Merge pull request #35 from kasmtech/deb-installation-instructions-readme [skip CI]

Deb installation instructions readme

.ci/detect_os_arch_package_format

@@ -0,0 +1,20 @@
+#!/usr/bin/ruby
+
+package_name = ARGV.first
+
+DEB_PACKAGE_REGEX = %r!(?<os>[^/]+)/kasmvncserver_.+?_(?<arch>.+?).(?<format>deb)!
+RPM_PACKAGE_REGEX = %r!(?<os>[^/]+)/kasmvncserver-.+?\.(?<arch>[^.]+).(?<format>rpm)!
+
+if matches = package_name.match(DEB_PACKAGE_REGEX)
+else matches = package_name.match(RPM_PACKAGE_REGEX)
+end
+
+os = matches["os"]
+arch = matches["arch"]
+package_format = matches["format"]
+
+puts <<-EXPORT
+  export PACKAGE_OS=#{os}
+  export OS_ARCH=#{arch}
+  export PACKAGE_FORMAT=#{package_format}
+EXPORT

.ci/next_release_version

@@ -0,0 +1,25 @@
+#!/bin/bash
+
+set -e
+
+version_from_tags() {
+  git tag | sort -r | head -1 | sed -e 's/^v//' -e 's/\-.\+//' | awk -F. -v OFS=. 'NF==1{print ++$NF}; NF>1{if(length($NF+1)>length($NF))$(NF-1)++; $NF=sprintf("%0*d", length($NF), ($NF+1)%(10^length($NF))); print}'
+}
+
+branch_name="$1"
+if [ -z "$branch_name" ]; then
+  echo >&2 "Usage: `basename $0` <branch_name>"
+  exit 1
+fi
+
+if echo "$branch_name" | grep -Pq '^release/([\d.]+)$'; then
+  RELEASE_BRANCH=1
+fi
+
+if [ -n "$RELEASE_BRANCH" ]; then
+  RELEASE_VERSION=$(echo "$branch_name" | sed 's!release/!!');
+else
+  RELEASE_VERSION="$(version_from_tags)"
+fi
+
+echo "$RELEASE_VERSION"

.ci/upload.sh

@@ -0,0 +1,40 @@
+#!/bin/bash
+
+function prepare_upload_filename() {
+  local package="$1";
+
+  .ci/detect_os_arch_package_format "$package" > /tmp/os_arch_package_format;
+  source /tmp/os_arch_package_format;
+  detect_release_branch
+  if [ -n "$RELEASE_BRANCH" ]; then
+    export upload_filename="kasmvncserver_${PACKAGE_OS}_${RELEASE_VERSION}_${OS_ARCH}.${PACKAGE_FORMAT}";
+  else
+    export SANITIZED_BRANCH="$(echo $CI_COMMIT_REF_NAME | sed 's/\//_/g')";
+    export upload_filename="kasmvncserver_${PACKAGE_OS}_${RELEASE_VERSION}_${SANITIZED_BRANCH}_${CI_COMMIT_SHA:0:6}_${OS_ARCH}.${PACKAGE_FORMAT}";
+  fi
+};
+
+function upload_to_s3() {
+  local package="$1";
+  local upload_filename="$2";
+
+  # Transfer to S3
+  python3 amazon-s3-bitbucket-pipelines-python/s3_upload.py "${S3_BUCKET}" "$package" "${S3_BUILD_DIRECTORY}/${upload_filename}";
+  # Use the Gitlab API to tell Gitlab where the artifact was stored
+  export S3_URL="https://${S3_BUCKET}.s3.amazonaws.com/${S3_BUILD_DIRECTORY}/${upload_filename}";
+  export BUILD_STATUS="{\"key\":\"doc\", \"state\":\"SUCCESSFUL\", \"name\":\"${upload_filename}\", \"url\":\"${S3_URL}\"}";
+  curl --request POST --header "PRIVATE-TOKEN:${GITLAB_API_TOKEN}" "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/statuses/${CI_COMMIT_SHA}?state=success&name=build-url&target_url=${S3_URL}";
+};
+function prepare_to_run_scripts_and_s3_uploads() {
+  export DEBIAN_FRONTEND=noninteractive;
+  apt-get update;
+  apt-get install -y ruby2.7 git;
+  apt-get install -y python3 python3-pip python3-boto3 curl pkg-config libxmlsec1-dev;
+  git clone https://bitbucket.org/awslabs/amazon-s3-bitbucket-pipelines-python.git;
+};
+
+detect_release_branch() {
+  if echo $CI_COMMIT_REF_NAME | grep -Pq '^release/([\d.]+)$'; then
+    export RELEASE_BRANCH=1;
+  fi
+}

.dockerignore

@@ -0,0 +1 @@
+builder/build

.gitignore

@@ -11,3 +11,13 @@ CMakeCache.txt
 Makefile
 Makefile.in
 config.h
+
+builder/build/
+builder/www/
+
+# Deb building artefacts
+debian/.debhelper/
+debian/files
+debian/kasmvncserver.substvars
+debian/kasmvncserver/
+.pc

.gitlab-ci.yml

@@ -0,0 +1,110 @@
+image: docker
+services:
+  - docker:dind
+
+variables:
+  GITLAB_SHARED_DIND_DIR: /builds/$CI_PROJECT_PATH/shared
+  GIT_FETCH_EXTRA_FLAGS: --tags
+
+stages:
+  - build
+  - upload
+
+.prepare_build: &prepare_build
+  - ls -l
+  - pwd
+  - apk add bash
+  - mkdir -p "$GITLAB_SHARED_DIND_DIR" && chmod 777 "$GITLAB_SHARED_DIND_DIR"
+
+.prepare_artfacts: &prepare_artfacts
+  - mkdir output
+  - cp -r builder/build/* output/
+  - rm output/*.tar.gz
+
+build_ubuntu_bionic:
+  stage: build
+  before_script:
+    - *prepare_build
+  after_script:
+    - *prepare_artfacts
+  script:
+    - bash builder/build-package ubuntu bionic
+  artifacts:
+    paths:
+      - output/
+
+build_ubuntu_focal:
+  stage: build
+  before_script:
+    - *prepare_build
+  after_script:
+    - *prepare_artfacts
+  script:
+    - bash builder/build-package ubuntu focal;
+  artifacts:
+    paths:
+      - output/
+
+build_debian_buster:
+  stage: build
+  before_script:
+    - *prepare_build
+  after_script:
+    - *prepare_artfacts
+  script:
+    - bash builder/build-package debian buster;
+  artifacts:
+    paths:
+      - output/
+
+build_debian_bullseye:
+  stage: build
+  before_script:
+    - *prepare_build
+  after_script:
+    - *prepare_artfacts
+  script:
+    - bash builder/build-package debian bullseye;
+  artifacts:
+    paths:
+      - output/
+
+build_kali_rolling:
+  stage: build
+  before_script:
+    - *prepare_build
+  after_script:
+    - *prepare_artfacts
+  script:
+    - bash builder/build-package kali kali-rolling;
+  artifacts:
+    paths:
+      - output/
+
+build_centos7:
+  stage: build
+  before_script:
+    - *prepare_build
+  after_script:
+    - *prepare_artfacts
+  script:
+    - bash builder/build-package centos core
+  artifacts:
+    paths:
+      - output/
+
+upload:
+  stage: upload
+  image: ubuntu:focal
+  before_script:
+    - . .ci/upload.sh
+  script:
+    - export S3_BUILD_DIRECTORY="kasmvnc/${CI_COMMIT_SHA}"
+    - prepare_to_run_scripts_and_s3_uploads
+    - export RELEASE_VERSION=$(.ci/next_release_version "$CI_COMMIT_REF_NAME")
+    - for package in `find output/ -type f -name 'kasmvncserver_*.deb' -or -name '*.rpm'`; do
+        prepare_upload_filename "$package";
+        echo;
+        echo "File to upload $upload_filename";
+        upload_to_s3 "$package" "$upload_filename";
+      done

ACKNOWLEDGEMENTS.md

@@ -0,0 +1,108 @@
+### License & Legal
+
+Incomplete and generally out of date copyright list::
+
+        Copyright (C) 2020 Kasm Technologies LLC
+        Copyright (C) 1999 AT&T Laboratories Cambridge
+        Copyright (C) 2002-2005 RealVNC Ltd.
+        Copyright (C) 2000-2006 TightVNC Group
+        Copyright (C) 2005-2006 Martin Koegler
+        Copyright (C) 2005-2006 Sun Microsystems, Inc.
+        Copyright (C) 2006 OCCAM Financial Technology
+        Copyright (C) 2000-2008 Constantin Kaplinsky
+        Copyright (C) 2004-2017 Peter Astrand for Cendio AB
+        Copyright (C) 2010 Antoine Martin
+        Copyright (C) 2010 m-privacy GmbH
+        Copyright (C) 2009-2011 D. R. Commander
+        Copyright (C) 2009-2011 Pierre Ossman for Cendio AB
+        Copyright (C) 2004, 2009-2011 Red Hat, Inc.
+        Copyright (C) 2009-2018 TigerVNC Team
+        All Rights Reserved.
+
+This software is distributed under the GNU General Public Licence as published
+by the Free Software Foundation.  See the file LICENCE.TXT for the conditions
+under which this software is made available.  KasmVNC also contains code from
+other sources.  See the Acknowledgements section below, and the individual
+source files, for details of the conditions under which they are made
+available.
+
+
+### Acknowledgements
+This distribution contains zlib compression software.  This is:
+
+  Copyright (C) 1995-2002 Jean-loup Gailly and Mark Adler
+
+  This software is provided 'as-is', without any express or implied
+  warranty.  In no event will the authors be held liable for any damages
+  arising from the use of this software.
+
+  Permission is granted to anyone to use this software for any purpose,
+  including commercial applications, and to alter it and redistribute it
+  freely, subject to the following restrictions:
+
+  1. The origin of this software must not be misrepresented; you must not
+     claim that you wrote the original software. If you use this software
+     in a product, an acknowledgment in the product documentation would be
+     appreciated but is not required.
+  2. Altered source versions must be plainly marked as such, and must not be
+     misrepresented as being the original software.
+  3. This notice may not be removed or altered from any source distribution.
+
+  Jean-loup Gailly        Mark Adler
+  jloup@gzip.org          madler@alumni.caltech.edu
+
+  The data format used by the zlib library is described by RFCs (Request for
+  Comments) 1950 to 1952 in the files ftp://ds.internic.net/rfc/rfc1950.txt
+  (zlib format), rfc1951.txt (deflate format) and rfc1952.txt (gzip format).
+
+
+This distribution contains public domain DES software by Richard Outerbridge.
+This is:
+
+Copyright (c) 1988,1989,1990,1991,1992 by Richard Outerbridge.
+(GEnie : OUTER; CIS : [71755,204]) Graven Imagery, 1992.
+
+
+This distribution contains software from the X Window System.  This is:
+
+ Copyright 1987, 1988, 1998  The Open Group
+
+ Permission to use, copy, modify, distribute, and sell this software and its
+ documentation for any purpose is hereby granted without fee, provided that
+ the above copyright notice appear in all copies and that both that
+ copyright notice and this permission notice appear in supporting
+ documentation.
+
+ The above copyright notice and this permission notice shall be included in
+ all copies or substantial portions of the Software.
+
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
+ OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+ Except as contained in this notice, the name of The Open Group shall not be
+ used in advertising or otherwise to promote the sale, use or other dealings
+ in this Software without prior written authorization from The Open Group.
+
+
+ Copyright 1987, 1988 by Digital Equipment Corporation, Maynard, Massachusetts.
+ All Rights Reserved
+
+ Permission to use, copy, modify, and distribute this software and its
+ documentation for any purpose and without fee is hereby granted,
+ provided that the above copyright notice appear in all copies and that
+ both that copyright notice and this permission notice appear in
+ supporting documentation, and that the name of Digital not be
+ used in advertising or publicity pertaining to distribution of the
+ software without specific, written prior permission.
+
+ DIGITAL DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING
+ ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL
+ DIGITAL BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR
+ ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
+ WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
+ ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ SOFTWARE.

LICENCE.TXT

@@ -1,340 +0,0 @@
-		    GNU GENERAL PUBLIC LICENSE
-		       Version 2, June 1991
-
-	  Copyright (C) 1989, 1991 Free Software Foundation, Inc.
-	 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
-			    Preamble
-
-  The licenses for most software are designed to take away your
-freedom to share and change it.  By contrast, the GNU General Public
-License is intended to guarantee your freedom to share and change free
-software--to make sure the software is free for all its users.  This
-General Public License applies to most of the Free Software
-Foundation's software and to any other program whose authors commit to
-using it.  (Some other Free Software Foundation software is covered by
-the GNU Library General Public License instead.)  You can apply it to
-your programs, too.
-
-  When we speak of free software, we are referring to freedom, not
-price.  Our General Public Licenses are designed to make sure that you
-have the freedom to distribute copies of free software (and charge for
-this service if you wish), that you receive source code or can get it
-if you want it, that you can change the software or use pieces of it
-in new free programs; and that you know you can do these things.
-
-  To protect your rights, we need to make restrictions that forbid
-anyone to deny you these rights or to ask you to surrender the rights.
-These restrictions translate to certain responsibilities for you if you
-distribute copies of the software, or if you modify it.
-
-  For example, if you distribute copies of such a program, whether
-gratis or for a fee, you must give the recipients all the rights that
-you have.  You must make sure that they, too, receive or can get the
-source code.  And you must show them these terms so they know their
-rights.
-
-  We protect your rights with two steps: (1) copyright the software, and
-(2) offer you this license which gives you legal permission to copy,
-distribute and/or modify the software.
-
-  Also, for each author's protection and ours, we want to make certain
-that everyone understands that there is no warranty for this free
-software.  If the software is modified by someone else and passed on, we
-want its recipients to know that what they have is not the original, so
-that any problems introduced by others will not reflect on the original
-authors' reputations.
-
-  Finally, any free program is threatened constantly by software
-patents.  We wish to avoid the danger that redistributors of a free
-program will individually obtain patent licenses, in effect making the
-program proprietary.  To prevent this, we have made it clear that any
-patent must be licensed for everyone's free use or not licensed at all.
-
-  The precise terms and conditions for copying, distribution and
-modification follow.
-
-		    GNU GENERAL PUBLIC LICENSE
-   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
-
-  0. This License applies to any program or other work which contains
-a notice placed by the copyright holder saying it may be distributed
-under the terms of this General Public License.  The "Program", below,
-refers to any such program or work, and a "work based on the Program"
-means either the Program or any derivative work under copyright law:
-that is to say, a work containing the Program or a portion of it,
-either verbatim or with modifications and/or translated into another
-language.  (Hereinafter, translation is included without limitation in
-the term "modification".)  Each licensee is addressed as "you".
-
-Activities other than copying, distribution and modification are not
-covered by this License; they are outside its scope.  The act of
-running the Program is not restricted, and the output from the Program
-is covered only if its contents constitute a work based on the
-Program (independent of having been made by running the Program).
-Whether that is true depends on what the Program does.
-
-  1. You may copy and distribute verbatim copies of the Program's
-source code as you receive it, in any medium, provided that you
-conspicuously and appropriately publish on each copy an appropriate
-copyright notice and disclaimer of warranty; keep intact all the
-notices that refer to this License and to the absence of any warranty;
-and give any other recipients of the Program a copy of this License
-along with the Program.
-
-You may charge a fee for the physical act of transferring a copy, and
-you may at your option offer warranty protection in exchange for a fee.
-
-  2. You may modify your copy or copies of the Program or any portion
-of it, thus forming a work based on the Program, and copy and
-distribute such modifications or work under the terms of Section 1
-above, provided that you also meet all of these conditions:
-
-    a) You must cause the modified files to carry prominent notices
-    stating that you changed the files and the date of any change.
-
-    b) You must cause any work that you distribute or publish, that in
-    whole or in part contains or is derived from the Program or any
-    part thereof, to be licensed as a whole at no charge to all third
-    parties under the terms of this License.
-
-    c) If the modified program normally reads commands interactively
-    when run, you must cause it, when started running for such
-    interactive use in the most ordinary way, to print or display an
-    announcement including an appropriate copyright notice and a
-    notice that there is no warranty (or else, saying that you provide
-    a warranty) and that users may redistribute the program under
-    these conditions, and telling the user how to view a copy of this
-    License.  (Exception: if the Program itself is interactive but
-    does not normally print such an announcement, your work based on
-    the Program is not required to print an announcement.)
-
-These requirements apply to the modified work as a whole.  If
-identifiable sections of that work are not derived from the Program,
-and can be reasonably considered independent and separate works in
-themselves, then this License, and its terms, do not apply to those
-sections when you distribute them as separate works.  But when you
-distribute the same sections as part of a whole which is a work based
-on the Program, the distribution of the whole must be on the terms of
-this License, whose permissions for other licensees extend to the
-entire whole, and thus to each and every part regardless of who wrote it.
-
-Thus, it is not the intent of this section to claim rights or contest
-your rights to work written entirely by you; rather, the intent is to
-exercise the right to control the distribution of derivative or
-collective works based on the Program.
-
-In addition, mere aggregation of another work not based on the Program
-with the Program (or with a work based on the Program) on a volume of
-a storage or distribution medium does not bring the other work under
-the scope of this License.
-
-  3. You may copy and distribute the Program (or a work based on it,
-under Section 2) in object code or executable form under the terms of
-Sections 1 and 2 above provided that you also do one of the following:
-
-    a) Accompany it with the complete corresponding machine-readable
-    source code, which must be distributed under the terms of Sections
-    1 and 2 above on a medium customarily used for software interchange; or,
-
-    b) Accompany it with a written offer, valid for at least three
-    years, to give any third party, for a charge no more than your
-    cost of physically performing source distribution, a complete
-    machine-readable copy of the corresponding source code, to be
-    distributed under the terms of Sections 1 and 2 above on a medium
-    customarily used for software interchange; or,
-
-    c) Accompany it with the information you received as to the offer
-    to distribute corresponding source code.  (This alternative is
-    allowed only for noncommercial distribution and only if you
-    received the program in object code or executable form with such
-    an offer, in accord with Subsection b above.)
-
-The source code for a work means the preferred form of the work for
-making modifications to it.  For an executable work, complete source
-code means all the source code for all modules it contains, plus any
-associated interface definition files, plus the scripts used to
-control compilation and installation of the executable.  However, as a
-special exception, the source code distributed need not include
-anything that is normally distributed (in either source or binary
-form) with the major components (compiler, kernel, and so on) of the
-operating system on which the executable runs, unless that component
-itself accompanies the executable.
-
-If distribution of executable or object code is made by offering
-access to copy from a designated place, then offering equivalent
-access to copy the source code from the same place counts as
-distribution of the source code, even though third parties are not
-compelled to copy the source along with the object code.
-
-  4. You may not copy, modify, sublicense, or distribute the Program
-except as expressly provided under this License.  Any attempt
-otherwise to copy, modify, sublicense or distribute the Program is
-void, and will automatically terminate your rights under this License.
-However, parties who have received copies, or rights, from you under
-this License will not have their licenses terminated so long as such
-parties remain in full compliance.
-
-  5. You are not required to accept this License, since you have not
-signed it.  However, nothing else grants you permission to modify or
-distribute the Program or its derivative works.  These actions are
-prohibited by law if you do not accept this License.  Therefore, by
-modifying or distributing the Program (or any work based on the
-Program), you indicate your acceptance of this License to do so, and
-all its terms and conditions for copying, distributing or modifying
-the Program or works based on it.
-
-  6. Each time you redistribute the Program (or any work based on the
-Program), the recipient automatically receives a license from the
-original licensor to copy, distribute or modify the Program subject to
-these terms and conditions.  You may not impose any further
-restrictions on the recipients' exercise of the rights granted herein.
-You are not responsible for enforcing compliance by third parties to
-this License.
-
-  7. If, as a consequence of a court judgment or allegation of patent
-infringement or for any other reason (not limited to patent issues),
-conditions are imposed on you (whether by court order, agreement or
-otherwise) that contradict the conditions of this License, they do not
-excuse you from the conditions of this License.  If you cannot
-distribute so as to satisfy simultaneously your obligations under this
-License and any other pertinent obligations, then as a consequence you
-may not distribute the Program at all.  For example, if a patent
-license would not permit royalty-free redistribution of the Program by
-all those who receive copies directly or indirectly through you, then
-the only way you could satisfy both it and this License would be to
-refrain entirely from distribution of the Program.
-
-If any portion of this section is held invalid or unenforceable under
-any particular circumstance, the balance of the section is intended to
-apply and the section as a whole is intended to apply in other
-circumstances.
-
-It is not the purpose of this section to induce you to infringe any
-patents or other property right claims or to contest validity of any
-such claims; this section has the sole purpose of protecting the
-integrity of the free software distribution system, which is
-implemented by public license practices.  Many people have made
-generous contributions to the wide range of software distributed
-through that system in reliance on consistent application of that
-system; it is up to the author/donor to decide if he or she is willing
-to distribute software through any other system and a licensee cannot
-impose that choice.
-
-This section is intended to make thoroughly clear what is believed to
-be a consequence of the rest of this License.
-
-  8. If the distribution and/or use of the Program is restricted in
-certain countries either by patents or by copyrighted interfaces, the
-original copyright holder who places the Program under this License
-may add an explicit geographical distribution limitation excluding
-those countries, so that distribution is permitted only in or among
-countries not thus excluded.  In such case, this License incorporates
-the limitation as if written in the body of this License.
-
-  9. The Free Software Foundation may publish revised and/or new versions
-of the General Public License from time to time.  Such new versions will
-be similar in spirit to the present version, but may differ in detail to
-address new problems or concerns.
-
-Each version is given a distinguishing version number.  If the Program
-specifies a version number of this License which applies to it and "any
-later version", you have the option of following the terms and conditions
-either of that version or of any later version published by the Free
-Software Foundation.  If the Program does not specify a version number of
-this License, you may choose any version ever published by the Free Software
-Foundation.
-
-  10. If you wish to incorporate parts of the Program into other free
-programs whose distribution conditions are different, write to the author
-to ask for permission.  For software which is copyrighted by the Free
-Software Foundation, write to the Free Software Foundation; we sometimes
-make exceptions for this.  Our decision will be guided by the two goals
-of preserving the free status of all derivatives of our free software and
-of promoting the sharing and reuse of software generally.
-
-			    NO WARRANTY
-
-  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
-FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
-OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
-PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
-OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
-TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
-PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
-REPAIR OR CORRECTION.
-
-  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
-REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
-INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
-OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
-TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
-YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
-PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
-POSSIBILITY OF SUCH DAMAGES.
-
-		     END OF TERMS AND CONDITIONS
-
-	Appendix: How to Apply These Terms to Your New Programs
-
-  If you develop a new program, and you want it to be of the greatest
-possible use to the public, the best way to achieve this is to make it
-free software which everyone can redistribute and change under these terms.
-
-  To do so, attach the following notices to the program.  It is safest
-to attach them to the start of each source file to most effectively
-convey the exclusion of warranty; and each file should have at least
-the "copyright" line and a pointer to where the full notice is found.
-
-    <one line to give the program's name and a brief idea of what it does.>
-    Copyright (C) 19yy  <name of author>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307,
-    USA.
-
-Also add information on how to contact you by electronic and paper mail.
-
-If the program is interactive, make it output a short notice like this
-when it starts in an interactive mode:
-
-    Gnomovision version 69, Copyright (C) 19yy name of author
-    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
-    This is free software, and you are welcome to redistribute it
-    under certain conditions; type `show c' for details.
-
-The hypothetical commands `show w' and `show c' should show the appropriate
-parts of the General Public License.  Of course, the commands you use may
-be called something other than `show w' and `show c'; they could even be
-mouse-clicks or menu items--whatever suits your program.
-
-You should also get your employer (if you work as a programmer) or your
-school, if any, to sign a "copyright disclaimer" for the program, if
-necessary.  Here is a sample; alter the names:
-
-  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
-  `Gnomovision' (which makes passes at compilers) written by James Hacker.
-
-  <signature of Ty Coon>, 1 April 1989
-  Ty Coon, President of Vice
-
-This General Public License does not permit incorporating your program into
-proprietary programs.  If your program is a subroutine library, you may
-consider it more useful to permit linking proprietary applications with the
-library.  If this is what you want to do, use the GNU Library General
-Public License instead of this License.

