fix: 修复RDP爆破高误报率问题 (#555)

- 移除 screen.go 中错误的认证结果覆盖逻辑
- 启用 NLA 协议的 ErrorCode 字段检测
- 添加 PubKeyAuth 验证确保认证真正成功
- 修复 io.go 中错误被静默忽略的问题
- 修复 socket.go/io.go 中可能导致 panic 的代码
- 修复 screen.go 中文件句柄泄漏和 log.Panic

mylib/grdp/protocol/nla/cssp.go

@@ -15,7 +15,7 @@ type TSRequest struct {
 	NegoTokens []NegoToken `asn1:"optional,explicit,tag:1"`
 	AuthInfo   []byte      `asn1:"optional,explicit,tag:2"`
 	PubKeyAuth []byte      `asn1:"optional,explicit,tag:3"`
-	//ErrorCode  int         `asn1:"optional,explicit,tag:4"`
+	ErrorCode  int         `asn1:"optional,explicit,tag:4"`
 }
 
 type TSCredentials struct {

mylib/grdp/protocol/tpkt/tpkt.go

@@ -317,9 +317,28 @@ func (t *TPKT) recvPubKeyInc(data []byte) error {
 		glog.Info("DecodeDERTRequest", err)
 		return err
 	}
+
+	// 检查服务器是否返回错误码（认证失败）
+	if tsreq.ErrorCode != 0 {
+		glog.Error("NLA authentication failed with error code:", tsreq.ErrorCode)
+		return fmt.Errorf("NLA auth failed: error code %d", tsreq.ErrorCode)
+	}
+
+	// 验证 PubKeyAuth 不为空（认证成功的标志）
+	if len(tsreq.PubKeyAuth) == 0 {
+		glog.Error("NLA authentication failed: empty PubKeyAuth")
+		return fmt.Errorf("NLA auth failed: empty PubKeyAuth")
+	}
+
 	glog.Trace("PubKeyAuth:", tsreq.PubKeyAuth)
-	//ignore
-	//pubkey := t.ntlmSec.GssDecrypt([]byte(tsreq.PubKeyAuth))
+
+	// 验证服务器返回的公钥（可选但推荐）
+	pubkey := t.ntlmSec.GssDecrypt(tsreq.PubKeyAuth)
+	if pubkey == nil {
+		glog.Error("NLA authentication failed: invalid PubKeyAuth signature")
+		return fmt.Errorf("NLA auth failed: invalid PubKeyAuth")
+	}
+
 	domain, username, password := t.ntlm.GetEncodedCredentials()
 	credentials := nla.EncodeDERTCredentials(domain, username, password)
 	authInfo := t.ntlmSec.GssEncrypt(credentials)