mirror of
https://github.com/fatedier/frp.git
synced 2025-08-02 20:11:46 +00:00
Compare commits
1 Commits
v0.61.0
...
c064142501
| Author | SHA1 | Date | |
|---|---|---|---|
|
c064142501 |
2
.github/FUNDING.yml
vendored
2
.github/FUNDING.yml
vendored
@@ -1,4 +1,4 @@
|
||||
# These are supported funding model platforms
|
||||
|
||||
github: [fatedier]
|
||||
custom: ["https://afdian.com/a/fatedier"]
|
||||
custom: ["https://afdian.net/a/fatedier"]
|
||||
|
||||
4
.github/workflows/golangci-lint.yml
vendored
4
.github/workflows/golangci-lint.yml
vendored
@@ -17,13 +17,13 @@ jobs:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version: '1.23'
|
||||
go-version: '1.22'
|
||||
cache: false
|
||||
- name: golangci-lint
|
||||
uses: golangci/golangci-lint-action@v4
|
||||
with:
|
||||
# Optional: version of golangci-lint to use in form of v1.2 or v1.2.3 or `latest` to use the latest version
|
||||
version: v1.61
|
||||
version: v1.57
|
||||
|
||||
# Optional: golangci-lint command line arguments.
|
||||
# args: --issues-exit-code=0
|
||||
|
||||
2
.github/workflows/goreleaser.yml
vendored
2
.github/workflows/goreleaser.yml
vendored
@@ -15,7 +15,7 @@ jobs:
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version: '1.23'
|
||||
go-version: '1.22'
|
||||
|
||||
- name: Make All
|
||||
run: |
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
service:
|
||||
golangci-lint-version: 1.61.x # use the fixed version to not introduce new linters unexpectedly
|
||||
golangci-lint-version: 1.57.x # use the fixed version to not introduce new linters unexpectedly
|
||||
|
||||
run:
|
||||
concurrency: 4
|
||||
@@ -14,7 +14,7 @@ linters:
|
||||
enable:
|
||||
- unused
|
||||
- errcheck
|
||||
- copyloopvar
|
||||
- exportloopref
|
||||
- gocritic
|
||||
- gofumpt
|
||||
- goimports
|
||||
@@ -90,7 +90,6 @@ linters-settings:
|
||||
- G402
|
||||
- G404
|
||||
- G501
|
||||
- G115 # integer overflow conversion
|
||||
|
||||
issues:
|
||||
# List of regexps of issue texts to exclude, empty list by default.
|
||||
|
||||
@@ -2,7 +2,7 @@ export PATH := $(PATH):`go env GOPATH`/bin
|
||||
export GO111MODULE=on
|
||||
LDFLAGS := -s -w
|
||||
|
||||
os-archs=darwin:amd64 darwin:arm64 freebsd:amd64 linux:amd64 linux:arm:7 linux:arm:5 linux:arm64 windows:amd64 windows:arm64 linux:mips64 linux:mips64le linux:mips:softfloat linux:mipsle:softfloat linux:riscv64 linux:loong64 android:arm64
|
||||
os-archs=darwin:amd64 darwin:arm64 freebsd:amd64 linux:amd64 linux:arm:7 linux:arm:5 linux:arm64 windows:amd64 windows:arm64 linux:mips64 linux:mips64le linux:mips:softfloat linux:mipsle:softfloat linux:riscv64 android:arm64
|
||||
|
||||
all: build
|
||||
|
||||
|
||||
@@ -9,6 +9,11 @@
|
||||
|
||||
<h3 align="center">Gold Sponsors</h3>
|
||||
<!--gold sponsors start-->
|
||||
<p align="center">
|
||||
<a href="https://lokal.so/?utm_campaign=github_repo&utm_medium=referral&utm_content=frp&utm_source=github" target="_blank">
|
||||
<img width="420px" src="https://raw.githubusercontent.com/fatedier/frp/dev/doc/pic/sponsor_lokal.png">
|
||||
</a>
|
||||
</p>
|
||||
<p align="center">
|
||||
<a href="https://workos.com/?utm_campaign=github_repo&utm_medium=referral&utm_content=frp&utm_source=github" target="_blank">
|
||||
<img width="420px" src="https://raw.githubusercontent.com/fatedier/frp/dev/doc/pic/sponsor_workos.png">
|
||||
|
||||
@@ -11,6 +11,11 @@ frp 是一个专注于内网穿透的高性能的反向代理应用，支持 TCP
|
||||
|
||||
<h3 align="center">Gold Sponsors</h3>
|
||||
<!--gold sponsors start-->
|
||||
<p align="center">
|
||||
<a href="https://lokal.so/?utm_campaign=github_repo&utm_medium=referral&utm_content=frp&utm_source=github" target="_blank">
|
||||
<img width="420px" src="https://raw.githubusercontent.com/fatedier/frp/dev/doc/pic/sponsor_lokal.png">
|
||||
</a>
|
||||
</p>
|
||||
<p align="center">
|
||||
<a href="https://workos.com/?utm_campaign=github_repo&utm_medium=referral&utm_content=frp&utm_source=github" target="_blank">
|
||||
<img width="420px" src="https://raw.githubusercontent.com/fatedier/frp/dev/doc/pic/sponsor_workos.png">
|
||||
@@ -95,7 +100,7 @@ frp 是一个免费且开源的项目，我们欢迎任何人为其开发和进
|
||||
|
||||
您可以通过 [GitHub Sponsors](https://github.com/sponsors/fatedier) 赞助我们。
|
||||
|
||||
国内用户可以通过 [爱发电](https://afdian.com/a/fatedier) 赞助我们。
|
||||
国内用户可以通过 [爱发电](https://afdian.net/a/fatedier) 赞助我们。
|
||||
|
||||
企业赞助者可以将贵公司的 Logo 以及链接放置在项目 README 文件中。
|
||||
|
||||
|
||||
@@ -1,4 +1,3 @@
|
||||
### Features
|
||||
|
||||
* The frpc visitor command-line parameter adds the `--server-user` option to specify the username of the server-side proxy to connect to.