README.md

@@ -13,59 +13,73 @@
   - Webp image compression for better bandwidth usage
   - Automatic mixing of webp and jpeg based on CPU availability on server
   - Multi-threaded image encoding for smoother frame rate for servers with more cores
-  - Full screen video detection, goes into configurable video mode for better full screen videoo playback performance.
-  - Dynamic jpeg/webp image coompression quality settings based on screen change rates
-  - Seemless clipboard support
+  - [Full screen video detection](https://github.com/kasmtech/KasmVNC/wiki/Video-Rendering-Options#video-mode), goes into configurable video mode for better full screen videoo playback performance.
+  - [Dynamic jpeg/webp image coompression](https://github.com/kasmtech/KasmVNC/wiki/Video-Rendering-Options#dynamic-image-quality) quality settings based on screen change rates
+  - Seemless clipboard support (on Chromium based browsers)
   - Allow client to set/change most configuration settings
-  - Data Loss Prevention features
+  - [Data Loss Prevention features](https://github.com/kasmtech/KasmVNC/wiki/Data-Loss-Prevention)
     - Key stroke logging
     - Clipboard logging
     - Max clipboard transfer size up and down
     - Min time between clipboard operations required
     - Keyboard input rate limit
-
+    - Screen region selection
+  - Deb packages for Debian, Ubuntu, and Kali Linux included in release.
+  - RPM packages for CentOS, Fedora. RPM packages are currently not updatable and not released, though you can build and install them. See build documentation.
+  - Web [API](https://github.com/kasmtech/KasmVNC/wiki/API) added for remotely controlling and getting information from KasmVNC
+  - Multi-User with ability to pass control to other users.
+  - Web UI uses a webpack for faster load times.
+  - Network and CPU bottleneck statistics
 
 
 Future Goals:
 
   - Support uploads and downloads
   - Pre-build Packages for all major Linux distributions
-  - CI pipelines to create releases
 
 ### Installation
-We are currently developing releasable packages for major operating sytems. The install script available with releases will install dependencies, compile webp, and pull down and install the pre-compiled KasmVNC tarball. Currently, only Ubuntu 18.04 LTS is pre-compiled.
 
-This installer assumes you already have a desktop environment installed, but have never configured a VNC server. Use the install script found in this project under builder/install/install.sh, currently Ubuntu 18.04LTS is the only operating system with pre-compiled binaries.
+#### Debian-based
 
 ```sh
-# install dependencies
-sudo apt-get -y install libjpeg-dev
+wget -qO- https://github.com/kasmtech/KasmVNC/releases/download/v0.9.1-beta/kasmvncserver_0.9.1~beta-1_amd64.deb
 
-# install KasmVNC
-wget https://github.com/kasmtech/KasmVNC/releases/download/v0.9.1-beta/KasmVNC_0.9.1-beta_Ubuntu_18.04.tar.gz | sudo tar xz --strip 1 -C /
+sudo dpkg -i kasmvncserver_0.9.1~beta-1_amd64.deb
+sudo apt-get -f install
 
-# Generate an SSL Cert and change owner
-sudo openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout /usr/local/share/kasmvnc/certs/self.pem -out /usr/local/share/kasmvnc/certs/self.pem -subj "/C=US/ST=VA/L=None/O=None/OU=DoFu/CN=kasm/emailAddress=none@none.none"
-sudo chown $USER /usr/local/share/kasmvnc/certs/self.pem
+# We provide an example script to run KasmVNC at #
+# /usr/share/doc/kasmvncserver/examples/kasmvncserver-easy-start. It runs a VNC
+# server on display :10 and on interface 0.0.0.0. If you're happy with those
+# defaults you can just use it as is:
+sudo ln -s /usr/share/doc/kasmvncserver/examples/kasmvncserver-easy-start /usr/bin/
 
-# start kasmvnc and set password for remote access
-vncserver :1 -interface 0.0.0.0
-# stop kasmvnc to make config changes
-vncserver -kill :1
+# Add your user to the ssl-cert group
+sudo addgroup $USER ssl-cert
+# You will need to re-connect in order to pick up the group change
 
-# modify vncstartup to launch your environment of choice, in this example LXDE
+# Create ~/.vnc directory and corresponding files.
+kasmvncserver-easy-start -d && kasmvncserver-easy-start -kill
+
+# Modify vncstartup to launch your environment of choice, in this example LXDE
+# This may be optional depending on your system configuration
 echo '/usr/bin/lxsession -s LXDE &' >> ~/.vnc/xstartup
 
-# The KasmVNC username is automatically set to your system username, you can mofify it if you wish
-vi ~/.vnc/config
+# Start KasmVNC with debug logging:
+kasmvncserver-easy-start -d
 
-# launch KasmVNC
-vncserver $DISPLAY -depth 24 -geometry 1280x1050 -websocketPort 8443 -cert /usr/local/share/kasmvnc/certs/self.pem -sslOnly -FrameRate=24 -interface 0.0.0.0
+# Tail the logs
+tail -f ~/.vnc/`hostname`:10.log
 ```
 
-Now navigate to your system at https://[ip-address]:8443/vnc.html
+Now navigate to your system at https://[ip-address]:8443/
 
-The options for vncserver in the example above:
+To stop a running KasmVNC:
+
+```sh
+kasmvncserver-easy-start -kill
+```
+
+The options for vncserver:
 
 | Argument | Description |
 | -------- | ----------- |
@@ -84,112 +98,7 @@ We need help, especially in packaging KasmVNC for various operating systems. We
 We also need help with Windows, which is not currently supported. While KasmVNC can technically be built for Windows 10, it is unusably slow, due to all the changes that occured in Windows since the original Windows support was added in the chain of VNC forked projects.
 
 ### Compiling From Source
-See the builder/README.md. We containerize our build systems to ensure highly repeatable builds. 
+See the [builder/README.md](https://github.com/kasmtech/KasmVNC/blob/master/builder/README.md). We containerize our build systems to ensure highly repeatable builds.
 
-License & Legal
-----
-Incomplete and generally out of date copyright list::
-
-        Copyright (C) 2020 Kasm Technologies LLC
-        Copyright (C) 1999 AT&T Laboratories Cambridge
-        Copyright (C) 2002-2005 RealVNC Ltd.
-        Copyright (C) 2000-2006 TightVNC Group
-        Copyright (C) 2005-2006 Martin Koegler
-        Copyright (C) 2005-2006 Sun Microsystems, Inc.
-        Copyright (C) 2006 OCCAM Financial Technology
-        Copyright (C) 2000-2008 Constantin Kaplinsky
-        Copyright (C) 2004-2017 Peter Astrand for Cendio AB
-        Copyright (C) 2010 Antoine Martin
-        Copyright (C) 2010 m-privacy GmbH
-        Copyright (C) 2009-2011 D. R. Commander
-        Copyright (C) 2009-2011 Pierre Ossman for Cendio AB
-        Copyright (C) 2004, 2009-2011 Red Hat, Inc.
-        Copyright (C) 2009-2018 TigerVNC Team
-        All Rights Reserved.
-
-This software is distributed under the GNU General Public Licence as published
-by the Free Software Foundation.  See the file LICENCE.TXT for the conditions
-under which this software is made available.  KasmVNC also contains code from
-other sources.  See the Acknowledgements section below, and the individual
-source files, for details of the conditions under which they are made
-available.
-
-### Acknoledgements
-This distribution contains zlib compression software.  This is:
-
-  Copyright (C) 1995-2002 Jean-loup Gailly and Mark Adler
-
-  This software is provided 'as-is', without any express or implied
-  warranty.  In no event will the authors be held liable for any damages
-  arising from the use of this software.
-
-  Permission is granted to anyone to use this software for any purpose,
-  including commercial applications, and to alter it and redistribute it
-  freely, subject to the following restrictions:
-
-  1. The origin of this software must not be misrepresented; you must not
-     claim that you wrote the original software. If you use this software
-     in a product, an acknowledgment in the product documentation would be
-     appreciated but is not required.
-  2. Altered source versions must be plainly marked as such, and must not be
-     misrepresented as being the original software.
-  3. This notice may not be removed or altered from any source distribution.
-
-  Jean-loup Gailly        Mark Adler
-  jloup@gzip.org          madler@alumni.caltech.edu
-
-  The data format used by the zlib library is described by RFCs (Request for
-  Comments) 1950 to 1952 in the files ftp://ds.internic.net/rfc/rfc1950.txt
-  (zlib format), rfc1951.txt (deflate format) and rfc1952.txt (gzip format).
-
-
-This distribution contains public domain DES software by Richard Outerbridge.
-This is:
-
-Copyright (c) 1988,1989,1990,1991,1992 by Richard Outerbridge.
-(GEnie : OUTER; CIS : [71755,204]) Graven Imagery, 1992.
-
-
-This distribution contains software from the X Window System.  This is:
-
- Copyright 1987, 1988, 1998  The Open Group
- 
- Permission to use, copy, modify, distribute, and sell this software and its
- documentation for any purpose is hereby granted without fee, provided that
- the above copyright notice appear in all copies and that both that
- copyright notice and this permission notice appear in supporting
- documentation.
- 
- The above copyright notice and this permission notice shall be included in
- all copies or substantial portions of the Software.
- 
- THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
- OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
- AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
- CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
- 
- Except as contained in this notice, the name of The Open Group shall not be
- used in advertising or otherwise to promote the sale, use or other dealings
- in this Software without prior written authorization from The Open Group.
- 
- 
- Copyright 1987, 1988 by Digital Equipment Corporation, Maynard, Massachusetts.
- All Rights Reserved
- 
- Permission to use, copy, modify, and distribute this software and its 
- documentation for any purpose and without fee is hereby granted, 
- provided that the above copyright notice appear in all copies and that
- both that copyright notice and this permission notice appear in 
- supporting documentation, and that the name of Digital not be
- used in advertising or publicity pertaining to distribution of the
- software without specific, written prior permission.  
- 
- DIGITAL DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING
- ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL
- DIGITAL BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR
- ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
- WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
- ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
- SOFTWARE.
+### License and Acknowledgements
+See the [LICENSE.TXT](https://github.com/kasmtech/KasmVNC/blob/master/LICENCE.TXT) and [ACKNOWLEDGEMENTS.MD](https://github.com/kasmtech/KasmVNC/blob/master/LICENSE.TXT)

bitbucket-pipelines.yml

@@ -1,30 +0,0 @@
-image: ubuntu:xenial
-pipelines:
-  default:
-    - step:
-        name: Build and Package
-        services:
-          - docker
-        script:
-          - export BASE_DIR="$(readlink -f .)"
-          - export RELEASE_VERSION=1.9
-          - export BUILD_FILE="kasmvnc_${RELEASE_VERSION}.${BITBUCKET_COMMIT}.tar.gz"
-          - export S3_BUILD_DIRECTORY="kasmvnc/${BITBUCKET_COMMIT}"
-          - export SANITIZED_BRANCH="$(echo $BITBUCKET_BRANCH | sed 's/\//_/g')"
-          - apt-get update
-          - apt-get install -y git python3 python3-pip python3-boto3 curl
-          - echo $SANITIZED_BRANCH
-          - docker build -t kasmvncbuilder:latest -f builder/dockerfile.build .
-          - docker run -v $BITBUCKET_CLONE_DIR:/build  kasmvncbuilder:latest
-          - ls -la $BITBUCKET_CLONE_DIR
-          - ls -la $BITBUCKET_CLONE_DIR/kasmvnc-Linux-x86_64-*.tar.gz
-          - git clone https://bitbucket.org/awslabs/amazon-s3-bitbucket-pipelines-python.git
-          - python3 amazon-s3-bitbucket-pipelines-python/s3_upload.py "${S3_BUCKET}" $BITBUCKET_CLONE_DIR/kasmvnc-Linux-x86_64-*.tar.gz "${S3_BUILD_DIRECTORY}/${BUILD_FILE}"
-          - export S3_URL="https://${S3_BUCKET}.s3.amazonaws.com/${S3_BUILD_DIRECTORY}/${BUILD_FILE}"
-          - export BUILD_STATUS="{\"key\":\"doc\", \"state\":\"SUCCESSFUL\", \"name\":\"${BUILD_FILE}\", \"url\":\"${S3_URL}\"}"
-          - echo ${BITBUCKET_REPO_OWNER}
-          - echo ${BITBUCKET_REPO_SLUG}
-          - echo ${BITBUCKET_COMMIT}
-          - echo ${BB_AUTH_STRING}
-          - echo ${BUILD_STATUS}
-          - curl -H "Content-Type:application/json" -X POST --user "${BB_AUTH_STRING}" -d "${BUILD_STATUS}" "https://api.bitbucket.org/2.0/repositories/${BITBUCKET_REPO_OWNER}/${BITBUCKET_REPO_SLUG}/commit/${BITBUCKET_COMMIT}/statuses/build"

builder/README.md

@@ -1,22 +1,72 @@
-REQIUREMENTS
+## REQIUREMENTS
 Docker CE
 
-# build the docker image
-    cd /src_code_root
-    sudo docker build -t kasmvncbuilder:18.04 -f builder/dockerfile.build .
+# Build a deb/rpm package
+```
+# builder/build-package <os> <os_codename>
+# os_codename is what "lsb_release -c" outputs, e.g. buster, focal.
+# Packages will be placed under builder/build/
 
-# run the builder
-    sudo docker run -v /tmp:/build --rm  kasmvncbuilder:18.04
+builder/build-package ubuntu bionic
+builder/build-package ubuntu focal
+builder/build-package debian buster
+builder/build-package debian bullseye
+builder/build-package kali kali-rolling
+builder/build-package centos core # CentOS 7
+builder/build-package fedora thirtythree
+```
 
-# tar will be on /tmp of host
-    cp /tmp/kasmvnc*.tar.gz builder/
+# Build and test a package
+```
+builder/build-and-test-deb ubuntu focal
+builder/build-and-test-rpm centos core
+```
 
-# build test desktop container with new binary installed
-    cd builder
-    sudo docker build -t kasmvnctester:18.04 -f dockerfile.test .
-    
-# run an instance of the new destkop
-    sudo docker run -d -p 80:6901 -p 5901:5901 -e VNCOPTIONS="-detectScrolling -PreferBandwidth -DynamicQualityMin=0" kasmvnctester:latest
+Open browser and point to https://localhost:443/ or https://\<ip-address\>:443/
 
-open browser and point to http://IPAddress/vnc_lite.html
-default password is "vncpassword" or use a VNC client
+3 default users are created:
+* 'foo' with default password 'foobar'. It can use mouse and keyboard.
+* 'foo-ro' with default password 'foobar'. It can only view.
+* 'foo-owner' with default password 'foobar'. It can manage other users.
+
+# Test a package
+
+If you want to test deb/rpm package you've already built, please use this:
+```
+builder/test-deb ubuntu focal
+```
+It will install the package inside a new container and run KasmVNC.
+
+Open browser and point to https://localhost:443/ or https://\<ip-address\>:443/
+
+# Package development
+
+## deb/rpm package building and testing
+
+First, a tarball is built, and then its files are copied to deb/rpm package as
+it is being built.
+Package testing stage installs the deb/rpm package in a fresh docker container
+and runs KasmVNC.
+
+```
+builder/build-tarball debian buster
+builder/build-deb debian buster
+builder/test-deb debian buster
+```
+
+Use `build-and-test-deb` to perform the whole dev lifecycle, but to iterate
+quickly, you'll need to skip building the tarball (which takes a long time), and
+just build your deb/rpm with `build-deb` and test with `test-deb`.
+
+`build-rpm` and `test-rpm` are also available.
+
+## Ensuring packages have all dependencies they need.
+
+If you're working on a deb/rpm package, testing that it has all the necessary
+dependencies is done via testing in a barebones environment (read: no XFCE). In
+this way we can be sure that runtime dependencies aren't met accidentally by
+packages installed with XFCE.
+
+```
+builder/test-deb-barebones ubuntu focal
+```

builder/build-and-test-deb

@@ -0,0 +1,16 @@
+#!/bin/bash
+
+set -e
+
+os="$1"
+codename="$2"
+
+if [[ -z "$os" ]] || [[ -z "$codename" ]]; then
+  echo "Usage: $0 <os> <codename>" >&2
+  exit 1
+fi
+
+cd "$(dirname "$0")"
+
+./build-tarball "$os" "$codename" && ./build-deb "$os" "$codename" && \
+  ./test-deb "$os" "$codename"

builder/build-and-test-rpm

@@ -0,0 +1,16 @@
+#!/bin/bash
+
+set -e
+
+os="$1"
+codename="$2"
+
+if [[ -z "$os" ]] || [[ -z "$codename" ]]; then
+  echo "Usage: $0 <os> <codename>" >&2
+  exit 1
+fi
+
+cd "$(dirname "$0")"
+
+./build-tarball "$os" "$codename" && ./build-rpm "$os" "$codename" && \
+  ./test-rpm "$os" "$codename"

builder/build-deb

@@ -0,0 +1,16 @@
+#!/bin/bash
+
+set -e
+
+cd "$(dirname "$0")/.."
+. builder/os_ver_cli.sh
+
+docker build -t debbuilder_${os}:${os_codename} -f \
+  builder/dockerfile.${os}_${os_codename}.deb.build .
+
+deb_output_dir=$(cd .. && echo $PWD)
+L_UID=$(id -u) #Ubuntu already has UID env var, but this should work on all Linix systems
+L_GID=$(id -g)
+docker run --rm -v "$deb_output_dir":/src --user $L_UID:$L_GID \
+  debbuilder_${os}:${os_codename} /bin/bash -c \
+  '/src/*/builder/build-deb-inside-docker'

builder/build-deb-inside-docker

@@ -0,0 +1,14 @@
+#!/bin/bash
+
+set -e
+
+cd "$(dirname "$0")/.."
+
+os=$(lsb_release -is | tr '[:upper:]' '[:lower:]')
+os_codename=$(lsb_release -cs)
+os_dir="builder/build/${os_codename}"
+
+dpkg-buildpackage -us -uc -b
+mkdir -p "$os_dir"
+cp ../*.deb "$os_dir"
+lintian ../*.deb || true

builder/build-package

@@ -0,0 +1,19 @@
+#!/bin/bash
+
+set -e
+
+os="$1"
+codename="$2"
+
+detect_package_format() {
+  package_format=rpm
+  if ls builder/dockerfile*"$os"* | grep -q .deb.build; then
+    package_format=deb
+  fi
+}
+
+cd "$(dirname "$0")/.."
+
+detect_package_format
+builder/build-tarball "$os" "$codename"
+builder/build-${package_format} "$os" "$codename"

builder/build-rpm

@@ -0,0 +1,16 @@
+#!/bin/bash
+
+set -e
+
+cd "$(dirname "$0")/.."
+. builder/os_ver_cli.sh
+
+docker build -t kasmvnc_rpmbuilder_${os}:${os_codename} -f \
+  builder/dockerfile.${os}_${os_codename}.rpm.build .
+
+source_dir=$(echo $PWD)
+L_UID=$(id -u) #Ubuntu already has UID env var, but this should work on all Linix systems
+L_GID=$(id -g)
+docker run --rm -v "$source_dir":/src --user $L_UID:$L_GID \
+  kasmvnc_rpmbuilder_${os}:${os_codename} /bin/bash -c \
+  '/src/builder/build-rpm-inside-docker'

builder/build-rpm-inside-docker

@@ -0,0 +1,30 @@
+#!/bin/bash
+
+set -e
+
+prepare_build_env() {
+  rpmdev-setuptree
+  copy_spec_and_tar_with_binaries
+}
+
+copy_spec_and_tar_with_binaries() {
+  cp /src/centos/kasmvncserver.spec ~/rpmbuild/SPECS/
+  cp /src/builder/build/kasmvnc.${os}_${os_codename}.tar.gz \
+    ~/rpmbuild/SOURCES/
+}
+
+copy_rpm_to_build_dir() {
+  cd /src/builder && \
+    mkdir -p "$os_dir" && cp ~/rpmbuild/RPMS/*/*.rpm ${os_dir}
+}
+
+cd "$(dirname "$0")/.."
+
+os=$(lsb_release -is | tr '[:upper:]' '[:lower:]')
+os_codename=$(lsb_release -cs | tr '[:upper:]' '[:lower:]')
+os_dir="build/${os}_${os_codename}"
+
+prepare_build_env
+rpmbuild -ba ~/rpmbuild/SPECS/kasmvncserver.spec
+copy_rpm_to_build_dir
+rpmlint "$os_dir"/*.rpm || true

builder/build-tarball

@@ -0,0 +1,31 @@
+#!/bin/bash
+
+set -e
+
+build_www_dir() {
+  local webpacked_www=$PWD/builder/www
+  local src_www=kasmweb
+
+  if [ "$src_www" -nt "$webpacked_www" ]; then
+    docker build -t kasmweb/www -f builder/dockerfile.www.build .
+    docker run --rm -v $PWD/builder/www:/build kasmweb/www:latest
+  fi
+}
+
+shared_with_docker_dir=${GITLAB_SHARED_DIND_DIR:-/tmp}
+
+cd "$(dirname "$0")/.."
+. builder/os_ver_cli.sh
+
+build_www_dir
+
+docker build -t kasmvncbuilder:$os_codename \
+  -f builder/dockerfile.${os}_${os_codename}.build .
+mkdir -p builder/build
+docker run -v $shared_with_docker_dir:/build --rm kasmvncbuilder:$os_codename
+
+L_GID=$(id -g)
+L_UID=$(id -u)
+tarball_name="kasmvnc.${os}_${os_codename}.tar.gz"
+chown $L_UID:$L_GID $shared_with_docker_dir/$tarball_name
+mv $shared_with_docker_dir/$tarball_name $PWD/builder/build/

builder/build.sh

@@ -1,5 +1,12 @@
 #!/bin/sh -e
 
+detect_quilt() {
+  if which quilt 1>/dev/null; then
+    QUILT_PRESENT=1
+    export QUILT_PATCHES=debian/patches
+  fi
+}
+
 # For build-dep to work, the apt sources need to have the source server
 #sudo apt-get build-dep xorg-server
 
@@ -7,7 +14,10 @@
 
 # Ubuntu applies a million patches, but here we use upstream to simplify matters
 cd /tmp
-wget https://www.x.org/archive/individual/xserver/xorg-server-1.19.6.tar.bz2
+# default to the version of x in Ubuntu 18.04, otherwise caller will need to specify
+XORG_VER=${XORG_VER:-"1.19.6"}
+XORG_PATCH=$(echo "$XORG_VER" | grep -Po '^\d.\d+' | sed 's#\.##')
+wget https://www.x.org/archive/individual/xserver/xorg-server-${XORG_VER}.tar.bz2
 
 #git clone https://kasmweb@bitbucket.org/kasmtech/kasmvnc.git
 #cd kasmvnc
@@ -20,13 +30,17 @@ sed -i -e '/find_package(FLTK/s@^@#@' \
 	-e '/add_subdirectory(tests/s@^@#@' \
 	CMakeLists.txt
 
-cmake .
+cmake -D CMAKE_BUILD_TYPE=RelWithDebInfo .
 make -j5
 
-tar -C unix/xserver -xvf /tmp/xorg-server-1.19.6.tar.bz2 --strip-components=1
+tar -C unix/xserver -xvf /tmp/xorg-server-${XORG_VER}.tar.bz2 --strip-components=1
 
 cd unix/xserver
-patch -Np1 -i ../xserver119.patch
+patch -Np1 -i ../xserver${XORG_PATCH}.patch
+if [[ $XORG_VER =~ ^1\.20\..*$ ]]; then
+  patch -Np1 -i ../xserver120.7.patch
+fi
+
 autoreconf -i
 # Configuring Xorg is long and has many distro-specific paths.
 # The distro paths start after prefix and end with the font path,
@@ -53,15 +67,20 @@ ln -s /src/unix/xserver/hw/vnc/Xvnc Xvnc
 cd ..
 mkdir -p man/man1
 touch man/man1/Xserver.1
-touch man/man1/Xvnc.1
+cp /src/unix/xserver/hw/vnc/Xvnc.man man/man1/Xvnc.1
 mkdir lib
 cd lib
-ln -s /usr/lib/x86_64-linux-gnu/dri dri
+if [ -d /usr/lib/x86_64-linux-gnu/dri ]; then
+  ln -s /usr/lib/x86_64-linux-gnu/dri dri
+else
+  ln -s /usr/lib64/dri dri
+fi
 cd /src
-sed  $'s#pushd $TMPDIR/inst#CWD=$(pwd)\\\ncd $TMPDIR/inst#' release/maketarball > release/maketarball2
-sed  $'s#popd#cd $CWD#' release/maketarball2 > release/maketarball3
-mv release/maketarball3 release/maketarball
 
