Merge remote-tracking branch 'upstream/dev' into dev

# Conflicts:
#	.github/workflows/build-and-push-image.yml
#	cmd/frpc/sub/verify.go
#	go.mod
#	go.sum
#	pkg/util/version/version.go

pkg/util/net/conn.go

@@ -16,6 +16,7 @@ package net
 
 import (
 	"context"
+	"crypto/hkdf"
 	"crypto/sha256"
 	"errors"
 	"io"
@@ -25,7 +26,6 @@ import (
 
 	libcrypto "github.com/fatedier/golib/crypto"
 	quic "github.com/quic-go/quic-go"
-	"golang.org/x/crypto/hkdf"
 
 	"github.com/fatedier/frp/pkg/util/xlog"
 )
@@ -335,11 +335,6 @@ func deriveAEADControlKeys(key []byte, algorithm string, transcriptHash []byte)
 }
 
 func deriveAEADControlKey(key []byte, algorithm string, transcriptHash []byte, direction string) ([]byte, error) {
-	info := []byte(aeadControlHKDFInfoPrefix + " " + algorithm + " " + direction)
-	reader := hkdf.New(sha256.New, key, transcriptHash, info)
-	out := make([]byte, libcrypto.AEADKeySize)
-	if _, err := io.ReadFull(reader, out); err != nil {
-		return nil, err
-	}
-	return out, nil
+	info := aeadControlHKDFInfoPrefix + " " + algorithm + " " + direction
+	return hkdf.Key(sha256.New, key, transcriptHash, info, libcrypto.AEADKeySize)
 }

pkg/util/net/conn_test.go

@@ -114,5 +114,11 @@ func TestDeriveAEADControlKeysUsesDistinctDirections(t *testing.T) {
 		bytes.Repeat([]byte{0x44}, 32),
 	)
 	require.NoError(t, err)
+	require.Equal(t, []byte{
+		0xa0, 0x58, 0xcd, 0x02, 0x5d, 0x96, 0x98, 0x5f,
+		0xeb, 0xeb, 0xff, 0x79, 0xa1, 0x9f, 0x62, 0xb7,
+		0x15, 0xe0, 0x53, 0x91, 0x3d, 0xfc, 0x74, 0x77,
+		0x05, 0x91, 0x4c, 0x62, 0x4b, 0xf3, 0xd4, 0x95,
+	}, clientToServerKey)
 	require.NotEqual(t, clientToServerKey, serverToClientKey)
 }

pkg/util/net/dial.go

@@ -45,6 +45,11 @@ func DialHookWebsocket(protocol string, host string) libnet.AfterHookFunc {
 		if err != nil {
 			return nil, nil, err
 		}
+		// The tunnel payload is a raw byte stream (yamux), not UTF-8 text.
+		// Send it as binary frames; otherwise RFC 6455-compliant intermediaries
+		// (e.g. API gateways/reverse proxies) UTF-8-validate the default text
+		// frames and close the connection on invalid bytes.
+		conn.PayloadType = websocket.BinaryFrame
 		return ctx, conn, nil
 	}
 }

pkg/util/net/websocket.go

@@ -32,6 +32,11 @@ func NewWebsocketListener(ln net.Listener) (wl *WebsocketListener) {
 
 	muxer := http.NewServeMux()
 	muxer.Handle(FrpWebsocketPath, websocket.Handler(func(c *websocket.Conn) {
+		// The tunnel payload is a raw byte stream (yamux), not UTF-8 text.
+		// Send it as binary frames; otherwise RFC 6455-compliant intermediaries
+		// (e.g. API gateways/reverse proxies) UTF-8-validate the default text
+		// frames and close the connection on invalid bytes.
+		c.PayloadType = websocket.BinaryFrame
 		notifyCh := make(chan struct{})
 		conn := WrapCloseNotifyConn(c, func(_ error) {
 			close(notifyCh)