|
||||
* Support multiple frpc instances with different subjects when using oidc authentication.
|
||||
* Added a new plugin `tls2raw`: Enables TLS termination and forwarding of decrypted raw traffic to local service.
|
||||
|
||||
@@ -230,7 +230,7 @@ func (ctl *Control) registerMsgHandlers() {
|
||||
ctl.msgDispatcher.RegisterHandler(&msg.Pong{}, ctl.handlePong)
|
||||
}
|
||||
|
||||
// heartbeatWorker sends heartbeat to server and check heartbeat timeout.
|
||||
// headerWorker sends heartbeat to server and check heartbeat timeout.
|
||||
func (ctl *Control) heartbeatWorker() {
|
||||
xl := ctl.xl
|
||||
|
||||
|
||||
@@ -137,7 +137,7 @@ func (pw *Wrapper) SetRunningStatus(remoteAddr string, respErr string) error {
|
||||
pw.Phase = ProxyPhaseStartErr
|
||||
pw.Err = respErr
|
||||
pw.lastStartErr = time.Now()
|
||||
return fmt.Errorf("%s", pw.Err)
|
||||
return fmt.Errorf(pw.Err)
|
||||
}
|
||||
|
||||
if err := pw.pxy.Run(); err != nil {
|
||||
|
||||
@@ -169,15 +169,6 @@ func (svr *Service) Run(ctx context.Context) error {
|
||||
netpkg.SetDefaultDNSAddress(svr.common.DNSServer)
|
||||
}
|
||||
|
||||
if svr.webServer != nil {
|
||||
go func() {
|
||||
log.Infof("admin server listen on %s", svr.webServer.Address())
|
||||
if err := svr.webServer.Run(); err != nil {
|
||||
log.Warnf("admin server exit with error: %v", err)
|
||||
}
|
||||
}()
|
||||
}
|
||||
|
||||
// first login to frps
|
||||
svr.loopLoginUntilSuccess(10*time.Second, lo.FromPtr(svr.common.LoginFailExit))
|
||||
if svr.ctl == nil {
|
||||
@@ -188,6 +179,14 @@ func (svr *Service) Run(ctx context.Context) error {
|
||||
|
||||
go svr.keepControllerWorking()
|
||||
|
||||
if svr.webServer != nil {
|
||||
go func() {
|
||||
log.Infof("admin server listen on %s", svr.webServer.Address())
|
||||
if err := svr.webServer.Run(); err != nil {
|
||||
log.Warnf("admin server exit with error: %v", err)
|
||||
}
|
||||
}()
|
||||
}
|
||||
<-svr.ctx.Done()
|
||||
svr.stop()
|
||||
return nil
|
||||
|
||||
@@ -15,11 +15,9 @@
|
||||
package sub
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"os"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/rodaine/table"
|
||||
"github.com/spf13/cobra"
|
||||
@@ -29,24 +27,24 @@ import (
|
||||
clientsdk "github.com/fatedier/frp/pkg/sdk/client"
|
||||
)
|
||||
|
||||
var adminAPITimeout = 30 * time.Second
|
||||
|
||||
func init() {
|
||||
commands := []struct {
|
||||
name string
|
||||
description string
|
||||
handler func(*v1.ClientCommonConfig) error
|
||||
}{
|
||||
{"reload", "Hot-Reload frpc configuration", ReloadHandler},
|
||||
{"status", "Overview of all proxies status", StatusHandler},
|
||||
{"stop", "Stop the running frpc", StopHandler},
|
||||
}
|
||||
rootCmd.AddCommand(NewAdminCommand(
|
||||
"reload",
|
||||
"Hot-Reload frpc configuration",
|
||||
ReloadHandler,
|
||||
))
|
||||
|
||||
for _, cmdConfig := range commands {
|
||||
cmd := NewAdminCommand(cmdConfig.name, cmdConfig.description, cmdConfig.handler)
|
||||
cmd.Flags().DurationVar(&adminAPITimeout, "api-timeout", adminAPITimeout, "Timeout for admin API calls")
|
||||
rootCmd.AddCommand(cmd)
|
||||
}
|
||||
rootCmd.AddCommand(NewAdminCommand(
|
||||
"status",
|
||||
"Overview of all proxies status",
|
||||
StatusHandler,
|
||||
))
|
||||
|
||||
rootCmd.AddCommand(NewAdminCommand(
|
||||
"stop",
|
||||
"Stop the running frpc",
|
||||
StopHandler,
|
||||
))
|
||||
}
|
||||
|
||||
func NewAdminCommand(name, short string, handler func(*v1.ClientCommonConfig) error) *cobra.Command {
|
||||
@@ -75,9 +73,7 @@ func NewAdminCommand(name, short string, handler func(*v1.ClientCommonConfig) er
|
||||
func ReloadHandler(clientCfg *v1.ClientCommonConfig) error {
|
||||
client := clientsdk.New(clientCfg.WebServer.Addr, clientCfg.WebServer.Port)
|
||||
client.SetAuth(clientCfg.WebServer.User, clientCfg.WebServer.Password)
|
||||
ctx, cancel := context.WithTimeout(context.Background(), adminAPITimeout)
|
||||
defer cancel()
|
||||
if err := client.Reload(ctx, strictConfigMode); err != nil {
|
||||
if err := client.Reload(strictConfigMode); err != nil {
|
||||
return err
|
||||
}
|
||||
fmt.Println("reload success")
|
||||
@@ -87,9 +83,7 @@ func ReloadHandler(clientCfg *v1.ClientCommonConfig) error {
|
||||
