mirror of
https://github.com/rustdesk/rustdesk.git
synced 2026-05-19 12:09:36 +03:00
Compare commits
7 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
d26100db01 | ||
|
|
0851cf4d38 | ||
|
|
66e39abb74 | ||
|
|
95758b1a47 | ||
|
|
2685a25e51 | ||
|
|
2643f00216 | ||
|
|
e222127009 |
Submodule libs/hbb_common updated: 9043c15acc...c8cbb6be28
@@ -276,21 +276,12 @@ impl PipeWireRecorder {
|
||||
// see: https://gitlab.freedesktop.org/pipewire/pipewire/-/issues/982
|
||||
src.set_property("always-copy", &true)?;
|
||||
|
||||
// COSMIC/Wayland fix: insert videoconvert between pipewiresrc and appsink.
|
||||
// xdg-desktop-portal-cosmic's modifier negotiation fails when the downstream
|
||||
// format set is too narrow (appsink only accepts BGRx/RGBx), producing
|
||||
// "no more output formats" / not-negotiated (-4). videoconvert accepts any
|
||||
// system-memory video/x-raw format, widening negotiation so the portal can
|
||||
// settle on a format it can deliver via its SHM path.
|
||||
let convert = gst::ElementFactory::make("videoconvert", None)?;
|
||||
|
||||
let sink = gst::ElementFactory::make("appsink", None)?;
|
||||
sink.set_property("drop", &true)?;
|
||||
sink.set_property("max-buffers", &1u32)?;
|
||||
|
||||
pipeline.add_many(&[&src, &convert, &sink])?;
|
||||
src.link(&convert)?;
|
||||
convert.link(&sink)?;
|
||||
pipeline.add_many(&[&src, &sink])?;
|
||||
src.link(&sink)?;
|
||||
|
||||
let appsink = sink
|
||||
.dynamic_cast::<AppSink>()
|
||||
|
||||
@@ -199,20 +199,6 @@ pub fn core_main() -> Option<Vec<String>> {
|
||||
}
|
||||
std::thread::spawn(move || crate::start_server(false, no_server));
|
||||
} else {
|
||||
#[cfg(any(target_os = "linux", target_os = "macos"))]
|
||||
// Root CLI management commands must talk to the user `--server` main IPC.
|
||||
// Example: `sudo rustdesk --option custom-rendezvous-server` should query the
|
||||
// user's IPC instead of root's `/tmp/<app>-0/ipc`; `connect()` still limits this
|
||||
// routing to empty-postfix main IPC only.
|
||||
let _user_main_ipc_scope = if crate::platform::is_installed()
|
||||
&& is_root()
|
||||
&& is_user_main_ipc_scope_cli_command(&args)
|
||||
{
|
||||
Some(crate::ipc::UserMainIpcScope::new())
|
||||
} else {
|
||||
None
|
||||
};
|
||||
|
||||
#[cfg(windows)]
|
||||
{
|
||||
use crate::platform;
|
||||
@@ -952,57 +938,6 @@ fn is_root() -> bool {
|
||||
crate::platform::is_root()
|
||||
}
|
||||
|
||||
#[cfg(any(target_os = "linux", target_os = "macos", test))]
|
||||
fn is_user_main_ipc_scope_cli_command(args: &[String]) -> bool {
|
||||
matches!(
|
||||
args.first().map(String::as_str),
|
||||
Some("--password")
|
||||
| Some("--set-unlock-pin")
|
||||
| Some("--get-id")
|
||||
| Some("--set-id")
|
||||
| Some("--config")
|
||||
| Some("--option")
|
||||
| Some("--assign")
|
||||
| Some("--deploy")
|
||||
)
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
fn args(values: &[&str]) -> Vec<String> {
|
||||
values.iter().map(|value| value.to_string()).collect()
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn user_main_ipc_scope_cli_command_matches_management_commands_only() {
|
||||
for command in [
|
||||
"--password",
|
||||
"--set-unlock-pin",
|
||||
"--get-id",
|
||||
"--set-id",
|
||||
"--config",
|
||||
"--option",
|
||||
"--assign",
|
||||
"--deploy",
|
||||
] {
|
||||
assert!(is_user_main_ipc_scope_cli_command(&args(&[command])));
|
||||
}
|
||||
|
||||
for command in [
|
||||
"--service",
|
||||
"--server",
|
||||
"--tray",
|
||||
"--cm",
|
||||
"--check-hwcodec-config",
|
||||
"--connect",
|
||||
] {
|
||||
assert!(!is_user_main_ipc_scope_cli_command(&args(&[command])));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Check if the executable is a Quick Support version.
|
||||
/// Note: This function must be kept in sync with `libs/portable/src/main.rs`.
