Huge number of changes, see x11vnc/ChangeLog

1 files changed, 403 insertions, 93 deletions

diff --git a/x11vnc/help.c b/x11vnc/help.c
index ff697af..d16f98a 100644
--- a/x11vnc/help.c
+++ b/x11vnc/help.c
@@ -793,7 +793,7 @@ void print_help(int mode) {
 "                       presented to the user on a black screen inside the\n"
 "                       vncviewer.  The connection is dropped if the user fails\n"
 "                       to supply the correct password in 3 tries or does not\n"
-"                       send one before a 25 second timeout.  Existing clients\n"
+"                       send one before a 45 second timeout.  Existing clients\n"
 "                       are view-only during this period.\n"
 "\n"
 "                       If the first character received is \"Escape\" then the\n"
@@ -1052,6 +1052,10 @@ void print_help(int mode) {
 "                       under -display WAIT:... for more details about XDM,\n"
 "                       etc configuration.\n"
 "\n"
+"                       Remember to enable XDMCP in the xdm-config, gdm.conf,\n"
+"                       or kdmrc configuration file.  See -display WAIT: for\n"
+"                       more info.\n"
+"\n"
 "-sshxdmsvc             Display manager Terminal services mode based on SSH.\n"
 "                       Alias for -display WAIT:cmd=FINDCREATEDISPLAY-Xvfb.xdmcp\n"
 "                       -localhost.\n"
@@ -1064,6 +1068,48 @@ void print_help(int mode) {
 "                       under -display WAIT:... for more details about XDM,\n"
 "                       etc configuration.\n"
 "\n"
+"                       Remember to enable XDMCP in the xdm-config, gdm.conf,\n"
+"                       or kdmrc configuration file.  See -display WAIT: for\n"
+"                       more info.\n"
+"\n"
+"-unixpw_system_greeter Present a \"Press 'Escape' for System Greeter\" option\n"
+"                       to the connecting VNC client in combined -unixpw\n"
+"                       and xdmcp FINDCREATEDISPLAY modes (e.g. -xdmsvc).\n"
+"\n"
+"                       Normally in a -unixpw mode the VNC client must\n"
+"                       supply a valid username and password to gain access.\n"
+"                       However, if -unixpw_system_greeter is supplied AND\n"
+"                       the FINDCREATEDISPLAY command matches 'xdmcp', then\n"
+"                       the user has the option to press Escape and then get a\n"
+"                       XDM/GDM/KDM login/greeter panel instead. They will then\n"
+"                       supply a username and password directly to the greeter.\n"
+"\n"
+"                       Otherwise, in xdmcp FINDCREATEDISPLAY mode the user\n"
+"                       must supply his username and password TWICE.  First to\n"
+"                       the initial unixpw login dialog, and second to the\n"
+"                       subsequent XDM/GDM/KDM greeter.  Note that if the user\n"
+"                       re-connects and supplies his username and password in\n"
+"                       the unixpw dialog the xdmcp greeter is skipped and\n"
+"                       he is connected directly to his existing X session.\n"
+"                       So the -unixpw_system_greeter option avoids the extra\n"
+"                       password at X session creation time.\n"
+"\n"
+"                       Example:  x11vnc -xdmsvc -unixpw_system_greeter\n"
+"                       See -unixpw and -display WAIT:... for more info.\n"
+"\n"
+"                       The special options after a colon at the end of the\n"
+"                       username (e.g. user:solid) described under -display\n"
+"                       WAIT: are also applied in this mode if they are typed\n"
+"                       in before the user hits Escape.  The username is ignored\n"
+"                       but the colon options are not.\n"
+"\n"
+"                       If the user pressed Escape the FINDCREATEDISPLAY command\n"
+"                       will be run with the env. var. X11VNC_XDM_ONLY=1.\n"
+"\n"
+"                       Remember to enable XDMCP in the xdm-config, gdm.conf,\n"
+"                       or kdmrc configuration file.  See -display WAIT: for\n"
+"                       more info.\n"
+"\n"
 "-redirect port         As in FINDCREATEDISPLAY-Xvnc.redirect mode except\n"
 "                       redirect immediately (i.e. without X session finding\n"
 "                       or creation) to a VNC server listening on port. You\n"
@@ -1135,12 +1181,13 @@ void print_help(int mode) {
 "                       Also in the case of -unixpw, the user logging in can\n"
 "                       place a colon at the end of her username and supply\n"
 "                       a few options: scale=, scale_cursor= (or sc=), solid\n"
-"                       (or so), id=, clear_mods (or cm), clear_keys (or ck),\n"
-"                       repeat, speeds= (or sp=), readtimeout= (or rd=),\n"
-"                       rotate= (or ro=), or noncache (or nc), all separated by\n"
-"                       commas if there is more than one.  After the user logs\n"
-"                       in successfully, these options will be applied to the\n"
-"                       VNC screen.  For example,\n"
+"                       (or so), id=, clear_mods (or cm), clear_keys (or\n"
+"                       ck), clear_all (or ca), repeat, speeds= (or sp=),\n"
+"                       readtimeout= (or rd=), viewonly (or vo), nodisplay=\n"
+"                       (or nd=), rotate= (or ro=), or noncache (or nc),\n"
+"                       all separated by commas if there is more than one.\n"
+"                       After the user logs in successfully, these options will\n"
+"                       be applied to the VNC screen.  For example,\n"
 "\n"
 "                          login: fred:scale=3/4,sc=1,repeat\n"
 "                          Password: ...\n"
@@ -1152,6 +1199,9 @@ void print_help(int mode) {
 "                       your long \"login:\" line press the Up arrow once\n"
 "                       (before typing anything else).\n"
 "\n"
+"                       In the login panel, press F1 to get a list of the\n"
+"                       available options that you can add after the username.\n"
+"\n"
 "                       Another option is \"geom=WxH\" or \"geom=WxHxD\" (or\n"
 "                       ge=). This only has an effect in FINDCREATEDISPLAY\n"
 "                       mode when a virtual X server such as Xvfb is going\n"
@@ -1226,7 +1276,9 @@ void print_help(int mode) {
 "                       ignore in the finding process.  The \":\" is optional.\n"
 "                       Ranges n-m e.g. 0-20 can also be supplied. This string\n"
