Implement signed API communication to improve security

README.md

@@ -60,6 +60,11 @@ hello-agent.exe --server                       # user session, SYSTEM token
         │       └─ stamps `agent_name` / `agent_version` / `inventory`
         │          into each /api/sysinfo payload (re-uploads when the
         │          inventory collector below transitions empty → ready)
+        │       └─ signs every request with the device's Ed25519 sk
+        │          (same key rendezvous registers via RegisterPk).
+        │          The server's first valid sig flips that peer to
+        │          `managed=1` and unsigned posts get 401 from then on.
+        │          Spec: rustdesk-server/docs/AGENT-API-AUTH.md
         ├── inventory::collect_inventory             (background thread)
         │       └─ PowerShell + WMI + wlanapi + ipify → `INVENTORY` global
         │          consumed by hbbs_http::sync above; one-shot, no retry
@@ -115,6 +120,12 @@ inventory — keep it in sync when adding new patches.
      `--cm` process can plug a `MessageBoxW`-based `InvokeUiCM` into
      upstream's connection-manager IPC loop and inherit file-transfer,
      chat, and clipboard handling rather than re-implementing them.
+   * `mod hbbs_http` → `pub mod hbbs_http` so hello-agent's
+     `unattended_password::try_report` can reach
+     `librustdesk::hbbs_http::sign::build_signed_headers` — without
+     this the in-crate POST can't sign and the build fails with
+     `E0603: module 'hbbs_http' is private`. Tightly coupled to the
+     **Signed agent API** divergence below.
 2. **Build shape** — [`vendor/rustdesk/Cargo.toml`](vendor/rustdesk/Cargo.toml):
    `[lib] crate-type` reduced from `["cdylib", "staticlib", "rlib"]` to
    `["rlib"]`. We statically link the rlib into hello-agent.exe; the
@@ -148,6 +159,44 @@ inventory — keep it in sync when adding new patches.
    [`src/main.rs`](vendor/rustdesk/src/main.rs) (`.author(...)`).
    Cosmetic, but they show through in the Windows EXE metadata and
    in-app error dialogs.
+6. **Signed agent API** — every `POST /api/heartbeat`,
+   `POST /api/sysinfo`, and `POST /api/unattended-password` carries
+   two extra headers (`X-RD-Device-Id`,
+   `X-RD-Signature: v1.<ts>.<base64-ed25519-sig>`) so the server can
+   bind the request to the device's existing rendezvous keypair
+   instead of trusting the `id` + `uuid` body fields. Without this
+   patch, anyone who knows a peer's id and uuid can inject inventory,
+   heartbeats, and unattended-access passwords for it. Three patch
+   sites in the vendor tree (plus one in the hello-agent crate):
+   * New file
+     [`src/hbbs_http/sign.rs`](vendor/rustdesk/src/hbbs_http/sign.rs) —
+     the signer (`build_signed_headers`, `path_from_url`). Reads
+     `Config::get_key_pair()` and `Config::get_id()`; uses the
+     re-exported `hbb_common::sodiumoxide`.
+   * [`src/hbbs_http.rs`](vendor/rustdesk/src/hbbs_http.rs) — adds
+     `pub mod sign;` next to the existing module declarations.
+   * [`src/common.rs`](vendor/rustdesk/src/common.rs) — the
+     `post_request_` and `parse_simple_header` header-string parsers
+     now accept a `\n`-separated list of `Name: Value` lines so we
+     can pass both signing headers in one call. Old single-pair
+     callers parse identically — there's no newline to split on.
+   * [`src/hbbs_http/sync.rs`](vendor/rustdesk/src/hbbs_http/sync.rs)
+     call sites (the sysinfo POST around the sysinfo-version
+     comparison block, and the heartbeat POST a few dozen lines
+     later) — both build a signed-headers string via
+     `crate::hbbs_http::sign::build_signed_headers("POST",
+     &path_from_url(&url), body.as_bytes()).unwrap_or_default()`
+     and pass it to `post_request` instead of `""`.
+
+   And in the hello-agent crate proper (not the vendor tree, no
+   re-sync concern):
+   * [`src/unattended_password.rs`](src/unattended_password.rs) —
+     `try_report` also signs its `POST /api/unattended-password`
+     via `librustdesk::hbbs_http::sign::build_signed_headers`.
+
+   Matching server side: see rustdesk-server's
+   [`docs/AGENT-API-AUTH.md`](https://github.com/cstudio-ch/rustdesk-server/blob/pro-features/docs/AGENT-API-AUTH.md)
+   for the wire format and verification flow.
 
 ## Build