|
||||
#[cfg(windows)]
|
||||
|
||||
210
src/ipc.rs
210
src/ipc.rs
@@ -33,25 +33,25 @@ use hbb_common::{
|
||||
tokio_util::codec::Framed,
|
||||
ResultType,
|
||||
};
|
||||
#[cfg(any(target_os = "linux", target_os = "macos"))]
|
||||
use ipc_auth::authorize_service_scoped_ipc_connection;
|
||||
#[cfg(windows)]
|
||||
pub(crate) use ipc_auth::authorize_windows_portable_service_ipc_connection;
|
||||
#[cfg(windows)]
|
||||
pub(crate) use ipc_auth::ensure_peer_executable_matches_current_by_pid_opt;
|
||||
#[cfg(windows)]
|
||||
pub(crate) use ipc_auth::log_rejected_windows_ipc_connection;
|
||||
#[cfg(any(target_os = "linux", target_os = "macos"))]
|
||||
use ipc_auth::{active_uid, authorize_service_scoped_ipc_connection};
|
||||
#[cfg(target_os = "linux")]
|
||||
pub(crate) use ipc_auth::{
|
||||
active_uid, ensure_peer_executable_matches_current_by_fd, is_allowed_service_peer_uid,
|
||||
log_rejected_uinput_connection, peer_uid_from_fd,
|
||||
};
|
||||
#[cfg(windows)]
|
||||
use ipc_auth::{
|
||||
authorize_windows_main_ipc_connection, portable_service_listener_security_attributes,
|
||||
should_allow_everyone_create_on_windows,
|
||||
};
|
||||
#[cfg(target_os = "linux")]
|
||||
pub(crate) use ipc_auth::{
|
||||
ensure_peer_executable_matches_current_by_fd, is_allowed_service_peer_uid,
|
||||
log_rejected_uinput_connection, peer_uid_from_fd,
|
||||
};
|
||||
#[cfg(target_os = "linux")]
|
||||
use ipc_fs::terminal_count_candidate_uids;
|
||||
#[cfg(any(target_os = "linux", target_os = "macos"))]
|
||||
use ipc_fs::{
|
||||
@@ -63,8 +63,6 @@ use parity_tokio_ipc::{
|
||||
};
|
||||
use serde_derive::{Deserialize, Serialize};
|
||||
#[cfg(any(target_os = "linux", target_os = "macos"))]
|
||||
use std::cell::Cell;
|
||||
#[cfg(any(target_os = "linux", target_os = "macos"))]
|
||||
use std::os::unix::fs::PermissionsExt;
|
||||
use std::{
|
||||
collections::HashMap,
|
||||
@@ -73,47 +71,12 @@ use std::{
|
||||
|
||||
// IPC actions here.
|
||||
pub const IPC_ACTION_CLOSE: &str = "close";
|
||||
#[cfg(target_os = "windows")]
|
||||
const PORTABLE_SERVICE_IPC_HANDSHAKE_TIMEOUT_MS: u64 = 3_000;
|
||||
#[cfg(target_os = "windows")]
|
||||
pub(crate) const IPC_TOKEN_LEN: usize = 64;
|
||||
#[cfg(target_os = "windows")]
|
||||
const IPC_TOKEN_RANDOM_BYTES: usize = IPC_TOKEN_LEN / 2;
|
||||
#[cfg(target_os = "windows")]
|
||||
const _: () = assert!(IPC_TOKEN_LEN % 2 == 0);
|
||||
pub static EXIT_RECV_CLOSE: AtomicBool = AtomicBool::new(true);
|
||||
|
||||
#[cfg(any(target_os = "linux", target_os = "macos"))]
|
||||
thread_local! {
|
||||
static USE_USER_MAIN_IPC: Cell<bool> = Cell::new(false);
|
||||
}
|
||||
|
||||
#[must_use = "bind this guard to a local variable to keep the IPC scope active"]
|
||||
/// Thread-local guard for routing root main IPC to the active user on Linux/macOS.