 "                       can also be set by the connecting user via \"nd=\"\n"
-"                       using \"+\" instead of \",\"\n"
+"                       using \"+\" instead of \",\"  If \"nd=all\" or you set\n"
+"                       X11VNC_SKIP_DISPLAY=all then all display finding fails\n"
+"                       as if you set X11VNC_FINDDISPLAY_ALWAYS_FAILS=1 (below.)\n"
 "\n"
 "                       Automatic Creation of User X Sessions:\n"
 "\n"
@@ -1282,6 +1334,8 @@ void print_help(int mode) {
 "                       If for some reason you do not want x11vnc to ever\n"
 "                       try to find an existing display set the env. var\n"
 "                       X11VNC_FINDDISPLAY_ALWAYS_FAILS=1 (also -env ...)\n"
+"                       This is the same as setting X11VNC_SKIP_DISPLAY=all or\n"
+"                       supplying \"nd=all\" after \"username:\"\n"
 "\n"
 "                       Use WAIT:cmd=FINDCREATEDISPLAY-print to print out the\n"
 "                       script that is used for this.\n"
@@ -1310,12 +1364,15 @@ void print_help(int mode) {
 "                       be the full path to the session/windowmanager program.\n"
 "\n"
 "                       More FD tricks:  FD_CUPS=port or FD_CUPS=host:port\n"
-"                       will set the cups printing environment.  Similarly\n"
-"                       for FD_ESD=port or FD_ESD=host:port for esddsp sound\n"
-"                       redirection.  FD_XDUMMY_NOROOT means the Xdummy server\n"
-"                       does not need to be started as root (e.g. it will sudo\n"
-"                       automatically).  Set FD_EXTRA to a command to be run\n"
-"                       a few seconds after the X server starts up.\n"
+"                       will set the cups printing environment.  Similarly for\n"
+"                       FD_ESD=port or FD_ESD=host:port for esddsp sound\n"
+"                       redirection.  FD_XDUMMY_NOROOT means the Xdummy\n"
+"                       server does not need to be started as root (e.g. it\n"
+"                       will sudo automatically).  Set FD_EXTRA to a command\n"
+"                       to be run a few seconds after the X server starts up.\n"
+"                       Set FD_TAG to be a unique name for the session, it is\n"
+"                       set as an X property, that makes FINDDISPLAY only find\n"
+"                       sessions with that tag value.\n"
 "\n"
 "                       If you want the FINDCREATEDISPLAY session to contact an\n"
 "                       XDMCP login manager (xdm/gdm/kdm) on the same machine,\n"
@@ -1395,8 +1452,9 @@ void print_help(int mode) {
 "                       Otherwise in -unixpw mode the normal login panel is\n"
 "                       provided.\n"
 "\n"
-"                       You *MUST* supply the -ssl option for VeNCrypt to be\n"
-"                       active.  This option only fine-tunes its operation.\n"
+"                       You *MUST* supply the -ssl option for VeNCrypt to\n"
+"                       be active.  The -vencrypt option only fine-tunes its\n"
+"                       operation.\n"
 "\n"
 "-anontls mode          The ANONTLS extension to the VNC protocol allows\n"
 "                       encrypted SSL/TLS connections.  If the -ssl mode is\n"
@@ -1431,8 +1489,9 @@ void print_help(int mode) {
 "\n"
 "                       Long example: -anontls newdh:plain:support\n"
 "\n"
-"                       You *MUST* supply the -ssl option for ANONTLS to be\n"
-"                       active.  This option only fine-tunes its operation.\n"
+"                       You *MUST* supply the -ssl option for ANONTLS to\n"
+"                       be active.  The -anontls option only fine-tunes its\n"
+"                       operation.\n"
 "\n"
 "-sslonly               Same as: \"-vencrypt never -anontls never\"  i.e. it\n"
 "                       disables the VeNCrypt and ANONTLS encryption methods\n"
@@ -1456,16 +1515,17 @@ void print_help(int mode) {
 "\n"
 "-ssl [pem]             Use the openssl library (www.openssl.org) to provide a\n"
 "                       built-in encrypted SSL/TLS tunnel between VNC viewers\n"
-"                       and x11vnc.  This requires libssl support to be compiled\n"
-"                       into x11vnc at build time.  If x11vnc is not built\n"
-"                       with libssl support it will exit immediately when -ssl\n"
-"                       is prescribed.\n"
+"                       and x11vnc.  This requires libssl support to be\n"
+"                       compiled into x11vnc at build time.  If x11vnc is not\n"
+"                       built with libssl support it will exit immediately when\n"
+"                       -ssl is prescribed.  See the -stunnel option below for\n"
+"                       an alternative.\n"
 "\n"
 "                       The VNC Viewer-side needs to support SSL/TLS as well.\n"
 "                       See this URL and also the discussion below for\n"
 "                       ideas on how to enable SSL support for the viewer:\n"
 "                       http://www.karlrunge.com/x11vnc/faq.html#faq-ssl-tun\n"
-"                       nel-viewers x11vnc provides an SSL enabled Java\n"
+"                       nel-viewers .  x11vnc provides an SSL enabled Java\n"
 "                       viewer applet in the classes/ssl directory (-http or\n"
 "                       -httpdir options.)  The SSVNC viewer package supports\n"
 "                       SSL tunnels too.\n"
@@ -1555,6 +1615,11 @@ void print_help(int mode) {
 "                       See -ssldir below to use a directory besides the\n"
 "                       default ~/.vnc/certs\n"
 "\n"
+"                       If your x11vnc binary was not compiled with OpenSSL\n"
+"                       library support, use of the -ssl option will induce an\n"
+"                       immediate failure and exit.  For such binaries, consider\n"
+"                       using the -stunnel option for SSL encrypted connections.\n"
+"\n"
 "                       Misc Info: In temporary cert creation mode \"TMP\", set\n"
 "                       the env. var. X11VNC_SHOW_TMP_PEM=1 to have x11vnc print\n"
 "                       out the entire certificate, including the PRIVATE KEY\n"
@@ -1657,7 +1722,7 @@ void print_help(int mode) {
 "\n"
 "\n"
 "                       NOTE: the following utilities, -sslGenCA, -sslGenCert,\n"
-"                       -sslEncKey, and -sslCertInfo are provided for\n"
+"                       -sslEncKey, -sslCertInfo, and -sslCRL are provided for\n"
 "                       completeness, but for casual usage they are overkill.\n"