+detect_quilt
+if [ -n "$QUILT_PRESENT" ]; then
+  quilt push -a
+fi
 make servertarball
 
-cp kasmvnc*.tar.gz /build/
+cp kasmvnc*.tar.gz /build/kasmvnc.${KASMVNC_BUILD_OS}_${KASMVNC_BUILD_OS_CODENAME}.tar.gz

builder/build_www.sh

@@ -0,0 +1,19 @@
+#!/bin/bash
+
+# clear previous build
+rm -rf /build/*
+
+# build webpack
+npm run build
+# remove node stuff from directory
+rm -rf node_modules/
+# copy all to build dir
+cp -R ./* /build/
+
+# remove unneccesary files
+cd /build
+rm *.md
+rm AUTHORS
+rm *.yml
+rm vnc.html
+rm vnc_lite.html

builder/dockerfile.centos_core.barebones.rpm.test

@@ -0,0 +1,18 @@
+FROM centos:centos7
+
+RUN yum install -y xterm
+RUN yum install -y vim less
+RUN yum install -y redhat-lsb-core
+
+ARG KASMVNC_PACKAGE_DIR
+COPY $KASMVNC_PACKAGE_DIR/*.rpm /tmp
+RUN yum localinstall -y /tmp/*.rpm
+
+RUN useradd -m foo
+
+USER foo:kasmvnc-cert
+
+RUN mkdir ~/.vnc && echo '/usr/bin/xterm &' >> ~/.vnc/xstartup && \
+  chmod +x ~/.vnc/xstartup
+
+ENTRYPOINT bash -c "echo -e \"$VNC_PW\n$VNC_PW\n\" | kasmvncpasswd -w -u \"$VNC_USER\" && vncserver :1 -interface 0.0.0.0 && vncserver -kill :1 && vncserver :1 -depth 24 -geometry 1280x1050 -websocketPort 8443 -cert /etc/pki/tls/private/kasmvnc.pem -sslOnly -FrameRate=24 -interface 0.0.0.0 -httpd /usr/share/kasmvnc/www && tail -f $HOME/.vnc/*.log "

builder/dockerfile.centos_core.build

@@ -0,0 +1,29 @@
+FROM centos:centos7
+
+ENV KASMVNC_BUILD_OS centos
+ENV KASMVNC_BUILD_OS_CODENAME core
+
+RUN yum install -y build-dep xorg-server libxfont-dev sudo
+RUN yum install -y gcc cmake git libjpeg-dev libgnutls28-dev vim wget tightvncserver
+RUN yum install -y libjpeg-dev libpng-dev libtiff-dev libgif-dev libavcodec-dev openssl-devel
+RUN yum install -y make
+RUN yum group install -y "Development Tools"
+RUN yum install -y xorg-x11-server-devel zlib-devel libjpeg-turbo-devel
+RUN yum install -y libxkbfile-devel libXfont2-devel xorg-x11-font-utils \
+  xorg-x11-xtrans-devel xorg-x11-xkb-utils-devel
+RUN yum install -y mesa-dri-drivers
+
+# Additions for webp
+RUN cd /tmp && wget https://storage.googleapis.com/downloads.webmproject.org/releases/webp/libwebp-1.0.2.tar.gz
+RUN cd /tmp && tar -xzvf /tmp/libwebp-*
+RUN cd /tmp/libwebp-1.0.2 && \
+    ./configure --enable-static --disable-shared && \
+    make && make install
+
+RUN useradd -m docker && echo "docker:docker" | chpasswd
+
+COPY . /src
+RUN chown -R docker:docker /src
+
+USER docker
+ENTRYPOINT ["/src/builder/build.sh"]

builder/dockerfile.centos_core.rpm.build

@@ -0,0 +1,12 @@
+FROM centos:centos7
+
+RUN yum install -y rpm* gpg* rng-tools rpmlint
+RUN yum install -y tree vim less
+RUN yum install -y redhat-lsb-core
+
+COPY centos/*.spec /tmp
+RUN yum-builddep -y /tmp/*.spec
+
+RUN useradd -m docker && echo "docker:docker" | chpasswd
+
+USER docker

builder/dockerfile.centos_core.rpm.test

@@ -0,0 +1,61 @@
+FROM centos:centos7
+
+ENV DISPLAY=:1 \
+    VNC_PORT=8443 \
+    VNC_RESOLUTION=1280x720 \
+    MAX_FRAME_RATE=24 \
+    VNCOPTIONS="-PreferBandwidth -DynamicQualityMin=4 -DynamicQualityMax=7" \
+    HOME=/home/user \
+    TERM=xterm \
+    STARTUPDIR=/dockerstartup \
+    INST_SCRIPTS=/dockerstartup/install \
+    KASM_RX_HOME=/dockerstartup/kasmrx \
+    DEBIAN_FRONTEND=noninteractive \
+    VNC_COL_DEPTH=24 \
+    VNC_RESOLUTION=1280x1024 \
+    VNC_PW=vncpassword \
+    VNC_USER=user \
+    VNC_VIEW_ONLY_PW=vncviewonlypassword \
+    LD_LIBRARY_PATH=/usr/local/lib/ \
+    OMP_WAIT_POLICY=PASSIVE \
+    SHELL=/bin/bash \
+    SINGLE_APPLICATION=0 \
+    KASMVNC_BUILD_OS=centos \
+    KASMVNC_BUILD_OS_CODENAME=core
+
+EXPOSE $VNC_PORT
+
+WORKDIR $HOME
+
+### REQUIRED STUFF ###
+
+RUN yum install -y openssl xterm gettext wget
+RUN yum install -y centos-release-scl-rh && yum install -y nss_wrapper
+RUN yum install -y xorg-x11-server xorg-x11-xauth xorg-x11-xkb-utils \
+  xkeyboard-config xorg-x11-server-utils
+RUN yum install -y epel-release && yum groupinstall xfce -y
+RUN yum erase -y pm-utils xscreensaver*
+RUN yum install -y redhat-lsb-core
+RUN yum install -y vim less
+
+RUN echo 'source $STARTUPDIR/generate_container_user' >> $HOME/.bashrc
+
+RUN mkdir -p $STARTUPDIR
+COPY startup/ $STARTUPDIR
+
+### START CUSTOM STUFF ####
+
+ARG KASMVNC_PACKAGE_DIR
+COPY $KASMVNC_PACKAGE_DIR/*.rpm /tmp
+RUN yum localinstall -y /tmp/*.rpm
+
+### END CUSTOM STUFF ###
+
+RUN chown -R 1000:0 $HOME
+USER 1000:kasmvnc-cert
+WORKDIR $HOME
+
+RUN mkdir ~/.vnc && echo '/usr/bin/xfce4-session &' >> ~/.vnc/xstartup && \
+  chmod +x ~/.vnc/xstartup
+
+ENTRYPOINT [ "/dockerstartup/vnc_startup.sh" ]

builder/dockerfile.debian_bullseye.build

@@ -0,0 +1,31 @@
+FROM debian:bullseye-slim
+
+ENV KASMVNC_BUILD_OS debian
+ENV KASMVNC_BUILD_OS_CODENAME bullseye
+ENV XORG_VER 1.20.10
+ENV DEBIAN_FRONTEND noninteractive
+
+RUN grep '^deb'  /etc/apt/sources.list | sed 's#^deb#deb-src#' >> /etc/apt/sources.list
+
+RUN apt-get update && \
+      apt-get -y install sudo
+
+RUN DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends tzdata
+RUN apt-get update && apt-get -y build-dep xorg-server libxfont-dev
+RUN apt-get update && apt-get -y install cmake git libjpeg-dev libgnutls28-dev vim wget tightvncserver
+RUN apt-get update && apt-get -y install libjpeg-dev libpng-dev libtiff-dev libgif-dev libavcodec-dev libssl-dev
+
+# Additions for webp
+RUN cd /tmp && wget https://storage.googleapis.com/downloads.webmproject.org/releases/webp/libwebp-1.0.2.tar.gz
+RUN cd /tmp && tar -xzvf /tmp/libwebp-*
+RUN cd /tmp/libwebp-1.0.2 && \
+    ./configure --enable-static --disable-shared && \
+    make && make install
+
+RUN useradd -m docker && echo "docker:docker" | chpasswd && adduser docker sudo
+
+COPY . /src
+RUN chown -R docker:docker /src
+
+USER docker
+ENTRYPOINT ["/src/builder/build.sh"]

builder/dockerfile.debian_bullseye.deb.build

@@ -0,0 +1,12 @@
+FROM debian:bullseye
+
+ENV DEBIAN_FRONTEND noninteractive
+
+RUN apt-get update && \
+      apt-get -y install vim build-essential devscripts equivs
+
+# Install build-deps for the package.
+COPY ./debian/control /tmp
+RUN apt-get update && echo YYY | mk-build-deps --install --remove /tmp/control
+
+USER 1000

builder/dockerfile.debian_bullseye.deb.test

@@ -0,0 +1,54 @@
+FROM debian:bullseye-slim
+
+ENV DISPLAY=:1 \
+    VNC_PORT=8443 \
+    VNC_RESOLUTION=1280x720 \
+    MAX_FRAME_RATE=24 \
+    VNCOPTIONS="-PreferBandwidth -DynamicQualityMin=4 -DynamicQualityMax=7" \
+    HOME=/home/user \
+    TERM=xterm \
+    STARTUPDIR=/dockerstartup \
+    INST_SCRIPTS=/dockerstartup/install \
+    KASM_RX_HOME=/dockerstartup/kasmrx \
+    DEBIAN_FRONTEND=noninteractive \
+    VNC_COL_DEPTH=24 \
+    VNC_RESOLUTION=1280x1024 \
+    VNC_PW=vncpassword \
+    VNC_USER=user \
+    VNC_VIEW_ONLY_PW=vncviewonlypassword \
+    LD_LIBRARY_PATH=/usr/local/lib/ \
+    OMP_WAIT_POLICY=PASSIVE \
+    SHELL=/bin/bash \
+    SINGLE_APPLICATION=0 \
+    KASMVNC_BUILD_OS=debian \
+    KASMVNC_BUILD_OS_CODENAME=buster
+
+EXPOSE $VNC_PORT
+
+WORKDIR $HOME
+
+### REQUIRED STUFF ###
+
+RUN apt-get update && apt-get install -y supervisor xfce4 xfce4-terminal dbus-x11 xterm libnss-wrapper gettext wget
+RUN apt-get purge -y pm-utils xscreensaver*
+RUN apt-get update && apt-get install -y vim less
+RUN apt-get update && apt-get -y install lsb-release
+
+RUN echo 'source $STARTUPDIR/generate_container_user' >> $HOME/.bashrc
+
+RUN mkdir -p $STARTUPDIR
+COPY startup/ $STARTUPDIR
+
+### START CUSTOM STUFF ####
+
+ARG KASMVNC_PACKAGE_DIR
+COPY $KASMVNC_PACKAGE_DIR/kasmvncserver_*.deb /tmp
+RUN dpkg -i /tmp/*.deb; apt-get -yf install
+
+### END CUSTOM STUFF ###
+
+RUN chown -R 1000:0 $HOME
+USER 1000:ssl-cert
+WORKDIR $HOME
+
+ENTRYPOINT [ "/dockerstartup/vnc_startup.sh" ]

builder/dockerfile.debian_buster.barebones.deb.test

@@ -0,0 +1,19 @@
+FROM debian:buster-slim
+
+ARG KASMVNC_PACKAGE_DIR
+COPY $KASMVNC_PACKAGE_DIR/kasmvncserver_*.deb /tmp
+RUN apt-get update && dpkg -i /tmp/*.deb; apt-get -yf install
+RUN apt-get update && apt-get -y install xterm
+
+COPY startup/deb/kasmvncserver-easy-start /usr/local/bin
+
+RUN useradd -m foo
+
+USER foo:ssl-cert
+
+RUN mkdir ~/.vnc && echo '/usr/bin/xterm &' >> ~/.vnc/xstartup && \
+  chmod +x ~/.vnc/xstartup
+
+ENTRYPOINT bash -c "echo -e \"$VNC_PW\n$VNC_PW\n\" | \
+  kasmvncpasswd -w -u $VNC_USER $HOME/.kasmpasswd && \
+  kasmvncserver-easy-start && tail -f $HOME/.vnc/*.log"

builder/dockerfile.debian_buster.build

@@ -0,0 +1,31 @@
+FROM debian:buster
+
+ENV KASMVNC_BUILD_OS debian
+ENV KASMVNC_BUILD_OS_CODENAME buster
+ENV XORG_VER 1.20.10
+ENV DEBIAN_FRONTEND noninteractive
+
+RUN grep '^deb'  /etc/apt/sources.list | sed 's#^deb#deb-src#' >> /etc/apt/sources.list
+
+RUN apt-get update && \
+      apt-get -y install sudo
+
+RUN DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends tzdata
+RUN apt-get update && apt-get -y build-dep xorg-server libxfont-dev
+RUN apt-get update && apt-get -y install cmake git libjpeg-dev libgnutls28-dev vim wget tightvncserver
+RUN apt-get update && apt-get -y install libjpeg-dev libpng-dev libtiff-dev libgif-dev libavcodec-dev libssl-dev
+
+# Additions for webp
+RUN cd /tmp && wget https://storage.googleapis.com/downloads.webmproject.org/releases/webp/libwebp-1.0.2.tar.gz
+RUN cd /tmp && tar -xzvf /tmp/libwebp-*
+RUN cd /tmp/libwebp-1.0.2 && \
+    ./configure --enable-static --disable-shared && \
+    make && make install
+
+RUN useradd -m docker && echo "docker:docker" | chpasswd && adduser docker sudo
+
+COPY . /src
+RUN chown -R docker:docker /src
+
+USER docker
+ENTRYPOINT ["/src/builder/build.sh"]

builder/dockerfile.debian_buster.deb.build

@@ -0,0 +1,12 @@
+FROM debian:buster
+
+ENV DEBIAN_FRONTEND noninteractive
+
+RUN apt-get update && \
+      apt-get -y install vim build-essential devscripts equivs
+
+# Install build-deps for the package.
+COPY ./debian/control /tmp
+RUN apt-get update && echo YYY | mk-build-deps --install --remove /tmp/control
+
+USER 1000

builder/dockerfile.debian_buster.deb.test

@@ -0,0 +1,54 @@
+FROM debian:buster-slim
+
+ENV DISPLAY=:1 \
+    VNC_PORT=8443 \
+    VNC_RESOLUTION=1280x720 \
+    MAX_FRAME_RATE=24 \
+    VNCOPTIONS="-PreferBandwidth -DynamicQualityMin=4 -DynamicQualityMax=7" \
+    HOME=/home/user \
+    TERM=xterm \
+    STARTUPDIR=/dockerstartup \
+    INST_SCRIPTS=/dockerstartup/install \
+    KASM_RX_HOME=/dockerstartup/kasmrx \
+    DEBIAN_FRONTEND=noninteractive \
+    VNC_COL_DEPTH=24 \
+    VNC_RESOLUTION=1280x1024 \
+    VNC_PW=vncpassword \
+    VNC_USER=user \
+    VNC_VIEW_ONLY_PW=vncviewonlypassword \
+    LD_LIBRARY_PATH=/usr/local/lib/ \
+    OMP_WAIT_POLICY=PASSIVE \
+    SHELL=/bin/bash \
+    SINGLE_APPLICATION=0 \
+    KASMVNC_BUILD_OS=debian \
+    KASMVNC_BUILD_OS_CODENAME=buster
+
+EXPOSE $VNC_PORT
+
+WORKDIR $HOME
+
+### REQUIRED STUFF ###
+
+RUN apt-get update && apt-get install -y supervisor xfce4 xfce4-terminal xterm libnss-wrapper gettext wget
+RUN apt-get purge -y pm-utils xscreensaver*
+RUN apt-get update && apt-get install -y vim less
+RUN apt-get update && apt-get -y install lsb-release
+
+RUN echo 'source $STARTUPDIR/generate_container_user' >> $HOME/.bashrc
+
+RUN mkdir -p $STARTUPDIR
+COPY startup/ $STARTUPDIR
+
+### START CUSTOM STUFF ####
+
+ARG KASMVNC_PACKAGE_DIR
+COPY $KASMVNC_PACKAGE_DIR/kasmvncserver_*.deb /tmp
+RUN dpkg -i /tmp/*.deb; apt-get -yf install
+
+### END CUSTOM STUFF ###
+
+RUN chown -R 1000:0 $HOME
+USER 1000:ssl-cert
+WORKDIR $HOME
+
+ENTRYPOINT [ "/dockerstartup/vnc_startup.sh" ]

builder/dockerfile.fedora_thirtythree.barebones.rpm.test

@@ -0,0 +1,18 @@
+FROM fedora:33
+
+RUN dnf install -y xterm
+RUN dnf install -y vim less
+RUN yum install -y redhat-lsb-core
+
+ARG KASMVNC_PACKAGE_DIR
+COPY $KASMVNC_PACKAGE_DIR/*.rpm /tmp
+RUN dnf localinstall -y /tmp/*.rpm
+
+RUN useradd -m foo
+
+USER foo:kasmvnc-cert
+
+RUN mkdir ~/.vnc && echo '/usr/bin/xterm &' >> ~/.vnc/xstartup && \
+  chmod +x ~/.vnc/xstartup
+
+ENTRYPOINT bash -c "echo -e \"$VNC_PW\n$VNC_PW\n\" | kasmvncpasswd -w -u \"$VNC_USER\" && vncserver :1 -interface 0.0.0.0 && vncserver -kill :1 && vncserver :1 -depth 24 -geometry 1280x1050 -websocketPort 8443 -cert /etc/pki/tls/private/kasmvnc.pem -sslOnly -FrameRate=24 -interface 0.0.0.0 -httpd /usr/share/kasmvnc/www && tail -f $HOME/.vnc/*.log "

builder/dockerfile.fedora_thirtythree.build

@@ -0,0 +1,38 @@
+FROM fedora:33
+
+ENV KASMVNC_BUILD_OS fedora
+ENV KASMVNC_BUILD_OS_CODENAME thirtythree
+ENV XORG_VER 1.20.10
+
+# RUN dnf install -y build-dep xorg-server libxfont-dev sudo
+RUN dnf install -y gcc cmake git gnutls-devel vim wget
+#tightvncserver
+RUN dnf install -y libjpeg-turbo-devel libpng-devel libtiff-devel giflib-devel openssl-devel
+
+#libavcodec-dev
+RUN dnf -y install https://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm
+RUN dnf -y install https://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm
+RUN dnf -y install ffmpeg-devel
+
+RUN dnf install -y make
+RUN dnf group install -y "Development Tools"
+RUN dnf install -y xorg-x11-server-devel zlib-devel libjpeg-turbo-devel
+RUN dnf install -y libxkbfile-devel libXfont2-devel xorg-x11-font-utils \
+  xorg-x11-xtrans-devel xorg-x11-xkb-utils-devel
+RUN dnf install -y mesa-dri-drivers
+RUN dnf install -y bzip2 redhat-lsb-core
+
+# Additions for webp
+RUN cd /tmp && wget https://storage.googleapis.com/downloads.webmproject.org/releases/webp/libwebp-1.0.2.tar.gz
+RUN cd /tmp && tar -xzvf /tmp/libwebp-*
+RUN cd /tmp/libwebp-1.0.2 && \
+    ./configure --enable-static --disable-shared && \
+    make && make install
+
+RUN useradd -m docker && echo "docker:docker" | chpasswd
+
+COPY . /src
+RUN chown -R docker:docker /src
+
+USER docker
+ENTRYPOINT ["/src/builder/build.sh"]

builder/dockerfile.fedora_thirtythree.rpm.build

@@ -0,0 +1,13 @@
+FROM fedora:33
+
+RUN dnf install -y fedora-packager fedora-review
+RUN dnf install -y tree vim less
+RUN dnf install -y redhat-lsb-core
+RUN dnf install -y dnf-plugins-core
+
+COPY centos/*.spec /tmp
+RUN dnf builddep -y /tmp/*.spec
+
+RUN useradd -m docker && echo "docker:docker" | chpasswd
+
+USER docker

builder/dockerfile.fedora_thirtythree.rpm.test

@@ -0,0 +1,64 @@
+FROM fedora:33
+
+ENV DISPLAY=:1 \
+    VNC_PORT=8443 \
+    VNC_RESOLUTION=1280x720 \
+    MAX_FRAME_RATE=24 \
+    VNCOPTIONS="-PreferBandwidth -DynamicQualityMin=4 -DynamicQualityMax=7" \
+    HOME=/home/user \
+    TERM=xterm \
+    STARTUPDIR=/dockerstartup \
+    INST_SCRIPTS=/dockerstartup/install \
+    KASM_RX_HOME=/dockerstartup/kasmrx \
+    DEBIAN_FRONTEND=noninteractive \
+    VNC_COL_DEPTH=24 \
+    VNC_RESOLUTION=1280x1024 \
+    VNC_PW=vncpassword \
+    VNC_USER=user \
+    VNC_VIEW_ONLY_PW=vncviewonlypassword \
+    LD_LIBRARY_PATH=/usr/local/lib/ \
+    OMP_WAIT_POLICY=PASSIVE \
+    SHELL=/bin/bash \
+    SINGLE_APPLICATION=0 \
+    KASMVNC_BUILD_OS=fedora \
+    KASMVNC_BUILD_OS_CODENAME=thirtythree
+
+EXPOSE $VNC_PORT
+
+WORKDIR $HOME
+
+### REQUIRED STUFF ###
+
+RUN dnf install -y openssl xterm gettext wget
+RUN dnf install -y nss_wrapper
+RUN dnf install -y xorg-x11-xauth xorg-x11-xkb-utils \
+  xkeyboard-config xorg-x11-server-utils
+# xorg-x11-server-Xorg
+# RUN dnf install -y @xfce-desktop-environment
+RUN dnf group install -y lxde-desktop
+RUN dnf erase -y pm-utils xscreensaver*
+RUN dnf install -y redhat-lsb-core
+RUN dnf install -y vim less
+
+RUN echo 'source $STARTUPDIR/generate_container_user' >> $HOME/.bashrc
+
+RUN mkdir -p $STARTUPDIR
+COPY startup/ $STARTUPDIR
+
+### START CUSTOM STUFF ####
+
+ARG KASMVNC_PACKAGE_DIR
+COPY $KASMVNC_PACKAGE_DIR/*.rpm /tmp
+# RUN dnf remove -y tigervnc-server-minimal
+RUN dnf localinstall -y --allowerasing /tmp/*.rpm
+
+### END CUSTOM STUFF ###
+
+RUN chown -R 1000:0 $HOME
+USER 1000:kasmvnc-cert
+WORKDIR $HOME
+
+RUN mkdir ~/.vnc && echo '/usr/bin/lxsession -s LXDE &' >> ~/.vnc/xstartup && \
+  chmod +x ~/.vnc/xstartup
+
+ENTRYPOINT [ "/dockerstartup/vnc_startup.sh" ]

builder/dockerfile.kali_kali-rolling.build

@@ -0,0 +1,31 @@
+FROM kalilinux/kali-rolling:latest
+
+ENV KASMVNC_BUILD_OS kali
+ENV KASMVNC_BUILD_OS_CODENAME kali-rolling
+ENV XORG_VER 1.20.10
+ENV DEBIAN_FRONTEND noninteractive
+
+RUN grep '^deb'  /etc/apt/sources.list | sed 's#^deb#deb-src#' >> /etc/apt/sources.list
+
+RUN apt-get update && \
+      apt-get -y install sudo
+
+RUN DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends tzdata
+RUN apt-get update && apt-get -y build-dep xorg-server libxfont-dev
+RUN apt-get update && apt-get -y install cmake git libjpeg-dev libgnutls28-dev vim wget tightvncserver
+RUN apt-get update && apt-get -y install libjpeg-dev libpng-dev libtiff-dev libgif-dev libavcodec-dev libssl-dev
+
+# Additions for webp
+RUN cd /tmp && wget https://storage.googleapis.com/downloads.webmproject.org/releases/webp/libwebp-1.0.2.tar.gz
+RUN cd /tmp && tar -xzvf /tmp/libwebp-*
+RUN cd /tmp/libwebp-1.0.2 && \
+    ./configure --enable-static --disable-shared && \
+    make && make install
+
+RUN useradd -m docker && echo "docker:docker" | chpasswd && adduser docker sudo
+
+COPY . /src
+RUN chown -R docker:docker /src
+
+USER docker
+ENTRYPOINT ["/src/builder/build.sh"]

