Fix: Silence SOCKET_DLLLOADER log flood and tighten device-port logging

SOCKET_DLLLOADER (210) is the shellcode / memory-DLL loader asking the
server for the full DLL payload before it can load the client. The MFC
master console serves it via SendServerDll; the Go web device port has no
payload to hand out, so every memory-DLL client startup/reconnect fell
into the default dispatch branch and logged "Unhandled command 210",
flooding the log. Add a protocol constant and drop the command silently.

While auditing the device-port logging surface:

- Downgrade wrapTLS's per-connection hex-dump lines and the screen-spy
  "[timing]" cold-start line from Info to Debug (they fire once per TCP
  connection / screen view and are diagnostics, not operational events).

- Distinguish a sub-connection hijack attempt from a plain orphan: when a
  screen/terminal sub-conn claims a MasterID from a source IP other than
  the device's login conn, log a dedicated Warn instead of mislabeling it
  as "orphan ... unknown device".

Co-Authored-By: deepseek-v4-pro

server/go/cmd/main.go

@@ -146,6 +146,11 @@ func (h *MyHandler) OnReceive(ctx *connection.Context, data []byte) {
 		// overlay learns to render arbitrary BGRA images. Drop silently for
 		// now; the standard IDC_* index (data[10] of every frame header) is
 		// what we actually use right now.
+	case protocol.CmdSockDllLoader:
+		// SOCKET_DLLLOADER (210): the shellcode / memory-DLL loader asks for the
+		// full DLL payload before it can load the client. Serving it is the MFC
+		// 主控端's job (server/2015Remote SendServerDll); this web device port has
+		// no payload to hand out, so drop it silently instead of logging "Unhandled".
 	default:
 		// Other commands are not implemented yet
 		h.log.Info("Unhandled command %d from client %d", cmd, ctx.ID)
@@ -290,10 +295,16 @@ func (h *MyHandler) handleTerminalStart(ctx *connection.Context, isPTY bool) {
 		return
 	}
 	if !h.hub.BindTerminalConn(devID, ctx, isPTY) {
-		// No pending session — this is a stale sub-conn (e.g. browser
-		// gave up and closed term_close already). Drop it.
-		h.log.Warn("orphan terminal sub-conn: device=%s conn=%d isPTY=%v",
-			devID, ctx.ID, isPTY)
+		// Either a stale sub-conn (no pending session — browser gave up and
+		// closed term_close already), or a hijack attempt from a source IP
+		// other than the device's login conn. Log the latter distinctly.
+		if mc := h.hub.MainConn(devID); mc != nil && mc.GetPeerIP() != ctx.GetPeerIP() {
+			h.log.Warn("terminal sub-conn rejected (foreign source IP): device=%s conn=%d src=%s want=%s",
+				devID, ctx.ID, ctx.GetPeerIP(), mc.GetPeerIP())
+		} else {
+			h.log.Warn("orphan terminal sub-conn: device=%s conn=%d isPTY=%v",
+				devID, ctx.ID, isPTY)
+		}
 		ctx.Close()
 		return
 	}
@@ -326,9 +337,16 @@ func (h *MyHandler) handleBitmapInfo(ctx *connection.Context, data []byte) {
 	deviceID := strconv.FormatUint(clientID, 10)
 
 	if !h.hub.BindScreenConn(deviceID, ctx) {
-		// Device not registered — main login hasn't happened (or device just
-		// went offline). Drop the orphan sub-conn rather than leak it.
-		h.log.Warn("orphan screen sub-conn %d for unknown device %s; closing", ctx.ID, deviceID)
+		// A failed bind is either a plain orphan (device not registered, or it
+		// just went offline) or a hijack attempt — a sub-conn claiming a
+		// MasterID from a different source IP than the device's login conn.
+		// The latter is a security signal worth surfacing distinctly.
+		if mc := h.hub.MainConn(deviceID); mc != nil && mc.GetPeerIP() != ctx.GetPeerIP() {
+			h.log.Warn("screen sub-conn rejected (foreign source IP): device=%s conn=%d src=%s want=%s",
+				deviceID, ctx.ID, ctx.GetPeerIP(), mc.GetPeerIP())
+		} else {
+			h.log.Warn("orphan screen sub-conn %d for unknown device %s; closing", ctx.ID, deviceID)
+		}
 		ctx.Close()
 		return
 	}

server/go/protocol/commands.go

@@ -126,6 +126,7 @@ const (
 	TokenTerminalClose byte = 233 // TOKEN_TERMINAL_CLOSE - shell exited / close ack
 	TokenConnAuth      byte = 246 // TOKEN_CONN_AUTH - sub-connection identity handshake
 	CmdCursorImage     byte = 93  // CMD_CURSOR_IMAGE - custom cursor bitmap (Phase 5+ feature)
+	CmdSockDllLoader   byte = 210 // SOCKET_DLLLOADER - shellcode/memory-DLL loader requests the full DLL payload
 )
 
 // Sub-connection authentication (matches common/commands.h ConnAuth* structs).

server/go/server/tls.go

@@ -105,9 +105,9 @@ func (s *Server) wrapTLS(conn net.Conn) net.Conn {
 
 	bc := &bufferedConn{Conn: conn, r: br}
 	if isTLSClientHello(hdr) {
-		s.logger.Info("wrapTLS: TLS peer %s first6=%x", conn.RemoteAddr(), hdr)
+		s.logger.Debug("wrapTLS: TLS peer %s first6=%x", conn.RemoteAddr(), hdr)
 		return tls.Server(bc, s.tlsCfg)
 	}
-	s.logger.Info("wrapTLS: plaintext peer %s first6=%x", conn.RemoteAddr(), hdr)
+	s.logger.Debug("wrapTLS: plaintext peer %s first6=%x", conn.RemoteAddr(), hdr)
 	return bc
 }

server/go/web/ws_handlers.go

@@ -339,7 +339,7 @@ func (h *wsHub) handleConnect(c *wsClient, raw []byte) {
 		c.queue(mustJSON(map[string]any{"cmd": "connect_result", "ok": false, "msg": msg}))
 		return
 	}
-	h.log.Info("[timing] COMMAND_SCREEN_SPY sent to device=%s (cold start)", in.ID)
+	h.log.Debug("[timing] COMMAND_SCREEN_SPY sent to device=%s (cold start)", in.ID)
 
 	c.queue(mustJSON(map[string]any{"cmd": "connect_result", "ok": true}))
 }