Due to a regression in Qt 5, we can't use disconnectSocket(true)
to abort a handshake.
Use non-forceful disconnect to work around the Qt 5 bug.
See inline comment for more details.
Fixesmumble-voip/mumble#2334
This allows live certificate/private key reloading
for individual virtual servers.
This makes it possible to integrate Murmur with
an external Let's Encrypt script, without having
to fully restart the virtual server in the process.
This gets rid of the following (harmless, but worrying) error in Murmur's log:
<W>2016-06-04 00:17:39.229 QObject::connect: No such slot MurmurDBus::userTextMessage(const User *, const TextMessage &)
Password login was always allowed for SuperUser. -disablesu
removes SuperUser password. Certificate based authentication
is never allowed for SuperUser. In consequence SuperUser can
authenticate neither with password nor with certificate.
Set new password to allow login for SuperUser again.
Our binaries are timestamped, and we expect them to be deemed
valid by Windows even after the certificate expires. And they
are.
However, our own code explicitly passes WTD_LIFETIME_SIGNING
to the WinTrust APIs, overriding Windows's default of treating
timestamped binaries as valid even after certificate expiry.
(As long as the certificate doesn't have the lifetime signing bit
set!)
From Windows Authenticode Portable Executable Signature Format [1]:
> Timestamp Processing with Lifetime Signing Semantics
>
> Applications or certification authorities that do not want timestamped
> signatures to verify successfully for an indefinite period of time have
> two options:
>
> - Set the lifetime signer OID in the publishers signing certificate.
>
> If the publishers signing certificate contains the lifetime signer
> OID in addition to the PKIX code signing OID, the signature becomes
> invalid when the publishers signing certificate expires, even if
> the signature is timestamped. The lifetime signer OID is defined as
> follows:
>
> szOID_KP_LIFETIME_SIGNING 1.3.6.1.4.1.311.10.3.13
>
> - Set the WTD_LIFETIME_SIGNING_FLAG in the WINTRUST_DATA structure
> when calling WinVerifyTrust.
>
> If a WinVerifyTrust caller sets WTD_LIFETIME_SIGNING_FLAG in the
> WINTRUST_DATA structure and the publishers signing certificate has
> expired, WinVerifyTrust reports the signature as invalid even if the
> signature is timestamped.
>
> If a publisher revokes a code signing certificate that contains the lifetime
> signer OID or a WinVerifyTrust caller sets WTD_LIFETIME_SIGNING_FLAG in the
> WINTRUST_DATA structure, WinVerifyTrust reports the signature as valid if both
> of the following conditions are met:
>
> - The signature was timestamped before the revocation date.
> - The signing certificate is still withinits validity period. After the
> validity period expires, the signature becomes invalid.
[1]: Windows Authenticode Portable Executable Signature Format
Version 1.0 March 21, 2008
http://download.microsoft.com/download/9/c/5/9c5b2167-8017-4bae-9fde-d599bac8184a/Authenticode_PE.docx
Places that use the QString() conversion operator
for Channel and ServerUser sometimes end up using
the QString move constructor, which doesn't take
const strings.
Example of an error:
Messages.cpp:1055:65: error: no viable conversion from 'Channel' to 'QString'
log(uSource, QString("Renamed channel %1 to %2").arg(QString(*c),
Fixes C++11 build on OS X (clang/libc++).
