CortenDesk Server 1.1.1

Security update. Synced with upstream rustdesk-server 1.1.17 and updated dependencies with known vulnerabilities.

Security

• WebSocket handshake DoS: tungstenite 0.17 to 0.26 (RUSTSEC-2023-0065). A crafted handshake on the WebSocket ports (21118/21119) could make the server spend unbounded CPU without authenticating.
• Protobuf recursion crash: protobuf 3.7.2 (RUSTSEC-2024-0437). Deeply nested input could crash hbbs.
• UDP reflection: hbbs ignores PunchHoleSent and LocalAddr over UDP, which could be used to bounce replies at a third party. Clients send these over TCP, which still works. From upstream.
• Forged client address on WebSocket: hbbs and hbbr take the client address from X-Real-IP / X-Forwarded-For on the WebSocket ports (upstream #634). The CortenDesk access policy and LAN address reports now use the real connection address instead. Keep 21118/21119 behind a proxy that sets those headers; don't publish them to the internet.
• Other dependency advisories cleared with cargo update.

Changes

• -b / --bind / BIND to listen on one local address (from upstream).
• Option names match ignoring case and - versus _; the console link variables also work from .env and --config.
• docs/environment-variables.md lists every option.
• CI now runs cargo audit, gitleaks and CodeQL.

docker pull ghcr.io/marcpope/cortendesk-server:1.1.1
docker pull marcpope/cortendesk-server:1.1.1

Static linux/amd64 and linux/arm64 binaries are attached below. Changes are listed in CHANGES.md.

CortenDesk Server 1.1.0

Adds a device access policy that hbbs fetches from a linked CortenDesk console (1.10.0 or later) and enforces on connection requests.

New

• Approved devices only. Pending, deleted and unknown devices still register and show up in the console, but cannot start or receive sessions.
• Incoming-only devices. A device can be reached but cannot start a session. Enforced in either mode.
• LAN addresses. The local address a peer reports during connection setup is sent to the console, so it can show a device's LAN IP.

A refused client sees the reason as text. Signed-in clients are identified by their console access token and the console's web client by a signed ticket. Matching signed-out clients by the IP they registered from is off in approved-only mode unless the console turns it on, since a shared public IP or a proxy that rewrites source addresses makes clients look alike.

If the console is unreachable, hbbs keeps the last policy it fetched, and caches it on disk for restarts.

Upgrading

No change unless you link a console: without CORTENDESK_SERVER_SECRET and CORTENDESK_CONSOLE_URL, 1.1.0 behaves like 1.0.0. The CortenDesk image bundles this server and links it automatically. For a separate server, see the README.

docker pull ghcr.io/marcpope/cortendesk-server:1.1.0
docker pull marcpope/cortendesk-server:1.1.0

Static linux/amd64 and linux/arm64 binaries are attached below. Changes are listed in CHANGES.md.

CortenDesk Server 1.0.0

First release. A fork of rustdesk-server 1.1.16 that fixes one thing: signed-in clients can connect.

The problem it fixes

RustDesk clients from 1.4.1 onwards encrypt their connection to the ID server whenever they are signed in to an API server, because the access token travels over it. The client starts that exchange by waiting for the server to send it a signed key. The open-source hbbs has no code to send one, so the client waits 18 seconds and fails:

Failed to secure tcp: deadline has elapsed

Every connection from a signed-in client fails that way — address book, recents, or a manually typed ID, direct or relayed. Sign out and the same client connects immediately. This release implements the missing server half, with no client-side workarounds.

Clients that do not encrypt signalling are unaffected, and the WebSocket and UDP paths are untouched.

Using it

Drop-in for rustdesk/rustdesk-server: same binaries, ports, flags and data files. Change the image, keep the volume, restart — device IDs and keys survive and no client needs reconfiguring.

docker pull ghcr.io/marcpope/cortendesk-server:1.0.0
docker pull marcpope/cortendesk-server:1.0.0

Static linux/amd64 and linux/arm64 binaries are attached below.

Notes

• AGPL-3.0, like the original. Modifications are listed in CHANGES.md, as that licence requires.
• rustdesk-utils is renamed cortendesk-utils.
• The daily version check against RustDesk's release feed is removed.
• Not affiliated with or endorsed by the RustDesk project. Report problems here, not to them.