Use specific class for protocol problems

Make it easier to identify communication issues.

19 files changed, 88 insertions, 77 deletions

diff --git a/common/rfb/CConnection.cxx b/common/rfb/CConnection.cxx
index 244c8862..8a718b5f 100644
--- a/common/rfb/CConnection.cxx
+++ b/common/rfb/CConnection.cxx
@@ -172,7 +172,7 @@ bool CConnection::processVersionMsg()
   if (sscanf(verStr, "RFB %03d.%03d\n",
              &majorVersion, &minorVersion) != 2) {
     state_ = RFBSTATE_INVALID;
-    throw Exception("reading version failed: not an RFB server?");
+    throw ProtocolException("reading version failed: not an RFB server?");
   }
 
   server.setVersion(majorVersion, minorVersion);
@@ -185,8 +185,10 @@ bool CConnection::processVersionMsg()
     vlog.error("Server gave unsupported RFB protocol version %d.%d",
                server.majorVersion, server.minorVersion);
     state_ = RFBSTATE_INVALID;
-    throw Exception(format("Server gave unsupported RFB protocol version %d.%d",
-                           server.majorVersion, server.minorVersion));
+    throw ProtocolException(format("Server gave unsupported RFB "
+                                   "protocol version %d.%d",
+                                   server.majorVersion,
+                                   server.minorVersion));
   } else if (server.beforeVersion(3,7)) {
     server.setVersion(3,3);
   } else if (server.afterVersion(3,8)) {
@@ -233,7 +235,7 @@ bool CConnection::processSecurityTypesMsg()
         secType = secTypeInvalid;
     } else {
       vlog.error("Unknown 3.3 security type %d", secType);
-      throw Exception("Unknown 3.3 security type");
+      throw ProtocolException("Unknown 3.3 security type");
     }
 
   } else {
@@ -283,7 +285,7 @@ bool CConnection::processSecurityTypesMsg()
   if (secType == secTypeInvalid) {
     state_ = RFBSTATE_INVALID;
     vlog.error("No matching security types");
-    throw Exception("No matching security types");
+    throw ProtocolException("No matching security types");
   }
 
   state_ = RFBSTATE_SECURITY;
@@ -327,7 +329,7 @@ bool CConnection::processSecurityResultMsg()
     vlog.debug("auth failed - too many tries");
     break;
   default:
-    throw Exception("Unknown security result from server");
+    throw ProtocolException("Unknown security result from server");
   }
 
   if (server.beforeVersion(3,8)) {
diff --git a/common/rfb/CMsgReader.cxx b/common/rfb/CMsgReader.cxx
index c94ecfd8..17c92227 100644
--- a/common/rfb/CMsgReader.cxx
+++ b/common/rfb/CMsgReader.cxx
@@ -119,7 +119,7 @@ bool CMsgReader::readMsg()
       ret = readEndOfContinuousUpdates();
       break;
     default:
-      throw Exception(format("Unknown message type %d", currentMsgType));
+      throw ProtocolException(format("Unknown message type %d", currentMsgType));
     }
 
     if (ret)
@@ -301,7 +301,7 @@ bool CMsgReader::readExtendedClipboard(int32_t len)
     return false;
 
   if (len < 4)
-    throw Exception("Invalid extended clipboard message");
+    throw ProtocolException("Invalid extended clipboard message");
   if (len > maxCutText) {
     vlog.error("Extended clipboard message too long (%d bytes) - ignoring", len);
     is->skip(len);
@@ -323,7 +323,7 @@ bool CMsgReader::readExtendedClipboard(int32_t len)
     }
 
     if (len < (int32_t)(4 + 4*num))
-      throw Exception("Invalid extended clipboard message");
+      throw ProtocolException("Invalid extended clipboard message");
 
     num = 0;
     for (i = 0;i < 16;i++) {
@@ -348,7 +348,7 @@ bool CMsgReader::readExtendedClipboard(int32_t len)
         continue;
 
       if (!zis.hasData(4))
-        throw Exception("Extended clipboard decode error");
+        throw ProtocolException("Extended clipboard decode error");
 
       lengths[num] = zis.readU32();
 