 "\n"
 "                       They provide VNC Certificate Authority (CA) key creation\n"
@@ -1708,8 +1773,9 @@ void print_help(int mode) {
 "                       the ss_vncviewer example script in the FAQ and SSVNC.)\n"
 "\n"
 "-sslCRL path           Set the Certificate Revocation Lists (CRL) to \"path\".\n"
+"                       This setting applies for both -ssl and -stunnel modes.\n"
 "\n"
-"                       If path is a file, the file contains one more more CRLs\n"
+"                       If path is a file, the file contains one or more CRLs\n"
 "                       in PEM format.  If path is a directory, it contains\n"
 "                       hash named files of CRLs in the usual OpenSSL manner.\n"
 "                       See the OpenSSL and stunnel(8) documentation for\n"
@@ -1721,6 +1787,10 @@ void print_help(int mode) {
 "                       The -sslCRL setting will be ignored when -sslverify is\n"
 "                       not specified.\n"
 "\n"
+"                       Note that if a CRL's expiration date has passed, all\n"
+"                       SSL connections will fail regardless of if they are\n"
+"                       related to the subject of the CRL or not.\n"
+"\n"
 "                       Only rarely will one's x11vnc -ssl infrastructure be so\n"
 "                       large that this option would be useful (since normally\n"
 "                       maintaining the contents of the -sslverify file or\n"
@@ -1832,11 +1902,13 @@ void print_help(int mode) {
 "\n"
 "                       Similar to -sslGenCA, you will be prompted to fill\n"
 "                       in some information that will be recorded in the\n"
-"                       certificate when it is created.  Tip: if you know\n"
-"                       the fully-qualified hostname other people will be\n"
-"                       connecting to you can use that as the CommonName \"CN\"\n"
-"                       to avoid some applications (e.g. web browsers and java\n"
-"                       plugin) complaining it does not match the hostname.\n"
+"                       certificate when it is created.\n"
+"\n"
+"                       Tip: if you know the fully-qualified hostname other\n"
+"                       people will be connecting to, you can use that as the\n"
+"                       CommonName \"CN\" to avoid some applications (e.g. web\n"
+"                       browsers and java plugin) complaining that it does not\n"
+"                       match the hostname.\n"
 "\n"
 "                       You will also need to supply the CA private key\n"
 "                       passphrase to unlock the private key created from\n"
@@ -1860,14 +1932,14 @@ void print_help(int mode) {
 "                       the cert and private key.  The <name>.crt contains the\n"
 "                       certificate only.\n"
 "\n"
-"                       NOTE: It is very important to know one should always\n"
+"                       NOTE: It is very important to know one should\n"
 "                       generate new keys with a passphrase.  Otherwise if an\n"
 "                       untrusted user steals the key file he could use it to\n"
 "                       masquerade as the x11vnc server (or VNC viewer client).\n"
 "                       You will be prompted whether to encrypt the key with\n"
 "                       a passphrase or not.  It is recommended that you do.\n"
 "                       One inconvenience to a passphrase is that it must\n"
-"                       be suppled every time x11vnc or the client app is\n"
+"                       be typed in EVERY time x11vnc or the client app is\n"
 "                       started up.\n"
 "\n"
 "                       Examples:\n"
@@ -1964,16 +2036,30 @@ void print_help(int mode) {
 "\n"
 "                       This external tunnel method was implemented prior to the\n"
 "                       integrated -ssl encryption described above.  It still\n"
-"                       works well.  This requires stunnel to be installed\n"
-"                       on the system and available via PATH (n.b. stunnel is\n"
-"                       often installed in sbin directories).  Version 4.x of\n"
-"                       stunnel is assumed (but see -stunnel3 below.)\n"
+"                       works well and avoids the requirement of linking with\n"
+"                       the OpenSSL libraries.  This mode requires stunnel\n"
+"                       to be installed on the system and available via PATH\n"
+"                       (n.b. stunnel is often installed in sbin directories).\n"
+"                       Version 4.x of stunnel is assumed (but see -stunnel3\n"
+"                       below.)\n"
 "\n"
 "                       [pem] is optional, use \"-stunnel /path/to/stunnel.pem\"\n"
 "                       to specify a PEM certificate file to pass to stunnel.\n"
-"                       Whether one is needed or not depends on your stunnel\n"
-"                       configuration.  stunnel often generates one at install\n"
-"                       time.  See the stunnel documentation for details.\n"
+"                       See the -ssl option for more info on certificate files.\n"
+"\n"
+"                       Whether or not your stunnel has its own certificate\n"
+"                       depends on your stunnel configuration; stunnel often\n"
+"                       generates one at install time.  See your stunnel\n"
+"                       documentation for details.  In any event, if you want to\n"
+"                       use this certificate you must supply the full path to it\n"
+"                       as [pem].  Note: the file may only be readable by root.\n"
+"\n"
+"                       [pem] may also be the special strings \"TMP\", \"SAVE\",\n"
+"                       and \"SAVE...\" as described in the -ssl option.\n"
+"                       If [pem] is not supplied, \"SAVE\" is assumed.\n"
+"\n"
+"                       Note that the VeNCrypt, ANONTLS, and \"ANON\" modes\n"
+"                       are not supported in -stunnel mode.\n"
 "\n"
 "                       stunnel is started up as a child process of x11vnc and\n"
 "                       any SSL connections stunnel receives are decrypted and\n"
@@ -1981,22 +2067,37 @@ void print_help(int mode) {
 "                       \"The SSL VNC desktop is ...\" and \"SSLPORT=...\"\n"
 "                       are printed out at startup to indicate this.\n"
 "\n"
-"                       The -localhost option is enforced by default\n"
-"                       to avoid people routing around the SSL channel.\n"
