Documentation
¶
Index ¶
- func Handler(tunnel string, vhost, control, opsH http.Handler, st *httpStats, ...) (http.Handler, error)
- func NodeName(tunnel string) func(tls.ConnectionState) string
- func NodeOnly(tunnel string) func(tls.ConnectionState) error
- func ProxyError(r *http.Request, err error)
- func QUICCertificate(ctx context.Context, cfg config.Config, domains *Domains) (func(*tls.ClientHelloInfo) (*tls.Certificate, error), error)
- func Serve(ctx context.Context, cfg config.Config, policy []byte, filt edgeFilter, ...) error
- type Domains
- func (d *Domains) Allowed(name string) bool
- func (d *Domains) CertStore() *certstore.Shared
- func (d *Domains) Domain(domain string, added bool)
- func (d *Domains) Known(name string) bool
- func (d *Domains) KnownHTTP(name string) bool
- func (d *Domains) Published() int
- func (d *Domains) Route(host string) (string, bool)
- func (d *Domains) Routed(host string) bool
- func (d *Domains) SetTunnelGrace(grace time.Duration)
- func (d *Domains) TCPDomain(domain string, added bool)
- func (d *Domains) TCPRoute(name string) bool
- func (d *Domains) TunnelCertValid(now time.Time) bool
- type Extras
- type TCPRoute
- type TCPRoutes
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Handler ¶
func Handler(tunnel string, vhost, control, opsH http.Handler, st *httpStats, route func(string) (string, bool), lim *liveLimits) (http.Handler, error)
Handler sends the tunnel name to the ops API and frp control, and a host that route matches to vhost, which is frps's site proxy in this process. route returns the published name that routes host: host itself, or a wildcard. Any other host gets no response at all. A nil route passes every host to vhost as its own site. A nil st counts nothing; a nil lim uses the default limits; a nil control leaves frp control out.
func NodeName ¶ added in v0.3.0
func NodeName(tunnel string) func(tls.ConnectionState) string
NodeName names the dark node of a verified client certificate of tunnel: <name> of spiffe://<tunnel>/node/<name>, or "" for any other.
func NodeOnly ¶
func NodeOnly(tunnel string) func(tls.ConnectionState) error
NodeOnly accepts a verified client certificate only when it carries a dark-node identity of tunnel: spiffe://<tunnel>/node/<name>. It guards frp control on TCP 443 and, through frps, on QUIC.
func ProxyError ¶ added in v0.3.0
ProxyError is frps's error hook (OnProxyError): every request frps could not proxy, on the request's goroutine. It logs one line that says where it failed and for whom, and counts it for the site. frps then answers 502 or 504, or, when the body broke off, cuts the response.
func QUICCertificate ¶
func QUICCertificate(ctx context.Context, cfg config.Config, domains *Domains) (func(*tls.ClientHelloInfo) (*tls.Certificate, error), error)
QUICCertificate is what frps presents on UDP 443, and only to the tunnel name: a probe naming anything else gets no certificate. It is the certmagic config TCP 443 uses, so both present the same certificate and a renewal on either is used by the other's next handshake.
func Serve ¶
func Serve(ctx context.Context, cfg config.Config, policy []byte, filt edgeFilter, domains *Domains, control, vhost http.Handler, routes TCPRoutes, apply ops.ApplyFunc, reboot func(), more Extras) error
Serve runs the HTTP and HTTPS servers until ctx ends, and the TCP routes on the HTTPS port. policy is the policy.yml cfg holds, as stored; apply stores and applies a new one.
Types ¶
type Domains ¶
type Domains struct {
// contains filtered or unexported fields
}
Domains is the set of hostnames that currently have an HTTP route or a TCP route: a name is one or the other, which frps decides. frps reports a name when its first route appears and when its last route disappears. Under tls: acme, the first report of an exact name manages its certificate: loaded from disk, or obtained. certmagic's timer then checks it every renew_interval and renews it once it is due. The last report stops that; the certificate stays on disk.
func NewDomains ¶
func (*Domains) Allowed ¶
Allowed is the tunnel name, or an exact name a dark node currently has registered: the names that may have a certificate.
func (*Domains) Domain ¶
Domain is the frps vhost callback. added is true when the name gains its first route and false when it loses its last. frps calls it with its router lock held, so the obtain runs in the background.
func (*Domains) Known ¶
Known is a name the edge answers TLS for: the tunnel, a routed site, or a TCP route. Anything else gets no certificate, no status code, and no bytes.
func (*Domains) KnownHTTP ¶ added in v0.7.0
KnownHTTP is a name the edge answers HTTP for: the tunnel or a routed site.
func (*Domains) Route ¶ added in v0.3.0
Route returns the published name frps routes host's HTTP by, matched the way its router matches: the exact name, then each wildcard parent down to three labels (a.b.example.com tries *.b.example.com, then *.example.com), then a catch-all "*". A name with a held certificate and no route is its own: frps finds no tunnel for it, and the request is answered 503.
func (*Domains) SetTunnelGrace ¶ added in v0.5.0
SetTunnelGrace sets how long a held name is answered (policy.yml's tunnel_grace).
func (*Domains) TCPDomain ¶ added in v0.7.0
TCPDomain is frps's callback for TCP routes, as Domain is for HTTP names. A TCP route's name has a certificate like any, and no HTTP route.
type Extras ¶ added in v0.4.0
type Extras struct {
Metrics []func(*metrics.Writer)
Status map[string]func() any
// Ready is whether the edge can serve: the status's ready and the
// fortressedge_ready metric. Nil is never ready.
Ready func() bool
}
Extras are what the rest of the edge adds to the ops API: metrics writers (the tunnel, the clock), and status keys with their values.
Source Files