Release v0.71.0 (#5495)

* web/frpc: support virtual net visitor plugin (#5414)

* web/frpc: fix visitor plugin validation for sudp (#5448)

* web: patch vulnerable transitive dependencies (#5449)

* web: fix Vite config tsconfig includes (#5450)

* test(web): add frontend unit test baseline (#5451)

* build(web): upgrade ESLint to v10 (#5452)

* build(web): upgrade auto import plugins (#5453)

* chore(web): upgrade frontend dependencies (#5454)

* feat: add negotiated binary UDP packets (#5456)

* docs: add release note for #5456 (#5458)

* server: validate control pool counts (#5459)

* feat: use binary codec for SUDP packets (#5461)

* update version to 0.71.0 (#5464)

* fix(frpc): respect feature gates in verify (#5465)

* remove retired Go Report Card badge (#5467)

* udp: handle closed forwarding channel (#5470)

* limit: clamp bandwidth limiter burst (#5471)

* client: reject invalid work connection addresses (#5472)

* ssh: serialize tunnel channel writes (#5473)

* config: reject case-insensitive subdomain domains (#5474)

* docs: add release note for domain validation fix (#5475)

* log: improve prefix handling (#5489)

* web: patch vulnerable transitive dependencies (#5490)

---------

Co-authored-by: barkure <43804451+barkure@users.noreply.github.com>
Co-authored-by: Yarden Shoham <git@yardenshoham.com>

.github/workflows/golangci-lint.yml

@@ -28,4 +28,4 @@ jobs:
       uses: golangci/golangci-lint-action@v9
       with:
         # Optional: version of golangci-lint to use in form of v1.2 or v1.2.3 or `latest` to use the latest version
-        version: v2.12.2
+        version: v2.11

README.md

@@ -12,14 +12,6 @@ frp is an open source project with its ongoing development made possible entirel
 
 <h3 align="center">Gold Sponsors</h3>
 <!--gold sponsors start-->
-<p align="center">
-  <a href="https://jb.gg/frp" target="_blank">
-    <img width="420px" src="https://raw.githubusercontent.com/fatedier/frp/dev/doc/pic/sponsor_jetbrains.jpg">
-	<br>
-	<b>The complete IDE crafted for professional Go developers</b>
-  </a>
-</p>
-
 <p align="center">
   <a href="https://github.com/beclab/Olares" target="_blank">
     <img width="420px" src="https://raw.githubusercontent.com/fatedier/frp/dev/doc/pic/sponsor_olares.jpeg">
@@ -40,6 +32,13 @@ an API that records Zoom, Google Meet, Microsoft Teams, in-person meetings, and
 
 </div>
 
+<p align="center">
+  <a href="https://jb.gg/frp" target="_blank">
+    <img width="420px" src="https://raw.githubusercontent.com/fatedier/frp/dev/doc/pic/sponsor_jetbrains.jpg">
+	<br>
+	<b>The complete IDE crafted for professional Go developers</b>
+  </a>
+</p>
 <!--gold sponsors end-->
 
 ## What is frp?

README_zh.md

@@ -14,14 +14,6 @@ frp 是一个完全开源的项目，我们的开发工作完全依靠赞助者
 
 <h3 align="center">Gold Sponsors</h3>
 <!--gold sponsors start-->
-<p align="center">
-  <a href="https://jb.gg/frp" target="_blank">
-    <img width="420px" src="https://raw.githubusercontent.com/fatedier/frp/dev/doc/pic/sponsor_jetbrains.jpg">
-	<br>
-	<b>The complete IDE crafted for professional Go developers</b>
-  </a>
-</p>
-
 <p align="center">
   <a href="https://github.com/beclab/Olares" target="_blank">
     <img width="420px" src="https://raw.githubusercontent.com/fatedier/frp/dev/doc/pic/sponsor_olares.jpeg">
@@ -42,6 +34,13 @@ an API that records Zoom, Google Meet, Microsoft Teams, in-person meetings, and
 
