merge: 合并 RustDesk 直连与会话优化

src/runtime/remote_access.rs

@@ -22,6 +22,9 @@ use super::ConfigApplyOptions;
 pub struct RustDeskRuntimeStatus {
     pub service_status: String,
     pub rendezvous_status: Option<String>,
+    pub connection_count: usize,
+    pub listening: bool,
+    pub listen_port: Option<u16>,
 }
 
 pub struct RemoteAccessCoordinator {
@@ -121,7 +124,7 @@ impl RemoteAccessCoordinator {
         let vnc = self.vnc.read().await.clone();
         let rtsp = self.rtsp.read().await.clone();
 
-        config.rustdesk.enabled = rustdesk.is_some_and(|service| service.is_listening());
+        config.rustdesk.enabled = rustdesk.is_some_and(|service| service.is_running());
         config.vnc.enabled = match vnc {
             Some(service) => matches!(
                 service.status().await,
@@ -145,10 +148,16 @@ impl RemoteAccessCoordinator {
             Some(service) => RustDeskRuntimeStatus {
                 service_status: service.status().to_string(),
                 rendezvous_status: service.rendezvous_status().map(|status| status.to_string()),
+                connection_count: service.connection_count(),
+                listening: service.is_listening(),
+                listen_port: service.is_listening().then(|| service.listen_port()),
             },
             None => RustDeskRuntimeStatus {
                 service_status: "not_initialized".to_string(),
                 rendezvous_status: None,
+                connection_count: 0,
+                listening: false,
+                listen_port: None,
             },
         }
     }
@@ -191,8 +200,12 @@ impl RemoteAccessCoordinator {
             .await?;
 
         let need_restart = options.force
+            || old_config.mode != new_config.mode
             || old_config.codec != new_config.codec
+            || old_config.direct_access_port != new_config.direct_access_port
             || old_config.rendezvous_server != new_config.rendezvous_server
+            || old_config.relay_server != new_config.relay_server
+            || old_config.relay_key != new_config.relay_key
             || old_config.device_id != new_config.device_id
             || old_config.device_password != new_config.device_password;
         let current = self.rustdesk.read().await.clone();
@@ -224,7 +237,7 @@ impl RemoteAccessCoordinator {
                     credentials_to_save = service.save_credentials();
                 }
                 Some(service) => {
-                    if service.is_listening() {
+                    if service.is_running() {
                         if need_restart {
                             service.restart(new_config.clone()).await.map_err(|error| {
                                 AppError::Config(format!(

src/rustdesk/bytes_codec.rs

@@ -1,7 +1,7 @@
 //! Variable-length TCP framing (RustDesk wire format).
 
 use bytes::{Buf, BufMut, Bytes, BytesMut};
-use std::io;
+use std::io::{self, IoSlice};
 use tokio::io::{AsyncRead, AsyncReadExt, AsyncWrite, AsyncWriteExt};
 
 const MAX_PACKET_LENGTH: usize = 0x3FFFFFFF;
@@ -53,6 +53,18 @@ fn decode_header(first_byte: u8, header_bytes: &[u8]) -> (usize, usize) {
 }
 
 pub async fn read_frame<R: AsyncRead + Unpin>(reader: &mut R) -> io::Result<BytesMut> {
+    read_frame_with_limit(reader, MAX_PACKET_LENGTH).await
+}
+
+/// Read one framed message while enforcing a caller-selected allocation limit.
+///
+/// Network-facing protocol stages should use a substantially smaller limit than
+/// the wire format's theoretical maximum so an untrusted peer cannot force a
+/// huge allocation by sending only a length header.
+pub async fn read_frame_with_limit<R: AsyncRead + Unpin>(
+    reader: &mut R,
+    max_packet_length: usize,
+) -> io::Result<BytesMut> {
     let mut first_byte = [0u8; 1];
     reader.read_exact(&mut first_byte).await?;
 
@@ -65,10 +77,10 @@ pub async fn read_frame<R: AsyncRead + Unpin>(reader: &mut R) -> io::Result<Byte
 
     let (_, msg_len) = decode_header(first_byte[0], &header_rest);
 
-    if msg_len > MAX_PACKET_LENGTH {
+    if msg_len > max_packet_length {
         return Err(io::Error::new(
             io::ErrorKind::InvalidData,
-            "Message too large",
+            format!("Message too large: {msg_len} bytes exceeds {max_packet_length}-byte limit"),
         ));
     }
 
@@ -86,6 +98,53 @@ pub async fn write_frame<W: AsyncWrite + Unpin>(writer: &mut W, data: &[u8]) ->
     Ok(())
 }
 
+/// Write a frame without copying its payload into a second contiguous buffer.
+/// TCP writers normally send the small header and payload in one vectored write.
+pub async fn write_frame_vectored<W: AsyncWrite + Unpin>(
+    writer: &mut W,
+    data: &[u8],
+) -> io::Result<()> {
+    let len = data.len();
+    let mut header = [0u8; 4];
+    let header_len = if len <= 0x3F {
+        header[0] = (len << 2) as u8;
+        1
+    } else if len <= 0x3FFF {
+        header[..2].copy_from_slice(&(((len << 2) as u16) | 0x1).to_le_bytes());
+        2
+    } else if len <= 0x3FFFFF {
+        let value = ((len << 2) as u32) | 0x2;
+        header[0] = (value & 0xFF) as u8;
+        header[1] = ((value >> 8) & 0xFF) as u8;
+        header[2] = ((value >> 16) & 0xFF) as u8;
+        3
+    } else if len <= MAX_PACKET_LENGTH {
+        header.copy_from_slice(&(((len << 2) as u32) | 0x3).to_le_bytes());
+        4
+    } else {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidInput,
+            "Message too large",
+        ));
+    };
+
+    let slices = [IoSlice::new(&header[..header_len]), IoSlice::new(data)];
+    let written = writer.write_vectored(&slices).await?;
+    if written == 0 {
+        return Err(io::Error::new(
+            io::ErrorKind::WriteZero,
+            "failed to write RustDesk frame",
+        ));
+    }
+    if written < header_len {
+        writer.write_all(&header[written..header_len]).await?;
+        writer.write_all(data).await?;
+    } else {
+        writer.write_all(&data[written - header_len..]).await?;
+    }
+    Ok(())
+}
+
 pub async fn write_frame_buffered<W: AsyncWrite + Unpin>(
     writer: &mut W,
     data: &[u8],
@@ -281,4 +340,32 @@ mod tests {
         let decoded = codec.decode(&mut buf).unwrap().unwrap();
         assert_eq!(decoded.len(), 100000);
     }
+
+    #[tokio::test]
+    async fn read_limit_rejects_length_before_allocating_payload() {
+        let encoded = encode_frame(&vec![0u8; 1024]).unwrap();
+        let (mut writer, mut reader) = tokio::io::duplex(encoded.len());
+        tokio::spawn(async move {
+            writer.write_all(&encoded).await.unwrap();
+        });
+
+        let error = read_frame_with_limit(&mut reader, 128).await.unwrap_err();
+        assert_eq!(error.kind(), io::ErrorKind::InvalidData);
+    }
+
+    #[tokio::test]
+    async fn vectored_writer_round_trips() {
+        let payload = vec![0x5a; 100_000];
+        let (mut writer, mut reader) = tokio::io::duplex(payload.len() + 4);
+        let expected = payload.clone();
+        let send = tokio::spawn(async move {
+            write_frame_vectored(&mut writer, &payload).await.unwrap();
+        });
+
+        let decoded = read_frame_with_limit(&mut reader, expected.len())
+            .await
+            .unwrap();
+        send.await.unwrap();
+        assert_eq!(decoded.as_ref(), expected.as_slice());
+    }
 }

