sctg-development/sctgdesk-server sctg-v1.1.16-sctg.2

SCTGDesk server 1.1.16-sctg.2

on GitHub

SCTGDesk server 1.1.16-sctg.2

Fixes for two defects of 1.1.16-sctg.1, found when it was first deployed. Upgrade from 1.1.16-sctg.1 as soon as you can.

SCTGDesk is an independent project, not affiliated with or endorsed by the RustDesk project or Purslane Ltd. Licensed under the AGPL-3.0; the source of this release is this repository at the tag sctg-v1.1.16-sctg.2.

Fixed

• A request with a malformed Authorization: Bearer token stopped the whole server. The API server runs inside hbbs and the release profile aborted on panic, so one unauthenticated request such as Bearer x killed hbbs, rendezvous included. The token is now rejected with 401. This is a remote denial of service: it affects 1.1.16-sctg.1; I did not check whether 1.1.99.x releases are affected.
• --logged-in-only could leave the client on "connecting" forever. The token check called the API server on port 21114 whatever --api-port said, and any failure ended the request without an answer. It now follows --api-port (or API_SERVER when set), gives up after 5 seconds, and answers the client with an explicit error ("The login server is unreachable.").
• The release builds now unwind on panic instead of aborting: a panic in an API handler answers 500 for that request only. A panic in a rendezvous task is contained by the runtime and no longer restarts the service by itself; this case has not been tested.

Tests

New end-to-end tests start the real hbbs and talk to it like the official client (key exchange, punch hole request with a token, malformed tokens). They fail on 1.1.16-sctg.1 and pass here.

Upgrading

Back up db_v2.sqlite3 and your key pair (id_ed25519, id_ed25519.pub) first. No configuration change is needed.

Checked by the maintainer on one deployment: the official RustDesk client 1.5.0 controls a peer through this server, with --logged-in-only, ALWAYS_USE_RELAY=Y and a TLS reverse proxy in front of the API. That server was upgraded from a 1.1.99-47 build with its existing database. Upgrading from 1.1.99.48 has not been tested.

Known limitations

• The valid-token path of --logged-in-only is not covered by the automated tests, only invalid tokens are.
• The unit tests of crates/api-oauth2 do not compile and are excluded from the CI; cargo audit reports advisories that are not triaged yet.
• The notes of 1.1.16-sctg.1 still apply otherwise: no 32-bit ARM binaries, no .deb packages, no client binary in the release.