Mxmilu666/frp
1
1
Fork 1
mirror of https://github.com/fatedier/frp.git synced 2026-10-19 23:33:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(client): reload plugin certificates on frpc reload (#5576)

Browse Source 
The https2http and https2https plugins read their certificate and key
once when the proxy starts, so a certificate that an external tool renews
on disk is only picked up after the proxy itself is recreated. frpc
reload rebuilt proxies only when their configuration changed, and a
rebuild closes the work connections that are already in use.

Let the plugin own the refresh. The HTTPS plugin server keeps the active
keypair and the last refresh error in one immutable snapshot published
through an atomic pointer, so a TLS handshake only loads that pointer and
never touches the disk. Reload rereads both files, and when their bytes
match the published pair it returns without parsing or replacing
anything; otherwise it parses the pair and swaps the snapshot in. A read
or parse failure keeps the previous certificate serving and records the
error next to it.

frpc reload collects the reloadable plugins of the live proxies and
applies the new configuration inside the same reload transaction that
also serializes control handoff, so a reload that races a reconnect
still refreshes the plugins of the published control. The certificate
files are read only after that transaction has been released. The config
store API keeps applying configuration without refreshing certificates,
because only an explicit reload may reread files. Proxy status reports a
refresh failure next to the still running proxy instead of dropping its
remote address.

No configuration field is added, and frps and the wire protocol are
unchanged. Without a reload nothing changes: certificates are still read
once at startup, generated self-signed certificates still never reload,
and a proxy whose configuration changed still goes through the existing
rebuild path.
This commit is contained in:
fatedier
2026-10-19 17:16:55 +08:00
committed by GitHub
parent 585fdc5b83
commit 00e4fc4dd3
14 changed files with 854 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+9
View File
@@ -809,6 +809,15 @@ webServer.port = 7400
Then run command `frpc reload -c ./frpc.toml` and wait for about 10 seconds to let `frpc` create or update or remove proxies.
For unchanged proxies using `https2http` or `https2https`, `frpc reload` also rereads
certificate and key files so externally renewed certificates take effect on new
TLS handshakes without interrupting existing connections. Unchanged file contents
leave the certificate untouched. If either file cannot be read or the pair is
invalid, the proxy keeps its previous certificate and reports the error in its
status and logs; reload still succeeds. A successful retry clears the error.
Generated self-signed certificates are unchanged, and Store API updates do not
refresh certificates on unchanged proxies.
**Note that global client parameters won't be modified except 'start'.**
`start` is a global allowlist evaluated after all sources are merged (config file/include/store).