f8ead215d8
build-windows / build-hello-agent-x64 (push) Successful in 5m41s
A single-binary, Flutter-free remote-support agent that speaks the stock
RustDesk wire protocol. Designed for one-line MDM deployment against a
self-hosted rustdesk-server: a supporter using the unmodified rustdesk.exe
client connects, the controlled-side user gets a native Win32 approval
prompt, click Yes / No.
CLI surface
hello-agent.exe --install # register + start service
hello-agent.exe --uninstall # stop, delete, clean up
hello-agent.exe --config <BLOB> # admin-UI deploy string
hello-agent.exe --install --config <BLOB> # MDM one-liner
--config accepts both forms emitted by the rustdesk-server admin UI: the
reversed-base64 deploy string and the host=,key=,api=,relay= filename
form. Decoded via the upstream custom_server module, persisted via
hbb_common::config::Config::set_option.
Architecture
--service runs as a Session 0 LocalSystem service. It polls
WTSGetActiveConsoleSessionId and (re)spawns hello-agent.exe --server
into the active console session via librustdesk::platform::run_as_user,
handling the Session 0 → user-session token impersonation.
--server is the worker. It boots three concurrent components:
1. cm_popup: an IPC listener on the rustdesk `_cm` named pipe
2. librustdesk::start_server(true, false): the upstream protocol
stack — rendezvous mediator, NAT punch, IPC server, screen
capture, login validation, hbbs_http heartbeat / sysinfo sync
3. (implicit) ApproveMode::Click is pinned in config, so every
incoming connection routes through cm_popup
The popup mechanism reuses an existing upstream contract without any
patches to the protocol code: when a peer connects with no password,
Connection::start in the upstream code calls try_start_cm_ipc, which
ipc::connect-s the `_cm` pipe before falling back to spawning a Flutter
CM child. Since cm_popup is up first, step 1 succeeds; we read the
Data::Login{authorized:false} frame, show MessageBoxTimeoutW (Yes/No,
60s, top-most, system-modal), and reply Data::Authorize or Data::Close.
Source tree
src/main.rs CLI dispatcher + run_server() composition
src/cli.rs hand-rolled argv parser + unit tests
src/service.rs windows-service install/uninstall/dispatcher
src/config_import.rs --config blob decoding + persistence
src/cm_popup.rs _cm IPC listener + Win32 approval dialog
Vendoring
The upstream RustDesk crate is vendored under vendor/rustdesk/ — full
workspace including libs/{hbb_common, scrap, enigo, clipboard,
virtual_display, remote_printer}. This makes the build self-contained
(no submodules, no sibling-repo checkout in CI) and gives us freedom to
fork in a different direction later. Excluded from the vendor: .git,
target/, flutter/, appimage/, flatpak/, fastlane/, docs/, examples/,
ci/, build.py, Dockerfile, upstream README/CLAUDE/AGENTS/GEMINI.
One local divergence vs. upstream: vendor/rustdesk/src/lib.rs flips
`mod custom_server` → `pub mod custom_server` so config_import.rs can
call get_custom_server_from_string without going through the
ui_interface shim. Documented in README.md → "Re-syncing the vendored
copy".
CI
.gitea/workflows/build-windows.yml builds on a self-hosted Windows
runner with Rust 1.75, LLVM 15.0.6 (libclang for bindgen via libvpx-sys),
and a vcpkg cache. The vendored vcpkg.json drives x64-windows-static
deps. The workflow stages the resulting hello-agent.exe into
SignOutput\, reports authenticode signing status (warns on unsigned),
and uploads as artifact. ~15 min full build, faster on incremental.
Out of scope for this commit: Linux/macOS builds, code signing, MSI
packaging, coexistence with stock rustdesk on the same box (currently
shares the RustDesk APP_NAME and config dir).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
200 lines
5.8 KiB
Rust
200 lines
5.8 KiB
Rust
use crate::client::*;
|
|
use async_trait::async_trait;
|
|
use hbb_common::{
|
|
config::PeerConfig,
|
|
config::READ_TIMEOUT,
|
|
futures::{SinkExt, StreamExt},
|
|
log,
|
|
message_proto::*,
|
|
protobuf::Message as _,
|
|
rendezvous_proto::ConnType,
|
|
tokio::{self, sync::mpsc},
|
|
Stream,
|
|
};
|
|
use std::sync::{Arc, RwLock};
|
|
|
|
#[derive(Clone)]
|
|
pub struct Session {
|
|
id: String,
|
|
lc: Arc<RwLock<LoginConfigHandler>>,
|
|
sender: mpsc::UnboundedSender<Data>,
|
|
password: String,
|
|
}
|
|
|
