Lolia-FRP/lolia-frp
5
0
Fork 0
forked from Mxmilu666/frp
Code Pull Requests Activity

feat(client): add useSystemCa and combine it with trustedCaFile (#5572)

Browse Source 
Move the frpc-only TLS option into the shared TLSConfig as
transport.tls.useSystemCa, replacing the unpublished useSystemRoots.
When set, frpc verifies the server with the system CAs; when
trustedCaFile is also set, its CAs are appended to the system pool so
both are trusted. Failures to load either source abort the connection
instead of falling back. Enabling the option without effective TLS is a
configuration error, and the field is rejected in frps transport.tls
and in both webServer.tls sections.

Fixes #5545
This commit is contained in:
fatedier
2026-10-18 16:00:02 +08:00
committed by GitHub
parent 7441443134
commit 26742060b1
13 changed files with 395 additions and 93 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/config/v1/client.go
-3
View File
@@ -175,9 +175,6 @@ type TLSClientConfig struct {
// first custom byte when tls is enabled.
// Since v0.50.0, the default value has been changed to true, and the first custom byte is disabled by default.
DisableCustomTLSFirstByte *bool `json:"disableCustomTLSFirstByte,omitempty"`
// UseSystemRoots enables server certificate verification using system roots.
// TrustedCaFile takes precedence. If neither is configured, verification is disabled.
UseSystemRoots bool `json:"useSystemRoots,omitempty"`
TLSConfig
}
pkg/config/v1/common.go
+4
View File
@@ -79,6 +79,10 @@ type TLSConfig struct {
KeyFile string `json:"keyFile,omitempty"`
// TrustedCaFile specifies the path of the trusted ca file that will load.
TrustedCaFile string `json:"trustedCaFile,omitempty"`
// UseSystemCa enables server certificate verification using system CAs.
// If TrustedCaFile is also set, its certificates are added to the system CA pool.
// Only supported in frpc's transport.tls. With neither trust source, frpc skips verification.
UseSystemCa bool `json:"useSystemCa,omitempty"`
// ServerName specifies the custom server name of tls certificate. By
// default, server name if same to ServerAddr.
ServerName string `json:"serverName,omitempty"`
pkg/config/v1/validation/client.go
+2 -2
View File
@@ -164,8 +164,8 @@ func validateTransportConfig(c *v1.ClientTransportConfig) (Warning, error) {
warnings = AppendError(warnings, checkTLSConfig("transport.tls.keyFile", c.TLS.KeyFile))
warnings = AppendError(warnings, checkTLSConfig("transport.tls.trustedCaFile", c.TLS.TrustedCaFile))
// wss keeps TLS on regardless of transport.tls.enable.
if c.TLS.UseSystemRoots && c.Protocol != "wss" {
warnings = AppendError(warnings, fmt.Errorf("transport.tls.useSystemRoots is ignored when transport.tls.enable is false"))
if c.TLS.UseSystemCa && c.Protocol != "wss" {
errs = AppendError(errs, fmt.Errorf("transport.tls.useSystemCa requires transport.tls.enable to be true unless transport.protocol is wss"))
}
}
pkg/config/v1/validation/common.go
+3
View File
@@ -23,6 +23,9 @@ import (
func validateWebServerConfig(c *v1.WebServerConfig) error {
if c.TLS != nil {
if c.TLS.UseSystemCa {
return fmt.Errorf("webServer.tls.useSystemCa is only supported in frpc transport.tls")
}
if c.TLS.CertFile == "" {
return fmt.Errorf("tls.certFile must be specified when tls is enabled")
}
pkg/config/v1/validation/server.go
+3
View File
@@ -44,6 +44,9 @@ func (v *ConfigValidator) ValidateServerConfig(c *v1.ServerConfig) (Warning, err
if err := validateWebServerConfig(&c.WebServer); err != nil {
errs = AppendError(errs, err)
}
if c.Transport.TLS.UseSystemCa {
errs = AppendError(errs, fmt.Errorf("transport.tls.useSystemCa is only supported in frpc transport.tls"))
}
errs = AppendError(errs, ValidatePort(c.BindPort, "bindPort"))
errs = AppendError(errs, ValidatePort(c.KCPBindPort, "kcpBindPort"))
pkg/config/v1/validation/tls_test.go
+146
View File
@@ -0,0 +1,146 @@
// Copyright 2026 The frp Authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package validation
import (
"encoding/json"
"fmt"