@@ -361,7 +361,7 @@ bool CMsgReader::readExtendedClipboard(int32_t len)
           size_t chunk;
 
           if (!zis.hasData(1))
-            throw Exception("Extended clipboard decode error");
+            throw ProtocolException("Extended clipboard decode error");
 
           chunk = zis.avail();
           if (chunk > lengths[num])
@@ -377,7 +377,7 @@ bool CMsgReader::readExtendedClipboard(int32_t len)
       }
 
       if (!zis.hasData(lengths[num]))
-        throw Exception("Extended clipboard decode error");
+        throw ProtocolException("Extended clipboard decode error");
 
       buffers[num] = new uint8_t[lengths[num]];
       zis.readBytes(buffers[num], lengths[num]);
@@ -407,7 +407,7 @@ bool CMsgReader::readExtendedClipboard(int32_t len)
       handler->handleClipboardNotify(flags);
       break;
     default:
-      throw Exception("Invalid extended clipboard action");
+      throw ProtocolException("Invalid extended clipboard action");
     }
   }
 
@@ -473,7 +473,7 @@ bool CMsgReader::readRect(const Rect& r, int encoding)
     vlog.error("Rect too big: %dx%d at %d,%d exceeds %dx%d",
 	    r.width(), r.height(), r.tl.x, r.tl.y,
             handler->server.width(), handler->server.height());
-    throw Exception("Rect too big");
+    throw ProtocolException("Rect too big");
   }
 
   if (r.is_empty())
@@ -485,7 +485,7 @@ bool CMsgReader::readRect(const Rect& r, int encoding)
 bool CMsgReader::readSetXCursor(int width, int height, const Point& hotspot)
 {
   if (width > maxCursorSize || height > maxCursorSize)
-    throw Exception("Too big cursor");
+    throw ProtocolException("Too big cursor");
 
   std::vector<uint8_t> rgba(width*height*4);
 
@@ -549,7 +549,7 @@ bool CMsgReader::readSetXCursor(int width, int height, const Point& hotspot)
 bool CMsgReader::readSetCursor(int width, int height, const Point& hotspot)
 {
   if (width > maxCursorSize || height > maxCursorSize)
-    throw Exception("Too big cursor");
+    throw ProtocolException("Too big cursor");
 
   int data_len = width * height * (handler->server.pf().bpp/8);
   int mask_len = ((width+7)/8) * height;
@@ -595,7 +595,7 @@ bool CMsgReader::readSetCursor(int width, int height, const Point& hotspot)
 bool CMsgReader::readSetCursorWithAlpha(int width, int height, const Point& hotspot)
 {
   if (width > maxCursorSize || height > maxCursorSize)
-    throw Exception("Too big cursor");
+    throw ProtocolException("Too big cursor");
 
   const PixelFormat rgbaPF(32, 32, false, true, 255, 255, 255, 16, 8, 0);
   ManagedPixelBuffer pb(rgbaPF, width, height);
@@ -656,7 +656,7 @@ bool CMsgReader::readSetCursorWithAlpha(int width, int height, const Point& hots
 bool CMsgReader::readSetVMwareCursor(int width, int height, const Point& hotspot)
 {
   if (width > maxCursorSize || height > maxCursorSize)
-    throw Exception("Too big cursor");
+    throw ProtocolException("Too big cursor");
 
   uint8_t type;
 
@@ -750,7 +750,7 @@ bool CMsgReader::readSetVMwareCursor(int width, int height, const Point& hotspot
 
     handler->setCursor(width, height, hotspot, data.data());
   } else {
-    throw Exception("Unknown cursor type");
+    throw ProtocolException("Unknown cursor type");
   }
 
