From 42c77b9a3b91bb4b651d9e506bccae5f508202d8 Mon Sep 17 00:00:00 2001
From: rustdesk <info@rustdesk.com>
Date: Wed, 23 Sep 2026 14:27:51 +0800
Subject: [PATCH] tcp: pin the subkeys for an advertisement above the pick

With advertised and picked both 1, swapping their order in the
derivation leaves the vector unchanged. Advertised 3 with picked 1 is
what a client meets at a newer server, and tells the two apart.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019aokqJuhjvB3kijXtAg5Ns
---
 src/tcp.rs | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/src/tcp.rs b/src/tcp.rs
index 332e404d7..b457bbe03 100644
--- a/src/tcp.rs
+++ b/src/tcp.rs
@@ -467,13 +467,13 @@ mod tests {
             hex(&Encrypt::new(key.clone()).enc(b"hello")),
             "3b768f827fdcc4af555b9e42533be6611e2c333481"
         );
-        let t = KxTranscript {
+        let mut t = KxTranscript {
             initiator_pk: &[0x22u8; 32],
             responder_pk: &[0x33u8; 32],
             advertised: 1,
             picked: 1,
         };
-        let Encrypt(send, _, _, recv) = Encrypt::new_split(key, true, &t).unwrap();
+        let Encrypt(send, _, _, recv) = Encrypt::new_split(key.clone(), true, &t).unwrap();
         assert_eq!(
             hex(&send.0),
             "c189ec6e1935c0751cfc85a0f075405cae507d7925bb19687caf56cbb54e0ecf"
@@ -482,6 +482,17 @@ mod tests {
             hex(&recv.unwrap().0),
             "8a62648e9195cb10ea900c0a24d2a166c1e982347a2dc6833c3e756bf5715d36"
         );
+        // With the two versions equal, swapping their order in the derivation would go unseen.
+        t.advertised = 3;
+        let Encrypt(send, _, _, recv) = Encrypt::new_split(key, true, &t).unwrap();
+        assert_eq!(
+            hex(&send.0),
+            "25b0778ae600f9731c7fa457d1cc5d40071b0aa3d34c90b53e1d5344b0e7123a"
+        );
+        assert_eq!(
+            hex(&recv.unwrap().0),
+            "5bbde0ac6a708d4cd1ff807125d79cb6030bde62f7a66b6cc1a79e31bd657756"
+        );
     }
 
     #[test]