x11vnc: kill gui_pid on exit in -connect/-connect_or_exit mode.

-grablocal n experiment (not compiled by default).  -macuskbd
   option for macosx for orig uskdb code. keycode=N remote contol
   cmd.  Find dpy look at non-NFS cookies in /tmp.  Fix gui tray
   insertion on recent gnome dt. Fix connect_file bug. Sync SSVNC

classes/ssl/ss_vncviewer

@@ -39,7 +39,7 @@
 #         and then a 2nd CONNECT to the destination VNC server.)
 #
 #         Use socks://host:port, socks4://host:port, or socks5://host,port
-#         to force usage of a SOCKS proxy.
+#         to force usage of a SOCKS proxy.  Also repeater://host:port.
 #
 # -showcert  Only fetch the certificate using the 'openssl s_client'
 #            command (openssl(1) must in installed).
@@ -259,8 +259,12 @@ if [ "X$reverse" != "X" ]; then
 		# check proxy usage under reverse connection:
 		if [ "X$use_ssh" = "X" -a "X$use_sshssl" = "X" ]; then
 			echo ""
-			echo "*Warning*: SSL -listen and a Web proxy does not make sense."
+			if echo "$proxy" | egrep "repeater://" > /dev/null; then
-			sleep 3
+				:
+			else
+				echo "*Warning*: SSL -listen and a Web proxy does not make sense."
+				sleep 3
+			fi
 		elif echo "$proxy" | grep "," > /dev/null; then
 			:
 		else
@@ -443,6 +447,9 @@ findfree() {
 # removes files, etc.
 final() {
 	echo ""
+	if [ "X$tmp_cfg" != "X" ]; then
+		rm -f $tmp_cfg
+	fi
 	if [ "X$SS_VNCVIEWER_RM" != "X" ]; then
 		rm -f $SS_VNCVIEWER_RM 2>/dev/null
 	fi
@@ -502,6 +509,11 @@ rchk() {
 }
 rchk
 
+dL="-L"
+if uname -sr | egrep 'SunOS 5\.[5-8]' > /dev/null; then
+	dL="-h"
+fi
+
 # a portable, but not absolutely safe, tmp file creator
 mytmp() {
 	tf=$1
@@ -509,7 +521,7 @@ mytmp() {
 	if [ -d "$tf" ]; then
 		echo "tmp file $tf still exists as a directory."
 		exit 1
-	elif [ -L "$tf" ]; then
+	elif [ $dL "$tf" ]; then
 		echo "tmp file $tf still exists as a symlink."
 		exit 1
 	elif [ -f "$tf" ]; then
@@ -564,50 +576,43 @@ pcode() {
 
 use IO::Socket::INET;
 
-my ($first, $second, $third) = split(/,/, $ENV{PPROXY_PROXY}, 3);
+if (exists $ENV{PPROXY_SLEEP}) {
+	print STDERR "PPROXY_PID: $$\n";
+	sleep $ENV{PPROXY_SLEEP};
+}
 
-if ($first =~ m,^socks4?://(\S*)$,i) {
+foreach my $var (qw(PPROXY_PROXY PPROXY_SOCKS PPROXY_DEST PPROXY_LISTEN
-	$ENV{PPROXY_SOCKS} = 1;
+    PPROXY_REVERSE PPROXY_REPEATER PPROXY_REMOVE PPROXY_KILLPID PPROXY_SLEEP)) {
-	$first = $1;
+	if (0 || $ENV{SS_DEBUG}) {
-} elsif ($first =~ m,^socks5://(\S*)$,i) {
+		print STDERR "$var: $ENV{$var}\n";
-	$ENV{PPROXY_SOCKS} = 5;
+	}
-	$first = $1;
+} 
-} elsif ($first =~ m,^https?://(\S*)$,i) {
+
-	$ENV{PPROXY_SOCKS} = "";
+if ($ENV{PPROXY_SOCKS} ne "" && $ENV{PPROXY_PROXY} !~ m,^socks5?://,i) {
-	$first = $1;
+	if ($ENV{PPROXY_SOCKS} eq "5") {
+		$ENV{PPROXY_PROXY} = "socks5://$ENV{PPROXY_PROXY}";
+	} else {
+		$ENV{PPROXY_PROXY} = "socks://$ENV{PPROXY_PROXY}";
+	}
 }
 
+my ($first, $second, $third) = split(/,/, $ENV{PPROXY_PROXY}, 3);
+my ($mode_1st, $mode_2nd, $mode_3rd) = ("", "", "");
+
+($first, $mode_1st) = url_parse($first);
+
 my ($proxy_host, $proxy_port) = split(/:/, $first);
 my $connect = $ENV{PPROXY_DEST};
 
-my $mode_2nd = "";
 if ($second ne "") {
-	if ($second =~ m,^socks4?://(\S*)$,i) {
+	($second, $mode_2nd) = url_parse($second);
-		$mode_2nd = "socks4";
-		$second = $1;
-	} elsif ($second =~ m,^socks5://(\S*)$,i) {
-		$mode_2nd = "socks5";
-		$second = $1;
-	} elsif ($second =~ m,^https?://(\S*)$,i) {
-		$mode_2nd = "http";
-		$second = $1;
-	}
 }
 
-my $mode_3rd = "";
 if ($third ne "") {
-	if ($third =~ m,^socks4?://(\S*)$,i) {
+	($third, $mode_3rd) = url_parse($third);
-		$mode_3rd = "socks4";
-		$third = $1;
-	} elsif ($third =~ m,^socks5://(\S*)$,i) {
-		$mode_3rd = "socks5";
-		$third = $1;
-	} elsif ($third =~ m,^https?://(\S*)$,i) {
-		$mode_3rd = "http";
-		$third = $1;
-	}
 }
 
+
 print STDERR "\n";
 print STDERR "PPROXY v0.2: a tool for Web proxies and SOCKS connections.\n";
 print STDERR "proxy_host:       $proxy_host\n";
@@ -615,10 +620,29 @@ print STDERR "proxy_port:       $proxy_port\n";
 print STDERR "proxy_connect:    $connect\n";
 print STDERR "pproxy_params:    $ENV{PPROXY_PROXY}\n";
 print STDERR "pproxy_listen:    $ENV{PPROXY_LISTEN}\n";
+print STDERR "pproxy_reverse:   $ENV{PPROXY_REVERSE}\n";
 print STDERR "\n";
+if (1) {
+	print STDERR "pproxy 1st: $first\t- $mode_1st\n";
+	print STDERR "pproxy 2nd: $second\t- $mode_2nd\n";
+	print STDERR "pproxy 3rd: $third\t- $mode_3rd\n";
+	print STDERR "\n";
+}
 
 my $listen_handle = "";
-if ($ENV{PPROXY_LISTEN} != "") {
+if ($ENV{PPROXY_REVERSE} ne "") {
+	my ($rhost, $rport) = split(/:/, $ENV{PPROXY_REVERSE});
+	$rport = 5900 unless $rport;
+	$listen_handle = IO::Socket::INET->new(
+		PeerAddr => $rhost,
+		PeerPort => $rport,
+		Proto => "tcp"
+	);
+	if (! $listen_handle) {
+		die "pproxy: $! -- PPROXY_REVERSE\n";
+	}
+	print STDERR "PPROXY_REVERSE: connected to $rhost $rport\n";
+} elsif ($ENV{PPROXY_LISTEN} ne "") {
 	my $listen_sock = IO::Socket::INET->new(
 		Listen    => 2,
 		LocalAddr => "localhost",
@@ -626,7 +650,7 @@ if ($ENV{PPROXY_LISTEN} != "") {
 		Proto     => "tcp"
 	);
 	if (! $listen_sock) {
-		die "pproxy: $!\n";
+		die "pproxy: $! -- PPROXY_LISTEN\n";
 	}
 	my $ip;
 	($listen_handle, $ip) = $listen_sock->accept();
@@ -647,6 +671,112 @@ if (! $sock) {
 	die "pproxy: $err\n";
 }
 
+unlink($0) if $ENV{PPROXY_REMOVE};
+
+$cur_proxy = $first;
+setmode($mode_1st);
+
+if ($second ne "") {
+	connection($second, 1);
+
+	setmode($mode_2nd);
+	$cur_proxy = $second;
+
+	if ($third ne "") {
+		connection($third, 2);
+		setmode($mode_3rd);
+		$cur_proxy = $third;
+		connection($connect, 3);
+	} else {
+		connection($connect, 2);
+	}
+} else {
+	connection($connect, 1);
+}
+
+$parent = $$;
+$child = fork;
+if (! defined $child) {
+	kill "TERM", $ENV{PPROXY_KILLPID} if $ENV{PPROXY_KILLPID};
+	exit 1;
+}
+
+if ($child) {
+	print STDERR "pproxy parent\[$$]  STDIN -> socket\n";
+	if ($listen_handle) {
+		xfer($listen_handle, $sock);
+	} else {
+		xfer(STDIN, $sock);
+	}
+	select(undef, undef, undef, 0.25);
+	if (kill 0, $child) {
+		select(undef, undef, undef, 1.5);
+		#print STDERR "pproxy\[$$]: kill TERM $child\n";
+		kill "TERM", $child;
+	}
+} else {
+	print STDERR "pproxy child \[$$]  socket -> STDOUT\n";
+	if ($listen_handle) {
+		xfer($sock, $listen_handle);
+	} else {
+		xfer($sock, STDOUT);
+	}
+	select(undef, undef, undef, 0.25);
+	if (kill 0, $parent) {
+		select(undef, undef, undef, 1.5);
+		#print STDERR "pproxy\[$$]: kill TERM $parent\n";
+		kill "TERM", $parent;
+	}
+}
+if ($ENV{PPROXY_KILLPID} ne "") {
+	if ($ENV{PPROXY_KILLPID} =~ /^(\+|-)/) {
+		$ENV{PPROXY_KILLPID} = $$ + $ENV{PPROXY_KILLPID};
+	}
+	print STDERR "kill TERM, $ENV{PPROXY_KILLPID}\n";
+	kill "TERM", $ENV{PPROXY_KILLPID};
+}
+exit;
+
+sub url_parse {
+	my $hostport = shift;
+	my $mode = "http";
+	if ($hostport =~ m,^socks4?://(\S*)$,i) {
+		$mode = "socks4";
+		$hostport = $1;
+	} elsif ($hostport =~ m,^socks5://(\S*)$,i) {
+		$mode = "socks5";
+		$hostport = $1;
+	} elsif ($hostport =~ m,^https?://(\S*)$,i) {
+		$mode = "http";
+		$hostport = $1;
+	} elsif ($hostport =~ m,^repeater://(\S*)\+(\S*)$,i) {
+		# ultravnc repeater proxy.
+		$hostport = $1;
+		$mode = "repeater:$2";
+		if ($hostport !~ /:\d+/) {
+			$hostport .= ":5900";
+		}
+	}
+	return ($hostport, $mode);
+}
+
+sub setmode {
+	my $mode = shift;
+	$ENV{PPROXY_REPEATER} = "";
+	if ($mode =~ /^socks/) {
+		if ($mode =~ /^socks5/) {
+			$ENV{PPROXY_SOCKS} = 5;
+		} else {
+			$ENV{PPROXY_SOCKS} = 1;
+		}
+	} elsif ($mode =~ /^repeater:(.*)/) {
+		$ENV{PPROXY_REPEATER} = $1;
+		$ENV{PPROXY_SOCKS} = "";
+	} else {
+		$ENV{PPROXY_SOCKS} = "";
+	}
+}
+
 sub connection {
 	my ($CONNECT, $w) = @_;
 
@@ -771,6 +901,18 @@ sub connection {
 			close $sock;
 			exit(1);
 		}
+	} elsif ($ENV{PPROXY_REPEATER} ne "") {
+		my $rep = $ENV{PPROXY_REPEATER};
+		print STDERR "repeater: $rep\n";
+		$rep .= pack("x") x 250;
+		syswrite($sock, $rep, 250);
+
+		my $ok = 1;
+		for (my $i = 0; $i < 12; $i++) {
+			my $c;
+			sysread($sock, $c, 1);
+			print STDERR $c;
+		}
 
 	} else {
 		# Web Proxy:
@@ -799,76 +941,6 @@ sub connection {
 	}
 }
 
-unlink($0) if $ENV{PPROXY_REMOVE};
-
-$cur_proxy = $first;
-
-if ($second ne "") {
-	connection($second, 1);
-
-	setmode($mode_2nd);
-	$cur_proxy = $second;
-
-	if ($third ne "") {
-		connection($third, 2);
-		setmode($mode_3rd);
-		$cur_proxy = $third;
-		connection($connect, 3);
-	} else {
-		connection($connect, 2);
-	}
-} else {
-	connection($connect, 1);
-}
-
-$parent = $$;
-$child = fork;
-if (! defined $child) {
-	exit 1;
-}
-
-if ($child) {
-	print STDERR "pproxy parent\[$$]  STDIN -> socket\n";
-	if ($listen_handle) {
-		xfer($listen_handle, $sock);
-	} else {
-		xfer(STDIN, $sock);
-	}
-	select(undef, undef, undef, 0.25);
-	if (kill 0, $child) {
-		select(undef, undef, undef, 1.5);
-		#print STDERR "pproxy\[$$]: kill TERM $child\n";
-		kill "TERM", $child;
-	}
-} else {
-	print STDERR "pproxy child \[$$]  socket -> STDOUT\n";
-	if ($listen_handle) {
-		xfer($sock, $listen_handle);
-	} else {
-		xfer($sock, STDOUT);
-	}
-	select(undef, undef, undef, 0.25);
-	if (kill 0, $parent) {
-		select(undef, undef, undef, 1.5);
-		#print STDERR "pproxy\[$$]: kill TERM $parent\n";
-		kill "TERM", $parent;
-	}
-}
-exit;
-
-sub setmode {
-	my $mode = shift;
-	if ($mode =~ /^socks/) {
-		if ($mode =~ /^socks5/) {
-			$ENV{PPROXY_SOCKS} = 5;
-		} else {
-			$ENV{PPROXY_SOCKS} = 1;
-		}
-	} else {
-		$ENV{PPROXY_SOCKS} = "";
-	}
-}
-
 sub xfer {
 	my($in, $out) = @_;
 	$RIN = $WIN = $EIN = "";
@@ -943,6 +1015,24 @@ if [ "X$use_ssh" = "X1" ]; then
 	# let user override ssh via $SSH
 	ssh=${SSH:-"ssh -x"}
 
+	if [ "X$SSVNC_LIM_ACCEPT_PRELOAD" != "X" ]; then
+		SSVNC_LIM_ACCEPT_PRELOAD="$SSVNC_BASEDIR/$SSVNC_UNAME/$SSVNC_LIM_ACCEPT_PRELOAD"
+	fi
+	if [ "X$SSVNC_LIM_ACCEPT_PRELOAD" != "X" ]; then
+		echo ""
+		echo "SSVNC_LIM_ACCEPT_PRELOAD=$SSVNC_LIM_ACCEPT_PRELOAD"
+	fi
+
+	if [ "X$SSVNC_LIM_ACCEPT_PRELOAD" != "X" -a -f "$SSVNC_LIM_ACCEPT_PRELOAD" ]; then
+		plvar=LD_PRELOAD
+		if uname | grep Darwin >/dev/null; then
+			plvar="DYLD_FORCE_FLAT_NAMESPACE=1 DYLD_INSERT_LIBRARIES"
+		fi
+		ssh="env $plvar=$SSVNC_LIM_ACCEPT_PRELOAD $ssh"
+	else
+		SSVNC_LIM_ACCEPT_PRELOAD=""
+	fi
+
 	if echo "$proxy" | egrep '(http|https|socks|socks4|socks5)://' > /dev/null; then
 		# Handle Web or SOCKS proxy(ies) for the initial connect.
 Kecho host=$host
@@ -1182,6 +1272,7 @@ Kecho proxy=$proxy
 		fi
 
 		if [ "X$SSVNC_EXTRA_SLEEP" != "X" ]; then
+			echo "sleep $SSVNC_EXTRA_SLEEP"
 			sleep $SSVNC_EXTRA_SLEEP
 		fi
 
@@ -1258,10 +1349,11 @@ Kecho proxy=$proxy
 
 	c=0
 	pssh=""
+	mssh=`echo "$ssh" | sed -e 's/^env.*ssh/ssh/'`
 	while [ $c -lt 30 ]
 	do
 		p=`expr $pmark + $c`
-		if ps -p "$p" 2>&1 | grep "$ssh" > /dev/null; then
+		if ps -p "$p" 2>&1 | grep "$mssh" > /dev/null; then
 			pssh=$p
 			break
 		fi
@@ -1269,6 +1361,8 @@ Kecho proxy=$proxy
 	done
 	if [ "X$getport" != "X" ]; then
 		:
+	elif [ "X$SSVNC_LIM_ACCEPT_PRELOAD" != "X" ] ; then
+		sleep 2
 	elif [ "X$ssh_cmd" = "Xsleep $ssh_sleep" ] ; then
 		#echo T sleep 1
 		sleep 1
@@ -1281,12 +1375,12 @@ Kecho proxy=$proxy
 		sleep 5
 	fi
 	echo ""
+	#reset
+	stty sane
 	if [ "X$SSVNC_EXTRA_SLEEP" != "X" ]; then
-		#echo T sleep $SSVNC_EXTRA_SLEEP
+		echo "sleep $SSVNC_EXTRA_SLEEP"
 		sleep $SSVNC_EXTRA_SLEEP
 	fi
-	#reset
-	stty sane
 	#echo "pssh=\"$pssh\""
 	if [ "X$use_sshssl" = "X" -a "X$getport" = "X" ]; then
 		echo "Running viewer:"
@@ -1351,12 +1445,15 @@ if [ "X$proxy" != "X" ]; then
 	PPROXY_REMOVE=1; export PPROXY_REMOVE
 	pcode "$ptmp"
 	if [ "X$showcert" != "X1" -a "X$direct_connect" = "X" ]; then
-		if uname | grep Darwin >/dev/null; then
+		if uname | egrep 'Darwin|SunOS' >/dev/null; then
 			# on mac we need to listen on socket instead of stdio:
 			nd=`findfree 6700`
 			PPROXY_LISTEN=$nd
 			export PPROXY_LISTEN
-			$ptmp 2>/dev/null &
+			if [ "X$reverse" = "X" ]; then
+				#$ptmp 2>/dev/null &
+				$ptmp &
+			fi
 			#sleep 3
 			sleep 2
 			host="localhost"
@@ -1423,7 +1520,7 @@ if [ "X$direct_connect" != "X" ]; then
 		disp="$N"
 	fi
 	if [ "X$SSVNC_EXTRA_SLEEP" != "X" ]; then
-		#echo T sleep $SSVNC_EXTRA_SLEEP
+		echo "T sleep $SSVNC_EXTRA_SLEEP"
 		sleep $SSVNC_EXTRA_SLEEP
 	fi
 	if [ "X$reverse" = "X" ]; then
@@ -1450,32 +1547,14 @@ if [ "X$direct_connect" != "X" ]; then
 	exit $?
 fi
 
-tmp=/tmp/ss_vncviewer${RANDOM}.$$
+tmp_cfg=/tmp/ss_vncviewer${RANDOM}.$$
-mytmp "$tmp"
+mytmp "$tmp_cfg"
-
-if [ "X$reverse" = "X" ]; then
-
-	cat > "$tmp" <<END
-foreground = yes
-pid =
-client = yes
-debug = 6
-$STUNNEL_EXTRA_OPTS
-$verify
-$cert
-
-[vnc_stunnel]
-accept = localhost:$use
-$connect
-
-END
-else
 
