Fix: Silence SOCKET_DLLLOADER log flood and tighten device-port logging

SOCKET_DLLLOADER (210) is the shellcode / memory-DLL loader asking the
server for the full DLL payload before it can load the client. The MFC
master console serves it via SendServerDll; the Go web device port has no
payload to hand out, so every memory-DLL client startup/reconnect fell
into the default dispatch branch and logged "Unhandled command 210",
flooding the log. Add a protocol constant and drop the command silently.

While auditing the device-port logging surface:

- Downgrade wrapTLS's per-connection hex-dump lines and the screen-spy
  "[timing]" cold-start line from Info to Debug (they fire once per TCP
  connection / screen view and are diagnostics, not operational events).

- Distinguish a sub-connection hijack attempt from a plain orphan: when a
  screen/terminal sub-conn claims a MasterID from a source IP other than
  the device's login conn, log a dedicated Warn instead of mislabeling it
  as "orphan ... unknown device".

Co-Authored-By: deepseek-v4-pro

server/go/cmd/main.go

@@ -146,6 +146,11 @@ func (h *MyHandler) OnReceive(ctx *connection.Context, data []byte) {
 		// overlay learns to render arbitrary BGRA images. Drop silently for
 		// now; the standard IDC_* index (data[10] of every frame header) is
 		// what we actually use right now.
+	case protocol.CmdSockDllLoader:
+		// SOCKET_DLLLOADER (210): the shellcode / memory-DLL loader asks for the
+		// full DLL payload before it can load the client. Serving it is the MFC
+		// 主控端's job (server/2015Remote SendServerDll); this web device port has
+		// no payload to hand out, so drop it silently instead of logging "Unhandled".
 	default:
 		// Other commands are not implemented yet
 		h.log.Info("Unhandled command %d from client %d", cmd, ctx.ID)
@@ -290,10 +295,16 @@ func (h *MyHandler) handleTerminalStart(ctx *connection.Context, isPTY bool) {
 		return
 	}
 	if !h.hub.BindTerminalConn(devID, ctx, isPTY) {
-		// No pending session — this is a stale sub-conn (e.g. browser
-		// gave up and closed term_close already). Drop it.
-		h.log.Warn("orphan terminal sub-conn: device=%s conn=%d isPTY=%v",
-			devID, ctx.ID, isPTY)
+		// Either a stale sub-conn (no pending session — browser gave up and
+		// closed term_close already), or a hijack attempt from a source IP
+		// other than the device's login conn. Log the latter distinctly.
+		if mc := h.hub.MainConn(devID); mc != nil && mc.GetPeerIP() != ctx.GetPeerIP() {
+			h.log.Warn("terminal sub-conn rejected (foreign source IP): device=%s conn=%d src=%s want=%s",
+				devID, ctx.ID, ctx.GetPeerIP(), mc.GetPeerIP())
+		} else {
+			h.log.Warn("orphan terminal sub-conn: device=%s conn=%d isPTY=%v",
+				devID, ctx.ID, isPTY)
+		}
 		ctx.Close()
 		return
 	}
@@ -326,9 +337,16 @@ func (h *MyHandler) handleBitmapInfo(ctx *connection.Context, data []byte) {
 	deviceID := strconv.FormatUint(clientID, 10)
 
 	if !h.hub.BindScreenConn(deviceID, ctx) {
-		// Device not registered — main login hasn't happened (or device just
-		// went offline). Drop the orphan sub-conn rather than leak it.
-		h.log.Warn("orphan screen sub-conn %d for unknown device %s; closing", ctx.ID, deviceID)
+		// A failed bind is either a plain orphan (device not registered, or it
+		// just went offline) or a hijack attempt — a sub-conn claiming a
+		// MasterID from a different source IP than the device's login conn.
+		// The latter is a security signal worth surfacing distinctly.
+		if mc := h.hub.MainConn(deviceID); mc != nil && mc.GetPeerIP() != ctx.GetPeerIP() {
+			h.log.Warn("screen sub-conn rejected (foreign source IP): device=%s conn=%d src=%s want=%s",
+				deviceID, ctx.ID, ctx.GetPeerIP(), mc.GetPeerIP())
+		} else {
+			h.log.Warn("orphan screen sub-conn %d for unknown device %s; closing", ctx.ID, deviceID)
+		}
 		ctx.Close()
 		return
 	}