-"                       Set STUNNEL_DISABLE_LOCALHOST=1 before starting x11vnc\n"
-"                       to disable the requirement.\n"
+"                       The -localhost option is enforced by default to avoid\n"
+"                       people routing around the SSL channel.  Use -env\n"
+"                       STUNNEL_DISABLE_LOCALHOST=1 to disable this security\n"
+"                       requirement.\n"
+"\n"
+"                       Set -env STUNNEL_DEBUG=1 for more debugging printout.\n"
+"\n"
+"                       Your VNC viewer will also need to be able to connect\n"
+"                       via SSL.  Unfortunately not too many do this.  See the\n"
+"                       information about SSL viewers under the -ssl option.\n"
 "\n"
-"                       Your VNC viewer will also need to be able to connect via\n"
-"                       SSL.  Unfortunately not too many do this.  UltraVNC has\n"
-"                       an encryption plugin but it does not seem to be SSL.\n"
+"                       Also, in the x11vnc distribution, patched TightVNC\n"
+"                       and UltraVNC Java applet jar files are provided in\n"
+"                       the classes/ssl directory that do SSL connections.\n"
+"                       Enable serving them with the -http, -http_ssl, -https,\n"
+"                       or -httpdir (see the option descriptions for more info.)\n"
 "\n"
-"                       Also, in the x11vnc distribution, a patched TightVNC\n"
-"                       Java applet is provided in classes/ssl that does SSL\n"
-"                       connections (only).\n"
+"                       Note that for the Java viewer applet usage the\n"
+"                       \"?PORT=xxxx\" in the various URLs printed at startup\n"
+"                       will need to be supplied to the web browser to connect\n"
+"                       properly.\n"
 "\n"
-"                       It is also not too difficult to set up an stunnel or\n"
-"                       other SSL tunnel on the viewer side.  A simple example\n"
-"                       on Unix using stunnel 3.x is:\n"
+"                       Currently the automatic \"single port\" HTTPS mode of\n"
+"                       -ssl is not fully supported in -stunnel mode.  However,\n"
+"                       it can be emulated via:\n"
+"\n"
+"                         %% x11vnc -stunnel -http_ssl -http_oneport ...\n"
+"\n"
+"                       In general, it is also not too difficult to set up\n"
+"                       an stunnel or other SSL tunnel on the viewer side.\n"
+"                       A simple example on Unix using stunnel 3.x is:\n"
 "\n"
 "                         %% stunnel -c -d localhost:5901 -r remotehost:5900\n"
 "                         %% vncviewer localhost:1\n"
@@ -2006,7 +2107,8 @@ void print_help(int mode) {
 "                       and SSVNC for more examples.\n"
 "\n"
 "-stunnel3  [pem]       Use version 3.x stunnel command line syntax instead of\n"
-"                       version 4.x\n"
+"                       version 4.x.  The -http/-httpdir Java applet serving\n"
+"                       is currently not available in this mode.\n"
 "\n"
 "-enc cipher:keyfile    Use symmetric encryption with cipher \"cipher\"\n"
 "                       and secret key data in \"keyfile\".  If keyfile is\n"
@@ -2025,7 +2127,7 @@ void print_help(int mode) {
 "                       Note that this mode will NOT work with the UltraVNC DSM\n"
 "                       plugins because they alter the RFB protocol in addition\n"
 "                       to tunnelling with the symmetric cipher (an unfortunate\n"
-"                       choice of implementation).\n"
+"                       choice of implementation...)\n"
 "\n"
 "                       cipher can be one of:  arc4, aesv2, aes-cfb, blowfish,\n"
 "                       aes256, or 3des.  See the OpenSSL documentation for\n"
@@ -2098,9 +2200,9 @@ void print_help(int mode) {
 "                       For both ways of using the viewer, you can specify the\n"
 "                       salt,ivec sizes (in GUI or, e.g. arc4@8,16).\n"
 "\n"
-"-https [port]          Use a special, separate HTTPS port (-ssl mode only)\n"
-"                       for HTTPS Java viewer applet downloading. I.e. not 5900\n"
-"                       and not 5800 (the defaults.)\n"
+"-https [port]          Use a special, separate HTTPS port (-ssl and\n"
+"                       -stunnel modes only) for HTTPS Java viewer applet\n"
+"                       downloading. I.e. not 5900 and not 5800 (the defaults.)\n"
 "\n"
 "                       BACKGROUND: In -ssl mode, it turns out you can use the\n"
 "                       single VNC port (e.g. 5900) for both VNC and HTTPS\n"
@@ -2120,6 +2222,8 @@ void print_help(int mode) {
 "                       or VNC Viewer applet.  That's right 3 separate \"Are\n"
 "                       you sure you want to connect?\" dialogs!)\n"
 "\n"
+"                       END OF BACKGROUND.\n"
+"\n"
 "                       USAGE: So use the -https option to provide a separate,\n"
 "                       more reliable HTTPS port that x11vnc will listen on.  If\n"
 "                       [port] is not provided (or is 0), one is autoselected.\n"
@@ -2153,7 +2257,9 @@ void print_help(int mode) {
 "                       to include the PORT= in the browser URL, simply supply\n"
 "                       \"-httpsredir\" to x11vnc.\n"
 "\n"
-"-http_oneport          For un-encrypted connections mode (i.e. no -ssl,\n"
+"                       This options does not work in -stunnel mode.\n"
+"\n"
+"-http_oneport          For UN-encrypted connections mode (i.e. no -ssl,\n"
 "                       -stunnel, or -enc options), allow the Java VNC Viewer\n"
 "                       applet to be downloaded thru the VNC port via HTTP.\n"
 "\n"
@@ -3537,10 +3643,21 @@ void print_help(int mode) {
 "                       Same as -dp and -dk, respectively.  Use multiple\n"
 "                       times for more output.\n"
 "\n"
-"-defer time            Time in ms to wait for updates before sending to client\n"
+"-defer time            Time in ms to delay sending updates to connected clients\n"
 "                       (deferUpdateTime)  Default: %d\n"
+"\n"
 "-wait time             Time in ms to pause between screen polls.  Used to cut\n"
 "                       down on load.  Default: %d\n"
+"\n"
+"-extra_fbur n          Perform extra FrameBufferUpdateRequests checks to\n"
+"                       try to be in better sync with the client's requests.\n"
+"                       What this does is perform extra polls of the client\n"
+"                       socket at critical times (before '-defer' and '-wait'\n"
