TheLanc3/rustdesk
1
0
Fork 0
mirror of https://github.com/rustdesk/rustdesk.git synced 2026-09-18 02:10:59 +03:00
Code Issues Packages Projects Releases Wiki Activity

temporary password: rotate when a peer is let in, not when it leaves

Browse Source 
The one-time password was regenerated after the connection loop exited,
so a remote desktop session kept it valid for hours and a port-forward
tunnel for as long as its mapping lived. It now rotates the moment a
connection becomes authorized. Reconnects and windows opened from a
live session are unaffected: they log in on the password the session
remembers, for 30 seconds past its last activity.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EZ49AbZJYfm8NTp5yDPMab
This commit is contained in:
rustdesk
2026-09-05 14:20:25 +08:00
parent fd0fe592eb
commit 40da387b16
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/server/connection.rs
View File

@@ -1206,9 +1206,6 @@ impl Connection {
} }
} }
video_service::notify_video_frame_fetched_by_conn_id(id, None); video_service::notify_video_frame_fetched_by_conn_id(id, None);
if conn.authorized {
password::update_temporary_password();
}
if let Err(err) = conn.try_port_forward_loop(&mut rx_from_cm).await { if let Err(err) = conn.try_port_forward_loop(&mut rx_from_cm).await {
conn.on_close(&err.to_string(), false).await; conn.on_close(&err.to_string(), false).await;
raii::AuthedConnID::check_remove_session(conn.inner.id(), conn.session_key()); raii::AuthedConnID::check_remove_session(conn.inner.id(), conn.session_key());
@@ -1876,6 +1873,10 @@ impl Connection {
} }
self.authorized = true; self.authorized = true;
self.unauthorized_id = None; self.unauthorized_id = None;
// One-time means gone once it has let a peer in, not once that peer
// leaves. This session's later logins come in on the password the
// session remembers, so they are not affected.
password::update_temporary_password();
// Releases the budget `check_id_whitelist` charges against this address: only a peer // Releases the budget `check_id_whitelist` charges against this address: only a peer
// that got this far proved more than a self-reported id. // that got this far proved more than a self-reported id.
self.clear_id_whitelist_failures(); self.clear_id_whitelist_failures();