src/rustdesk/config.rs

@@ -11,12 +11,24 @@ pub enum RustDeskCodec {
     H265,
 }
 
+#[typeshare]
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+#[derive(Default)]
+pub enum RustDeskMode {
+    #[default]
+    Id,
+    DirectIp,
+}
+
 #[typeshare]
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(default)]
 pub struct RustDeskConfig {
     pub enabled: bool,
+    pub mode: RustDeskMode,
     pub codec: RustDeskCodec,
+    pub direct_access_port: u16,
     pub rendezvous_server: String,
     pub relay_server: Option<String>,
     #[typeshare(skip)]
@@ -40,7 +52,9 @@ impl Default for RustDeskConfig {
     fn default() -> Self {
         Self {
             enabled: false,
+            mode: RustDeskMode::Id,
             codec: RustDeskCodec::H264,
+            direct_access_port: 21118,
             rendezvous_server: String::new(),
             relay_server: None,
             relay_key: None,
@@ -58,9 +72,12 @@ impl Default for RustDeskConfig {
 impl RustDeskConfig {
     pub fn is_valid(&self) -> bool {
         self.enabled
-            && !self.rendezvous_server.is_empty()
             && !self.device_id.is_empty()
             && !self.device_password.is_empty()
+            && match self.mode {
+                RustDeskMode::Id => !self.rendezvous_server.trim().is_empty(),
+                RustDeskMode::DirectIp => self.direct_access_port != 0,
+            }
     }
 
     pub fn effective_rendezvous_server(&self) -> &str {
@@ -214,4 +231,43 @@ mod tests {
         config.rendezvous_server = String::new();
         assert_eq!(config.effective_rendezvous_server(), "");
     }
+
+    #[test]
+    fn direct_ip_mode_is_valid_without_rendezvous_server() {
+        let config = RustDeskConfig {
+            enabled: true,
+            mode: RustDeskMode::DirectIp,
+            rendezvous_server: String::new(),
+            ..Default::default()
+        };
+
+        assert!(config.is_valid());
+    }
+
+    #[test]
+    fn id_mode_is_invalid_without_rendezvous_server() {
+        let config = RustDeskConfig {
+            enabled: true,
+            mode: RustDeskMode::Id,
+            rendezvous_server: String::new(),
+            ..Default::default()
+        };
+
+        assert!(!config.is_valid());
+    }
+
+    #[test]
+    fn legacy_config_defaults_to_id_mode() {
+        let config: RustDeskConfig = serde_json::from_value(serde_json::json!({
+            "enabled": false,
+            "codec": "h264",
+            "rendezvous_server": "",
+            "device_id": "123456789",
+            "device_password": "password"
+        }))
+        .expect("legacy RustDesk config should deserialize");
+
+        assert_eq!(config.mode, RustDeskMode::Id);
+        assert_eq!(config.direct_access_port, 21118);
+    }
 }

src/rustdesk/frame_adapters.rs

@@ -91,6 +91,12 @@ impl VideoFrameAdapter {
             return data;
         }
 
+        // Parameter sets are relevant only on random-access frames. Avoid a
+        // full Annex-B/AVCC scan on every delta frame in every client session.
+        if !is_keyframe {
+            return data;
+        }
+
         let (sps, pps) = crate::video::codec::h264_bitstream::extract_sps_pps(&data);
         let mut has_sps = false;
         let mut has_pps = false;

src/rustdesk/mod.rs

@@ -17,7 +17,7 @@ use std::time::Duration;
 use parking_lot::RwLock;
 use protobuf::Message;
 use tokio::net::{TcpListener, TcpStream};
-use tokio::sync::broadcast;
+use tokio::sync::{broadcast, Semaphore};
 use tokio::task::JoinHandle;
 use tracing::{debug, error, info, warn};
 
@@ -26,13 +26,14 @@ use crate::hid::HidController;
 use crate::utils::bind_tcp_listener;
 use crate::video::stream_manager::VideoStreamManager;
 
-use self::config::RustDeskConfig;
+use self::config::{RustDeskConfig, RustDeskMode};
 use self::connection::ConnectionManager;
 use self::protocol::{make_local_addr, make_relay_response, make_request_relay};
 use self::rendezvous::{AddrMangle, RendezvousMediator, RendezvousStatus};
 
 const RELAY_CONNECT_TIMEOUT_MS: u64 = 10_000;
 const SERVICE_SHUTDOWN_TIMEOUT: Duration = Duration::from_secs(2);
+const MAX_PENDING_CONNECTION_ATTEMPTS: usize = 8;
 
 #[derive(Debug, Clone, PartialEq)]
 pub enum ServiceStatus {
@@ -53,14 +54,13 @@ impl std::fmt::Display for ServiceStatus {
     }
 }
 