+"                       calls.)  The default is n=1.  Set to a larger number to\n"
+"                       insert more checks or set to n=0 to disable.  A downside\n"
+"                       of these extra calls is that more mouse input may be\n"
+"                       processed than desired.\n"
+"\n"
 "-wait_ui factor        Factor by which to cut the -wait time if there\n"
 "                       has been recent user input (pointer or keyboard).\n"
 "                       Improves response, but increases the load whenever you\n"
@@ -4350,6 +4467,28 @@ void print_help(int mode) {
 "                       x11vnc server as long as X permissions, etc. permit\n"
 "                       communication between the two.\n"
 "\n"
+"                       FONTS: On some systems the tk fonts can be too small,\n"
+"                       jagged, or otherwise unreadable.  There are 4 env vars\n"
+"                       you can set to be the tk font you prefer:\n"
+"\n"
+"                       X11VNC_FONT_BOLD   main font for menus and buttons.\n"
+"                       X11VNC_FONT_FIXED  font for fixed width text.\n"
+"\n"
+"                       X11VNC_FONT_BOLD_SMALL  tray icon font.\n"
+"                       X11VNC_FONT_REG_SMALL   tray icon menu font.\n"
+"\n"
+"                       The last two only apply for the tray icon mode.\n"
+"\n"
+"                       Here are some examples:\n"
+"\n"
+"                       -env X11VNC_FONT_BOLD='Helvetica -16 bold'\n"
+"                       -env X11VNC_FONT_FIXED='Courier -14'\n"
+"                       -env X11VNC_FONT_REG_SMALL='Helvetica -12'\n"
+"\n"
+"                       You can put the lines like the above (without the\n"
+"                       quotes) in your ~/.x11vncrc file to avoid having to\n"
+"                       specify them on the x11vnc command line.\n"
+"\n"
 "-remote command        Remotely control some aspects of an already running\n"
 "                       x11vnc server.  \"-R\" and \"-r\" are aliases for\n"
 "                       \"-remote\".  After the remote control command is\n"
@@ -4373,12 +4512,26 @@ void print_help(int mode) {
 "                       'x11vnc -R shared' will enable shared connections, and\n"
 "                       'x11vnc -R scale:3/4' will rescale the desktop.\n"
 "\n"
+"                       To run a bunch of commands in a sequence use something\n"
+"                       like: x11vnc -R 'script:firstcmd;secondcmd;...'\n"
+"\n"
+"                       Use x11vnc -R script:file=/path/to/file to read commands\n"
+"                       from a file (can be multi-line and use the comment '#'\n"
+"                       character in the normal way.  The ';' separator must\n"
+"                       still be used to separate each command.)\n"
+"\n"
+"                       To not try to contact another x11vnc process and instead\n"
+"                       just run the command (or query) directly, prefix the\n"
+"                       command with the string \"DIRECT:\"\n"
+"\n"
 "                       The following -remote/-R commands are supported:\n"
 "\n"
 "                       stop            terminate the server, same as \"quit\"\n"
 "                                       \"exit\" or \"shutdown\".\n"
 "                       ping            see if the x11vnc server responds.\n"
-"                                       Return is: ans=ping:<xdisplay>\n"
+"                                       return is: ans=ping:<display>\n"
+"                       ping:mystring   as above, but use your own unique string.\n"
+"                                       return is: ans=ping:mystring:<xdisplay>\n"
 "                       blacken         try to push a black fb update to all\n"
 "                                       clients (due to timings a client\n"
 "                                       could miss it). Same as \"zero\", also\n"
@@ -4473,6 +4626,7 @@ void print_help(int mode) {
 "                       nograbptr       disable -grabptr mode.\n"
 "                       grabalways      enable  -grabalways mode.\n"
 "                       nograbalways    disable -grabalways mode.\n"
+"                       grablocal:n     set -grablocal to n.\n"
 "                       client_input:str set the K, M, B -input on a per-client\n"
 "                                       basis.  select which client as for\n"
 "                                       disconnect, e.g. client_input:host:MB\n"
@@ -4558,6 +4712,9 @@ void print_help(int mode) {
 "                       nosetclipboard  enable  -nosetclipboard mode.\n"
 "                       setclipboard    disable -nosetclipboard mode.\n"
 "                       seldir:str      set -seldir to \"str\"\n"
+"                       resend_cutbuffer resend the most recent CUTBUFFER0 copy\n"
+"                       resend_clipboard resend the most recent CLIPBOARD copy\n"
+"                       resend_primary   resend the most recent PRIMARY copy\n"
 "                       cursor:mode     enable  -cursor \"mode\".\n"
 "                       show_cursor     enable  showing a cursor.\n"
 "                       noshow_cursor   disable showing a cursor. (same as\n"
@@ -4630,8 +4787,25 @@ void print_help(int mode) {
 "                       nodebug_pointer disable -debug_pointer, same as \"nodp\"\n"
 "                       debug_keyboard   enable  -debug_keyboard, same as \"dk\"\n"
 "                       nodebug_keyboard disable -debug_keyboard, same as \"nodk\"\n"
+"                       keycode:n       inject keystroke 'keycode' (xmodmap -pk)\n"
+"                       keycode:n,down  inject 'keycode' (down=0,1)\n"
+"                       keysym:str      inject keystroke 'keysym' (number/name)\n"
+"                       keysym:str,down inject 'keysym' (down=0,1)\n"
+"                       ptr:x,y,mask    inject pointer event x, y, button-mask\n"
+"                       sleep:t         sleep floating point time t.\n"
+"                       get_xprop:p     get X property named 'p'.\n"
+"                       set_xprop:p:val set X property named 'p' to 'val'.\n"
+"                                       p -> id=NNN:p for hex/dec window id.\n"
+"                       wininfo:id      get info about X window id.  use 'root'\n"
+"                                       for root window, use +id for children.\n"
+"                       grab_state      get state of pointer and keyboard grab.\n"
+"                       pointer_pos     print XQueryPointer x,y cursor position.\n"
+"                       mouse_x         print x11vnc's idea of cursor position.\n"