builder/dockerfile.kali_kali-rolling.deb.build

@@ -0,0 +1,12 @@
+FROM kalilinux/kali-rolling:latest
+
+ENV DEBIAN_FRONTEND noninteractive
+
+RUN apt-get update && \
+      apt-get -y install vim build-essential devscripts equivs
+
+# Install build-deps for the package.
+COPY ./debian/control /tmp
+RUN apt-get update && echo YYY | mk-build-deps --install --remove /tmp/control
+
+USER 1000

builder/dockerfile.kali_kali-rolling.deb.test

@@ -0,0 +1,54 @@
+FROM kalilinux/kali-rolling:latest
+
+ENV DISPLAY=:1 \
+    VNC_PORT=8443 \
+    VNC_RESOLUTION=1280x720 \
+    MAX_FRAME_RATE=24 \
+    VNCOPTIONS="-PreferBandwidth -DynamicQualityMin=4 -DynamicQualityMax=7" \
+    HOME=/home/user \
+    TERM=xterm \
+    STARTUPDIR=/dockerstartup \
+    INST_SCRIPTS=/dockerstartup/install \
+    KASM_RX_HOME=/dockerstartup/kasmrx \
+    DEBIAN_FRONTEND=noninteractive \
+    VNC_COL_DEPTH=24 \
+    VNC_RESOLUTION=1280x1024 \
+    VNC_PW=vncpassword \
+    VNC_USER=user \
+    VNC_VIEW_ONLY_PW=vncviewonlypassword \
+    LD_LIBRARY_PATH=/usr/local/lib/ \
+    OMP_WAIT_POLICY=PASSIVE \
+    SHELL=/bin/bash \
+    SINGLE_APPLICATION=0 \
+    KASMVNC_BUILD_OS=ubuntu \
+    KASMVNC_BUILD_OS_VER=18.04
+
+EXPOSE $VNC_PORT
+
+WORKDIR $HOME
+
+### REQUIRED STUFF ###
+
+RUN apt-get update && apt-get install -y supervisor xfce4 xfce4-terminal dbus-x11 xterm libnss-wrapper gettext wget
+RUN apt-get purge -y pm-utils xscreensaver*
+RUN apt-get update && apt-get install -y vim less
+RUN apt-get update && apt-get -y install lsb-release
+
+RUN echo 'source $STARTUPDIR/generate_container_user' >> $HOME/.bashrc
+
+RUN mkdir -p $STARTUPDIR
+COPY startup/ $STARTUPDIR
+
+### START CUSTOM STUFF ####
+
+ARG KASMVNC_PACKAGE_DIR
+COPY $KASMVNC_PACKAGE_DIR/kasmvncserver_*.deb /tmp
+RUN dpkg -i /tmp/*.deb; apt-get -yf install
+
+### END CUSTOM STUFF ###
+
+RUN chown -R 1000:0 $HOME
+USER 1000:ssl-cert
+WORKDIR $HOME
+
+ENTRYPOINT [ "/dockerstartup/vnc_startup.sh" ]

builder/dockerfile.test

@@ -1,12 +0,0 @@
-FROM kasmweb/desktop-deluxe:develop
-
-ENV VNCOPTIONS "-PreferBandwidth -DynamicQualityMin=3 -DynamicQualityMax=7 -detectScrolling"
-
-USER root
- 
-COPY kasmvnc-Linux-x86_64-*.tar.gz /tmp/
-RUN tar -xzvf /tmp/kasmvnc-Linux-x86_64-*.tar.gz --strip 1 -C /
-
-USER 1000
-
-CMD ["--tail-log"]

builder/dockerfile.ubuntu_bionic.build

@@ -1,5 +1,9 @@
 FROM ubuntu:18.04
 
+ENV KASMVNC_BUILD_OS ubuntu
+ENV KASMVNC_BUILD_OS_CODENAME bionic
+ENV XORG_VER 1.20.10
+
 RUN sed -i 's$# deb-src$deb-src$' /etc/apt/sources.list
 
 RUN apt-get update && \

builder/dockerfile.ubuntu_bionic.deb.build

@@ -0,0 +1,10 @@
+FROM ubuntu:bionic
+
+RUN apt-get update && \
+      apt-get -y install vim build-essential devscripts equivs
+
+# Install build-deps for the package.
+COPY ./debian/control /tmp
+RUN apt-get update && echo YYY | mk-build-deps --install --remove /tmp/control
+
+USER 1000

builder/dockerfile.ubuntu_bionic.deb.test

@@ -0,0 +1,54 @@
+FROM ubuntu:bionic
+
+ENV DISPLAY=:1 \
+    VNC_PORT=8443 \
+    VNC_RESOLUTION=1280x720 \
+    MAX_FRAME_RATE=24 \
+    VNCOPTIONS="-PreferBandwidth -DynamicQualityMin=4 -DynamicQualityMax=7" \
+    HOME=/home/user \
+    TERM=xterm \
+    STARTUPDIR=/dockerstartup \
+    INST_SCRIPTS=/dockerstartup/install \
+    KASM_RX_HOME=/dockerstartup/kasmrx \
+    DEBIAN_FRONTEND=noninteractive \
+    VNC_COL_DEPTH=24 \
+    VNC_RESOLUTION=1280x1024 \
+    VNC_PW=vncpassword \
+    VNC_USER=user \
+    VNC_VIEW_ONLY_PW=vncviewonlypassword \
+    LD_LIBRARY_PATH=/usr/local/lib/ \
+    OMP_WAIT_POLICY=PASSIVE \
+    SHELL=/bin/bash \
+    SINGLE_APPLICATION=0 \
+    KASMVNC_BUILD_OS=ubuntu \
+    KASMVNC_BUILD_OS_CODENAME=bionic
+
+EXPOSE $VNC_PORT
+
+WORKDIR $HOME
+
+### REQUIRED STUFF ###
+
+RUN apt-get update && apt-get install -y supervisor xfce4 xfce4-terminal xterm libnss-wrapper gettext wget
+RUN apt-get purge -y pm-utils xscreensaver*
+RUN apt-get update && apt-get install -y vim less
+RUN apt-get update && apt-get -y install lsb-release
+
+RUN echo 'source $STARTUPDIR/generate_container_user' >> $HOME/.bashrc
+
+RUN mkdir -p $STARTUPDIR
+COPY startup/ $STARTUPDIR
+
+### START CUSTOM STUFF ####
+
+ARG KASMVNC_PACKAGE_DIR
+COPY $KASMVNC_PACKAGE_DIR/kasmvncserver_*.deb /tmp
+RUN dpkg -i /tmp/*.deb; apt-get -yf install
+
+### END CUSTOM STUFF ###
+
+RUN chown -R 1000:0 $HOME
+USER 1000:ssl-cert
+WORKDIR $HOME
+
+ENTRYPOINT [ "/dockerstartup/vnc_startup.sh" ]

builder/dockerfile.ubuntu_bionic.test

@@ -0,0 +1,51 @@
+FROM ubuntu:18.04
+
+ENV DISPLAY=:1 \
+    VNC_PORT=8443 \
+    VNC_RESOLUTION=1280x720 \
+    MAX_FRAME_RATE=24 \
+    VNCOPTIONS="-PreferBandwidth -DynamicQualityMin=4 -DynamicQualityMax=7" \
+    HOME=/home/user \
+    TERM=xterm \
+    STARTUPDIR=/dockerstartup \
+    INST_SCRIPTS=/dockerstartup/install \
+    KASM_RX_HOME=/dockerstartup/kasmrx \
+    DEBIAN_FRONTEND=noninteractive \
+    VNC_COL_DEPTH=24 \
+    VNC_RESOLUTION=1280x1024 \
+    VNC_PW=vncpassword \
+    VNC_USER=user \
+    VNC_VIEW_ONLY_PW=vncviewonlypassword \
+    LD_LIBRARY_PATH=/usr/local/lib/ \
+    OMP_WAIT_POLICY=PASSIVE \
+    SHELL=/bin/bash \
+    SINGLE_APPLICATION=0 \
+    KASMVNC_BUILD_OS=ubuntu \
+    KASMVNC_BUILD_OS_CODENAME=bionic
+
+EXPOSE $VNC_PORT
+
+WORKDIR $HOME
+
+### REQUIRED STUFF ###
+
+RUN apt-get update && apt-get install -y supervisor xfce4 xfce4-terminal xterm libnss-wrapper gettext libjpeg-dev wget
+RUN apt-get purge -y pm-utils xscreensaver*
+
+RUN echo 'source $STARTUPDIR/generate_container_user' >> $HOME/.bashrc
+
+RUN mkdir -p $STARTUPDIR
+COPY startup/ $STARTUPDIR
+
+### START CUSTOM STUFF ####
+
+COPY build/kasmvnc.${KASMVNC_BUILD_OS}_${KASMVNC_BUILD_OS_CODENAME}.tar.gz /tmp/
+RUN tar -xzvf /tmp/kasmvnc.${KASMVNC_BUILD_OS}_${KASMVNC_BUILD_OS_CODENAME}.tar.gz --strip 1 -C /
+
+### END CUSTOM STUFF ###
+
+RUN chown -R 1000:0 $HOME
+USER 1000
+WORKDIR $HOME
+
+ENTRYPOINT [ "/dockerstartup/vnc_startup.sh" ]

builder/dockerfile.ubuntu_focal.barebones.deb.test

@@ -0,0 +1,15 @@
+FROM ubuntu:focal
+
+ARG KASMVNC_PACKAGE_DIR
+COPY $KASMVNC_PACKAGE_DIR/kasmvncserver_*.deb /tmp
+RUN apt-get update && dpkg -i /tmp/*.deb; apt-get -yf install
+RUN apt-get update && apt-get -y install xterm lsb-release
+
+RUN useradd -m foo && addgroup foo ssl-cert
+
+USER foo
+
+RUN mkdir ~/.vnc && echo '/usr/bin/xterm &' >> ~/.vnc/xstartup && \
+  chmod +x ~/.vnc/xstartup
+
+ENTRYPOINT bash -c "echo -e \"$VNC_PW\n$VNC_PW\n\" | kasmvncpasswd -w -u \"$VNC_USER\" && vncserver :1 -interface 0.0.0.0 && vncserver -kill :1 && vncserver :1 -depth 24 -geometry 1280x1050 -websocketPort 8443 -cert /etc/ssl/certs/ssl-cert-snakeoil.pem -key /etc/ssl/private/ssl-cert-snakeoil.key -sslOnly -FrameRate=24 -interface 0.0.0.0 -httpd /usr/share/kasmvnc/www && tail -f $HOME/.vnc/*.log "

builder/dockerfile.ubuntu_focal.build

@@ -0,0 +1,31 @@
+FROM ubuntu:focal
+
+ENV KASMVNC_BUILD_OS ubuntu
+ENV KASMVNC_BUILD_OS_CODENAME focal
+ENV XORG_VER 1.20.8
+ENV DEBIAN_FRONTEND noninteractive
+
+RUN sed -i 's$# deb-src$deb-src$' /etc/apt/sources.list
+
+RUN apt-get update && \
+      apt-get -y install sudo
+
+RUN apt-get update && apt-get install -y --no-install-recommends tzdata
+RUN apt-get update && apt-get -y build-dep xorg-server libxfont-dev
+RUN apt-get update && apt-get -y install cmake git libjpeg-dev libgnutls28-dev vim wget tightvncserver
+RUN apt-get update && apt-get -y install libjpeg-dev libpng-dev libtiff-dev libgif-dev libavcodec-dev libssl-dev
+
+# Additions for webp
+RUN cd /tmp && wget https://storage.googleapis.com/downloads.webmproject.org/releases/webp/libwebp-1.0.2.tar.gz
+RUN cd /tmp && tar -xzvf /tmp/libwebp-*
+RUN cd /tmp/libwebp-1.0.2 && \
+    ./configure --enable-static --disable-shared && \
+    make && make install
+
+RUN useradd -m docker && echo "docker:docker" | chpasswd && adduser docker sudo
+
+COPY . /src
+RUN chown -R docker:docker /src
+
+USER docker
+ENTRYPOINT ["/src/builder/build.sh"]

builder/dockerfile.ubuntu_focal.deb.build

@@ -0,0 +1,12 @@
+FROM ubuntu:focal
+
+ENV DEBIAN_FRONTEND noninteractive
+
+RUN apt-get update && \
+      apt-get -y install vim build-essential devscripts equivs
+
+# Install build-deps for the package.
+COPY ./debian/control /tmp
+RUN apt-get update && echo YYY | mk-build-deps --install --remove /tmp/control
+
+USER 1000

builder/dockerfile.ubuntu_focal.deb.test

@@ -0,0 +1,57 @@
+FROM ubuntu:focal
+
+ENV DISPLAY=:1 \
+    VNC_PORT=8443 \
+    VNC_RESOLUTION=1280x720 \
+    MAX_FRAME_RATE=24 \
+    VNCOPTIONS="-PreferBandwidth -DynamicQualityMin=4 -DynamicQualityMax=7" \
+    HOME=/home/user \
+    TERM=xterm \
+    STARTUPDIR=/dockerstartup \
+    INST_SCRIPTS=/dockerstartup/install \
+    KASM_RX_HOME=/dockerstartup/kasmrx \
+    DEBIAN_FRONTEND=noninteractive \
+    VNC_COL_DEPTH=24 \
+    VNC_RESOLUTION=1280x1024 \
+    VNC_PW=vncpassword \
+    VNC_USER=user \
+    VNC_VIEW_ONLY_PW=vncviewonlypassword \
+    LD_LIBRARY_PATH=/usr/local/lib/ \
+    OMP_WAIT_POLICY=PASSIVE \
+    SHELL=/bin/bash \
+    SINGLE_APPLICATION=0 \
+    KASMVNC_BUILD_OS=ubuntu \
+    KASMVNC_BUILD_OS_CODENAME=bionic
+
+EXPOSE $VNC_PORT
+
+WORKDIR $HOME
+
+### REQUIRED STUFF ###
+
+RUN apt-get update && apt-get install -y supervisor xfce4 xfce4-terminal xterm libnss-wrapper gettext wget
+RUN apt-get purge -y pm-utils xscreensaver*
+RUN apt-get update && apt-get install -y vim less
+RUN apt-get update && apt-get -y install lsb-release
+
+RUN echo 'source $STARTUPDIR/generate_container_user' >> $HOME/.bashrc
+
+RUN mkdir -p $STARTUPDIR
+COPY startup/ $STARTUPDIR
+
+### START CUSTOM STUFF ####
+
+ARG KASMVNC_PACKAGE_DIR
+COPY $KASMVNC_PACKAGE_DIR/kasmvncserver_*.deb /tmp
+RUN dpkg -i /tmp/*.deb; apt-get -yf install
+
+RUN mkdir ~/.vnc && echo '/usr/bin/xfce4-session &' >> ~/.vnc/xstartup && \
+  chmod +x ~/.vnc/xstartup
+
+### END CUSTOM STUFF ###
+
+RUN chown -R 1000:0 $HOME
+USER 1000:ssl-cert
+WORKDIR $HOME
+
+ENTRYPOINT [ "/dockerstartup/vnc_startup.sh" ]

builder/dockerfile.ubuntu_focal.test

@@ -0,0 +1,51 @@
+FROM ubuntu:focal
+
+ENV DISPLAY=:1 \
+    VNC_PORT=8443 \
+    VNC_RESOLUTION=1280x720 \
+    MAX_FRAME_RATE=24 \
+    VNCOPTIONS="-PreferBandwidth -DynamicQualityMin=4 -DynamicQualityMax=7" \
+    HOME=/home/user \
+    TERM=xterm \
+    STARTUPDIR=/dockerstartup \
+    INST_SCRIPTS=/dockerstartup/install \
+    KASM_RX_HOME=/dockerstartup/kasmrx \
+    DEBIAN_FRONTEND=noninteractive \
+    VNC_COL_DEPTH=24 \
+    VNC_RESOLUTION=1280x1024 \
+    VNC_PW=vncpassword \
+    VNC_USER=user \
+    VNC_VIEW_ONLY_PW=vncviewonlypassword \
+    LD_LIBRARY_PATH=/usr/local/lib/ \
+    OMP_WAIT_POLICY=PASSIVE \
+    SHELL=/bin/bash \
+    SINGLE_APPLICATION=0 \
+    KASMVNC_BUILD_OS=ubuntu \
+    KASMVNC_BUILD_OS_CODENAME=focal
+
+EXPOSE $VNC_PORT
+
+WORKDIR $HOME
+
+### REQUIRED STUFF ###
+
+RUN apt-get update && apt-get install -y supervisor xfce4 xfce4-terminal xterm libnss-wrapper gettext libjpeg-dev wget
+RUN apt-get purge -y pm-utils xscreensaver*
+
+RUN echo 'source $STARTUPDIR/generate_container_user' >> $HOME/.bashrc
+
+RUN mkdir -p $STARTUPDIR
+COPY startup/ $STARTUPDIR
+
+### START CUSTOM STUFF ####
+
+COPY build/kasmvnc.${KASMVNC_BUILD_OS}_${KASMVNC_BUILD_OS_CODENAME}.tar.gz /tmp/
+RUN tar -xzvf /tmp/kasmvnc.${KASMVNC_BUILD_OS}_${KASMVNC_BUILD_OS_CODENAME}.tar.gz --strip 1 -C /
+
+### END CUSTOM STUFF ###
+
+RUN chown -R 1000:0 $HOME
+USER 1000
+WORKDIR $HOME
+
+ENTRYPOINT [ "/dockerstartup/vnc_startup.sh" ]

builder/dockerfile.www.build

@@ -0,0 +1,10 @@
+FROM node:12-buster
+
+COPY kasmweb/ /src/www/
+COPY builder/build_www.sh /src/
+
+WORKDIR /src/www
+
+RUN npm install
+
+ENTRYPOINT [ "/src/build_www.sh" ]

builder/os_ver_cli.sh

@@ -0,0 +1,8 @@
+default_os=ubuntu
+default_os_codename=bionic
+
+os=${1:-$default_os}
+os_codename=${2:-$default_os_codename}
+os_image="$os:$os_codename"
+
+echo "Building for $os_image"

builder/startup/deb/kasmvncserver-easy-start

@@ -0,0 +1,46 @@
+#!/bin/bash
+
+set -e
+
+display=:10
+interface=0.0.0.0
+cert_group=ssl-cert
+
+if [[ "$1" = "--help" ]]; then
+  cat >&2 <<-USAGE
+Usage: `basename $0` [options]
+  -d     Debug output
+  -kill  Kill vncserver
+  --help show this help
+USAGE
+  exit
+fi
+
+if [[ "$1" = "-d" ]]; then
+  log_option="-log *:stderr:100"
+fi
+
+action=start
+if [[ "$1" = "-kill" ]]; then
+  action=kill
+fi
+
+if groups | grep -qvw ssl-cert; then
+  cat <<-EOF
+    Can't access TLS certificate.
+    Please add your user to $cert_group via 'addgroup <user> ssl-cert'
+EOF
+  exit 1
+fi
+
+if [[ "$action" = "kill" ]]; then
+  vncserver -kill $display
+  exit
+fi
+
+vncserver $display -interface $interface
+vncserver -kill $display
+vncserver $display -depth 24 -geometry 1280x1050 -websocketPort 8443 \
+  -cert /etc/ssl/certs/ssl-cert-snakeoil.pem \
+  -key /etc/ssl/private/ssl-cert-snakeoil.key -sslOnly -FrameRate=24 \
+  -interface $interface -httpd /usr/share/kasmvnc/www $log_option

builder/startup/generate_container_user

@@ -0,0 +1,46 @@
+detect_libnss_wrapper() {
+  if $(which dpkg &>/dev/null); then
+    libnss_wrapper_file=$(dpkg -S libnss_wrapper.so | awk -F' ' '{ print $2 }')
+    return
+  fi
+
+  if [ -r /usr/lib/libnss_wrapper.so ]; then
+      libnss_wrapper_file=/usr/lib/libnss_wrapper.so
+  elif [ -r /usr/lib64/libnss_wrapper.so ]; then
+      libnss_wrapper_file=/usr/lib64/libnss_wrapper.so
+  else
+      echo "no libnss_wrapper.so installed!"
+      exit 1
+  fi
+}
+
+# Set current user in nss_wrapper
+USER_ID=$(id -u)
+GROUP_ID=$(id -g)
+echo "USER_ID: $USER_ID, GROUP_ID: $GROUP_ID"
+
+# Attempt to set the username to the kasm username
+USERNAME=${VNC_USER:-default}
+# Make the username posix compliant
+USERNAME=$(echo "$USERNAME" | sed -r 's#[^a-zA-Z0-9\._\-]#_#g')
+if ! echo "$USERNAME" | grep -qP "^[a-zA-Z0-9_\.][a-zA-Z0-9_\-\.]*"; then
+    USERNAME="default"
+fi
+export PS1="$USERNAME:\w\$ "
+
+if [ x"$USER_ID" != x"0" ]; then
+
+    NSS_WRAPPER_PASSWD=/tmp/passwd
+    NSS_WRAPPER_GROUP=/etc/group
+
+    cat /etc/passwd > $NSS_WRAPPER_PASSWD
+
+    echo "${USERNAME}:x:${USER_ID}:${GROUP_ID}:Default Application User:${HOME}:/bin/bash" >> $NSS_WRAPPER_PASSWD
+
+    export NSS_WRAPPER_PASSWD
+    export NSS_WRAPPER_GROUP
+
+    detect_libnss_wrapper
+    echo "nss_wrapper location: $libnss_wrapper_file"
+    export LD_PRELOAD="$libnss_wrapper_file"
+fi