-const DIRECT_LISTEN_PORT: u16 = 21118;
-
 pub struct RustDeskService {
     config: Arc<RwLock<RustDeskConfig>>,
     status: Arc<RwLock<ServiceStatus>>,
     rendezvous: Arc<RwLock<Option<Arc<RendezvousMediator>>>>,
     rendezvous_handle: Arc<RwLock<Option<JoinHandle<()>>>>,
     tcp_listener_handle: Arc<RwLock<Option<Vec<JoinHandle<()>>>>>,
+    listener_start_lock: Arc<tokio::sync::Mutex<()>>,
     listen_port: Arc<RwLock<u16>>,
     connection_manager: Arc<ConnectionManager>,
     video_manager: Arc<VideoStreamManager>,
@@ -78,6 +78,7 @@ impl RustDeskService {
     ) -> Self {
         let (shutdown_tx, _) = broadcast::channel(1);
         let connection_manager = Arc::new(ConnectionManager::new(config.clone()));
+        let direct_access_port = config.direct_access_port;
 
         Self {
             config: Arc::new(RwLock::new(config)),
@@ -85,7 +86,8 @@ impl RustDeskService {
             rendezvous: Arc::new(RwLock::new(None)),
             rendezvous_handle: Arc::new(RwLock::new(None)),
             tcp_listener_handle: Arc::new(RwLock::new(None)),
-            listen_port: Arc::new(RwLock::new(DIRECT_LISTEN_PORT)),
+            listener_start_lock: Arc::new(tokio::sync::Mutex::new(())),
+            listen_port: Arc::new(RwLock::new(direct_access_port)),
             connection_manager,
             video_manager,
             hid,
@@ -107,6 +109,7 @@ impl RustDeskService {
     }
 
     pub fn update_config(&self, config: RustDeskConfig) {
+        self.connection_manager.update_config(config.clone());
         *self.config.write() = config;
     }
 
@@ -126,7 +129,11 @@ impl RustDeskService {
         self.tcp_listener_handle.read().is_some()
     }
 
-    pub async fn start(&self) -> anyhow::Result<()> {
+    pub fn is_running(&self) -> bool {
+        self.status() == ServiceStatus::Running
+    }
+
+    pub async fn start(self: &Arc<Self>) -> anyhow::Result<()> {
         let config = self.config.read().clone();
 
         if !config.enabled {
@@ -146,9 +153,8 @@ impl RustDeskService {
 
         *self.status.write() = ServiceStatus::Starting;
         info!(
-            "Starting RustDesk service with ID: {} -> {}",
+            "Starting RustDesk service in {:?} mode with ID: {}",
-            config.device_id,
+            config.mode, config.device_id,
-            config.rendezvous_addr()
         );
 
         if let Err(e) = crypto::init() {
@@ -157,6 +163,29 @@ impl RustDeskService {
             return Err(e.into());
         }
 
+        self.connection_manager.set_hid(self.hid.clone());
+
+        self.connection_manager.set_audio(self.audio.clone());
+
+        self.connection_manager
+            .set_video_manager(self.video_manager.clone());
+
+        if config.mode == RustDeskMode::DirectIp {
+            let listen_port = match self
+                .ensure_tcp_listener(config.direct_access_port, false)
+                .await
+            {
+                Ok(result) => result,
+                Err(err) => {
+                    *self.status.write() = ServiceStatus::Error(err.to_string());
+                    return Err(err);
+                }
+            };
+            *self.listen_port.write() = listen_port;
+            *self.status.write() = ServiceStatus::Running;
+            return Ok(());
+        }
+
         let mediator = Arc::new(RendezvousMediator::new(config.clone()));
 
         let keypair = mediator.ensure_keypair();
@@ -165,36 +194,27 @@ impl RustDeskService {
         let signing_keypair = mediator.ensure_signing_keypair();
         self.connection_manager.set_signing_keypair(signing_keypair);
 
-        self.connection_manager.set_hid(self.hid.clone());
-
-        self.connection_manager.set_audio(self.audio.clone());
-
-        self.connection_manager
-            .set_video_manager(self.video_manager.clone());
-
         *self.rendezvous.write() = Some(mediator.clone());
 
-        let (tcp_handles, listen_port) = match self.start_tcp_listener_with_port().await {
-            Ok(result) => result,
-            Err(err) => {
-                *self.status.write() = ServiceStatus::Error(err.to_string());
-                return Err(err);
-            }
-        };
-        *self.tcp_listener_handle.write() = Some(tcp_handles);
-
-        mediator.set_listen_port(listen_port);
-
         let connection_manager = self.connection_manager.clone();
         let service_config = self.config.clone();
+        let connection_attempts = Arc::new(Semaphore::new(MAX_PENDING_CONNECTION_ATTEMPTS));
 
         mediator.set_punch_callback(Arc::new({
             let connection_manager = connection_manager.clone();
             let service_config = service_config.clone();
+            let connection_attempts = connection_attempts.clone();
             move |peer_addr, rendezvous_addr, relay_server, uuid, socket_addr, device_id| {
                 let conn_mgr = connection_manager.clone();
                 let config = service_config.clone();
+                let attempts = connection_attempts.clone();
                 tokio::spawn(async move {
+                    let Ok(_permit) = attempts.try_acquire_owned() else {
+                        warn!(
+                            "Dropping RustDesk punch request: too many pending connection attempts"
+                        );
+                        return;
+                    };
                     if let Some(addr) = peer_addr {
                         info!("Attempting P2P direct connection to {}", addr);
                         match punch::try_direct_connection(addr).await {
@@ -232,10 +252,18 @@ impl RustDeskService {
         mediator.set_relay_callback(Arc::new({
             let connection_manager = connection_manager.clone();
             let service_config = service_config.clone();
+            let connection_attempts = connection_attempts.clone();
             move |rendezvous_addr, relay_server, uuid, socket_addr, device_id| {
                 let conn_mgr = connection_manager.clone();
                 let config = service_config.clone();
+                let attempts = connection_attempts.clone();
                 tokio::spawn(async move {
+                    let Ok(_permit) = attempts.try_acquire_owned() else {
+                        warn!(
+                            "Dropping RustDesk relay request: too many pending connection attempts"
+                        );
+                        return;
+                    };
                     let relay_key = rustdesk_relay_key(&config);
                     if let Err(e) = handle_relay_request(
                         &rendezvous_addr,
@@ -254,19 +282,39 @@ impl RustDeskService {
             }
         }));
 
