From 28492584606edf699cdd3294bd2e0e6e4cec7788 Mon Sep 17 00:00:00 2001
From: rustdesk <info@rustdesk.com>
Date: Wed, 23 Sep 2026 13:20:36 +0800
Subject: [PATCH] tcp: pin the version 0 frame and the version 1 subkeys

The existing tests run both ends on the same code, so they pass even
if the derivation changes. Fixed bytes catch that: the version 0 frame
released peers send, and the same subkey vector hbbs's copy of this
code pins.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019aokqJuhjvB3kijXtAg5Ns
---
 src/tcp.rs | 28 +++++++++++++++++++++++++++-
 1 file changed, 27 insertions(+), 1 deletion(-)

diff --git a/src/tcp.rs b/src/tcp.rs
index 35d22d639..332e404d7 100644
--- a/src/tcp.rs
+++ b/src/tcp.rs
@@ -454,10 +454,36 @@ mod tests {
         let (mut initiator, mut responder) = (Encrypt::new(key.clone()), Encrypt::new(key));
         let sent = seal_and_open(&mut initiator, &mut responder, b"hello");
         let back = seal_and_open(&mut responder, &mut initiator, b"hello");
-        // Pinned so the path a peer without versions relies on stays byte-for-byte.
         assert_eq!(sent, back);
     }
 
+    // Fixed bytes: the version 0 frame is what released peers send, and the subkeys are the ones
+    // hbbs's own copy of this code pins, so a change here breaks the wire, not just this test.
+    #[test]
+    fn test_wire_vectors() {
+        let hex = |b: &[u8]| b.iter().map(|b| format!("{:02x}", b)).collect::<String>();
+        let key = Key([0x11u8; 32]);
+        assert_eq!(
+            hex(&Encrypt::new(key.clone()).enc(b"hello")),
+            "3b768f827fdcc4af555b9e42533be6611e2c333481"
+        );
+        let t = KxTranscript {
+            initiator_pk: &[0x22u8; 32],
+            responder_pk: &[0x33u8; 32],
+            advertised: 1,
+            picked: 1,
+        };
+        let Encrypt(send, _, _, recv) = Encrypt::new_split(key, true, &t).unwrap();
+        assert_eq!(
+            hex(&send.0),
+            "c189ec6e1935c0751cfc85a0f075405cae507d7925bb19687caf56cbb54e0ecf"
+        );
+        assert_eq!(
+            hex(&recv.unwrap().0),
+            "8a62648e9195cb10ea900c0a24d2a166c1e982347a2dc6833c3e756bf5715d36"
+        );
+    }
+
     #[test]
     fn test_split_directions_use_different_keys() {
         let key = secretbox::gen_key();