"testing"
"github.com/stretchr/testify/require"
v1 "github.com/fatedier/frp/pkg/config/v1"
)
func TestClientTLSCATrustSources(t *testing.T) {
for _, test := range []struct {
name string
tlsJSON string
useSystemCa bool
caFile string
}{
{name: "default", tlsJSON: `{}`},
{name: "file only", tlsJSON: `{"trustedCaFile":"ca.pem"}`, caFile: "ca.pem"},
{name: "system only", tlsJSON: `{"useSystemCa":true}`, useSystemCa: true},
{name: "combined", tlsJSON: `{"useSystemCa":true,"trustedCaFile":"ca.pem"}`, useSystemCa: true, caFile: "ca.pem"},
} {
t.Run(test.name, func(t *testing.T) {
cfg := &v1.ClientCommonConfig{}
require.NoError(t, json.Unmarshal([]byte(`{"transport":{"tls":`+test.tlsJSON+`}}`), cfg))
require.NoError(t, cfg.Complete())
require.Equal(t, test.useSystemCa, cfg.Transport.TLS.UseSystemCa)
require.Equal(t, test.caFile, cfg.Transport.TLS.TrustedCaFile)
warnings, err := NewConfigValidator(nil).ValidateClientCommonConfig(cfg)
require.NoError(t, warnings)
require.NoError(t, err)
})
}
}
func TestClientSystemCARequiresTLS(t *testing.T) {
for _, protocol := range []string{"tcp", "kcp", "quic", "websocket", "wss"} {
for _, state := range []struct {
name string
enable *bool
}{
{name: "default"},
{name: "enabled", enable: new(true)},
{name: "disabled", enable: new(false)},
} {
t.Run(protocol+"/"+state.name, func(t *testing.T) {
cfg := &v1.ClientCommonConfig{}
cfg.Transport.Protocol = protocol
cfg.Transport.TLS.Enable = state.enable
cfg.Transport.TLS.UseSystemCa = true
require.NoError(t, cfg.Complete())
warnings, err := NewConfigValidator(nil).ValidateClientCommonConfig(cfg)
require.NoError(t, warnings, "useSystemCa must produce an error, not a warning")
if state.name == "disabled" && protocol != "wss" {
require.ErrorContains(t, err, "transport.tls.useSystemCa")
require.ErrorContains(t, err, "transport.tls.enable")
} else {
require.NoError(t, err)
}
})
}
}
}
func TestDisabledTLSFileWarnings(t *testing.T) {
for _, protocol := range []string{"tcp", "kcp", "quic", "websocket", "wss"} {
t.Run(protocol, func(t *testing.T) {
cfg := &v1.ClientCommonConfig{}
cfg.Transport.Protocol = protocol
cfg.Transport.TLS.Enable = new(false)
cfg.Transport.TLS.CertFile = "client.pem"
cfg.Transport.TLS.KeyFile = "client.key"
cfg.Transport.TLS.TrustedCaFile = "ca.pem"
require.NoError(t, cfg.Complete())
warnings, err := NewConfigValidator(nil).ValidateClientCommonConfig(cfg)
require.NoError(t, err)
for _, field := range []string{"certFile", "keyFile", "trustedCaFile"} {
require.ErrorContains(t, warnings, "transport.tls."+field+" is invalid when transport.tls.enable is false")
}
})
}
}
func TestSystemCAUnsupportedLocations(t *testing.T) {
for _, test := range []struct {
name string
server bool
configJSON string
fieldPath string
}{
{
name: "frps transport", server: true,
configJSON: `{"transport":{"tls":{"useSystemCa":%t}}}`, fieldPath: "transport.tls.useSystemCa",
},
{
name: "frpc webServer", configJSON: `{"webServer":{"tls":{"certFile":"server.pem","keyFile":"server.key","useSystemCa":%t}}}`,
fieldPath: "webServer.tls.useSystemCa",
},
{
name: "frps webServer", server: true,
configJSON: `{"webServer":{"tls":{"certFile":"server.pem","keyFile":"server.key","useSystemCa":%t}}}`,
fieldPath: "webServer.tls.useSystemCa",
},
} {
for _, enabled := range []bool{false, true} {
t.Run(fmt.Sprintf("%s/%t", test.name, enabled), func(t *testing.T) {
data := fmt.Appendf(nil, test.configJSON, enabled)
var warnings Warning
var err error
if test.server {
cfg := &v1.ServerConfig{}
require.NoError(t, json.Unmarshal(data, cfg))
require.NoError(t, cfg.Complete())
warnings, err = NewConfigValidator(nil).ValidateServerConfig(cfg)
} else {
cfg := &v1.ClientCommonConfig{}
require.NoError(t, json.Unmarshal(data, cfg))
require.NoError(t, cfg.Complete())
warnings, err = NewConfigValidator(nil).ValidateClientCommonConfig(cfg)
}
require.NoError(t, warnings)
if enabled {
require.EqualError(t, err, test.fieldPath+" is only supported in frpc transport.tls")
} else {
require.NoError(t, err)
}
})
}
}
}