-        let connection_manager2 = self.connection_manager.clone();
+        let weak_service = Arc::downgrade(self);
+        let intranet_attempts = connection_attempts.clone();
         mediator.set_intranet_callback(Arc::new(
-            move |rendezvous_addr, peer_socket_addr, local_addr, relay_server, device_id| {
+            move |rendezvous_addr, peer_socket_addr, local_ip, relay_server, device_id| {
-                let conn_mgr = connection_manager2.clone();
+                let weak_service = weak_service.clone();
-
+                let attempts = intranet_attempts.clone();
                 tokio::spawn(async move {
+                    let Ok(_permit) = attempts.try_acquire_owned() else {
+                        warn!("Dropping RustDesk intranet request: too many pending connection attempts");
+                        return;
+                    };
+                    let Some(service) = weak_service.upgrade() else {
+                        return;
+                    };
+                    let preferred_port = service.config.read().direct_access_port;
+                    let listen_port = match service
+                        .ensure_tcp_listener(preferred_port, true)
+                        .await
+                    {
+                        Ok(port) => port,
+                        Err(error) => {
+                            error!("Failed to start on-demand RustDesk listener: {}", error);
+                            return;
+                        }
+                    };
+                    let local_addr = SocketAddr::new(local_ip, listen_port);
                     if let Err(e) = handle_intranet_request(
                         &rendezvous_addr,
                         &peer_socket_addr,
                         local_addr,
                         &relay_server,
                         &device_id,
-                        conn_mgr,
+                        service.connection_manager.clone(),
                     )
                     .await
                     {
@@ -298,16 +346,29 @@ impl RustDeskService {
         Ok(())
     }
 
-    async fn start_tcp_listener_with_port(&self) -> anyhow::Result<(Vec<JoinHandle<()>>, u16)> {
+    async fn ensure_tcp_listener(
-        let (listeners, listen_port) = match self.bind_direct_listeners(DIRECT_LISTEN_PORT) {
+        self: &Arc<Self>,
+        preferred_port: u16,
+        allow_ephemeral_fallback: bool,
+    ) -> anyhow::Result<u16> {
+        let _guard = self.listener_start_lock.lock().await;
+        if self.tcp_listener_handle.read().is_some() {
+            return Ok(*self.listen_port.read());
+        }
+        if self.status() == ServiceStatus::Stopped {
+            anyhow::bail!("RustDesk service stopped before listener could start");
+        }
+
+        let (listeners, listen_port) = match self.bind_direct_listeners(preferred_port) {
             Ok(result) => result,
-            Err(err) => {
+            Err(error) if allow_ephemeral_fallback => {
                 warn!(
-                    "Failed to bind RustDesk TCP on port {}: {}, falling back to random port",
+                    "RustDesk port {} unavailable for on-demand listening: {}; using an ephemeral port",
-                    DIRECT_LISTEN_PORT, err
+                    preferred_port, error
                 );
                 self.bind_direct_listeners(0)?
             }
+            Err(error) => return Err(error),
         };
 
         *self.listen_port.write() = listen_port;
@@ -328,15 +389,13 @@ impl RustDeskService {
                             match result {
                                 Ok((stream, peer_addr)) => {
                                     info!("Accepted direct connection from {}", peer_addr);
-                                    let conn_mgr = conn_mgr.clone();
+                                    if let Err(e) = conn_mgr.accept_listener_connection(stream, peer_addr).await {
-                                    tokio::spawn(async move {
+                                        warn!("Rejected direct connection from {}: {}", peer_addr, e);
-                                        if let Err(e) = conn_mgr.accept_connection(stream, peer_addr).await {
-                                            error!("Failed to handle direct connection from {}: {}", peer_addr, e);
                                     }
-                                    });
                                 }
                                 Err(e) => {
                                     error!("TCP accept error: {}", e);
+                                    tokio::time::sleep(Duration::from_millis(100)).await;
                                 }
                             }
                         }
@@ -350,7 +409,8 @@ impl RustDeskService {
             handles.push(handle);
         }
 
-        Ok((handles, listen_port))
+        *self.tcp_listener_handle.write() = Some(handles);
+        Ok(listen_port)
     }
 
     fn bind_direct_listeners(&self, port: u16) -> anyhow::Result<(Vec<TcpListener>, u16)> {
@@ -384,8 +444,8 @@ impl RustDeskService {
         info!("Stopping RustDesk service");
 
         let _ = self.shutdown_tx.send(());
-
+        let _listener_guard = self.listener_start_lock.lock().await;
-        self.connection_manager.close_all();
+        *self.status.write() = ServiceStatus::Stopped;
 
         if let Some(mediator) = self.rendezvous.read().as_ref() {
             mediator.stop();
@@ -403,13 +463,15 @@ impl RustDeskService {
             }
         }
 
+        // No listener can admit a new session after this point.
+        self.connection_manager.close_all().await;
+
         *self.rendezvous.write() = None;
-        *self.status.write() = ServiceStatus::Stopped;
 
         Ok(())
     }
 
-    pub async fn restart(&self, config: RustDeskConfig) -> anyhow::Result<()> {
+    pub async fn restart(self: &Arc<Self>, config: RustDeskConfig) -> anyhow::Result<()> {
         self.stop().await?;
         self.update_config(config);
         self.start().await

src/rustdesk/rendezvous.rs

@@ -128,7 +128,7 @@ pub type RelayCallback = Arc<dyn Fn(String, String, String, Vec<u8>, String) + S
 pub type PunchCallback =
     Arc<dyn Fn(Option<SocketAddr>, String, String, String, Vec<u8>, String) + Send + Sync>;
 
