Merge pull request #5444 from fatedier/dev

Release v0.70.1

.github/workflows/build-and-push-image.yml

@@ -65,7 +65,7 @@ jobs:
         with:
           context: .
           file: ./dockerfiles/Dockerfile-for-frpc
-          platforms: linux/amd64,linux/arm/v7,linux/arm64,linux/ppc64le,linux/s390x
+          platforms: linux/amd64,linux/arm/v7,linux/arm64,linux/ppc64le
           push: true
           tags: |
             ${{ env.TAG_FRPC }}
@@ -76,7 +76,7 @@ jobs:
         with:
           context: .
           file: ./dockerfiles/Dockerfile-for-frps
-          platforms: linux/amd64,linux/arm/v7,linux/arm64,linux/ppc64le,linux/s390x
+          platforms: linux/amd64,linux/arm/v7,linux/arm64,linux/ppc64le
           push: true
           tags: |
             ${{ env.TAG_FRPS }}

Makefile.cross-compiles

@@ -9,7 +9,7 @@ all: build
 build: app
 
 app:
-	@$(foreach n, $(os-archs), \
+	@set -e; $(foreach n, $(os-archs), \
 		os=$(shell echo "$(n)" | cut -d : -f 1); \
 		arch=$(shell echo "$(n)" | cut -d : -f 2); \
 		extra=$(shell echo "$(n)" | cut -d : -f 3); \

README.md

@@ -2,7 +2,6 @@
 
 [![Build Status](https://circleci.com/gh/fatedier/frp.svg?style=shield)](https://circleci.com/gh/fatedier/frp)
 [![GitHub release](https://img.shields.io/github/tag/fatedier/frp.svg?label=release)](https://github.com/fatedier/frp/releases)
-[![Go Report Card](https://goreportcard.com/badge/github.com/fatedier/frp)](https://goreportcard.com/report/github.com/fatedier/frp)
 [![GitHub Releases Stats](https://img.shields.io/github/downloads/fatedier/frp/total.svg?logo=github)](https://somsubhra.github.io/github-release-stats/?username=fatedier&repository=frp)
 
 [README](README.md) | [中文文档](README_zh.md)
@@ -13,16 +12,6 @@ frp is an open source project with its ongoing development made possible entirel
 
 <h3 align="center">Gold Sponsors</h3>
 <!--gold sponsors start-->
-<p align="center">
-  <a href="https://github.com/beclab/Olares" target="_blank">
-    <img width="420px" src="https://raw.githubusercontent.com/fatedier/frp/dev/doc/pic/sponsor_olares.jpeg">
-	<br>
-	<b>The sovereign cloud that puts you in control</b>
-	<br>
-	<sub>An open source, self-hosted alternative to public clouds, built for data ownership and privacy</sub>
-  </a>
-</p>
-
 <div align="center">
 
 ## Recall.ai - API for meeting recordings
@@ -33,16 +22,6 @@ an API that records Zoom, Google Meet, Microsoft Teams, in-person meetings, and
 
 </div>
 
-<p align="center">
-  <a href="https://requestly.com/?utm_source=github&utm_medium=partnered&utm_campaign=frp" target="_blank">
-    <img width="480px" src="https://github.com/user-attachments/assets/24670320-997d-4d62-9bca-955c59fe883d">
-    <br>
-    <b>Requestly - Free & Open-Source alternative to Postman</b>
-    <br>
-    <sub>All-in-one platform to Test, Mock and Intercept APIs.</sub>
-  </a>
-</p>
-
 <p align="center">
   <a href="https://jb.gg/frp" target="_blank">
     <img width="420px" src="https://raw.githubusercontent.com/fatedier/frp/dev/doc/pic/sponsor_jetbrains.jpg">
@@ -50,6 +29,16 @@ an API that records Zoom, Google Meet, Microsoft Teams, in-person meetings, and
 	<b>The complete IDE crafted for professional Go developers</b>
   </a>
 </p>
+
+<p align="center">
+  <a href="https://github.com/beclab/Olares" target="_blank">
+    <img width="420px" src="https://raw.githubusercontent.com/fatedier/frp/dev/doc/pic/sponsor_olares.jpeg">
+	<br>
+	<b>The sovereign cloud that puts you in control</b>
+	<br>
+	<sub>An open source, self-hosted alternative to public clouds, built for data ownership and privacy</sub>
+  </a>
+</p>
 <!--gold sponsors end-->
 
 ## What is frp?

README_zh.md

@@ -15,16 +15,6 @@ frp 是一个完全开源的项目，我们的开发工作完全依靠赞助者
 
 <h3 align="center">Gold Sponsors</h3>
 <!--gold sponsors start-->
-<p align="center">
-  <a href="https://github.com/beclab/Olares" target="_blank">
-    <img width="420px" src="https://raw.githubusercontent.com/fatedier/frp/dev/doc/pic/sponsor_olares.jpeg">
-	<br>
-	<b>The sovereign cloud that puts you in control</b>
-	<br>
-	<sub>An open source, self-hosted alternative to public clouds, built for data ownership and privacy</sub>
-  </a>
-</p>
-
 <div align="center">
 
 ## Recall.ai - API for meeting recordings
@@ -35,16 +25,6 @@ an API that records Zoom, Google Meet, Microsoft Teams, in-person meetings, and
 
 </div>
 
-<p align="center">
-  <a href="https://requestly.com/?utm_source=github&utm_medium=partnered&utm_campaign=frp" target="_blank">
-    <img width="480px" src="https://github.com/user-attachments/assets/24670320-997d-4d62-9bca-955c59fe883d">
-    <br>
-    <b>Requestly - Free & Open-Source alternative to Postman</b>
-    <br>
-    <sub>All-in-one platform to Test, Mock and Intercept APIs.</sub>
-  </a>
-</p>
-
 <p align="center">
   <a href="https://jb.gg/frp" target="_blank">
     <img width="420px" src="https://raw.githubusercontent.com/fatedier/frp/dev/doc/pic/sponsor_jetbrains.jpg">
@@ -52,6 +32,16 @@ an API that records Zoom, Google Meet, Microsoft Teams, in-person meetings, and
 	<b>The complete IDE crafted for professional Go developers</b>
   </a>
 </p>
+
+<p align="center">
+  <a href="https://github.com/beclab/Olares" target="_blank">
+    <img width="420px" src="https://raw.githubusercontent.com/fatedier/frp/dev/doc/pic/sponsor_olares.jpeg">
+	<br>
+	<b>The sovereign cloud that puts you in control</b>
+	<br>
+	<sub>An open source, self-hosted alternative to public clouds, built for data ownership and privacy</sub>
+  </a>
+</p>
 <!--gold sponsors end-->
 