|
||||
#[cfg(any(target_os = "linux", target_os = "macos"))]
|
||||
pub(crate) struct UserMainIpcScope {
|
||||
previous: bool,
|
||||
}
|
||||
|
||||
#[cfg(any(target_os = "linux", target_os = "macos"))]
|
||||
impl UserMainIpcScope {
|
||||
pub(crate) fn new() -> Self {
|
||||
let previous = USE_USER_MAIN_IPC.with(|use_user_main| {
|
||||
let previous = use_user_main.get();
|
||||
use_user_main.set(true);
|
||||
previous
|
||||
});
|
||||
Self { previous }
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(any(target_os = "linux", target_os = "macos"))]
|
||||
impl Drop for UserMainIpcScope {
|
||||
fn drop(&mut self) {
|
||||
USE_USER_MAIN_IPC.with(|use_user_main| use_user_main.set(self.previous));
|
||||
}
|
||||
}
|
||||
|
||||
#[inline]
|
||||
pub async fn connect_service(ms_timeout: u64) -> ResultType<ConnectionTmpl<ConnClient>> {
|
||||
connect(ms_timeout, crate::POSTFIX_SERVICE).await
|
||||
@@ -1149,7 +1112,11 @@ async fn handle(data: Data, stream: &mut Connection) {
|
||||
};
|
||||
}
|
||||
|
||||
#[cfg(target_os = "windows")]
|
||||
pub async fn connect(ms_timeout: u64, postfix: &str) -> ResultType<ConnectionTmpl<ConnClient>> {
|
||||
let path = Config::ipc_path(postfix);
|
||||
connect_with_path(ms_timeout, &path).await
|
||||
}
|
||||
|
||||
pub(crate) fn generate_one_time_ipc_token() -> ResultType<String> {
|
||||
use hbb_common::rand::{rngs::OsRng, RngCore as _};
|
||||
use std::fmt::Write as _;
|
||||
@@ -1170,7 +1137,6 @@ pub(crate) fn generate_one_time_ipc_token() -> ResultType<String> {
|
||||
Ok(token)
|
||||
}
|
||||
|
||||
#[cfg(target_os = "windows")]
|
||||
pub(crate) fn constant_time_ipc_token_eq(expected: &str, candidate: &str) -> bool {
|
||||
if expected.len() != IPC_TOKEN_LEN || candidate.len() != IPC_TOKEN_LEN {
|
||||
return false;
|
||||
@@ -1183,7 +1149,6 @@ pub(crate) fn constant_time_ipc_token_eq(expected: &str, candidate: &str) -> boo
|
||||
== 0
|
||||
}
|
||||
|
||||
#[cfg(target_os = "windows")]
|
||||
pub(crate) async fn portable_service_ipc_handshake_as_client<T>(
|
||||
stream: &mut ConnectionTmpl<T>,
|
||||
token: &str,
|
||||
@@ -1208,7 +1173,6 @@ where
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(target_os = "windows")]
|
||||
pub(crate) async fn portable_service_ipc_handshake_as_server<T, F>(
|
||||
stream: &mut ConnectionTmpl<T>,
|
||||
mut validate_token: F,
|
||||
@@ -1245,103 +1209,6 @@ async fn connect_with_path(ms_timeout: u64, path: &str) -> ResultType<Connection
|
||||
Ok(ConnectionTmpl::new(client))
|
||||
}
|
||||
|
||||
#[cfg(any(target_os = "linux", target_os = "macos"))]
|
||||
#[inline]
|
||||
fn select_server_uid_for_user_main_ipc(
|
||||
server_uids: &[u32],
|
||||
active_uid: Option<u32>,
|
||||
prefer_root: bool,
|
||||
) -> ResultType<u32> {
|
||||
let mut server_uids = server_uids.to_vec();
|
||||
server_uids.sort_unstable();
|
||||
server_uids.dedup();
|
||||
|
||||
match server_uids.as_slice() {
|
||||
[] => {
|
||||
if let Some(uid) = active_uid {
|
||||
// If no `--server` processes are found but the active user is identifiable,
|
||||
// try the active user anyway because the main process may also listen on "" IPC.
|
||||
return Ok(uid);
|
||||
} else {
|
||||
bail!("No --server process found for user main IPC")
|
||||
}
|
||||
}
|
||||
[uid] => return Ok(*uid),
|
||||
_ => {}
|
||||
}
|
||||
|
||||
if prefer_root && server_uids.contains(&0) {
|
||||
return Ok(0);
|
||||
}
|
||||
if let Some(active_uid) = active_uid.filter(|uid| server_uids.contains(uid)) {
|
||||
return Ok(active_uid);
|
||||
}
|
||||
bail!("Multiple --server processes found for user main IPC");
|
||||
}
|
||||
|
||||
#[cfg(any(target_os = "linux", target_os = "macos"))]
|
||||
fn running_server_uids_for_current_exe() -> ResultType<Vec<u32>> {
|
||||
let current_exe = std::env::current_exe()?;
|
||||
let current_exe_path = std::fs::canonicalize(¤t_exe)?;
|
||||
let current_pid = hbb_common::sysinfo::Pid::from_u32(std::process::id());
|
||||
let mut sys = hbb_common::sysinfo::System::new();
|
||||
sys.refresh_processes();
|
||||
let mut server_uids = Vec::new();
|
||||
for process in sys.processes().values() {
|
||||
if process.pid() == current_pid {
|
||||
continue;
|
||||
}
|
||||
if process.cmd().get(1).map_or(true, |arg| arg != "--server") {
|
||||
continue;
|
||||
}
|
||||
let Ok(process_path) = std::fs::canonicalize(process.exe()) else {
|
||||
continue;
|
||||
};
|
||||
if process_path != current_exe_path {
|
||||
continue;
|
||||
}
|
||||
let Some(uid) = process.user_id().map(|uid| **uid as u32) else {
|
||||
// Root CLI management commands need a stable matching `--server` target.
|
||||
// If this key process races during enumeration, failing the command is clearer
|
||||
// than silently skipping it; `--server` is not expected to exit frequently.