 </div>
 
+<p align="center">
+  <a href="https://jb.gg/frp" target="_blank">
+    <img width="420px" src="https://raw.githubusercontent.com/fatedier/frp/dev/doc/pic/sponsor_jetbrains.jpg">
+	<br>
+	<b>The complete IDE crafted for professional Go developers</b>
+  </a>
+</p>
 <!--gold sponsors end-->
 
 ## 为什么使用 frp ？

Release.md

@@ -1,3 +1,9 @@
+## Features
+
+* UDP packet payloads for ordinary UDP proxies and SUDP now use a dedicated binary codec when frpc and frps successfully negotiate the capability under wire protocol v2, using a more compact wire representation. Wire protocol v1 remains JSON; wire protocol v2 falls back to JSON `UDPPacket` when the peer does not support or did not negotiate the capability.
+
 ## Fixes
 
-* Fixed VirtualNet route lifecycle issues during reconnect and shutdown, including stale route cleanup, shutdown races, and reconnect backoff overflow.
+* Fixed a server panic and remote denial of service caused by a client sending a negative `pool_count`. Negative values are now rejected before work-connection pool resources are allocated.
+* Fixed `frpc verify` ignoring configured `featureGates`, which caused VirtualNet configurations to be rejected even when the feature was enabled.
+* Fixed a case-insensitive validation bypass that allowed `customDomains` under the configured `subDomainHost` to be registered using mixed-case domain names.

client/connector.go

@@ -24,7 +24,7 @@ import (
 	"time"
 
 	libnet "github.com/fatedier/golib/net"
-	fmux "github.com/fatedier/yamux"
+	fmux "github.com/hashicorp/yamux"
 	quic "github.com/quic-go/quic-go"
 	"github.com/samber/lo"
 

client/health/health.go

@@ -119,7 +119,6 @@ func (monitor *Monitor) checkWorker() {
 
 		if err == nil {
 			xl.Tracef("do one health check success")
-			monitor.failedTimes = 0
 			if !monitor.statusOK && monitor.statusNormalFn != nil {
 				xl.Infof("health check status change to success")
 				monitor.statusOK = true

client/health/health_test.go

@@ -1,65 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package health
-
-import (
-	"context"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-
-	v1 "github.com/fatedier/frp/pkg/config/v1"
-)
-
-func TestMonitorResetsFailedTimesAfterSuccess(t *testing.T) {
-	var checkCount atomic.Int32
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		count := checkCount.Add(1)
-		if count == 1 || count == 2 || count == 4 {
-			w.WriteHeader(http.StatusServiceUnavailable)
-			return
-		}
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer server.Close()
-
-	var failedCount atomic.Int32
-	monitor := NewMonitor(
-		context.Background(),
-		v1.HealthCheckConfig{
-			Type:            "http",
-			Path:            "/health",
-			TimeoutSeconds:  1,
-			IntervalSeconds: 1,
-			MaxFailed:       3,
-		},
-		strings.TrimPrefix(server.URL, "http://"),
-		func() {},
-		func() { failedCount.Add(1) },
-	)
-	monitor.interval = 10 * time.Millisecond
-	monitor.Start()
-	defer monitor.Stop()
-
-	require.Eventually(t, func() bool {
-		return checkCount.Load() >= 5
-	}, time.Second, 10*time.Millisecond)
-	require.Equal(t, int32(0), failedCount.Load())
-}

client/proxy/xtcp.go

@@ -22,7 +22,7 @@ import (
 	"reflect"
 	"time"
 