+"                       mouse_y         print x11vnc's idea of cursor position.\n"
+"                       noop            do nothing.\n"
 "                       defer:n         set -defer to n ms,same as deferupdate:n\n"
 "                       wait:n          set -wait to n ms.\n"
+"                       extra_fbur:n    set -extra_fbur to n.\n"
 "                       wait_ui:f       set -wait_ui factor to f.\n"
 "                       setdefer:n      set -setdefer to -2,-1,0,1, or 2.\n"
 "                       wait_bog        disable -nowait_bog mode.\n"
@@ -4670,6 +4844,7 @@ void print_help(int mode) {
 "                       nosnapfb        disable -snapfb mode.\n"
 "                       rawfb:str       set -rawfb mode to \"str\".\n"
 "                       uinput_accel:f  set uinput_accel to f.\n"
+"                       uinput_thresh:n set uinput_thresh to n.\n"
 "                       uinput_reset:n  set uinput_reset to n ms.\n"
 "                       uinput_always:n set uinput_always to 1/0.\n"
 "                       progressive:n   set libvncserver -progressive slice\n"
@@ -4687,7 +4862,9 @@ void print_help(int mode) {
 "                       macresize       disable -macnoresize mode.\n"
 "                       maciconanim:n   set -maciconanim to n.\n"
 "                       macmenu         enable  -macmenu  mode.\n"
-"                       macnomenu       disable -macnmenu mode.\n"
+"                       macnomenu       disable -macmenu  mode.\n"
+"                       macuskbd        enable  -macuskbd mode.\n"
+"                       macnouskbd      disable -macuskbd mode.\n"
 /* access */
 "                       httpport:n      set -httpport to n.\n"
 "                       httpdir:dir     set -httpdir to dir (and enable http).\n"
@@ -4724,6 +4901,100 @@ void print_help(int mode) {
 "                       noremote        disable the -remote command processing,\n"
 "                                       it cannot be turned back on.\n"
 "\n"
+"                       bcx_xattach:str  This remote control command is for\n"
+"                       use with the BARCO xattach program or the x2x program.\n"
+"                       Both of these programs are for 'pointer and keyboard'\n"
+"                       sharing between separate X displays.  In general the\n"
+"                       two displays are usually nearby, e.g. on the same desk,\n"
+"                       and this allows the user to share a single pointer and\n"
+"                       keyboard between them.  The user moves the mouse to\n"
+"                       an edge and then the mouse pointer appears to 'jump'\n"
+"                       to the other display screen.  Thus it emulates what a\n"
+"                       single X server would do for two screens (e.g. :0.0 and\n"
+"                       :0.1) The illusion of a single Xserver with multiple\n"
+"                       screens is achieved by forwarding events to the 2nd\n"
+"                       one via the XTEST extension.\n"
+"\n"
+"                       What the x11vnc bcx_xattach command does is to perform\n"
+"                       some pointer movements to try to INDUCE xattach/x2x\n"
+"                       to 'jump' to the other display.  In what follows the\n"
+"                       'master' display refers to the one that when it has\n"
+"                       'focus' it is basically doing nothing besides watching\n"
+"                       for the mouse to go over an edge.  The 'slave'\n"
+"                       display refers to the one to which the mouse and\n"
+"                       keyboard is redirected to once an edge in the master\n"
+"                       has been crossed.  Note that the x11vnc executing the\n"
+"                       bcx_xattach command MUST be the one connected to the\n"
+"                       *master* display.\n"
+"\n"
+"                       Also note that when input is being redirected (via\n"
+"                       XTEST) from the master display to the slave display,\n"
+"                       the master display's pointer and keyboard are *grabbed*\n"
+"                       by xattach/x2x.  x11vnc can use this info to verify that\n"
+"                       the master/slave mode change has taken place correctly.\n"
+"                       If you specify the \"ifneeded\" option (see below)\n"
+"                       and the initial grab state is that of the desired\n"
+"                       final state, then no pointer movements are injected\n"
+"                       and \"DONE,GRAB_OK\" is returned.\n"
+"\n"
+"                       \"str\" must contain one of \"up\", \"down\", \"left\",\n"
+"                       or \"right\" to indicate the direction of the 'jump'.\n"
+"                       \"str\" must also contain one of \"master_to_slave\"\n"
+"                       or \"slave_to_master\" to indicate the type of mode\n"
+"                       change induced by the jump.  Use \"M2S\" and \"S2M\"\n"
+"                       as shorter aliases.\n"
+"\n"
+"                       \"str\" may be a \"+\" separated list of additional\n"
+"                       tuning options.  The \"shift=n\" option indicates an\n"
+"                       offset shift position away from (0,0) (default 20).\n"
+"                       \"final=x+y\" specifies the final position of the cursor\n"
+"                       at the end of the normal move sequence; default 30+30.\n"
+"                       \"extra_move=x+y\" means to do one more pointer move\n"
+"                       after \"final\" to x+y.  \"dt=n\" sets the sleep time\n"
+"                       in milliseconds between pointer moves (default: 40ms)\n"
+"                       \"retry=n\" specifies the maximum number of retries if\n"
+"                       the grab state change fails. \"ifneeded\" means to not\n"
+"                       apply the pointer movements if the initial grab state is\n"
+"                       that of the desired final state. \"nograbcheck\" means\n"
+"                       to not check if the grab state changed as expected and\n"
+"                       only apply the pointer movements (default is to check\n"
+"                       the grab states.)\n"
+"\n"
+"                       If you do not specify \"up\", etc., to bcx_xattach\n"
+"                       nothing will be attempted and the command returns\n"
+"                       the string FAIL,NO_DIRECTION_SPECIFIED.  If you do\n"
+"                       not specify \"master_to_slave\" or \"M2S\", etc., to\n"
+"                       bcx_xattach nothing will be attempted and the command\n"