builder/startup/vnc_startup.sh

@@ -0,0 +1,112 @@
+#!/bin/bash
+### every exit != 0 fails the script
+set -e
+
+# should also source $STARTUPDIR/generate_container_user
+source $HOME/.bashrc
+
+## correct forwarding of shutdown signal
+cleanup () {
+    kill -s SIGTERM $!
+    exit 0
+}
+trap cleanup SIGINT SIGTERM
+
+detect_www_dir() {
+  local package_www_dir="/usr/share/kasmvnc/www"
+  if [[ -d "$package_www_dir" ]]; then
+    package_www_dir_option="-httpd $package_www_dir"
+  fi
+}
+
+detect_cert_location() {
+  local tarball_cert="$HOME/.vnc/self.pem"
+  local deb_cert="/etc/ssl/certs/ssl-cert-snakeoil.pem"
+  local deb_key="/etc/ssl/private/ssl-cert-snakeoil.key"
+  local rpm_cert="/etc/pki/tls/private/kasmvnc.pem"
+
+  if [[ -f "$deb_cert" ]]; then
+    cert_option="-cert $deb_cert -key $deb_key"
+  elif [[ -f "$rpm_cert" ]]; then
+    cert_option="-cert $rpm_cert"
+  else
+    cert_option="-cert $tarball_cert"
+  fi
+}
+
+add_vnc_user() {
+  local username="$1"
+  local password="$2"
+  local permission_option="$3"
+
+  echo "Adding user $username"
+  echo -e "$password\n$password" | kasmvncpasswd $permission_option \
+    -u "$username" $HOME/.kasmpasswd
+}
+
+## resolve_vnc_connection
+VNC_IP=$(hostname -i)
+
+# first entry is control, second is view (if only one is valid for both)
+mkdir -p "$HOME/.vnc"
+PASSWD_PATH="$HOME/.vnc/passwd"
+add_vnc_user "$VNC_USER" "$VNC_PW" "-w"
+add_vnc_user "$VNC_USER-ro" "$VNC_PW"
+add_vnc_user "$VNC_USER-owner" "$VNC_PW" "-o"
+add_vnc_user "$VNC_USER-to-delete" "$VNC_PW"
+
+kasmvncpasswd -n -u "$VNC_USER-owner" -w -o $HOME/.kasmpasswd
+kasmvncpasswd -d -u "$VNC_USER-to-delete" $HOME/.kasmpasswd
+
+chmod 0600 $HOME/.kasmpasswd
+openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout $HOME/.vnc/self.pem -out $HOME/.vnc/self.pem -subj "/C=US/ST=VA/L=None/O=None/OU=DoFu/CN=kasm/emailAddress=none@none.none"
+
+vncserver :1 -interface 0.0.0.0
+vncserver -kill :1
+
+if [[ -f $PASSWD_PATH ]]; then
+    rm -f $PASSWD_PATH
+fi
+
+#echo "$VNC_PW" | vncpasswd -f > $PASSWD_PATH
+#echo "$VNC_VIEW_ONLY_PW" | vncpasswd -f >> $PASSWD_PATH
+#chmod 600 $PASSWD_PATH
+
+unset VNC_VIEW_ONLY_PW
+unset VNC_PW
+
+if [[ $DEBUG == true ]]; then
+  echo -e "\n------------------ start VNC server ------------------------"
+  echo "remove old vnc locks to be a reattachable container"
+fi
+vncserver -kill $DISPLAY &> $HOME/.vnc/vnc_startup.log \
+    || rm -rfv /tmp/.X*-lock /tmp/.X11-unix &> $HOME/.vnc/vnc_startup.log \
+    || echo "no locks present"
+
+
+detect_www_dir
+detect_cert_location
+[ -n "$KASMVNC_VERBOSE_LOGGING" ] && verbose_logging_option="-log *:stderr:100"
+
+echo -e "start vncserver with param: VNC_COL_DEPTH=$VNC_COL_DEPTH, VNC_RESOLUTION=$VNC_RESOLUTION\n..."
+vncserver $DISPLAY -depth $VNC_COL_DEPTH -geometry $VNC_RESOLUTION -FrameRate=$MAX_FRAME_RATE -websocketPort $VNC_PORT $cert_option -sslOnly -interface 0.0.0.0 $VNCOPTIONS $package_www_dir_option $verbose_logging_option #&> $STARTUPDIR/no_vnc_startup.log
+
+PID_SUN=$!
+
+echo -e "start window manager\n..."
+$STARTUPDIR/window_manager_startup.sh #&> $STARTUPDIR/window_manager_startup.log
+
+## log connect options
+echo -e "\n\n------------------ VNC environment started ------------------"
+echo -e "\nVNCSERVER started on DISPLAY= $DISPLAY \n\t=> connect via VNC viewer with $VNC_IP:$VNC_PORT"
+echo -e "\nnoVNC HTML client started:\n\t=> connect via http://$VNC_IP:$NO_VNC_PORT/?password=...\n"
+echo "WEB PID: $PID_SUB"
+
+# tail vncserver logs
+tail -f $HOME/.vnc/*$DISPLAY.log &
+
+eval "$@"
+
+wait $PID_SUB
+
+echo "Exiting Kasm container"

builder/startup/window_manager_startup.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+set -e
+
+echo -e "\n------------------ Xfce4 window manager startup------------------"
+
+### disable screen saver and power management
+xset -dpms &
+xset s noblank &
+xset s off &
+
+if [ "$SINGLE_APPLICATION" -eq "1" ]; then
+    echo "Configured of Single Application Mode"
+    sed -i "s/O|SHMC/|/g" $HOME/.config/xfce4/xfconf/xfce-perchannel-xml/xfwm4.xml
+    #xfwm4 --daemon
+fi

builder/test-deb

@@ -0,0 +1,14 @@
+#!/bin/bash
+
+set -e
+
+cd "$(dirname "$0")"
+. ./os_ver_cli.sh
+
+docker build --build-arg KASMVNC_PACKAGE_DIR="build/${os_codename}" \
+  -t kasmvnctester_${os}:$os_codename \
+  -f dockerfile.${os}_${os_codename}.deb.test .
+docker run -it -p 443:8443 --rm \
+  -e KASMVNC_VERBOSE_LOGGING=$KASMVNC_VERBOSE_LOGGING \
+  -e "VNC_USER=foo" -e "VNC_PW=foobar" \
+  kasmvnctester_${os}:$os_codename

builder/test-deb-barebones

@@ -0,0 +1,14 @@
+#!/bin/bash
+
+set -e
+
+cd "$(dirname "$0")"
+os="${1:-debian}"
+os_codename="${2:-buster}"
+
+docker build --build-arg KASMVNC_PACKAGE_DIR="build/${os_codename}" \
+  -t kasmvnctester_barebones_${os}:$os_codename \
+  -f dockerfile.${os}_${os_codename}.barebones.deb.test .
+echo
+docker run -it -p 443:8443 --rm -e "VNC_USER=foo" -e "VNC_PW=foobar" \
+  kasmvnctester_barebones_${os}:$os_codename

builder/test-rpm

@@ -0,0 +1,17 @@
+#!/bin/bash
+
+set -e
+
+cd "$(dirname "$0")"
+. ./os_ver_cli.sh
+
+echo kasmvnctester_${os}:$os_codename
+docker build --build-arg \
+  KASMVNC_PACKAGE_DIR="build/${os}_${os_codename}" \
+  -t kasmvnctester_${os}:$os_codename \
+  -f dockerfile.${os}_${os_codename}.rpm.test .
+
+docker run -it -p 443:8443 --rm \
+  -e KASMVNC_VERBOSE_LOGGING=$KASMVNC_VERBOSE_LOGGING \
+  -e "VNC_USER=foo" -e "VNC_PW=foobar" \
+  kasmvnctester_${os}:$os_codename

builder/test-rpm-barebones

@@ -0,0 +1,13 @@
+#!/bin/bash
+
+set -e
+
+cd "$(dirname "$0")"
+os="${1:-centos}"
+os_codename="${2:-core}"
+
+docker build --build-arg KASMVNC_PACKAGE_DIR="build/${os}_${os_codename}" \
+  -t kasmvnctester_barebones_${os}:$os_codename \
+  -f dockerfile.${os}_${os_codename}.barebones.rpm.test .
+docker run -it -p 443:8443 --rm -e "VNC_USER=foo" -e "VNC_PW=foobar" \
+  kasmvnctester_barebones_${os}:$os_codename

centos/kasmvncserver.spec

@@ -0,0 +1,104 @@
+Name:           kasmvncserver
+Version:        0.9.1~beta
+Release:        1%{?dist}
+Summary:        VNC server accessible from a web browser
+
+License: GPLv2+
+URL: https://github.com/kasmtech/KasmVNC
+
+BuildRequires: rsync
+Requires: xorg-x11-xauth, xorg-x11-xkb-utils, xkeyboard-config, xorg-x11-server-utils, openssl, perl
+Conflicts: tigervnc-server, tigervnc-server-minimal
+
+%description
+VNC stands for Virtual Network Computing. It is, in essence, a remote
+display system which allows you to view a computing `desktop' environment
+not only on the machine where it is running, but from anywhere on the
+Internet and from a wide variety of machine architectures.
+
+KasmVNC has different goals than TigerVNC:
+
+Web-based - KasmVNC is designed to provide a web accessible remote desktop.
+It comes with a web server and web-socket server built in. There is no need to
+install other components. Simply run and navigate to your desktop's URL on the
+port you specify. While you can still tun on the legacy VNC port, it is
+disabled by default.
+
+Security - KasmVNC defaults to HTTPS and allows for HTTP Basic Auth. VNC
+Password authentication is limited by specification to 8 characters and is not
+sufficient for use on an internet accessible remote desktop. Our goal is to
+create a by default secure, web based experience.
+
+Simplicity - KasmVNC aims at being simple to deploy and configure.
+
+%prep
+
+%install
+rm -rf $RPM_BUILD_ROOT
+
+TARGET_OS=$(lsb_release -is | tr '[:upper:]' '[:lower:]')
+TARGET_OS_CODENAME=$(lsb_release -cs | tr '[:upper:]' '[:lower:]')
+TARBALL=$RPM_SOURCE_DIR/kasmvnc.${TARGET_OS}_${TARGET_OS_CODENAME}.tar.gz
+TAR_DATA=$(mktemp -d)
+tar -xzf "$TARBALL" -C "$TAR_DATA"
+
+SRC=$TAR_DATA/usr/local
+SRC_BIN=$SRC/bin
+DESTDIR=$RPM_BUILD_ROOT
+DST_MAN=$DESTDIR/usr/share/man/man1
+
+mkdir -p $DESTDIR/usr/bin $DESTDIR/usr/share/man/man1 \
+  $DESTDIR/usr/share/doc/kasmvncserver
+cp $SRC_BIN/Xvnc $DESTDIR/usr/bin;
+cp $SRC_BIN/vncserver $DESTDIR/usr/bin;
+cp $SRC_BIN/vncconfig $DESTDIR/usr/bin;
+cp $SRC_BIN/kasmvncpasswd $DESTDIR/usr/bin;
+cd $DESTDIR/usr/bin && ln -s kasmvncpasswd vncpasswd;
+cp -r $SRC/share/doc/kasmvnc*/* $DESTDIR/usr/share/doc/kasmvncserver/
+rsync -r --exclude '.git*' --exclude po2js --exclude xgettext-html \
+  --exclude www/utils/ --exclude .eslintrc \
+  $SRC/share/kasmvnc $DESTDIR/usr/share
+cp $SRC/man/man1/Xvnc.1 $DESTDIR/usr/share/man/man1/;
+cp $SRC/share/man/man1/vncserver.1 $DST_MAN;
+cp $SRC/share/man/man1/vncconfig.1 $DST_MAN;
+cp $SRC/share/man/man1/vncpasswd.1 $DST_MAN;
+cd $DST_MAN && ln -s vncpasswd.1 kasmvncpasswd.1;
+
+%files
+/usr/bin/*
+/usr/share/man/man1/*
+/usr/share/kasmvnc/www
+
+%license /usr/share/doc/kasmvncserver/LICENCE.TXT
+%doc /usr/share/doc/kasmvncserver/README.md
+
+%changelog
+* Fri Feb 12 2021 KasmTech <info@kasmweb.com> - 0.9.1~beta-1
+- Initial release of the rpm package.
+
+%post
+  kasmvnc_group="kasmvnc-cert"
+
+  create_kasmvnc_group() {
+    if ! getent group "$kasmvnc_group" >/dev/null; then
+	    groupadd --system "$kasmvnc_group"
+    fi
+  }
+
+  make_self_signed_certificate() {
+    local cert_file=/etc/pki/tls/private/kasmvnc.pem
+    [ -f "$cert_file" ] && return 0
+
+    openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
+      -keyout "$cert_file" \
+      -out "$cert_file" -subj \
+      "/C=US/ST=VA/L=None/O=None/OU=DoFu/CN=kasm/emailAddress=none@none.none"
+    chgrp "$kasmvnc_group" "$cert_file"
+    chmod 640 "$cert_file"
+  }
+
+  create_kasmvnc_group
+  make_self_signed_certificate
+
+%postun
+  rm -f /etc/pki/tls/private/kasmvnc.pem

common/network/CMakeLists.txt

@@ -1,10 +1,12 @@
-include_directories(${CMAKE_SOURCE_DIR}/common)
+include_directories(${CMAKE_SOURCE_DIR}/common ${CMAKE_SOURCE_DIR}/unix/kasmvncpasswd)
 
 set(NETWORK_SOURCES
+  GetAPIMessager.cxx
   Socket.cxx
   TcpSocket.cxx
   websocket.c
-  websockify.c)
+  websockify.c
+  ${CMAKE_SOURCE_DIR}/unix/kasmvncpasswd/kasmpasswd.c)
 
 if(NOT WIN32)
   set(NETWORK_SOURCES ${NETWORK_SOURCES} UnixSocket.cxx)

common/network/GetAPI.h

@@ -0,0 +1,75 @@
+/* Copyright (C) 2021 Kasm
+ *
+ * This is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this software; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307,
+ * USA.
+ */
+
+#ifndef __NETWORK_GET_API_H__
+#define __NETWORK_GET_API_H__
+
+#include <kasmpasswd.h>
+#include <pthread.h>
+#include <rfb/PixelBuffer.h>
+#include <rfb/PixelFormat.h>
+#include <stdint.h>
+#include <vector>
+
+namespace network {
+
+  class GetAPIMessager {
+  public:
+    GetAPIMessager(const char *passwdfile_);
+
+    // from main thread
+    void mainUpdateScreen(rfb::PixelBuffer *pb);
+
+    // from network threads
+    uint8_t *netGetScreenshot(uint16_t w, uint16_t h,
+                              const uint8_t q, const bool dedup,
+                              uint32_t &len, uint8_t *staging);
+    uint8_t netAddUser(const char name[], const char pw[], const bool write);
+    uint8_t netRemoveUser(const char name[]);
+    uint8_t netGiveControlTo(const char name[]);
+
+    enum USER_ACTION {
+      //USER_ADD, - handled locally for interactivity
+      USER_REMOVE,
+      USER_GIVE_CONTROL,
+    };
+
+    struct action_data {
+      enum USER_ACTION action;
+      kasmpasswd_entry_t data;
+    };
+
+    pthread_mutex_t userMutex;
+    std::vector<action_data> actionQueue;
+
+  private:
+    const char *passwdfile;
+
+    pthread_mutex_t screenMutex;
+    rfb::ManagedPixelBuffer screenPb;
+    uint16_t screenW, screenH;
+    uint64_t screenHash;
+
+    std::vector<uint8_t> cachedJpeg;
+    uint16_t cachedW, cachedH;
+    uint8_t cachedQ;
+  };
+
+}
+
+#endif // __NETWORK_GET_API_H__

common/network/GetAPIMessager.cxx

@@ -0,0 +1,288 @@
+/* Copyright (C) 2021 Kasm
+ *
+ * This is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this software; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307,
+ * USA.
+ */
+
+#define __STDC_FORMAT_MACROS
+
+#include <inttypes.h>
+#include <network/GetAPI.h>
+#include <rfb/ConnParams.h>
+#include <rfb/LogWriter.h>
+#include <rfb/JpegCompressor.h>
+#include <rfb/xxhash.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+using namespace network;
+using namespace rfb;
+
+static LogWriter vlog("GetAPIMessager");
+
+PixelBuffer *progressiveBilinearScale(const PixelBuffer *pb,
+					const uint16_t tgtw, const uint16_t tgth,
+					const float tgtdiff);
+
+struct TightJPEGConfiguration {
+    int quality;
+    int subsampling;
+};
+
+static const struct TightJPEGConfiguration conf[10] = {
+  {  15, subsample4X }, // 0
+  {  29, subsample4X }, // 1
+  {  41, subsample4X }, // 2
+  {  42, subsample2X }, // 3
+  {  62, subsample2X }, // 4
+  {  77, subsample2X }, // 5
+  {  79, subsampleNone }, // 6
+  {  86, subsampleNone }, // 7
+  {  92, subsampleNone }, // 8
+  { 100, subsampleNone }  // 9
+};
+
+GetAPIMessager::GetAPIMessager(const char *passwdfile_): passwdfile(passwdfile_),
+					screenW(0), screenH(0), screenHash(0),
+					cachedW(0), cachedH(0), cachedQ(0) {
+
+	pthread_mutex_init(&screenMutex, NULL);
+	pthread_mutex_init(&userMutex, NULL);
+}
+
+// from main thread
+void GetAPIMessager::mainUpdateScreen(rfb::PixelBuffer *pb) {
+	if (pthread_mutex_trylock(&screenMutex))
+		return;
+
+	int stride;
+	const rdr::U8 * const buf = pb->getBuffer(pb->getRect(), &stride);
+
+	if (pb->width() != screenW || pb->height() != screenH) {
+		screenHash = 0;
+		screenW = pb->width();
+		screenH = pb->height();
+		screenPb.setPF(pb->getPF());
+		screenPb.setSize(screenW, screenH);
+
+		cachedW = cachedH = cachedQ = 0;
+		cachedJpeg.clear();
+	}
+
+	const uint64_t newHash = XXH64(buf, pb->area() * 4, 0);
+	if (newHash != screenHash) {
+		cachedW = cachedH = cachedQ = 0;
+		cachedJpeg.clear();
+
+		screenHash = newHash;
+		rdr::U8 *rw = screenPb.getBufferRW(screenPb.getRect(), &stride);
+		memcpy(rw, buf, screenW * screenH * 4);
+		screenPb.commitBufferRW(screenPb.getRect());
+	}
+
+	pthread_mutex_unlock(&screenMutex);
+}
+
+// from network threads
+uint8_t *GetAPIMessager::netGetScreenshot(uint16_t w, uint16_t h,
+	const uint8_t q, const bool dedup,
+	uint32_t &len, uint8_t *staging) {
+
+	uint8_t *ret = NULL;
+	len = 0;
+
+	if (w > screenW)
+		w = screenW;
+	if (h > screenH)
+		h = screenH;
+
+	if (!screenW || !screenH)
+		vlog.error("Screenshot requested but no screenshot exists (screen hasn't been viewed)");
+
+	if (!w || !h || q > 9 || !staging)
+		return NULL;
+
+	if (pthread_mutex_lock(&screenMutex))
+		return NULL;
+
+	if (w == cachedW && h == cachedH && q == cachedQ) {
+		if (dedup) {
+			// Return the hash of the unchanged image
+			sprintf((char *) staging, "%" PRIx64, screenHash);
+			ret = staging;
+			len = 16;
+		} else {
+			// Return the cached image
+			len = cachedJpeg.size();
+			ret = staging;
+			memcpy(ret, &cachedJpeg[0], len);
+
+			vlog.info("Returning cached screenshot");
+		}
+	} else {
+		// Encode the new JPEG, cache it
+		JpegCompressor jc;
+		int quality, subsampling;
+
+		quality = conf[q].quality;
+		subsampling = conf[q].subsampling;
+
+		jc.clear();
+		int stride;
+
+		if (w != screenW || h != screenH) {
+			float xdiff = w / (float) screenW;
+			float ydiff = h / (float) screenH;
+			const float diff = xdiff < ydiff ? xdiff : ydiff;
+
+			const uint16_t neww = screenW * diff;
+			const uint16_t newh = screenH * diff;
+
+			const PixelBuffer *scaled = progressiveBilinearScale(&screenPb, neww, newh, diff);
+			const rdr::U8 * const buf = scaled->getBuffer(scaled->getRect(), &stride);
+
+			jc.compress(buf, stride, scaled->getRect(),
+					scaled->getPF(), quality, subsampling);
+
+			cachedJpeg.resize(jc.length());
+			memcpy(&cachedJpeg[0], jc.data(), jc.length());
+
+			delete scaled;
+
+			vlog.info("Returning scaled screenshot");
+		} else {
+			const rdr::U8 * const buf = screenPb.getBuffer(screenPb.getRect(), &stride);
+
+			jc.compress(buf, stride, screenPb.getRect(),
+					screenPb.getPF(), quality, subsampling);
+
+			cachedJpeg.resize(jc.length());
+			memcpy(&cachedJpeg[0], jc.data(), jc.length());
+
+			vlog.info("Returning normal screenshot");
+		}
+
+		cachedQ = q;
+		cachedW = w;
+		cachedH = h;
+
+		len = cachedJpeg.size();
+		ret = staging;
+		memcpy(ret, &cachedJpeg[0], len);
+	}
+
+	pthread_mutex_unlock(&screenMutex);
+
+	return ret;
+}
+
+#define USERNAME_LEN sizeof(((struct kasmpasswd_entry_t *)0)->user)
+#define PASSWORD_LEN sizeof(((struct kasmpasswd_entry_t *)0)->password)
+
+uint8_t GetAPIMessager::netAddUser(const char name[], const char pw[], const bool write) {
+	if (strlen(name) >= USERNAME_LEN) {
+		vlog.error("Username too long");
+		return 0;
+	}
+
+	if (strlen(pw) >= PASSWORD_LEN) {
+		vlog.error("Password too long");
+		return 0;
+	}
+
+	if (!passwdfile)
+		return 0;
+
+	action_data act;
+
+	memcpy(act.data.user, name, USERNAME_LEN);
+	act.data.user[USERNAME_LEN - 1] = '\0';
+	memcpy(act.data.password, pw, PASSWORD_LEN);
+	act.data.password[PASSWORD_LEN - 1] = '\0';
+	act.data.owner = 0;
+	act.data.write = write;
+
+	if (pthread_mutex_lock(&userMutex))
+		return 0;
+
+        // This needs to be handled locally for proper interactivity
+        // (consider adding users when nobody is connected).
+        // The mutex and atomic rename keep things in sync.
+
+        struct kasmpasswd_t *set = readkasmpasswd(passwdfile);
+        unsigned s;
+        for (s = 0; s < set->num; s++) {
+          if (!strcmp(set->entries[s].user, act.data.user)) {
+            vlog.error("Can't create user %s, already exists", act.data.user);
+            goto out;
+          }
+        }
+
+        s = set->num++;
+        set->entries = (struct kasmpasswd_entry_t *) realloc(set->entries,
+                                                                 set->num * sizeof(struct kasmpasswd_entry_t));
+        set->entries[s] = act.data;
+
+        writekasmpasswd(passwdfile, set);
+        vlog.info("User %s created", act.data.user);
+out:
+	pthread_mutex_unlock(&userMutex);
+
+	return 1;
+}
+
+uint8_t GetAPIMessager::netRemoveUser(const char name[]) {
+	if (strlen(name) >= USERNAME_LEN) {
+		vlog.error("Username too long");
+		return 0;
+	}
+
+	action_data act;
+	act.action = USER_REMOVE;
+
+	memcpy(act.data.user, name, USERNAME_LEN);
+	act.data.user[USERNAME_LEN - 1] = '\0';
+
+	if (pthread_mutex_lock(&userMutex))
+		return 0;
+
+	actionQueue.push_back(act);
+
+	pthread_mutex_unlock(&userMutex);
+
+	return 1;
+}
+
+uint8_t GetAPIMessager::netGiveControlTo(const char name[]) {
+	if (strlen(name) >= USERNAME_LEN) {
+		vlog.error("Username too long");
+		return 0;
+	}
+
+	action_data act;
+	act.action = USER_GIVE_CONTROL;
+
+	memcpy(act.data.user, name, USERNAME_LEN);
+	act.data.user[USERNAME_LEN - 1] = '\0';
+
+	if (pthread_mutex_lock(&userMutex))
+		return 0;
+
+	actionQueue.push_back(act);
+
+	pthread_mutex_unlock(&userMutex);
+
+	return 1;
+}

common/network/Socket.h

@@ -74,6 +74,8 @@ namespace network {
     virtual ~ConnectionFilter() {}
   };
 
+  class GetAPIMessager;
+
   class SocketListener {
   public:
     SocketListener(int fd);
@@ -93,6 +95,8 @@ namespace network {
     void setFilter(ConnectionFilter* f) {filter = f;}
     int getFd() {return fd;}
 
+    virtual GetAPIMessager *getMessager() { return NULL; }
+
   protected:
     SocketListener();
 

common/network/TcpSocket.cxx

@@ -1,15 +1,15 @@
 /* Copyright (C) 2002-2005 RealVNC Ltd.  All Rights Reserved.
- * 
+ *
  * This is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 2 of the License, or
  * (at your option) any later version.
- * 
+ *
  * This software is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- * 
+ *
  * You should have received a copy of the GNU General Public License
  * along with this software; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307,
@@ -38,9 +38,11 @@
 #include <sys/un.h>
 #include <stdlib.h>
 #include <unistd.h>
+#include <pthread.h>
 #include <wordexp.h>
 #include "websocket.h"
 
+#include <network/GetAPI.h>
 #include <network/TcpSocket.h>
 #include <rfb/LogWriter.h>
 #include <rfb/Configuration.h>
@@ -123,11 +125,20 @@ WebSocket::WebSocket(int sock) : Socket(sock)
 }
 
 char* WebSocket::getPeerAddress() {
-  return rfb::strDup("websocket");
+  struct sockaddr_un addr;
+  socklen_t len = sizeof(struct sockaddr_un);
+  if (getpeername(getFd(), (struct sockaddr *) &addr, &len) != 0) {
+    vlog.error("unable to get peer name for socket");
+    return rfb::strDup("websocket");
+  }
+  return rfb::strDup(addr.sun_path + 1);
 }
 
 char* WebSocket::getPeerEndpoint() {
-  return rfb::strDup("websocket");
+  char buf[1024];
+  sprintf(buf, "%s::websocket", getPeerAddress());
+
+  return rfb::strDup(buf);
 }
 
