This change allows server admins to specify Diffie-Hellman
parameters for Murmur to use. This is done using the sslDHParams
option in the config file. Diffie-Hellman parameters can also be
set on a per-server basis using the sslDHParams option.
Note: the functionality implemented in this change requires the
QSslDiffieHellmanParameters class in Qt, which has not yet landed
upstream in the Qt 5 'dev' branch. This means that the functionality
discussed in this change will, for now, only work in binaries provided
by the Mumble project, or binaries that are built using our build
environments, and not binaries that link against any released versions
of Qt at present.
This change modifies the default TLS cipher suite string to add
EDH+aRSA+AESGCM, DHE-RSA-AES256-SHA and DHE-RSA-AES128-SHA.
This yields the following ciphers, in TLS/RFC notation:
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_DHE_RSA_WITH_AES_128_CBC_SHA
This change also allows Murmur servers to provide forward secrecy
to older clients, such as our own pre-built binaries before 1.2.9.
It also provides forward secrecy for users that use Mumble 1.2.x
versions on Linux distros, and other Unix-like systems. This is
because Mumble 1.2.x on Unix-like systems builds against Qt 4, which
limits the connection to TLS 1.0.
Before this change, Murmur was not able to negotiate an ephemeral
Diffie-Hellman key exchange for those clients. This is now possible.
Mistakenly checked string for empty instead of null resulting
in a set but empty string not causing the correct error message.
Instead the request to set a password was ignored and the server
started normally. This patch resolves this issue. If the password
is set but empty an error is emitted and the server isn't started.
Fixes#1778
Qt4's moc is not able to expand QT_VERSION_CHECK which may lead
to invalid codegen when used for backwards compatibility work.
Replaced all occurances with explicit check against numeric
version which are treated correctly. Even though bad interactions
might be rare we should no longer use this macro as long as we
want to compile with Qt 4. Also see:
http://lists.qt-project.org/pipermail/interest/2013-August/008351.html
* uninitialized membervars,
* AudioOutput.cpp: fix delete on array to delete[]
* OSS.cpp: close file descriptor in false data case
* OverlayEditorScene.cpp: rm duplicate logic
* fix ifndef to match usage of declared variable
* member var initializations
* check for null (ds in d3d9 as some lines above),
* lower scope of var decl.,
* swap bufsize check and array dereference so check is before! deref,
* initialize member vars in constr.
- don't keep saved uid 0. That's bad as an attacker that manages to
execute code could switch back to uid 0
- set $HOME as Qt doesn't look at passwd information
- initialize supplementary groups
- use "mumble-server" as fallback if no user is specified