   return true;
diff --git a/common/rfb/CSecurityDH.cxx b/common/rfb/CSecurityDH.cxx
index e37a3a33..ca110cb2 100644
--- a/common/rfb/CSecurityDH.cxx
+++ b/common/rfb/CSecurityDH.cxx
@@ -86,9 +86,9 @@ bool CSecurityDH::readKey()
   uint16_t gen = is->readU16();
   keyLength = is->readU16();
   if (keyLength < MinKeyLength)
-    throw Exception("DH key is too short");
+    throw ProtocolException("DH key is too short");
   if (keyLength > MaxKeyLength)
-    throw Exception("DH key is too long");
+    throw ProtocolException("DH key is too long");
   if (!is->hasDataOrRestore(keyLength * 2))
     return false;
   is->clearRestorePoint();
diff --git a/common/rfb/CSecurityRSAAES.cxx b/common/rfb/CSecurityRSAAES.cxx
index 37b59532..11c392d5 100644
--- a/common/rfb/CSecurityRSAAES.cxx
+++ b/common/rfb/CSecurityRSAAES.cxx
@@ -174,9 +174,9 @@ bool CSecurityRSAAES::readPublicKey()
   is->setRestorePoint();
   serverKeyLength = is->readU32();
   if (serverKeyLength < MinKeyLength)
-    throw Exception("server key is too short");
+    throw ProtocolException("server key is too short");
   if (serverKeyLength > MaxKeyLength)
-    throw Exception("server key is too long");
+    throw ProtocolException("server key is too long");
   size_t size = (serverKeyLength + 7) / 8;
   if (!is->hasDataOrRestore(size * 2))
     return false;
@@ -189,7 +189,7 @@ bool CSecurityRSAAES::readPublicKey()
   nettle_mpz_set_str_256_u(serverKey.n, size, serverKeyN);
   nettle_mpz_set_str_256_u(serverKey.e, size, serverKeyE);
   if (!rsa_public_key_prepare(&serverKey))
-    throw Exception("server key is invalid");
+    throw ProtocolException("server key is invalid");
   return true;
 }
 
@@ -255,7 +255,7 @@ bool CSecurityRSAAES::readRandom()
   is->setRestorePoint();
   size_t size = is->readU16();
   if (size != clientKey.size)
-    throw Exception("client key length doesn't match");
+    throw ProtocolException("client key length doesn't match");
   if (!is->hasDataOrRestore(size))
     return false;
   is->clearRestorePoint();
@@ -268,7 +268,7 @@ bool CSecurityRSAAES::readRandom()
   if (!rsa_decrypt(&clientKey, &randomSize, serverRandom, x) ||
       randomSize != (size_t)keySize / 8) {
     mpz_clear(x);
-    throw Exception("failed to decrypt server random");
+    throw ProtocolException("failed to decrypt server random");
   }
   mpz_clear(x);
   return true;
@@ -397,7 +397,7 @@ bool CSecurityRSAAES::readHash()
     sha256_digest(&ctx, hashSize, realHash);
   }
   if (memcmp(hash, realHash, hashSize) != 0)
-    throw Exception("hash doesn't match");
+    throw ProtocolException("hash doesn't match");
   return true;
 }
 
@@ -427,7 +427,7 @@ bool CSecurityRSAAES::readSubtype()
     return false;
   subtype = rais->readU8();
   if (subtype != secTypeRA2UserPass && subtype != secTypeRA2Pass)
-    throw Exception("unknown RSA-AES subtype");
+    throw ProtocolException("unknown RSA-AES subtype");
   return true;
 }
 
diff --git a/common/rfb/CSecurityTLS.cxx b/common/rfb/CSecurityTLS.cxx
index ae916139..fc1cde8e 100644
--- a/common/rfb/CSecurityTLS.cxx
+++ b/common/rfb/CSecurityTLS.cxx
@@ -146,7 +146,7 @@ bool CSecurityTLS::processMsg()
       return false;
 
     if (is->readU8() == 0)
-      throw Exception("Server failed to initialize TLS session");
+      throw ProtocolException("Server failed to initialize TLS session");
 
     ret = gnutls_init(&session, GNUTLS_CLIENT);
     if (ret != GNUTLS_E_SUCCESS)
@@ -312,7 +312,7 @@ void CSecurityTLS::checkSession()
     return;
 
   if (gnutls_certificate_type_get(session) != GNUTLS_CRT_X509)
-    throw Exception("unsupported certificate type");
+    throw ProtocolException("unsupported certificate type");
 
   err = gnutls_certificate_verify_peers2(session, &status);
   if (err != 0) {
@@ -340,8 +340,8 @@ void CSecurityTLS::checkSession()
 
       gnutls_free(status_str.data);
 