 // -=- TcpSocket
@@ -421,10 +432,37 @@ int TcpListener::getMyPort() {
 
 extern settings_t settings;
 
+static uint8_t *screenshotCb(void *messager, uint16_t w, uint16_t h, const uint8_t q,
+                             const uint8_t dedup,
+                             uint32_t *len, uint8_t *staging)
+{
+  GetAPIMessager *msgr = (GetAPIMessager *) messager;
+  return msgr->netGetScreenshot(w, h, q, dedup, *len, staging);
+}
+
+static uint8_t adduserCb(void *messager, const char name[], const char pw[],
+                          const uint8_t write)
+{
+  GetAPIMessager *msgr = (GetAPIMessager *) messager;
+  return msgr->netAddUser(name, pw, write);
+}
+
+static uint8_t removeCb(void *messager, const char name[])
+{
+  GetAPIMessager *msgr = (GetAPIMessager *) messager;
+  return msgr->netRemoveUser(name);
+}
+
+static uint8_t givecontrolCb(void *messager, const char name[])
+{
+  GetAPIMessager *msgr = (GetAPIMessager *) messager;
+  return msgr->netGiveControlTo(name);
+}
+
 WebsocketListener::WebsocketListener(const struct sockaddr *listenaddr,
                          socklen_t listenaddrlen,
-                         bool sslonly, const char *cert,
-                         const char *basicauth,
+                         bool sslonly, const char *cert, const char *certkey,
+                         bool disablebasicauth,
                          const char *httpdir)
 {
   int one = 1;
@@ -494,9 +532,9 @@ WebsocketListener::WebsocketListener(const struct sockaddr *listenaddr,
     settings.passwdfile = strdup(wexp.we_wordv[0]);
   wordfree(&wexp);
 
-  settings.basicauth = basicauth;
+  settings.disablebasicauth = disablebasicauth;
   settings.cert = cert;
-  settings.key = "";
+  settings.key = certkey;
   settings.ssl_only = sslonly;
   settings.verbose = vlog.getLevel() >= vlog.LEVEL_DEBUG;
   settings.httpdir = NULL;
@@ -505,6 +543,12 @@ WebsocketListener::WebsocketListener(const struct sockaddr *listenaddr,
 
   settings.listen_sock = sock;
 
+  settings.messager = messager = new GetAPIMessager(settings.passwdfile);
+  settings.screenshotCb = screenshotCb;
+  settings.adduserCb = adduserCb;
+  settings.removeCb = removeCb;
+  settings.givecontrolCb = givecontrolCb;
+
   pthread_t tid;
   pthread_create(&tid, NULL, start_server, NULL);
 }
@@ -673,8 +717,8 @@ void network::createTcpListeners(std::list<SocketListener*> *listeners,
 
 void network::createWebsocketListeners(std::list<SocketListener*> *listeners,
                                  const struct addrinfo *ai,
-                                 bool sslonly, const char *cert,
-                                 const char *basicauth,
+                                 bool sslonly, const char *cert, const char *certkey,
+                                 bool disablebasicauth,
                                  const char *httpdir)
 {
   const struct addrinfo *current;
@@ -701,7 +745,7 @@ void network::createWebsocketListeners(std::list<SocketListener*> *listeners,
     try {
       new_listeners.push_back(new WebsocketListener(current->ai_addr,
                                               current->ai_addrlen,
-                                              sslonly, cert, basicauth,
+                                              sslonly, cert, certkey, disablebasicauth,
                                               httpdir));
     } catch (SocketException& e) {
       // Ignore this if it is due to lack of address family support on
@@ -729,7 +773,8 @@ void network::createWebsocketListeners(std::list<SocketListener*> *listeners,
                                  const char *addr,
                                  bool sslonly,
                                  const char *cert,
-                                 const char *basicauth,
+                                 const char *certkey,
+                                 bool disablebasicauth,
                                  const char *httpdir)
 {
   if (addr && !strcmp(addr, "local")) {
@@ -757,7 +802,7 @@ void network::createWebsocketListeners(std::list<SocketListener*> *listeners,
     ai[1].ai_addrlen = sizeof(sa[1].u.sin6);
     ai[1].ai_next = NULL;
 
-    createWebsocketListeners(listeners, ai, sslonly, cert, basicauth, httpdir);
+    createWebsocketListeners(listeners, ai, sslonly, cert, certkey, disablebasicauth, httpdir);
   } else {
     struct addrinfo *ai, hints;
     char service[16];
@@ -780,7 +825,7 @@ void network::createWebsocketListeners(std::list<SocketListener*> *listeners,
                            gai_strerror(result));
 
     try {
-      createWebsocketListeners(listeners, ai, sslonly, cert, basicauth, httpdir);
+      createWebsocketListeners(listeners, ai, sslonly, cert, certkey, disablebasicauth, httpdir);
     } catch(...) {
       freeaddrinfo(ai);
       throw;

common/network/TcpSocket.h

@@ -90,7 +90,8 @@ namespace network {
   class WebsocketListener : public SocketListener {
   public:
     WebsocketListener(const struct sockaddr *listenaddr, socklen_t listenaddrlen,
-                      bool sslonly, const char *cert, const char *basicauth,
+                      bool sslonly, const char *cert, const char *certkey,
+                      bool disablebasicauth,
                       const char *httpdir);
 
     virtual int getMyPort();
@@ -99,8 +100,12 @@ namespace network {
 
     int internalSocket;
 
+    virtual GetAPIMessager *getMessager() { return messager; }
+
   protected:
     virtual Socket* createSocket(int fd);
+  private:
+    GetAPIMessager *messager;
   };
 
   void createLocalTcpListeners(std::list<SocketListener*> *listeners,
@@ -110,7 +115,8 @@ namespace network {
                           const char *addr,
                           bool sslonly,
                           const char *cert,
-                          const char *basicauth,
+                          const char *certkey,
+                          bool disablebasicauth,
                           const char *httpdir);
   void createTcpListeners(std::list<SocketListener*> *listeners,
                           const char *addr,
@@ -121,7 +127,8 @@ namespace network {
                           const struct addrinfo *ai,
                           bool sslonly,
                           const char *cert,
-                          const char *basicauth,
+                          const char *certkey,
+                          bool disablebasicauth,
                           const char *httpdir);
 
   typedef struct vnc_sockaddr {

common/network/websocket.c

@@ -9,8 +9,10 @@
  */
 #define _GNU_SOURCE
 
+#include <ctype.h>
 #include <pthread.h>
 #include <unistd.h>
+#include <crypt.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <errno.h>
@@ -29,6 +31,7 @@
 #include <openssl/md5.h> /* md5 hash */
 #include <openssl/sha.h> /* sha1 hash */
 #include "websocket.h"
+#include "kasmpasswd.h"
 
 /*
  * Global state
@@ -58,29 +61,78 @@ void fatal(char *msg)
     exit(1);
 }
 
-/* resolve host with also IP address parsing */ 
-int resolve_host(struct in_addr *sin_addr, const char *hostname) 
-{ 
-    if (!inet_aton(hostname, sin_addr)) { 
-        struct addrinfo *ai, *cur; 
-        struct addrinfo hints; 
-        memset(&hints, 0, sizeof(hints)); 
-        hints.ai_family = AF_INET; 
-        if (getaddrinfo(hostname, NULL, &hints, &ai)) 
-            return -1; 
-        for (cur = ai; cur; cur = cur->ai_next) { 
-            if (cur->ai_family == AF_INET) { 
-                *sin_addr = ((struct sockaddr_in *)cur->ai_addr)->sin_addr; 
-                freeaddrinfo(ai); 
-                return 0; 
-            } 
-        } 
-        freeaddrinfo(ai); 
-        return -1; 
-    } 
-    return 0; 
-} 
+/* resolve host with also IP address parsing */
+int resolve_host(struct in_addr *sin_addr, const char *hostname)
+{
+    if (!inet_aton(hostname, sin_addr)) {
+        struct addrinfo *ai, *cur;
+        struct addrinfo hints;
+        memset(&hints, 0, sizeof(hints));
+        hints.ai_family = AF_INET;
+        if (getaddrinfo(hostname, NULL, &hints, &ai))
+            return -1;
+        for (cur = ai; cur; cur = cur->ai_next) {
+            if (cur->ai_family == AF_INET) {
+                *sin_addr = ((struct sockaddr_in *)cur->ai_addr)->sin_addr;
+                freeaddrinfo(ai);
+                return 0;
+            }
+        }
+        freeaddrinfo(ai);
+        return -1;
+    }
+    return 0;
+}
 
+static const char *parse_get(const char * const in, const char * const opt, unsigned *len) {
+	const char *start = in;
+	const char *end = strchrnul(start, '&');
+	const unsigned optlen = strlen(opt);
+	*len = 0;
+
+	while (1) {
+		if (!strncmp(start, opt, optlen)) {
+			const char *arg = strchr(start, '=');
+			if (!arg)
+				return "";
+			arg++;
+			*len = end - arg;
+			return arg;
+		}
+
+		if (!*end)
+			break;
+
+		end++;
+		start = end;
+		end = strchrnul(start, '&');
+	}
+
+	return "";
+}
+
+static void percent_decode(const char *src, char *dst) {
+	while (1) {
+		if (!*src)
+			break;
+		if (*src != '%') {
+			*dst++ = *src++;
+		} else {
+			src++;
+			if (!src[0] || !src[1])
+				break;
+			char hex[3];
+			hex[0] = src[0];
+			hex[1] = src[1];
+			hex[2] = '\0';
+
+			src += 2;
+			*dst++ = strtol(hex, NULL, 16);
+		}
+	}
+
+	*dst = '\0';
+}
 
 /*
  * SSL Wrapper Code
@@ -106,7 +158,7 @@ ssize_t ws_send(ws_ctx_t *ctx, const void *buf, size_t len) {
 
 ws_ctx_t *alloc_ws_ctx() {
     ws_ctx_t *ctx;
-    if (! (ctx = malloc(sizeof(ws_ctx_t))) )
+    if (! (ctx = calloc(sizeof(ws_ctx_t), 1)) )
         { fatal("malloc()"); }
 
     if (! (ctx->cin_buf = malloc(BUFSIZE)) )
@@ -160,12 +212,14 @@ ws_ctx_t *ws_socket_ssl(ws_ctx_t *ctx, int socket, char * certfile, char * keyfi
 
     }
 
-    ctx->ssl_ctx = SSL_CTX_new(TLSv1_server_method());
+    ctx->ssl_ctx = SSL_CTX_new(SSLv23_server_method());
     if (ctx->ssl_ctx == NULL) {
         ERR_print_errors_fp(stderr);
         fatal("Failed to configure SSL context");
     }
 
+    SSL_CTX_set_options(ctx->ssl_ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3);
+
     if (SSL_CTX_use_PrivateKey_file(ctx->ssl_ctx, use_keyfile,
                                     SSL_FILETYPE_PEM) <= 0) {
         sprintf(msg, "Unable to load private key file %s\n", use_keyfile);
@@ -305,7 +359,7 @@ int decode_hixie(char *src, size_t srclength,
     *left = srclength;
 
     if (srclength == 2 &&
-        (src[0] == '\xff') && 
+        (src[0] == '\xff') &&
         (src[1] == '\x00')) {
         // client sent orderly close frame
         *opcode = 0x8; // Close frame
@@ -323,7 +377,7 @@ int decode_hixie(char *src, size_t srclength,
             return len;
         }
         retlen += len;
-        start = end + 2; // Skip '\xff' end and '\x00' start 
+        start = end + 2; // Skip '\xff' end and '\x00' start
         framecount++;
     } while (end < (src+srclength-1));
     if (framecount > 1) {
@@ -396,7 +450,7 @@ int decode_hybi(unsigned char *src, size_t srclength,
     int i = 0, len, framecount = 0;
     size_t remaining = 0;
     unsigned int target_offset = 0, hdr_length = 0, payload_length = 0;
-    
+
     *left = srclength;
     frame = src;
 
@@ -496,7 +550,7 @@ int decode_hybi(unsigned char *src, size_t srclength,
         snprintf(cntstr, 3, "%d", framecount);
         traffic(cntstr);
     }
-    
+
     *left = remaining;
     return target_offset;
 }
@@ -540,7 +594,7 @@ int parse_handshake(ws_ctx_t *ws_ctx, char *handshake) {
     end = strstr(start, "\r\n");
     strncpy(headers->origin, start, end-start);
     headers->origin[end-start] = '\0';
-   
+
     start = strstr(handshake, "\r\nSec-WebSocket-Version: ");
     if (start) {
         // HyBi/RFC 6455
@@ -557,14 +611,14 @@ int parse_handshake(ws_ctx_t *ws_ctx, char *handshake) {
         end = strstr(start, "\r\n");
         strncpy(headers->key1, start, end-start);
         headers->key1[end-start] = '\0';
-   
+
         start = strstr(handshake, "\r\nConnection: ");
         if (!start) { return 0; }
         start += 14;
         end = strstr(start, "\r\n");
         strncpy(headers->connection, start, end-start);
         headers->connection[end-start] = '\0';
-   
+
         start = strstr(handshake, "\r\nSec-WebSocket-Protocol: ");
         if (!start) { return 0; }
         start += 26;
@@ -589,7 +643,7 @@ int parse_handshake(ws_ctx_t *ws_ctx, char *handshake) {
             end = strstr(start, "\r\n");
             strncpy(headers->key1, start, end-start);
             headers->key1[end-start] = '\0';
-        
+
             start = strstr(handshake, "\r\nSec-WebSocket-Key2: ");
             if (!start) { return 0; }
             start += 22;
@@ -810,6 +864,226 @@ nope:
     ws_send(ws_ctx, buf, strlen(buf));
 }
 
+static uint8_t ownerapi(ws_ctx_t *ws_ctx, const char *in) {
+    char buf[4096], path[4096], args[4096] = "";
+    uint8_t ret = 0; // 0 = continue checking
+
+    if (strncmp(in, "GET ", 4)) {
+        wserr("non-GET request, rejecting\n");
+        return 0;
+    }
+    in += 4;
+    const char *end = strchr(in, ' ');
+    unsigned len = end - in;
+
+    if (len < 1 || len > 1024 || strstr(in, "../")) {
+        wserr("Request too long (%u) or attempted dir traversal attack, rejecting\n", len);
+        return 0;
+    }
+
+    end = memchr(in, '?', len);
+    if (end) {
+        len = end - in;
+        end++;
+
+        const char *argend = strchr(end, ' ');
+        strncpy(args, end, argend - end);
+        args[argend - end] = '\0';
+    }
+
+    memcpy(path, in, len);
+    path[len] = '\0';
+
+    if (strstr(args, "password=")) {
+        wserr("Requested owner api '%s' with args (skipped, includes password)\n", path);
+    } else {
+        wserr("Requested owner api '%s' with args '%s'\n", path, args);
+    }
+
+    #define entry(x) if (!strcmp(path, x))
+
+    const char *param;
+
+    entry("/api/get_screenshot") {
+        uint8_t q = 7, dedup = 0;
+        uint16_t w = 4096, h = 4096;
+
+        param = parse_get(args, "width", &len);
+        if (len && isdigit(param[0]))
+            w = atoi(param);
+
+        param = parse_get(args, "height", &len);
+        if (len && isdigit(param[0]))
+            h = atoi(param);
+
+        param = parse_get(args, "quality", &len);
+        if (len && isdigit(param[0]))
+            q = atoi(param);
+
+        param = parse_get(args, "deduplicate", &len);
+        if (len && isalpha(param[0])) {
+            if (!strncmp(param, "true", len))
+                dedup = 1;
+        }
+
+        uint8_t *staging = malloc(1024 * 1024 * 8);
+
+        settings.screenshotCb(settings.messager, w, h, q, dedup, &len, staging);
+
+        if (len == 16) {
+            sprintf(buf, "HTTP/1.1 200 OK\r\n"
+                     "Server: KasmVNC/4.0\r\n"
+                     "Connection: close\r\n"
+                     "Content-type: text/plain\r\n"
+                     "Content-length: %u\r\n"
+                     "\r\n", len);
+            ws_send(ws_ctx, buf, strlen(buf));
+            ws_send(ws_ctx, staging, len);
+
+            wserr("Screenshot hadn't changed and dedup was requested, sent hash\n");
+            ret = 1;
+        } else if (len) {
+            sprintf(buf, "HTTP/1.1 200 OK\r\n"
+                     "Server: KasmVNC/4.0\r\n"
+                     "Connection: close\r\n"
+                     "Content-type: image/jpeg\r\n"
+                     "Content-length: %u\r\n"
+                     "\r\n", len);
+            ws_send(ws_ctx, buf, strlen(buf));
+            ws_send(ws_ctx, staging, len);
+
+            wserr("Sent screenshot %u bytes\n", len);
+            ret = 1;
+        }
+
+        free(staging);
+
+        if (!len) {
+            wserr("Invalid params to screenshot\n");
+            goto nope;
+        }
+    } else entry("/api/create_user") {
+        char decname[1024] = "", decpw[1024] = "";
+        uint8_t write = 0;
+
+        param = parse_get(args, "name", &len);
+        if (len) {
+            memcpy(buf, param, len);
+            buf[len] = '\0';
+            percent_decode(buf, decname);
+        }
+
+        param = parse_get(args, "password", &len);
+        if (len) {
+            memcpy(buf, param, len);
+            buf[len] = '\0';
+            percent_decode(buf, decpw);
+
+            struct crypt_data cdata;
+            cdata.initialized = 0;
+
+            const char *encrypted = crypt_r(decpw, "$5$kasm$", &cdata);
+            strcpy(decpw, encrypted);
+        }
+
+        param = parse_get(args, "write", &len);
+        if (len && isalpha(param[0])) {
+            if (!strncmp(param, "true", len))
+                write = 1;
+        }
+
+        if (!decname[0] || !decpw[0])
+            goto nope;
+
+        if (!settings.adduserCb(settings.messager, decname, decpw, write)) {
+            wserr("Invalid params to create_user\n");
+            goto nope;
+        }
+
+        sprintf(buf, "HTTP/1.1 200 OK\r\n"
+                 "Server: KasmVNC/4.0\r\n"
+                 "Connection: close\r\n"
+                 "Content-type: text/plain\r\n"
+                 "Content-length: 6\r\n"
+                 "\r\n"
+                 "200 OK");
+        ws_send(ws_ctx, buf, strlen(buf));
+
+        ret = 1;
+    } else entry("/api/remove_user") {
+        char decname[1024] = "";
+
+        param = parse_get(args, "name", &len);
+        if (len) {
+            memcpy(buf, param, len);
+            buf[len] = '\0';
+            percent_decode(buf, decname);
+        }
+
+        if (!decname[0])
+            goto nope;
+
+        if (!settings.removeCb(settings.messager, decname)) {
+            wserr("Invalid params to remove_user\n");
+            goto nope;
+        }
+
+        sprintf(buf, "HTTP/1.1 200 OK\r\n"
+                 "Server: KasmVNC/4.0\r\n"
+                 "Connection: close\r\n"
+                 "Content-type: text/plain\r\n"
+                 "Content-length: 6\r\n"
+                 "\r\n"
+                 "200 OK");
+        ws_send(ws_ctx, buf, strlen(buf));
+
+        wserr("Passed remove_user request to main thread\n");
+        ret = 1;
+    } else entry("/api/give_control") {
+        char decname[1024] = "";
+
+        param = parse_get(args, "name", &len);
+        if (len) {
+            memcpy(buf, param, len);
+            buf[len] = '\0';
+            percent_decode(buf, decname);
+        }
+
+        if (!decname[0])
+            goto nope;
+
+        if (!settings.givecontrolCb(settings.messager, decname)) {
+            wserr("Invalid params to give_control\n");
+            goto nope;
+        }
+
+        sprintf(buf, "HTTP/1.1 200 OK\r\n"
+                 "Server: KasmVNC/4.0\r\n"
+                 "Connection: close\r\n"
+                 "Content-type: text/plain\r\n"
+                 "Content-length: 6\r\n"
+                 "\r\n"
+                 "200 OK");
+        ws_send(ws_ctx, buf, strlen(buf));
+
+        wserr("Passed give_control request to main thread\n");
+        ret = 1;
+    }
+
+    #undef entry
+
+    return ret;
+nope:
+    sprintf(buf, "HTTP/1.1 400 Bad Request\r\n"
+                 "Server: KasmVNC/4.0\r\n"
+                 "Connection: close\r\n"
+                 "Content-type: text/plain\r\n"
+                 "\r\n"
+                 "400 Bad Request");
+    ws_send(ws_ctx, buf, strlen(buf));
+    return 1;
+}
+
 ws_ctx_t *do_handshake(int sock) {
     char handshake[4096], response[4096], sha1[29], trailer[17];
     char *scheme, *pre;
@@ -878,8 +1152,8 @@ ws_ctx_t *do_handshake(int sock) {
         usleep(10);
     }
 
-    const char *colon;
-    if ((colon = strchr(settings.basicauth, ':'))) {
+    unsigned char owner = 0;
+    if (!settings.disablebasicauth) {
         const char *hdr = strstr(handshake, "Authorization: Basic ");
         if (!hdr) {
             handler_emsg("BasicAuth required, but client didn't send any. 401 Unauth\n");
@@ -904,40 +1178,56 @@ ws_ctx_t *do_handshake(int sock) {
         tmp[len] = '\0';
         len = ws_b64_pton(tmp, response, 256);
 
-        char authbuf[4096];
-        strncpy(authbuf, settings.basicauth, 4096);
-        authbuf[4095] = '\0';
+        char authbuf[4096] = "";
 
         // Do we need to read it from the file?
         char *resppw = strchr(response, ':');
         if (resppw && *resppw)
             resppw++;
-        if (!colon[1] && settings.passwdfile) {
-            if (resppw && *resppw) {
+        if (settings.passwdfile) {
+            if (resppw && *resppw && resppw - response < 32) {
                 char pwbuf[4096];
-                FILE *f = fopen(settings.passwdfile, "r");
-                if (f) {
-                    handler_emsg("BasicAuth reading password from %s\n", settings.passwdfile);
-                    const unsigned len = fread(pwbuf, 1, 4096, f);
-                    fclose(f);
-                    pwbuf[4095] = '\0';
-                    if (len < 4096)
-                        pwbuf[len] = '\0';
-
-                    snprintf(authbuf, 4096, "%s%s", settings.basicauth, pwbuf);
-                    authbuf[4095] = '\0';
-
-                    const char *encrypted = crypt(resppw, "$5$kasm$");
-                    *resppw = '\0';
-
-                    snprintf(pwbuf, 4096, "%s%s", response, encrypted);
-                    pwbuf[4095] = '\0';
-                    strcpy(response, pwbuf);
-                } else {
-                    fprintf(stderr, " websocket %d: Error: BasicAuth configured to read password from file %s, but the file doesn't exist\n",
+                struct kasmpasswd_t *set = readkasmpasswd(settings.passwdfile);
+                if (!set->num) {
+                    fprintf(stderr, " websocket %d: Error: BasicAuth configured to read password from file %s, but the file doesn't exist or has no valid users\n",
                             wsthread_handler_id,
                             settings.passwdfile);
+                } else {
+                    unsigned i;
+                    char inuser[32];
+                    unsigned char found = 0;
+                    memcpy(inuser, response, resppw - response - 1);
+                    inuser[resppw - response - 1] = '\0';
+
+                    for (i = 0; i < set->num; i++) {
+                        if (!strcmp(set->entries[i].user, inuser)) {
+                            found = 1;
+                            strcpy(ws_ctx->user, inuser);
+                            snprintf(authbuf, 4096, "%s:%s", set->entries[i].user,
+                                     set->entries[i].password);
+                            authbuf[4095] = '\0';
+
+                            if (set->entries[i].owner)
+                                owner = 1;
+                            break;
+                        }
+                    }
+
+                    if (!found)
+                        handler_emsg("BasicAuth user %s not found\n", inuser);
                 }
+                free(set->entries);
+                free(set);
+
+                struct crypt_data cdata;
+                cdata.initialized = 0;
+
+                const char *encrypted = crypt_r(resppw, "$5$kasm$", &cdata);
+                *resppw = '\0';
+
+                snprintf(pwbuf, 4096, "%s%s", response, encrypted);
+                pwbuf[4095] = '\0';
+                strcpy(response, pwbuf);
             } else {
                 // Client tried an empty password, just fail them
                 response[0] = '\0';
@@ -959,9 +1249,28 @@ ws_ctx_t *do_handshake(int sock) {
     if (!parse_handshake(ws_ctx, handshake)) {
         handler_emsg("Invalid WS request, maybe a HTTP one\n");
 