 ## 为什么使用 frp ？

Release.md

@@ -1,18 +1,5 @@
-## Compatibility Policy
+## Fixes
 
-Starting with v0.69.0, each minor release is supported until there are nine newer minor releases. For example, v0.69.0 will be supported until v0.78.0 is released. Within this window, frpc v0.69.0 is guaranteed to work with any frps from v0.61.0 to v0.77.0, and vice versa. Patch releases within the same minor are always compatible. Versions outside the support window may continue to work on a best-effort basis, but compatibility is no longer guaranteed.
-
-For mixed-version deployments, upgrade frps first, then upgrade frpc. This keeps the server side ready for newer client-side protocol behavior before clients start using it.
-
-## Notes
-
-This release introduces wire protocol v2 as a transition path for future frpc/frps protocol changes. The existing wire protocol is difficult to extend without compatibility risk, and upcoming changes, including replacing deprecated stream encryption methods, require a versioned protocol.
-
-**The default value of `transport.wireProtocol` remains `v1` in this release.** Users can keep the default for now. To test v2 early, upgrade both frpc and frps to versions that support it, then set `transport.wireProtocol = "v2"` in frpc. A v2-enabled frpc cannot connect to an older frps.
-
-v1 will be deprecated when v2 becomes the default in a future release. It will continue to be supported until v0.78.0 is released, and may be removed in v0.78.0 or later.
-
-## Features
-
-* Added `transport.wireProtocol` for frpc to select the internal message protocol used between frpc and frps. Supported values are `v1` and `v2`.
-* Added client protocol visibility in the frps dashboard and `/api/clients` API. Online clients now report their negotiated protocol as `v1` or `v2`.
+* HTTP vhost servers no longer support HTTP/1.1 `Upgrade: h2c` requests. Cleartext HTTP/2 prior-knowledge remains supported.
+* Fixed control-session replacement leaks when frpc reconnects through a half-open TCP multiplexed connection.
+* Fixed an SSH tunnel gateway panic when handling malformed exec requests.

client/control_session.go

@@ -74,17 +74,18 @@ func (d *controlSessionDialer) Dial(previousRunID string) (*SessionContext, erro
 		return nil, err
 	}
 
-	loginRespMsg, err := d.exchangeLogin(conn, loginMsg)
+	loginResult, err := d.exchangeLogin(conn, loginMsg)
 	if err != nil {
 		return nil, err
 	}
+	loginRespMsg := loginResult.resp
 	if loginRespMsg.Error != "" {
 		return nil, errors.New(loginRespMsg.Error)
 	}
 
 	var controlRW io.ReadWriter = conn
 	if d.clientSpec == nil || d.clientSpec.Type != "ssh-tunnel" {
-		controlRW, err = netpkg.NewCryptoReadWriter(conn, d.auth.EncryptionKey())
+		controlRW, err = d.newControlReadWriter(conn, loginResult.crypto)
 		if err != nil {
 			return nil, fmt.Errorf("create control crypto read writer: %w", err)
 		}
@@ -125,9 +126,16 @@ func (d *controlSessionDialer) buildLoginMsg(previousRunID string) (*msg.Login,
 	return loginMsg, nil
 }
 
-func (d *controlSessionDialer) exchangeLogin(conn net.Conn, loginMsg *msg.Login) (*msg.LoginResp, error) {
+type loginExchangeResult struct {
+	resp   *msg.LoginResp
+	crypto *wire.CryptoContext
+}
+
+func (d *controlSessionDialer) exchangeLogin(conn net.Conn, loginMsg *msg.Login) (*loginExchangeResult, error) {
 	rw := msg.NewV1ReadWriter(conn)
 	var wireConn *wire.Conn
+	var clientHello wire.ClientHello
+	var clientHelloPayload []byte
 
 	if d.common.Transport.WireProtocol == wire.ProtocolV2 {
 		if err := wire.WriteMagic(conn); err != nil {
@@ -136,14 +144,23 @@ func (d *controlSessionDialer) exchangeLogin(conn net.Conn, loginMsg *msg.Login)
 
 		wireConn = wire.NewConn(conn)
 		rw = msg.NewV2ReadWriterWithConn(wireConn)
-		hello := wire.DefaultClientHello(wire.BootstrapInfo{
+		var err error
+		clientHello, err = wire.NewClientHello(wire.BootstrapInfo{
 			Transport: d.common.Transport.Protocol,
 			TLS:       lo.FromPtr(d.common.Transport.TLS.Enable) || d.common.Transport.Protocol == "wss" || d.common.Transport.Protocol == "quic",
 			TCPMux:    lo.FromPtr(d.common.Transport.TCPMux),
 		})
-		if err := wireConn.WriteJSONFrame(wire.FrameTypeClientHello, hello); err != nil {
+		if err != nil {
 			return nil, err
 		}
+		clientHelloFrame, err := wire.NewJSONFrame(wire.FrameTypeClientHello, clientHello)
+		if err != nil {
+			return nil, err
+		}
+		if err := wireConn.WriteFrame(clientHelloFrame); err != nil {
+			return nil, err
+		}
+		clientHelloPayload = clientHelloFrame.Payload
 	}
 	if err := rw.WriteMsg(loginMsg); err != nil {
 		return nil, err
@@ -154,19 +171,50 @@ func (d *controlSessionDialer) exchangeLogin(conn net.Conn, loginMsg *msg.Login)
 		_ = conn.SetReadDeadline(time.Time{})
 	}()
 