|
||||
bail!("Failed to read --server process uid");
|
||||
};
|
||||
server_uids.push(uid);
|
||||
}
|
||||
Ok(server_uids)
|
||||
}
|
||||
|
||||
#[cfg(any(target_os = "linux", target_os = "macos"))]
|
||||
fn user_main_ipc_server_uid() -> ResultType<u32> {
|
||||
let server_uids = running_server_uids_for_current_exe()?;
|
||||
#[cfg(target_os = "linux")]
|
||||
let prefer_root = crate::platform::linux::is_login_screen_wayland();
|
||||
#[cfg(target_os = "macos")]
|
||||
let prefer_root = false;
|
||||
select_server_uid_for_user_main_ipc(&server_uids, active_uid(), prefer_root)
|
||||
}
|
||||
|
||||
pub async fn connect(ms_timeout: u64, postfix: &str) -> ResultType<ConnectionTmpl<ConnClient>> {
|
||||
#[cfg(any(target_os = "linux", target_os = "macos"))]
|
||||
{
|
||||
let use_user_main_ipc = USE_USER_MAIN_IPC.with(|use_user_main| use_user_main.get());
|
||||
let is_root_main_ipc =
|
||||
unsafe { hbb_common::libc::geteuid() == 0 } && postfix.is_empty() && use_user_main_ipc;
|
||||
if is_root_main_ipc {
|
||||
let uid = user_main_ipc_server_uid()?;
|
||||
let path = Config::ipc_path_for_uid(uid, postfix);
|
||||
return connect_with_path(ms_timeout, &path).await;
|
||||
}
|
||||
let path = Config::ipc_path(postfix);
|
||||
return connect_with_path(ms_timeout, &path).await;
|
||||
}
|
||||
#[cfg(not(any(target_os = "linux", target_os = "macos")))]
|
||||
{
|
||||
let path = Config::ipc_path(postfix);
|
||||
connect_with_path(ms_timeout, &path).await
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(target_os = "linux")]
|
||||
pub async fn connect_for_uid(
|
||||
ms_timeout: u64,
|
||||
@@ -2135,16 +2002,7 @@ mod test {
|
||||
assert!(std::mem::size_of::<Data>() <= 120);
|
||||
}
|
||||
|
||||
#[cfg(any(target_os = "linux", target_os = "macos"))]
|
||||
#[test]
|
||||
fn test_service_ipc_path_is_shared_across_uids() {
|
||||
assert_eq!(
|
||||
Config::ipc_path_for_uid(0, crate::POSTFIX_SERVICE),
|
||||
Config::ipc_path_for_uid(501, crate::POSTFIX_SERVICE)
|
||||
);
|
||||
}
|
||||
|
||||
#[cfg(any(target_os = "linux", target_os = "macos"))]
|
||||
#[cfg(target_os = "linux")]
|
||||
#[test]
|
||||
fn test_ipc_path_differs_by_uid_for_cm() {
|
||||
let effective_uid = unsafe { hbb_common::libc::geteuid() as u32 };
|
||||
@@ -2163,46 +2021,4 @@ mod test {
|
||||
Config::ipc_path_for_uid(other_uid, postfix)
|
||||
);
|
||||
}
|
||||
|
||||
#[cfg(any(target_os = "linux", target_os = "macos"))]
|
||||
#[test]
|
||||
fn test_select_server_uid_uses_active_uid_when_no_server_found() {
|
||||
assert_eq!(
|
||||
select_server_uid_for_user_main_ipc(&[], Some(501), false).unwrap(),
|
||||
501
|
||||
);
|
||||
}
|
||||
|
||||
#[cfg(any(target_os = "linux", target_os = "macos"))]
|
||||
#[test]
|
||||
fn test_select_server_uid_uses_single_server_uid() {
|
||||
assert_eq!(
|
||||
select_server_uid_for_user_main_ipc(&[501], None, false).unwrap(),
|
||||
501
|
||||
);
|
||||
}
|
||||
|
||||
#[cfg(any(target_os = "linux", target_os = "macos"))]
|
||||
#[test]
|
||||
fn test_select_server_uid_prefers_active_uid_with_multiple_servers() {
|
||||
assert_eq!(
|
||||
select_server_uid_for_user_main_ipc(&[0, 501], Some(501), false).unwrap(),
|
||||
501
|
||||
);
|
||||
}
|
||||
|
||||
#[cfg(any(target_os = "linux", target_os = "macos"))]
|
||||
#[test]
|
||||
fn test_select_server_uid_prefers_root_on_wayland_login_screen() {
|
||||
assert_eq!(
|
||||
select_server_uid_for_user_main_ipc(&[0, 501], Some(501), true).unwrap(),
|
||||
0
|
||||
);
|
||||
}
|
||||
|
||||
#[cfg(any(target_os = "linux", target_os = "macos"))]
|
||||
#[test]
|
||||
fn test_select_server_uid_fails_when_multiple_servers_are_ambiguous() {
|
||||
assert!(select_server_uid_for_user_main_ipc(&[501, 502], None, false).is_err());
|
||||
}
|
||||
}
|
||||
|
||||
@@ -607,30 +607,27 @@ pub(crate) fn log_rejected_windows_ipc_connection(
|
||||
peer_session_id: Option<u32>,
|
||||
expected_session_id: Option<u32>,