+        if (strstr(handshake, "/api/")) {
+            handler_emsg("HTTP request under /api/\n");
+
+            if (owner) {
+                if (ownerapi(ws_ctx, handshake))
+                    goto done;
+            } else {
+                sprintf(response, "HTTP/1.1 401 Unauthorized\r\n"
+                        "Server: KasmVNC/4.0\r\n"
+                        "Connection: close\r\n"
+                        "Content-type: text/plain\r\n"
+                        "\r\n"
+                        "401 Unauthorized");
+                ws_send(ws_ctx, response, strlen(response));
+                goto done;
+            }
+        }
+
         if (settings.httpdir && settings.httpdir[0])
             servefile(ws_ctx, handshake);
 
+done:
         free_ws_ctx(ws_ctx);
         return NULL;
     }
@@ -995,7 +1304,7 @@ ws_ctx_t *do_handshake(int sock) {
         snprintf(response, sizeof(response), SERVER_HANDSHAKE_HIXIE, pre, headers->origin,
                  pre, scheme, headers->host, headers->path, pre, "base64", trailer);
     }
-    
+
     //handler_msg("response: %s\n", response);
     ws_send(ws_ctx, response, strlen(response));
 
@@ -1012,7 +1321,6 @@ void *subthread(void *ptr) {
 
     const int csock = pass->csock;
     wsthread_handler_id = pass->id;
-    free((void *) pass);
 
     ws_ctx_t *ws_ctx;
 
@@ -1022,11 +1330,14 @@ void *subthread(void *ptr) {
         goto out;   // Child process exits
     }
 
+    memcpy(ws_ctx->ip, pass->ip, sizeof(pass->ip));
+
     proxy_handler(ws_ctx);
     if (pipe_error) {
         handler_emsg("Closing due to SIGPIPE\n");
     }
 out:
+    free((void *) pass);
 
     if (ws_ctx) {
         ws_socket_free(ws_ctx);
@@ -1062,12 +1373,13 @@ void *start_server(void *unused) {
             error("ERROR on accept");
             continue;
         }
+        struct wspass_t *pass = calloc(1, sizeof(struct wspass_t));
+        inet_ntop(cli_addr.sin_family, &cli_addr.sin_addr, pass->ip, sizeof(pass->ip));
         fprintf(stderr, " websocket %d: got client connection from %s\n",
                     settings.handler_id,
-                    inet_ntoa(cli_addr.sin_addr));
+                    pass->ip);
 
         pthread_t tid;
-        struct wspass_t *pass = calloc(1, sizeof(struct wspass_t));
         pass->id = settings.handler_id;
         pass->csock = csock;
         pthread_create(&tid, NULL, subthread, pass);

common/network/websocket.h

@@ -1,4 +1,5 @@
 #include <openssl/ssl.h>
+#include <stdint.h>
 
 #define BUFSIZE 65536
 #define DBUFSIZE (BUFSIZE * 3) / 4 - 20
@@ -53,11 +54,15 @@ typedef struct {
     char      *cout_buf;
     char      *tin_buf;
     char      *tout_buf;
+
+    char      user[32];
+    char      ip[64];
 } ws_ctx_t;
 
 struct wspass_t {
     int csock;
     unsigned id;
+    char ip[64];
 };
 
 typedef struct {
@@ -66,10 +71,19 @@ typedef struct {
     unsigned int handler_id;
     const char *cert;
     const char *key;
-    const char *basicauth;
+    uint8_t disablebasicauth;
     const char *passwdfile;
     int ssl_only;
     const char *httpdir;
+
+    void *messager;
+    uint8_t *(*screenshotCb)(void *messager, uint16_t w, uint16_t h, const uint8_t q,
+                             const uint8_t dedup,
+                             uint32_t *len, uint8_t *staging);
+    uint8_t (*adduserCb)(void *messager, const char name[], const char pw[],
+                          const uint8_t write);
+    uint8_t (*removeCb)(void *messager, const char name[]);
+    uint8_t (*givecontrolCb)(void *messager, const char name[]);
 } settings_t;
 
 #ifdef __cplusplus

common/network/websockify.c

@@ -227,7 +227,13 @@ void proxy_handler(ws_ctx_t *ws_ctx) {
     strcpy(addr.sun_path, ".KasmVNCSock");
     addr.sun_path[0] = '\0';
 
+    struct sockaddr_un myaddr;
+    myaddr.sun_family = AF_UNIX;
+    sprintf(myaddr.sun_path, ".%s@%s", ws_ctx->user, ws_ctx->ip);
+    myaddr.sun_path[0] = '\0';
+
     int tsock = socket(AF_UNIX, SOCK_STREAM, 0);
+    bind(tsock, (struct sockaddr *) &myaddr, sizeof(struct sockaddr_un));
 
     handler_msg("connecting to VNC target\n");
 

common/rfb/CMakeLists.txt

@@ -1,4 +1,5 @@
-include_directories(${CMAKE_SOURCE_DIR}/common ${JPEG_INCLUDE_DIR})
+include_directories(${CMAKE_SOURCE_DIR}/common ${JPEG_INCLUDE_DIR}
+                    ${CMAKE_SOURCE_DIR}/unix/kasmvncpasswd)
 
 set(RFB_SOURCES
   Blacklist.cxx

common/rfb/Configuration.cxx

@@ -433,8 +433,7 @@ bool StringParameter::setParam(const char* v) {
   if (immutable) return true;
   if (!v)
     throw rfb::Exception("setParam(<null>) not allowed");
-  if (strcasecmp(getName(), "BasicAuth")) // don't log the auth info
-    vlog.debug("set %s(String) to %s", getName(), v);
+  vlog.debug("set %s(String) to %s", getName(), v);
   CharArray oldValue(value);
   value = strDup(v);
   return value != 0;

common/rfb/ConnParams.cxx

@@ -26,6 +26,7 @@
 #include <rfb/ledStates.h>
 #include <rfb/ConnParams.h>
 #include <rfb/ServerCore.h>
+#include <rfb/SMsgHandler.h>
 #include <rfb/util.h>
 
 using namespace rfb;
@@ -43,7 +44,7 @@ ConnParams::ConnParams()
     supportsContinuousUpdates(false),
     compressLevel(2), qualityLevel(-1), fineQualityLevel(-1),
     subsampling(subsampleUndefined), name_(0), verStrPos(0),
-    ledState_(ledUnknown)
+    ledState_(ledUnknown), shandler(NULL)
 {
   memset(kasmPassed, 0, KASM_NUM_SETTINGS);
   setName("");
@@ -124,6 +125,8 @@ void ConnParams::setEncodings(int nEncodings, const rdr::S32* encodings)
   encodings_.clear();
   encodings_.insert(encodingRaw);
 
+  bool canChangeSettings = !shandler || shandler->canChangeKasmSettings();
+
   for (int i = nEncodings-1; i >= 0; i--) {
     switch (encodings[i]) {
     case encodingCopyRect:
@@ -184,11 +187,11 @@ void ConnParams::setEncodings(int nEncodings, const rdr::S32* encodings)
       subsampling = subsample16X;
       break;
     case pseudoEncodingPreferBandwidth:
-      if (!rfb::Server::ignoreClientSettingsKasm)
+      if (!rfb::Server::ignoreClientSettingsKasm && canChangeSettings)
         Server::preferBandwidth.setParam();
       break;
     case pseudoEncodingMaxVideoResolution:
-      if (!rfb::Server::ignoreClientSettingsKasm)
+      if (!rfb::Server::ignoreClientSettingsKasm && canChangeSettings)
         kasmPassed[KASM_MAX_VIDEO_RESOLUTION] = true;
       break;
     }
@@ -205,7 +208,7 @@ void ConnParams::setEncodings(int nEncodings, const rdr::S32* encodings)
         encodings[i] <= pseudoEncodingFineQualityLevel100)
       fineQualityLevel = encodings[i] - pseudoEncodingFineQualityLevel0;
 
-    if (!rfb::Server::ignoreClientSettingsKasm) {
+    if (!rfb::Server::ignoreClientSettingsKasm && canChangeSettings) {
       if (encodings[i] >= pseudoEncodingJpegVideoQualityLevel0 &&
           encodings[i] <= pseudoEncodingJpegVideoQualityLevel9)
           Server::jpegVideoQuality.setParam(encodings[i] - pseudoEncodingJpegVideoQualityLevel0);

common/rfb/ConnParams.h

@@ -42,6 +42,8 @@ namespace rfb {
   const int subsample8X = 4;
   const int subsample16X = 5;
 
+  class SMsgHandler;
+
   class ConnParams {
   public:
     ConnParams();
@@ -74,6 +76,8 @@ namespace rfb {
     const PixelFormat& pf() const { return pf_; }
     void setPF(const PixelFormat& pf);
 
+    void setSHandler(SMsgHandler *s) { shandler = s; }
+
     const char* name() const { return name_; }
     void setName(const char* name);
 
@@ -136,6 +140,7 @@ namespace rfb {
     char verStr[13];
     int verStrPos;
     unsigned int ledState_;
+    SMsgHandler *shandler;
   };
 }
 #endif

common/rfb/EncodeManager.cxx

@@ -966,7 +966,7 @@ static PixelBuffer *bilinearScale(const PixelBuffer *pb, const uint16_t w, const
   return newpb;
 }
 
-static PixelBuffer *progressiveBilinearScale(const PixelBuffer *pb,
+PixelBuffer *progressiveBilinearScale(const PixelBuffer *pb,
                                  const uint16_t tgtw, const uint16_t tgth,
                                  const float tgtdiff)
 {
@@ -1181,38 +1181,13 @@ uint8_t EncodeManager::getEncoderType(const Rect& rect, const PixelBuffer *pb,
                                       const PixelBuffer *scaledpb, const Rect& scaledrect) const
 {
   struct RectInfo info;
-  unsigned int divisor, maxColours;
+  unsigned int maxColours = 256;
   PixelBuffer *ppb;
   Encoder *encoder;
 
   bool useRLE;
   EncoderType type;
 
-  // FIXME: This is roughly the algorithm previously used by the Tight
-  //        encoder. It seems a bit backwards though, that higher
-  //        compression setting means spending less effort in building
-  //        a palette. It might be that they figured the increase in
-  //        zlib setting compensated for the loss.
-  if (conn->cp.compressLevel == -1)
-    divisor = 2 * 8;
-  else
-    divisor = conn->cp.compressLevel * 8;
-  if (divisor < 4)
-    divisor = 4;
-
-  maxColours = rect.area()/divisor;
-
-  // Special exception inherited from the Tight encoder
-  if (activeEncoders[encoderFullColour] == encoderTightJPEG) {
-    if ((conn->cp.compressLevel != -1) && (conn->cp.compressLevel < 2))
-      maxColours = 24;
-    else
-      maxColours = 96;
-  }
-
-  if (maxColours < 2)
-    maxColours = 2;
-
   encoder = encoders[activeEncoders[encoderIndexedRLE]];
   if (maxColours > encoder->maxPaletteSize)
     maxColours = encoder->maxPaletteSize;

common/rfb/InputHandler.h

@@ -36,7 +36,9 @@ namespace rfb {
                           rdr::U32 __unused_attr keycode,
                           bool __unused_attr down) { }
     virtual void pointerEvent(const Point& __unused_attr pos,
-                              int __unused_attr buttonMask) { }
+		              int __unused_attr buttonMask,
+                              const bool __unused_attr skipClick,
+                              const bool __unused_attr skipRelease) { }
     virtual void clientCutText(const char* __unused_attr str,
                                int __unused_attr len) { }
   };

common/rfb/SMsgHandler.cxx

@@ -24,6 +24,7 @@ using namespace rfb;
 
 SMsgHandler::SMsgHandler()
 {
+  cp.setSHandler(this);
 }
 
 SMsgHandler::~SMsgHandler()

common/rfb/SMsgHandler.h

@@ -56,6 +56,8 @@ namespace rfb {
 
     virtual void sendStats() = 0;
 
+    virtual bool canChangeKasmSettings() const = 0;
+
     // InputHandler interface
     // The InputHandler methods will be called for the corresponding messages.
 

common/rfb/SMsgReader.cxx

@@ -151,7 +151,7 @@ void SMsgReader::readSetMaxVideoResolution()
   width = is->readU16();
   height = is->readU16();
 
-  if (!rfb::Server::ignoreClientSettingsKasm) {
+  if (!rfb::Server::ignoreClientSettingsKasm && handler->canChangeKasmSettings()) {
     sprintf(tmp, "%ux%u", width, height);
     rfb::Server::maxVideoResolution.setParam(tmp);
   }
@@ -217,7 +217,7 @@ void SMsgReader::readPointerEvent()
   int mask = is->readU8();
   int x = is->readU16();
   int y = is->readU16();
-  handler->pointerEvent(Point(x, y), mask);
+  handler->pointerEvent(Point(x, y), mask, false, false);
 }
 
 

common/rfb/ServerCore.cxx

@@ -163,6 +163,19 @@ rfb::StringParameter rfb::Server::DLP_ClipLog
 ("DLP_Log",
  "Log clipboard/kbd actions. Accepts off, info or verbose",
  "off");
+rfb::StringParameter rfb::Server::DLP_Region
+("DLP_Region",
+ "Black out anything outside this region",
+ "");
+
+rfb::BoolParameter rfb::Server::DLP_RegionAllowClick
+("DLP_RegionAllowClick",
+ "Allow clicks inside the blacked-out region",
+ false);
+rfb::BoolParameter rfb::Server::DLP_RegionAllowRelease
+("DLP_RegionAllowRelease",
+ "Allow click releases inside the blacked-out region",
+ true);
 
 rfb::StringParameter rfb::Server::maxVideoResolution
 ("MaxVideoResolution",

common/rfb/ServerCore.h

@@ -49,6 +49,9 @@ namespace rfb {
     static IntParameter DLP_ClipDelay;
     static IntParameter DLP_KeyRateLimit;
     static StringParameter DLP_ClipLog;
+    static StringParameter DLP_Region;
+    static BoolParameter DLP_RegionAllowClick;
+    static BoolParameter DLP_RegionAllowRelease;
     static IntParameter jpegVideoQuality;
     static IntParameter webpVideoQuality;
     static StringParameter maxVideoResolution;

common/rfb/VNCSConnectionST.cxx

@@ -38,6 +38,9 @@
 #include <ctype.h>
 #include <stdlib.h>
 #include <stdint.h>
+#include <wordexp.h>
+
+#include "kasmpasswd.h"
 
 using namespace rfb;
 
@@ -45,6 +48,8 @@ static LogWriter vlog("VNCSConnST");
 
 static Cursor emptyCursor(0, 0, Point(0, 0), NULL);
 
+extern rfb::BoolParameter disablebasicauth;
+
 VNCSConnectionST::VNCSConnectionST(VNCServerST* server_, network::Socket *s,
                                    bool reverse)
   : sock(s), reverseConnection(reverse),
@@ -54,7 +59,7 @@ VNCSConnectionST::VNCSConnectionST(VNCServerST* server_, network::Socket *s,
     losslessTimer(this), kbdLogTimer(this), server(server_), updates(false),
     updateRenderedCursor(false), removeRenderedCursor(false),
     continuousUpdates(false), encodeManager(this, &server_->encCache),
-    pointerEventTime(0),
+    needsPermCheck(false), pointerEventTime(0),
     clientHasCursor(false),
     accessRights(AccessDefault), startTime(time(0))
 {
@@ -65,10 +70,31 @@ VNCSConnectionST::VNCSConnectionST(VNCServerST* server_, network::Socket *s,
   memset(bstats_total, 0, sizeof(bstats_total));
   gettimeofday(&connStart, NULL);
 
+  // Check their permissions, if applicable
+  kasmpasswdpath[0] = '\0';
+  wordexp_t wexp;
+  if (!wordexp(rfb::Server::kasmPasswordFile, &wexp, WRDE_NOCMD))
+    strncpy(kasmpasswdpath, wexp.we_wordv[0], 4096);
+  kasmpasswdpath[4095] = '\0';
+  wordfree(&wexp);
+
+  user[0] = '\0';
+  const char *at = strchr(peerEndpoint.buf, '@');
+  if (at && at - peerEndpoint.buf > 1 && at - peerEndpoint.buf < 32) {
+    memcpy(user, peerEndpoint.buf, at - peerEndpoint.buf);
+    user[at - peerEndpoint.buf] = '\0';
+  }
+
+  bool write, owner;
+  if (!getPerms(write, owner) || !write)
+    accessRights = (accessRights & ~(AccessPtrEvents | AccessKeyEvents | AccessSetDesktopSize));
+
   // Configure the socket
   setSocketTimeouts();
   lastEventTime = time(0);
   gettimeofday(&lastRealUpdate, NULL);
+  gettimeofday(&lastClipboardOp, NULL);
+  gettimeofday(&lastKeyEvent, NULL);
 
   server->clients.push_front(this);
 }
@@ -611,7 +637,7 @@ void VNCSConnectionST::setPixelFormat(const PixelFormat& pf)
   setCursor();
 }
 
-void VNCSConnectionST::pointerEvent(const Point& pos, int buttonMask)
+void VNCSConnectionST::pointerEvent(const Point& pos, int buttonMask, const bool skipClick, const bool skipRelease)
 {
   pointerEventTime = lastEventTime = time(0);
   server->lastUserInputTime = lastEventTime;
@@ -623,7 +649,23 @@ void VNCSConnectionST::pointerEvent(const Point& pos, int buttonMask)
       server->pointerClient = this;
     else
       server->pointerClient = 0;
-    server->desktop->pointerEvent(pointerEventPos, buttonMask);
+
+    bool skipclick = false, skiprelease = false;
+    if (server->DLPRegion.enabled) {
+      rdr::U16 x1, y1, x2, y2;
+      server->translateDLPRegion(x1, y1, x2, y2);
+
+      if (pos.x < x1 || pos.x >= x2 ||
+          pos.y < y1 || pos.y >= y2) {
+
+          if (!Server::DLP_RegionAllowClick)
+            skipclick = true;
+          if (!Server::DLP_RegionAllowRelease)
+            skiprelease = true;
+      }
+    }
+
+    server->desktop->pointerEvent(pointerEventPos, buttonMask, skipclick, skiprelease);
   }
 }
 
@@ -999,6 +1041,33 @@ bool VNCSConnectionST::isShiftPressed()
   return false;
 }
 
+bool VNCSConnectionST::getPerms(bool &write, bool &owner) const
+{
+  bool found = false;
+  if (disablebasicauth) {
+    // We're running without basicauth
+    write = true;
+    return true;
+  }
+  if (user[0]) {
+    struct kasmpasswd_t *set = readkasmpasswd(kasmpasswdpath);
+    unsigned i;
+    for (i = 0; i < set->num; i++) {
+      if (!strcmp(set->entries[i].user, user)) {
+        write = set->entries[i].write;
+        owner = set->entries[i].owner;
+        found = true;
+        break;
+      }
+    }
+
+    free(set->entries);
+    free(set);
+  }
+
+  return found;
+}
+
 void VNCSConnectionST::writeRTTPing()
 {
   char type;
@@ -1079,6 +1148,22 @@ void VNCSConnectionST::writeFramebufferUpdate()
   if (isCongested())
     return;
 
+  // Check for permission changes?
+  if (needsPermCheck) {
+    needsPermCheck = false;
+
+    bool write, owner, ret;
+    ret = getPerms(write, owner);
+    if (!ret) {
+      close("User was deleted");
+      return;
+    } else if (!write) {
+      accessRights = (accessRights & ~(AccessPtrEvents | AccessKeyEvents | AccessSetDesktopSize));
+    } else {
+      accessRights |= AccessPtrEvents | AccessKeyEvents | AccessSetDesktopSize;
+    }
+  }
+
   // Updates often consists of many small writes, and in continuous
   // mode, we will also have small fence messages around the update. We
   // need to aggregate these in order to not clog up TCP's congestion

common/rfb/VNCSConnectionST.h

@@ -102,6 +102,10 @@ namespace rfb {
     // or because the current cursor position has not been set by this client.
     bool needRenderedCursor();
 
+    void recheckPerms() {
+        needsPermCheck = true;
+    }
+
     network::Socket* getSock() { return sock; }
     void add_changed(const Region& region) { updates.add_changed(region); }
     void add_changed_all() { updates.add_changed(server->pb->getRect()); }
@@ -164,7 +168,7 @@ namespace rfb {
     virtual void queryConnection(const char* userName);
     virtual void clientInit(bool shared);
     virtual void setPixelFormat(const PixelFormat& pf);
-    virtual void pointerEvent(const Point& pos, int buttonMask);
+    virtual void pointerEvent(const Point& pos, int buttonMask, const bool skipClick, const bool skipRelease);
     virtual void keyEvent(rdr::U32 keysym, rdr::U32 keycode, bool down);
     virtual void clientCutText(const char* str, int len);
     virtual void framebufferUpdateRequest(const Rect& r, bool incremental);
@@ -179,12 +183,23 @@ namespace rfb {
     virtual void supportsLEDState();
 
     virtual void sendStats();
+    virtual bool canChangeKasmSettings() const {
+        return (accessRights & (AccessPtrEvents | AccessKeyEvents)) ==
+               (AccessPtrEvents | AccessKeyEvents);
+    }
 
     // setAccessRights() allows a security package to limit the access rights
     // of a VNCSConnectioST to the server.  These access rights are applied
     // such that the actual rights granted are the minimum of the server's
     // default access settings and the connection's access settings.
-    virtual void setAccessRights(AccessRights ar) {accessRights=ar;}
+    virtual void setAccessRights(AccessRights ar) {
+        accessRights = ar;
+
+        bool write, owner;
+        if (!getPerms(write, owner) || !write)
+            accessRights = (accessRights & ~(AccessPtrEvents | AccessKeyEvents));
+        needsPermCheck = false;
+    }
 
     // Timer callbacks
     virtual bool handleTimeout(Timer* t);
@@ -193,6 +208,8 @@ namespace rfb {
 
     bool isShiftPressed();
 
+    bool getPerms(bool &write, bool &owner) const;
+
     // Congestion control
     void writeRTTPing();
     bool isCongested();
@@ -249,6 +266,10 @@ namespace rfb {
     rdr::U64 bstats_total[BS_NUM];
     struct timeval connStart;
 
+    char user[32];
+    char kasmpasswdpath[4096];
+    bool needsPermCheck;
+
     time_t lastEventTime;
     time_t pointerEventTime;
     Point pointerEventPos;

common/rfb/VNCServerST.cxx

@@ -51,6 +51,8 @@
 #include <assert.h>
 #include <stdlib.h>
 
+#include <network/GetAPI.h>
+
 #include <rfb/ComparingUpdateTracker.h>
 #include <rfb/KeyRemapper.h>
 #include <rfb/ListConnInfo.h>
@@ -63,6 +65,11 @@
 
 #include <rdr/types.h>
 
+#include <fcntl.h>
+#include <sys/inotify.h>
+#include <unistd.h>
+#include <wordexp.h>
+
 using namespace rfb;
 
 static LogWriter slog("VNCServerST");
@@ -73,20 +80,136 @@ EncCache VNCServerST::encCache;
 // -=- VNCServerST Implementation
 //
 