-	p2=`expr 5500 + $N`
+# make_tcert is no longer invoked via the ssvnc gui (Listen mode).
-	connect="connect = localhost:$p2"
+# make_tcert is for testing only now via -mycert BUILTIN
-	if [ "X$cert" = "X" ]; then
+make_tcert() {
-		tcert="/tmp/tcert${RANDOM}.$$"
+	tcert="/tmp/tcert${RANDOM}.$$"
-		cat > $tcert <<END
+	cat > $tcert <<END
 -----BEGIN RSA PRIVATE KEY-----
 MIIEowIBAAKCAQEAvkfXxb0wcxgrjV2ziFikjII+ze8iKcTBt47L0GM/c21efelN
 +zZpJUUXLu4zz8Ryq8Q+sQgfNy7uTOpN9bUUaOk1TnD7gaDQnQWiNHmqbW2kL+DS
@@ -1527,77 +1606,132 @@ wAH966SAOvd2s6yOHMvyDRIL7WHxfESB6rDHsdIW/yny1fBePjv473KrxyXtbz7I
 dMw1yW09l+eEo4A7GzwOdw==
 -----END CERTIFICATE-----
 END
-		chmod 600 $tcert
+	chmod 600 $tcert
-		cert="cert = $tcert"
+	echo "$tcert"
+}
+
+stunnel_exec=""
+if echo $STUNNEL_EXTRA_SVC_OPTS | grep '#stunnel-exec' > /dev/null; then
+	stunnel_exec="#"
+fi
+
+if [ "X$reverse" = "X" ]; then
+
+	if echo "$proxy" | grep repeater:// > /dev/null; then
+		if [ "X$cert" = "XBUILTIN" ]; then
+			ttcert=`make_tcert`
+			cert="cert = $ttcert"
+		fi
+		# Note for listen mode, an empty cert will cause stunnel to fail.
+		# The ssvnc gui will have already taken care of this.
 	fi
 
+	cat > "$tmp_cfg" <<END
+foreground = yes
+pid =
+client = yes
+debug = 6
+$STUNNEL_EXTRA_OPTS
+$STUNNEL_EXTRA_OPTS_USER
+$verify
+$cert
+
+${stunnel_exec}[vnc_stunnel]
+${stunnel_exec}accept = localhost:$use
+$connect
+$STUNNEL_EXTRA_SVC_OPTS
+$STUNNEL_EXTRA_SVC_OPTS_USER
+
+END
+else
+	stunnel_exec=""	# doesn't work for listening.
+
+	p2=`expr 5500 + $N`
+	connect="connect = localhost:$p2"
+	if [ "X$cert" = "XBUILTIN" ]; then
+		ttcert=`make_tcert`
+		cert="cert = $ttcert"
+	fi
+	# Note for listen mode, an empty cert will cause stunnel to fail.
+	# The ssvnc gui will have already taken care of this.
+
 	STUNNEL_EXTRA_OPTS=`echo "$STUNNEL_EXTRA_OPTS" | sed -e 's/maxconn/#maxconn/'`
 
 	hloc=""
 	if [ "X$use_ssh" = "X1" ]; then
 		hloc="localhost:"
 	fi
-	cat > "$tmp" <<END
+	cat > "$tmp_cfg" <<END
 foreground = yes
 pid =
 client = no
 debug = 6
 $STUNNEL_EXTRA_OPTS
+$STUNNEL_EXTRA_OPTS_USER
 $verify
 $cert
 
 [vnc_stunnel]
 accept = $hloc$port
 $connect
+$STUNNEL_EXTRA_SVC_OPTS
+$STUNNEL_EXTRA_SVC_OPTS_USER
 
 END
-
 fi
 
 echo ""
 echo "Using this stunnel configuration:"
 echo ""
-cat "$tmp" | uniq
+cat "$tmp_cfg" | uniq
 echo ""
 sleep 1
 
-echo ""
+if [ "X$stunnel_exec" = "X" ]; then
-echo "Running stunnel:"
-echo "$STUNNEL $tmp"
-st=`echo "$STUNNEL" | awk '{print $1}'`
-$st -help > /dev/null 2>&1
-$STUNNEL "$tmp" < /dev/tty > /dev/tty &
-stunnel_pid=$!
-echo ""
-
-# pause here to let the user supply a possible passphrase for the
-# mycert key:
-if [ "X$mycert" != "X" ]; then
-	sleep 1
 	echo ""
-	echo "(pausing for possible certificate passphrase dialog)"
+	echo "Running stunnel:"
+	echo "$STUNNEL $tmp_cfg"
+	st=`echo "$STUNNEL" | awk '{print $1}'`
+	$st -help > /dev/null 2>&1
+	$STUNNEL "$tmp_cfg" < /dev/tty > /dev/tty &
+	stunnel_pid=$!
 	echo ""
-	sleep 4
+
+	# pause here to let the user supply a possible passphrase for the
+	# mycert key:
+	if [ "X$mycert" != "X" ]; then
+		sleep 1
+		echo ""
+		echo "(pausing for possible certificate passphrase dialog)"
+		echo ""
+		sleep 4
+	fi
+	#echo T sleep 1
+	sleep 1
+	rm -f "$tmp_cfg"
 fi
-#echo T sleep 1
+
-sleep 1
-rm -f "$tmp"
 
 echo ""
 if [ "X$SSVNC_EXTRA_SLEEP" != "X" ]; then
+	echo "sleep $SSVNC_EXTRA_SLEEP"
 	sleep $SSVNC_EXTRA_SLEEP
 fi
 echo "Running viewer:"
 if [ "X$reverse" = "X" ]; then
-	echo "$VNCVIEWERCMD" "$@" localhost:$N
+	vnc_hp=localhost:$N
+	if [ "X$stunnel_exec" != "X" ]; then
+		vnc_hp="exec=$STUNNEL $tmp_cfg"
+	fi
+	echo "$VNCVIEWERCMD" "$@" "$vnc_hp"
 	trap "final" 0 2 15
 	echo ""
-	$VNCVIEWERCMD "$@" localhost:$N
+	$VNCVIEWERCMD "$@" "$vnc_hp"
 	if [ $? != 0 ]; then
 		echo "vncviewer command failed: $?"
 		if [ "X$secondtry" = "X1" ]; then
 			sleep 2
-			$VNCVIEWERCMD "$@" localhost:$N
+			$VNCVIEWERCMD "$@" "$vnc_hp"
 		fi
 	fi
 else
@@ -1607,6 +1741,12 @@ else
 	echo "$VNCVIEWERCMD" "$@" -listen $N
 	trap "final" 0 2 15
 	echo ""
+	if [ "X$proxy" != "X" ]; then
+		PPROXY_REVERSE="localhost:$port"; export PPROXY_REVERSE
+		PPROXY_SLEEP=1; export PPROXY_SLEEP;
+		PPROXY_KILLPID=+1; export PPROXY_KILLPID;
+		$ptmp &
+	fi
 	$VNCVIEWERCMD "$@" -listen $N
 fi
 

x11vnc/8to24.c

@@ -1359,6 +1359,8 @@ static int get_cmap(int j, Colormap cmap) {
 		X_LOCK;
 		ncells = CellsOfScreen(ScreenOfDisplay(dpy, scr));
 		X_UNLOCK;
+	} else {
+		ncells = NCOLOR;
 	}
 if (db24 > 1) fprintf(stderr, "get_cmap: %d 0x%x\n", j, (unsigned int) cmap);
 

x11vnc/ChangeLog

@@ -1,3 +1,10 @@
+2008-09-06  Karl Runge <runge@karlrunge.com>
+	* x11vnc: kill gui_pid on exit in -connect/-connect_or_exit mode.
+	  -grablocal n experiment (not compiled by default).  -macuskbd
+	  option for macosx for orig uskdb code. keycode=N remote contol
+	  cmd.  Find dpy look at non-NFS cookies in /tmp.  Fix gui tray
+	  insertion on recent gnome dt. Fix connect_file bug. Sync SSVNC
+
 2008-06-07  Karl Runge <runge@karlrunge.com>
 	* x11vnc: -clip xineramaN option, -DIGNORE_GETSPNAM for HP-UX.
 	  Print info on SSH_CONNECTION override.

x11vnc/connections.c

@@ -755,6 +755,10 @@ void client_gone(rfbClientPtr client) {
 
 	if (inetd && client == inetd_client) {
 		rfbLog("inetd viewer exited.\n");
+		if (gui_pid > 0) {
+			rfbLog("killing gui_pid %d\n", gui_pid);
+			kill(gui_pid, SIGTERM);
+		}
 		clean_up_exit(0);
 	}
 	if (connect_once) {
@@ -779,6 +783,10 @@ void client_gone(rfbClientPtr client) {
 		}
 
 		rfbLog("viewer exited.\n");
+		if ((client_connect || connect_or_exit) && gui_pid > 0) {
+			rfbLog("killing gui_pid %d\n", gui_pid);
+			kill(gui_pid, SIGTERM);
+		}
 		clean_up_exit(0);
 	}
 #ifdef MACOSX
@@ -2423,6 +2431,10 @@ void reverse_connect(char *str) {
 		if (connect_or_exit) {
 			rfbLogEnable(1);
 			rfbLog("exiting under -connect_or_exit\n");
+			if (gui_pid > 0) {
+				rfbLog("killing gui_pid %d\n", gui_pid);
+				kill(gui_pid, SIGTERM);
+			}
 			clean_up_exit(0);
 		}
 		return;
@@ -2458,6 +2470,10 @@ void reverse_connect(char *str) {
 		if (client_count <= nclients0)  {
 			rfbLogEnable(1);
 			rfbLog("exiting under -connect_or_exit\n");
+			if (gui_pid > 0) {
+				rfbLog("killing gui_pid %d\n", gui_pid);
+				kill(gui_pid, SIGTERM);
+			}
 			clean_up_exit(0);
 		}
 	}
@@ -2737,6 +2753,7 @@ void check_gui_inputs(void) {
 static int turn_off_truecolor = 0;
 
 static void turn_off_truecolor_ad(rfbClientPtr client) {
+	if (client) {}
 	if (turn_off_truecolor) {
 		rfbLog("turning off truecolor advertising.\n");
 		screen->serverFormat.trueColour = FALSE;

x11vnc/gui.c

@@ -25,6 +25,7 @@ Window tray_request = None;
 Window tray_window = None;
 int tray_unembed = 0;
 pid_t run_gui_pid = 0;
+pid_t gui_pid = 0;
 
 
 char *get_gui_code(void);
@@ -50,6 +51,10 @@ static Window tweak_tk_window_id(Window win) {
 	char *name = NULL;
 	Window parent, new;
 
+	if (getenv("NO_TWEAK_TK_WINDOW_ID")) {
+		return win;
+	}
+
 	/* hack for tk, does not report outermost window */
 	new = win;
 	parent = parent_window(win, &name);
@@ -684,8 +689,10 @@ void do_gui(char *opts, int sleep) {
 					fprintf(icon_mode_fh, "none\n");
 					fflush(icon_mode_fh);
 					if (! got_connect_once) {
-						/* want -forever for tray */
+						if (!client_connect && !connect_or_exit) {
-						connect_once = 0;
+							/* want -forever for tray? */
+							connect_once = 0;
+						}
 					}
 				}
 			}
@@ -707,6 +714,7 @@ void do_gui(char *opts, int sleep) {
 		}
 		if (connect_to_x11vnc) {
 			run_gui_pid = p;
+			gui_pid = p;
 		}
 #else
 		fprintf(stderr, "system does not support fork: start "

x11vnc/gui.h

@@ -12,6 +12,7 @@ extern Window tray_request;
 extern Window tray_window;
 extern int tray_unembed;
 extern pid_t run_gui_pid;
+extern pid_t gui_pid;
 
 extern char *get_gui_code(void);
 extern int tray_embed(Window iconwin, int remove);

x11vnc/help.c

@@ -484,7 +484,7 @@ void print_help(int mode) {
 "                       to plumb reverse connections.\n"
 "\n"
 "-connect_or_exit str   As with -connect, except if none of the reverse\n"
-"                       connections succeed, then x11vnc shutdowns immediately.\n"
+"                       connections succeed, then x11vnc shuts down immediately\n"
 "\n"
 "                       By the way, if you do not want x11vnc to listen on\n"
 "                       ANY interface use -rfbport 0  which is handy for the\n"
@@ -628,6 +628,16 @@ void print_help(int mode) {
 "                       use the -R remote control to turn the other back on,\n"
 "                       e.g. -R nograbptr.\n"
 "\n"
+#ifdef ENABLE_GRABLOCAL
+"-grablocal n           If it appears that a user sitting at the physical\n"
+"                       display has injected a keystroke or mouse event ignore\n"
+"                       any VNC client inputs for the next n seconds.  The idea\n"
+"                       is that during a demonstration, etc, the local user\n"
+"                       will not be interrupted by viewers accidentally moving\n"
+"                       the mouse, etc.  The detection of local user input is\n"
+"                       approximate and so at times gives unexpected results.\n"
+"\n"
+#endif
 "-viewpasswd string     Supply a 2nd password for view-only logins.  The -passwd\n"
 "                       (full-access) password must also be supplied.\n"
 "\n"
@@ -3631,25 +3641,27 @@ void print_help(int mode) {
 "                       You can also set the env. var X11VNC_UINPUT_DEBUG=1 or\n"
 "                       higher to get debugging output for UINPUT mode.\n"
 "\n"
-"-macnodim              For the native Mac OS X server, disable dimming. \n"
+"-macnodim              For the native MacOSX server, disable dimming. \n"
-"-macnosleep            For the native Mac OS X server, disable display sleep.\n"
+"-macnosleep            For the native MacOSX server, disable display sleep.\n"
-"-macnosaver            For the native Mac OS X server, disable screensaver.\n"
+"-macnosaver            For the native MacOSX server, disable screensaver.\n"
-"-macnowait             For the native Mac OS X server, do not wait for the\n"
+"-macnowait             For the native MacOSX server, do not wait for the\n"
 "                       user to switch back to his display.\n"
-"-macwheel n            For the native Mac OS X server, set the mouse wheel\n"
+"-macwheel n            For the native MacOSX server, set the mouse wheel\n"
 "                       speed to n (default 5).\n"
-"-macnoswap             For the native Mac OS X server, do not swap mouse\n"
+"-macnoswap             For the native MacOSX server, do not swap mouse\n"
 "                       buttons 2 and 3.\n"
-"-macnoresize           For the native Mac OS X server, do not resize or reset\n"
+"-macnoresize           For the native MacOSX server, do not resize or reset\n"
 "                       the framebuffer even if it is detected that the screen\n"
 "                       resolution or depth has changed.\n"
-"-maciconanim n         For the native Mac OS X server, set n to the number\n"
+"-maciconanim n         For the native MacOSX server, set n to the number\n"
 "                       of milliseconds that the window iconify/deiconify\n"
 "                       animation takes.  In -ncache mode this value will be\n"
 "                       used to skip the animation if possible. (default 400)\n"
-"-macmenu               For the native Mac OS X server, in -ncache client-side\n"
+"-macmenu               For the native MacOSX server, in -ncache client-side\n"
 "                       caching mode, try to cache pull down menus (not perfect\n"
 "                       because they have animated fades, etc.)\n"
+"-macuskbd              For the native MacOSX server, use the original\n"
+"                       keystroke insertion code based on a US keyboard.\n"
 "\n"
 "-gui [gui-opts]        Start up a simple tcl/tk gui based on the the remote\n"
 "                       control options -remote/-query described below.\n"
@@ -3707,6 +3719,14 @@ void print_help(int mode) {
 "                       fully functional, the gui mode should be \"start\"\n"
 "                       (the default).\n"
 "\n"
+"                       Note that tray or icon mode will imply the -forever\n"
+"                       x11vnc option (if the x11vnc server is started along\n"
+"                       with the gui) unless -connect or -connect_or_exit has\n"
+"                       been specified.  So x11vnc (and the tray/icon gui)\n"
+"                       will wait for more connections after the first client\n"
+"                       disconnects.  If you want only one viewer connection\n"
+"                       include the -once option.\n"
+"\n"
 "                       For \"icon\" the gui just a small standalone window.\n"
 "                       For \"tray\" it will attempt to embed itself in the\n"
 "                       \"system tray\" if possible. If \"=setpass\" is appended then\n"
@@ -4397,12 +4417,13 @@ void xopen_display_fail_message(char *disp) {
 	fprintf(stderr, "\n");
 	fprintf(stderr, "Some tips and guidelines:\n");
 	fprintf(stderr, "\n");
-	fprintf(stderr, " * An X server (the one you wish to view) must"
+	fprintf(stderr, "** An X server (the one you wish to view) must"
 	    " be running before x11vnc is\n");
-	fprintf(stderr, "   started: x11vnc does not start the X server.  (however, see the\n");
+	fprintf(stderr, "   started: x11vnc does not start the X server.  "
-	fprintf(stderr, "   recent -create option if that is what you really want).\n");
+	    "(however, see the -create\n");
+	fprintf(stderr, "   option if that is what you really want).\n");
 	fprintf(stderr, "\n");
-	fprintf(stderr, " * You must use -display <disp>, -OR- set and"
+	fprintf(stderr, "** You must use -display <disp>, -OR- set and"
 	    " export your $DISPLAY\n");
 	fprintf(stderr, "   environment variable to refer to the display of"
 	    " the desired X server.\n");
@@ -4414,7 +4435,7 @@ void xopen_display_fail_message(char *disp) {
 	    " or a guru if you are having\n");
 	fprintf(stderr, "   difficulty determining what your X DISPLAY is.\n");
 	fprintf(stderr, "\n");
-	fprintf(stderr, " * Next, you need to have sufficient permissions"
+	fprintf(stderr, "** Next, you need to have sufficient permissions"
 	    " (Xauthority) \n");
 	fprintf(stderr, "   to connect to the X DISPLAY.   Here are some"
 	    " Tips:\n");
@@ -4438,7 +4459,7 @@ void xopen_display_fail_message(char *disp) {
 	    " -display :0\n");
 	fprintf(stderr, "   you must have read permission for the auth file.\n");
 	fprintf(stderr, "\n");
-	fprintf(stderr, " - If NO ONE is logged into an X session yet, but"
+	fprintf(stderr, "** If NO ONE is logged into an X session yet, but"
 	    " there is a greeter login\n");
 	fprintf(stderr, "   program like \"gdm\", \"kdm\", \"xdm\", or"
 	    " \"dtlogin\" running, you will need\n");
@@ -4447,18 +4468,21 @@ void xopen_display_fail_message(char *disp) {
 	fprintf(stderr, "   Some examples for various display managers:\n");
 	fprintf(stderr, "\n");
 	fprintf(stderr, "     gdm:     -auth /var/gdm/:0.Xauth\n");
+	fprintf(stderr, "              -auth /var/lib/gdm/:0.Xauth\n");
 	fprintf(stderr, "     kdm:     -auth /var/lib/kdm/A:0-crWk72\n");
+	fprintf(stderr, "              -auth /var/run/xauth/A:0-crWk72\n");
 	fprintf(stderr, "     xdm:     -auth /var/lib/xdm/authdir/authfiles/A:0-XQvaJk\n");
 	fprintf(stderr, "     dtlogin: -auth /var/dt/A:0-UgaaXa\n");
 	fprintf(stderr, "\n");
+	fprintf(stderr, "   Sometimes the command \"ps wwwwaux | grep auth\""
+	    " can reveal the file location.\n");
+	fprintf(stderr, "\n");
 	fprintf(stderr, "   Only root will have read permission for the"
 	    " file, and so x11vnc must be run\n");
-	fprintf(stderr, "   as root.  The random characters in the filenames"
+	fprintf(stderr, "   as root (or copy it).  The random characters in the filenames"
-	    " will of course change,\n");
+	    " will of course\n");
-	fprintf(stderr, "   and the directory the cookie file resides in may"
+	fprintf(stderr, "   change and the directory the cookie file resides in"
-	    " also be system dependent.\n");
+	    " is system dependent.\n");
-	fprintf(stderr, "   Sometimes the command \"ps wwwaux | grep auth\""
-	    " can reveal the file location.\n");
 	fprintf(stderr, "\n");
 	fprintf(stderr, "See also: http://www.karlrunge.com/x11vnc/#faq\n");
 }
@@ -4474,7 +4498,7 @@ void nopassword_warning_msg(int gotloc) {
 "#@        YOU ARE RUNNING X11VNC WITHOUT A PASSWORD!!        @#\n"
 "#@                                                           @#\n"
 "#@  This means anyone with network access to this computer   @#\n"
-"#@  will be able to view and control your desktop.           @#\n"
+"#@  may be able to view and control your desktop.            @#\n"
 "#@                                                           @#\n"
 "#@ >>> If you did not mean to do this Press CTRL-C now!! <<< @#\n"
 "#@                                                           @#\n"

x11vnc/keyboard.c

@@ -3149,6 +3149,7 @@ void keyboard(rfbBool down, rfbKeySym keysym, rfbClientPtr client) {
 				last_rfb_down = down;
 				last_rfb_keysym = keysym;
 				last_rfb_keytime = tnow;
+				last_rfb_key_injected = dnow();
 
 				got_user_input++;
 				got_keyboard_input++;
@@ -3176,6 +3177,7 @@ void keyboard(rfbBool down, rfbKeySym keysym, rfbClientPtr client) {
 	last_rfb_down = down;
 	last_rfb_keysym = keysym;
 	last_rfb_keytime = tnow;
+	last_rfb_key_injected = dnow();
 
 	got_user_input++;
 	got_keyboard_input++;

x11vnc/macosxCG.c

@@ -31,6 +31,7 @@ int macosxCG_get_cursor_pos(int *x, int *y);
 int macosxCG_get_cursor(void);
 void macosxCG_init_key_table(void);
 void macosxCG_key_inject(int down, unsigned int keysym);
+void macosxCG_keycode_inject(int down, int keycode);
 
 CGDirectDisplayID displayID = 0;
 
@@ -595,6 +596,14 @@ void macosxCG_init_key_table(void) {
 }
 
 extern void init_key_table(void);
+extern int macosx_us_kbd;
+
+void macosxCG_keycode_inject(int down, int keycode) {
+	CGKeyCode keyCode = (CGKeyCode) keycode;
+	CGCharCode keyChar = 0;
+
+	CGPostKeyboardEvent(keyChar, keyCode, down);
+}
 
 void macosxCG_key_inject(int down, unsigned int keysym) {
 	CGKeyCode keyCode = keyTable[(unsigned short)keysym];
@@ -606,7 +615,7 @@ void macosxCG_key_inject(int down, unsigned int keysym) {
 
 	init_key_table();
 
-	if (keysym < 0xFF) {
+	if (keysym < 0xFF && macosx_us_kbd) {
 		keyChar = (CGCharCode) keysym;
 	}
 	if (keyCode == 0xFFFF) {

x11vnc/macosxCG.h

@@ -20,6 +20,7 @@ extern int macosxCG_get_cursor_pos(int *x, int *y);
 extern int macosxCG_get_cursor(void);
 extern void macosxCG_init_key_table(void);
 extern void macosxCG_key_inject(int down, unsigned int keysym);
+extern void macosxCG_keycode_inject(int down, int keycode);
 
 extern void macosxCG_refresh_callback_off(void);
 extern void macosxCG_refresh_callback_on(void);

x11vnc/misc/enhanced_tightvnc_viewer/README

@@ -29,7 +29,7 @@ survey http://rechten.uvt.nl/koops/cryptolaw/index.htm for useful
 information.
 