-      throw Exception(format("Invalid server certificate: %s",
-                             error.c_str()));
+      throw ProtocolException(format("Invalid server certificate: %s",
+                                     error.c_str()));
     }
 
     err = gnutls_certificate_verification_status_print(status,
@@ -360,7 +360,7 @@ void CSecurityTLS::checkSession()
 
   cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
   if (!cert_list_size)
-    throw Exception("empty certificate chain");
+    throw ProtocolException("empty certificate chain");
 
   /* Process only server's certificate, not issuer's certificate */
   gnutls_x509_crt_t crt;
diff --git a/common/rfb/CSecurityVeNCrypt.cxx b/common/rfb/CSecurityVeNCrypt.cxx
index 3ebb3855..606fd96f 100644
--- a/common/rfb/CSecurityVeNCrypt.cxx
+++ b/common/rfb/CSecurityVeNCrypt.cxx
@@ -105,7 +105,7 @@ bool CSecurityVeNCrypt::processMsg()
       os->writeU8(0);
       os->writeU8(0);
       os->flush();
-      throw Exception("The server reported an unsupported VeNCrypt version");
+      throw ProtocolException("The server reported an unsupported VeNCrypt version");
      }
 
      haveSentVersion = true;
@@ -117,8 +117,8 @@ bool CSecurityVeNCrypt::processMsg()
       return false;
 
     if (is->readU8())
-      throw Exception("The server reported it could not support the "
-                      "VeNCrypt version");
+      throw ProtocolException("The server reported it could not "
+                              "support the VeNCrypt version");
 
     haveAgreedVersion = true;
   }
@@ -131,7 +131,7 @@ bool CSecurityVeNCrypt::processMsg()
     nAvailableTypes = is->readU8();
 
     if (!nAvailableTypes)
-      throw Exception("The server reported no VeNCrypt sub-types");
+      throw ProtocolException("The server reported no VeNCrypt sub-types");
 
     availableTypes = new uint32_t[nAvailableTypes];
     haveNumberOfTypes = true;
@@ -172,7 +172,7 @@ bool CSecurityVeNCrypt::processMsg()
 
       /* Set up the stack according to the chosen type: */
       if (chosenType == secTypeInvalid || chosenType == secTypeVeNCrypt)
-        throw Exception("No valid VeNCrypt sub-type");
+        throw ProtocolException("No valid VeNCrypt sub-type");
 
       vlog.info("Choosing security type %s (%d)", secTypeName(chosenType),
 		 chosenType);
@@ -191,7 +191,7 @@ bool CSecurityVeNCrypt::processMsg()
      * happen, since if the server supports 0 sub-types, it doesn't support
      * this security type
      */
-    throw Exception("The server reported 0 VeNCrypt sub-types");
+    throw ProtocolException("The server reported 0 VeNCrypt sub-types");
   }
 
   return csecurity->processMsg();
diff --git a/common/rfb/DecodeManager.cxx b/common/rfb/DecodeManager.cxx
index 2b121ebe..0475d62d 100644
--- a/common/rfb/DecodeManager.cxx
+++ b/common/rfb/DecodeManager.cxx
@@ -114,14 +114,14 @@ bool DecodeManager::decodeRect(const Rect& r, int encoding,
 
   if (!Decoder::supported(encoding)) {
     vlog.error("Unknown encoding %d", encoding);
-    throw rdr::Exception("Unknown encoding");
+    throw ProtocolException("Unknown encoding");
   }
 
   if (!decoders[encoding]) {
     decoders[encoding] = Decoder::createDecoder(encoding);
     if (!decoders[encoding]) {
       vlog.error("Unknown encoding %d", encoding);
-      throw rdr::Exception("Unknown encoding");
+      throw ProtocolException("Unknown encoding");
     }
   }
 
diff --git a/common/rfb/Exception.h b/common/rfb/Exception.h
index 3c8a461c..b11609d0 100644
--- a/common/rfb/Exception.h
+++ b/common/rfb/Exception.h
@@ -1,4 +1,5 @@
 /* Copyright (C) 2002-2005 RealVNC Ltd.  All Rights Reserved.
+ * Copyright 2014-2024 Pierre Ossman for Cendio AB
  * 
  * This is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -22,6 +23,13 @@
 