+	var cryptoContext *wire.CryptoContext
 	if wireConn != nil {
+		serverHelloFrame, err := wireConn.ReadFrame()
+		if err != nil {
+			return nil, err
+		}
+		if serverHelloFrame.Type != wire.FrameTypeServerHello {
+			return nil, fmt.Errorf("unexpected frame type %d, want %d", serverHelloFrame.Type, wire.FrameTypeServerHello)
+		}
 		var serverHello wire.ServerHello
-		if err := wireConn.ReadJSONFrame(wire.FrameTypeServerHello, &serverHello); err != nil {
+		if err := wireConn.UnmarshalFrame(serverHelloFrame, &serverHello); err != nil {
 			return nil, err
 		}
 		if serverHello.Error != "" {
 			return nil, errors.New(serverHello.Error)
 		}
+		cryptoContext, err = wire.NewClientCryptoContext(clientHelloPayload, serverHelloFrame.Payload)
+		if err != nil {
+			return nil, err
+		}
 	}
 
 	var loginRespMsg msg.LoginResp
 	if err := rw.ReadMsgInto(&loginRespMsg); err != nil {
 		return nil, err
 	}
-	return &loginRespMsg, nil
+	return &loginExchangeResult{
+		resp:   &loginRespMsg,
+		crypto: cryptoContext,
+	}, nil
+}
+
+func (d *controlSessionDialer) newControlReadWriter(conn net.Conn, cryptoContext *wire.CryptoContext) (io.ReadWriter, error) {
+	if d.common.Transport.WireProtocol == wire.ProtocolV2 {
+		if cryptoContext == nil {
+			return nil, errors.New("missing v2 crypto negotiation")
+		}
+		return netpkg.NewAEADCryptoReadWriter(
+			conn,
+			d.auth.EncryptionKey(),
+			netpkg.AEADCryptoRoleClient,
+			cryptoContext.Algorithm,
+			cryptoContext.TranscriptHash,
+		)
+	}
+	return netpkg.NewCryptoReadWriter(conn, d.auth.EncryptionKey())
 }

client/control_session_test.go

@@ -29,6 +29,7 @@ import (
 	v1 "github.com/fatedier/frp/pkg/config/v1"
 	"github.com/fatedier/frp/pkg/msg"
 	"github.com/fatedier/frp/pkg/proto/wire"
+	netpkg "github.com/fatedier/frp/pkg/util/net"
 )
 
 type testConnector struct {
@@ -140,8 +141,17 @@ func TestControlSessionDialerDialV2(t *testing.T) {
 		}
 
 		wireConn := wire.NewConn(serverRaw)
+		clientHelloFrame, err := wireConn.ReadFrame()
+		if err != nil {
+			serverErrCh <- err
+			return
+		}
+		if clientHelloFrame.Type != wire.FrameTypeClientHello {
+			serverErrCh <- fmt.Errorf("unexpected frame type %d, want %d", clientHelloFrame.Type, wire.FrameTypeClientHello)
+			return
+		}
 		var hello wire.ClientHello
-		if err := wireConn.ReadJSONFrame(wire.FrameTypeClientHello, &hello); err != nil {
+		if err := wireConn.UnmarshalFrame(clientHelloFrame, &hello); err != nil {
 			serverErrCh <- err
 			return
 		}
@@ -160,11 +170,52 @@ func TestControlSessionDialerDialV2(t *testing.T) {
 			serverErrCh <- fmt.Errorf("unexpected user: %s", loginMsg.User)
 			return
 		}
-		if err := wireConn.WriteJSONFrame(wire.FrameTypeServerHello, wire.DefaultServerHello()); err != nil {
+		serverHello, err := wire.NewServerHello(hello)
+		if err != nil {
 			serverErrCh <- err
 			return
 		}
-		serverErrCh <- rw.WriteMsg(&msg.LoginResp{RunID: "run-v2"})
+		serverHelloFrame, err := wire.NewJSONFrame(wire.FrameTypeServerHello, serverHello)
+		if err != nil {
+			serverErrCh <- err
+			return
+		}
+		cryptoContext := wire.NewCryptoContext(
+			serverHello.Selected.Crypto.Algorithm,
+			clientHelloFrame.Payload,
+			serverHelloFrame.Payload,
+		)
+		if err := wireConn.WriteFrame(serverHelloFrame); err != nil {
+			serverErrCh <- err
+			return
+		}
+		if err := rw.WriteMsg(&msg.LoginResp{RunID: "run-v2"}); err != nil {
+			serverErrCh <- err
+			return
+		}
+
+		controlRW, err := netpkg.NewAEADCryptoReadWriter(
+			serverRaw,
+			[]byte("token"),
+			netpkg.AEADCryptoRoleServer,
+			cryptoContext.Algorithm,
+			cryptoContext.TranscriptHash,
+		)
+		if err != nil {
+			serverErrCh <- err
+			return
+		}
+		controlMsgRW := msg.NewReadWriter(controlRW, wire.ProtocolV2)
+		var ping msg.Ping
+		if err := controlMsgRW.ReadMsgInto(&ping); err != nil {
+			serverErrCh <- err
+			return
+		}
+		if ping.PrivilegeKey != "v2-ping" || ping.Timestamp != 12345 {
+			serverErrCh <- fmt.Errorf("unexpected ping: %+v", ping)
+			return
+		}
+		serverErrCh <- nil
 	}()
 
 	dialer := newTestControlSessionDialer(t, wire.ProtocolV2, connector, nil)
@@ -177,6 +228,7 @@ func TestControlSessionDialerDialV2(t *testing.T) {
 	require.NotNil(t, sessionCtx.Conn)
 	require.NotNil(t, sessionCtx.Connector)
 	require.False(t, connector.closed.Load())
+	require.NoError(t, sessionCtx.Conn.WriteMsg(&msg.Ping{PrivilegeKey: "v2-ping", Timestamp: 12345}))
 	require.NoError(t, <-serverErrCh)
 }
 

client/proxy/sudp.go

@@ -87,6 +87,7 @@ func (pxy *SUDPProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
 	}
 
 	workConn := netpkg.WrapReadWriteCloserToConn(remote, conn)
+	payloadConn := msg.NewConn(workConn, msg.NewReadWriter(workConn, pxy.clientCfg.Transport.WireProtocol))
 	readCh := make(chan *msg.UDPPacket, 1024)
 	sendCh := make(chan msg.Message, 1024)
 	isClose := false
@@ -109,7 +110,7 @@ func (pxy *SUDPProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
 	}
 