 All work done by Karl J. Runge in this project is
-Copyright (c) 2006-2007 Karl J. Runge and is licensed under the GPL as
+Copyright (c) 2006-2008 Karl J. Runge and is licensed under the GPL as
 described in the file COPYING in this directory.
 
 All the files and information in this project are provided "AS IS"
@@ -66,23 +66,30 @@ The enhanced TightVNC viewer features are:
 
 	- Create or Import SSL Certificates and Private Keys.
 
+	- Reverse (viewer listening) VNC connections via SSL and SSH.
+
+	- Support for Web Proxies, SOCKS Proxies, and the UltraVNC
+	  repeater proxy (e.g. repeater://host:port+ID:1234). Multiple
+	  proxies may be chained together (3 max).
+
+	- Support for SSH Gateway connections and non-standard SSH ports.
+
+	- You can also use your own VNC Viewer, e.g. UltraVNC or RealVNC,
+	  with the front-end GUI or scripts if you like.
+
 	- Automatic Service tunnelling via SSH for CUPS and SMB Printing,
 	  ESD/ARTSD Audio, and SMB (Windows/Samba) filesystem mounting.
 
+	- Sets up any additional SSH port redirections that you want.
+
         - Port Knocking for "closed port" SSH/SSL connections.  In addition
           to a simple fixed port sequence and one-time-pad implementation,
           a hook is also provided to run any port knocking client before a
           connecting.
 
-	- You can also use your own VNC Viewer, e.g. UltraVNC or RealVNC,
-	  with the front-end GUI or scripts if you like.
-
-	- Sets up any additional SSH port redirections that you want.
-
 	- Support for native MacOS X usage with bundled Chicken of the
-	  VNC viewer.
+	  VNC viewer (the Unix X11 viewer is also provided for MacOS X,
-
+	  and is better IMHO).
-	- Reverse (viewer listening) VNC connections via SSL and SSH.
 
 	- Dynamic VNC Server Port determination and redirection (using
 	  ssh's builtin SOCKS proxy, -D) for servers like x11vnc that
@@ -116,6 +123,16 @@ The enhanced TightVNC viewer features are:
 	  (java must be in $PATH). Note that x11vnc supports UltraVNC
 	  file transfer.
 
+	- Connection support for the UltraVNC repeater proxy (-repeater
+	  option).
+
+	- Support for UltraVNC Single Click operation. (both unencrypted:
+	  SC I, and SSL encrypted: SC III)
+
+	- Instead of hostname:display one can also supply "exec=command args..."
+	  to connect the viewer to the stdio of an external command
+	  (e.g. stunnel or socat) rather than using a TCP/IP socket.
+
 	- Extremely low color modes: 64 and 8 colors in 8bpp
 	  (-use64/-bgr222, -use8/-bgr111)
 
@@ -391,7 +408,7 @@ If you need to Build:
 If your OS/arch is not included or the provided binary has the wrong
 library dependencies, etc. the script "build.unix" may be able to
 successfully build on for you and deposit the binaries down in ./bin/...
-using the included source code.
+using the included source code.  It is a hack but usually works.
 
 You MUST run the build.unix script from this directory (that this toplevel
 README is in, i.e "ssvnc") and like this:
@@ -401,9 +418,30 @@ README is in, i.e "ssvnc") and like this:
 To use custom locations for libraries see the LDFLAGS_OS and CPPFLAGS_OS
 description at the top of the build.unix script.
 
+You can set these env. vars to customize the build:
+
+	SSVNC_BUILD_NO_STATIC=1        do not try to statically link libs
+	SSVNC_BUILD_FORCE_OVERWRITE=1  do not prompt about existing binaries
+	SSVNC_BUILD_SKIP_VIEWER=1      do not build vncviewer
+	SSVNC_BUILD_SKIP_STUNNEL=1     do not build stunnel
+	SSVNC_BUILD_ULTRAFTP=1         only build the file xfer helper jar
+
+here is an example to build only the vncviewer and with normal library
+linking (and in a more or less automated way):
+
+ env SSVNC_BUILD_NO_STATIC=1 SSVNC_BUILD_FORCE_OVERWRITE=1 SSVNC_BUILD_SKIP_STUNNEL=1 ./build.unix
+
 Feel free to ask us if you need help running ./build.unix
 
 
+Convential Build:
+
+A more conventional source tarball is provided in ssvnc-x.y.z.src.tar.gz.
+It uses a more or less familiar 'make config; make all; make install'
+method.  It does not include stunnel, so that must be installed on the
+system separately.
+
+
 The programs:
 ------------
 
@@ -519,6 +557,86 @@ as long as you install external vncviewer and stunnel packages:
 	ssvnc_unix_minimal-1.x.y.tar.gz
 
 
+Untrusted Local Users:
+---------------------
+
+    *IMPORTANT WARNING*:  If you run SSVNC on a workstation or computer
+    that other users can log into and you DO NOT TRUST these users
+    (it is a shame but sometimes one has to work in an environment like
+    this), then please note the following warning.
+
+    By 'do not trust' we mean they might try to gain access to remote
+    machines you connect to via SSVNC.  Note that an untrusted local
+    user can often obtain root access in a short amount of time; if a
+    user has acheived that, then all bets are off for ANYTHING that you
+    do on the workstation.  It is best to get rid of Untrusted Local
+    Users as soon as possible.
+
+    Both the SSL and SSH tunnels set up by SSVNC listen on certain ports
+    on the 'localhost' address and redirect TCP connections to the remote
+    machine; usually the VNC server running there (but it could also be
+    another service, e.g. CUPS printing).  These are the stunnel(8) SSL
+    redirection and the ssh(1) '-L' port redirection.  Because 'localhost'
+    is used only users or programs on the same workstation that is
+    running SSVNC can connect to these ports, however this includes any
+    local users (not just the user running SSVNC.)
+
+    If the untrusted local user tries to connect to these ports, he may
+    succeed in varying degrees to gain access to the remote machine.
+    We now list some safeguards one can put in place to try to make this
+    more difficult to acheive.
+
+    It probably pays to have the VNC server require a password, even
+    though there has already been SSL or SSH authentication (via
+    certificates or passwords).  In general if the VNC Server requires
+    SSL authentication of the viewer that helps, unless the untrusted
+    local user has gained access to your SSVNC certificate keys.
+
+    If the VNC server is configured to only allow one viewer connection
+    at a time, then the window of opportunity that the untrusted local
+    user can use is greatly reduced: he might only have a second or two
+    between the tunnel being set up and the SSVNC vncviewer connecting
+    to it (i.e. if the VNC server only allows a single connection, the
+    untrusted local user cannot connect once your session is established).
+    Similarly, when you disconnect the tunnel is torn down quickly and
+    there is little or no window of opportunity to connect (e.g. x11vnc
+    in its default mode exits after the first client disconnects).
+
+    Also for SSL tunnelling with stunnel(8) on Unix using one of the SSVNC
+    prebuilt 'bundles', a patched stunnel is provided that denies all
+    connections after the first one, and exits when the first one closes.
+    This is not true if the system installed stunnel(8) is used and is
+    not true when using SSVNC on Windows.
+
+    The following are two experimental features that are added to SSVNC
+    to improve the situation for the SSL/stunnel case.  Set them via
+    Options -> Advanced -> "STUNNEL Local Port Protections".
+
+    1) For SSL tunnelling with stunnel(8) on Unix there is a setting
+       'Use stunnel EXEC mode' (experimental) that will try to exec(2)
+       stunnel instead of using a listening socket.  This will require
+       using the specially modified vncviewer unix viewer provided
+       by SSVNC.  If this mode proves stable it will become the default.
+
+    2) For SSL tunnelling with stunnel(8) on Unix there is a setting
+       'Use stunnel IDENT check' (experimental) to limit socket
+       connections to be from you (this assumes the untrusted local
+       user has not become root on your workstation and has modified
+       your local IDENT check service; if he has you have much bigger
+       problems to worry about...)
+
+    There is also one simple LD_PRELOAD trick for SSH to limit the number
+    of accepted port redirection connections.  This makes the window of
+    time the untrusted local user can connect to the tunnel much smaller.
+    Enable it via Options -> Advanced -> "SSH Local Port Protections".
+    You will need to have the lim_accept.so file in your SSVNC package.
+
+    The main message is to 'Watch your Back' when you connect via the
+    SSVNC tunnels and there are users you don't trust on your workstation.
+    The same applies to ANY use of SSH '-L' port redirections or outgoing
+    stunnel SSL redirection services.
+
+
 Help and Info:
 -------------
 

x11vnc/misc/enhanced_tightvnc_viewer/Windows/sshvnc.bat

@@ -0,0 +1 @@
+start ssvnc.exe -ssh %1 %2 %3 %4 %5 %6 %7 %8 %9

x11vnc/misc/enhanced_tightvnc_viewer/Windows/tsvnc.bat

@@ -0,0 +1 @@
+start ssvnc.exe -ts %1 %2 %3 %4 %5 %6 %7 %8 %9

x11vnc/misc/enhanced_tightvnc_viewer/bin/sshvnc

@@ -0,0 +1,7 @@
+#!/bin/sh
+# 
+# wrapper for SSH_ONLY mode 
+# 
+PATH=`dirname "$0"`:$PATH; export PATH
+SSVNC_SSH_ONLY=1; export SSVNC_SSH_ONLY
+exec ssvnc -ssh "$@"

x11vnc/misc/enhanced_tightvnc_viewer/bin/ssvnc

@@ -79,7 +79,11 @@ nearby=0
 if [ -x "$dir/vncviewer" -a -x "$dir/stunnel" ]; then
 	nearby=1
 fi
-if [ ! -d "$dir/$name" -a $nearby = 0 ]; then
+if [ "X$name" = "X." ]; then
+	:
+	#type vncviewer
+	#type stunnel
+elif [ ! -d "$dir/$name" -a $nearby = 0 ]; then
 	echo
 	echo "Cannot find platform dir for your OS `uname -sm`:"
 	echo

x11vnc/misc/enhanced_tightvnc_viewer/bin/ssvnc_cmd

@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2006 by Karl J. Runge <runge@karlrunge.com>
+# Copyright (c) 2006-2008 by Karl J. Runge <runge@karlrunge.com>
 #
 # ssvnc_cmd:
 #
@@ -23,9 +23,15 @@
 #
 # Usage:
 #
-#     ssvnc_cmd [ss_vncviewer-args] hostname:N [tightvncviewer-args]
+#     ssvnc_cmd [ss_vncviewer-args] hostname:N [vncviewer-args]
 #
-# "hostname:N" is the host and VNC display to connect to, e.g. snoopy:0
+#  if, instead, this script is named "tightvncviewer" it calls the
+#  vncviewer directly and must be invoked as:
+#
+#     tightvncviewer [vncviewer-args] hostname:N
+#
+# In both cases, "hostname:N" is the host and VNC display to connect to,
+# e.g. snoopy:0
 #
 # See the script util/ss_vncviewer for details about its arguments:
 #
@@ -35,6 +41,8 @@
 #	-alpha
 #	-grab
 #
+# N.B. if this script is named "tightvncviewer" the vncviewer is called
+# directly, and there won't be any SSL or SSH encryption tunnels.
 #
 # If the *very first* argument is "-cotvnc" then it is assumed you are on
 # Darwin and want to run the Chicken of the VNC viewer via our wrapper.
@@ -75,9 +83,12 @@
 #       Option names may be abbreviated, e.g. -bgr instead of -bgr233.
 #       See the manual page for more information.
 #  
+# Note: the enhanced tightvnc viewer (SSVNC) has many more options, run
+# this script as "ssvnc_cmd Vnc://a:0 -help" or "tightvncviewer -help"
+# to seem them.
 
-if [ "X$1" = "X-h" -o "X$1" = "X-help" -o "X$1" = "X--help" ]; then
+if [ "X$1" = "X-h" -o "X$1" = "X-helpxxx" -o "X$1" = "X--help" ]; then
-	head -76 "$0" | grep -v bin/sh
+	tail -n +2 "$0" | sed -e '/^$/ q' -e 's/^#//' 
 	exit
 fi
 
@@ -145,12 +156,20 @@ do
 done
 dir=`dirname "$f"`
 PATH="$dir:$PATH"
+SSVNC_BASEDIR="$dir"
+export SSVNC_BASEDIR
+SSVNC_UNAME="$name"
+export SSVNC_UNAME
 
 nearby=0
 if [ -x "$dir/vncviewer" -a -x "$dir/stunnel" ]; then
 	nearby=1
 fi
-if [ ! -d "$dir/$name" -a $nearby = 0 ]; then
+if [ "X$name" = "X." ]; then
+	:
+	#type vncviewer
+	#type stunnel
+elif [ ! -d "$dir/$name" -a $nearby = 0 ]; then
 	echo
 	echo "Cannot find platform dir for your OS `uname -sm`:"
 	echo
@@ -223,6 +242,9 @@ fi
 #
 #
 if [ $use_ours = 1 ]; then
+	# avoid system vncviewer app-defaults
+	#XFILESEARCHPATH="/tmp/path/nowhere"; export XFILESEARCHPATH
+
 	if [ "X$base" = "Xtightvncviewer" ]; then
 		$VNCVIEWERCMD -encodings 'copyrect tight zrle zlib hextile' "$@"
 	else

x11vnc/misc/enhanced_tightvnc_viewer/bin/tsvnc

@@ -0,0 +1,7 @@
+#!/bin/sh
+# 
+# wrapper for TS_ONLY mode 
+# 
+PATH=`dirname "$0"`:$PATH; export PATH
+SSVNC_TS_ONLY=1; export SSVNC_TS_ONLY
+exec ssvnc -ts "$@"

x11vnc/misc/enhanced_tightvnc_viewer/bin/util/ss_vncviewer

@@ -447,6 +447,9 @@ findfree() {
 # removes files, etc.
 final() {
 	echo ""
+	if [ "X$tmp_cfg" != "X" ]; then
+		rm -f $tmp_cfg
+	fi
 	if [ "X$SS_VNCVIEWER_RM" != "X" ]; then
 		rm -f $SS_VNCVIEWER_RM 2>/dev/null
 	fi
@@ -1012,6 +1015,24 @@ if [ "X$use_ssh" = "X1" ]; then
 	# let user override ssh via $SSH
 	ssh=${SSH:-"ssh -x"}
 
+	if [ "X$SSVNC_LIM_ACCEPT_PRELOAD" != "X" ]; then
+		SSVNC_LIM_ACCEPT_PRELOAD="$SSVNC_BASEDIR/$SSVNC_UNAME/$SSVNC_LIM_ACCEPT_PRELOAD"
+	fi
+	if [ "X$SSVNC_LIM_ACCEPT_PRELOAD" != "X" ]; then
+		echo ""
+		echo "SSVNC_LIM_ACCEPT_PRELOAD=$SSVNC_LIM_ACCEPT_PRELOAD"
+	fi
+
+	if [ "X$SSVNC_LIM_ACCEPT_PRELOAD" != "X" -a -f "$SSVNC_LIM_ACCEPT_PRELOAD" ]; then
+		plvar=LD_PRELOAD
+		if uname | grep Darwin >/dev/null; then
+			plvar="DYLD_FORCE_FLAT_NAMESPACE=1 DYLD_INSERT_LIBRARIES"
+		fi
+		ssh="env $plvar=$SSVNC_LIM_ACCEPT_PRELOAD $ssh"
+	else
+		SSVNC_LIM_ACCEPT_PRELOAD=""
+	fi
+
 	if echo "$proxy" | egrep '(http|https|socks|socks4|socks5)://' > /dev/null; then
 		# Handle Web or SOCKS proxy(ies) for the initial connect.
 Kecho host=$host
@@ -1328,10 +1349,11 @@ Kecho proxy=$proxy
 
 	c=0
 	pssh=""
+	mssh=`echo "$ssh" | sed -e 's/^env.*ssh/ssh/'`
 	while [ $c -lt 30 ]
 	do
 		p=`expr $pmark + $c`
-		if ps -p "$p" 2>&1 | grep "$ssh" > /dev/null; then
+		if ps -p "$p" 2>&1 | grep "$mssh" > /dev/null; then
 			pssh=$p
 			break
 		fi
@@ -1339,6 +1361,8 @@ Kecho proxy=$proxy
 	done
 	if [ "X$getport" != "X" ]; then
 		:
+	elif [ "X$SSVNC_LIM_ACCEPT_PRELOAD" != "X" ] ; then
+		sleep 2
 	elif [ "X$ssh_cmd" = "Xsleep $ssh_sleep" ] ; then
 		#echo T sleep 1
 		sleep 1
@@ -1523,9 +1547,11 @@ if [ "X$direct_connect" != "X" ]; then
 	exit $?
 fi
 
-tmp=/tmp/ss_vncviewer${RANDOM}.$$
+tmp_cfg=/tmp/ss_vncviewer${RANDOM}.$$
-mytmp "$tmp"
+mytmp "$tmp_cfg"
 
+# make_tcert is no longer invoked via the ssvnc gui (Listen mode).
+# make_tcert is for testing only now via -mycert BUILTIN
 make_tcert() {
 	tcert="/tmp/tcert${RANDOM}.$$"
 	cat > $tcert <<END
@@ -1584,37 +1610,50 @@ END
 	echo "$tcert"
 }
 
+stunnel_exec=""
+if echo $STUNNEL_EXTRA_SVC_OPTS | grep '#stunnel-exec' > /dev/null; then
+	stunnel_exec="#"
+fi
+
 if [ "X$reverse" = "X" ]; then
 
 	if echo "$proxy" | grep repeater:// > /dev/null; then
-		if [ "X$cert" = "X" ]; then
+		if [ "X$cert" = "XBUILTIN" ]; then
 			ttcert=`make_tcert`
 			cert="cert = $ttcert"
 		fi
+		# Note for listen mode, an empty cert will cause stunnel to fail.
+		# The ssvnc gui will have already taken care of this.
 	fi
 
-	cat > "$tmp" <<END
+	cat > "$tmp_cfg" <<END
 foreground = yes
 pid =
 client = yes
 debug = 6
 $STUNNEL_EXTRA_OPTS
+$STUNNEL_EXTRA_OPTS_USER
 $verify
 $cert
 
-[vnc_stunnel]
+${stunnel_exec}[vnc_stunnel]
-accept = localhost:$use
+${stunnel_exec}accept = localhost:$use
 $connect
+$STUNNEL_EXTRA_SVC_OPTS
+$STUNNEL_EXTRA_SVC_OPTS_USER
 
 END
 else
+	stunnel_exec=""	# doesn't work for listening.
 
 	p2=`expr 5500 + $N`
 	connect="connect = localhost:$p2"
-	if [ "X$cert" = "X" ]; then
+	if [ "X$cert" = "XBUILTIN" ]; then
 		ttcert=`make_tcert`
 		cert="cert = $ttcert"
 	fi
+	# Note for listen mode, an empty cert will cause stunnel to fail.
+	# The ssvnc gui will have already taken care of this.
 