-	fmux "github.com/fatedier/yamux"
+	fmux "github.com/hashicorp/yamux"
 	"github.com/quic-go/quic-go"
 
 	v1 "github.com/fatedier/frp/pkg/config/v1"

client/visitor/xtcp.go

@@ -25,7 +25,7 @@ import (
 	"time"
 
 	libio "github.com/fatedier/golib/io"
-	fmux "github.com/fatedier/yamux"
+	fmux "github.com/hashicorp/yamux"
 	quic "github.com/quic-go/quic-go"
 	"golang.org/x/time/rate"
 

go.mod

@@ -6,10 +6,10 @@ require (
 	github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5
 	github.com/coreos/go-oidc/v3 v3.18.0
 	github.com/fatedier/golib v0.8.2
-	github.com/fatedier/yamux v0.2.0
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/mux v1.8.1
 	github.com/gorilla/websocket v1.5.0
+	github.com/hashicorp/yamux v0.1.1
 	github.com/onsi/ginkgo/v2 v2.23.4
 	github.com/onsi/gomega v1.36.3
 	github.com/pelletier/go-toml/v2 v2.2.0
@@ -73,3 +73,6 @@ require (
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
 	sigs.k8s.io/yaml v1.3.0 // indirect
 )
+
+// TODO(fatedier): Temporary use the modified version, update to the official version after merging into the official repository.
+replace github.com/hashicorp/yamux => github.com/fatedier/yamux v0.0.0-20250825093530-d0154be01cd6

go.sum

@@ -22,8 +22,8 @@ github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1m
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/fatedier/golib v0.8.2 h1:02n2Dg7KJ7rR7p7n4/6hBUjaLQf2J7EiHYZQsgGTvww=
 github.com/fatedier/golib v0.8.2/go.mod h1:ArUGvPg2cOw/py2RAuBt46nNZH2VQ5Z70p109MAZpJw=
-github.com/fatedier/yamux v0.2.0 h1:H+2A9iBVh7aJlEOc1Ws1FXWOaecBf2nRv9zpFMPUWg8=
-github.com/fatedier/yamux v0.2.0/go.mod h1:d4FtRDrC9sHvRpiDL6J5EnfjLhqzZZplHe5yToSn2Ac=
+github.com/fatedier/yamux v0.0.0-20250825093530-d0154be01cd6 h1:u92UUy6FURPmNsMBUuongRWC0rBqN6gd01Dzu+D21NE=
+github.com/fatedier/yamux v0.0.0-20250825093530-d0154be01cd6/go.mod h1:c5/tk6G0dSpXGzJN7Wk1OEie8grdSJAmeawId9Zvd34=
 github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
 github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=

pkg/plugin/visitor/virtual_net.go

@@ -20,7 +20,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"io"
 	"net"
 	"sync"
 	"time"
@@ -34,16 +33,10 @@ func init() {
 	Register(v1.VisitorPluginVirtualNet, NewVirtualNetPlugin)
 }
 
-type clientRouteController interface {
-	RegisterClientRoute(context.Context, string, []net.IPNet, io.ReadWriteCloser)
-	UnregisterClientRoute(string, io.Writer) bool
-}
-
 type VirtualNetPlugin struct {
 	pluginCtx PluginContext
 
-	routeController clientRouteController
-	routes          []net.IPNet
+	routes []net.IPNet
 
 	mu             sync.Mutex
 	controllerConn net.Conn
@@ -55,11 +48,6 @@ type VirtualNetPlugin struct {
 	cancel context.CancelFunc
 }
 
-const (
-	virtualNetReconnectBaseDelay = 60 * time.Second
-	virtualNetReconnectMaxDelay  = 300 * time.Second
-)
-
 func NewVirtualNetPlugin(pluginCtx PluginContext, options v1.VisitorPluginOptions) (Plugin, error) {
 	opts := options.(*v1.VirtualNetVisitorPluginOptions)
 
@@ -67,9 +55,6 @@ func NewVirtualNetPlugin(pluginCtx PluginContext, options v1.VisitorPluginOption
 		pluginCtx: pluginCtx,
 		routes:    make([]net.IPNet, 0),
 	}
-	if pluginCtx.VnetController != nil {
-		p.routeController = pluginCtx.VnetController
-	}
 
 	p.ctx, p.cancel = context.WithCancel(pluginCtx.Ctx)
 
