Lolia-FRP/lolia-frp
5
0
Fork 0
forked from Mxmilu666/frp
Code Pull Requests Activity

feat(client): add useSystemCa and combine it with trustedCaFile (#5572)

Browse Source 
Move the frpc-only TLS option into the shared TLSConfig as
transport.tls.useSystemCa, replacing the unpublished useSystemRoots.
When set, frpc verifies the server with the system CAs; when
trustedCaFile is also set, its CAs are appended to the system pool so
both are trusted. Failures to load either source abort the connection
instead of falling back. Enabling the option without effective TLS is a
configuration error, and the field is rejected in frps transport.tls
and in both webServer.tls sections.

Fixes #5545
This commit is contained in:
fatedier
2026-10-18 16:00:02 +08:00
committed by GitHub
parent 7441443134
commit 26742060b1
13 changed files with 395 additions and 93 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/config/v1/validation/client.go
+2 -2
View File
@@ -164,8 +164,8 @@ func validateTransportConfig(c *v1.ClientTransportConfig) (Warning, error) {
warnings = AppendError(warnings, checkTLSConfig("transport.tls.keyFile", c.TLS.KeyFile))
warnings = AppendError(warnings, checkTLSConfig("transport.tls.trustedCaFile", c.TLS.TrustedCaFile))
// wss keeps TLS on regardless of transport.tls.enable.
if c.TLS.UseSystemRoots && c.Protocol != "wss" {
warnings = AppendError(warnings, fmt.Errorf("transport.tls.useSystemRoots is ignored when transport.tls.enable is false"))
if c.TLS.UseSystemCa && c.Protocol != "wss" {
errs = AppendError(errs, fmt.Errorf("transport.tls.useSystemCa requires transport.tls.enable to be true unless transport.protocol is wss"))
}
}