 	STUNNEL_EXTRA_OPTS=`echo "$STUNNEL_EXTRA_OPTS" | sed -e 's/maxconn/#maxconn/'`
 
@@ -1622,18 +1661,21 @@ else
 	if [ "X$use_ssh" = "X1" ]; then
 		hloc="localhost:"
 	fi
-	cat > "$tmp" <<END
+	cat > "$tmp_cfg" <<END
 foreground = yes
 pid =
 client = no
 debug = 6
 $STUNNEL_EXTRA_OPTS
+$STUNNEL_EXTRA_OPTS_USER
 $verify
 $cert
 
 [vnc_stunnel]
 accept = $hloc$port
 $connect
+$STUNNEL_EXTRA_SVC_OPTS
+$STUNNEL_EXTRA_SVC_OPTS_USER
 
 END
 fi
@@ -1641,31 +1683,33 @@ fi
 echo ""
 echo "Using this stunnel configuration:"
 echo ""
-cat "$tmp" | uniq
+cat "$tmp_cfg" | uniq
 echo ""
 sleep 1
 
-echo ""
+if [ "X$stunnel_exec" = "X" ]; then
-echo "Running stunnel:"
-echo "$STUNNEL $tmp"
-st=`echo "$STUNNEL" | awk '{print $1}'`
-$st -help > /dev/null 2>&1
-$STUNNEL "$tmp" < /dev/tty > /dev/tty &
-stunnel_pid=$!
-echo ""
-
-# pause here to let the user supply a possible passphrase for the
-# mycert key:
-if [ "X$mycert" != "X" ]; then
-	sleep 1
 	echo ""
-	echo "(pausing for possible certificate passphrase dialog)"
+	echo "Running stunnel:"
+	echo "$STUNNEL $tmp_cfg"
+	st=`echo "$STUNNEL" | awk '{print $1}'`
+	$st -help > /dev/null 2>&1
+	$STUNNEL "$tmp_cfg" < /dev/tty > /dev/tty &
+	stunnel_pid=$!
 	echo ""
-	sleep 4
+
+	# pause here to let the user supply a possible passphrase for the
+	# mycert key:
+	if [ "X$mycert" != "X" ]; then
+		sleep 1
+		echo ""
+		echo "(pausing for possible certificate passphrase dialog)"
+		echo ""
+		sleep 4
+	fi
+	#echo T sleep 1
+	sleep 1
+	rm -f "$tmp_cfg"
 fi
-#echo T sleep 1
-sleep 1
-rm -f "$tmp"
 
 
 echo ""
@@ -1675,15 +1719,19 @@ if [ "X$SSVNC_EXTRA_SLEEP" != "X" ]; then
 fi
 echo "Running viewer:"
 if [ "X$reverse" = "X" ]; then
-	echo "$VNCVIEWERCMD" "$@" localhost:$N
+	vnc_hp=localhost:$N
+	if [ "X$stunnel_exec" != "X" ]; then
+		vnc_hp="exec=$STUNNEL $tmp_cfg"
+	fi
+	echo "$VNCVIEWERCMD" "$@" "$vnc_hp"
 	trap "final" 0 2 15
 	echo ""
-	$VNCVIEWERCMD "$@" localhost:$N
+	$VNCVIEWERCMD "$@" "$vnc_hp"
 	if [ $? != 0 ]; then
 		echo "vncviewer command failed: $?"
 		if [ "X$secondtry" = "X1" ]; then
 			sleep 2
-			$VNCVIEWERCMD "$@" localhost:$N
+			$VNCVIEWERCMD "$@" "$vnc_hp"
 		fi
 	fi
 else

x11vnc/misc/enhanced_tightvnc_viewer/build.unix

@@ -1,6 +1,10 @@
 #!/bin/sh
 
-# Notes: to customize locations, e.g. for libjpeg, set LDFLAGS_OS and/or CPPFLAGS_OS
+# See the README in this directory for more info on using this script
+# (build.unix).  Search for SSVNC_BUILD.
+#
+# Notes: to customize locations, e.g. for libjpeg, set LDFLAGS_OS and/or
+# CPPFLAGS_OS
 #
 # e.g. on Darwin we did:
 #
@@ -45,6 +49,10 @@ if [ ! -d ./bin -o ! -d src/patches -o ! -f ./build.unix ]; then
 	exit $?
 fi
 
+pline() {
+	echo "------------------------------------------------------------------"
+}
+
 # Try to find osname.arch
 #
 name=$UNAME
@@ -62,35 +70,73 @@ if [ `uname` = "Darwin" ]; then
 	LDD="otool -L"
 fi
 
+# Create a tmp dir for this build:
+#
+tmp=./src/tmp/$name.$$
+if [ "X$TMPDIR" != "X" ]; then
+	tmp="$TMPDIR/$tmp"
+fi
+mkdir -p $tmp || exit 1
+
+# Do ultraftp Java viewer (only):
+#
+if [ "X$SSVNC_BUILD_ULTRAFTP" != "X" ]; then
+	ultraftp_tar=`ls -td ./src/zips/ultraftp.tar* | head -1`
+	if [ ! -f $ultraftp_tar ]; then
+		echo "could not locate ultraftp java vnc viewer source"
+		exit 1
+	fi
+	echo ""
+	pline
+	echo "BUILDING THE ULTRAFTP HELPER JAR"
+	echo ""
+	sleep 1
+
+	cat $ultraftp_tar | (cd $tmp; tar xvf -) || exit 1
+	cd $tmp/ultraftp || exit 1
+	pwd
+	echo
+	make install
+
+	exit 0	# DONE
+fi
+
 # Work out main destination:
 #
 dest=./bin/$name
 if [ -d $dest ]; then
-	printf "$dest exists.  overwrite it? [y]/n "
+	if [ "X$SSVNC_BUILD_FORCE_OVERWRITE" = "X" ]; then
-	read x
+		printf "$dest exists.  overwrite in it? [y]/n "
-	if [ "X$x" = "Xn" ]; then
+		read x
-		exit
+		if [ "X$x" = "Xn" ]; then
+			exit
+		fi
+	else
+		echo "$dest exists.  overwriting in it."
+	fi
+	if [ "X$SSVNC_BUILD_SKIP_VIEWER" = "X" ]; then
+		if [ `uname` = "Darwin" ]; then
+			rm -f $dest/vncviewer.x11*
+		else
+			rm -f $dest/vncviewer*
+		fi
+	fi
+	if [ "X$SSVNC_BUILD_SKIP_STUNNEL" = "X" ]; then
+		rm -f $dest/stunnel*
 	fi
-	rm -f $dest/*stunnel*
-	rm -f $dest/*vncviewer*
 fi
 mkdir -p $dest || exit 1
 
-# Create a tmp dir for this build:
-#
-tmp=./src/tmp/$name.$$
-if [ "X$TMPDIR" != "X" ]; then
-	tmp="$TMPDIR/$tmp"
-fi
-mkdir -p $tmp || exit 1
 
 # Try to find some static archives of various libraries:
 #
 libs="$tmp/libs"
 mkdir -p $libs || exit 1
 for liba in libz.a libjpeg.a libssl.a libcrypto.a
-#for liba in libz.a libjpeg.a
 do
+	if [ "X$SSVNC_BUILD_NO_STATIC" != "X" ]; then
+		break
+	fi
 	for dir in /usr/lib /lib /usr/local/lib /usr/pkg/lib /usr/sfw/lib /usr/openwin/lib
 	do
 		if [ "$name" = "Linux.x86_64" -o "$name" = "Linux.ppc64" ] ; then
@@ -105,10 +151,12 @@ do
 		fi
 	done
 done
-echo "Found these static archive libraries, will try to use them..."
+if [ "X$SSVNC_BUILD_NO_STATIC" = "X" ]; then
-ls -ld $libs
+	echo "Found these static archive libraries, will try to use them..."
-ls -l $libs
+	ls -ld $libs
-echo
+	ls -l $libs
+	echo
+fi
 
 have_gcc=""
 if type gcc > /dev/null; then
@@ -132,7 +180,7 @@ END
 	fi
 fi
 
-if [ -d /var/tmp/LIBS ]; then
+if [ -d /var/tmp/LIBS -a "X$SSVNC_BUILD_NO_STATIC" = "X" ]; then
 	LDFLAGS_OS="$LDFLAGS_OS -L/var/tmp/LIBS"
 fi
 
@@ -150,176 +198,262 @@ if [ $cnt -lt 1 ]; then
 	exit 1
 fi
 
+pline() {
+	echo "------------------------------------------------------------------"
+}
+
 # Do tightvnc viewer:
 #
-tight_src=`ls -td ./src/vnc_unixsrc* | head -1`
+if [ "X$SSVNC_BUILD_SKIP_VIEWER" = "X" ]; then
-if [ ! -d $tight_src ]; then
+	tight_src=`ls -td ./src/vnc_unixsrc* | head -1`
-	echo "could not locate tight vnc viewer source"
+	if [ ! -d $tight_src ]; then
-	exit 1
+		echo "could not locate tight vnc viewer source"
-fi
+		exit 1
+	fi
+	echo ""
+	pline
+	echo "BUILDING THE VNCVIEWER"
+	echo ""
+	sleep 1
 
-cp -pR "$tight_src" "$tmp/vnc_unixsrc" || exit 1
+	cp -pR "$tight_src" "$tmp/vnc_unixsrc" || exit 1
 
-echo "applying tight vnc patches:"
+	echo "applying tight vnc patches:"
-start=`pwd`
+	start=`pwd`
-cd $tmp;
+	cd $tmp;
-failed=0
+	failed=0
-count=0
+	count=0
-patches="../../patches/tight-vncviewer-full.patch"
+	patches="../../patches/tight-vncviewer-full.patch"
-if [ ! -f "$patches" ]; then
+	if [ ! -f "$patches" ]; then
-	patches=`ls ../../patches/tight* | grep -v 'tight-vncviewer-full.patch'`
+		patches=`ls ../../patches/tight* | grep -v 'tight-vncviewer-full.patch'`
-fi
-for patch in $patches
-do
-	if [ ! -f "$patch" ]; then
-		continue
-	fi
-	if [ "X$PATCH_FAIL" != "X" ]; then
-		failed=1	
-		break
 	fi
-	echo PATCHING WITH: "$patch" 
+	for patch in $patches
-	ls -l "$patch"
+	do
+		if [ ! -f "$patch" ]; then
+			continue
+		fi
+		if [ "X$PATCH_FAIL" != "X" ]; then
+			failed=1	
+			break
+		fi
+		echo PATCHING WITH: "$patch" 
+		ls -l "$patch"
+		sleep 1
+		patch -p0 < "$patch"
+		if [ $? != 0 ]; then
+			failed=`expr $failed + 1`
+		else
+			count=`expr $count + 1`
+		fi
+	done
 	sleep 1
-	patch -p0 < "$patch"
+	cd "$start"
-	if [ $? != 0 ]; then
+	if [ $failed != 0 -o $count = 0 ]; then
-		failed=`expr $failed + 1`
+		ball=src/zips/vnc_unixsrc_vncviewer.patched.tar
-	else
+		echo "patches failed, trying to use backup tarball:"
-		count=`expr $count + 1`
+		ls -l $ball
+		sleep 2
+		cat $ball | (cd $tmp; tar -xvf -)
 	fi
-done
+	echo
-sleep 1
-cd "$start"
-if [ $failed != 0 -o $count = 0 ]; then
-	ball=src/zips/vnc_unixsrc_vncviewer.patched.tar
-	echo "patches failed, trying to use backup tarball:"
-	ls -l $ball
-	sleep 2
-	cat $ball | (cd $tmp; tar -xvf -)
-fi
-echo
 
 
-cd $tmp/vnc_unixsrc
+	cd $tmp/vnc_unixsrc
-xmkmf
+	xmkmf
-make Makefiles
+	make Makefiles
-mv vncviewer/Makefile vncviewer/Makefile.orig
+	mv vncviewer/Makefile vncviewer/Makefile.orig
-sed -e "s,EXTRA_LDOPTIONS =,EXTRA_LDOPTIONS = -L$start/$libs $LDFLAGS_OS," \
+	sed -e "s,EXTRA_LDOPTIONS =,EXTRA_LDOPTIONS = -L$start/$libs $LDFLAGS_OS," \
-    -e "s,CCOPTIONS =,CCOPTIONS = $CPPFLAGS_OS," \
+	    -e "s,CCOPTIONS =,CCOPTIONS = $CPPFLAGS_OS," \
-	vncviewer/Makefile.orig > vncviewer/Makefile
+		vncviewer/Makefile.orig > vncviewer/Makefile
 
-if [ `uname` = "SunOS" ]; then
+	if [ `uname` = "SunOS" ]; then
-	for d in vncviewer libvncauth vncconnect vncpasswd
+		for d in vncviewer libvncauth vncconnect vncpasswd
-	do
+		do
-		mv $d/Makefile $d/Makefile.orig
+			mv $d/Makefile $d/Makefile.orig
-		sed -e "s,CCOPTIONS =.*\$,CCOPTIONS = $CPPFLAGS_OS," \
+			sed -e "s,CCOPTIONS =.*\$,CCOPTIONS = $CPPFLAGS_OS," \
-			$d/Makefile.orig > $d/Makefile
+				$d/Makefile.orig > $d/Makefile
-	done
+		done
-fi
+	fi
 
-make depend
+	make depend
-echo $PATH
+	echo $PATH
-make all
+	make all
-ls -l vncviewer/vncviewer
+	ls -l vncviewer/vncviewer
-cd "$start"
+	cd "$start"
-src=$tmp/vnc_unixsrc/vncviewer/vncviewer
+	src=$tmp/vnc_unixsrc/vncviewer/vncviewer
-sync
+	sync
-sleep 2
+	sleep 2
-sync
+	sync
-strip $src
+	strip $src
-sync
+	sync
-sleep 2
+	sleep 2
-sync
+	sync
-wc  $src
+	wc  $src
-sum $src
+	sum $src
-sleep 2
+	sleep 2
-
+
-suff=""
+	suff=""
-if [ `uname` = "Darwin" ]; then
+	if [ `uname` = "Darwin" ]; then
-	suff=".x11"
+		suff=".x11"
+	fi
+	echo cp -p $src $dest/vncviewer$suff
+	sleep 1
+	cp -p $src $dest/vncviewer$suff || exit 1
+
+	echo
+	pline
+	echo "LISTING, HELP, and LDD THE VNCVIEWER:" 
+	echo
+	sleep 1
+
+	ls -l $src $dest/vncviewer$suff
+	echo
+	echo $dest/vncviewer$suff -h
+	echo
+	$dest/vncviewer$suff -h
+	echo
+	echo $LDD $dest/vncviewer$suff
+	echo
+	$LDD $dest/vncviewer$suff
+	echo ""
 fi
-echo cp -p $src $dest/vncviewer$suff
-sleep 1
-cp -p $src $dest/vncviewer$suff || exit 1
-ls -l $src $dest/vncviewer$suff
-$dest/vncviewer$suff -h
-$LDD $dest/vncviewer$suff
-echo ""
 
 # Do stunnel:
 #
-stunnel_src=`ls -td ./src/stunnel* | head -1`
+if [ "X$SSVNC_BUILD_SKIP_STUNNEL" = "X" ]; then
-if [ ! -d $stunnel_src ]; then
+	stunnel_src=`ls -td ./src/stunnel* | head -1`
-	echo "could not locate stunnel source"
+	if [ ! -d $stunnel_src ]; then
-	exit 1
+		echo "could not locate stunnel source"
-fi
+		exit 1
+	fi
+	echo ""
+	pline
+	echo "BUILDING THE STUNNEL"
+	echo ""
+	sleep 1
 
-cp -pR "$stunnel_src" "$tmp/stunnel" || exit 1
+	cp -pR "$stunnel_src" "$tmp/stunnel" || exit 1
 
-echo "applying stunnel patches:"
+	echo "applying stunnel patches:"
-start=`pwd`
+	start=`pwd`
-cd $tmp;
+	cd $tmp;
-failed=0
+	failed=0
-count=0
+	count=0
-for patch in ../../patches/stunnel*
+	for patch in ../../patches/stunnel*
-do
+	do
-	if [ ! -f "$patch" ]; then
+		if [ ! -f "$patch" ]; then
-		continue
+			continue
+		fi
+		if [ "X$PATCH_FAIL" != "X" ]; then
+			failed=1	
+			break
+		fi
+		echo PATCHING WITH: "$patch" 
+		ls -l "$patch"
+		sleep 1
+		patch -p0 < $patch
+		if [ $? != 0 ]; then
+			failed=`expr $failed + 1`
+		else
+			count=`expr $count + 1`
+		fi
+	done
+	sleep 1
+	cd "$start"
+	if [ $failed != 0 -o $count = 0 ]; then
+		ball=src/zips/stunnel.patched.tar
+		echo "patches failed, trying to use backup tarball:"
+		ls -l $ball
+		sleep 2
+		cat $ball | (cd $tmp; tar -xvf -)
 	fi
-	if [ "X$PATCH_FAIL" != "X" ]; then
+	echo
-		failed=1	
+
-		break
+
+	cd $tmp/stunnel
+	if [ `uname` = "SunOS" ]; then
+		cp configure configure.orig
+		sed -e "s,/var/ssl,/var/ssl /usr/sfw," configure.orig > configure
 	fi
-	echo PATCHING WITH: "$patch" 
+	env LDFLAGS="-L$start/$libs $LDFLAGS_OS" CPPFLAGS="$CPPFLAGS_OS" ./configure --disable-libwrap
-	ls -l "$patch"
+	make
+	ls -l src/stunnel
+	cd "$start"
+	src=$tmp/stunnel/src/stunnel
+	sync
+	sleep 2
+	sync
+	strip $src
+	sync
+	sleep 2
+	sync
+	wc  $src
+	sum $src
+	sleep 2
+	echo cp -p $src $dest/stunnel
+	cp -p $src $dest/stunnel || exit 1
 	sleep 1
-	patch -p0 < $patch
+	cp -p $src $dest/stunnel || exit 1
-	if [ $? != 0 ]; then
+
-		failed=`expr $failed + 1`
+	echo
-	else
+	pline
-		count=`expr $count + 1`
+	echo "LISTING, HELP, and LDD THE STUNNEL:" 
+	echo
+	sleep 1
+
+	ls -l $src $dest/stunnel
+	echo
+	echo $dest/stunnel -help
+	echo
+	$dest/stunnel -help
+	echo
+	echo $LDD $dest/stunnel
+	echo
+	$LDD $dest/stunnel
+	echo ""
+fi
+
+# Do vncstorepw and ld preload friends:
+#
+if [ "X$SSVNC_BUILD_SKIP_VNCSTOREPW" = "X" ]; then
+	vncpw_tar=`ls -td ./src/zips/vncstorepw* | head -1`
+	if [ ! -f $vncpw_tar ]; then
+		echo "could not locate vncstorepw source"
+		exit 1
 	fi
-done
+	echo ""
-sleep 1
+	pline
-cd "$start"
+	echo "BUILDING THE VNCSTOREPW AND FRIENDS"
-if [ $failed != 0 -o $count = 0 ]; then
+	echo ""
-	ball=src/zips/stunnel.patched.tar
+	sleep 1
-	echo "patches failed, trying to use backup tarball:"
+
-	ls -l $ball
+	cat "$vncpw_tar" | (cd $tmp; tar xvf -)
-	sleep 2
+
-	cat $ball | (cd $tmp; tar -xvf -)
+	cd $tmp/vncstorepw
+	make
+
+	cd "$start"
+	cp -p $tmp/vncstorepw/vncstorepw $tmp/vncstorepw/lim_accept.so $dest
+	echo ""
 fi
-echo
 