-pub type IntranetCallback = Arc<dyn Fn(String, Vec<u8>, SocketAddr, String, String) + Send + Sync>;
+pub type IntranetCallback = Arc<dyn Fn(String, Vec<u8>, IpAddr, String, String) + Send + Sync>;
 
 pub struct RendezvousMediator {
     config: Arc<RwLock<RustDeskConfig>>,
@@ -143,7 +143,6 @@ pub struct RendezvousMediator {
     relay_callback: Arc<RwLock<Option<RelayCallback>>>,
     punch_callback: Arc<RwLock<Option<PunchCallback>>>,
     intranet_callback: Arc<RwLock<Option<IntranetCallback>>>,
-    listen_port: Arc<RwLock<u16>>,
     shutdown_tx: broadcast::Sender<()>,
 }
 
@@ -166,23 +165,10 @@ impl RendezvousMediator {
             relay_callback: Arc::new(RwLock::new(None)),
             punch_callback: Arc::new(RwLock::new(None)),
             intranet_callback: Arc::new(RwLock::new(None)),
-            listen_port: Arc::new(RwLock::new(21118)),
             shutdown_tx,
         }
     }
 
-    pub fn set_listen_port(&self, port: u16) {
-        let old_port = *self.listen_port.read();
-        if old_port != port {
-            *self.listen_port.write() = port;
-            self.increment_serial();
-        }
-    }
-
-    pub fn listen_port(&self) -> u16 {
-        *self.listen_port.read()
-    }
-
     pub fn increment_serial(&self) {
         let mut serial = self.serial.write();
         *serial = serial.wrapping_add(1);
@@ -430,7 +416,9 @@ impl RendezvousMediator {
     ) -> anyhow::Result<()> {
         let id = self.device_id();
 
-        let local_addrs = get_local_addresses();
+        let local_addrs = tokio::task::spawn_blocking(get_local_addresses)
+            .await
+            .map_err(|error| anyhow::anyhow!("Failed to inspect local addresses: {error}"))?;
         if local_addrs.is_empty() {
             debug!("No local addresses available for LocalAddr response");
             return Ok(());
@@ -439,21 +427,18 @@ impl RendezvousMediator {
         let config = self.config.read().clone();
         let rendezvous_addr = config.rendezvous_addr();
 
-        let listen_port = self.listen_port();
-
         let local_ip = local_addrs[0];
-        let local_sock_addr = SocketAddr::new(local_ip, listen_port);
 
         info!(
-            "FetchLocalAddr: calling intranet callback with local_addr={}, rendezvous={}",
+            "FetchLocalAddr: requesting an on-demand listener for {}, rendezvous={}",
-            local_sock_addr, rendezvous_addr
+            local_ip, rendezvous_addr
         );
 
         if let Some(callback) = self.intranet_callback.read().as_ref() {
             callback(
                 rendezvous_addr,
                 peer_socket_addr.to_vec(),
-                local_sock_addr,
+                local_ip,
                 relay_server.to_string(),
                 id,
             );

src/web/handlers/config/rustdesk.rs

@@ -47,18 +47,22 @@ async fn current_status(
         config: RustDeskConfigResponse::from(&config),
         service_status: runtime.service_status,
         rendezvous_status: runtime.rendezvous_status,
+        connection_count: runtime.connection_count,
+        listening: runtime.listening,
+        listen_port: runtime.listen_port,
     }
 }
 
 #[derive(Debug, serde::Serialize)]
 pub struct RustDeskConfigResponse {
     pub enabled: bool,
+    pub mode: crate::rustdesk::config::RustDeskMode,
     pub codec: crate::rustdesk::config::RustDeskCodec,
+    pub direct_access_port: u16,
     pub rendezvous_server: String,
     pub relay_server: Option<String>,
     pub device_id: String,
     pub has_password: bool,
-    pub has_keypair: bool,
     pub relay_key: Option<String>,
 }
 
@@ -66,12 +70,13 @@ impl From<&RustDeskConfig> for RustDeskConfigResponse {
     fn from(config: &RustDeskConfig) -> Self {
         Self {
             enabled: config.enabled,
+            mode: config.mode,
             codec: config.codec,
+            direct_access_port: config.direct_access_port,
             rendezvous_server: config.rendezvous_server.clone(),
             relay_server: config.relay_server.clone(),
             device_id: config.device_id.clone(),
             has_password: !config.device_password.is_empty(),
-            has_keypair: config.public_key.is_some() && config.private_key.is_some(),
             relay_key: config.relay_key.clone(),
         }
     }
@@ -82,6 +87,9 @@ pub struct RustDeskStatusResponse {
     pub config: RustDeskConfigResponse,
     pub service_status: String,
     pub rendezvous_status: Option<String>,
+    pub connection_count: usize,
+    pub listening: bool,
+    pub listen_port: Option<u16>,
 }
 
 pub async fn get_rustdesk_config(
@@ -117,28 +125,22 @@ pub async fn update_rustdesk_config(
 pub async fn regenerate_device_id(
     State(state): State<RemoteAccessApiState>,
 ) -> Result<Json<RustDeskConfigResponse>> {
-    state
+    let _apply_guard = try_apply_lock(&state.rustdesk_apply_lock, "rustdesk")?;
-        .config
+    let old_config = state.config.get().rustdesk.clone();
-        .update(|config| {
+    let mut regenerated = old_config.clone();
-            config.rustdesk.device_id = RustDeskConfig::generate_device_id();
+    regenerated.device_id = RustDeskConfig::generate_device_id();
-        })
+    let new_config = persist_and_apply(&state, old_config, regenerated).await?;
-        .await?;
-
-    let new_config = state.config.get().rustdesk.clone();
     Ok(Json(RustDeskConfigResponse::from(&new_config)))
 }
 
 pub async fn regenerate_device_password(
     State(state): State<RemoteAccessApiState>,
 ) -> Result<Json<RustDeskConfigResponse>> {
-    state
+    let _apply_guard = try_apply_lock(&state.rustdesk_apply_lock, "rustdesk")?;
-        .config
+    let old_config = state.config.get().rustdesk.clone();
-        .update(|config| {
+    let mut regenerated = old_config.clone();
-            config.rustdesk.device_password = RustDeskConfig::generate_password();
+    regenerated.device_password = RustDeskConfig::generate_password();
-        })
+    let new_config = persist_and_apply(&state, old_config, regenerated).await?;
-        .await?;
-
-    let new_config = state.config.get().rustdesk.clone();
     Ok(Json(RustDeskConfigResponse::from(&new_config)))
 }
 