@@ -100,7 +85,7 @@ func (p *VirtualNetPlugin) Name() string {
 
 func (p *VirtualNetPlugin) Start() {
 	xl := xlog.FromContextSafe(p.pluginCtx.Ctx)
-	if p.routeController == nil {
+	if p.pluginCtx.VnetController == nil {
 		return
 	}
 
@@ -126,17 +111,16 @@ func (p *VirtualNetPlugin) run() {
 		select {
 		case <-p.ctx.Done():
 			xl.Infof("VirtualNetPlugin run loop for visitor [%s] stopping (context cancelled before pipe creation).", p.pluginCtx.Name)
-			p.cleanupCurrentControllerConn(xl)
+			p.cleanupControllerConn(xl)
 			return
 		default:
 		}
 
 		controllerConn, pluginConn := net.Pipe()
-		xl.Infof("attempting to register client route for visitor [%s]", p.pluginCtx.Name)
-		if !p.registerControllerConn(controllerConn, pluginConn) {
-			xl.Infof("VirtualNetPlugin run loop for visitor [%s] stopping (context cancelled before route registration).", p.pluginCtx.Name)
-			return
-		}
+
+		p.mu.Lock()
+		p.controllerConn = controllerConn
+		p.mu.Unlock()
 
 		// Wrap with CloseNotifyConn which supports both close notification and error recording
 		var closeErr error
@@ -145,6 +129,8 @@ func (p *VirtualNetPlugin) run() {
 			close(currentCloseSignal) // Signal the run loop on close.
 		})
 
+		xl.Infof("attempting to register client route for visitor [%s]", p.pluginCtx.Name)
+		p.pluginCtx.VnetController.RegisterClientRoute(p.ctx, p.pluginCtx.Name, p.routes, controllerConn)
 		xl.Infof("successfully registered client route for visitor [%s]. Starting connection handler with CloseNotifyConn.", p.pluginCtx.Name)
 
 		// Pass the CloseNotifyConn to the visitor for handling.
@@ -155,7 +141,7 @@ func (p *VirtualNetPlugin) run() {
 		select {
 		case <-p.ctx.Done():
 			xl.Infof("VirtualNetPlugin run loop stopping for visitor [%s] (context cancelled while waiting).", p.pluginCtx.Name)
-			p.cleanupControllerConn(xl, controllerConn)
+			p.cleanupControllerConn(xl)
 			return
 		case <-currentCloseSignal:
 			// Determine reconnect delay based on error with exponential backoff
@@ -166,7 +152,8 @@ func (p *VirtualNetPlugin) run() {
 					p.pluginCtx.Name, p.consecutiveErrors, closeErr)
 
 				// Exponential backoff: 60s, 120s, 240s, 300s (capped)
-				reconnectDelay = virtualNetReconnectDelay(p.consecutiveErrors)
+				baseDelay := 60 * time.Second
+				reconnectDelay = min(baseDelay*time.Duration(1<<uint(p.consecutiveErrors-1)), 300*time.Second)
 			} else {
 				// Reset consecutive errors on successful connection
 				if p.consecutiveErrors > 0 {
@@ -180,7 +167,7 @@ func (p *VirtualNetPlugin) run() {
 			}
 
 			// The visitor closed the plugin side. Close the controller side.
-			p.cleanupControllerConn(xl, controllerConn)
+			p.cleanupControllerConn(xl)
 
 			xl.Infof("waiting %v before attempting reconnection for visitor [%s]...", reconnectDelay, p.pluginCtx.Name)
 			select {
@@ -195,66 +182,16 @@ func (p *VirtualNetPlugin) run() {
 	}
 }
 