 
-cd $tmp/stunnel
+if [ "X$SSVNC_BUILD_SKIP_VIEWER" = "X" -a "X$SSVNC_BUILD_SKIP_STUNNEL" = "X" ]; then
-if [ `uname` = "SunOS" ]; then
+	# list the viewer again.
-	cp configure configure.orig
+
-	sed -e "s,/var/ssl,/var/ssl /usr/sfw," configure.orig > configure
+	echo
+	pline
+	echo "LISTING, HELP, and LDD THE VNCVIEWER (again):" 
+	echo
+	sleep 1
+
+	ls -l $dest/vncviewer$suff
+	echo
+	echo $dest/vncviewer$suff -h
+	echo
+	$dest/vncviewer$suff -h
+	echo
+	echo $LDD $dest/vncviewer$suff
+	echo
+	$LDD $dest/vncviewer$suff
 fi
-env LDFLAGS="-L$start/$libs $LDFLAGS_OS" CPPFLAGS="$CPPFLAGS_OS" ./configure --disable-libwrap
-make
-ls -l src/stunnel
-cd "$start"
-src=$tmp/stunnel/src/stunnel
-sync
-sleep 2
-sync
-strip $src
-sync
-sleep 2
-sync
-wc  $src
-sum $src
-sleep 2
-echo cp -p $src $dest/stunnel
-cp -p $src $dest/stunnel || exit 1
-sleep 1
-cp -p $src $dest/stunnel || exit 1
-ls -l $src $dest/stunnel
-$dest/stunnel -help
-$LDD $dest/stunnel
-echo ""
-
-$dest/vncviewer$suff -h
-$LDD $dest/vncviewer$suff

x11vnc/misc/enhanced_tightvnc_viewer/man/man1/ssvnc.1

@@ -0,0 +1,148 @@
+'\" t
+.\" ** The above line should force tbl to be a preprocessor **
+.\" Man page for the SSVNC vncviewer
+.\"
+.\" Copyright (C) 2006-2008 Karl J. Runge <runge@karlrunge.com>
+.\"
+.\" You may distribute under the terms of the GNU General Public
+.\" License as specified in the file LICENCE.TXT that comes with the
+.\" TightVNC distribution.
+.\"
+.TH ssvnc 1 "September 2008" "" "SSVNC"
+.SH NAME
+ssvnc \- a GUI wrapper for SSL and SSH VNC connections.
+.SH SYNOPSIS
+.B ssvnc
+.br
+.B ssvnc
+.RI [\| host \|][\| :display \|]
+.br
+.B ssvnc
+.RI [\| saved-profile-name \|]
+.br
+.B ssvnc
+.RI [\| options \|][\| host-or-profile \]
+.br
+.B ssvnc
+.IR \--help
+.br
+.SH DESCRIPTION
+.B ssvnc
+is a tcl/tk gui wrapper that runs on Unix, MacOSX, and Windows.
+It sets up an SSL or SSH tunnel to the remote VNC Server and then launches
+the VNC viewer (either the one provided or another one that you have
+specified) to use that encrypted tunnel to connect to the VNC Server.
+The use of Proxies and Gateways to make the connections is implemented. 
+
+Once you have started the SSVNC gui, you can click on the buttons
+"Help", "Options -> Help", "Certs -> Help", etc. for much information
+on how to use and configure the tool.
+
+In short, you supply a VNC server "hostname:display" in the
+"VNC Host:Display" entry box and then press the "Connect" button to
+connect to the server via SSL (stunnel).  E.g. "far-away.east:0".
+Port numbers are also allowed, e.g. far-away.east:5905.
+
+Or supply user@hostname:display and click on the "Use SSH" option, then
+press the "Connect" button to connect to the server via an SSH tunnel.
+E.g. "fred@far-away.east:0".
+
+As an easter egg, we note it is also possible to disable the use of SSL/SSH 
+encryption tunnels by using a vnc:// or Vnc:// prefix before
+host:display.
+
+Normally you do not specify any command line options.  You simply
+run \fBssvnc\fR and use the GUI that starts up.
+
+However, as shortcuts you can supply a VNC host:display (or host:port)
+on the command line.  to connect to immediately (the GUI is started
+and the connection is initiated).  For example, "\fBssvnc far-away.east:0\fR"
+Instead of a  host:display, you can specify the name of a saved profile to
+automatically load that profile and then connect to its server.  
+For example "\fBssvnc far\fR", if you name the profile "far".
+You can use the \fB-profiles\fR option to list the profiles you have saved.
+
+The related commands \fBsshvnc\fR and \fBtsvnc\fR start up the GUI in
+simplified modes: SSH Only Mode, and Terminal Services Mode, respectively.
+See below and the application Help for more information on the modes.
+
+There are also some command line options described as follows.
+.SH OPTIONS
+.TP
+\fB\--help\fR
+Starts up the GUI as though the 'Help' button was pressed to show the
+main Help panel.
+.TP
+\fB\-profiles\fR
+List the saved SSVNC profiles you have created.  A profile
+is a destination host with specific parameter settings.
+.TP
+\fB\-list\fR
+Same as \fB\-profiles\fR
+.TP
+\fB\-ssh\fR
+Start in "SSH Only Mode".  No SSL aspects are shown.
+Same as running the command \fBsshvnc\fR
+.TP
+\fB\-ts\fR
+Start in "Terminal Services Mode".  This is like "SSH Only Mode", but
+simpler and assumes \fBx11vnc\fR is available on the remote side
+to start and manage X and VNC sessions.
+Same as running the command \fBtsvnc\fR
+.TP
+\fB\-tso\fR
+Same as \fB-ts\fR "Terminal Services Mode", however never let the
+user leave this mode (no button to switch modes is provided.)
+Same as SSVNC_TS_ALWAYS=1.
+.TP
+\fB\-ssl\fR
+Force the full GUI Mode: both SSL and SSH.  This is the default.
+.TP
+\fB\-nv\fR
+Toggle the "Verify All Certs" button to be off at startup.
+.TP
+\fB\-nvb\fR
+Never show the "Verify All Certs" button.
+Same as SSVNC_NO_VERIFY_ALL_BUTTON=1.
+.TP
+\fB\-bigger\fR
+Make the Profile Selection Dialog window bigger.
+Same as SSVNC_BIGGER_DIALOG=1.
+.SH URL NOTATION
+Here are all of our URL-like prefixes that you can put in front of
+host:display (or host:port): 
+
+For SSL:  vncs:// vncssl:// and vnc+ssl://
+
+For SSH:  vncssh:// and vnc+ssh://
+
+For No Encryption Tunnel:  vnc:// and Vnc://
+
+Examples:
+
+To quickly make an SSL connection: \fBssvnc vncs://snoopy.com:0\fR
+
+To quickly make an SSH connection: \fBssvnc vnc+ssh://fred@snoopy.com:0\fR
+
+To quickly make a direct connection: \fBssvnc Vnc://snoopy.com:0\fR
+
+The above will also work in the "VNC Host:Display" entry box in the GUI.
+Press the "Connect" button after entering them.
+.SH FILES
+Your SSVNC vnc profiles are stored in the \fB$HOME/.vnc/profiles\fR
+directory.  They end in suffix \fB.vnc\fR
+
+Your SSVNC vnc certificates and keys are stored in the \fB$HOME/.vnc/certs\fR
+directory.  They typically end in \fB.pem\fR (both certificate and
+private key) or \fB.crt\fR (certificate only).
+
+You can put a few global parameters (e.g. mode=sshvnc) in your
+\fB$HOME/.ssvncrc\fR file (\fBssvnc_rc\fR on Windows); see the
+application Help for more information.
+
+.SH SEE ALSO
+\fBssvncviewer\fB(1), \fBvncviewer\fR(1), \fBstunnel\fR(8), \fBssh\fR(1), \fBx11vnc\fR(1), \fBvncserver\fR(1) 
+http://www.karlrunge.com/x11vnc http://www.karlrunge.com/x11vnc/ssvnc.html
+.SH AUTHORS
+Karl J. Runge <runge@karlrunge.com> wrote the SSVNC gui (tcl/tk) and
+associated wrapper scripts.

x11vnc/misc/enhanced_tightvnc_viewer/man/man1/ssvncviewer.1

@@ -0,0 +1,586 @@
+'\" t
+.\" ** The above line should force tbl to be a preprocessor **
+.\" Man page for X vncviewer
+.\"
+.\" Copyright (C) 1998 Marcus.Brinkmann@ruhr-uni-bochum.de
+.\" Copyright (C) 2000,2001 Red Hat, Inc.
+.\" Copyright (C) 2001-2003 Constantin Kaplinsky <const@ce.cctpu.edu.ru>
+.\" Copyright (C) 2006-2008 Karl J. Runge <runge@karlrunge.com>
+.\"
+.\" You may distribute under the terms of the GNU General Public
+.\" License as specified in the file LICENCE.TXT that comes with the
+.\" TightVNC distribution.
+.\"
+.TH ssvncviewer 1 "August 2008" "" "SSVNC"
+.SH NAME
+ssvncviewer \- an X viewer client for VNC
+.SH SYNOPSIS
+.B ssvncviewer
+.RI [\| options \|]
+.RI [\| host \|][\| :display \|]
+.br
+.B ssvncviewer
+.RI [\| options \|]
+.RI [\| host \|][\| ::port \|]
+.br
+.B ssvncviewer
+.RI [\| options \|]
+.RI exec=[\| cmd+args... \|]
+.br
+.B ssvncviewer
+.RI [\| options \|]
+.RI /path/to/unix/socket
+.br
+.B ssvncviewer
+.RI [\| options \|]
+.IR \-listen
+.RI [\| display \|]
+.br
+.B ssvncviewer
+.IR \-help
+.br
+.SH DESCRIPTION
+.B ssvncviewer
+is an Xt\-based client application for the VNC (Virtual Network
+Computing) system. It can connect to any VNC\-compatible server such
+as \fBXvnc\fR, WinVNC, or \fBx11vnc\fR, allowing you to control desktop environment
+of a different machine.
+
+ssvncviewer is an enhanced version of the tightvnc unix viewer that can
+take advantage of features in the \fBx11vnc\fR and UltraVNC VNC servers.
+See below for the description of these features.
+
+You can use F8 to display a pop\-up utility menu. Press F8 twice to
+pass single F8 to the remote side.
+.SH OPTIONS
+.TP
+\fB\-help\fR
+Prints a short usage notice to stderr.
+.TP
+\fB\-listen\fR
+Make the viewer listen on port 5500+\fIdisplay\fR for reverse
+connections from a server. WinVNC supports reverse connections using
+the "Add New Client" menu option, or the \-connect command line
+option. \fBXvnc\fR requires the use of the helper program
+\fBvncconnect\fR.
+.TP
+\fB\-via\fR \fIgateway\fR
+Automatically create encrypted TCP tunnel to the \fIgateway\fR machine
+before connection, connect to the \fIhost\fR through that tunnel
+(TightVNC\-specific). By default, this option invokes SSH local port
+forwarding, assuming that SSH client binary can be accessed as
+/usr/bin/ssh. Note that when using the \fB\-via\fR option, the host
+machine name should be specified as known to the gateway machine, e.g. 
+"localhost" denotes the \fIgateway\fR, not the machine where vncviewer
+was launched. See the ENVIRONMENT section below for the information on
+configuring the \fB\-via\fR option.
+.TP
+\fB\-shared\fR
+When connecting, specify that a shared connection is requested. In
+TightVNC, this is the default mode, allowing you to share the desktop
+with other clients already using it.
+.TP
+\fB\-noshared\fR
+When connecting, specify that the session may not be shared. This
+would either disconnect other connected clients or refuse your
+connection, depending on the server configuration.
+.TP
+\fB\-viewonly\fR
+Disable transfer of mouse and keyboard events from the client to the
+server.
+.TP
+\fB\-fullscreen\fR
+Start in full\-screen mode. Please be aware that operating in
+full\-screen mode may confuse X window managers. Typically, such
+conflicts cause incorrect handling of input focus or make the viewer
+window disappear mysteriously. See the grabKeyboard setting in the
+RESOURCES section below for a method to solve input focus problem.
+.TP
+\fB\-noraiseonbeep\fR
+By default, the viewer shows and raises its window on remote beep
+(bell) event. This option disables such behaviour
+(TightVNC\-specific).
+.TP
+\fB\-user\fR \fIusername\fR
+User name for Unix login authentication. Default is to use current
+Unix user name. If this option was given, the viewer will prefer Unix
+login authentication over the standard VNC authentication.
+.TP
+\fB\-passwd\fR \fIpasswd\-file\fR
+File from which to get the password (as generated by the
+\fBvncpasswd\fR(1) program). This option affects only the standard VNC
+authentication.
+.TP
+\fB\-encodings\fR \fIencoding\-list\fR
+TightVNC supports several different compression methods to encode
+screen updates; this option specifies a set of them to use in order of
+preference. Encodings are specified separated with spaces, and must
+thus be enclosed in quotes if more than one is specified. Available
+encodings, in default order for a remote connection, are "copyrect
+tight hextile zlib corre rre raw". For a local connection (to the same
+machine), the default order to try is "raw copyrect tight hextile zlib
+corre rre". Raw encoding is always assumed as a last option if no
+other encoding can be used for some reason. For more information on
+encodings, see the section ENCODINGS below.
+.TP
+\fB\-bgr233\fR
+Always use the BGR233 format to encode pixel data. This reduces
+network traffic, but colors may be represented inaccurately. The
+bgr233 format is an 8\-bit "true color" format, with 2 bits blue, 3
+bits green, and 3 bits red.
+.TP
+\fB\-owncmap\fR
+Try to use a PseudoColor visual and a private colormap. This allows
+the VNC server to control the colormap.
+.TP
+\fB\-truecolour\fR, \fB\-truecolor\fR
+Try to use a TrueColor visual.
+.TP
+\fB\-depth\fR \fIdepth\fR
+On an X server which supports multiple TrueColor visuals of different
+depths, attempt to use the specified one (in bits per pixel); if
+successful, this depth will be requested from the VNC server.
+.TP
+\fB\-compresslevel \fIlevel\fR
+Use specified compression \fIlevel\fR (0..9) for "tight" and "zlib"
+encodings (TightVNC\-specific). Level 1 uses minimum of CPU time and
+achieves weak compression ratios, while level 9 offers best
+compression but is slow in terms of CPU time consumption on the server
+side. Use high levels with very slow network connections, and low
+levels when working over high\-speed LANs. It's not recommended to use
+compression level 0, reasonable choices start from the level 1.
+.TP
+\fB\-quality \fIlevel\fR
+Use the specified JPEG quality \fIlevel\fR (0..9) for the "tight"
+encoding (TightVNC\-specific). Quality level 0 denotes bad image
+quality but very impressive compression ratios, while level 9 offers
+very good image quality at lower compression ratios. Note that the
+"tight" encoder uses JPEG to encode only those screen areas that look
+suitable for lossy compression, so quality level 0 does not always
+mean unacceptable image quality.
+.TP
+\fB\-nojpeg\fR
+Disable lossy JPEG compression in Tight encoding (TightVNC\-specific). 
+Disabling JPEG compression is not a good idea in typical cases, as
+that makes the Tight encoder less efficient. You might want to use
+this option if it's absolutely necessary to achieve perfect image
+quality (see also the \fB\-quality\fR option).
+.TP
+\fB\-nocursorshape\fR
+Disable cursor shape updates, protocol extensions used to handle
+remote cursor movements locally on the client side
+(TightVNC\-specific). Using cursor shape updates decreases delays with
+remote cursor movements, and can improve bandwidth usage dramatically. 
+.TP
+\fB\-x11cursor\fR
+Use a real X11 cursor with X-style cursor shape updates, instead of
+drawing the remote cursor on the framebuffer. This option also
+disables the dot cursor, and disables cursor position updates in
+non-fullscreen mode.
+.TP
+\fB\-autopass\fR
+Read a plain-text password from stdin. This option affects only the
+standard VNC authentication.
+
+.SH Enhanced TightVNC Viewer (SSVNC) OPTIONS
+.TP
+Enhanced TightVNC Viewer (SSVNC) web page is located at:
+.TP
+http://www.karlrunge.com/x11vnc/ssvnc.html
+.TP
+Note: ZRLE and ZYWRLE encodings are now supported.
+.TP
+Note: F9 is shortcut to Toggle FullScreen mode.
+.TP
+Note: In -listen mode set the env var. SSVNC_MULTIPLE_LISTEN=1
+to allow more than one incoming VNC server at a time.
+.TP
+Note: If the host:port is specified as "exec=command args..."
+then instead of making a TCP/IP socket connection to the
+remote VNC server, "command args..." is executed and the
+viewer is attached to its stdio.  This enables tunnelling
+established via an external command, e.g. an stunnel(8)
+that does not involve a listening socket.
+This mode does not work for -listen reverse connections.
+.TP
+Note: If the host:port contains a '/' it is interpreted as a
+unix-domain socket (AF_LOCAL insead of AF_INET)
+.TP
+\fB\-use64\fR
+In \fB\-bgr233\fR mode, use 64 colors instead of 256.
+.TP
+\fB\-bgr222\fR
+Same as \fB\-use64\fR.
+.TP
+\fB\-use8\fR
+In \fB\-bgr233\fR mode, use 8 colors instead of 256.
+.TP
+\fB\-bgr111\fR
+Same as \fB\-use8\fR.
+.TP
+\fB\-16bpp\fR
+If the vnc viewer X display is depth 24 at 32bpp
+request a 16bpp format from the VNC server to cut
+network traffic by up to 2X, then tranlate the
+pixels to 32bpp locally.
+.TP
+\fB\-bgr565\fR
+Same as \fB\-16bpp\fR.
+.TP
+\fB\-grey\fR
+Use a grey scale for the 16- and 8\fB\-bpp\fR modes.
+.TP
+\fB\-alpha\fR
+Use alphablending transparency for local cursors
+requires: x11vnc server, both client and server
+must be 32bpp and same endianness.
+.TP
+\fB\-ycrop\fR n
+Only show the top n rows of the framebuffer.  For
+use with x11vnc \fB\-ncache\fR client caching option
+to help "hide" the pixel cache region.
+Use a negative value (e.g. \fB\-1\fR) for autodetection.
+Autodetection will always take place if the remote
+fb height is more than 2 times the width.
+.TP
+\fB\-sbwidth\fR n
+Scrollbar width for x11vnc \fB\-ncache\fR mode (\fB\-ycrop\fR),
+default is very narrow: 2 pixels, it is narrow to
+avoid distraction in \fB\-ycrop\fR mode.
+.TP
+\fB\-nobell\fR
+Disable bell.
+.TP
+\fB\-rawlocal\fR
+Prefer raw encoding for localhost, default is
+no, i.e. assumes you have a SSH tunnel instead.
+.TP
+\fB\-graball\fR
+Grab the entire X server when in fullscreen mode,
+needed by some old window managers like fvwm2.
+.TP
+\fB\-popupfix\fR
+Warp the popup back to the pointer position,
+needed by some old window managers like fvwm2.
+.TP
+\fB\-grabkbd\fR
+Grab the X keyboard when in fullscreen mode,
+needed by some window managers. Same as \fB\-grabkeyboard\fR.
+\fB\-grabkbd\fR is the default, use \fB\-nograbkbd\fR to disable.
+.TP
+\fB\-bs\fR, \fB\-nobs\fR
+Whether or not to use X server Backingstore for the
+main viewer window.  The default is to not, mainly
+because most Linux, etc, systems X servers disable
+*all* Backingstore by default.  To re\fB\-enable\fR it put
+Option "Backingstore"
+in the Device section of /etc/X11/xorg.conf.
+In \fB\-bs\fR mode with no X server backingstore, whenever an
+area of the screen is re\fB\-exposed\fR it must go out to the
+VNC server to retrieve the pixels. This is too slow.
+In \fB\-nobs\fR mode, memory is allocated by the viewer to
+provide its own backing of the main viewer window. This
+actually makes some activities faster (changes in large
+regions) but can appear to "flash" too much.
+.TP
+\fB\-noshm\fR
+Disable use of MIT shared memory extension (not recommended)
+.TP
+\fB\-termchat\fR
+Do the UltraVNC chat in the terminal vncviewer is in
+instead of in an independent window.
+.TP
+\fB\-unixpw\fR
+str Useful for logging into x11vnc in \fB\-unixpw\fR mode. "str" is a
+string that allows many ways to enter the Unix Username
+and Unix Password.  These characters: username, newline,
+password, newline are sent to the VNC server after any VNC
+authentication has taken place.  Under x11vnc they are
+used for the \fB\-unixpw\fR login.  Other VNC servers could do
+something similar.
+You can also indicate "str" via the environment
+variable SSVNC_UNIXPW.
+Note that the Escape key is actually sent first to tell
+x11vnc to not echo the Unix Username back to the VNC
+viewer. Set SSVNC_UNIXPW_NOESC=1 to override this.
+If str is ".", then you are prompted at the command line
+for the username and password in the normal way.  If str is
+"-" the stdin is read via getpass(3) for username@password.
+Otherwise if str is a file, it is opened and the first line
+read is taken as the Unix username and the 2nd as the
+password. If str prefixed by "rm:" the file is removed
+after reading. Otherwise, if str has a "@" character,
+it is taken as username@password. Otherwise, the program
+exits with an error. Got all that?
+.TP
+\fB-repeater\fR str  This is for use with UltraVNC repeater proxy described
+here: http://www.uvnc.com/addons/repeater.html.  The "str"
+is the ID string to be sent to the repeater.  E.g. ID:1234
+It can also be the hostname and port or display of the VNC
+server, e.g. 12.34.56.78:0 or snoopy.com:1.  Note that when
+using -repeater, the host:dpy on the cmdline is the repeater
+server, NOT the VNC server.  The repeater will connect you.
+Example: vncviewer ... -repeater ID:3333 repeat.host:5900
+Example: vncviewer ... -repeater vhost:0 repeat.host:5900
+.TP
+\fB\-printres\fR  Print out the Ssvnc X resources (appdefaults) and
+then exit. You can save them to a file and customize them (e.g. the
+keybindings and Popup menu)  Then point to the file via
+XENVIRONMENT or XAPPLRESDIR.
+.TP
+\fB New Popup actions:\fR
+
+ ViewOnly:                ~ -viewonly
+ Disable Bell:            ~ -nobell
+ Cursor Shape:            ~ -nocursorshape
+ X11 Cursor:              ~ -x11cursor
+ Cursor Alphablend:       ~ -alpha
+ Toggle Tight/ZRLE:       ~ -encodings ...
+ Toggle ZRLE/ZYWRLE:      ~ -encodings zywrle...
+ Quality Level            ~ -quality (both Tight and ZYWRLE)
+ Compress Level           ~ -compresslevel
+ Disable JPEG:            ~ -nojpeg  (Tight)
+ Full Color               ~ as many colors as local screen allows.
+ Grey scale (16 & 8-bpp)  ~ -grey, for low colors 16/8bpp modes.
+ 16 bit color (BGR565)    ~ -16bpp / -bgr565
+ 8  bit color (BGR233)    ~ -bgr233
+ 256 colors               ~ -bgr233 default # of colors.
+  64 colors               ~ -bgr222 / -use64
+   8 colors               ~ -bgr111 / -use8
+ Set Y Crop (y-max)       ~ -ycrop
+ Set Scrollbar Width      ~ -sbwidth
+
+ UltraVNC Extensions:
+
+ Set 1/n Server Scale  Ultravnc ext. Scale desktop by 1/n.
+ Text Chat             Ultravnc ext. Do Text Chat.
+ File Transfer         Ultravnc ext. File xfer via Java helper.
+ Single Window         Ultravnc ext. Grab a single window.
+                       (click on the window you want).
+ Disable Remote Input  Ultravnc ext. Try to prevent input and
+                       viewing of monitor at physical display.
+
+ Note: the Ultravnc extensions only apply to servers that
+ support them.  x11vnc/libvncserver supports some of them.
+
+.SH ENCODINGS
+The server supplies information in whatever format is desired by the
+client, in order to make the client as easy as possible to implement. 
+If the client represents itself as able to use multiple formats, the
+server will choose one.
+
+.I Pixel format
+refers to the representation of an individual pixel. The most common
+formats are 24 and 16 bit "true\-color" values, and 8\-bit "color map"
+representations, where an arbitrary map converts the color number to
+RGB values.
+
+.I Encoding
+refers to how a rectangle of pixels are sent (all pixel information in
+VNC is sent as rectangles). All rectangles come with a header giving
+the location and size of the rectangle and an encoding type used by
+the data which follows. These types are listed below.
+.TP
+.B Raw
+The raw encoding simply sends width*height pixel values. All clients
+are required to support this encoding type. Raw is also the fastest
+when the server and viewer are on the same machine, as the connection
+speed is essentially infinite and raw encoding minimizes processing
+time.
+.TP
+.B CopyRect
+The Copy Rectangle encoding is efficient when something is being
+moved; the only data sent is the location of a rectangle from which
+data should be copied to the current location. Copyrect could also be
+used to efficiently transmit a repeated pattern.
+.TP
+.B RRE
+The Rise\-and\-Run\-length\-Encoding is basically a 2D version of
+run\-length encoding (RLE). In this encoding, a sequence of identical
+pixels are compressed to a single value and repeat count. In VNC, this
+is implemented with a background color, and then specifications of an
+arbitrary number of subrectangles and color for each. This is an
+efficient encoding for large blocks of constant color.
+.TP
+.B CoRRE
+This is a minor variation on RRE, using a maximum of 255x255 pixel
+rectangles. This allows for single\-byte values to be used, reducing
+packet size. This is in general more efficient, because the savings
+from sending 1\-byte values generally outweighs the losses from the
+(relatively rare) cases where very large regions are painted the same
+color.
+.TP
+.B Hextile
+Here, rectangles are split up in to 16x16 tiles, which are sent in a
+predetermined order. The data within the tiles is sent either raw or
+as a variant on RRE. Hextile encoding is usually the best choice for
+using in high\-speed network environments (e.g. Ethernet local\-area
+networks).
+.TP
+.B Zlib
+Zlib is a very simple encoding that uses zlib library to compress raw
+pixel data. This encoding achieves good compression, but consumes a
+lot of CPU time. Support for this encoding is provided for
+compatibility with VNC servers that might not understand Tight
+encoding which is more efficient than Zlib in nearly all real\-life
+situations.
+.TP
+.B Tight
+Like Zlib encoding, Tight encoding uses zlib library to compress the
+pixel data, but it pre\-processes data to maximize compression ratios,
+and to minimize CPU usage on compression. Also, JPEG compression may
+be used to encode color\-rich screen areas (see the description of
+\-quality and \-nojpeg options above). Tight encoding is usually the
+best choice for low\-bandwidth network environments (e.g. slow modem
+connections).
+.TP
+.B ZRLE
+The SSVNC viewer has ported the RealVNC (www.realvnc.com) ZRLE encoding
+to the unix tightvnc viewer.
+.TP
+.B ZYWRLE
+The SSVNC viewer has ported the Hitachi lossy wavelet based ZRLE
+encoding from http://mobile.hitachi-system.co.jp/publications/ZYWRLE/ 
+to the unix tightvnc viewer.
+.SH RESOURCES
+X resources that \fBvncviewer\fR knows about, aside from the
+normal Xt resources, are as follows:
+.TP
+.B shareDesktop
+Equivalent of \fB\-shared\fR/\fB\-noshared\fR options. Default true.
+.TP
+.B viewOnly
+Equivalent of \fB\-viewonly\fR option. Default false.
+.TP
+.B fullScreen
+Equivalent of \fB\-fullscreen\fR option. Default false.
+.TP
+.B grabKeyboard
+Grab keyboard in full-screen mode. This can help to solve problems
+with losing keyboard focus. Default false.
+.TP
+.B raiseOnBeep
+Equivalent of \fB\-noraiseonbeep\fR option, when set to false. Default
+true.
+.TP
+.B passwordFile
+Equivalent of \fB\-passwd\fR option.
+.TP
+.B userLogin
+Equivalent of \fB\-user\fR option.
+.TP
+.B passwordDialog
+Whether to use a dialog box to get the password (true) or get it from
+the tty (false). Irrelevant if \fBpasswordFile\fR is set. Default
+false.
+.TP
+.B encodings
+Equivalent of \fB\-encodings\fR option.
+.TP
+.B compressLevel
+Equivalent of \fB\-compresslevel\fR option (TightVNC\-specific).
+.TP
+.B qualityLevel
+Equivalent of \fB\-quality\fR option (TightVNC\-specific).
+.TP
+.B enableJPEG
+Equivalent of \fB\-nojpeg\fR option, when set to false. Default true.
+.TP
+.B useRemoteCursor
+Equivalent of \fB\-nocursorshape\fR option, when set to false
+(TightVNC\-specific). Default true.
+.TP
+.B useBGR233
+Equivalent of \fB\-bgr233\fR option. Default false.
+.TP
+.B nColours
+When using BGR233, try to allocate this many "exact" colors from the
+BGR233 color cube. When using a shared colormap, setting this resource
+lower leaves more colors for other X clients. Irrelevant when using
+truecolor. Default is 256 (i.e. all of them).
+.TP
+.B useSharedColours
+If the number of "exact" BGR233 colors successfully allocated is less
+than 256 then the rest are filled in using the "nearest" colors
+available. This resource says whether to only use the "exact" BGR233
+colors for this purpose, or whether to use other clients' "shared"
+colors as well. Default true (i.e. use other clients' colors).
+.TP
+.B forceOwnCmap
+Equivalent of \fB\-owncmap\fR option. Default false.
+.TP
+.B forceTrueColour
+Equivalent of \fB\-truecolour\fR option. Default false.
+.TP
+.B requestedDepth
+Equivalent of \fB\-depth\fR option.
+.TP
+.B useSharedMemory
+Use MIT shared memory extension if on the same machine as the X
+server. Default true.
+.TP
+.B wmDecorationWidth, wmDecorationHeight
+The total width and height taken up by window manager decorations.
+This is used to calculate the maximum size of the VNC viewer window. 
+Default is width 4, height 24.
+.TP
+.B bumpScrollTime, bumpScrollPixels
+When in full screen mode and the VNC desktop is bigger than the X
+display, scrolling happens whenever the mouse hits the edge of the
+screen. The maximum speed of scrolling is bumpScrollPixels pixels
+every bumpScrollTime milliseconds. The actual speed of scrolling will
+be slower than this, of course, depending on how fast your machine is. 
+Default 20 pixels every 25 milliseconds.
+.TP
+.B popupButtonCount
+The number of buttons in the popup window. See the README file for
+more information on how to customize the buttons.
+.TP
+.B debug
+For debugging. Default false.
+.TP
+.B rawDelay, copyRectDelay
+For debugging, see the README file for details. Default 0 (off).
+.SH ENVIRONMENT
+When started with the \fB\-via\fR option, vncviewer reads the
+\fBVNC_VIA_CMD\fR environment variable, expands patterns beginning
+with the "%" character, and executes result as a command assuming that
+it would create TCP tunnel that should be used for VNC connection. If
+not set, this environment variable defaults to "/usr/bin/ssh -f -L
+%L:%H:%R %G sleep 20".
+
+The following patterns are recognized in the \fBVNC_VIA_CMD\fR (note
+that all the patterns %G, %H, %L and %R must be present in the command
+template):
+.TP
+.B %%
+A literal "%";
+.TP
+.B %G
+gateway host name;
+.TP
+.B %H
+remote VNC host name, as known to the gateway;
+.TP
+.B %L
+local TCP port number;
+.TP
+.B %R
+remote TCP port number.
+.SH SEE ALSO
+\fBvncserver\fR(1), \fBXvnc\fR(1), \fBvncpasswd\fR(1),
+\fBvncconnect\fR(1), \fBssh\fR(1)
+.SH AUTHORS
+Original VNC was developed in AT&T Laboratories Cambridge. TightVNC
+additions was implemented by Constantin Kaplinsky. Many other people
+participated in development, testing and support.
+
+\fBMan page authors:\fR
+.br
+Marcus Brinkmann <Marcus.Brinkmann@ruhr-uni-bochum.de>,
+.br
+Terran Melconian <terran@consistent.org>,
+.br
+Tim Waugh <twaugh@redhat.com>,
+.br
+Constantin Kaplinsky <const@ce.cctpu.edu.ru>