func StatusHandler(clientCfg *v1.ClientCommonConfig) error {
|
||||
client := clientsdk.New(clientCfg.WebServer.Addr, clientCfg.WebServer.Port)
|
||||
client.SetAuth(clientCfg.WebServer.User, clientCfg.WebServer.Password)
|
||||
ctx, cancel := context.WithTimeout(context.Background(), adminAPITimeout)
|
||||
defer cancel()
|
||||
res, err := client.GetAllProxyStatus(ctx)
|
||||
res, err := client.GetAllProxyStatus()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
@@ -115,9 +109,7 @@ func StatusHandler(clientCfg *v1.ClientCommonConfig) error {
|
||||
func StopHandler(clientCfg *v1.ClientCommonConfig) error {
|
||||
client := clientsdk.New(clientCfg.WebServer.Addr, clientCfg.WebServer.Port)
|
||||
client.SetAuth(clientCfg.WebServer.User, clientCfg.WebServer.Password)
|
||||
ctx, cancel := context.WithTimeout(context.Background(), adminAPITimeout)
|
||||
defer cancel()
|
||||
if err := client.Stop(ctx); err != nil {
|
||||
if err := client.Stop(); err != nil {
|
||||
return err
|
||||
}
|
||||
fmt.Println("stop success")
|
||||
|
||||
@@ -327,7 +327,7 @@ requestHeaders.set.x-from-where = "frp"
|
||||
|
||||
[[proxies]]
|
||||
name = "plugin_tls2raw"
|
||||
type = "tcp"
|
||||
type = "https"
|
||||
remotePort = 6008
|
||||
[proxies.plugin]
|
||||
type = "tls2raw"
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
FROM golang:1.23 AS building
|
||||
FROM golang:1.22 AS building
|
||||
|
||||
COPY . /building
|
||||
WORKDIR /building
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
FROM golang:1.23 AS building
|
||||
FROM golang:1.22 AS building
|
||||
|
||||
COPY . /building
|
||||
WORKDIR /building
|
||||
|
||||
7
go.mod
7
go.mod
@@ -23,7 +23,7 @@ require (
|
||||
github.com/spf13/pflag v1.0.5
|
||||
github.com/stretchr/testify v1.9.0
|
||||
github.com/tidwall/gjson v1.17.1
|
||||
github.com/xtaci/kcp-go/v5 v5.6.13
|
||||
github.com/xtaci/kcp-go/v5 v5.6.8
|
||||
golang.org/x/crypto v0.22.0
|
||||
golang.org/x/net v0.24.0
|
||||
golang.org/x/oauth2 v0.16.0
|
||||
@@ -59,8 +59,9 @@ require (
|
||||
github.com/prometheus/client_model v0.5.0 // indirect
|
||||
github.com/prometheus/common v0.48.0 // indirect
|
||||
github.com/prometheus/procfs v0.12.0 // indirect
|
||||
github.com/templexxx/cpu v0.1.1 // indirect
|
||||
github.com/templexxx/xorsimd v0.4.3 // indirect
|
||||
github.com/rogpeppe/go-internal v1.11.0 // indirect
|
||||
github.com/templexxx/cpu v0.1.0 // indirect
|
||||
github.com/templexxx/xorsimd v0.4.2 // indirect
|
||||
github.com/tidwall/match v1.1.1 // indirect
|
||||
github.com/tidwall/pretty v1.2.0 // indirect
|
||||
github.com/tjfoc/gmsm v1.4.1 // indirect
|
||||
|
||||
16
go.sum
16
go.sum
@@ -116,8 +116,8 @@ github.com/rivo/uniseg v0.2.0 h1:S1pD9weZBuJdFmowNwbpi7BJ8TNftyUImj/0WQi72jY=
|
||||
github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
|
||||
github.com/rodaine/table v1.2.0 h1:38HEnwK4mKSHQJIkavVj+bst1TEY7j9zhLMWu4QJrMA=
|
||||
github.com/rodaine/table v1.2.0/go.mod h1:wejb/q/Yd4T/SVmBSRMr7GCq3KlcZp3gyNYdLSBhkaE=
|
||||
github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
|
||||
github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
|
||||
github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
|
||||
github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA=
|
||||
github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
|
||||
github.com/samber/lo v1.39.0 h1:4gTz1wUhNYLhFSKl6O+8peW0v2F4BCY034GRpU9WnuA=
|
||||
github.com/samber/lo v1.39.0/go.mod h1:+m/ZKRl6ClXCE2Lgf3MsQlWfh4bn1bz6CXEOxnEXnEA=
|
||||
@@ -136,10 +136,10 @@ github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXl
|
||||
github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
|
||||
github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
|
||||
github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
|
||||
github.com/templexxx/cpu v0.1.1 h1:isxHaxBXpYFWnk2DReuKkigaZyrjs2+9ypIdGP4h+HI=
|
||||
github.com/templexxx/cpu v0.1.1/go.mod h1:w7Tb+7qgcAlIyX4NhLuDKt78AHA5SzPmq0Wj6HiEnnk=
|
||||
github.com/templexxx/xorsimd v0.4.3 h1:9AQTFHd7Bhk3dIT7Al2XeBX5DWOvsUPZCuhyAtNbHjU=
|
||||
github.com/templexxx/xorsimd v0.4.3/go.mod h1:oZQcD6RFDisW2Am58dSAGwwL6rHjbzrlu25VDqfWkQg=
|
||||
github.com/templexxx/cpu v0.1.0 h1:wVM+WIJP2nYaxVxqgHPD4wGA2aJ9rvrQRV8CvFzNb40=