 namespace rfb {
   typedef rdr::Exception Exception;
+
+  class ProtocolException : public Exception {
+  public:
+    ProtocolException(const char* what_arg) : Exception(what_arg) {}
+    ProtocolException(const std::string& what_arg) : Exception(what_arg) {}
+  };
+
   struct AuthFailureException : public Exception {
     AuthFailureException(const char* reason)
       : Exception(reason) {}
diff --git a/common/rfb/HextileDecoder.cxx b/common/rfb/HextileDecoder.cxx
index dc9b9be7..d440b1af 100644
--- a/common/rfb/HextileDecoder.cxx
+++ b/common/rfb/HextileDecoder.cxx
@@ -189,7 +189,7 @@ void HextileDecoder::hextileDecode(const Rect& r, rdr::InStream* is,
           int w = ((wh >> 4) & 15) + 1;
           int h = (wh & 15) + 1;
           if (x + w > 16 || y + h > 16) {
-            throw rfb::Exception("HEXTILE_DECODE: Hextile out of bounds");
+            throw ProtocolException("HEXTILE_DECODE: Hextile out of bounds");
           }
           ptr = buf + y * t.width() + x;
           int rowAdd = t.width() - w;
diff --git a/common/rfb/JpegDecompressor.cxx b/common/rfb/JpegDecompressor.cxx
index 9406b43d..60c215fc 100644
--- a/common/rfb/JpegDecompressor.cxx
+++ b/common/rfb/JpegDecompressor.cxx
@@ -24,7 +24,7 @@
 #endif
 
 #include <rfb/JpegDecompressor.h>
-#include <rdr/Exception.h>
+#include <rfb/Exception.h>
 #include <rfb/Rect.h>
 #include <rfb/PixelFormat.h>
 
@@ -217,7 +217,7 @@ void JpegDecompressor::decompress(const uint8_t *jpegBuf,
     jpeg_abort_decompress(dinfo);
     if (dstBufIsTemp && dstBuf) delete[] dstBuf;
     if (rowPointer) delete[] rowPointer;
-    throw rdr::Exception("Tight Decoding: Wrong JPEG data received.\n");
+    throw ProtocolException("Tight Decoding: Wrong JPEG data received.\n");
   }
 
   while (dinfo->output_scanline < dinfo->output_height) {
diff --git a/common/rfb/PixelFormat.cxx b/common/rfb/PixelFormat.cxx
index f883cbf5..a538deb7 100644
--- a/common/rfb/PixelFormat.cxx
+++ b/common/rfb/PixelFormat.cxx
@@ -180,7 +180,7 @@ void PixelFormat::read(rdr::InStream* is)
   }
 
   if (!isSane())
-    throw Exception("invalid pixel format");
+    throw ProtocolException("invalid pixel format");
 
   updateState();
 }
diff --git a/common/rfb/RREDecoder.cxx b/common/rfb/RREDecoder.cxx
index 41bf501a..4f2db071 100644
--- a/common/rfb/RREDecoder.cxx
+++ b/common/rfb/RREDecoder.cxx
@@ -107,7 +107,7 @@ void RREDecoder::rreDecode(const Rect& r, rdr::InStream* is,
     int h = is->readU16();
 
     if (((x+w) > r.width()) || ((y+h) > r.height()))
-      throw Exception ("RRE decode error");
+      throw ProtocolException("RRE decode error");
 
     pb->fillRect(pf, Rect(r.tl.x+x, r.tl.y+y, r.tl.x+x+w, r.tl.y+y+h), &pix);
   }
diff --git a/common/rfb/SConnection.cxx b/common/rfb/SConnection.cxx
index cf9dde05..6e58b3b4 100644
--- a/common/rfb/SConnection.cxx
+++ b/common/rfb/SConnection.cxx
@@ -123,7 +123,7 @@ bool SConnection::processVersionMsg()
   if (sscanf(verStr, "RFB %03d.%03d\n",
              &majorVersion, &minorVersion) != 2) {
     state_ = RFBSTATE_INVALID;
-    throw Exception("reading version failed: not an RFB client?");
+    throw ProtocolException("reading version failed: not an RFB client?");
   }
 