 	// udp service <- frpc <- frps <- frpc visitor <- user
-	workConnReaderFn := func(conn net.Conn, readCh chan *msg.UDPPacket) {
+	workConnReaderFn := func(payloadConn *msg.Conn, readCh chan *msg.UDPPacket) {
 		defer closeFn()
 
 		for {
@@ -122,7 +123,7 @@ func (pxy *SUDPProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
 			}
 
 			var udpMsg msg.UDPPacket
-			if errRet := msg.ReadMsgInto(conn, &udpMsg); errRet != nil {
+			if errRet := payloadConn.ReadMsgInto(&udpMsg); errRet != nil {
 				xl.Warnf("read from workConn for sudp error: %v", errRet)
 				return
 			}
@@ -137,7 +138,7 @@ func (pxy *SUDPProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
 	}
 
 	// udp service -> frpc -> frps -> frpc visitor -> user
-	workConnSenderFn := func(conn net.Conn, sendCh chan msg.Message) {
+	workConnSenderFn := func(payloadConn *msg.Conn, sendCh chan msg.Message) {
 		defer func() {
 			closeFn()
 			xl.Infof("writer goroutine for sudp work connection closed")
@@ -148,12 +149,12 @@ func (pxy *SUDPProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
 			switch m := rawMsg.(type) {
 			case *msg.UDPPacket:
 				xl.Tracef("frpc send udp package to frpc visitor, [udp local: %v, remote: %v], [tcp work conn local: %v, remote: %v]",
-					m.LocalAddr.String(), m.RemoteAddr.String(), conn.LocalAddr().String(), conn.RemoteAddr().String())
+					m.LocalAddr.String(), m.RemoteAddr.String(), payloadConn.LocalAddr().String(), payloadConn.RemoteAddr().String())
 			case *msg.Ping:
 				xl.Tracef("frpc send ping message to frpc visitor")
 			}
 
-			if errRet = msg.WriteMsg(conn, rawMsg); errRet != nil {
+			if errRet = payloadConn.WriteMsg(rawMsg); errRet != nil {
 				xl.Errorf("sudp work write error: %v", errRet)
 				return
 			}
@@ -184,8 +185,8 @@ func (pxy *SUDPProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
 		}
 	}
 
-	go workConnSenderFn(workConn, sendCh)
-	go workConnReaderFn(workConn, readCh)
+	go workConnSenderFn(payloadConn, sendCh)
+	go workConnReaderFn(payloadConn, readCh)
 	go heartbeatFn(sendCh)
 
 	udp.Forwarder(pxy.localAddr, readCh, sendCh, int(pxy.clientCfg.UDPPacketSize), pxy.cfg.Transport.ProxyProtocolVersion)

client/proxy/udp.go

@@ -99,15 +99,17 @@ func (pxy *UDPProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
 
 	pxy.mu.Lock()
 	pxy.workConn = netpkg.WrapReadWriteCloserToConn(remote, conn)
+	// Plain UDP payload follows the configured wire protocol for message framing.
+	payloadRW := msg.NewReadWriter(pxy.workConn, pxy.clientCfg.Transport.WireProtocol)
 	pxy.readCh = make(chan *msg.UDPPacket, 1024)
 	pxy.sendCh = make(chan msg.Message, 1024)
 	pxy.closed = false
 	pxy.mu.Unlock()
 
-	workConnReaderFn := func(conn net.Conn, readCh chan *msg.UDPPacket) {
+	workConnReaderFn := func(rw msg.ReadWriter, readCh chan *msg.UDPPacket) {
 		for {
 			var udpMsg msg.UDPPacket
-			if errRet := msg.ReadMsgInto(conn, &udpMsg); errRet != nil {
+			if errRet := rw.ReadMsgInto(&udpMsg); errRet != nil {
 				xl.Warnf("read from workConn for udp error: %v", errRet)
 				return
 			}
@@ -120,7 +122,7 @@ func (pxy *UDPProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
 			}
 		}
 	}
-	workConnSenderFn := func(conn net.Conn, sendCh chan msg.Message) {
+	workConnSenderFn := func(rw msg.ReadWriter, sendCh chan msg.Message) {
 		defer func() {
 			xl.Infof("writer goroutine for udp work connection closed")
 		}()
@@ -132,7 +134,7 @@ func (pxy *UDPProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
 			case *msg.Ping:
 				xl.Tracef("send ping message to udp workConn")
 			}
-			if errRet = msg.WriteMsg(conn, rawMsg); errRet != nil {
+			if errRet = rw.WriteMsg(rawMsg); errRet != nil {
 				xl.Errorf("udp work write error: %v", errRet)
 				return
 			}
@@ -151,8 +153,8 @@ func (pxy *UDPProxy) InWorkConn(conn net.Conn, _ *msg.StartWorkConn) {
 		}
 	}
 
-	go workConnSenderFn(pxy.workConn, pxy.sendCh)
-	go workConnReaderFn(pxy.workConn, pxy.readCh)
+	go workConnSenderFn(payloadRW, pxy.sendCh)
+	go workConnReaderFn(payloadRW, pxy.readCh)
 	go heartbeatFn(pxy.sendCh)
 