-// registerControllerConn publishes and registers controllerConn atomically with
-// respect to Close. A canceled plugin cannot register a new route.
-func (p *VirtualNetPlugin) registerControllerConn(controllerConn, pluginConn net.Conn) bool {
-	p.mu.Lock()
-	if p.ctx.Err() != nil || p.routeController == nil {
-		p.mu.Unlock()
-		_ = controllerConn.Close()
-		_ = pluginConn.Close()
-		return false
-	}
-
-	p.controllerConn = controllerConn
-	p.routeController.RegisterClientRoute(p.ctx, p.pluginCtx.Name, p.routes, controllerConn)
-	p.mu.Unlock()
-	return true
-}
-
-// virtualNetReconnectDelay returns a bounded reconnect delay without allowing
-// the exponential shift to overflow for large consecutive error counts.
-func virtualNetReconnectDelay(consecutiveErrors int) time.Duration {
-	if consecutiveErrors <= 1 {
-		return virtualNetReconnectBaseDelay
-	}
-	if consecutiveErrors >= 4 {
-		return virtualNetReconnectMaxDelay
-	}
-	return virtualNetReconnectBaseDelay * time.Duration(1<<uint(consecutiveErrors-1))
-}
-
-// cleanupControllerConn unregisters and closes one connection round without
-// affecting a replacement route owned by another connection.
-func (p *VirtualNetPlugin) cleanupControllerConn(xl *xlog.Logger, controllerConn net.Conn) {
+// cleanupControllerConn closes the current controllerConn (if it exists) under lock.
+func (p *VirtualNetPlugin) cleanupControllerConn(xl *xlog.Logger) {
 	p.mu.Lock()
 	defer p.mu.Unlock()
-	p.cleanupControllerConnLocked(xl, controllerConn)
-}
-
-func (p *VirtualNetPlugin) cleanupCurrentControllerConn(xl *xlog.Logger) {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-	p.cleanupControllerConnLocked(xl, p.controllerConn)
-}
-
-// cleanupControllerConnLocked must be called with p.mu held.
-func (p *VirtualNetPlugin) cleanupControllerConnLocked(xl *xlog.Logger, controllerConn net.Conn) {
-	if controllerConn == nil {
-		p.closeSignal = nil
-		return
-	}
-
-	if p.routeController != nil &&
-		p.routeController.UnregisterClientRoute(p.pluginCtx.Name, controllerConn) {
-		xl.Infof("unregistered client route for visitor [%s]", p.pluginCtx.Name)
-	}
-	xl.Debugf("cleaning up controllerConn for visitor [%s]", p.pluginCtx.Name)
-	_ = controllerConn.Close()
-	if p.controllerConn == controllerConn {
+	if p.controllerConn != nil {
+		xl.Debugf("cleaning up controllerConn for visitor [%s]", p.pluginCtx.Name)
+		p.controllerConn.Close()
 		p.controllerConn = nil
-		p.closeSignal = nil
 	}
+	p.closeSignal = nil
 }
 
 // Close initiates the plugin shutdown.
@@ -265,9 +202,15 @@ func (p *VirtualNetPlugin) Close() error {
 	// Signal the run loop goroutine to stop.
 	p.cancel()
 
-	// Unregister and close the current connection while holding the same lock
-	// used to check cancellation and register a route in run.
-	p.cleanupCurrentControllerConn(xl)
+	// Unregister the route from the controller.
+	if p.pluginCtx.VnetController != nil {
+		p.pluginCtx.VnetController.UnregisterClientRoute(p.pluginCtx.Name)
+		xl.Infof("unregistered client route for visitor [%s]", p.pluginCtx.Name)
+	}
+
+	// Explicitly close the controller side of the pipe.
+	// This ensures the pipe is broken even if the run loop is stuck or the visitor hasn't closed its end.
+	p.cleanupControllerConn(xl)
 	xl.Infof("finished cleaning up connections during close for visitor [%s]", p.pluginCtx.Name)
 