   client.setVersion(majorVersion, minorVersion);
@@ -215,7 +215,7 @@ void SConnection::processSecurityType(int secType)
   secTypes = security.GetEnabledSecTypes();
   if (std::find(secTypes.begin(), secTypes.end(),
                 secType) == secTypes.end())
-    throw Exception("Requested security type not available");
+    throw ProtocolException("Requested security type not available");
 
   vlog.info("Client requests security type %s(%d)",
             secTypeName(secType),secType);
@@ -320,7 +320,7 @@ void SConnection::failConnection(const char* message)
   }
 
   state_ = RFBSTATE_INVALID;
-  throw Exception(message);
+  throw ProtocolException(message);
 }
 
 void SConnection::failConnection(const std::string& message)
diff --git a/common/rfb/SMsgReader.cxx b/common/rfb/SMsgReader.cxx
index 5b1b0eaa..ee37370e 100644
--- a/common/rfb/SMsgReader.cxx
+++ b/common/rfb/SMsgReader.cxx
@@ -107,7 +107,7 @@ bool SMsgReader::readMsg()
     break;
   default:
     vlog.error("unknown message type %d", currentMsgType);
-    throw Exception("unknown message type");
+    throw ProtocolException("unknown message type");
   }
 
   if (ret)
@@ -334,7 +334,7 @@ bool SMsgReader::readExtendedClipboard(int32_t len)
     return false;
 
   if (len < 4)
-    throw Exception("Invalid extended clipboard message");
+    throw ProtocolException("Invalid extended clipboard message");
   if (len > maxCutText) {
     vlog.error("Extended clipboard message too long (%d bytes) - ignoring", len);
     is->skip(len);
@@ -356,7 +356,7 @@ bool SMsgReader::readExtendedClipboard(int32_t len)
     }
 
     if (len < (int32_t)(4 + 4*num))
-      throw Exception("Invalid extended clipboard message");
+      throw ProtocolException("Invalid extended clipboard message");
 
     num = 0;
     for (i = 0;i < 16;i++) {
@@ -381,7 +381,7 @@ bool SMsgReader::readExtendedClipboard(int32_t len)
         continue;
 
       if (!zis.hasData(4))
-        throw Exception("Extended clipboard decode error");
+        throw ProtocolException("Extended clipboard decode error");
 
       lengths[num] = zis.readU32();
 
@@ -394,7 +394,7 @@ bool SMsgReader::readExtendedClipboard(int32_t len)
           size_t chunk;
 
           if (!zis.hasData(1))
-            throw Exception("Extended clipboard decode error");
+            throw ProtocolException("Extended clipboard decode error");
 
           chunk = zis.avail();
           if (chunk > lengths[num])
@@ -410,7 +410,7 @@ bool SMsgReader::readExtendedClipboard(int32_t len)
       }
 
       if (!zis.hasData(lengths[num]))
-        throw Exception("Extended clipboard decode error");
+        throw ProtocolException("Extended clipboard decode error");
 
       buffers[num] = new uint8_t[lengths[num]];
       zis.readBytes(buffers[num], lengths[num]);
@@ -440,7 +440,7 @@ bool SMsgReader::readExtendedClipboard(int32_t len)
       handler->handleClipboardNotify(flags);
       break;
     default:
-      throw Exception("Invalid extended clipboard action");
+      throw ProtocolException("Invalid extended clipboard action");
     }
   }
 
@@ -464,7 +464,7 @@ bool SMsgReader::readQEMUMessage()
     ret = readQEMUKeyEvent();
     break;
   default:
-    throw Exception(format("unknown QEMU submessage type %d", subType));
+    throw ProtocolException(format("unknown QEMU submessage type %d", subType));
   }
 