 	// Call Forwarder with proxy protocol version (empty string means no proxy protocol)

client/proxy/xtcp.go

@@ -57,8 +57,7 @@ func NewXTCPProxy(baseProxy *BaseProxy, cfg v1.ProxyConfigurer) Proxy {
 func (pxy *XTCPProxy) InWorkConn(conn net.Conn, startWorkConnMsg *msg.StartWorkConn) {
 	xl := pxy.xl
 	defer conn.Close()
-	var natHoleSidMsg msg.NatHoleSid
-	err := msg.ReadMsgInto(conn, &natHoleSidMsg)
+	natHoleSidMsg, err := readNatHoleSid(conn, pxy.clientCfg.Transport.WireProtocol)
 	if err != nil {
 		xl.Errorf("xtcp read from workConn error: %v", err)
 		return
@@ -131,6 +130,15 @@ func (pxy *XTCPProxy) InWorkConn(conn net.Conn, startWorkConnMsg *msg.StartWorkC
 	pxy.listenByQUIC(listenConn, raddr, startWorkConnMsg)
 }
 
+func readNatHoleSid(conn net.Conn, wireProtocol string) (*msg.NatHoleSid, error) {
+	workMsgConn := msg.NewConn(conn, msg.NewReadWriter(conn, wireProtocol))
+	var natHoleSidMsg msg.NatHoleSid
+	if err := workMsgConn.ReadMsgInto(&natHoleSidMsg); err != nil {
+		return nil, err
+	}
+	return &natHoleSidMsg, nil
+}
+
 func (pxy *XTCPProxy) listenByKCP(listenConn *net.UDPConn, raddr *net.UDPAddr, startWorkConnMsg *msg.StartWorkConn) {
 	xl := pxy.xl
 	listenConn.Close()

client/proxy/xtcp_test.go

@@ -0,0 +1,66 @@
+// Copyright 2026 The frp Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build !frps
+
+package proxy
+
+import (
+	"net"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/fatedier/frp/pkg/msg"
+	"github.com/fatedier/frp/pkg/proto/wire"
+)
+
+func TestReadNatHoleSidUsesSelectedWireProtocol(t *testing.T) {
+	for _, tc := range []struct {
+		name         string
+		wireProtocol string
+	}{
+		{name: "v2", wireProtocol: wire.ProtocolV2},
+		{name: "v1", wireProtocol: wire.ProtocolV1},
+		{name: "default", wireProtocol: ""},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			client, server := net.Pipe()
+			defer client.Close()
+			defer server.Close()
+			setPipeDeadline(t, client, server)
+
+			errCh := make(chan error, 1)
+			go func() {
+				writer := msg.NewConn(server, msg.NewReadWriter(server, tc.wireProtocol))
+				errCh <- writer.WriteMsg(&msg.NatHoleSid{Sid: "sid"})
+			}()
+
+			out, err := readNatHoleSid(client, tc.wireProtocol)
+			require.NoError(t, err)
+			require.Equal(t, "sid", out.Sid)
+			require.NoError(t, <-errCh)
+		})
+	}
+}
+
+func setPipeDeadline(t *testing.T, conns ...net.Conn) {
+	t.Helper()
+
+	deadline := time.Now().Add(time.Second)
+	for _, conn := range conns {
+		require.NoError(t, conn.SetDeadline(deadline))
+	}
+}

client/service.go

@@ -22,6 +22,7 @@ import (
 	"net/http"
 	"os"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"github.com/fatedier/golib/crypto"
@@ -109,6 +110,9 @@ func setServiceOptionsDefault(options *ServiceOptions) error {
 // Service is the client service that connects to frps and provides proxy services.
 type Service struct {
 	ctlMu sync.RWMutex
+	// Stores gracefulShutdownDuration independently from ctlMu, because the
+	// graceful shutdown wait may hold ctlMu for an arbitrary duration.
+	gracefulShutdownDuration atomic.Int64
 	// manager control connection with server
 	ctl *Control
 	// Uniq id got from frps, it will be attached to loginMsg.
@@ -150,7 +154,6 @@ type Service struct {
 	ctx context.Context
 	// call cancel to stop service
 	cancel context.CancelCauseFunc
-	gracefulShutdownDuration time.Duration
 
 	connectorCreator func(context.Context, *v1.ClientCommonConfig) Connector
 	handleWorkConnCb func(*v1.ProxyBaseConfig, net.Conn, *msg.StartWorkConn) bool
@@ -412,7 +415,7 @@ func (svr *Service) Close() {
 }
 
 func (svr *Service) GracefulClose(d time.Duration) {
-	svr.gracefulShutdownDuration = d
+	svr.gracefulShutdownDuration.Store(int64(d))
 	svr.cancel(nil)
 }
 
@@ -429,7 +432,8 @@ func (svr *Service) stop() {
 	svr.ctlMu.Lock()
 	defer svr.ctlMu.Unlock()
 	if svr.ctl != nil {
-		svr.ctl.GracefulClose(svr.gracefulShutdownDuration)
+		d := time.Duration(svr.gracefulShutdownDuration.Load())
+		svr.ctl.GracefulClose(d)
 		svr.ctl = nil
 	}
 	if svr.webServer != nil {

