (itemSize * nItems > end - ptr)
-    nItems = (end - ptr) / itemSize;
-
-  return nItems;
 }
 

common/rdr/HexOutStream.h

@@ -26,24 +26,24 @@ namespace rdr {
   class HexOutStream : public OutStream {
   public:
 
-    HexOutStream(OutStream& os, int buflen=0);
+    HexOutStream(OutStream& os);
     virtual ~HexOutStream();
 
     void flush();
-    int length();
+    size_t length();
 
     static char intToHex(int i);
-    static char* binToHexStr(const char* data, int length);
+    static char* binToHexStr(const char* data, size_t length);
 
   private:
     void writeBuffer();
-    int overrun(int itemSize, int nItems);
+    virtual void overrun(size_t needed);
 
     OutStream& out_stream;
 
     U8* start;
-    int offset;
-    int bufSize;
+    size_t offset;
+    size_t bufSize;
   };
 
 }

common/rdr/InStream.h

@@ -35,28 +35,33 @@ namespace rdr {
 
     virtual ~InStream() {}
 
-    // check() ensures there is buffer data for at least one item of size
-    // itemSize bytes.  Returns the number of items in the buffer (up to a
-    // maximum of nItems).  If wait is false, then instead of blocking to wait
-    // for the bytes, zero is returned if the bytes are not immediately
-    // available.
+    // avail() returns the number of bytes that are currenctly directly
+    // available from the stream.
 
-    inline int check(int itemSize, int nItems=1, bool wait=true)
+    inline size_t avail()
     {
-      if (ptr + itemSize * nItems > end) {
-        if (ptr + itemSize > end)
-          return overrun(itemSize, nItems, wait);
+      return end - ptr;
+    }
 
-        nItems = (end - ptr) / itemSize;
-      }
-      return nItems;
+    // check() ensures there is buffer data for at least needed bytes. Returns
+    // true once the data is available. If wait is false, then instead of
+    // blocking to wait for the bytes, false is returned if the bytes are not
+    // immediately available.
+
+    inline size_t check(size_t needed, bool wait=true)
+    {
+      if (needed > avail())
+        return overrun(needed, wait);
+
+      return true;
     }
 
     // checkNoWait() tries to make sure that the given number of bytes can
     // be read without blocking.  It returns true if this is the case, false
     // otherwise.  The length must be "small" (less than the buffer size).
+    // If length is zero, checkNoWait() will return true.
 
-    inline bool checkNoWait(int length) { return check(length, 1, false)!=0; }
+    inline bool checkNoWait(size_t length) { return check(length, false); }
 
     // readU/SN() methods read unsigned and signed N-bit integers.
 
@@ -82,24 +87,24 @@ namespace rdr {
 
     static U32 maxStringLength;
 
-    inline void skip(int bytes) {
+    inline void skip(size_t bytes) {
       while (bytes > 0) {
-        int n = check(1, bytes);
+        size_t n = check(1, bytes);
         ptr += n;
         bytes -= n;
       }
     }
 
     // readBytes() reads an exact number of bytes.
+    // If length is zero, readBytes() will return immediately.
 
-    void readBytes(void* data, int length) {
-      U8* dataPtr = (U8*)data;
-      U8* dataEnd = dataPtr + length;
-      while (dataPtr < dataEnd) {
-        int n = check(1, dataEnd - dataPtr);
-        memcpy(dataPtr, ptr, n);
+    void readBytes(void* data, size_t length) {
+      while (length > 0) {
+        size_t n = check(1, length);
+        memcpy(data, ptr, n);
         ptr += n;
-        dataPtr += n;
+        data = (U8*)data + n;
+        length -= n;
       }
     }
 
@@ -114,7 +119,7 @@ namespace rdr {
 
     // pos() returns the position in the stream.
 
-    virtual int pos() = 0;
+    virtual size_t pos() = 0;
 
     // getptr(), getend() and setptr() are "dirty" methods which allow you to
     // manipulate the buffer directly.  This is useful for a stream which is a
@@ -127,13 +132,12 @@ namespace rdr {
   private:
 
     // overrun() is implemented by a derived class to cope with buffer overrun.
-    // It ensures there are at least itemSize bytes of buffer data.  Returns
-    // the number of items in the buffer (up to a maximum of nItems).  itemSize
-    // is supposed to be "small" (a few bytes).  If wait is false, then
-    // instead of blocking to wait for the bytes, zero is returned if the bytes
-    // are not immediately available.
+    // It ensures there are at least needed bytes of buffer data. Returns true
+    // once the data is available. If wait is false, then instead of blocking
+    // to wait for the bytes, false is returned if the bytes are not
+    // immediately available.
 