 	return nil

pkg/plugin/visitor/virtual_net_test.go

@@ -1,245 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//go:build !frps
-
-package visitor
-
-import (
-	"context"
-	"io"
-	"net"
-	"sync"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/fatedier/frp/pkg/util/xlog"
-)
-
-const testVirtualNetVisitorName = "vnet-visitor"
-
-type fakeClientRouteController struct {
-	mu sync.Mutex
-
-	routes map[string]io.Writer
-
-	beforeRegister  func()
-	registerCalls   int
-	unregisterCalls int
-}
-
-func newFakeClientRouteController() *fakeClientRouteController {
-	return &fakeClientRouteController{
-		routes: make(map[string]io.Writer),
-	}
-}
-
-func (c *fakeClientRouteController) RegisterClientRoute(
-	_ context.Context,
-	name string,
-	_ []net.IPNet,
-	conn io.ReadWriteCloser,
-) {
-	if c.beforeRegister != nil {
-		c.beforeRegister()
-	}
-
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	c.registerCalls++
-	c.routes[name] = conn
-}
-
-func (c *fakeClientRouteController) UnregisterClientRoute(name string, conn io.Writer) bool {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	c.unregisterCalls++
-	owner, ok := c.routes[name]
-	if !ok || owner != conn {
-		return false
-	}
-	delete(c.routes, name)
-	return true
-}
-
-func (c *fakeClientRouteController) owner() io.Writer {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	return c.routes[testVirtualNetVisitorName]
-}
-
-func (c *fakeClientRouteController) callCounts() (register, unregister int) {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	return c.registerCalls, c.unregisterCalls
-}
-
-type trackedConn struct {
-	net.Conn
-	closed atomic.Bool
-}
-
-func (c *trackedConn) Close() error {
-	c.closed.Store(true)
-	return c.Conn.Close()
-}
-
-func newTrackedPipe(t *testing.T) (*trackedConn, *trackedConn) {
-	t.Helper()
-	left, right := net.Pipe()
-	trackedLeft := &trackedConn{Conn: left}
-	trackedRight := &trackedConn{Conn: right}
-	t.Cleanup(func() {
-		_ = trackedLeft.Close()
-		_ = trackedRight.Close()
-	})
-	return trackedLeft, trackedRight
-}
-
-func newTestVirtualNetPlugin(t *testing.T, controller *fakeClientRouteController) *VirtualNetPlugin {
-	t.Helper()
-	pluginCtx := context.Background()
-	ctx, cancel := context.WithCancel(pluginCtx)
-	p := &VirtualNetPlugin{
-		pluginCtx: PluginContext{
-			Name: testVirtualNetVisitorName,
-			Ctx:  pluginCtx,
-		},
-		routeController: controller,
-		routes: []net.IPNet{{
-			IP:   net.ParseIP("10.1.0.1"),
-			Mask: net.CIDRMask(32, 32),
-		}},
-		ctx:    ctx,
-		cancel: cancel,
-	}
-	t.Cleanup(func() {
-		_ = p.Close()
-	})
-	return p
-}
-
-func waitResult[T any](t *testing.T, ch <-chan T) T {
-	t.Helper()
-	select {
-	case result := <-ch:
-		return result
-	case <-time.After(5 * time.Second):
-		t.Fatal("timed out waiting for concurrent operation")
-		var zero T
-		return zero
-	}
-}
-
-// TestVirtualNetReconnectDelay verifies the documented exponential backoff and
-// ensures large error counts remain capped instead of overflowing to zero.
-func TestVirtualNetReconnectDelay(t *testing.T) {
-	tests := []struct {
-		name              string
-		consecutiveErrors int
-		want              time.Duration
-	}{
-		{name: "first error", consecutiveErrors: 1, want: 60 * time.Second},
-		{name: "second error", consecutiveErrors: 2, want: 120 * time.Second},
-		{name: "third error", consecutiveErrors: 3, want: 240 * time.Second},