|
||||
peer_is_system: Option<bool>,
|
||||
peer_is_elevated: Option<bool>,
|
||||
) {
|
||||
static LOG_THROTTLE: OnceLock<Mutex<UnauthorizedIpcLogThrottle>> = OnceLock::new();
|
||||
throttled_unauthorized_ipc_log(&LOG_THROTTLE, |suppressed| {
|
||||
if suppressed > 0 {
|
||||
log::warn!(
|
||||
"Rejected unauthorized connection on ipc channel: postfix={}, peer_pid={:?}, peer_session_id={:?}, expected_session_id={:?}, peer_is_system={:?}, peer_is_elevated={:?} (suppressed {} similar events)",
|
||||
"Rejected unauthorized connection on ipc channel: postfix={}, peer_pid={:?}, peer_session_id={:?}, expected_session_id={:?}, peer_is_system={:?} (suppressed {} similar events)",
|
||||
postfix,
|
||||
peer_pid,
|
||||
peer_session_id,
|
||||
expected_session_id,
|
||||
peer_is_system,
|
||||
peer_is_elevated,
|
||||
suppressed
|
||||
);
|
||||
} else {
|
||||
log::warn!(
|
||||
"Rejected unauthorized connection on ipc channel: postfix={}, peer_pid={:?}, peer_session_id={:?}, expected_session_id={:?}, peer_is_system={:?}, peer_is_elevated={:?}",
|
||||
"Rejected unauthorized connection on ipc channel: postfix={}, peer_pid={:?}, peer_session_id={:?}, expected_session_id={:?}, peer_is_system={:?}",
|
||||
postfix,
|
||||
peer_pid,
|
||||
peer_session_id,
|
||||
expected_session_id,
|
||||
peer_is_system,
|
||||
peer_is_elevated
|
||||
peer_is_system
|
||||
);
|
||||
}
|
||||
});
|
||||
@@ -658,14 +655,8 @@ pub(crate) fn authorize_service_scoped_ipc_connection(stream: &Connection, postf
|
||||
|
||||
#[cfg(windows)]
|
||||
pub(crate) fn authorize_windows_main_ipc_connection(stream: &Connection, postfix: &str) -> bool {
|
||||
let (
|
||||
authorized,
|
||||
peer_pid,
|
||||
peer_session_id,
|
||||
server_session_id,
|
||||
peer_is_system,
|
||||
peer_is_elevated,
|
||||
) = stream.server_authorization_status();
|
||||
let (authorized, peer_pid, peer_session_id, server_session_id, peer_is_system) =
|
||||
stream.server_authorization_status();
|
||||
if !authorized {
|
||||
log_rejected_windows_ipc_connection(
|
||||
postfix,
|
||||
@@ -673,7 +664,6 @@ pub(crate) fn authorize_windows_main_ipc_connection(stream: &Connection, postfix
|
||||
peer_session_id,
|
||||
server_session_id,
|
||||
peer_is_system,
|
||||
peer_is_elevated,
|
||||
);
|
||||
return false;
|
||||
}
|
||||
@@ -786,14 +776,7 @@ impl ConnectionTmpl<parity_tokio_ipc::Connection> {
|
||||
|
||||
fn server_authorization_status(
|
||||
&self,
|
||||
) -> (
|
||||
bool,
|
||||
Option<u32>,
|
||||
Option<u32>,
|
||||
Option<u32>,
|
||||
Option<bool>,
|
||||
Option<bool>,
|
||||
) {
|
||||
) -> (bool, Option<u32>, Option<u32>, Option<u32>, Option<bool>) {
|
||||
let peer_pid = self.peer_pid();
|
||||
let server_session_id = crate::platform::windows::get_current_process_session_id();
|
||||
let peer_session_id =
|
||||
@@ -803,34 +786,20 @@ impl ConnectionTmpl<parity_tokio_ipc::Connection> {
|
||||
let peer_is_system = peer_is_system_result
|
||||
.as_ref()
|
||||
.and_then(|r| r.as_ref().ok().copied());
|
||||
let session_authorized = is_allowed_windows_session_scoped_peer(
|
||||
peer_is_system.unwrap_or(false),
|
||||
peer_session_id,
|
||||
server_session_id,
|
||||
);
|
||||
let peer_is_elevated_result = if session_authorized {
|
||||
None
|
||||
} else {
|
||||
peer_pid.map(|pid| crate::platform::windows::is_elevated(Some(pid)))
|
||||
};
|
||||
let peer_is_elevated = peer_is_elevated_result
|
||||
.as_ref()
|
||||
.and_then(|r| r.as_ref().ok().copied());
|
||||
if server_session_id.is_none()
|
||||
&& !peer_is_system.unwrap_or(false)
|
||||
&& !peer_is_elevated.unwrap_or(false)
|
||||
{
|
||||
if server_session_id.is_none() && !peer_is_system.unwrap_or(false) {
|
||||
// When the server session id cannot be determined, the session-id allow-path is
|
||||
// disabled and only privileged peers can be authorized.
|
||||
// disabled and only SYSTEM peers can be authorized.