x11vnc/misc/enhanced_tightvnc_viewer/src/patches/_getpatches

@@ -3,3 +3,7 @@
 cp -p /dist/src/apps/VNC/tight_vnc_1.3dev5/tight-vncviewer*patch .
 cp -p /dist/src/apps/VNC/tight_vnc_1.3dev5/vnc_unixsrc_vncviewer.patched.tar ../zips/
 
+cp -p /dist/src/apps/VNC/etc/libvncserver_cvs/expts/java_ssl/ultra/ultraftp.tar ../zips/
+cp -p /dist/src/apps/VNC/etc/libvncserver_cvs/expts/vncstorepw.tar ../zips/
+
+cp -p /dist/src/apps/VNC/tight_vnc_1.3dev5/vnc_unixsrc/vncviewer/vncviewer.man ../../man/man1/ssvncviewer.1

x11vnc/options.c

@@ -241,6 +241,7 @@ int ncache_dt_change = 1;
 int ncache_keep_anims = 0;
 int ncache_old_wm = 0;
 int macosx_ncache_macmenu = 0;
+int macosx_us_kbd = 0;
 int ncache_beta_tester = 0;
 int ncdb = 0;
 

x11vnc/options.h

@@ -182,6 +182,7 @@ extern int ncache_xrootpmap;
 extern int ncache_keep_anims;
 extern int ncache_old_wm;
 extern int macosx_ncache_macmenu;
+extern int macosx_us_kbd;
 extern int ncache_beta_tester;
 extern int ncdb;
 

x11vnc/pointer.c

@@ -690,6 +690,9 @@ void pointer(int mask, int x, int y, rfbClientPtr client) {
 				button_mask_prev = button_mask;
 				button_mask = mask;
 			}
+			if (!view_only && (input.motion || input.button)) {
+				last_rfb_ptr_injected = dnow();
+			}
 			return;
 		}
 	}
@@ -714,6 +717,7 @@ void pointer(int mask, int x, int y, rfbClientPtr client) {
 		last_pointer_client = client;
 
 		last_pointer_time = now;
+		last_rfb_ptr_injected = dnow();
 
 		if (blackout_ptr && blackouts) {
 			int b, ok = 1;

x11vnc/remote.c

@@ -630,6 +630,10 @@ int remote_control_access_ok(void) {
 #endif	/* NO_X11 */
 }
 
+#ifdef MACOSX
+void macosxCG_keycode_inject(int down, int keycode);
+#endif
+
 /*
  * Huge, ugly switch to handle all remote commands and queries
  * -remote/-R and -query/-Q.
@@ -3502,6 +3506,19 @@ char *process_remote_cmd(char *cmd, int stringonly) {
 		adjust_grabs(0, 0);
 		rfbLog("disabled grab_always\n");
 
+	} else if (strstr(p, "grablocal") == p) {
+		COLON_CHECK("grablocal:")
+		if (query) {
+			snprintf(buf, bufn, "ans=%s%s%d", p, co,
+			    grab_local);
+			goto qry;
+		}
+		p += strlen("grablocal:");
+
+		grab_local = atoi(p);
+		rfbLog("remote_cmd: changed -grablocal to: %d\n",
+		    grab_local);
+
 	} else if (strstr(p, "client_input") == p) {
 		NOTAPP
 		COLON_CHECK("client_input:")
@@ -3578,6 +3595,28 @@ char *process_remote_cmd(char *cmd, int stringonly) {
 		rfbLog("remote_cmd: turning off debug_keyboard.\n");
 		debug_keyboard = 0;
 
+	} else if (strstr(p, "keycode") == p) {
+		int kc;
+		NOTAPP
+		COLON_CHECK("keycode:")
+		p += strlen("keycode:");
+		kc = atoi(p);
+		if (kc < 0) kc = 0;
+		kc = kc % 256;
+		rfbLog("remote_cmd: insert keycode %d\n", kc);
+
+		if (macosx_console) {
+#ifdef MACOSX
+			macosxCG_keycode_inject(1, kc);
+			usleep(100*1000);
+			macosxCG_keycode_inject(0, kc);
+#endif
+		} else {
+			XTestFakeKeyEvent_wr(dpy, kc, 1, CurrentTime);
+			usleep(100*1000);
+			XTestFakeKeyEvent_wr(dpy, kc, 0, CurrentTime);
+		}
+		
 	} else if (strstr(p, "deferupdate") == p) {
 		int d;
 		COLON_CHECK("deferupdate:")
@@ -4421,6 +4460,19 @@ char *process_remote_cmd(char *cmd, int stringonly) {
 		rfbLog("remote_cmd: disable macosx_ncache_macmenu.\n");
 		macosx_ncache_macmenu = 0;
 
+	} else if (!strcmp(p, "macuskbd")) {
+		if (query) {
+			snprintf(buf, bufn, "ans=%s:%d", p, macosx_us_kbd); goto qry;
+		}
+		rfbLog("remote_cmd: enable macosx_us_kbd.\n");
+		macosx_us_kbd = 1;
+	} else if (!strcmp(p, "nomacuskbd")) {
+		if (query) {
+			snprintf(buf, bufn, "ans=%s:%d", p, !macosx_us_kbd); goto qry;
+		}
+		rfbLog("remote_cmd: disable macosx_us_kbd.\n");
+		macosx_us_kbd = 0;
+
 	} else if (strstr(p, "hack") == p) { /* skip-cmd-list */
 		COLON_CHECK("hack:")
 		if (query) {

x11vnc/solid.c

@@ -532,6 +532,12 @@ static void solid_gnome(char *color) {
 	    "/desktop/gnome/background/picture_options";
 	char set_option[] = "gconftool-2 --set "
 	    "/desktop/gnome/background/picture_options --type string '%s'";
+#if 0
+	char get_filename[] = "gconftool-2 --get "
+	    "/desktop/gnome/background/picture_filename";
+	char set_filename[] = "gconftool-2 --set "
+	    "/desktop/gnome/background/picture_filename --type string '%s'";
+#endif
 	static char *orig_color = NULL;
 	static char *orig_option = NULL;
 	char *cmd;
@@ -607,6 +613,14 @@ static void solid_gnome(char *color) {
 	sprintf(cmd, set_option, "none");
 	dt_cmd(cmd);
 	free(cmd);
+
+#if 0
+	cmd = (char *) malloc(strlen(set_filename) + strlen("none") + 1);
+	sprintf(cmd, set_filename, "none");
+	dt_cmd(cmd);
+	free(cmd);
+#endif
+
 #endif	/* NO_X11 */
 }
 