   if (!ret) {
diff --git a/common/rfb/SSecurityRSAAES.cxx b/common/rfb/SSecurityRSAAES.cxx
index 10e901fb..c2fb0f6f 100644
--- a/common/rfb/SSecurityRSAAES.cxx
+++ b/common/rfb/SSecurityRSAAES.cxx
@@ -36,6 +36,7 @@
 #include <nettle/sha2.h>
 #include <nettle/base64.h>
 #include <nettle/asn1.h>
+
 #include <rfb/SSecurityRSAAES.h>
 #include <rfb/SConnection.h>
 #include <rfb/LogWriter.h>
@@ -296,9 +297,9 @@ bool SSecurityRSAAES::readPublicKey()
   is->setRestorePoint();
   clientKeyLength = is->readU32();
   if (clientKeyLength < MinKeyLength)
-    throw Exception("client key is too short");
+    throw ProtocolException("client key is too short");
   if (clientKeyLength > MaxKeyLength)
-    throw Exception("client key is too long");
+    throw ProtocolException("client key is too long");
   size_t size = (clientKeyLength + 7) / 8;
   if (!is->hasDataOrRestore(size * 2))
     return false;
@@ -311,7 +312,7 @@ bool SSecurityRSAAES::readPublicKey()
   nettle_mpz_set_str_256_u(clientKey.n, size, clientKeyN);
   nettle_mpz_set_str_256_u(clientKey.e, size, clientKeyE);
   if (!rsa_public_key_prepare(&clientKey))
-    throw Exception("client key is invalid");
+    throw ProtocolException("client key is invalid");
   return true;
 }
 
@@ -360,7 +361,7 @@ bool SSecurityRSAAES::readRandom()
   is->setRestorePoint();
   size_t size = is->readU16();
   if (size != serverKey.size)
-    throw Exception("server key length doesn't match");
+    throw ProtocolException("server key length doesn't match");
   if (!is->hasDataOrRestore(size))
     return false;
   is->clearRestorePoint();
@@ -373,7 +374,7 @@ bool SSecurityRSAAES::readRandom()
   if (!rsa_decrypt(&serverKey, &randomSize, clientRandom, x) ||
     randomSize != (size_t)keySize / 8) {
     mpz_clear(x);
-    throw Exception("failed to decrypt client random");
+    throw ProtocolException("failed to decrypt client random");
   }
   mpz_clear(x);
   return true;
@@ -502,7 +503,7 @@ bool SSecurityRSAAES::readHash()
     sha256_digest(&ctx, hashSize, realHash);
   }
   if (memcmp(hash, realHash, hashSize) != 0)
-    throw Exception("hash doesn't match");
+    throw ProtocolException("hash doesn't match");
   return true;
 }
 
diff --git a/common/rfb/SSecurityVeNCrypt.cxx b/common/rfb/SSecurityVeNCrypt.cxx
index 164ea927..e4347fb6 100644
--- a/common/rfb/SSecurityVeNCrypt.cxx
+++ b/common/rfb/SSecurityVeNCrypt.cxx
@@ -99,8 +99,8 @@ bool SSecurityVeNCrypt::processMsg()
     case 0x0001: /* 0.1 Legacy VeNCrypt, not supported */
       os->writeU8(0xFF); /* This is not OK */
       os->flush();
-      throw Exception("The client cannot support the server's "
-                       "VeNCrypt version");
+      throw ProtocolException("The client cannot support the server's "
+                              "VeNCrypt version");
 
     case 0x0002: /* 0.2 */
       os->writeU8(0); /* OK */
@@ -109,7 +109,7 @@ bool SSecurityVeNCrypt::processMsg()
     default:
       os->writeU8(0xFF); /* Not OK */
       os->flush();
-      throw Exception("The client returned an unsupported VeNCrypt version");
+      throw ProtocolException("The client returned an unsupported VeNCrypt version");
     }
   }
 
@@ -138,7 +138,7 @@ bool SSecurityVeNCrypt::processMsg()
       os->flush(); 
       haveSentTypes = true;
     } else
-      throw Exception("There are no VeNCrypt sub-types to send to the client");
+      throw ProtocolException("There are no VeNCrypt sub-types to send to the client");
   }
 
   /* get type back from client (must be one of the ones we sent) */
@@ -163,7 +163,7 @@ bool SSecurityVeNCrypt::processMsg()
 