+static char kasmpasswdpath[4096];
+
 // -=- Constructors/Destructor
 
+static void mixedPercentages() {
+  slog.error("Mixing percentages and absolute values in DLP_Region is not allowed");
+  exit(1);
+}
+
+static void parseRegionPart(const bool percents, rdr::U16 &pcdest, int &dest,
+                            char **inptr) {
+  char *nextptr, *ptr;
+  ptr = *inptr;
+  int val = strtol(ptr, &nextptr, 10);
+  if (!*ptr || ptr == nextptr) {
+    slog.error("Invalid value for DLP_Region");
+    exit(1);
+  }
+  ptr = nextptr;
+  if (*ptr == '%') {
+    if (!percents)
+      mixedPercentages();
+    pcdest = val;
+
+    if (val < 0 || val > 100) {
+      slog.error("Percent must be 0-100");
+      exit(1);
+    }
+
+    ptr++;
+  } else if (percents) {
+    mixedPercentages();
+  }
+  dest = val;
+
+  for (; *ptr && *ptr == ','; ptr++);
+
+  *inptr = ptr;
+}
+
 VNCServerST::VNCServerST(const char* name_, SDesktop* desktop_)
   : blHosts(&blacklist), desktop(desktop_), desktopStarted(false),
-    blockCounter(0), pb(0), ledState(ledUnknown),
+    blockCounter(0), pb(0), blackedpb(0), ledState(ledUnknown),
     name(strDup(name_)), pointerClient(0), comparer(0),
     cursor(new Cursor(0, 0, Point(), NULL)),
     renderedCursorInvalid(false),
     queryConnectionHandler(0), keyRemapper(&KeyRemapper::defInstance),
     lastConnectionTime(0), disableclients(false),
-    frameTimer(this)
+    frameTimer(this), apimessager(NULL)
 {
   lastUserInputTime = lastDisconnectTime = time(0);
   slog.debug("creating single-threaded server %s", name.buf);
+
+  DLPRegion.enabled = DLPRegion.percents = false;
+
+  if (Server::DLP_Region[0]) {
+    unsigned len = strlen(Server::DLP_Region);
+    unsigned i;
+    unsigned commas = 0;
+    int val;
+    char *ptr, *nextptr;
+
+    for (i = 0; i < len; i++) {
+      if (Server::DLP_Region[i] == ',')
+        commas++;
+    }
+
+    if (commas != 3) {
+      slog.error("DLP_Region must contain four values");
+      exit(1);
+    }
+
+    ptr = (char *) (const char *) Server::DLP_Region;
+
+    val = strtol(ptr, &nextptr, 10);
+    if (!*ptr || ptr == nextptr) {
+      slog.error("Invalid value for DLP_Region");
+      exit(1);
+    }
+    ptr = nextptr;
+    if (*ptr == '%') {
+      DLPRegion.percents = true;
+      DLPRegion.pcx1 = val;
+      ptr++;
+    }
+    DLPRegion.x1 = val;
+
+    for (; *ptr && *ptr == ','; ptr++);
+
+    parseRegionPart(DLPRegion.percents, DLPRegion.pcy1, DLPRegion.y1,
+                    &ptr);
+    parseRegionPart(DLPRegion.percents, DLPRegion.pcx2, DLPRegion.x2,
+                    &ptr);
+    parseRegionPart(DLPRegion.percents, DLPRegion.pcy2, DLPRegion.y2,
+                    &ptr);
+
+    // Validity checks
+    if (!DLPRegion.percents) {
+      if (DLPRegion.x1 > 0 && DLPRegion.x2 > 0 && DLPRegion.x2 <= DLPRegion.x1) {
+        slog.error("DLP_Region x2 must be > x1");
+        exit(1);
+      }
+      if (DLPRegion.y1 > 0 && DLPRegion.y2 > 0 && DLPRegion.y2 <= DLPRegion.y1) {
+        slog.error("DLP_Region y2 must be > y1");
+        exit(1);
+      }
+    }
+
+    DLPRegion.enabled = 1;
+  }
+
+  kasmpasswdpath[0] = '\0';
+  wordexp_t wexp;
+  if (!wordexp(rfb::Server::kasmPasswordFile, &wexp, WRDE_NOCMD))
+    strncpy(kasmpasswdpath, wexp.we_wordv[0], 4096);
+  kasmpasswdpath[4095] = '\0';
+  wordfree(&wexp);
+
+  if (kasmpasswdpath[0] && access(kasmpasswdpath, R_OK) == 0) {
+    // Set up a watch on the password file
+    inotifyfd = inotify_init();
+    if (inotifyfd < 0)
+      slog.error("Failed to init inotify");
+
+    int flags = fcntl(inotifyfd, F_GETFL, 0);
+    fcntl(inotifyfd, F_SETFL, flags | O_NONBLOCK);
+
+    if (inotify_add_watch(inotifyfd, kasmpasswdpath, IN_CLOSE_WRITE | IN_DELETE_SELF) < 0)
+      slog.error("Failed to set watch");
+  }
 }
 
 VNCServerST::~VNCServerST()
@@ -611,6 +734,138 @@ int VNCServerST::msToNextUpdate()
     return frameTimer.getRemainingMs();
 }
 
+static void checkAPIMessages(network::GetAPIMessager *apimessager)
+{
+  if (pthread_mutex_lock(&apimessager->userMutex))
+    return;
+
+  const unsigned num = apimessager->actionQueue.size();
+  unsigned i;
+  for (i = 0; i < num; i++) {
+    slog.info("Main thread processing user API request %u/%u", i + 1, num);
+
+    const network::GetAPIMessager::action_data &act = apimessager->actionQueue[i];
+    struct kasmpasswd_t *set = NULL;
+    unsigned s;
+    bool found;
+
+    switch (act.action) {
+      case network::GetAPIMessager::USER_REMOVE:
+        set = readkasmpasswd(kasmpasswdpath);
+        found = false;
+        for (s = 0; s < set->num; s++) {
+          if (!strcmp(set->entries[s].user, act.data.user)) {
+            set->entries[s].user[0] = '\0';
+            found = true;
+            break;
+          }
+        }
+
+        if (found) {
+          writekasmpasswd(kasmpasswdpath, set);
+          slog.info("User %s removed", act.data.user);
+        } else {
+          slog.error("Tried to remove nonexistent user %s", act.data.user);
+        }
+      break;
+      case network::GetAPIMessager::USER_GIVE_CONTROL:
+        set = readkasmpasswd(kasmpasswdpath);
+        found = false;
+        for (s = 0; s < set->num; s++) {
+          if (!strcmp(set->entries[s].user, act.data.user)) {
+            set->entries[s].write = 1;
+            found = true;
+          } else {
+            set->entries[s].write = 0;
+          }
+        }
+
+        if (found) {
+          writekasmpasswd(kasmpasswdpath, set);
+          slog.info("User %s given control", act.data.user);
+        } else {
+          slog.error("Tried to give control to nonexistent user %s", act.data.user);
+        }
+      break;
+    }
+
+    if (set) {
+      free(set->entries);
+      free(set);
+    }
+  }
+
+  apimessager->actionQueue.clear();
+  pthread_mutex_unlock(&apimessager->userMutex);
+}
+
+void VNCServerST::translateDLPRegion(rdr::U16 &x1, rdr::U16 &y1, rdr::U16 &x2, rdr::U16 &y2) const
+{
+  if (DLPRegion.percents) {
+    x1 = DLPRegion.pcx1 ? DLPRegion.pcx1 * pb->getRect().width() / 100 : 0;
+    y1 = DLPRegion.pcy1 ? DLPRegion.pcy1 * pb->getRect().height() / 100 : 0;
+    x2 = DLPRegion.pcx2 ? (100 - DLPRegion.pcx2) * pb->getRect().width() / 100 : pb->getRect().width();
+    y2 = DLPRegion.pcy2 ? (100 - DLPRegion.pcy2) * pb->getRect().height() / 100 : pb->getRect().height();
+  } else {
+    x1 = abs(DLPRegion.x1);
+    y1 = abs(DLPRegion.y1);
+    x2 = pb->getRect().width();
+    y2 = pb->getRect().height();
+
+    if (DLPRegion.x2 < 0)
+      x2 += DLPRegion.x2;
+    else if (DLPRegion.x2 > 0)
+      x2 = DLPRegion.x2;
+
+    if (DLPRegion.y2 < 0)
+      y2 += DLPRegion.y2;
+    else if (DLPRegion.y2 > 0)
+      y2 = DLPRegion.y2;
+  }
+
+  if (y2 > pb->getRect().height())
+    y2 = pb->getRect().height() - 1;
+  if (x2 > pb->getRect().width())
+    x2 = pb->getRect().width() - 1;
+
+  //slog.info("DLP_Region vals %u,%u %u,%u", x1, y1, x2, y2);
+}
+
+void VNCServerST::blackOut()
+{
+  // Compute the region, since the resolution may have changed
+  rdr::U16 x1, y1, x2, y2;
+
+  translateDLPRegion(x1, y1, x2, y2);
+
+  if (blackedpb)
+    delete blackedpb;
+  blackedpb = new ManagedPixelBuffer(pb->getPF(), pb->getRect().width(), pb->getRect().height());
+
+  int stride;
+  const rdr::U8 *src = pb->getBuffer(pb->getRect(), &stride);
+  rdr::U8 *data = blackedpb->getBufferRW(pb->getRect(), &stride);
+  stride *= 4;
+
+  memcpy(data, src, stride * pb->getRect().height());
+
+  rdr::U16 y;
+  const rdr::U16 w = pb->getRect().width();
+  const rdr::U16 h = pb->getRect().height();
+  for (y = 0; y < h; y++) {
+    if (y < y1 || y > y2) {
+      memset(data, 0, stride);
+    } else {
+      if (x1)
+        memset(data, 0, x1 * 4);
+      if (x2)
+        memset(&data[x2 * 4], 0, (w - x2) * 4);
+    }
+
+    data += stride;
+  }
+}
+
 // writeUpdate() is called on a regular interval in order to see what
 // updates are pending and propagates them to the update tracker for
 // each client. It uses the ComparingUpdateTracker's compare() method
@@ -628,6 +883,11 @@ void VNCServerST::writeUpdate()
   assert(blockCounter == 0);
   assert(desktopStarted);
 
+  if (DLPRegion.enabled) {
+    comparer->enable_copyrect(false);
+    blackOut();
+  }
+
   comparer->getUpdateInfo(&ui, pb->getRect());
   toCheck = ui.changed.union_(ui.copied);
 
@@ -659,8 +919,40 @@ void VNCServerST::writeUpdate()
   encCache.clear();
   encCache.enabled = clients.size() > 1;
 
+  // Check if the password file was updated
+  bool permcheck = false;
+  if (inotifyfd >= 0) {
+    char buf[256];
+    int ret = read(inotifyfd, buf, 256);
+    int pos = 0;
+    while (ret > 0) {
+      const struct inotify_event * const ev = (struct inotify_event *) &buf[pos];
+
+      if (ev->mask & IN_IGNORED) {
+        // file was deleted, set new watch
+        if (inotify_add_watch(inotifyfd, kasmpasswdpath, IN_CLOSE_WRITE | IN_DELETE_SELF) < 0)
+          slog.error("Failed to set watch");
+      }
+
+      permcheck = true;
+
+      ret -= sizeof(struct inotify_event) - ev->len;
+      pos += sizeof(struct inotify_event) - ev->len;
+    }
+  }
+
+  if (apimessager) {
+    apimessager->mainUpdateScreen(pb);
+
+    checkAPIMessages(apimessager);
+  }
+
   for (ci = clients.begin(); ci != clients.end(); ci = ci_next) {
     ci_next = ci; ci_next++;
+
+    if (permcheck)
+      (*ci)->recheckPerms();
+
     (*ci)->add_copied(ui.copied, ui.copy_delta);
     (*ci)->add_copypassed(ui.copypassed);
     (*ci)->add_changed(ui.changed);

common/rfb/VNCServerST.h

@@ -43,6 +43,7 @@ namespace rfb {
   class ListConnInfo;
   class PixelBuffer;
   class KeyRemapper;
+  class network::GetAPIMessager;
 
   class VNCServerST : public VNCServer,
                       public Timer::Callback,
@@ -94,7 +95,7 @@ namespace rfb {
     virtual void setPixelBuffer(PixelBuffer* pb, const ScreenSet& layout);
     virtual void setPixelBuffer(PixelBuffer* pb);
     virtual void setScreenLayout(const ScreenSet& layout);
-    virtual PixelBuffer* getPixelBuffer() const { return pb; }
+    virtual PixelBuffer* getPixelBuffer() const { if (DLPRegion.enabled && blackedpb) return blackedpb; else return pb; }
     virtual void serverCutText(const char* str, int len);
     virtual void add_changed(const Region &region);
     virtual void add_copied(const Region &dest, const Point &delta);
@@ -186,6 +187,8 @@ namespace rfb {
     bool getDisable() { return disableclients;};
     void setDisable(bool disable) { disableclients = disable;};
 
+    void setAPIMessager(network::GetAPIMessager *msgr) { apimessager = msgr; }
+
   protected:
 
     friend class VNCSConnectionST;
@@ -206,6 +209,7 @@ namespace rfb {
     bool desktopStarted;
     int blockCounter;
     PixelBuffer* pb;
+    ManagedPixelBuffer *blackedpb;
     ScreenSet screenLayout;
     unsigned int ledState;
 
@@ -232,6 +236,7 @@ namespace rfb {
     void stopFrameClock();
     int msToNextUpdate();
     void writeUpdate();
+    void blackOut();
     Region getPendingRegion();
     const RenderedCursor* getRenderedCursor();
 
@@ -249,6 +254,19 @@ namespace rfb {
     bool disableclients;
 
     Timer frameTimer;
+
+    int inotifyfd;
+
+    network::GetAPIMessager *apimessager;
+
+    struct {
+        bool enabled;
+        int x1, y1, x2, y2;
+        bool percents;
+        rdr::U16 pcx1, pcy1, pcx2, pcy2;
+    } DLPRegion;
+
+    void translateDLPRegion(rdr::U16 &x1, rdr::U16 &y1, rdr::U16 &x2, rdr::U16 &y2) const;
   };
 
 };

debian/Makefile.to_fakebuild_tar_package

@@ -0,0 +1,32 @@
+TARGET_OS := $(shell lsb_release -is | tr '[:upper:]' '[:lower:]')
+TARGET_OS_CODENAME := $(shell lsb_release -cs | tr '[:upper:]' '[:lower:]')
+TARBALL_DIR := builder/build
+TARBALL := $(TARBALL_DIR)/kasmvnc.$(TARGET_OS)_$(TARGET_OS_CODENAME).tar.gz
+TAR_DATA := $(shell mktemp -d)
+SRC := $(TAR_DATA)/usr/local
+SRC_BIN := $(SRC)/bin
+DST_MAN := $(DESTDIR)/usr/share/man/man1
+
+install: unpack_tarball
+	echo "TAR_DATA: $(TAR_DATA)"
+	echo "installing files"
+	mkdir -p $(DESTDIR)/usr/bin $(DESTDIR)/usr/share/man/man1 \
+	  $(DESTDIR)/usr/share/doc/kasmvncserver
+	cp $(SRC_BIN)/Xvnc $(DESTDIR)/usr/bin/Xkasmvnc
+	cp $(SRC_BIN)/vncserver $(DESTDIR)/usr/bin/kasmvncserver
+	cp $(SRC_BIN)/vncconfig $(DESTDIR)/usr/bin/kasmvncconfig
+	cp $(SRC_BIN)/kasmvncpasswd $(DESTDIR)/usr/bin/
+	cp -r $(SRC)/share/doc/kasmvnc*/* $(DESTDIR)/usr/share/doc/kasmvncserver/
+	rsync -r --exclude '.git*' --exclude po2js --exclude xgettext-html \
+	  --exclude www/utils/ --exclude .eslintrc \
+	  $(SRC)/share/kasmvnc $(DESTDIR)/usr/share
+	cp $(SRC)/man/man1/Xvnc.1 $(DESTDIR)/usr/share/man/man1/Xkasmvnc.1
+	cp $(SRC)/share/man/man1/vncserver.1 $(DST_MAN)/kasmvncserver.1
+	cp $(SRC)/share/man/man1/vncpasswd.1 $(DST_MAN)/kasmvncpasswd.1
+	cp $(SRC)/share/man/man1/vncconfig.1 $(DST_MAN)/kasmvncconfig.1
+
+unpack_tarball:
+	tar -xzf "$(TARBALL)" -C "$(TAR_DATA)"
+
+clean:
+	rm -rf $(TAR_DATA)

debian/README.source

@@ -0,0 +1,10 @@
+kasmvnc for Debian
+-----------------
+
+<this file describes information about the source package, see Debian policy
+manual section 4.14. You WILL either need to modify or delete this file>
+
+
+
+ -- Dmitry Maksyoma <ledestin@gmail.com>  Fri, 25 Dec 2020 21:29:24 +1300
+

debian/changelog

@@ -0,0 +1,5 @@
+kasmvnc (0.9.1~beta-1) unstable; urgency=medium
+
+  * Initial release of the Debian package.
+
+ -- Dmitry Maksyoma <ledestin@gmail.com>  Fri, 25 Dec 2020 21:29:24 +1300

debian/compat

@@ -0,0 +1 @@
+11

debian/control

@@ -0,0 +1,36 @@
+Source: kasmvnc
+Section: x11
+Priority: optional
+Maintainer: Kasm Technologies LLC <info@kasmweb.com>
+Build-Depends: debhelper (>= 11), rsync, libjpeg-dev, libjpeg-dev, libpng-dev,
+  libtiff-dev, libgif-dev, libavcodec-dev, libssl-dev, libgl1, libxfont2, libsm6
+Standards-Version: 4.1.3
+Homepage: https://github.com/kasmtech/KasmVNC
+#Vcs-Browser: https://salsa.debian.org/debian/kasmvnc
+#Vcs-Git: https://salsa.debian.org/debian/kasmvnc.git
+
+Package: kasmvncserver
+Architecture: amd64
+Depends: ${shlibs:Depends}, ${misc:Depends}, ${perl:Depends}, ssl-cert, xauth,
+  x11-xkb-utils, xkb-data, procps
+Provides: vnc-server
+Description: VNC server accessible from a web browser
+ VNC stands for Virtual Network Computing. It is, in essence, a remote
+ display system which allows you to view a computing `desktop' environment
+ not only on the machine where it is running, but from anywhere on the
+ Internet and from a wide variety of machine architectures.
+ .
+ KasmVNC has different goals than TigerVNC:
+ .
+ Web-based - KasmVNC is designed to provide a web accessible remote desktop.
+ It comes with a web server and websocket server built in. There is no need to
+ install other components. Simply run and navigate to your desktop's URL on the
+ port you specify. While you can still tun on the legacy VNC port, it is
+ disabled by default.
+ .
+ Security - KasmVNC defaults to HTTPS and allows for HTTP Basic Auth. VNC
+ Password authentication is limited by specification to 8 characters and is not
+ suffecient for use on an internet accessible remote desktop. Our goal is to
+ create a by default secure, web based experience.
+ .
+ Simplicity - KasmVNC aims at being simple to deploy and configure.

debian/copyright

@@ -0,0 +1,70 @@
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: kasmvnc
+Source: https://github.com/kasmtech/KasmVNC
+
+Files: *
+Copyright: Copyright (C) 2020 Kasm Technologies LLC
+    Copyright (C) 1999 AT&T Laboratories Cambridge
+    Copyright (C) 2002-2005 RealVNC Ltd.
+    Copyright (C) 2000-2006 TightVNC Group
+    Copyright (C) 2005-2006 Martin Koegler
+    Copyright (C) 2005-2006 Sun Microsystems, Inc.
+    Copyright (C) 2006 OCCAM Financial Technology
+    Copyright (C) 2000-2008 Constantin Kaplinsky
+    Copyright (C) 2004-2017 Peter Astrand for Cendio AB
+    Copyright (C) 2010 Antoine Martin
+    Copyright (C) 2010 m-privacy GmbH
+    Copyright (C) 2009-2011 D. R. Commander
+    Copyright (C) 2009-2011 Pierre Ossman for Cendio AB
+    Copyright (C) 2004, 2009-2011 Red Hat, Inc.
+    Copyright (C) 2009-2018 TigerVNC Team
+    All Rights Reserved.
+
+License: GPL-2+
+ This package is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 2 of the License, or
+ (at your option) any later version.
+ .
+ This package is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ GNU General Public License for more details.
+ .
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <https://www.gnu.org/licenses/>
+ .
+ On Debian systems, the complete text of the GNU General
+ Public License version 2 can be found in "/usr/share/common-licenses/GPL-2".
+
+libwebp statically linked:
+Copyright: Copyright (c) 2010, Google Inc. All rights reserved.
+
+License:
+  Redistribution and use in source and binary forms, with or without
+  modification, are permitted provided that the following conditions are
+  met:
+
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in
+      the documentation and/or other materials provided with the
+      distribution.
+
+    * Neither the name of Google nor the names of its contributors may
+      be used to endorse or promote products derived from this software
+      without specific prior written permission.
+
+  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+  "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+  LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+  A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+  HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+  LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+  DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+  THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+  OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

debian/examples

@@ -0,0 +1 @@
+builder/startup/deb/kasmvncserver-easy-start

debian/kasmvnc-docs.docs

@@ -0,0 +1 @@
+README.source

debian/menu.ex

@@ -0,0 +1,2 @@
+?package(kasmvnc):needs="X11|text|vc|wm" section="Applications/see-menu-manual"\
+  title="kasmvnc" command="/usr/bin/kasmvnc"

debian/patches/fix-kasmvncserver-perl-hashbang.patch

@@ -0,0 +1,10 @@
+Description: Lintian complains about #!/usr/bin/env perl.
+Author: Dmitry Maksyoma <ledestin@gmail.com>
+--- a/unix/vncserver
++++ b/unix/vncserver
+@@ -1,4 +1,4 @@
+-#!/usr/bin/env perl
++#!/usr/bin/perl
+ #
+ #  Copyright (C) 2009-2010 D. R. Commander.  All Rights Reserved.
+ #  Copyright (C) 2005-2006 Sun Microsystems, Inc.  All Rights Reserved.

debian/patches/series

@@ -0,0 +1 @@
+fix-kasmvncserver-perl-hashbang.patch

debian/postinst

@@ -0,0 +1,49 @@
+#!/bin/sh
+# postinst script for kasmvnc
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <postinst> `configure' <most-recently-configured-version>
+#        * <old-postinst> `abort-upgrade' <new version>
+#        * <conflictor's-postinst> `abort-remove' `in-favour' <package>
+#          <new-version>
+#        * <postinst> `abort-remove'
+#        * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
+#          <failed-install-package> <version> `removing'
+#          <conflicting-package> <version>
+# for details, see https://www.debian.org/doc/debian-policy/ or
+# the debian-policy package
+
+case "$1" in
+    configure)
+      bindir=/usr/bin
+      mandir=/usr/share/man
+      commands="kasmvncserver kasmvncpasswd kasmvncconfig Xkasmvnc"
+
+      for kasm_command in $commands; do
+        generic_command=`echo "$kasm_command" | sed -e 's/kasm//'`;
+        update-alternatives --install "$bindir/$generic_command" \
+          "$generic_command" "$bindir/$kasm_command" 90 \
+          --slave "$mandir/man1/$generic_command.1.gz" "$generic_command.1.gz" \
+            "$mandir/man1/$kasm_command.1.gz"
+      done
+    ;;
+
+    abort-upgrade|abort-remove|abort-deconfigure)
+    ;;
+
+    *)
+        echo "postinst called with unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0

debian/postrm.ex

@@ -0,0 +1,37 @@
+#!/bin/sh
+# postrm script for kasmvnc
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <postrm> `remove'
+#        * <postrm> `purge'
+#        * <old-postrm> `upgrade' <new-version>
+#        * <new-postrm> `failed-upgrade' <old-version>
+#        * <new-postrm> `abort-install'
+#        * <new-postrm> `abort-install' <old-version>
+#        * <new-postrm> `abort-upgrade' <old-version>
+#        * <disappearer's-postrm> `disappear' <overwriter>
+#          <overwriter-version>
+# for details, see https://www.debian.org/doc/debian-policy/ or
+# the debian-policy package
+
+
+case "$1" in
+    purge|remove|upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)
+    ;;
+
+    *)
+        echo "postrm called with unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0

debian/preinst.ex

@@ -0,0 +1,35 @@
+#!/bin/sh
+# preinst script for kasmvnc
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <new-preinst> `install'
+#        * <new-preinst> `install' <old-version>
+#        * <new-preinst> `upgrade' <old-version>
+#        * <old-preinst> `abort-upgrade' <new-version>
+# for details, see https://www.debian.org/doc/debian-policy/ or
+# the debian-policy package
+
+
+case "$1" in
+    install|upgrade)
+    ;;
+
+    abort-upgrade)
+    ;;
+
+    *)
+        echo "preinst called with unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0