Documentation
¶
Index ¶
- func Handler(tunnel string, vhost, control, opsH http.Handler, st *httpStats, ...) (http.Handler, error)
- func NodeName(tunnel string) func(tls.ConnectionState) string
- func NodeOnly(tunnel string) func(tls.ConnectionState) error
- func ProxyError(r *http.Request, err error)
- func QUICCertificate(ctx context.Context, cfg config.Config, domains *Domains) (func(*tls.ClientHelloInfo) (*tls.Certificate, error), error)
- func Serve(ctx context.Context, cfg config.Config, policy []byte, filt edgeFilter, ...) error
- type Domains
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Handler ¶
func Handler(tunnel string, vhost, control, opsH http.Handler, st *httpStats, route func(string) (string, bool), lim *liveLimits) (http.Handler, error)
Handler sends the tunnel name to the ops API and frp control, and a host that route matches to vhost, which is frps's site proxy in this process. route returns the published name that routes host: host itself, or a wildcard. Any other host gets no response at all. A nil route passes every host to vhost as its own site. A nil st counts nothing; a nil lim uses the default limits; a nil control leaves frp control out.
func NodeName ¶ added in v0.3.0
func NodeName(tunnel string) func(tls.ConnectionState) string
NodeName names the dark node of a verified client certificate of tunnel: <name> of spiffe://<tunnel>/node/<name>, or "" for any other.
func NodeOnly ¶
func NodeOnly(tunnel string) func(tls.ConnectionState) error
NodeOnly accepts a verified client certificate only when it carries a dark-node identity of tunnel: spiffe://<tunnel>/node/<name>. It guards frp control on TCP 443 and, through frps, on QUIC.
func ProxyError ¶ added in v0.3.0
ProxyError is frps's error hook (OnProxyError): every request frps could not proxy, on the request's goroutine. It logs one line that says where it failed and for whom, and counts it for the site. frps then answers 502 or 504, or, when the body broke off, cuts the response.
func QUICCertificate ¶
func QUICCertificate(ctx context.Context, cfg config.Config, domains *Domains) (func(*tls.ClientHelloInfo) (*tls.Certificate, error), error)
QUICCertificate is what frps presents on UDP 443, and only to the tunnel name: a probe naming anything else gets no certificate. It is the certmagic config TCP 443 uses, so both present the same certificate and a renewal on either is used by the other's next handshake.
func Serve ¶
func Serve(ctx context.Context, cfg config.Config, policy []byte, filt edgeFilter, domains *Domains, control, vhost http.Handler, apply ops.ApplyFunc, reboot func(), tunnel func(*metrics.Writer)) error
Serve runs the HTTP and HTTPS servers until ctx ends. policy is the policy.yml cfg holds, as stored; apply stores and applies a new one. tunnel writes the tunnel's metrics, which frps counts.
Types ¶
type Domains ¶
type Domains struct {
// contains filtered or unexported fields
}
Domains is the set of hostnames that currently have an HTTP route. frps reports a name when its first route appears and when its last route disappears. Under tls: acme, the first report of an exact name manages its certificate: loaded from disk, or obtained. certmagic's timer then checks it every renew_interval and renews it once it is due. The last report stops that; the certificate stays on disk.
func NewDomains ¶
func (*Domains) Allowed ¶
Allowed is the tunnel name, or an exact name a dark node currently has registered: the names that may have a certificate.
func (*Domains) Domain ¶
Domain is the frps vhost callback. added is true when the name gains its first route and false when it loses its last. frps calls it with its router lock held, so the obtain runs in the background.
func (*Domains) Known ¶
Known is a name the edge answers for: the tunnel or a routed site. Anything else gets no certificate, no status code, and no bytes.
Source Files