|
||||
log::debug!(
|
||||
"IPC authorization: server session id unavailable; rejecting non-privileged peer, peer_pid={:?}, peer_session_id={:?}",
|
||||
"IPC authorization: server session id unavailable; rejecting non-SYSTEM peer, peer_pid={:?}, peer_session_id={:?}",
|
||||
peer_pid,
|
||||
peer_session_id
|
||||
);
|
||||
}
|
||||
// Main IPC trusts same-session peers, LocalSystem, and elevated administrators.
|
||||
// Service-scoped IPC channels keep their own stricter authorization paths.
|
||||
let authorized = session_authorized || peer_is_elevated.unwrap_or(false);
|
||||
let authorized = is_allowed_windows_session_scoped_peer(
|
||||
peer_is_system.unwrap_or(false),
|
||||
peer_session_id,
|
||||
server_session_id,
|
||||
);
|
||||
if !authorized {
|
||||
if let (Some(pid), Some(Err(err))) = (peer_pid, peer_is_system_result.as_ref()) {
|
||||
log::debug!(
|
||||
@@ -839,13 +808,6 @@ impl ConnectionTmpl<parity_tokio_ipc::Connection> {
|
||||
err
|
||||
);
|
||||
}
|
||||
if let (Some(pid), Some(Err(err))) = (peer_pid, peer_is_elevated_result.as_ref()) {
|
||||
log::debug!(
|
||||
"Failed to determine whether peer process is elevated, pid={}, err={}",
|
||||
pid,
|
||||
err
|
||||
);
|
||||
}
|
||||
}
|
||||
(
|
||||
authorized,
|
||||
@@ -853,7 +815,6 @@ impl ConnectionTmpl<parity_tokio_ipc::Connection> {
|
||||
peer_session_id,
|
||||
server_session_id,
|
||||
peer_is_system,
|
||||
peer_is_elevated,
|
||||
)
|
||||
}
|
||||
|
||||
|
||||
@@ -208,7 +208,7 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
|
||||
("Closed manually by the peer", "Cerrado manualmente por el par"),
|
||||
("Enable remote configuration modification", "Habilitar modificación remota de configuración"),
|
||||
("Run without install", "Ejecutar sin instalar"),
|
||||
("Connect via relay", "Conectar a través de relay"),
|
||||
("Connect via relay", ""),
|
||||
("Always connect via relay", "Conéctese siempre a través de relay"),
|
||||
("whitelist_tip", "Solo las direcciones IP autorizadas pueden conectarse a este escritorio"),
|
||||
("Login", "Iniciar sesión"),
|
||||
@@ -228,7 +228,7 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
|
||||
("Username missed", "Olvidó su nombre de usuario"),
|
||||
("Password missed", "Olvidó su contraseña"),
|
||||
("Wrong credentials", "Credenciales incorrectas"),
|
||||
("The verification code is incorrect or has expired", "El código de verificación es incorrecto o ha caducado"),
|
||||
("The verification code is incorrect or has expired", ""),
|
||||
("Edit Tag", "Editar tag"),
|
||||
("Forget Password", "Olvidar contraseña"),
|
||||
("Favorites", "Favoritos"),
|
||||
@@ -302,8 +302,8 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
|
||||
("Keep RustDesk background service", "Dejar RustDesk como Servicio en 2do plano"),
|
||||
("Ignore Battery Optimizations", "Ignorar optimizacioens de bateria"),
|
||||
("android_open_battery_optimizations_tip", "Si deseas deshabilitar esta característica, por favor, ve a la página siguiente de ajustes, busca y entra en [Batería] y desmarca [Sin restricción]"),
|
||||
("Start on boot", "Iniciar al arrancar"),
|
||||
("Start the screen sharing service on boot, requires special permissions", "Iniciar el servicio de pantalla compartida al arrancar, requiere permisos especiales"),
|
||||
("Start on boot", ""),
|
||||
("Start the screen sharing service on boot, requires special permissions", ""),
|
||||
("Connection not allowed", "Conexión no disponible"),
|
||||
("Legacy mode", "Modo heredado"),
|
||||
("Map mode", "Modo mapa"),
|
||||
@@ -326,8 +326,8 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
|
||||
("Ratio", "Relación"),
|
||||
("Image Quality", "Calidad de imagen"),
|
||||
("Scroll Style", "Estilo de desplazamiento"),
|
||||
("Show Toolbar", "Mostrar herramientas"),
|
||||
("Hide Toolbar", "Ocultar herramientas"),
|
||||
("Show Toolbar", ""),
|
||||
("Hide Toolbar", ""),
|
||||
("Direct Connection", "Conexión directa"),
|
||||
("Relay Connection", "Conexión Relay"),
|
||||
("Secure Connection", "Conexión segura"),
|
||||
@@ -338,7 +338,7 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
|
||||
("Security", "Seguridad"),
|
||||
("Theme", "Tema"),
|
||||
("Dark Theme", "Tema Oscuro"),
|
||||
("Light Theme", "Tema claro"),
|
||||
("Light Theme", ""),
|
||||