client/service_shutdown_test.go

@@ -0,0 +1,95 @@
+package client
+
+import (
+	"context"
+	"net"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/fatedier/frp/client/proxy"
+	"github.com/fatedier/frp/client/visitor"
+	v1 "github.com/fatedier/frp/pkg/config/v1"
+	"github.com/fatedier/frp/pkg/msg"
+)
+
+type gracefulCloseTestConnector struct {
+	conn net.Conn
+}
+
+func (*gracefulCloseTestConnector) Connect() (*msg.Conn, error) { return nil, net.ErrClosed }
+func (c *gracefulCloseTestConnector) Close() error              { return c.conn.Close() }
+
+func newGracefulCloseTestService() *Service {
+	ctx := context.Background()
+	common := &v1.ClientCommonConfig{}
+	serverConn, clientConn := net.Pipe()
+	ctl := &Control{
+		ctx: ctx,
+		sessionCtx: &SessionContext{
+			Common:    common,
+			RunID:     "graceful-close-race",
+			Conn:      msg.NewConn(clientConn, msg.NewV1ReadWriter(clientConn)),
+			Connector: &gracefulCloseTestConnector{conn: serverConn},
+		},
+		doneCh: make(chan struct{}),
+	}
+	ctl.pm = proxy.NewManager(ctx, common, nil, nil, nil)
+	ctl.vm = visitor.NewManager(ctx, "graceful-close-race", common, nil, nil, nil)
+	return &Service{ctl: ctl, cancel: context.CancelCauseFunc(func(error) {})}
+}
+
+func TestGracefulCloseAndStopSynchronizeDuration(t *testing.T) {
+	for i := range 10000 {
+		svr := newGracefulCloseTestService()
+		start := make(chan struct{})
+		var wg sync.WaitGroup
+		wg.Add(2)
+		go func() {
+			defer wg.Done()
+			<-start
+			svr.GracefulClose(time.Duration(i))
+		}()
+		go func() {
+			defer wg.Done()
+			<-start
+			svr.stop()
+		}()
+		close(start)
+		wg.Wait()
+	}
+}
+
+func TestGracefulCloseDoesNotBlockDuringStop(t *testing.T) {
+	const gracefulDuration = 200 * time.Millisecond
+
+	svr := newGracefulCloseTestService()
+	svr.GracefulClose(gracefulDuration)
+	stopDone := make(chan struct{})
+	go func() {
+		svr.stop()
+		close(stopDone)
+	}()
+	defer func() {
+		select {
+		case <-stopDone:
+		case <-time.After(time.Second):
+			t.Error("stop did not finish")
+		}
+	}()
+
+	deadline := time.Now().Add(time.Second)
+	for svr.ctlMu.TryLock() {
+		svr.ctlMu.Unlock()
+		if time.Now().After(deadline) {
+			t.Fatal("stop did not acquire ctlMu")
+		}
+		time.Sleep(time.Millisecond)
+	}
+
+	start := time.Now()
+	svr.GracefulClose(0)
+	if elapsed := time.Since(start); elapsed >= gracefulDuration/2 {
+		t.Fatalf("GracefulClose blocked for %v while stop was waiting", elapsed)
+	}
+}

client/visitor/sudp.go

@@ -113,15 +113,16 @@ func (sv *SUDPVisitor) dispatcher() {
 func (sv *SUDPVisitor) worker(workConn net.Conn, firstPacket *msg.UDPPacket) {
 	xl := xlog.FromContextSafe(sv.ctx)
 	xl.Debugf("starting sudp proxy worker")
+	payloadConn := msg.NewConn(workConn, msg.NewReadWriter(workConn, sv.clientCfg.Transport.WireProtocol))
 
 	wg := &sync.WaitGroup{}
 	wg.Add(2)
 	closeCh := make(chan struct{})
 
 	// udp service -> frpc -> frps -> frpc visitor -> user
-	workConnReaderFn := func(conn net.Conn) {
+	workConnReaderFn := func(payloadConn *msg.Conn) {
 		defer func() {
-			conn.Close()
+			payloadConn.Close()
 			close(closeCh)
 			wg.Done()
 		}()
@@ -133,13 +134,13 @@ func (sv *SUDPVisitor) worker(workConn net.Conn, firstPacket *msg.UDPPacket) {
 			)
 
 			// frpc will send heartbeat in workConn to frpc visitor for keeping alive
-			_ = conn.SetReadDeadline(time.Now().Add(60 * time.Second))
-			if rawMsg, errRet = msg.ReadMsg(conn); errRet != nil {
+			_ = payloadConn.SetReadDeadline(time.Now().Add(60 * time.Second))
+			if rawMsg, errRet = payloadConn.ReadMsg(); errRet != nil {
 				xl.Warnf("read from workconn for user udp conn error: %v", errRet)
 				return
 			}
 
-			_ = conn.SetReadDeadline(time.Time{})
+			_ = payloadConn.SetReadDeadline(time.Time{})
 			switch m := rawMsg.(type) {
 			case *msg.Ping:
 				xl.Debugf("frpc visitor get ping message from frpc")
@@ -157,15 +158,15 @@ func (sv *SUDPVisitor) worker(workConn net.Conn, firstPacket *msg.UDPPacket) {
 	}
 
 	// udp service <- frpc <- frps <- frpc visitor <- user
-	workConnSenderFn := func(conn net.Conn) {
+	workConnSenderFn := func(payloadConn *msg.Conn) {
 		defer func() {
-			conn.Close()
+			payloadConn.Close()
 			wg.Done()
 		}()
 
 		var errRet error
 		if firstPacket != nil {
-			if errRet = msg.WriteMsg(conn, firstPacket); errRet != nil {
+			if errRet = payloadConn.WriteMsg(firstPacket); errRet != nil {
 				xl.Warnf("sender goroutine for udp work connection closed: %v", errRet)
 				return
 			}
@@ -180,7 +181,7 @@ func (sv *SUDPVisitor) worker(workConn net.Conn, firstPacket *msg.UDPPacket) {
 					return
 				}
 
-				if errRet = msg.WriteMsg(conn, udpMsg); errRet != nil {
+				if errRet = payloadConn.WriteMsg(udpMsg); errRet != nil {
 					xl.Warnf("sender goroutine for udp work connection closed: %v", errRet)
 					return
 				}
@@ -191,8 +192,8 @@ func (sv *SUDPVisitor) worker(workConn net.Conn, firstPacket *msg.UDPPacket) {
 		}
 	}
 