|
||||
github.com/templexxx/cpu v0.1.0/go.mod h1:w7Tb+7qgcAlIyX4NhLuDKt78AHA5SzPmq0Wj6HiEnnk=
|
||||
github.com/templexxx/xorsimd v0.4.2 h1:ocZZ+Nvu65LGHmCLZ7OoCtg8Fx8jnHKK37SjvngUoVI=
|
||||
github.com/templexxx/xorsimd v0.4.2/go.mod h1:HgwaPoDREdi6OnULpSfxhzaiiSUY4Fi3JPn1wpt28NI=
|
||||
github.com/tidwall/gjson v1.17.1 h1:wlYEnwqAHgzmhNUFfw7Xalt2JzQvsMx2Se4PcoFCT/U=
|
||||
github.com/tidwall/gjson v1.17.1/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
|
||||
github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
|
||||
@@ -148,8 +148,8 @@ github.com/tidwall/pretty v1.2.0 h1:RWIZEg2iJ8/g6fDDYzMpobmaoGh5OLl4AXtGUGPcqCs=
|
||||
github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
|
||||
github.com/tjfoc/gmsm v1.4.1 h1:aMe1GlZb+0bLjn+cKTPEvvn9oUEBlJitaZiiBwsbgho=
|
||||
github.com/tjfoc/gmsm v1.4.1/go.mod h1:j4INPkHWMrhJb38G+J6W4Tw0AbuN8Thu3PbdVYhVcTE=
|
||||
github.com/xtaci/kcp-go/v5 v5.6.13 h1:FEjtz9+D4p8t2x4WjciGt/jsIuhlWjjgPCCWjrVR4Hk=
|
||||
github.com/xtaci/kcp-go/v5 v5.6.13/go.mod h1:75S1AKYYzNUSXIv30h+jPKJYZUwqpfvLshu63nCNSOM=
|
||||
github.com/xtaci/kcp-go/v5 v5.6.8 h1:jlI/0jAyjoOjT/SaGB58s4bQMJiNS41A2RKzR6TMWeI=
|
||||
github.com/xtaci/kcp-go/v5 v5.6.8/go.mod h1:oE9j2NVqAkuKO5o8ByKGch3vgVX3BNf8zqP8JiGq0bM=
|
||||
github.com/xtaci/lossyconn v0.0.0-20200209145036-adba10fffc37 h1:EWU6Pktpas0n8lLQwDsRyZfmkPeRbdgPtW609es+/9E=
|
||||
github.com/xtaci/lossyconn v0.0.0-20200209145036-adba10fffc37/go.mod h1:HpMP7DB2CyokmAh4lp0EQnnWhmycP/TvwBGzvuie+H0=
|
||||
github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
|
||||
|
||||
@@ -18,7 +18,7 @@ rm -rf ./release/packages
|
||||
mkdir -p ./release/packages
|
||||
|
||||
os_all='linux windows darwin freebsd android'
|
||||
arch_all='386 amd64 arm arm64 mips64 mips64le mips mipsle riscv64 loong64'
|
||||
arch_all='386 amd64 arm arm64 mips64 mips64le mips mipsle riscv64'
|
||||
extra_all='_ hf'
|
||||
|
||||
cd ./release
|
||||
|
||||
@@ -50,8 +50,7 @@ func NewAuthVerifier(cfg v1.AuthServerConfig) (authVerifier Verifier) {
|
||||
case v1.AuthMethodToken:
|
||||
authVerifier = NewTokenAuth(cfg.AdditionalScopes, cfg.Token)
|
||||
case v1.AuthMethodOIDC:
|
||||
tokenVerifier := NewTokenVerifier(cfg.OIDC)
|
||||
authVerifier = NewOidcAuthVerifier(cfg.AdditionalScopes, tokenVerifier)
|
||||
authVerifier = NewOidcAuthVerifier(cfg.AdditionalScopes, cfg.OIDC)
|
||||
}
|
||||
return authVerifier
|
||||
}
|
||||
|
||||
@@ -87,18 +87,14 @@ func (auth *OidcAuthProvider) SetNewWorkConn(newWorkConnMsg *msg.NewWorkConn) (e
|
||||
return err
|
||||
}
|
||||
|
||||
type TokenVerifier interface {
|
||||
Verify(context.Context, string) (*oidc.IDToken, error)
|
||||
}
|
||||
|
||||
type OidcAuthConsumer struct {
|
||||
additionalAuthScopes []v1.AuthScope
|
||||
|
||||
verifier TokenVerifier
|
||||
subjectsFromLogin []string
|
||||
verifier *oidc.IDTokenVerifier
|
||||
subjectFromLogin string
|
||||
}
|
||||
|
||||
func NewTokenVerifier(cfg v1.AuthOIDCServerConfig) TokenVerifier {
|
||||
func NewOidcAuthVerifier(additionalAuthScopes []v1.AuthScope, cfg v1.AuthOIDCServerConfig) *OidcAuthConsumer {
|
||||
provider, err := oidc.NewProvider(context.Background(), cfg.Issuer)
|
||||
if err != nil {
|
||||
panic(err)
|
||||
@@ -109,14 +105,9 @@ func NewTokenVerifier(cfg v1.AuthOIDCServerConfig) TokenVerifier {
|
||||
SkipExpiryCheck: cfg.SkipExpiryCheck,
|
||||
SkipIssuerCheck: cfg.SkipIssuerCheck,
|
||||
}
|
||||
return provider.Verifier(&verifierConf)
|
||||
}
|
||||
|
||||
func NewOidcAuthVerifier(additionalAuthScopes []v1.AuthScope, verifier TokenVerifier) *OidcAuthConsumer {
|
||||
return &OidcAuthConsumer{
|
||||
additionalAuthScopes: additionalAuthScopes,
|
||||
verifier: verifier,
|
||||
subjectsFromLogin: []string{},
|
||||
verifier: provider.Verifier(&verifierConf),
|
||||
}
|
||||
}
|
||||
|
||||
@@ -125,9 +116,7 @@ func (auth *OidcAuthConsumer) VerifyLogin(loginMsg *msg.Login) (err error) {
|
||||
if err != nil {
|
||||
return fmt.Errorf("invalid OIDC token in login: %v", err)
|
||||
}
|
||||
if !slices.Contains(auth.subjectsFromLogin, token.Subject) {
|
||||
auth.subjectsFromLogin = append(auth.subjectsFromLogin, token.Subject)
|
||||
}
|
||||
auth.subjectFromLogin = token.Subject
|
||||
return nil
|
||||
}
|
||||
|
||||
@@ -136,11 +125,11 @@ func (auth *OidcAuthConsumer) verifyPostLoginToken(privilegeKey string) (err err
|
||||
if err != nil {
|
||||
return fmt.Errorf("invalid OIDC token in ping: %v", err)
|
||||
}
|
||||
if !slices.Contains(auth.subjectsFromLogin, token.Subject) {
|
||||
if token.Subject != auth.subjectFromLogin {
|
||||
return fmt.Errorf("received different OIDC subject in login and ping. "+
|
||||
"original subjects: %s, "+
|
||||
"original subject: %s, "+
|
||||
"new subject: %s",
|
||||
auth.subjectsFromLogin, token.Subject)
|
||||
auth.subjectFromLogin, token.Subject)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
@@ -1,64 +0,0 @@
|
||||
package auth_test
|
||||
|
||||
import (
|
||||
"context"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/coreos/go-oidc/v3/oidc"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/fatedier/frp/pkg/auth"
|
||||
v1 "github.com/fatedier/frp/pkg/config/v1"
|
||||
"github.com/fatedier/frp/pkg/msg"
|
||||
)
|
||||
|
||||
type mockTokenVerifier struct{}
|
||||
|
||||
func (m *mockTokenVerifier) Verify(ctx context.Context, subject string) (*oidc.IDToken, error) {
|
||||
return &oidc.IDToken{
|
||||
Subject: subject,
|
||||
}, nil
|
||||
}
|
||||
|
||||
func TestPingWithEmptySubjectFromLoginFails(t *testing.T) {
|
||||
r := require.New(t)
|
||||
consumer := auth.NewOidcAuthVerifier([]v1.AuthScope{v1.AuthScopeHeartBeats}, &mockTokenVerifier{})
|
||||
err := consumer.VerifyPing(&msg.Ping{
|
||||
PrivilegeKey: "ping-without-login",
|
||||
Timestamp: time.Now().UnixMilli(),
|
||||
})
|
||||
r.Error(err)
|
||||
r.Contains(err.Error(), "received different OIDC subject in login and ping")
|
||||
}
|
||||
|
||||
func TestPingAfterLoginWithNewSubjectSucceeds(t *testing.T) {
|
||||
r := require.New(t)
|
||||
consumer := auth.NewOidcAuthVerifier([]v1.AuthScope{v1.AuthScopeHeartBeats}, &mockTokenVerifier{})
|
||||
err := consumer.VerifyLogin(&msg.Login{
|
||||
PrivilegeKey: "ping-after-login",
|
||||
})
|
||||
r.NoError(err)
|
||||
|
||||
err = consumer.VerifyPing(&msg.Ping{
|
||||
PrivilegeKey: "ping-after-login",
|
||||
Timestamp: time.Now().UnixMilli(),
|
||||
})
|
||||
r.NoError(err)
|
||||
}
|
||||
|
||||
func TestPingAfterLoginWithDifferentSubjectFails(t *testing.T) {
|
||||
r := require.New(t)
|
||||
consumer := auth.NewOidcAuthVerifier([]v1.AuthScope{v1.AuthScopeHeartBeats}, &mockTokenVerifier{})
|
||||
err := consumer.VerifyLogin(&msg.Login{
|
||||
PrivilegeKey: "login-with-first-subject",
|
||||
})
|
||||
r.NoError(err)
|
||||
|
||||
err = consumer.VerifyPing(&msg.Ping{
|
||||
PrivilegeKey: "ping-with-different-subject",
|
||||
Timestamp: time.Now().UnixMilli(),
|
||||
})
|
||||
r.Error(err)
|
||||
r.Contains(err.Error(), "received different OIDC subject in login and ping")
|
||||
}
|
||||
@@ -140,7 +140,6 @@ func registerVisitorBaseConfigFlags(cmd *cobra.Command, c *v1.VisitorBaseConfig,
|
||||
cmd.Flags().BoolVarP(&c.Transport.UseCompression, "uc", "", false, "use compression")
|
||||
cmd.Flags().StringVarP(&c.SecretKey, "sk", "", "", "secret key")
|
||||
cmd.Flags().StringVarP(&c.ServerName, "server_name", "", "", "server name")
|
||||
cmd.Flags().StringVarP(&c.ServerUser, "server-user", "", "", "server user")
|
||||
cmd.Flags().StringVarP(&c.BindAddr, "bind_addr", "", "", "bind addr")
|
||||
cmd.Flags().IntVarP(&c.BindPort, "bind_port", "", 0, "bind port")
|
||||
}
|
||||
|
||||
@@ -159,18 +159,18 @@ func NewPortsRangeSliceFromString(str string) ([]PortsRange, error) {
|
||||
out = append(out, PortsRange{Single: int(singleNum)})
|
||||
case 2:
|
||||
// range numbers
|
||||
minNum, err := strconv.ParseInt(strings.TrimSpace(numArray[0]), 10, 64)
|
||||
min, err := strconv.ParseInt(strings.TrimSpace(numArray[0]), 10, 64)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("range number is invalid, %v", err)
|
||||
}
|
||||
maxNum, err := strconv.ParseInt(strings.TrimSpace(numArray[1]), 10, 64)
|
||||
max, err := strconv.ParseInt(strings.TrimSpace(numArray[1]), 10, 64)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("range number is invalid, %v", err)
|
||||
}
|
||||
if maxNum < minNum {
|
||||
if max < min {
|
||||
return nil, fmt.Errorf("range number is invalid")
|
||||
}
|
||||
out = append(out, PortsRange{Start: int(minNum), End: int(maxNum)})
|
||||
out = append(out, PortsRange{Start: int(min), End: int(max)})
|
||||
default:
|
||||
return nil, fmt.Errorf("range number is invalid")
|
||||
}
|
||||
|
||||
@@ -78,9 +78,9 @@ func ListAllLocalIPs() ([]net.IP, error) {
|
||||
return ips, nil
|
||||
}
|
||||
|
||||
func ListLocalIPsForNatHole(maxItems int) ([]string, error) {
|
||||
if maxItems <= 0 {
|
||||
return nil, fmt.Errorf("maxItems must be greater than 0")
|
||||
func ListLocalIPsForNatHole(max int) ([]string, error) {
|
||||
if max <= 0 {
|
||||
return nil, fmt.Errorf("max must be greater than 0")
|
||||
}
|
||||
|
||||
ips, err := ListAllLocalIPs()
|
||||
@@ -88,9 +88,9 @@ func ListLocalIPsForNatHole(maxItems int) ([]string, error) {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
filtered := make([]string, 0, maxItems)
|
||||
filtered := make([]string, 0, max)
|
||||
for _, ip := range ips {
|
||||
if len(filtered) >= maxItems {
|
||||
if len(filtered) >= max {
|
||||
break
|
||||
}
|
||||
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
package client
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io"
|
||||
@@ -32,8 +31,8 @@ func (c *Client) SetAuth(user, pwd string) {
|
||||
c.authPwd = pwd
|
||||
}
|
||||
|
||||
func (c *Client) GetProxyStatus(ctx context.Context, name string) (*client.ProxyStatusResp, error) {
|
||||
req, err := http.NewRequestWithContext(ctx, "GET", "http://"+c.address+"/api/status", nil)
|
||||
func (c *Client) GetProxyStatus(name string) (*client.ProxyStatusResp, error) {
|
||||
req, err := http.NewRequest("GET", "http://"+c.address+"/api/status", nil)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
@@ -55,8 +54,8 @@ func (c *Client) GetProxyStatus(ctx context.Context, name string) (*client.Proxy
|
||||
return nil, fmt.Errorf("no proxy status found")
|
||||
}
|
||||
|
||||
func (c *Client) GetAllProxyStatus(ctx context.Context) (client.StatusResp, error) {
|
||||
req, err := http.NewRequestWithContext(ctx, "GET", "http://"+c.address+"/api/status", nil)
|
||||
func (c *Client) GetAllProxyStatus() (client.StatusResp, error) {
|
||||
req, err := http.NewRequest("GET", "http://"+c.address+"/api/status", nil)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
@@ -71,7 +70,7 @@ func (c *Client) GetAllProxyStatus(ctx context.Context) (client.StatusResp, erro
|
||||
return allStatus, nil
|
||||
}
|
||||
|
||||
func (c *Client) Reload(ctx context.Context, strictMode bool) error {
|
||||
func (c *Client) Reload(strictMode bool) error {
|
||||
v := url.Values{}
|
||||
if strictMode {
|
||||
v.Set("strictConfig", "true")
|
||||
@@ -80,7 +79,7 @@ func (c *Client) Reload(ctx context.Context, strictMode bool) error {
|
||||
if len(v) > 0 {
|
||||
queryStr = "?" + v.Encode()
|
||||
}
|
||||
req, err := http.NewRequestWithContext(ctx, "GET", "http://"+c.address+"/api/reload"+queryStr, nil)
|
||||
req, err := http.NewRequest("GET", "http://"+c.address+"/api/reload"+queryStr, nil)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
@@ -88,8 +87,8 @@ func (c *Client) Reload(ctx context.Context, strictMode bool) error {
|
||||
return err
|
||||
}
|
||||
|
||||
func (c *Client) Stop(ctx context.Context) error {
|
||||
req, err := http.NewRequestWithContext(ctx, "POST", "http://"+c.address+"/api/stop", nil)
|
||||
func (c *Client) Stop() error {
|
||||
req, err := http.NewRequest("POST", "http://"+c.address+"/api/stop", nil)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
@@ -97,16 +96,16 @@ func (c *Client) Stop(ctx context.Context) error {
|
||||
return err
|
||||
}
|
||||
|
||||
func (c *Client) GetConfig(ctx context.Context) (string, error) {
|
||||
req, err := http.NewRequestWithContext(ctx, "GET", "http://"+c.address+"/api/config", nil)
|
||||
func (c *Client) GetConfig() (string, error) {
|
||||
req, err := http.NewRequest("GET", "http://"+c.address+"/api/config", nil)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
return c.do(req)
|
||||
}
|
||||
|
||||
func (c *Client) UpdateConfig(ctx context.Context, content string) error {
|
||||
req, err := http.NewRequestWithContext(ctx, "PUT", "http://"+c.address+"/api/config", strings.NewReader(content))
|
||||
func (c *Client) UpdateConfig(content string) error {
|
||||
req, err := http.NewRequest("PUT", "http://"+c.address+"/api/config", strings.NewReader(content))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
@@ -85,21 +85,21 @@ func ParseRangeNumbers(rangeStr string) (numbers []int64, err error) {
|
||||
numbers = append(numbers, singleNum)
|
||||
case 2:
|
||||
// range numbers
|
||||
minValue, errRet := strconv.ParseInt(strings.TrimSpace(numArray[0]), 10, 64)
|
||||
min, errRet := strconv.ParseInt(strings.TrimSpace(numArray[0]), 10, 64)
|
||||
if errRet != nil {
|
||||
err = fmt.Errorf("range number is invalid, %v", errRet)
|
||||
return
|
||||
}
|
||||
maxValue, errRet := strconv.ParseInt(strings.TrimSpace(numArray[1]), 10, 64)
|
||||
max, errRet := strconv.ParseInt(strings.TrimSpace(numArray[1]), 10, 64)
|
||||
if errRet != nil {
|
||||
err = fmt.Errorf("range number is invalid, %v", errRet)
|
||||
return
|
||||
}
|
||||
if maxValue < minValue {
|
||||
if max < min {
|
||||
err = fmt.Errorf("range number is invalid")
|
||||
return
|
||||
}
|
||||
for i := minValue; i <= maxValue; i++ {
|
||||
for i := min; i <= max; i++ {
|
||||
numbers = append(numbers, i)
|
||||
}
|
||||
default:
|
||||
@@ -118,13 +118,13 @@ func GenerateResponseErrorString(summary string, err error, detailed bool) strin
|
||||
}
|
||||
|
||||
func RandomSleep(duration time.Duration, minRatio, maxRatio float64) time.Duration {
|
||||
minValue := int64(minRatio * 1000.0)
|
||||
maxValue := int64(maxRatio * 1000.0)
|
||||
min := int64(minRatio * 1000.0)
|
||||
max := int64(maxRatio * 1000.0)
|
||||
var n int64
|
||||
if maxValue <= minValue {
|
||||
n = minValue
|
||||
if max <= min {
|
||||
n = min
|
||||
} else {
|
||||
n = mathrand.Int64N(maxValue-minValue) + minValue
|
||||
n = mathrand.Int64N(max-min) + min
|
||||
}
|
||||
d := duration * time.Duration(n) / time.Duration(1000)
|
||||
time.Sleep(d)
|
||||
|
||||
@@ -14,7 +14,7 @@
|
||||
|
||||
package version
|
||||
|
||||
var version = "0.61.0"
|
||||
var version = "0.59.0"
|
||||
|
||||
func Full() string {
|
||||
return version
|
||||
|
||||
@@ -137,17 +137,17 @@ func (pxy *BaseProxy) GetWorkConnFromPool(src, dst net.Addr) (workConn net.Conn,
|
||||
dstAddr string
|
||||
srcPortStr string
|
||||
dstPortStr string
|
||||
srcPort uint64
|
||||
dstPort uint64
|
||||
srcPort int
|
||||
dstPort int
|
||||
)
|
||||
|
||||
if src != nil {
|
||||
srcAddr, srcPortStr, _ = net.SplitHostPort(src.String())
|
||||
srcPort, _ = strconv.ParseUint(srcPortStr, 10, 16)
|
||||
srcPort, _ = strconv.Atoi(srcPortStr)
|
||||
}
|
||||
if dst != nil {
|
||||
dstAddr, dstPortStr, _ = net.SplitHostPort(dst.String())
|
||||
dstPort, _ = strconv.ParseUint(dstPortStr, 10, 16)
|
||||
dstPort, _ = strconv.Atoi(dstPortStr)
|
||||
}
|
||||
err := msg.WriteMsg(workConn, &msg.StartWorkConn{
|
||||
ProxyName: pxy.GetName(),
|
||||
@@ -190,8 +190,8 @@ func (pxy *BaseProxy) startCommonTCPListenersHandler() {
|
||||
} else {
|
||||
tempDelay *= 2
|
||||
}
|
||||
if maxTime := 1 * time.Second; tempDelay > maxTime {
|
||||
tempDelay = maxTime
|
||||
if max := 1 * time.Second; tempDelay > max {
|
||||
tempDelay = max
|
||||
}
|
||||
xl.Infof("met temporary error: %s, sleep for %s ...", err, tempDelay)
|
||||
time.Sleep(tempDelay)
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
package basic
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"strconv"
|
||||
"strings"
|
||||
@@ -55,7 +54,7 @@ var _ = ginkgo.Describe("[Feature: ClientManage]", func() {
|
||||
framework.NewRequestExpect(f).Port(p3Port).Ensure()
|
||||
|
||||
client := f.APIClientForFrpc(adminPort)
|
||||
conf, err := client.GetConfig(context.Background())
|
||||
conf, err := client.GetConfig()
|
||||
framework.ExpectNoError(err)
|
||||
|
||||
newP2Port := f.AllocPort()
|
||||
@@ -66,10 +65,10 @@ var _ = ginkgo.Describe("[Feature: ClientManage]", func() {
|
||||
newClientConf = newClientConf[:p3Index]
|
||||
}
|
||||
|
||||
err = client.UpdateConfig(context.Background(), newClientConf)
|
||||
err = client.UpdateConfig(newClientConf)
|
||||
framework.ExpectNoError(err)
|
||||
|
||||
err = client.Reload(context.Background(), true)
|
||||
err = client.Reload(true)
|
||||
framework.ExpectNoError(err)
|
||||
time.Sleep(time.Second)
|
||||
|
||||
@@ -121,7 +120,7 @@ var _ = ginkgo.Describe("[Feature: ClientManage]", func() {
|
||||
framework.NewRequestExpect(f).Port(testPort).Ensure()
|
||||
|
||||
client := f.APIClientForFrpc(adminPort)
|
||||
err := client.Stop(context.Background())
|
||||
err := client.Stop()
|
||||
framework.ExpectNoError(err)
|
||||
|
||||
time.Sleep(3 * time.Second)
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
package basic
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"net"
|
||||
"strconv"
|
||||
@@ -102,7 +101,7 @@ var _ = ginkgo.Describe("[Feature: Server Manager]", func() {
|
||||
client := f.APIClientForFrpc(adminPort)
|
||||
|
||||
// tcp random port
|
||||
status, err := client.GetProxyStatus(context.Background(), "tcp")
|
||||
status, err := client.GetProxyStatus("tcp")
|
||||
framework.ExpectNoError(err)
|
||||
|
||||
_, portStr, err := net.SplitHostPort(status.RemoteAddr)
|
||||
@@ -113,7 +112,7 @@ var _ = ginkgo.Describe("[Feature: Server Manager]", func() {
|
||||
framework.NewRequestExpect(f).Port(port).Ensure()
|
||||
|
||||
// udp random port
|
||||
status, err = client.GetProxyStatus(context.Background(), "udp")
|
||||
status, err = client.GetProxyStatus("udp")
|
||||
framework.ExpectNoError(err)
|
||||
|
||||
_, portStr, err = net.SplitHostPort(status.RemoteAddr)
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
package basic
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"strconv"
|
||||
"strings"
|
||||
@@ -58,7 +57,7 @@ var _ = ginkgo.Describe("[Feature: ClientManage]", func() {
|
||||
framework.NewRequestExpect(f).Port(p3Port).Ensure()
|
||||
|
||||
client := f.APIClientForFrpc(adminPort)
|
||||
conf, err := client.GetConfig(context.Background())
|
||||
conf, err := client.GetConfig()
|
||||
framework.ExpectNoError(err)
|
||||
|
||||
newP2Port := f.AllocPort()
|
||||
@@ -69,10 +68,10 @@ var _ = ginkgo.Describe("[Feature: ClientManage]", func() {
|
||||
newClientConf = newClientConf[:p3Index]
|
||||
}
|
||||
|
||||
err = client.UpdateConfig(context.Background(), newClientConf)
|
||||
err = client.UpdateConfig(newClientConf)
|
||||
framework.ExpectNoError(err)
|
||||
|
||||
err = client.Reload(context.Background(), true)
|
||||
err = client.Reload(true)
|
||||
framework.ExpectNoError(err)
|
||||
time.Sleep(time.Second)
|
||||
|
||||
@@ -125,7 +124,7 @@ var _ = ginkgo.Describe("[Feature: ClientManage]", func() {
|
||||
framework.NewRequestExpect(f).Port(testPort).Ensure()
|
||||
|
||||
client := f.APIClientForFrpc(adminPort)
|
||||
err := client.Stop(context.Background())
|
||||
err := client.Stop()
|
||||
framework.ExpectNoError(err)
|
||||
|
||||
time.Sleep(3 * time.Second)
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
package basic
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
|
||||
"github.com/onsi/ginkgo/v2"
|
||||
@@ -73,7 +72,7 @@ var _ = ginkgo.Describe("[Feature: Config]", func() {
|
||||
|
||||
client := f.APIClientForFrpc(adminPort)
|
||||
checkProxyFn := func(name string, localPort, remotePort int) {
|
||||
status, err := client.GetProxyStatus(context.Background(), name)
|
||||
status, err := client.GetProxyStatus(name)
|
||||
framework.ExpectNoError(err)
|
||||
|
||||
framework.ExpectContainSubstring(status.LocalAddr, fmt.Sprintf(":%d", localPort))
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
package basic
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"net"
|
||||
"strconv"
|
||||
@@ -113,7 +112,7 @@ var _ = ginkgo.Describe("[Feature: Server Manager]", func() {
|
||||
client := f.APIClientForFrpc(adminPort)
|
||||
|
||||
// tcp random port
|
||||
status, err := client.GetProxyStatus(context.Background(), "tcp")
|
||||
status, err := client.GetProxyStatus("tcp")
|
||||
framework.ExpectNoError(err)
|
||||
|
||||
_, portStr, err := net.SplitHostPort(status.RemoteAddr)
|
||||
@@ -124,7 +123,7 @@ var _ = ginkgo.Describe("[Feature: Server Manager]", func() {
|
||||
framework.NewRequestExpect(f).Port(port).Ensure()
|
||||
|
||||
// udp random port
|
||||
status, err = client.GetProxyStatus(context.Background(), "udp")
|
||||
status, err = client.GetProxyStatus("udp")
|
||||
framework.ExpectNoError(err)
|
||||
|
||||
_, portStr, err = net.SplitHostPort(status.RemoteAddr)
|
||||
|
||||
Reference in New Issue
Block a user