     /* Set up the stack according to the chosen type */
     if (chosenType == secTypeInvalid || chosenType == secTypeVeNCrypt)
-      throw Exception("No valid VeNCrypt sub-type");
+      throw ProtocolException("No valid VeNCrypt sub-type");
 
     ssecurity = security->GetSSecurity(sc, chosenType);
   }
diff --git a/common/rfb/TightDecoder.cxx b/common/rfb/TightDecoder.cxx
index 89d2e839..ff05b279 100644
--- a/common/rfb/TightDecoder.cxx
+++ b/common/rfb/TightDecoder.cxx
@@ -104,14 +104,14 @@ bool TightDecoder::readRect(const Rect& r, rdr::InStream* is,
 
   // Quit on unsupported compression type.
   if (comp_ctl > tightMaxSubencoding)
-    throw Exception("TightDecoder: bad subencoding value received");
+    throw ProtocolException("TightDecoder: bad subencoding value received");
 
   // "Basic" compression type.
 
   int palSize = 0;
 
   if (r.width() > TIGHT_MAX_WIDTH)
-    throw Exception(format("TightDecoder: too large rectangle (%d pixels)", r.width()));
+    throw ProtocolException(format("TightDecoder: too large rectangle (%d pixels)", r.width()));
 
   // Possible palette
   if ((comp_ctl & tightExplicitFilter) != 0) {
@@ -143,12 +143,12 @@ bool TightDecoder::readRect(const Rect& r, rdr::InStream* is,
       break;
     case tightFilterGradient:
       if (server.pf().bpp == 8)
-        throw Exception("TightDecoder: invalid BPP for gradient filter");
+        throw ProtocolException("TightDecoder: invalid BPP for gradient filter");
       break;
     case tightFilterCopy:
       break;
     default:
-      throw Exception("TightDecoder: unknown filter code received");
+      throw ProtocolException("TightDecoder: unknown filter code received");
     }
   }
 
@@ -384,7 +384,7 @@ void TightDecoder::decodeRect(const Rect& r, const uint8_t* buffer,
     netbuf = new uint8_t[dataSize];
 
     if (!zis[streamId].hasData(dataSize))
-      throw Exception("Tight decode error");
+      throw ProtocolException("Tight decode error");
     zis[streamId].readBytes(netbuf, dataSize);
 
     zis[streamId].flushUnderlying();
diff --git a/common/rfb/VNCSConnectionST.cxx b/common/rfb/VNCSConnectionST.cxx
index 9cdf289d..7fa8f626 100644
--- a/common/rfb/VNCSConnectionST.cxx
+++ b/common/rfb/VNCSConnectionST.cxx
@@ -728,7 +728,7 @@ void VNCSConnectionST::enableContinuousUpdates(bool enable,
   Rect rect;
 
   if (!client.supportsFence() || !client.supportsContinuousUpdates())
-    throw Exception("Client tried to enable continuous updates when not allowed");
+    throw ProtocolException("Client tried to enable continuous updates when not allowed");
 
   continuousUpdates = enable;
 
diff --git a/common/rfb/ZRLEDecoder.cxx b/common/rfb/ZRLEDecoder.cxx
index e274a697..eab16baf 100644
--- a/common/rfb/ZRLEDecoder.cxx
+++ b/common/rfb/ZRLEDecoder.cxx
@@ -64,7 +64,7 @@ static inline T readPixel(rdr::ZlibInStream* zis)
 static inline void zlibHasData(rdr::ZlibInStream* zis, size_t length)
 {
   if (!zis->hasData(length))
-    throw Exception("ZRLE decode error");
+    throw ProtocolException("ZRLE decode error");
 }
 
 ZRLEDecoder::ZRLEDecoder() : Decoder(DecoderOrdered)
@@ -242,7 +242,7 @@ void ZRLEDecoder::zrleDecode(const Rect& r, rdr::InStream* is,
             } while (b == 255);
 
             if (end - ptr < len) {
-              throw Exception ("ZRLE decode error");
+              throw ProtocolException("ZRLE decode error");
             }
 
             while (len-- > 0) *ptr++ = pix;
@@ -267,7 +267,7 @@ void ZRLEDecoder::zrleDecode(const Rect& r, rdr::InStream* is,
               } while (b == 255);
 
               if (end - ptr < len) {
-                throw Exception ("ZRLE decode error");
+                throw ProtocolException("ZRLE decode error");
               }
             }