+"                       returns the string FAIL,NO_MODE_CHANGE_SPECIFIED.\n"
+"\n"
+"                       Otherwise, the returned string will contain \"DONE\".\n"
+"                       It will be \"DONE,GRAB_OK\" if the grab state changed\n"
+"                       as expected (or if \"ifneeded\" was supplied and\n"
+"                       the initial grab state was already the desired\n"
+"                       one.)  If the initial grab state was incorrect,\n"
+"                       but the final grab state was correct then it is\n"
+"                       \"DONE,GRAB_FAIL_INIT\".  If the initial grab state\n"
+"                       was correct, but the final grab state was incorrect\n"
+"                       then it is \"DONE,GRAB_FAIL_FINAL\".  If both are\n"
+"                       incorrect it will be \"DONE,GRAB_FAIL\".  Under grab\n"
+"                       failure the string will be followed by \":p1,k1-p2,k2\"\n"
+"                       where  p1,k1 indicates the initial pointer and keyboard\n"
+"                       grab states and p2,k2 the final ones. If GRAB_FAIL or\n"
+"                       GRAB_FAIL_FINAL occurs, the action will be retried up\n"
+"                       to 3 times; trying to reset the state and sleeping a\n"
+"                       bit between each try.  Set retry=n to adjust the number\n"
+"                       of retries, zero to disable retries.\n"
+"\n"
+"                       Examples:\n"
+"                           -R bcx_xattach:down+M2S\n"
+"                           -R bcx_xattach:up+S2M\n"
+"                           -R bcx_xattach:up+S2M+nograbcheck+dt=30\n"
+"                           -R bcx_xattach:down+M2S+extra_move=100+100\n"
+"\n"
+"                       or use -Q instead of -R to retrieve the result text.\n"
+"\n"
+"                       End of the bcx_xattach:str description.\n"
+"\n"
 "                       The vncconnect(1) command from standard VNC\n"
 "                       distributions may also be used if string is prefixed\n"
 "                       with \"cmd=\" E.g. 'vncconnect cmd=stop'.  Under some\n"
@@ -4752,7 +5023,8 @@ void print_help(int mode) {
 "                       query straight to the X11VNC_REMOTE property or connect\n"
 "                       file use \"qry=...\" instead of \"cmd=...\"\n"
 "\n"
-"                       ans= stop quit exit shutdown ping blacken zero\n"
+"                       ans= stop quit exit shutdown ping resend_cutbuffer\n"
+"                       resend_clipboard resend_primary blacken zero\n"
 "                       refresh reset close disconnect id sid waitmapped\n"
 "                       nowaitmapped clip flashcmap noflashcmap shiftcmap\n"
 "                       truecolor notruecolor overlay nooverlay overlay_cursor\n"
@@ -4763,7 +5035,7 @@ void print_help(int mode) {
 "                       once timeout tightfilexfer notightfilexfer ultrafilexfer\n"
 "                       noultrafilexfer rfbversion deny lock nodeny unlock\n"
 "                       avahi mdns zeroconf noavahi nomdns nozeroconf connect\n"
-"                       proxy  allowonce allow localhost nolocalhost listen\n"
+"                       proxy allowonce allow localhost nolocalhost listen\n"
 "                       lookup nolookup accept afteraccept gone shm noshm\n"
 "                       flipbyteorder noflipbyteorder onetile noonetile\n"
 "                       solid_color solid nosolid blackout xinerama noxinerama\n"
@@ -4773,10 +5045,10 @@ void print_help(int mode) {
 "                       sloppy_keys nosloppy_keys skip_dups noskip_dups\n"
 "                       add_keysyms noadd_keysyms clear_mods noclear_mods\n"
 "                       clear_keys noclear_keys clear_all clear_locks keystate\n"
-"                       remap repeat norepeat fb nofb bell nobell sel nosel\n"
-"                       primary noprimary setprimary nosetprimary clipboard\n"
-"                       noclipboard setclipboard nosetclipboard seldir\n"
-"                       cursorshape nocursorshape cursorpos nocursorpos\n"
+"                       remap repeat norepeat fb nofb bell nobell sendbell\n"
+"                       sel nosel primary noprimary setprimary nosetprimary\n"
+"                       clipboard noclipboard setclipboard nosetclipboard\n"
+"                       seldir cursorshape nocursorshape cursorpos nocursorpos\n"
 "                       cursor_drag nocursor_drag cursor show_cursor\n"
 "                       noshow_cursor nocursor arrow xfixes noxfixes xdamage\n"
 "                       noxdamage xd_area xd_mem alphacut alphafrac alpharemove\n"
@@ -4792,16 +5064,18 @@ void print_help(int mode) {
 "                       nowireframe nowf wireframelocal wfl nowireframelocal\n"
 "                       nowfl wirecopyrect wcr nowirecopyrect nowcr scr_area\n"
 "                       scr_skip scr_inc scr_keys scr_term scr_keyrepeat\n"
-"                       scr_parms scrollcopyrect scr noscrollcopyrect noscr\n"
-"                       fixscreen noxrecord xrecord reset_record pointer_mode pm\n"
-"                       input_skip allinput noallinput input grabkbd nograbkbd\n"
-"                       grabptr nograbptr grabalways nograbalways grablocal\n"
-"                       client_input ssltimeout speeds wmdt debug_pointer dp\n"
-"                       nodebug_pointer nodp debug_keyboard dk nodebug_keyboard\n"
-"                       nodk keycode deferupdate defer setdefer wait_ui\n"
-"                       wait_bog nowait_bog slow_fb xrefresh wait readtimeout\n"
-"                       nap nonap sb screen_blank fbpm nofbpm dpms nodpms\n"
-"                       clientdpms noclientdpms forcedpms noforcedpms\n"
+"                       scr_parms scrollcopyrect scr noscrollcopyrect\n"
+"                       noscr fixscreen noxrecord xrecord reset_record\n"
+"                       pointer_mode pm input_skip allinput noallinput input\n"
+"                       grabkbd nograbkbd grabptr nograbptr grabalways\n"
+"                       nograbalways grablocal client_input ssltimeout\n"
+"                       speeds wmdt debug_pointer dp nodebug_pointer nodp\n"
+"                       debug_keyboard dk nodebug_keyboard nodk keycode\n"
+"                       keysym ptr sleep get_xprop set_xprop wininfo\n"
+"                       bcx_xattach deferupdate defer setdefer extra_fbur\n"
+"                       wait_ui wait_bog nowait_bog slow_fb xrefresh wait\n"
+"                       readtimeout nap nonap sb screen_blank fbpm nofbpm dpms\n"
+"                       nodpms clientdpms noclientdpms forcedpms noforcedpms\n"
 "                       noserverdpms serverdpms noultraext ultraext chatwindow\n"