src/web/handlers/config/types.rs

@@ -899,7 +899,9 @@ fn validate_rustdesk_relay_key(key: &str) -> Result<(), AppError> {
 #[derive(Debug, Deserialize)]
 pub struct RustDeskConfigUpdate {
     pub enabled: Option<bool>,
+    pub mode: Option<crate::rustdesk::config::RustDeskMode>,
     pub codec: Option<crate::rustdesk::config::RustDeskCodec>,
+    pub direct_access_port: Option<u16>,
     pub rendezvous_server: Option<String>,
     pub relay_server: Option<String>,
     pub relay_key: Option<String>,
@@ -908,6 +910,11 @@ pub struct RustDeskConfigUpdate {
 
 impl RustDeskConfigUpdate {
     pub fn validate(&self) -> crate::error::Result<()> {
+        if self.direct_access_port == Some(0) {
+            return Err(AppError::BadRequest(
+                "RustDesk direct access port must be greater than 0".into(),
+            ));
+        }
         // Validate rendezvous server format (should be host:port)
         if let Some(ref server) = self.rendezvous_server {
             if !server.is_empty() && !server.contains(':') {
@@ -944,11 +951,25 @@ impl RustDeskConfigUpdate {
     }
 
     pub fn validate_merged(&self, config: &RustDeskConfig) -> crate::error::Result<()> {
-        if config.enabled && config.rendezvous_server.trim().is_empty() {
+        if config.enabled {
+            match config.mode {
+                crate::rustdesk::config::RustDeskMode::Id
+                    if config.rendezvous_server.trim().is_empty() =>
+                {
                     return Err(AppError::BadRequest(
-                "RustDesk ID server is required".into(),
+                        "RustDesk ID server is required in ID service mode".into(),
                     ));
                 }
+                crate::rustdesk::config::RustDeskMode::DirectIp
+                    if config.direct_access_port == 0 =>
+                {
+                    return Err(AppError::BadRequest(
+                        "RustDesk direct access port must be greater than 0".into(),
+                    ));
+                }
+                _ => {}
+            }
+        }
         Ok(())
     }
 
@@ -956,9 +977,15 @@ impl RustDeskConfigUpdate {
         if let Some(enabled) = self.enabled {
             config.enabled = enabled;
         }
+        if let Some(mode) = self.mode {
+            config.mode = mode;
+        }
         if let Some(codec) = self.codec {
             config.codec = codec;
         }
+        if let Some(port) = self.direct_access_port {
+            config.direct_access_port = port;
+        }
         if let Some(ref server) = self.rendezvous_server {
             config.rendezvous_server = server.clone();
         }
@@ -1466,7 +1493,9 @@ mod tests {
     fn rustdesk_relay_key_accepts_hbbs_style_base64_32_bytes() {
         let update = RustDeskConfigUpdate {
             enabled: None,
+            mode: None,
             codec: None,
+            direct_access_port: None,
             rendezvous_server: None,
             relay_server: None,
             relay_key: Some("pLU0pEj2IZnNVKzrIO1pIdwGA3dOVJJLkFIYGOCGH1E=".to_string()),
@@ -1481,7 +1510,9 @@ mod tests {
         let not_32 = "AAAAAAAAAAAAAAAAAAAAAA==".to_string();
         let update = RustDeskConfigUpdate {
             enabled: None,
+            mode: None,
             codec: None,
+            direct_access_port: None,
             rendezvous_server: None,
             relay_server: None,
             relay_key: Some(not_32),
@@ -1490,6 +1521,49 @@ mod tests {
         assert!(update.validate().is_err());
     }
 
+    #[test]
+    fn rustdesk_direct_ip_mode_does_not_require_id_server() {
+        let mut config = RustDeskConfig::default();
+        config.enabled = true;
+        config.mode = crate::rustdesk::config::RustDeskMode::DirectIp;
+        config.rendezvous_server.clear();
+
+        let update = RustDeskConfigUpdate {
+            enabled: Some(true),
+            mode: Some(crate::rustdesk::config::RustDeskMode::DirectIp),
+            codec: None,
+            direct_access_port: Some(21118),
+            rendezvous_server: Some(String::new()),
+            relay_server: None,
+            relay_key: None,
+            device_password: None,
+        };
+
+        assert!(update.validate().is_ok());
+        assert!(update.validate_merged(&config).is_ok());
+    }
+
+    #[test]
+    fn rustdesk_id_mode_requires_id_server_when_enabled() {
+        let mut config = RustDeskConfig::default();
+        config.enabled = true;
+        config.mode = crate::rustdesk::config::RustDeskMode::Id;
+        config.rendezvous_server.clear();
+
+        let update = RustDeskConfigUpdate {
+            enabled: Some(true),
+            mode: Some(crate::rustdesk::config::RustDeskMode::Id),
+            codec: None,
+            direct_access_port: None,
+            rendezvous_server: Some(String::new()),
+            relay_server: None,
+            relay_key: None,
+            device_password: None,
+        };
+
+        assert!(update.validate_merged(&config).is_err());
+    }
+
     #[test]
     fn ipv6_bind_vnc_config_accepts_ipv6_literals() {
         for bind in ["::", "::1", "2001:db8::1"] {

web/src/api/config.ts

@@ -221,12 +221,13 @@ export const extensionsApi = {
 
 export interface RustDeskConfigResponse {
   enabled: boolean
+  mode: 'id' | 'direct_ip'
   codec: 'h264' | 'h265'
+  direct_access_port: number
   rendezvous_server: string
   relay_server: string | null
   device_id: string
   has_password: boolean
-  has_keypair: boolean
   relay_key: string | null
 }
 