x11vnc/ssltools.h

@@ -694,12 +694,16 @@ char find_display[] =
 "# display + xauth info to caller (x11vnc running as root or nobody).\n"
 "# x11vnc then uses the info to open the display.\n"
 "#\n"
+"# If not called with -unixpw, root, etc. uses current $USER.\n"
 "\n"
 "#FIND_DISPLAY_OUTPUT=/tmp/fdo.$USER.txt\n"
+"\n"
 "if [ \"X$FIND_DISPLAY_OUTPUT\" != \"X\" ]; then\n"
 "	if [ \"X$FIND_DISPLAY_EXEC\" = \"X\" ]; then\n"
 "		FIND_DISPLAY_EXEC=1\n"
 "		export FIND_DISPLAY_EXEC\n"
+"		# we rerun ourselves with verbose output to a file:\n"
+"		#\n"
 "		if [ \"X$FIND_DISPLAY_OUTPUT\" != \"X\" ]; then\n"
 "			/bin/sh $0 \"$@\" 2> $FIND_DISPLAY_OUTPUT\n"
 "		else\n"
@@ -710,13 +714,19 @@ char find_display[] =
 "fi\n"
 "\n"
 "if [ \"X$FIND_DISPLAY_OUTPUT\" != \"X\" ]; then\n"
+"	# turn on verbose output\n"
+"	set -xv\n"
+"fi\n"
+"if [ \"X$FIND_DISPLAY_DEBUG\" != \"X\" ]; then\n"
+"	# print environment and turn on verbose output\n"
+"	env\n"
 "	set -xv\n"
 "fi\n"
 "\n"
-"#env; set -xv\n"
 "PATH=$PATH:/bin:/usr/bin:/usr/X11R6/bin:/usr/bin/X11:/usr/openwin/bin:/usr/ucb\n"
 "export PATH\n"
 "\n"
+"# This is to try to trick ps(1) into writing wide lines: \n"
 "COLUMNS=256\n"
 "export COLUMNS\n"
 "\n"
@@ -726,6 +736,8 @@ char find_display[] =
 "	showxauth=\"\"\n"
 "	shift\n"
 "fi\n"
+"\n"
+"# -f means use this xauthority file:\n"
 "if [ \"X$1\" = \"X-f\" ]; then\n"
 "	shift\n"
 "	if [ ! -r $1 ]; then\n"
@@ -736,6 +748,8 @@ char find_display[] =
 "	shift\n"
 "fi\n"
 "\n"
+"# we need to set user:\n"
+"#\n"
 "user=\"$1\"			# cmd line arg takes precedence\n"
 "if [ \"X$user\" = \"X\" ]; then\n"
 "	user=$X11VNC_USER	# then X11VNC_USER\n"
@@ -754,20 +768,30 @@ char find_display[] =
 "	exit 1\n"
 "fi\n"
 "\n"
+"# util to try to match a display with a Linux VT and print\n"
+"# disp,VT=... etc.  Otherwise just print out display.\n"
+"#\n"
 "prdpy () {\n"
 "	d1=$1\n"
 "	chvt0=\"\"\n"
+"	# we can only do chvt on Linux:\n"
 "	if [ \"X$uname\" = \"XLinux\" ]; then\n"
 "		d2=$d1\n"
 "		d3=`echo \"$d2\" | sed -e 's/^.*:/:/' -e 's/\\..*$//'`\n"
 "		d4=\"($d2|$d3)\"\n"
+"\n"
+"		# vt is usually in X server line:\n"
+"		#\n"
 "		vt=`ps wwwwwaux | grep X | egrep -v 'startx|xinit' | egrep \" $d4 \" | egrep ' vt([789]|[1-9][0-9][0-9]*) ' | grep -v grep | head -n 1`\n"
+"\n"
 "		if [ \"X$vt\" != \"X\" ]; then\n"
+"			# strip it out and add it.\n"
 "			vt=`echo \"$vt\" | sed -e 's/^.* vt\\([0-9][0-9]*\\) .*$/\\1/'`\n"
 "			if echo \"$vt\" | grep '^[0-9][0-9]*$' > /dev/null; then\n"
 "				chvt0=\",VT=$vt\"\n"
 "			fi\n"
 "		else\n"
+"			# otherwise look for tty:\n"
 "			vt=`ps wwwwwaux | grep X | egrep \" $d4 \" | egrep ' tty([789]|[1-9][0-9][0-9]*) ' | grep -v grep | head -n 1`\n"
 "			if [ \"X$vt\" != \"X\" ]; then\n"
 "				vt=`echo \"$vt\" | sed -e 's/^.* tty\\([0-9][0-9]*\\) .*$/\\1/'`\n"
@@ -775,21 +799,27 @@ char find_display[] =
 "					chvt0=\",VT=$vt\"\n"
 "				fi\n"
 "			else\n"
+"				# otherwise try lsof:\n"
 "				pvt=`ps wwwwwaux | grep X | egrep -v 'startx|xinit' | egrep \" $d4 \" | head -n 1 | awk '{print $2}'`\n"
 "				if [ \"X$pvt\" != \"X\" ]; then\n"
 "					vt=`lsof -p \"$pvt\" 2>/dev/null | egrep '/dev/tty([789]|[1-9][0-9][0-9]*)$' | grep -v grep | head -n 1 | awk '{print $NF}' | sed -e 's,/dev/tty,,'`\n"
 "					if echo \"$vt\" | grep '^[0-9][0-9]*$' > /dev/null; then\n"
 "						chvt0=\",VT=$vt\"\n"
 "					else\n"
+"						# if this fails, at least tell them the XPID:\n"
 "						chvt0=\",XPID=$pvt\"\n"
 "					fi\n"
 "				fi\n"
 "			fi\n"
 "		fi\n"
 "	fi\n"
+"\n"
+"	# return the string, possibly with ,VT=... appended:\n"
+"	#\n"
 "	echo \"$d1$chvt0\"\n"
 "}\n"
 "\n"
+"# save uname, netstat, and ps output:\n"
 "uname=`uname`\n"
 "nsout=`netstat -an`\n"
 "if [ \"X$uname\" = \"XDarwin\" ]; then\n"
@@ -800,6 +830,10 @@ char find_display[] =
 "	pslist=`echo \"$psout\" | awk '{print $2}'`\n"
 "fi\n"
 "\n"
+"# this mode is to try to grab a display manager (gdm, kdm, xdm...) display\n"
+"# when we are run as root (e.g. no one is logged in yet).  We look at the\n"
+"# -auth line in the X/Xorg commandline.\n"
+"#\n"
 "if [ \"X$FD_XDM\" != \"X\" ]; then\n"
 "	list=\"\"\n"
 "	for pair in `echo \"$psout\" | grep '/X.* :[0-9][0-9]* .*-auth' | egrep -v 'startx|xinit' | sed -e 's,^.*/X.* \\(:[0-9][0-9]*\\) .* -auth \\([^ ][^ ]*\\).*$,\\1\\,\\2,' | sort -u`\n"
@@ -807,6 +841,8 @@ char find_display[] =
 "		da=`echo \"$pair\" | awk -F, '{print $1}'`\n"
 "		xa=`echo \"$pair\" | awk -F, '{print $2}'`\n"
 "		if [ -f $xa -a -r $xa ]; then\n"
+"			# if we have an xauth file, we proceed to test it:\n"
+"			#\n"
 "			env XAUTHORITY=\"$xa\" xdpyinfo -display \"$da\" >/dev/null 2>&1\n"
 "			if [ $? = 0 ]; then\n"
 "				env XAUTHORITY=/dev/null xdpyinfo -display \"$da\" >/dev/null 2>&1\n"
@@ -814,6 +850,7 @@ char find_display[] =
 "					y=`prdpy $da`\n"
 "					echo \"DISPLAY=$y\"\n"
 "					if [ \"X$showxauth\" != \"X\" ]; then\n"
+"						# copy the cookie:\n"
 "						cook=`xauth -f \"$xa\" list | head -n 1 | awk '{print $NF}'`\n"
 "						tf=$HOME/.xat.$$\n"
 "						rm -f $tf\n"
@@ -838,6 +875,7 @@ char find_display[] =
 "						xauth -f $tf extract - \"$da\" 2>/dev/null\n"
 "						rm -f $tf\n"
 "					fi\n"
+"					# DONE\n"
 "					exit 0\n"
 "				fi\n"
 "			fi\n"
@@ -847,26 +885,54 @@ char find_display[] =
 "	if [ \"X$showxauth\" != \"X\" ]; then\n"
 "		echo \"\"\n"
 "	fi\n"
+"	# DONE\n"
 "	exit 1\n"
 "fi\n"
 "\n"
-"# Now try to match X DISPLAY to user:\n"
+"# Normal case here (not xdm...).\n"
+"\n"
+"# Try to match X DISPLAY to user:\n"
 "\n"
 "# who(1) output column 2:\n"
 "#gone=`last $user | grep 'gone.*no.logout' | awk '{print $2}' | grep '^:' | sed -e 's,/.*,,' | tr '\\n' '|'`\n"
 "#gone=\"${gone}__quite_impossible__\"\n"
 "#display=`who 2>/dev/null | grep \"^${user}[ 	][ 	]*:[0-9]\" | egrep -v \" ($gone)\\>\" | head -n 1 \\\n"
 "#    | awk '{print $2}' | sed -e 's,/.*$,,'`\n"
+"\n"
 "poss=\"\"\n"
 "list=`who 2>/dev/null | grep \"^${user}[ 	][ 	]*:[0-9]\" | awk '{print $2}' | sed -e 's,/.*$,,'`\n"
 "list=\"$list \"`w -h \"$user\" 2>/dev/null | grep \"^${user}[ 	][ 	]*:[0-9]\" | awk '{print $2}' | sed -e 's,/.*$,,'`\n"
 "list=\"$list \"`who 2>/dev/null | grep \"^${user}[ 	]\" | awk '{print $NF}' | grep '(:[0-9]' | sed -e 's/[()]//g'`\n"
 "host=`hostname 2>/dev/null | sed -e 's/\\..*$//'`\n"
+"\n"
 "if [ \"X$X11VNC_FINDDISPLAY_SKIP_XAUTH\" = \"X\" ]; then\n"
+"	# do a normal xauth list:\n"
 "	list=\"$list \"`xauth list | awk '{print $1}' | grep /unix | grep \"^${host}\" | sed -e 's/^.*:/:/' | sort -n | uniq`\n"
+"\n"
+"	# check for gdm and kdm non-NFS cookies in /tmp:\n"
+"	for xa in /tmp/.gdm* /tmp/.Xauth*\n"
+"	do\n"
+"		# try to be somewhat careful about the real owner of the file:\n"
+"		if id | sed -e 's/ gid.*$//' | grep -w root > /dev/null; then\n"
+"			break\n"
+"		fi\n"
+"		if [ -f $xa -a -r $xa ]; then\n"
+"			if ls -l \"$xa\" | sed -e 's,/tmp.*$,,' | grep -w \"$user\" > /dev/null; then\n"
+"				# append these too:\n"
+"				if find \"$xa\" -user \"$user\" -perm 600 > /dev/null; then\n"
+"					:\n"
+"				else\n"
+"					continue\n"
+"				fi\n"
+"				# it passes the ownership tests, add it:\n"
+"				list=\"$list \"`xauth -f \"$xa\" list | awk '{print $1}' | grep /unix | grep \"^${host}\" | sed -e 's/^.*:/:/' | sort -n | uniq | sed -e \"s,\\$,\\,$xa,\"`\n"
+"			fi\n"
+"		fi\n"
+"	done\n"
 "fi\n"
 "\n"
 "if [ \"X$uname\" = \"XDarwin\" ]; then\n"
+"	# macosx uses \"console\" string (in leopard X11 runs/launched by default)\n"
 "	if who 2>/dev/null | grep -i \"^${user}[ 	][ 	]*console[ 	]\" > /dev/null; then\n"
 "		echo \"DISPLAY=console\"\n"
 "		if [ \"X$FIND_DISPLAY_ALL\" = \"X\" ]; then\n"
@@ -878,12 +944,15 @@ char find_display[] =
 "	fi\n"
 "fi\n"
 "\n"
+"# try the items in the list:\n"
+"#\n"
 "for p in $list\n"
 "do\n"
 "	xa=`echo \"$p\" | awk -F, '{print $2}'`\n"
 "	d=`echo \"$p\" | sed -e 's/,.*$//' -e 's/://' -e 's/\\..*$//'`\n"
 "	ok=\"\"\n"
 "	if [ \"X$X11VNC_SKIP_DISPLAY\" != \"X\" ]; then\n"
+"		# user supplied skip list:\n"
 "		mat=\"\"\n"
 "		for skip in `echo $X11VNC_SKIP_DISPLAY | tr ',' '\\n'`\n"
 "		do\n"
@@ -902,6 +971,8 @@ char find_display[] =
 "			continue\n"
 "		fi\n"
 "	fi\n"
+"\n"
+"	# check for the local X11 files:\n"
 "	xd=\"/tmp/.X11-unix/X$d\"\n"
 "	if [ -r \"$xd\" -o -w \"$xd\" -o -x \"$xd\" ]; then\n"
 "		if echo \"$nsout\" | grep \"/tmp/.X11-unix/X$d[  ]*\\$\" > /dev/null; then\n"
@@ -909,6 +980,7 @@ char find_display[] =
 "		fi\n"
 "	fi\n"
 "	if [ \"X$ok\" = \"X\" ]; then\n"
+"		# instead check for the lock:\n"
 "		if [ -f \"/tmp/.X$d-lock\" ]; then\n"
 "			pid=`cat \"/tmp/.X$d-lock\" | sed -e 's/[ 	]//g'`\n"
 "			if echo \"$pid\" | grep '^[0-9][0-9]*$' > /dev/null; then\n"
@@ -922,14 +994,21 @@ char find_display[] =
 "			fi\n"
 "		fi\n"
 "	fi\n"
+"\n"
 "	if [ \"X$ok\" = \"X1\" ]; then\n"
+"		# ok, put it on the list\n"
 "		poss=\"$poss $p\"\n"
+"		if [ \"X$xa\" != \"X\" ]; then\n"
+"			# xauth file too, if applicable\n"
+"			poss=\"$poss,$xa\"\n"
+"		fi\n"
 "	fi\n"
 "done\n"
 "\n"
 "seenvalues=\"\"\n"
 "\n"
 "seen() {\n"
+"	# simple util to skip repeats\n"
 "	v=$1\n"
 "	if [ \"X$seenvalues\" != \"X\" ]; then\n"
 "		for v2 in $seenvalues\n"
@@ -948,9 +1027,14 @@ char find_display[] =
 "	seenret=0\n"
 "}\n"
 "\n"
+"# now get read to try each one in $poss\n"
+"#\n"
 "poss=`echo \"$poss\" | sed -e 's/^ *//' -e 's/ *$//'`\n"
+"display=\"\"\n"
+"xauth_use=\"\"\n"
 "\n"
 "if [ \"X$X11VNC_FINDDISPLAY_SKIP_XAUTH\" != \"X\" ]; then\n"
+"	# we are not supposed to call xauth(1), simply report\n"
 "	if [ \"X$FIND_DISPLAY_ALL\" != \"X\" ]; then\n"
 "		for p in $poss\n"
 "		do\n"
@@ -961,6 +1045,8 @@ char find_display[] =
 "			if [ \"X$seenret\" = \"X1\" ]; then\n"
 "				continue\n"
 "			fi\n"
+"			# get rid of any ,xauth\n"
+"			p=`echo \"$p\" | sed -e 's/,.*$//'`\n"
 "			y=`prdpy $p`\n"
 "			echo $y\n"
 "		done\n"
@@ -969,6 +1055,7 @@ char find_display[] =
 "	display=`echo \"$poss\" | tr ' ' '\\n' | head -n 1`\n"
 "else\n"
 "	freebie=\"\"\n"
+"	xauth_freebie=\"\"\n"
 "	for p in $poss\n"
 "	do\n"
 "		if [ \"X$p\" = \"X\" ]; then\n"
@@ -978,22 +1065,47 @@ char find_display[] =
 "		if [ \"X$seenret\" = \"X1\" ]; then\n"
 "			continue\n"
 "		fi\n"
-"		xdpyinfo -display \"$p\" >/dev/null 2>&1\n"
+"\n"
+"		# extract ,xauth if any.\n"
+"		xa=\"\"\n"
+"		xa=`echo \"$p\" | awk -F, '{print $2}'`\n"
+"		p=`echo \"$p\" | sed -e 's/,.*$//'`\n"
+"\n"
+"		# check xauth for it:\n"
+"		if [ \"X$xa\" != \"X\" ]; then\n"
+"			XAUTHORITY=\"$xa\" xdpyinfo -display \"$p\" >/dev/null 2>&1\n"
+"		else\n"
+"			xdpyinfo -display \"$p\" >/dev/null 2>&1\n"
+"		fi\n"
+"\n"
 "		if [ $? = 0 ]; then\n"
 "			if [ \"X$FD_TAG\" != \"X\" ]; then\n"
-"				if xprop -display \"$p\" -root -len 128 FD_TAG | grep -iv no.such.atom \\\n"
+"				# look for x11vnc special FD_TAG property:\n"
-"				    | grep \"=[ 	][ 	]*\\\"$FD_TAG\\\"\" > /dev/null; then\n"
+"				if [ \"X$xa\" = \"X\" ]; then\n"
-"					:\n"
+"					if xprop -display \"$p\" -root -len 128 FD_TAG | grep -iv no.such.atom \\\n"
+"					    | grep \"=[ 	][ 	]*\\\"$FD_TAG\\\"\" > /dev/null; then\n"
+"						:\n"
+"					else\n"
+"						continue\n"
+"					fi\n"
 "				else\n"
-"					continue\n"
+"					if env XAUTHORITY=\"$xa\" xprop -display \"$p\" -root -len 128 FD_TAG | grep -iv no.such.atom \\\n"
+"					    | grep \"=[ 	][ 	]*\\\"$FD_TAG\\\"\" > /dev/null; then\n"
+"						:\n"
+"					else\n"
+"						continue\n"
+"					fi\n"
 "				fi\n"
 "			fi\n"
-"			# try again with no authority:\n"
+"\n"
+"			# Now try again with no authority:\n"
 "			env XAUTHORITY=/dev/null xdpyinfo -display \"$p\" >/dev/null 2>&1\n"
-"			# 0 means got in for free... skip it.\n"
+"\n"
+"			# 0 means got in for free... skip it unless we don't find anything else.\n"
 "			if [ $? != 0 ]; then\n"
 "				# keep it\n"
 "				display=\"$p\"\n"
+"				xauth_use=\"$xa\"\n"
 "				if [ \"X$FIND_DISPLAY_ALL\" != \"X\" ]; then\n"
 "					y=`prdpy $p`\n"
 "					echo \"DISPLAY=$y\"\n"
@@ -1001,6 +1113,7 @@ char find_display[] =
 "				fi\n"
 "				break\n"
 "			else\n"
+"				# store in freebie as fallback\n"
 "				if [ \"X$FIND_DISPLAY_ALL\" != \"X\" ]; then\n"
 "					y=`prdpy $p`\n"
 "					echo \"$y,NOXAUTH\"\n"
@@ -1008,16 +1121,20 @@ char find_display[] =
 "				fi\n"
 "				if [ \"X$freebie\" = \"X\" ]; then\n"
 "					freebie=\"$p\"\n"
+"					xauth_freebie=\"$xa\"\n"
 "				fi\n"
 "			fi\n"
 "		fi\n"
 "	done\n"
 "	if [ \"X$display\" = \"X\" -a \"X$freebie\" != \"X\" ]; then\n"
+"		# fallback to the freebie (if any)\n"
 "		display=\"$freebie\"\n"
+"		xauth_use=\"$xauth_freebie\"\n"
 "	fi\n"
 "fi\n"
 "\n"
 "if [ \"X$FIND_DISPLAY_ALL\" != \"X\" ]; then\n"
+"	# we have listed everything, get out.\n"
 "	exit\n"
 "fi\n"
 "if [ \"X$display\" = \"X\" ]; then\n"
@@ -1030,11 +1147,25 @@ char find_display[] =
 "	exit 1\n"
 "fi\n"
 "\n"
+"# append ,VT=n if applicable:\n"
 "dpy2=`prdpy \"$display\"`\n"
 "\n"
 "echo \"DISPLAY=$dpy2\"\n"
+"if [ \"X$FIND_DISPLAY_XAUTHORITY_PATH\" != \"X\" ]; then\n"
+"	# caller wants XAUTHORITY printed out too.\n"
+"	if [ \"X$xauth_use\" != \"X\" -a -f \"$xauth_use\" ]; then\n"
+"		echo \"XAUTHORITY=$xauth_use\"\n"
+"	else\n"
+"		echo \"XAUTHORITY=$XAUTHORITY\"\n"
+"	fi\n"
+"fi\n"
 "if [ \"X$showxauth\" != \"X\" ]; then\n"
-"	xauth extract - \"$display\" 2>/dev/null\n"
+"	# show the (binary) xauth data:\n"
+"	if [ \"X$xauth_use\" != \"X\" -a -f \"$xauth_use\" ]; then\n"
+"		xauth -f \"$xauth_use\" extract - \"$display\" 2>/dev/null\n"
+"	else\n"
+"		xauth extract - \"$display\" 2>/dev/null\n"
+"	fi\n"
 "fi\n"
 "\n"
 "exit 0\n"

x11vnc/tkx11vnc

@@ -340,6 +340,7 @@ Permissions
 	grabkbd
 	grabptr
 	grabalways
+	grablocal:
 	forcedpms
 	clientdpms
 	noserverdpms
@@ -4828,7 +4829,10 @@ proc get_icon_label {{set 0}} {
 	if {$icon_minimal} {
 		set lab [get_vnc_display_number]
 		if {$lab != "none"} {
-			set lab "  :$lab"
+			#set lab "  :$lab"
+			set lab ":$lab"
+		} else {
+			set lab "-"
 		}
 	} else {
 		set lab $lab0
@@ -5074,7 +5078,7 @@ proc make_icon {} {
 	wm title . "tkx11vnc"
 	update
 	if {$tray_embed && $tray_running} {
-		wm deiconify .
+		#wm deiconify .;   #  why did we have this???
 		#after 10000 {wm deiconify .; puts "reqheight [winfo reqheight .]"; puts "reqwidth  [winfo reqwidth  .]"; puts "height [winfo height .]"; puts "width  [winfo width  .]"}
 	} else {
 		wm deiconify .
@@ -5146,7 +5150,7 @@ proc clean_icon_exit {} {
 }
 
 proc make_gui {mode} {
-	global icon_mode tray_embed full_win icon_win
+	global icon_mode tray_embed tray_running full_win icon_win
 	global top_widget_names x11vnc_gui_geom
 	global gui_current_state make_gui_count
 	global x11vnc_connect connected_to_x11vnc
@@ -5226,7 +5230,9 @@ proc make_gui {mode} {
 