 "                       nochatwindow chaton chatoff fs gaps grow fuzz snapfb\n"
 "                       nosnapfb rawfb uinput_accel uinput_thresh uinput_reset\n"
@@ -4819,21 +5093,23 @@ void print_help(int mode) {
 "                       macnoresize macresize nomacnoresize maciconanim macmenu\n"
 "                       macnomenu nomacmenu macuskbd nomacuskbd noremote\n"
 "\n"
-"                       aro=  noop display vncdisplay desktopname guess_desktop\n"
-"                       http_url auth xauth users rootshift clipshift scale_str\n"
-"                       scaled_x scaled_y scale_numer scale_denom scale_fac_x\n"
+"                       aro=  noop display vncdisplay autoport loop loopbg\n"
+"                       desktopname guess_desktop http_url auth xauth\n"
+"                       users rootshift clipshift scale_str scaled_x\n"
+"                       scaled_y scale_numer scale_denom scale_fac_x\n"
 "                       scale_fac_y scaling_blend scaling_nomult4 scaling_pad\n"
 "                       scaling_interpolate inetd privremote unsafe safer\n"
 "                       nocmds passwdfile unixpw unixpw_nis unixpw_list ssl\n"
 "                       ssl_pem sslverify stunnel stunnel_pem https httpsredir\n"
-"                       usepw using_shm logfile o flag rc norc h help V version\n"
-"                       lastmod bg sigpipe threads readrate netrate netlatency\n"
-"                       pipeinput clients client_count pid ext_xtest ext_xtrap\n"
-"                       ext_xrecord ext_xkb ext_xshm ext_xinerama ext_overlay\n"
-"                       ext_xfixes ext_xdamage ext_xrandr rootwin num_buttons\n"
-"                       button_mask mouse_x mouse_y bpp depth indexed_color\n"
-"                       dpy_x dpy_y wdpy_x wdpy_y off_x off_y cdpy_x cdpy_y\n"
-"                       coff_x coff_y rfbauth passwd viewpasswd\n"
+"                       usepw using_shm logfile o flag rmflag rc norc h help\n"
+"                       V version lastmod bg sigpipe threads readrate netrate\n"
+"                       netlatency pipeinput clients client_count pid ext_xtest\n"
+"                       ext_xtrap ext_xrecord ext_xkb ext_xshm ext_xinerama\n"
+"                       ext_overlay ext_xfixes ext_xdamage ext_xrandr rootwin\n"
+"                       num_buttons button_mask mouse_x mouse_y grab_state\n"
+"                       pointer_pos bpp depth indexed_color dpy_x dpy_y wdpy_x\n"
+"                       wdpy_y off_x off_y cdpy_x cdpy_y coff_x coff_y rfbauth\n"
+"                       passwd viewpasswd\n"
 "\n"
 "-QD variable           Just like -query variable, but returns the default\n"
 "                       value for that parameter (no running x11vnc server\n"
@@ -4853,10 +5129,43 @@ void print_help(int mode) {
 "                       the -query request is processed in the normal way.\n"
 "                       This allows for a reliable way to see if the -remote\n"
 "                       command was processed by querying for any new settings.\n"
-"                       Note however that there is timeout of a few seconds so\n"
-"                       if the x11vnc takes longer than that to process the\n"
-"                       requests the requester will think that a failure has\n"
-"                       taken place.\n"
+"                       Note however that there is timeout of a few seconds\n"
+"                       (see the next paragraph) so if the x11vnc takes longer\n"
+"                       than that to process the requests the requester will\n"
+"                       think that a failure has taken place.\n"
+"\n"
+"                       The default is to wait 3.5 seconds.  Or if cmd=stop\n"
+"                       only 1.0 seconds.  If cmd matches 'script:' then it\n"
+"                       will wait up to 10.0 seconds.  Set X11VNC_SYNC_TIMEOUT\n"
+"                       to the number of seconds you want it to wait.\n"
+"\n"
+"-query_retries str     If a query fails to get a response from an x11vnc\n"
+"                       server, retry up to n times.  \"str\" is specified as\n"
+"                       n[:t][/match]  Optionally the delay between tries may\n"
+"                       be specified by \"t\" a floating point time (default\n"
+"                       0.5 seconds.)  Note: the response is not checked for\n"
+"                       validity or whether it corresponds to the query sent.\n"
+"                       The query \"ping:mystring\" may be used to help uniquely\n"
+"                       identify the query.  Optionally, a matching string after\n"
+"                       a \"/\" will be used to check the result text.  Up to\n"
+"                       n retries will take place until the matching string is\n"
+"                       found in the output text.  If the match string is never\n"
+"                       found the program's exit code is 1; if the match is\n"
+"                       found it exits with 0.  Note that there may be stdout\n"
+"                       printed for each retry (i.e. multiple lines printed\n"
+"                       out to stdout.)\n"
+"                       Example: -query_retries 4:1.5/grab_state\n"
+"\n"
+"-remote_prefix str     Enable a remote-control communication channel for\n"
+"                       connected VNC clients.  str is a non-empty string. If a\n"
+"                       VNC client sends rfbCutText having the prefix \"str\"\n"
+"                       then the part after it is processed as though it were\n"
+"                       sent via 'x11vnc -remote ...'.  If it begins with\n"
+"                       neither 'cmd=' nor 'qry=' then 'qry=' is assumed.\n"
+"                       Any corresponding output text for that remote control\n"
+"                       command is sent back to all client as rfbCutText.\n"
+"                       The returned output is also prefixed with \"str\".\n"
+"                       Example: -remote_prefix DO_THIS:\n"
 "\n"
 "-noremote              Do not process any remote control commands or queries.\n"
 "-yesremote             Do process remote control commands or queries.\n"
@@ -4936,6 +5245,7 @@ void print_help(int mode) {
 			int w = 23;
 			char tmp[100];
 			if (p[0] == '-') {
+				memset(tmp, 0, sizeof(tmp));
 				strncpy(tmp, p, w);
 				fprintf(stderr, "  %s", tmp);
 				l++;
@@ -4981,8 +5291,8 @@ void print_help(int mode) {
 		waitms,
 		wait_ui,
 		take_naps ? "take naps":"no naps",
-		rfbMaxClientWait/1000,
 		screen_blank,
+		rfbMaxClientWait/1000,
 		watch_fbpm ? "-nofbpm":"-fbpm",
 		watch_dpms ? "-nodpms":"-dpms",
 		xdamage_max_area, NSCAN, xdamage_memory,