@@ -234,11 +235,16 @@ export interface RustDeskStatusResponse {
   config: RustDeskConfigResponse
   service_status: string
   rendezvous_status: string | null
+  connection_count: number
+  listening: boolean
+  listen_port: number | null
 }
 
 export interface RustDeskConfigUpdate {
   enabled?: boolean
+  mode?: 'id' | 'direct_ip'
   codec?: 'h264' | 'h265'
+  direct_access_port?: number
   rendezvous_server?: string
   relay_server?: string
   relay_key?: string

web/src/i18n/en-US.ts

@@ -1072,6 +1072,13 @@ export default {
     rustdesk: {
       title: 'RustDesk Remote',
       desc: 'Configure the RustDesk service; the selected codec will be locked',
+      mode: 'Access Mode',
+      modeId: 'ID Service',
+      modeIdDesc: 'Register with an ID server and use the configured relay when direct connections fail',
+      modeDirectIp: 'Direct IP',
+      modeDirectIpDesc: 'Listen on the device only, without connecting to an ID or relay server',
+      directAccessPort: 'Direct Access Port',
+      directAccessPortInvalid: 'The direct access port must be between 1 and 65535',
       rendezvousServer: 'ID Server',
       rendezvousServerPlaceholder: 'hbbs.example.com:21116',
       rendezvousServerRequired: 'Enter the RustDesk ID server',
@@ -1079,7 +1086,6 @@ export default {
       relayServerPlaceholder: 'hbbr.example.com:21117',
       relayKey: 'Relay Key',
       codec: 'Codec',
-      deviceInfo: 'Device Info',
       deviceId: 'Device ID',
       devicePassword: 'Device Password',
       showPassword: 'Show Password',
@@ -1095,7 +1101,6 @@ export default {
       notInitialized: 'Not Initialized',
       copyId: 'Copy ID',
       copyPassword: 'Copy Password',
-      keypairGenerated: 'Keypair Generated',
     },
     rtsp: {
       title: 'RTSP Streaming',

web/src/i18n/zh-CN.ts

@@ -1071,6 +1071,13 @@ export default {
     rustdesk: {
       title: 'RustDesk 远程',
       desc: '配置 RustDesk 服务，将会锁定所选编码',
+      mode: '接入模式',
+      modeId: 'ID 服务',
+      modeIdDesc: '通过 ID 服务器注册，并在直连失败时按配置使用中继服务器',
+      modeDirectIp: 'IP 直连',
+      modeDirectIpDesc: '仅监听设备端口，不连接 ID 或中继服务器',
+      directAccessPort: '直连端口',
+      directAccessPortInvalid: '直连端口必须在 1 到 65535 之间',
       rendezvousServer: 'ID 服务器',
       rendezvousServerPlaceholder: 'hbbs.example.com:21116',
       rendezvousServerRequired: '请填写 RustDesk ID 服务器',
@@ -1078,7 +1085,6 @@ export default {
       relayServerPlaceholder: 'hbbr.example.com:21117',
       relayKey: '中继密钥',
       codec: '编码格式',
-      deviceInfo: '设备信息',
       deviceId: '设备 ID',
       devicePassword: '设备密码',
       showPassword: '显示密码',
@@ -1094,7 +1100,6 @@ export default {
       notInitialized: '未初始化',
       copyId: '复制 ID',
       copyPassword: '复制密码',
-      keypairGenerated: '密钥对已生成',
     },
     rtsp: {
       title: 'RTSP 视频流',

web/src/types/generated.ts

@@ -248,6 +248,11 @@ export interface ExtensionsConfig {
 	frpc: FrpcConfig;
 }
 
+export enum RustDeskMode {
+	Id = "id",
+	DirectIp = "direct_ip",
+}
+
 export enum RustDeskCodec {
 	H264 = "h264",
 	H265 = "h265",
@@ -255,7 +260,9 @@ export enum RustDeskCodec {
 
 export interface RustDeskConfig {
 	enabled: boolean;
+	mode: RustDeskMode;
 	codec: RustDeskCodec;
+	direct_access_port: number;
 	rendezvous_server: string;
 	relay_server?: string;
 	device_id: string;
@@ -633,7 +640,9 @@ export interface RtspStatusResponse {
 
 export interface RustDeskConfigUpdate {
 	enabled?: boolean;
+	mode?: RustDeskMode;
 	codec?: RustDeskCodec;
+	direct_access_port?: number;
 	rendezvous_server?: string;
 	relay_server?: string;
 	relay_key?: string;

web/src/views/SettingsView.vue

@@ -496,16 +496,24 @@ const rustdeskCopied = ref<'id' | 'password' | null>(null)
 const { copy: clipboardCopy } = useClipboard()
 const rustdeskLocalConfig = ref({
   enabled: false,
+  mode: 'id' as 'id' | 'direct_ip',
   codec: 'h264' as 'h264' | 'h265',
+  direct_access_port: 21118,
   rendezvous_server: '',
   relay_server: '',
   relay_key: '',
 })
 
 const rustdeskValidationMessage = computed(() => {
-  if (!rustdeskLocalConfig.value.rendezvous_server?.trim()) {
+  if (rustdeskLocalConfig.value.mode === 'id' && !rustdeskLocalConfig.value.rendezvous_server?.trim()) {
     return t('extensions.rustdesk.rendezvousServerRequired')
   }
+  if (
+    rustdeskLocalConfig.value.mode === 'direct_ip'
+    && (rustdeskLocalConfig.value.direct_access_port < 1 || rustdeskLocalConfig.value.direct_access_port > 65535)
+  ) {
+    return t('extensions.rustdesk.directAccessPortInvalid')
+  }
   return ''
 })
 
@@ -1941,7 +1949,9 @@ function applyRustdeskStatus(status: RustDeskStatusResponse) {
   rustdeskStatus.value = status
   rustdeskLocalConfig.value = {
     enabled: config.enabled,
+    mode: config.mode || 'id',
     codec: config.codec || 'h264',
+    direct_access_port: config.direct_access_port || 21118,
     rendezvous_server: config.rendezvous_server,
     relay_server: config.relay_server || '',
     relay_key: config.relay_key || '',
@@ -2335,7 +2345,9 @@ function updateStatusBadgeText(): string {
 function rustdeskUpdatePayload(enabled = rustdeskLocalConfig.value.enabled) {
   return {
     enabled,
+    mode: rustdeskLocalConfig.value.mode,
     codec: rustdeskLocalConfig.value.codec,
+    direct_access_port: rustdeskLocalConfig.value.direct_access_port,
     rendezvous_server: normalizeRustdeskServer(
       rustdeskLocalConfig.value.rendezvous_server,
       21116,
@@ -2346,7 +2358,10 @@ function rustdeskUpdatePayload(enabled = rustdeskLocalConfig.value.enabled) {
 }
 