 
 	update
-	wm deiconify .
+	if {!$tray_embed || !$tray_running} {
+		wm deiconify .
+	}
 	update idletasks
 	wm minsize $w [winfo width $w] [winfo height $w]
 	if {$mode == "full" && $make_gui_count > 1} {
@@ -6187,6 +6193,9 @@ proc change_view_state {} {
 			exit
 		}
 		make_gui $new
+		if {$new == "tray"} {
+			wm withdraw .
+		}
 	} else {
 		set_view_variable $old
 	}
@@ -6346,10 +6355,16 @@ set ls ""
 catch {set ls [font metrics $bfont -linespace]}
 if {$ls != ""} {
     if {$ls > 14} {
-	# some recent setups have BIG rendering for the above fonts:
+	# some recent setups have BIG rendering for the above fonts.
+	# on recent (8/08) debian these are really ragged:
 	set bfont "-adobe-helvetica-bold-r-*-*-*-90-*-*-*-*-*-*"
 	set sfont "-adobe-helvetica-bold-r-*-*-*-75-*-*-*-*-*-*"
 	set snfont "-adobe-helvetica-medium-r-*-*-*-75-*-*-*-*-*-*"
+
+	# these are bigger but look better... but for how long?
+	set bfont "-adobe-helvetica-bold-r-*-*-*-100-*-*-*-*-*-*"
+	set sfont "-adobe-helvetica-bold-r-*-*-*-80-*-*-*-*-*-*"
+	set snfont "-adobe-helvetica-medium-r-*-*-*-80-*-*-*-*-*-*"
     }
 }
 set help_indent 24;

x11vnc/tkx11vnc.h

@@ -351,6 +351,7 @@ char gui_code[] = "";
 "	grabkbd\n"
 "	grabptr\n"
 "	grabalways\n"
+"	grablocal:\n"
 "	forcedpms\n"
 "	clientdpms\n"
 "	noserverdpms\n"
@@ -4839,7 +4840,10 @@ char gui_code[] = "";
 "	if {$icon_minimal} {\n"
 "		set lab [get_vnc_display_number]\n"
 "		if {$lab != \"none\"} {\n"
-"			set lab \"  :$lab\"\n"
+"			#set lab \"  :$lab\"\n"
+"			set lab \":$lab\"\n"
+"		} else {\n"
+"			set lab \"-\"\n"
 "		}\n"
 "	} else {\n"
 "		set lab $lab0\n"
@@ -5085,7 +5089,7 @@ char gui_code[] = "";
 "	wm title . \"tkx11vnc\"\n"
 "	update\n"
 "	if {$tray_embed && $tray_running} {\n"
-"		wm deiconify .\n"
+"		#wm deiconify .;   #  why did we have this???\n"
 "		#after 10000 {wm deiconify .; puts \"reqheight [winfo reqheight .]\"; puts \"reqwidth  [winfo reqwidth  .]\"; puts \"height [winfo height .]\"; puts \"width  [winfo width  .]\"}\n"
 "	} else {\n"
 "		wm deiconify .\n"
@@ -5157,7 +5161,7 @@ char gui_code[] = "";
 "}\n"
 "\n"
 "proc make_gui {mode} {\n"
-"	global icon_mode tray_embed full_win icon_win\n"
+"	global icon_mode tray_embed tray_running full_win icon_win\n"
 "	global top_widget_names x11vnc_gui_geom\n"
 "	global gui_current_state make_gui_count\n"
 "	global x11vnc_connect connected_to_x11vnc\n"
@@ -5237,7 +5241,9 @@ char gui_code[] = "";
 "\n"
 "\n"
 "	update\n"
-"	wm deiconify .\n"
+"	if {!$tray_embed || !$tray_running} {\n"
+"		wm deiconify .\n"
+"	}\n"
 "	update idletasks\n"
 "	wm minsize $w [winfo width $w] [winfo height $w]\n"
 "	if {$mode == \"full\" && $make_gui_count > 1} {\n"
@@ -6198,6 +6204,9 @@ char gui_code[] = "";
 "			exit\n"
 "		}\n"
 "		make_gui $new\n"
+"		if {$new == \"tray\"} {\n"
+"			wm withdraw .\n"
+"		}\n"
 "	} else {\n"
 "		set_view_variable $old\n"
 "	}\n"
@@ -6357,10 +6366,16 @@ char gui_code[] = "";
 "catch {set ls [font metrics $bfont -linespace]}\n"
 "if {$ls != \"\"} {\n"
 "    if {$ls > 14} {\n"
-"	# some recent setups have BIG rendering for the above fonts:\n"
+"	# some recent setups have BIG rendering for the above fonts.\n"
+"	# on recent (8/08) debian these are really ragged:\n"
 "	set bfont \"-adobe-helvetica-bold-r-*-*-*-90-*-*-*-*-*-*\"\n"
 "	set sfont \"-adobe-helvetica-bold-r-*-*-*-75-*-*-*-*-*-*\"\n"
 "	set snfont \"-adobe-helvetica-medium-r-*-*-*-75-*-*-*-*-*-*\"\n"
+"\n"
+"	# these are bigger but look better... but for how long?\n"
+"	set bfont \"-adobe-helvetica-bold-r-*-*-*-100-*-*-*-*-*-*\"\n"
+"	set sfont \"-adobe-helvetica-bold-r-*-*-*-80-*-*-*-*-*-*\"\n"
+"	set snfont \"-adobe-helvetica-medium-r-*-*-*-80-*-*-*-*-*-*\"\n"
 "    }\n"
 "}\n"
 "set help_indent 24;\n"

x11vnc/user.c

@@ -2524,6 +2524,8 @@ fprintf(stderr, "\n");}
 	return 1;
 }
 
+void ssh_remote_tunnel(char *, int);
+
 static XImage ximage_struct;
 
 int wait_for_client(int *argc, char** argv, int http) {

x11vnc/userinput.c

@@ -3575,7 +3575,7 @@ void check_fixscreen(void) {
 	}
 	if (advertise_truecolor && advertise_truecolor_reset && indexed_color) {
 		/* this will reset framebuffer to correct colors, if needed */
-		static dlast = 0.0;
+		static double dlast = 0.0;
 		now = dnow();
 		if (now > last_client + 1.0 && now < last_client + 3.0 && now > dlast + 5.0) {
 			rfbLog("advertise truecolor reset framebuffer\n");
@@ -9080,6 +9080,8 @@ if (hack_val == 2) {
 	for (k = 1; k <= 3; k++) {
 		int j, retry = 0;
 
+		if (retry) {}
+
 		nsave = n;
 
 		if (k > 1 && ncdb) fprintf(stderr, "read_events-%d\n", k);
@@ -9250,12 +9252,10 @@ if (ncdb) fprintf(stderr, "SKIPWINS: Ev_unmap/map: 0x%lx %d\n", twin, n2);
 		}
 	}
 	if (ncache_old_wm) {
-		int old_maps = 0; 
-		int old_unmaps = 0; 
 		int shifts = 0;
 		for (i=0; i < n; i++) {
 			XEvent ev;
-			int ns, skip = 0, type, idx = -1, state, valid;
+			int type, idx = -1;
 			int ik = Ev_order[i];
 			int x_new, y_new, w_new, h_new;
 			int x_old, y_old, w_old, h_old;
@@ -9517,7 +9517,7 @@ if (ncdb) fprintf(stderr, "UM Ev_order[%d] = %d oku=%d okm=%d\n", i, j, oku, okm
 		} else if (n_MN <= 2 && n_ON_st <= 1) {
 			for (i=0; i < n; i++) {
 				XEvent ev;
-				int ns, skip = 0, type, idx = -1, state, valid;
+				int type, idx = -1, state, valid;
 				int ik = Ev_order[i];
 
 				if (Ev_done[ik]) continue;

x11vnc/x11vnc.1

@@ -1,8 +1,8 @@
 .\" This file was automatically generated from x11vnc -help output.
-.TH X11VNC "1" "June 2008" "x11vnc " "User Commands"
+.TH X11VNC "1" "September 2008" "x11vnc " "User Commands"
 .SH NAME
 x11vnc - allow VNC connections to real X11 displays
-         version: 0.9.4, lastmod: 2008-06-06
+         version: 0.9.4, lastmod: 2008-09-06
 .SH SYNOPSIS
 .B x11vnc
 [OPTION]...
@@ -566,7 +566,7 @@ to plumb reverse connections.
 \fB-connect_or_exit\fR \fIstr\fR
 .IP
 As with \fB-connect,\fR except if none of the reverse
-connections succeed, then x11vnc shutdowns immediately.
+connections succeed, then x11vnc shuts down immediately
 .IP
 By the way, if you do not want x11vnc to listen on
 ANY interface use \fB-rfbport\fR 0  which is handy for the
@@ -4239,50 +4239,55 @@ higher to get debugging output for UINPUT mode.
 .PP
 \fB-macnodim\fR
 .IP
-For the native Mac OS X server, disable dimming.
+For the native MacOSX server, disable dimming.
 .PP
 \fB-macnosleep\fR
 .IP
-For the native Mac OS X server, disable display sleep.
+For the native MacOSX server, disable display sleep.
 .PP
 \fB-macnosaver\fR
 .IP
-For the native Mac OS X server, disable screensaver.
+For the native MacOSX server, disable screensaver.
 .PP
 \fB-macnowait\fR
 .IP
-For the native Mac OS X server, do not wait for the
+For the native MacOSX server, do not wait for the
 user to switch back to his display.
 .PP
 \fB-macwheel\fR \fIn\fR
 .IP
-For the native Mac OS X server, set the mouse wheel
+For the native MacOSX server, set the mouse wheel
 speed to n (default 5).
 .PP
 \fB-macnoswap\fR
 .IP
-For the native Mac OS X server, do not swap mouse
+For the native MacOSX server, do not swap mouse
 buttons 2 and 3.
 .PP
 \fB-macnoresize\fR
 .IP
-For the native Mac OS X server, do not resize or reset
+For the native MacOSX server, do not resize or reset
 the framebuffer even if it is detected that the screen
 resolution or depth has changed.
 .PP
 \fB-maciconanim\fR \fIn\fR
 .IP
-For the native Mac OS X server, set n to the number
+For the native MacOSX server, set n to the number
 of milliseconds that the window iconify/deiconify
 animation takes.  In \fB-ncache\fR mode this value will be
 used to skip the animation if possible. (default 400)
 .PP
 \fB-macmenu\fR
 .IP
-For the native Mac OS X server, in \fB-ncache\fR client-side
+For the native MacOSX server, in \fB-ncache\fR client-side
 caching mode, try to cache pull down menus (not perfect
 because they have animated fades, etc.)
 .PP
+\fB-macuskbd\fR
+.IP
+For the native MacOSX server, use the original
+keystroke insertion code based on a US keyboard.
+.PP
 \fB-gui\fR \fI[gui-opts]\fR
 .IP
 Start up a simple tcl/tk gui based on the the remote
@@ -4341,6 +4346,14 @@ the full gui is available under "Advanced".  To be
 fully functional, the gui mode should be "start"
 (the default).
 .IP
+Note that tray or icon mode will imply the \fB-forever\fR
+x11vnc option (if the x11vnc server is started along
+with the gui) unless \fB-connect\fR or \fB-connect_or_exit\fR has
+been specified.  So x11vnc (and the tray/icon gui)
+will wait for more connections after the first client
+disconnects.  If you want only one viewer connection
+include the \fB-once\fR option.
+.IP
 For "icon" the gui just a small standalone window.
 For "tray" it will attempt to embed itself in the
 "system tray" if possible. If "=setpass" is appended then

x11vnc/x11vnc.c

@@ -965,7 +965,7 @@ void check_redir_services(void) {
 }
 
 void ssh_remote_tunnel(char *instr, int lport) {
-	char *p, *q, *cmd, *ssh;
+	char *q, *cmd, *ssh;
 	char *s = strdup(instr);
 	int sleep = 300, disp = 0, sport = 0;
 	int rc, len, rport;
@@ -1089,7 +1089,6 @@ void ssh_remote_tunnel(char *instr, int lport) {
 
 	free(cmd);
 	free(s);
-
 }
 
 void check_filexfer(void) {
@@ -1272,6 +1271,11 @@ static void watch_loop(void) {
 			check_xrecord_reset(0);
 			check_add_keysyms();
 			check_new_passwds(0);
+#ifdef ENABLE_GRABLOCAL
+			if (grab_local) {
+				check_local_grab();
+			}
+#endif
 			if (started_as_root) {
 				check_switched_user();
 			}
@@ -2600,14 +2604,19 @@ int main(int argc, char* argv[]) {
 		} else if (!strcmp(arg, "-connect") ||
 		    !strcmp(arg, "-connect_or_exit")) {
 			CHECK_ARGC
-			if (strchr(argv[++i], '/' && !strstr(argv[i], "repeater://"))) {
+			if (!strcmp(arg, "-connect_or_exit")) {
+				connect_or_exit = 1;
+			}
+			if (strchr(argv[++i], '/') && !strstr(argv[i], "repeater://")) {
+				struct stat sb;
 				client_connect_file = strdup(argv[i]);
+				if (stat(client_connect_file, &sb) != 0) {
+					FILE* f = fopen(client_connect_file, "w");
+					if (f != NULL) fclose(f);
+				}
 			} else {
 				client_connect = strdup(argv[i]);
 			}
-			if (!strcmp(arg, "-connect_or_exit")) {
-				connect_or_exit = 1;
-			}
 		} else if (!strcmp(arg, "-proxy")) {
 			CHECK_ARGC
 			connect_proxy = strdup(argv[++i]);
@@ -2634,6 +2643,11 @@ int main(int argc, char* argv[]) {
 			grab_kbd = 1;
 			grab_ptr = 1;
 			grab_always = 1;
+#ifdef ENABLE_GRABLOCAL
+		} else if (!strcmp(arg, "-grablocal")) {
+			CHECK_ARGC
+			grab_local = atoi(argv[++i]);
+#endif
 		} else if (!strcmp(arg, "-viewpasswd")) {
 			vpw_loc = i;
 			CHECK_ARGC
@@ -3368,6 +3382,8 @@ int main(int argc, char* argv[]) {
 			macosx_icon_anim_time = atoi(argv[++i]);
 		} else if (!strcmp(arg, "-macmenu")) {
 			macosx_ncache_macmenu = 1;
+		} else if (!strcmp(arg, "-macuskbd")) {
+			macosx_us_kbd = 1;
 		} else if (!strcmp(arg, "-gui")) {
 			launch_gui = 1;
 			if (i < argc-1) {

x11vnc/x11vnc.h

@@ -456,7 +456,7 @@ extern unsigned char *tile_has_xdamage_diff, *tile_row_has_xdamage_diff;
 /* times of recent events */
 extern time_t last_event, last_input, last_client;
 extern time_t last_keyboard_input, last_pointer_input; 
-extern time_t last_local_input;
+extern time_t last_local_input;	/* macosx */
 extern time_t last_fb_bytes_sent;
 extern double last_keyboard_time;
 extern double last_pointer_time;
@@ -507,6 +507,8 @@ extern rfbBool last_rfb_down;
 extern rfbBool last_rfb_key_accepted;
 extern rfbKeySym last_rfb_keysym;
 extern double last_rfb_keytime;
+extern double last_rfb_key_injected;
+extern double last_rfb_ptr_injected;
 extern int fb_copy_in_progress;	
 extern int drag_in_progress;	
 extern int shut_down;	

x11vnc/x11vnc_defs.c

@@ -15,7 +15,7 @@ int xtrap_base_event_type = 0;
 int xdamage_base_event_type = 0;
 
 /*               date +'lastmod: %Y-%m-%d' */
-char lastmod[] = "0.9.4 lastmod: 2008-06-06";
+char lastmod[] = "0.9.4 lastmod: 2008-09-06";
 
 /* X display info */
 
@@ -170,6 +170,8 @@ rfbBool last_rfb_down = FALSE;
 rfbBool last_rfb_key_accepted = FALSE;
 rfbKeySym last_rfb_keysym = 0;
 double last_rfb_keytime = 0.0;
+double last_rfb_key_injected = 0.0;
+double last_rfb_ptr_injected = 0.0;
 int fb_copy_in_progress = 0;	
 int drag_in_progress = 0;	
 int shut_down = 0;	

x11vnc/xevents.c

@@ -24,6 +24,7 @@ int grab_buster = 0;
 int grab_kbd = 0;
 int grab_ptr = 0;
 int grab_always = 0;
+int grab_local = 0;
 int sync_tod_delay = 20;
 
 void initialize_vnc_connect_prop(void);
@@ -694,6 +695,96 @@ void check_keycode_state(void) {
 	}
 }
 
+/*
+ * To use the experimental -grablocal option configure like this:
+ * env CPPFLAGS=-DENABLE_GRABLOCAL LDFLAGS=-lXss ./configure
+ */
+#ifdef ENABLE_GRABLOCAL
+#include <X11/extensions/scrnsaver.h>
+
+void check_local_grab(void) {
+	static double last_check = 0.0;
+	double now;
+
+	if (grab_local <= 0) {
+		return;
+	}
+	if (! client_count) {
+		return;
+	}
+	if (unixpw_in_progress) return;
+
+	if (last_rfb_key_injected <= 0.0 && last_rfb_ptr_injected <= 0.0) {
+		return;
+	}
+
+	RAWFB_RET_VOID
+
+	now = dnow();
+
+	if (now > last_check + 0.1)   {
+#if !NO_X11
+		int ret;
+		double idle;
+		XScreenSaverInfo info;
+		static int save_viewonly = -1, local_is_idle = -1, db = -1;
+
+		if (debug_keyboard) db = debug_keyboard;
+		if (debug_pointer ) db = debug_pointer;
+
+		if (db < 0) {
+			if (getenv("LOCAL_GRAB_DEBUG")) {
+				db = atoi(getenv("LOCAL_GRAB_DEBUG"));
+			} else {
+				db = 0;
+			}
+		}
+
+		ret = XScreenSaverQueryInfo(dpy, RootWindowOfScreen(
+		    ScreenOfDisplay(dpy, 0)), &info);
+
+		if (ret) {
+			double tlatest_rfb = 0.0;
+
+			idle = ((double) info.idle)/1000.0;
+			now = dnow();
+
+			if (last_rfb_key_injected > 0.0) {
+				tlatest_rfb = last_rfb_key_injected;
+			}
+			if (last_rfb_ptr_injected > tlatest_rfb) {
+				tlatest_rfb = last_rfb_ptr_injected;
+			}
+			if (db > 1) fprintf(stderr, "idle: %.4f latest: %.4f dt: %.4f\n", idle, now - tlatest_rfb, idle - (now - tlatest_rfb));
+
+			if (now - tlatest_rfb <= idle + 0.005) {
+				/* 0.005 is 5ms tolerance */
+			} else if (idle < grab_local) {
+				if (local_is_idle < 0 || local_is_idle) {
+					save_viewonly = view_only;
+					view_only = 1;
+					if (db) {
+						rfbLog("check_local_grab: set viewonly\n");
+					}
+				}
+				
+				local_is_idle = 0;
+			} else {
+				if (!local_is_idle && save_viewonly >= 0) {
+					view_only = save_viewonly;
+					if (db) {
+						rfbLog("check_local_grab: restored viewonly; %d\n", view_only);
+					}
+				}
+				local_is_idle = 1;
+			}
+		}
+#endif
+		last_check = dnow();
+	}
+}
+#endif
+
 void check_autorepeat(void) {
 	static time_t last_check = 0;
 	time_t now = time(NULL);

x11vnc/xevents.h

@@ -7,6 +7,7 @@ extern int grab_buster;
 extern int grab_kbd;
 extern int grab_ptr;
 extern int grab_always;
+extern int grab_local;
 extern int sync_tod_delay;
 
 extern void initialize_vnc_connect_prop(void);

x11vnc/xinerama.c

@@ -267,7 +267,7 @@ void check_xinerama_clip(void) {
 		}
 	}
 	for (i=0; i <= k; i++) {
-		int j, jmon, mon = -1, mox = -1;
+		int j, jmon = 0, mon = -1, mox = -1;
 		for (j=0; j < is; j++) {
 			if (mon < 0 || score[j] < mon) {
 				mon = score[j];

x11vnc/xinerama.h

@@ -13,5 +13,6 @@ extern void push_sleep(int n);
 extern void push_black_screen(int n);
 extern void refresh_screen(int push);
 extern void zero_fb(int x1, int y1, int x2, int y2);
+extern void check_xinerama_clip(void);
 
 #endif /* _X11VNC_XINERAMA_H */