("Dark", "Oscuro"),
|
||||
("Light", "Claro"),
|
||||
("Follow System", "Tema del sistema"),
|
||||
@@ -355,12 +355,12 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
|
||||
("Audio Input Device", "Dispositivo de entrada de audio"),
|
||||
("Use IP Whitelisting", "Usar lista de IPs admitidas"),
|
||||
("Network", "Red"),
|
||||
("Pin Toolbar", "Anclar herramientas"),
|
||||
("Unpin Toolbar", "Desanclar herramientas"),
|
||||
("Pin Toolbar", ""),
|
||||
("Unpin Toolbar", ""),
|
||||
("Recording", "Grabando"),
|
||||
("Directory", "Directorio"),
|
||||
("Automatically record incoming sessions", "Grabación automática de sesiones entrantes"),
|
||||
("Automatically record outgoing sessions", "Grabación automática de sesiones salientes"),
|
||||
("Automatically record outgoing sessions", ""),
|
||||
("Change", "Cambiar"),
|
||||
("Start session recording", "Comenzar grabación de sesión"),
|
||||
("Stop session recording", "Detener grabación de sesión"),
|
||||
@@ -368,7 +368,7 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
|
||||
("Enable LAN discovery", "Habilitar descubrimiento de LAN"),
|
||||
("Deny LAN discovery", "Denegar descubrimiento de LAN"),
|
||||
("Write a message", "Escribir un mensaje"),
|
||||
("Prompt", "Solicitud"),
|
||||
("Prompt", ""),
|
||||
("Please wait for confirmation of UAC...", "Por favor, espera confirmación de UAC"),
|
||||
("elevated_foreground_window_tip", "La ventana actual del escritorio remoto necesita privilegios elevados para funcionar, así que no puedes usar ratón y teclado temporalmente. Puedes solicitar al usuario remoto que minimize la ventana actual o hacer clic en el botón de elevación de la ventana de gestión de conexión. Para evitar este problema, se recomienda instalar el programa en el dispositivo remto."),
|
||||
("Disconnected", "Desconectado"),
|
||||
@@ -616,9 +616,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
|
||||
("During service is on", "Mientras el servicio está activo"),
|
||||
("Capture screen using DirectX", "Capturar pantalla con DirectX"),
|
||||
("Back", "Atrás"),
|
||||
("Apps", "Aplicaciones"),
|
||||
("Volume up", "Subir volumen"),
|
||||
("Volume down", "Bajar volumen"),
|
||||
("Apps", ""),
|
||||
("Volume up", "Bajar volumen"),
|
||||
("Volume down", "Subir volumen"),
|
||||
("Power", "Encendido"),
|
||||
("Telegram bot", "Bot de Telegram"),
|
||||
("enable-bot-tip", "Si activas esta característica puedes recibir código 2FA de tu bot. También puede funcionar como notificación de conexión."),
|
||||
@@ -651,7 +651,7 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
|
||||
("Update client clipboard", "Actualizar portapapeles del cliente"),
|
||||
("Untagged", "Sin itiquetar"),
|
||||
("new-version-of-{}-tip", "Hay una nueva versión de {} disponible"),
|
||||
("Accessible devices", "Dispositivos accesibles"),
|
||||
("Accessible devices", ""),
|
||||
("upgrade_remote_rustdesk_client_to_{}_tip", "Por favor, actualiza el cliente RustDesk a la versión {} o superior en el lado remoto"),
|
||||
("d3d_render_tip", "Al activar el renderizado D3D, la pantalla de control remoto puede verse negra en algunos equipos."),
|
||||
("Use D3D rendering", "Usar renderizado D3D"),
|
||||
@@ -689,9 +689,9 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
|
||||
("Use WebSocket", "Usar WebSocket"),
|
||||
("Trackpad speed", "Velocidad de trackpad"),
|
||||
("Default trackpad speed", "Velocidad predeterminada de trackpad"),
|
||||
("Numeric one-time password", "Contraseña numérica de un solo uso"),
|
||||
("Enable IPv6 P2P connection", "Habilitar conexión IPv6 P2P"),
|
||||
("Enable UDP hole punching", "Habilitar perforación de agujero UDP"),
|
||||
("Numeric one-time password", ""),
|
||||
("Enable IPv6 P2P connection", ""),
|
||||
("Enable UDP hole punching", ""),
|
||||
("View camera", "Ver cámara"),
|
||||
("Enable camera", "Habilitar cámara"),
|
||||
("No cameras", "No hay cámaras"),
|
||||
@@ -708,8 +708,8 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
|
||||
("Failed to check if the user is an administrator.", "No se ha podido comprobar si el usuario es un administrador."),
|
||||
("Supported only in the installed version.", "Soportado solo en la versión instalada."),
|
||||
("elevation_username_tip", "Introduzca el nombre de usuario o dominio\\NombreDeUsuario"),