 async function saveRustdeskConfig() {
-  if (rustdeskLocalConfig.value.enabled && !validateRustdeskConfig()) return
+  if (
+    (rustdeskLocalConfig.value.enabled || rustdeskLocalConfig.value.mode === 'direct_ip')
+    && !validateRustdeskConfig()
+  ) return
 
   loading.value = true
   saved.value = false
@@ -5066,6 +5081,21 @@ watch(isWindows, () => {
                     <Label>{{ t('extensions.autoStart') }}</Label>
                     <Switch v-model="rustdeskLocalConfig.enabled" />
                   </div>
+                  <div class="grid gap-2 sm:grid-cols-4 sm:items-center">
+                    <Label class="sm:text-right">{{ t('extensions.rustdesk.mode') }}</Label>
+                    <div class="sm:col-span-3 space-y-1">
+                      <Select v-model="rustdeskLocalConfig.mode" :disabled="rustdeskStatus?.service_status === 'running'">
+                        <SelectTrigger class="w-full"><SelectValue /></SelectTrigger>
+                        <SelectContent>
+                          <SelectItem value="id">{{ t('extensions.rustdesk.modeId') }}</SelectItem>
+                          <SelectItem value="direct_ip">{{ t('extensions.rustdesk.modeDirectIp') }}</SelectItem>
+                        </SelectContent>
+                      </Select>
+                      <p class="text-xs text-muted-foreground">
+                        {{ rustdeskLocalConfig.mode === 'id' ? t('extensions.rustdesk.modeIdDesc') : t('extensions.rustdesk.modeDirectIpDesc') }}
+                      </p>
+                    </div>
+                  </div>
                   <div class="grid gap-2 sm:grid-cols-4 sm:items-center">
                     <Label class="sm:text-right">{{ t('extensions.rustdesk.codec') }}</Label>
                     <div class="sm:col-span-3 space-y-1">
@@ -5075,7 +5105,7 @@ watch(isWindows, () => {
                       </Select>
                     </div>
                   </div>
-                  <div class="grid gap-2 sm:grid-cols-4 sm:items-center">
+                  <div v-if="rustdeskLocalConfig.mode === 'id'" class="grid gap-2 sm:grid-cols-4 sm:items-center">
                     <Label class="sm:text-right">{{ t('extensions.rustdesk.rendezvousServer') }}</Label>
                     <div class="sm:col-span-3 space-y-1">
                       <Input
@@ -5086,7 +5116,7 @@ watch(isWindows, () => {
                       <p v-if="rustdeskLocalConfig.enabled && rustdeskValidationMessage" class="text-xs text-destructive">{{ rustdeskValidationMessage }}</p>
                     </div>
                   </div>
-                  <div class="grid gap-2 sm:grid-cols-4 sm:items-center">
+                  <div v-if="rustdeskLocalConfig.mode === 'id'" class="grid gap-2 sm:grid-cols-4 sm:items-center">
                     <Label class="sm:text-right">{{ t('extensions.rustdesk.relayServer') }}</Label>
                     <div class="sm:col-span-3 space-y-1">
                       <Input
@@ -5096,7 +5126,7 @@ watch(isWindows, () => {
                       />
                     </div>
                   </div>
-                  <div class="grid gap-2 sm:grid-cols-4 sm:items-center">
+                  <div v-if="rustdeskLocalConfig.mode === 'id'" class="grid gap-2 sm:grid-cols-4 sm:items-center">
                     <Label class="sm:text-right">{{ t('extensions.rustdesk.relayKey') }}</Label>
                     <div class="sm:col-span-3 space-y-1">
                       <div class="relative">
@@ -5123,15 +5153,26 @@ watch(isWindows, () => {
                       </div>
                     </div>
                   </div>
+                  <div v-if="rustdeskLocalConfig.mode === 'direct_ip'" class="grid gap-2 sm:grid-cols-4 sm:items-center">
+                    <Label class="sm:text-right">{{ t('extensions.rustdesk.directAccessPort') }}</Label>
+                    <div class="sm:col-span-3 space-y-1">
+                      <Input
+                        v-model.number="rustdeskLocalConfig.direct_access_port"
+                        type="number"
+                        min="1"
+                        max="65535"
+                        :disabled="rustdeskStatus?.service_status === 'running'"
+                      />
+                      <p v-if="rustdeskValidationMessage" class="text-xs text-destructive">{{ rustdeskValidationMessage }}</p>
+                    </div>
+                  </div>
                 </div>
                 <Separator />
 
                 <!-- Device Info -->
                 <div class="space-y-3">
-                  <h4 class="text-sm font-medium">{{ t('extensions.rustdesk.deviceInfo') }}</h4>
-
                   <!-- Device ID -->
-                  <div class="grid gap-2 sm:grid-cols-4 sm:items-center">
+                  <div v-if="rustdeskLocalConfig.mode === 'id'" class="grid gap-2 sm:grid-cols-4 sm:items-center">
                     <Label class="sm:text-right">{{ t('extensions.rustdesk.deviceId') }}</Label>
                     <div class="sm:col-span-3 flex items-center gap-2">
                       <code class="font-mono text-lg bg-muted px-3 py-1 rounded">{{ rustdeskConfig?.device_id || '-' }}</code>
@@ -5176,15 +5217,6 @@ watch(isWindows, () => {
                     </div>
                   </div>
 
-                  <!-- Keypair Status -->
-                  <div class="grid gap-2 sm:grid-cols-4 sm:items-center">
-                    <Label class="sm:text-right">{{ t('extensions.rustdesk.keypairGenerated') }}</Label>
-                    <div class="sm:col-span-3">
-                      <Badge :variant="rustdeskConfig?.has_keypair ? 'default' : 'secondary'">
-                        {{ rustdeskConfig?.has_keypair ? t('common.yes') : t('common.no') }}
-                      </Badge>
-                    </div>
-                  </div>
                 </div>
               </CardContent>
               <CardFooter class="border-t pt-4 justify-end">