We don't exit here, so it's not a fatal error. It's also a fairly common
scenario, so remove the alert completely.

We'll just crash later if we try to use such a large screen, so reject
the request from the client instead and keep the server running.

It expects the callers to include this, so make sure we're consistently
providing one.

The previous method stored the certificates as authorities, meaning that
the owner of that certificate could impersonate any server it wanted
after a client had added an exception.

Handle this more properly by only storing exceptions for specific
hostname/certificate combinations, the same way browsers or SSH does
things.

Include something more user friendly when we need to fail fatally and
not just the technical error.

Major restructuring of how streams work. Neither input nor output
streams are now blocking. This avoids stalling the rest of the client or
server when a peer is slow or unresponsive.

Note that this puts an extra burden on users of streams to make sure
they are allowed to do their work once the underlying transports are
ready (e.g. monitoring fds).

These are not universal in the protocol so having functions for them
only obfuscates things.

The specification only states a single result byte and not any reason
after a TLS authentication failure.

Now measures over an entire update, which should hopefully give us more
stable values. They are still small values for fast networks though so
increase precision in the values we keep.

Provide some safety checks when directly accessing the underlying
pointer of streams.

Some systems (like TLS) need to send some final data before closing
a connection. Make sure this is properly handled by cleaning up the
security object before closing the underlying network socket.

Otherwise we might send duplicate result codes and other weird things.

External callers don't need to know the exact details, only if there is
data that needs to be flushed or not.

This allows us to handle peaks in input and output streams gracefully
without having to block processing.

The principle can be used in a more general fashion than just TCP
streams.

We can do what we want with the standard methods.

Just have a simply number of bytes argument to avoid a lot of
complexity.

Most streams are backed by a memory buffer. Create common base classes
for this functionality to avoid code duplication.

Makes it more readable to write code that needs to know how much
data/space is available in a stream.

It might leak data depending on what's in the buffer. Use pad() instead
where blank space is needed.

They were accidentally left unused in fbad8a9 so they haven't been used
in some time.

We need to be able to tell this exception came from a decoder.

For readability.

There might be some final handshake data that is still stuck in the
buffers, so make a best effort attempt at getting it to the client.

Makes things more consistent and avoids surprises.

The socket is closed at this point so we have to rely on a cached
value for the logging.

It's a generic feature that is better handled as part of SConnection's
state machine.

We can't safely use the normal timers in base classes as we cannot
guarantee that subclasses will call the base class' handleTimeout()
properly if the subclass overrides it.

Might as well make these explicit so the cost is apparent.

vncsession-start is running in SELinux vnc_session_t domain because of
"SELinuxContext=system_u:system_r:vnc_session_t:s0" option in systemd
vncserver@.service unit file. vncsession-start executing binary
vncsession with SELinux label/type vnc_session_t. This access was not
allowed in vncsession policy.

This is the current upstream so let's make use of it to get the latest
in features and fixes.

It's included by default in dynamic builds so we need to make sure it
isn't lost when switching to static.

They are new modules and not generated files.

It creates an invalid region if given an empty rect. Fortunately
RegionInitBoxes() handles that just fine, so use that instead.

We no longer support such old X servers so start using the current
functions.

It seems like many of the X11 operations can end up with no pixels
actually changing. So instead of discovering and adding workarounds for
each individually we'll just check very region added if it's empty.

Otherwise it might fail if the repositories have changed since the image
was generated.

We now require at least 1.16, so remove all code that handled older
versions than that.

We removed support in the code ages ago, but overlooked this part of the
documentation. Also remove some dead code in Xvnc on the same theme.