-	go workConnReaderFn(workConn)
-	go workConnSenderFn(workConn)
+	go workConnReaderFn(payloadConn)
+	go workConnSenderFn(payloadConn)
 
 	wg.Wait()
 	xl.Infof("sudp worker is closed")

doc/agents/release.md

@@ -33,7 +33,51 @@ git commit -m "bump version to vX.Y.Z"
 git push origin dev
 ```
 
-## 3. Merge dev → master
+## 3. Pre-release Validation
+
+Run the standard e2e suite locally:
+
+```bash
+make e2e
+```
+
+For releases that touch compatibility-sensitive areas such as login, control
+connections, work connections, visitors, transport, or wire protocol handling,
+also run the manual compatibility e2e suite:
+
+```bash
+make e2e-compatibility
+make e2e-compatibility-floor
+```
+
+`make e2e-compatibility` builds the current `frps` and `frpc`, resolves the
+recent stable release baselines from GitHub, downloads or reuses their binaries,
+and tests current binaries against those historical releases. The default number
+of recent baselines is controlled by `FRP_COMPAT_BASELINE_COUNT` in the
+`Makefile`.
+
+Downloaded release binaries are cached under:
+
+```text
+.cache/e2e-compat/<version>/<os>_<arch>/
+```
+
+For a release validation run that must be exactly reproducible, pass an explicit
+baseline matrix instead of using the floating recent-release list:
+
+```bash
+FRP_COMPAT_BASELINE_VERSIONS="0.X.0 0.Y.0" make e2e-compatibility
+```
+
+Use `make e2e-compatibility-smoke` for a quick single-baseline check while
+iterating locally. If GitHub release metadata requests are rate-limited, set
+`GITHUB_TOKEN` or use `FRP_COMPAT_BASELINE_VERSIONS`.
+
+The compatibility floor is a support-policy decision, not a value that should
+change every release. Update `FRP_COMPAT_FLOOR_VERSION` only when the declared
+compatibility window changes.
+
+## 4. Merge dev → master
 
 Create a PR from `dev` to `master`:
 
@@ -43,7 +87,7 @@ gh pr create --base master --head dev --title "bump version"
 
 Wait for CI to pass, then merge using **merge commit** (not squash).
 
-## 4. Tag the Release
+## 5. Tag the Release
 
