UNITRONIX b65a16c7b5 fix(signal,updater,ratelimit): address #121, #122, #123 ...

Three independent bug fixes bundled together; none of the issues are
auto-closed by this commit so the reporters can confirm on a tagged build.

#121 — NAT hairpin: same-public-IP detection forces relay path

The signal handler now distinguishes 'same /24 private subnet' (genuine
LAN, keep direct path) from 'same public IP' (NAT hairpin scenario).
When both peers register from the same public IP, both the UDP and
TCP/WS punch-hole handlers skip the LAN-address exchange and steer the
client straight to the relay — matching upstream RustDesk behavior.
Most consumer routers and cellular gateways drop hairpinned UDP, which
was causing same-Wi-Fi connections to silently time out.

  - new helper isSamePublicIP() in signal/handler.go
  - new config flag SameNATRelay (default: enabled)
  - env: SAME_NAT_RELAY=N to opt out
  - cli: --same-nat-relay=false to opt out

Reported-by: @eternalliving (#121)

#122 — Rate limit configurable, 0 disables

The 20 registrations/min/IP cap was unworkable for any deployment with
real NAT/CGNAT in front of it. Made it tunable without recompiling and
hardened the limiter to short-circuit when disabled.

  - new config field SignalRateLimitPerIP (default: 20, unchanged)
  - env: SIGNAL_RATE_LIMIT_PER_IP=<n> (0 = unlimited)
  - cli: --signal-rate-limit-per-ip=<n>
  - ratelimit.IPLimiter.Allow() now returns true early when limit<=0

Reported-by: @Henry-739 (#122)

#123 — Updater corrupting live SQLite WAL files

A previous gitleaks-fix commit accidentally tracked live SQLite sidecar
files (auth.db-shm/wal, betterdesk.db-shm/wal, .session_secret,
.update_sha). The in-app updater's diff-against-GitHub logic then
'restored' those tracked-by-mistake files on user installs, which is
exactly how SQLite database corruption gets manufactured.

Layered defense:
  - .gitignore now covers *.db-shm, *.db-wal, *.sqlite3-{shm,wal,journal},
    web-nodejs/data/, .session_secret, .update_sha, .api_key,
    .admin_credentials, .force_password_update, .env*
  - removed the offending files from the index (data/.gitkeep retained)
  - updateService.js EXCLUDE_PATTERNS extended to match the new gitignore
  - new write-time guard isProtectedRuntimePath() wired into all four
    write sites in updateService.js so even a stale GitHub diff cannot
    overwrite a runtime state file on disk

Reported-by: @SterlynKong (#123)

2026-05-01 16:22:50 +02:00

..

.gitkeep

fix(signal,updater,ratelimit): address #121, #122, #123

2026-05-01 16:22:50 +02:00