|
impl Session {
|
|
pub fn new(id: &str, sender: mpsc::UnboundedSender<Data>) -> Self {
|
|
let mut password = "".to_owned();
|
|
if PeerConfig::load(id).password.is_empty() {
|
|
match rpassword::prompt_password("Enter password: ") {
|
|
Ok(p) => password = p,
|
|
Err(e) => {
|
|
log::error!("Failed to read password: {:?}", e);
|
|
password = "".to_owned();
|
|
}
|
|
}
|
|
}
|
|
let session = Self {
|
|
id: id.to_owned(),
|
|
sender,
|
|
password,
|
|
lc: Default::default(),
|
|
};
|
|
session.lc.write().unwrap().initialize(
|
|
id.to_owned(),
|
|
ConnType::PORT_FORWARD,
|
|
None,
|
|
false,
|
|
None,
|
|
None,
|
|
);
|
|
session
|
|
}
|
|
}
|
|
|
|
#[async_trait]
|
|
impl Interface for Session {
|
|
fn get_login_config_handler(&self) -> Arc<RwLock<LoginConfigHandler>> {
|
|
return self.lc.clone();
|
|
}
|
|
|
|
fn msgbox(&self, msgtype: &str, title: &str, text: &str, link: &str) {
|
|
match msgtype {
|
|
"input-password" => {
|
|
self.sender
|
|
.send(Data::Login((self.password.clone(), true)))
|
|
.ok();
|
|
}
|
|
"re-input-password" => {
|
|
log::error!("{}: {}", title, text);
|
|
match rpassword::prompt_password("Enter password: ") {
|
|
Ok(password) => {
|
|
let login_data = Data::Login((password, true));
|
|
self.sender.send(login_data).ok();
|
|
}
|
|
Err(e) => {
|
|
log::error!("reinput password failed, {:?}", e);
|
|
}
|
|
}
|
|
}
|
|
msg if msg.contains("error") => {
|
|
log::error!("{}: {}: {}", msgtype, title, text);
|
|
}
|
|
_ => {
|
|
log::info!("{}: {}: {}", msgtype, title, text);
|
|
}
|
|
}
|
|
}
|
|
|
|
fn handle_login_error(&self, err: &str) -> bool {
|
|
handle_login_error(self.lc.clone(), err, self)
|
|
}
|
|
|
|
fn handle_peer_info(&self, pi: PeerInfo) {
|
|
self.lc.write().unwrap().handle_peer_info(&pi);
|
|
}
|
|
|
|
async fn handle_hash(&self, pass: &str, hash: Hash, peer: &mut Stream) {
|
|
log::info!(
|
|
"password={}",
|
|
hbb_common::password_security::temporary_password()
|
|
);
|
|
handle_hash(self.lc.clone(), &pass, hash, self, peer).await;
|
|
}
|
|
|
|
async fn handle_login_from_ui(
|
|
&self,
|
|
os_username: String,
|
|
os_password: String,
|
|
password: String,
|
|
remember: bool,
|
|
peer: &mut Stream,
|
|
) {
|
|
handle_login_from_ui(
|
|
self.lc.clone(),
|
|
os_username,
|
|
os_password,
|
|
password,
|
|
remember,
|
|
peer,
|
|
)
|
|
.await;
|
|
}
|
|
|
|
async fn handle_test_delay(&self, t: TestDelay, peer: &mut Stream) {
|
|
handle_test_delay(t, peer).await;
|
|
}
|
|
|
|
fn send(&self, data: Data) {
|
|
self.sender.send(data).ok();
|
|
}
|
|
}
|
|
|
|
#[tokio::main(flavor = "current_thread")]
|
|
pub async fn connect_test(id: &str, key: String, token: String) {
|
|
let (sender, mut receiver) = mpsc::unbounded_channel::<Data>();
|
|
let handler = Session::new(&id, sender);
|
|
match crate::client::Client::start(id, &key, &token, ConnType::PORT_FORWARD, handler).await {
|
|
Err(err) => {
|
|
log::error!("Failed to connect {}: {}", &id, err);
|
|
}
|
|
Ok((mut stream, direct)) => {
|
|
log::info!("direct: {}", direct);
|
|
// rpassword::prompt_password("Input anything to exit").ok();
|
|
loop {
|
|
tokio::select! {
|
|
res = hbb_common::timeout(READ_TIMEOUT, stream.next()) => match res {
|
|
Err(_) => {
|
|
log::error!("Timeout");
|
|
break;
|
|
}
|
|
Ok(Some(Ok(bytes))) => {
|
|
if let Ok(msg_in) = Message::parse_from_bytes(&bytes) {
|
|
match msg_in.union {
|
|
Some(message::Union::Hash(hash)) => {
|
|
log::info!("Got hash");
|
|
break;
|
|
}
|
|
_ => {}
|
|
}
|
|
}
|
|
}
|
|
_ => {}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
#[tokio::main(flavor = "current_thread")]
|
|
pub async fn start_one_port_forward(
|
|
id: String,
|
|
port: i32,
|
|
remote_host: String,
|
|
remote_port: i32,
|
|
key: String,
|
|
token: String,
|
|
) {
|
|
crate::common::test_rendezvous_server();
|
|
crate::common::test_nat_type();
|
|
let (sender, mut receiver) = mpsc::unbounded_channel::<Data>();
|
|
let handler = Session::new(&id, sender);
|
|
if let Err(err) = crate::port_forward::listen(
|
|
handler.id.clone(),
|
|
handler.password.clone(),
|
|
port,
|
|
handler.clone(),
|
|
receiver,
|
|
&key,
|
|
&token,
|
|
handler.lc.clone(),
|
|
remote_host,
|
|
remote_port,
|
|
)
|
|
.await
|
|
{
|
|
log::error!("Failed to listen on {}: {}", port, err);
|
|
}
|
|
log::info!("port forward (:{}) exit", port);
|
|
}
|