-		{name: "fourth error", consecutiveErrors: 4, want: 300 * time.Second},
-		{name: "shift width boundary", consecutiveErrors: 64, want: 300 * time.Second},
-		{name: "observed retry storm", consecutiveErrors: 329769, want: 300 * time.Second},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			require.Equal(t, tt.want, virtualNetReconnectDelay(tt.consecutiveErrors))
-		})
-	}
-}
-
-func TestVirtualNetPluginCloseBeforeRegisterDoesNotReplaceNewRoute(t *testing.T) {
-	controller := newFakeClientRouteController()
-	oldPlugin := newTestVirtualNetPlugin(t, controller)
-	newPlugin := newTestVirtualNetPlugin(t, controller)
-	oldControllerConn, oldPluginConn := newTrackedPipe(t)
-	newControllerConn, newPluginConn := newTrackedPipe(t)
-
-	allowOldRegister := make(chan struct{})
-	oldRegisterResult := make(chan bool, 1)
-	go func() {
-		<-allowOldRegister
-		oldRegisterResult <- oldPlugin.registerControllerConn(oldControllerConn, oldPluginConn)
-	}()
-
-	require.NoError(t, oldPlugin.Close())
-	require.True(t, newPlugin.registerControllerConn(newControllerConn, newPluginConn))
-	close(allowOldRegister)
-
-	require.False(t, waitResult(t, oldRegisterResult))
-	require.Same(t, newControllerConn, controller.owner())
-	registerCalls, _ := controller.callCounts()
-	require.Equal(t, 1, registerCalls)
-	require.True(t, oldControllerConn.closed.Load())
-	require.True(t, oldPluginConn.closed.Load())
-}
-
-func TestVirtualNetPluginRegisterBeforeCloseIsCleanedUp(t *testing.T) {
-	controller := newFakeClientRouteController()
-	p := newTestVirtualNetPlugin(t, controller)
-	controllerConn, pluginConn := newTrackedPipe(t)
-	registerEntered := make(chan struct{})
-	var registerEnteredOnce sync.Once
-	controller.beforeRegister = func() {
-		registerEnteredOnce.Do(func() {
-			close(registerEntered)
-		})
-		<-p.ctx.Done()
-	}
-
-	registerResult := make(chan bool, 1)
-	go func() {
-		registerResult <- p.registerControllerConn(controllerConn, pluginConn)
-	}()
-	waitResult(t, registerEntered)
-
-	closeResult := make(chan error, 1)
-	go func() {
-		closeResult <- p.Close()
-	}()
-
-	require.NoError(t, waitResult(t, closeResult))
-	require.True(t, waitResult(t, registerResult))
-	require.Nil(t, controller.owner())
-	registerCalls, unregisterCalls := controller.callCounts()
-	require.Equal(t, 1, registerCalls)
-	require.Equal(t, 1, unregisterCalls)
-	require.True(t, controllerConn.closed.Load())
-}
-
-func TestVirtualNetPluginOldConnectionCleanupKeepsReplacementRoute(t *testing.T) {
-	controller := newFakeClientRouteController()
-	oldPlugin := newTestVirtualNetPlugin(t, controller)
-	newPlugin := newTestVirtualNetPlugin(t, controller)
-	oldControllerConn, oldPluginConn := newTrackedPipe(t)
-	newControllerConn, newPluginConn := newTrackedPipe(t)
-
-	require.True(t, oldPlugin.registerControllerConn(oldControllerConn, oldPluginConn))
-	require.True(t, newPlugin.registerControllerConn(newControllerConn, newPluginConn))
-	require.Same(t, newControllerConn, controller.owner())
-
-	oldPlugin.cleanupControllerConn(xlog.FromContextSafe(oldPlugin.ctx), oldControllerConn)
-
-	require.Same(t, newControllerConn, controller.owner())
-	require.True(t, oldControllerConn.closed.Load())
-}

pkg/vnet/controller.go

@@ -246,9 +246,9 @@ func (c *Controller) RegisterClientRoute(ctx context.Context, name string, route
 	go c.readLoopClient(ctx, conn)
 }
 