-    virtual int overrun(int itemSize, int nItems, bool wait=true) = 0;
+    virtual bool overrun(size_t needed, bool wait=true) = 0;
 
   protected:
 

common/rdr/MemInStream.h

@@ -36,7 +36,7 @@ namespace rdr {
 
   public:
 
-    MemInStream(const void* data, int len, bool deleteWhenDone_=false)
+    MemInStream(const void* data, size_t len, bool deleteWhenDone_=false)
       : start((const U8*)data), deleteWhenDone(deleteWhenDone_)
     {
       ptr = start;
@@ -48,12 +48,12 @@ namespace rdr {
         delete [] start;
     }
 
-    int pos() { return ptr - start; }
-    void reposition(int pos) { ptr = start + pos; }
+    size_t pos() { return ptr - start; }
+    void reposition(size_t pos) { ptr = start + pos; }
 
   private:
 
-    int overrun(int itemSize, int nItems, bool wait) { throw EndOfStream(); }
+    bool overrun(size_t needed, bool wait) { throw EndOfStream(); }
     const U8* start;
     bool deleteWhenDone;
   };

common/rdr/MemOutStream.h

@@ -23,6 +23,7 @@
 #ifndef __RDR_MEMOUTSTREAM_H__
 #define __RDR_MEMOUTSTREAM_H__
 
+#include <rdr/Exception.h>
 #include <rdr/OutStream.h>
 
 namespace rdr {
@@ -40,16 +41,10 @@ namespace rdr {
       delete [] start;
     }
 
-    void writeBytes(const void* data, int length) {
-      check(length);
-      memcpy(ptr, data, length);
-      ptr += length;
-    }
-
-    int length() { return ptr - start; }
+    size_t length() { return ptr - start; }
     void clear() { ptr = start; };
     void clearAndZero() { memset(start, 0, ptr-start); clear(); }
-    void reposition(int pos) { ptr = start + pos; }
+    void reposition(size_t pos) { ptr = start + pos; }
 
     // data() returns a pointer to the buffer.
 
@@ -57,22 +52,23 @@ namespace rdr {
 
   protected:
 
-    // overrun() either doubles the buffer or adds enough space for nItems of
-    // size itemSize bytes.
+    // overrun() either doubles the buffer or adds enough space for
+    // needed bytes.
 
-    int overrun(int itemSize, int nItems) {
-      int len = ptr - start + itemSize * nItems;
-      if (len < (end - start) * 2)
+    virtual void overrun(size_t needed) {
+      size_t len = ptr - start + needed;
+      if (len < (size_t)(end - start) * 2)
         len = (end - start) * 2;
 
+      if (len < (size_t)(end - start))
+        throw Exception("Overflow in MemOutStream::overrun()");
+
       U8* newStart = new U8[len];
       memcpy(newStart, start, ptr - start);
       ptr = newStart + (ptr - start);
       delete [] start;
       start = newStart;
       end = newStart + len;
-
-      return nItems;
     }
 
     U8* start;

common/rdr/OutStream.h

@@ -40,19 +40,20 @@ namespace rdr {
 
     virtual ~OutStream() {}
 
-    // check() ensures there is buffer space for at least one item of size
-    // itemSize bytes.  Returns the number of items which fit (up to a maximum
-    // of nItems).
+    // avail() returns the number of bytes that currently be written to the
+    // stream without any risk of blocking.
 
-    inline int check(int itemSize, int nItems=1)
+    inline size_t avail()
     {
-      if (ptr + itemSize * nItems > end) {
-        if (ptr + itemSize > end)
-          return overrun(itemSize, nItems);
+      return end - ptr;
+    }
 
-        nItems = (end - ptr) / itemSize;
-      }
-      return nItems;
+    // check() ensures there is buffer space for at least needed bytes.
+
+    inline void check(size_t needed)
+    {
+      if (needed > avail())
+        overrun(needed);
     }
 
     // writeU/SN() methods write unsigned and signed N-bit integers.
@@ -76,36 +77,33 @@ namespace rdr {
       writeBytes(str, len);
     }
 
-    inline void pad(int bytes) {
+    inline void pad(size_t bytes) {
       while (bytes-- > 0) writeU8(0);
     }
 
-    inline void skip(int bytes) {
-      while (bytes > 0) {
-        int n = check(1, bytes);
-        ptr += n;
-        bytes -= n;
-      }
-    }
-
     // writeBytes() writes an exact number of bytes.
 
-    void writeBytes(const void* data, int length) {
-      const U8* dataPtr = (const U8*)data;
-      const U8* dataEnd = dataPtr + length;
-      while (dataPtr < dataEnd) {
-        int n = check(1, dataEnd - dataPtr);
-        memcpy(ptr, dataPtr, n);
+    void writeBytes(const void* data, size_t length) {
+      while (length > 0) {
+        check(1);
+        size_t n = length;
+        if (length > avail())
+          n = avail();
+        memcpy(ptr, data, n);
         ptr += n;
-        dataPtr += n;
+        data = (U8*)data + n;
+        length -= n;
       }
     }
 
     // copyBytes() efficiently transfers data between streams
 
-    void copyBytes(InStream* is, int length) {
+    void copyBytes(InStream* is, size_t length) {
       while (length > 0) {
-        int n = check(1, length);
+        check(1);
+        size_t n = length;
+        if (length > avail())
+          n = avail();
         is->readBytes(ptr, n);
         ptr += n;
         length -= n;
@@ -124,7 +122,7 @@ namespace rdr {
 
     // length() returns the length of the stream.
 
-    virtual int length() = 0;
+    virtual size_t length() = 0;
 
     // flush() requests that the stream be flushed.
 
@@ -141,11 +139,9 @@ namespace rdr {
   private:
 
     // overrun() is implemented by a derived class to cope with buffer overrun.
-    // It ensures there are at least itemSize bytes of buffer space.  Returns
-    // the number of items which fit (up to a maximum of nItems).  itemSize is
-    // supposed to be "small" (a few bytes).
+    // It ensures there are at least needed bytes of buffer space.
 
-    virtual int overrun(int itemSize, int nItems) = 0;
+    virtual void overrun(size_t needed) = 0;
 
   protected: