Documentation
¶
Index ¶
- func Handler(tunnel string, vhost, control, opsH http.Handler, st *httpStats, ...) (http.Handler, error)
- func NodeOnly(tunnel string) func(tls.ConnectionState) error
- func QUICCertificate(ctx context.Context, cfg config.Config, domains *Domains) (func(*tls.ClientHelloInfo) (*tls.Certificate, error), error)
- func Serve(ctx context.Context, cfg config.Config, policy []byte, filt edgeFilter, ...) error
- type Domains
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Handler ¶
func Handler(tunnel string, vhost, control, opsH http.Handler, st *httpStats, routed func(string) bool, lim *liveLimits) (http.Handler, error)
Handler sends the tunnel name to the ops API and frp control, and a host that routed reports to vhost, which is frps's site proxy in this process. Any other host gets no response at all. A nil routed passes every host to vhost. A nil lim uses the default limits; a nil control leaves frp control out.
func NodeOnly ¶
func NodeOnly(tunnel string) func(tls.ConnectionState) error
NodeOnly accepts a verified client certificate only when it carries a dark-node identity of tunnel: spiffe://<tunnel>/node/<name>. It guards frp control on TCP 443 and, through frps, on QUIC.
func QUICCertificate ¶
func QUICCertificate(ctx context.Context, cfg config.Config, domains *Domains) (func(*tls.ClientHelloInfo) (*tls.Certificate, error), error)
QUICCertificate is what frps presents on UDP 443, and only to the tunnel name: a probe naming anything else gets no certificate. It is the certmagic config TCP 443 uses, so both present the same certificate and a renewal on either is used by the other's next handshake.
func Serve ¶
func Serve(ctx context.Context, cfg config.Config, policy []byte, filt edgeFilter, domains *Domains, control, vhost http.Handler, apply ops.ApplyFunc, reboot func()) error
Serve runs the HTTP and HTTPS servers until ctx ends. policy is the policy.yml cfg holds, as stored; apply stores and applies a new one.
Types ¶
type Domains ¶
type Domains struct {
// contains filtered or unexported fields
}
Domains is the set of hostnames that currently have an HTTP route. frps reports a name when its first route appears and when its last route disappears. Under tls: acme, the first report of an exact name manages its certificate: loaded from disk, or obtained. certmagic's timer then checks it every renew_interval and renews it once it is due. The last report stops that; the certificate stays on disk.
func NewDomains ¶
func (*Domains) Allowed ¶
Allowed is the tunnel name, or an exact name a dark node currently has registered: the names that may have a certificate.
func (*Domains) Domain ¶
Domain is the frps vhost callback. added is true when the name gains its first route and false when it loses its last. frps calls it with its router lock held, so the obtain runs in the background.
Source Files