-// UnregisterClientRoute removes a client route only when it is still owned by conn.
-func (c *Controller) UnregisterClientRoute(name string, conn io.Writer) bool {
-	return c.clientRouter.delRoute(name, conn)
+// UnregisterClientRoute Remove client route from routing table
+func (c *Controller) UnregisterClientRoute(name string) {
+	c.clientRouter.delRoute(name)
 }
 
 // StartServerConnReadLoop starts the read loop for a server connection
@@ -304,15 +304,10 @@ func (r *clientRouter) findConn(dst net.IP) (io.Writer, error) {
 	return nil, fmt.Errorf("no route found for destination %s", dst)
 }
 
-func (r *clientRouter) delRoute(name string, conn io.Writer) bool {
+func (r *clientRouter) delRoute(name string) {
 	r.mu.Lock()
 	defer r.mu.Unlock()
-	re, ok := r.routes[name]
-	if !ok || re.conn != conn {
-		return false
-	}
 	delete(r.routes, name)
-	return true
 }
 
 func (r *clientRouter) removeConnRoute(conn io.Writer) {

pkg/vnet/controller_test.go

@@ -1,64 +0,0 @@
-// Copyright 2026 The frp Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package vnet
-
-import (
-	"net"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	v1 "github.com/fatedier/frp/pkg/config/v1"
-)
-
-// TestClientRouterDeleteRouteRequiresMatchingConnection verifies that a stale
-// visitor cannot remove a replacement route registered under the same name.
-func TestClientRouterDeleteRouteRequiresMatchingConnection(t *testing.T) {
-	require := require.New(t)
-	controller := NewController(v1.VirtualNetConfig{})
-
-	_, route, err := net.ParseCIDR("10.1.0.1/32")
-	require.NoError(err)
-
-	oldConn, oldPeer := net.Pipe()
-	t.Cleanup(func() {
-		_ = oldConn.Close()
-		_ = oldPeer.Close()
-	})
-	replacementConn, replacementPeer := net.Pipe()
-	t.Cleanup(func() {
-		_ = replacementConn.Close()
-		_ = replacementPeer.Close()
-	})
-
-	controller.clientRouter.addRoute("vnet-visitor", []net.IPNet{*route}, oldConn)
-	controller.clientRouter.addRoute("vnet-visitor", []net.IPNet{*route}, replacementConn)
-
-	require.False(controller.UnregisterClientRoute("vnet-visitor", oldConn))
-	got, err := controller.clientRouter.findConn(net.ParseIP("10.1.0.1"))
-	require.NoError(err)
-	require.Same(replacementConn, got)
-
-	// The read loop for an old connection can exit after a replacement route
-	// has already been registered. Its deferred cleanup must keep the new owner.
-	controller.clientRouter.removeConnRoute(oldConn)
-	got, err = controller.clientRouter.findConn(net.ParseIP("10.1.0.1"))
-	require.NoError(err)
-	require.Same(replacementConn, got)
-
-	require.True(controller.UnregisterClientRoute("vnet-visitor", replacementConn))
-	_, err = controller.clientRouter.findConn(net.ParseIP("10.1.0.1"))
-	require.Error(err)
-}

server/service.go

@@ -29,7 +29,7 @@ import (
 
 	"github.com/fatedier/golib/crypto"
 	"github.com/fatedier/golib/net/mux"
-	fmux "github.com/fatedier/yamux"
+	fmux "github.com/hashicorp/yamux"
 	quic "github.com/quic-go/quic-go"
 	"github.com/samber/lo"