Properly store certificate exceptions in Java viewer
Like the native viewer, the Java viewer didn't store certificate
exceptions properly. Whilst not as bad as the native viewer, it still
failed to check that a stored certificate wouldn't be maliciously used
for another server. In practice this can in most cases be used to
impersonate another server.
Handle this like the native viewer by storing exceptions for a specific
hostname/certificate combination.
Ensure queueMutex is always correctly released by using finally blocks. This is the closest approximation of AutoMutex style automatic release you can get in Java.
Various errors exposed when connecting to RealVNC servers
on alternative platforms (ARM, SPARC). SSLEngineManager
was also cleaned up but most of the changes are cosmetic.
Fully implement support for alpha cursor pseudo encoding.
Alpha cursors are not supported in java on Windows so disable
it in that case. Ideally it would be nice to be able to test
whether or not the client OS supports it, but at the moment
MS Windows is the only one that I'm aware of that doesn't.
Fix regression that omitted support for client redirect.
Also, delay showing DesktopWindow until first valid rect has been
recieved. This allows for a ClientRedirect to take place before
any data rects have been received.
Make all viewer parameters static. Viewer instances are isolated from each other by spawning a completely new process for each viewer, rather than simply starting a new thread. All dialogs were redesigned to better match the look of the native viewer, and also to be more tolerant of sizing differences between platforms.
95f39a5 introduced a regression whereby an exception would be thrown
when a PEM encoded CA certificate file containing one or more blank
lines was read in under Apple Java 6. Additionally, CA certs were
being appended to the ~/.vnc/x509_savedcerts.pem file even if they
were already included in it. Also fixes a possible FileNotFoundException
if the x509_savedcerts.pem file didn't exist.
Fixes #193 and also adds automatic certificate saving feature like
the Fltk viewer. Also pulls in CA certificates from all trusted
authorities known to the JRE for the case when the server is using
a certificate from a top-level authority.
The SSLEngineManager was basically an abomination. The work is now
done as it should be, with the buffers being fed and the engine
deciding when data is consumed or produced. The engine should be
much more robust now as well.
Additionally, although JRE 7 supports the TLSv1.1 and TLSv1.2
protocols, they are not actually enabled by default. The JSSE
reference cites compatibility reasons for this but this doesn't
appear to be the case with the TigerVNC server and they will be
enabled by default in JRE 8.
The regular expression for enabling anonymous DH cipher suites
was too narrow and excluded the elliptic curve ciphers, which
are now ordered ahead of the ephemeral ciphers by the default
security provider.
Lastly, increase the size of the buffer in FdOutStream from 8Kb
to 16Kb. I'm not sure why FdInStream and FdOutStream were
asymmetric to begin with, but 16Kb is the default size for TLS
packets and there seems to be now negative effects on plain
text connections.
Brian P. Hinz
Pierre Ossman
Pepijn Van Eeckhoudt