|
||||
("Preparing for installation ...", "Preparando instlación..."),
|
||||
("Show my cursor", "Mostrar mi cursor"),
|
||||
("Preparing for installation ...", ""),
|
||||
("Show my cursor", ""),
|
||||
("Scale custom", "Escala personalizada"),
|
||||
("Custom scale slider", "Control deslizante de escala personalizada"),
|
||||
("Decrease", "Disminuir"),
|
||||
@@ -721,28 +721,28 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
|
||||
("Show virtual joystick", "Mostrar joystick virtual"),
|
||||
("Edit note", "Editar nota"),
|
||||
("Alias", ""),
|
||||
("ScrollEdge", "Desplazamiento de pantalla"),
|
||||
("Allow insecure TLS fallback", "Permitir conexión TLS insegura de respaldo"),
|
||||
("allow-insecure-tls-fallback-tip", "De forma predeterminada, RustDesk verifica el certificado de servidor para protocolos que usen TLS.\nCon esta opción habilitada, Rustdesk volverá al paso de omisión de verificación y procederá en caso de fallo de verificación."),
|
||||
("Disable UDP", "Inhabilitar UDP"),
|
||||
("disable-udp-tip", "Controla si se usa TCP solamente.\nCuando esta opción está activa, RustDesk no usará más el puerto UDP 21116, en su lugar se usará el TCP 21116."),
|
||||
("server-oss-not-support-tip", "NOTA: El servidor RustDesk OSS no incluye esta característica."),
|
||||
("input note here", "Introducir nota aquí"),
|
||||
("note-at-conn-end-tip", "Pedir nota al finalizar la conexión"),
|
||||
("Show terminal extra keys", "Mostrar teclas extra del terminal"),
|
||||
("Relative mouse mode", "Modo de ratón relativo"),
|
||||
("rel-mouse-not-supported-peer-tip", "El modo relativo de ratón no está soportado por el par."),
|
||||
("rel-mouse-not-ready-tip", "El modo relativo de ratón aún no está preparado. Por favor, inténtalo de nuevo."),
|
||||
("rel-mouse-lock-failed-tip", "Ha fallado el bloqueo del cursor. El modo relativo del ratón ha sido inhabilitado."),
|
||||
("rel-mouse-exit-{}-tip", "Pulsa {} para salir."),
|
||||
("rel-mouse-permission-lost-tip", "Permiso de teclado revocado. El modo relativo del ratón ha sido inhabilitado."),
|
||||
("Changelog", "Registro de cambios"),
|
||||
("keep-awake-during-outgoing-sessions-label", "Mantener la pantalla activa durante sesiones salientes"),
|
||||
("keep-awake-during-incoming-sessions-label", "Mantener la pantalla activa durante sesiones entrantes"),
|
||||
("ScrollEdge", ""),
|
||||
("Allow insecure TLS fallback", ""),
|
||||
("allow-insecure-tls-fallback-tip", ""),
|
||||
("Disable UDP", ""),
|
||||
("disable-udp-tip", ""),
|
||||
("server-oss-not-support-tip", ""),
|
||||
("input note here", ""),
|
||||
("note-at-conn-end-tip", ""),
|
||||
("Show terminal extra keys", ""),
|
||||
("Relative mouse mode", ""),
|
||||
("rel-mouse-not-supported-peer-tip", ""),
|
||||
("rel-mouse-not-ready-tip", ""),
|
||||
("rel-mouse-lock-failed-tip", ""),
|
||||
("rel-mouse-exit-{}-tip", ""),
|
||||
("rel-mouse-permission-lost-tip", ""),
|
||||
("Changelog", ""),
|
||||
("keep-awake-during-outgoing-sessions-label", ""),
|
||||
("keep-awake-during-incoming-sessions-label", ""),
|
||||
("Continue with {}", "Continuar con {}"),
|
||||
("Display Name", "Nombre de pantalla"),
|
||||
("password-hidden-tip", "La contraseña permanente está ajustada a (oculta)."),
|
||||
("preset-password-in-use-tip", "Se está usando la contraseña predeterminada."),
|
||||
("Enable privacy mode", "Habilitar modo privado"),
|
||||
("Display Name", ""),
|
||||
("password-hidden-tip", ""),
|
||||
("preset-password-in-use-tip", ""),
|
||||
("Enable privacy mode", ""),
|
||||
].iter().cloned().collect();
|
||||
}
|
||||
|
||||
@@ -743,6 +743,6 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
|
||||
("Display Name", "Naam Weergeven"),
|
||||
("password-hidden-tip", "Er is een permanent wachtwoord ingesteld (verborgen)."),
|
||||
("preset-password-in-use-tip", "Het basis wachtwoord is momenteel in gebruik."),
|
||||
("Enable privacy mode", "Privacymodus inschakelen"),
|
||||
("Enable privacy mode", "Schakel privacymodus in"),
|
||||
].iter().cloned().collect();
|
||||
}
|
||||
|
||||
@@ -614,7 +614,6 @@ fn authorize_service_scoped_ipc_connection(
|
||||
peer_session_id,
|
||||
expected_active_session_id,
|
||||
peer_is_system,
|
||||
None,
|
||||
);
|
||||
return false;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user