 ```bash
 git checkout master
@@ -52,7 +96,7 @@ git tag -a vX.Y.Z -m "bump version"
 git push origin vX.Y.Z
 ```
 
-## 5. Trigger GoReleaser
+## 6. Trigger GoReleaser
 
 Manually trigger the `goreleaser` workflow in GitHub Actions:
 

go.mod

@@ -4,8 +4,8 @@ go 1.25.0
 
 require (
 	github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5
-	github.com/coreos/go-oidc/v3 v3.14.1
-	github.com/fatedier/golib v0.6.0
+	github.com/coreos/go-oidc/v3 v3.18.0
+	github.com/fatedier/golib v0.8.1
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/mux v1.8.1
 	github.com/gorilla/websocket v1.5.0
@@ -13,10 +13,9 @@ require (
 	github.com/onsi/ginkgo/v2 v2.23.4
 	github.com/onsi/gomega v1.36.3
 	github.com/pelletier/go-toml/v2 v2.2.0
-	github.com/pion/stun/v3 v3.1.1
 	github.com/pires/go-proxyproto v0.7.0
 	github.com/prometheus/client_golang v1.19.1
-	github.com/quic-go/quic-go v0.55.0
+	github.com/quic-go/quic-go v0.60.0
 	github.com/rodaine/table v1.2.0
 	github.com/samber/lo v1.47.0
 	github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8
@@ -26,15 +25,17 @@ require (
 	github.com/tidwall/gjson v1.17.1
 	github.com/vishvananda/netlink v1.3.0
 	github.com/xtaci/kcp-go/v5 v5.6.13
-	golang.org/x/crypto v0.49.0
-	golang.org/x/net v0.52.0
-	golang.org/x/oauth2 v0.28.0
-	golang.org/x/sync v0.20.0
+	golang.org/x/crypto v0.54.0
+	golang.org/x/net v0.56.0
+	golang.org/x/oauth2 v0.36.0
+	golang.org/x/sync v0.22.0
+	golang.org/x/sys v0.47.0
 	golang.org/x/time v0.10.0
 	golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173
 	gopkg.in/ini.v1 v1.67.0
 	k8s.io/apimachinery v0.28.8
 	k8s.io/client-go v0.28.8
+	k8s.io/utils v0.0.0-20230406110748-d93618cff8a2
 )
 
 require (
@@ -42,7 +43,7 @@ require (
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/go-jose/go-jose/v4 v4.0.5 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
 	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
@@ -51,9 +52,6 @@ require (
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/klauspost/cpuid/v2 v2.2.6 // indirect
 	github.com/klauspost/reedsolomon v1.12.0 // indirect
-	github.com/pion/dtls/v3 v3.0.10 // indirect
-	github.com/pion/logging v0.2.4 // indirect
-	github.com/pion/transport/v4 v4.0.1 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/client_model v0.5.0 // indirect
@@ -65,17 +63,13 @@ require (
 	github.com/tidwall/pretty v1.2.0 // indirect
 	github.com/tjfoc/gmsm v1.4.1 // indirect
 	github.com/vishvananda/netns v0.0.4 // indirect
-	github.com/wlynxg/anet v0.0.5 // indirect
 	go.uber.org/automaxprocs v1.6.0 // indirect
-	golang.org/x/mod v0.33.0 // indirect
-	golang.org/x/sys v0.42.0 // indirect
-	golang.org/x/text v0.35.0 // indirect
-	golang.org/x/tools v0.42.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
+	golang.org/x/tools v0.47.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 	google.golang.org/protobuf v1.36.5 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/utils v0.0.0-20230406110748-d93618cff8a2 // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
 	sigs.k8s.io/yaml v1.3.0 // indirect
 )

go.sum

@@ -11,8 +11,8 @@ github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj
 github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/coreos/go-oidc/v3 v3.14.1 h1:9ePWwfdwC4QKRlCXsJGou56adA/owXczOzwKdOumLqk=
-github.com/coreos/go-oidc/v3 v3.14.1/go.mod h1:HaZ3szPaZ0e4r6ebqvsLWlk2Tn+aejfmrfah6hnSYEU=
+github.com/coreos/go-oidc/v3 v3.18.0 h1:V9orjXynvu5wiC9SemFTWnG4F45v403aIcjWo0d41+A=
+github.com/coreos/go-oidc/v3 v3.18.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4=
 github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
@@ -20,12 +20,12 @@ github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/fatedier/golib v0.6.0 h1:/mgBZZbkbMhIEZoXf7nV8knpUDzas/b+2ruYKxx1lww=
-github.com/fatedier/golib v0.6.0/go.mod h1:ArUGvPg2cOw/py2RAuBt46nNZH2VQ5Z70p109MAZpJw=
+github.com/fatedier/golib v0.8.1 h1:pHcIu0zAcZ6VTkO1dW/meelCGN5nem52DKCBY7cUvyA=
+github.com/fatedier/golib v0.8.1/go.mod h1:ArUGvPg2cOw/py2RAuBt46nNZH2VQ5Z70p109MAZpJw=
 github.com/fatedier/yamux v0.0.0-20250825093530-d0154be01cd6 h1:u92UUy6FURPmNsMBUuongRWC0rBqN6gd01Dzu+D21NE=
 github.com/fatedier/yamux v0.0.0-20250825093530-d0154be01cd6/go.mod h1:c5/tk6G0dSpXGzJN7Wk1OEie8grdSJAmeawId9Zvd34=
-github.com/go-jose/go-jose/v4 v4.0.5 h1:M6T8+mKZl/+fNNuFHvGIzDz7BTLQPIounk/b9dw3AaE=
-github.com/go-jose/go-jose/v4 v4.0.5/go.mod h1:s3P1lRrkT8igV8D9OjyL4WRyHvjB6a4JSllnOrmmBOA=
+github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
+github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
 github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
@@ -78,14 +78,6 @@ github.com/onsi/gomega v1.36.3 h1:hID7cr8t3Wp26+cYnfcjR6HpJ00fdogN6dqZ1t6IylU=
 github.com/onsi/gomega v1.36.3/go.mod h1:8D9+Txp43QWKhM24yyOBEdpkzN8FvJyAwecBgsU4KU0=
 github.com/pelletier/go-toml/v2 v2.2.0 h1:QLgLl2yMN7N+ruc31VynXs1vhMZa7CeHHejIeBAsoHo=
 github.com/pelletier/go-toml/v2 v2.2.0/go.mod h1:1t835xjRzz80PqgE6HHgN2JOsmgYu/h4qDAS4n929Rs=
-github.com/pion/dtls/v3 v3.0.10 h1:k9ekkq1kaZoxnNEbyLKI8DI37j/Nbk1HWmMuywpQJgg=
-github.com/pion/dtls/v3 v3.0.10/go.mod h1:YEmmBYIoBsY3jmG56dsziTv/Lca9y4Om83370CXfqJ8=
-github.com/pion/logging v0.2.4 h1:tTew+7cmQ+Mc1pTBLKH2puKsOvhm32dROumOZ655zB8=
-github.com/pion/logging v0.2.4/go.mod h1:DffhXTKYdNZU+KtJ5pyQDjvOAh/GsNSyv1lbkFbe3so=
-github.com/pion/stun/v3 v3.1.1 h1:CkQxveJ4xGQjulGSROXbXq94TAWu8gIX2dT+ePhUkqw=
-github.com/pion/stun/v3 v3.1.1/go.mod h1:qC1DfmcCTQjl9PBaMa5wSn3x9IPmKxSdcCsxBcDBndM=
-github.com/pion/transport/v4 v4.0.1 h1:sdROELU6BZ63Ab7FrOLn13M6YdJLY20wldXW2Cu2k8o=
-github.com/pion/transport/v4 v4.0.1/go.mod h1:nEuEA4AD5lPdcIegQDpVLgNoDGreqM/YqmEx3ovP4jM=
 github.com/pires/go-proxyproto v0.7.0 h1:IukmRewDQFWC7kfnb66CSomk2q/seBuilHBYFwyq0Hs=
 github.com/pires/go-proxyproto v0.7.0/go.mod h1:Vz/1JPY/OACxWGQNIRY2BeyDmpoaWmEP40O9LbuiFR4=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
@@ -103,8 +95,10 @@ github.com/prometheus/common v0.48.0 h1:QO8U2CdOzSn1BBsmXJXduaaW+dY/5QLjfB8svtSz
 github.com/prometheus/common v0.48.0/go.mod h1:0/KsvlIEfPQCQ5I2iNSAWKPZziNCvRs5EC6ILDTlAPc=
 github.com/prometheus/procfs v0.12.0 h1:jluTpSng7V9hY0O2R9DzzJHYb2xULk9VTR1V1R/k6Bo=
 github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3cnaOZAZEfOo=
-github.com/quic-go/quic-go v0.55.0 h1:zccPQIqYCXDt5NmcEabyYvOnomjs8Tlwl7tISjJh9Mk=
-github.com/quic-go/quic-go v0.55.0/go.mod h1:DR51ilwU1uE164KuWXhinFcKWGlEjzys2l8zUl5Ss1U=
+github.com/quic-go/go-ossfuzz-seeds v0.1.0 h1:APacT+iIaNF6fd8AGEiN3bT/Jtkd2jz4v4TzM7MFjy0=
+github.com/quic-go/go-ossfuzz-seeds v0.1.0/go.mod h1:3IOHRbJIc+L6YKMwfDtJAM9Vj9k0YY4muhuyUYk5tbk=
+github.com/quic-go/quic-go v0.60.0 h1:xcQioE8OM66UQLeUMHltK1CCcOu3JbVB4JAQdDQSB+0=
+github.com/quic-go/quic-go v0.60.0/go.mod h1:wpKpjmPpftl30sL6pFh7REVpjbcCVy4zt2vDyK1TuJk=
 github.com/rivo/uniseg v0.2.0 h1:S1pD9weZBuJdFmowNwbpi7BJ8TNftyUImj/0WQi72jY=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rodaine/table v1.2.0 h1:38HEnwK4mKSHQJIkavVj+bst1TEY7j9zhLMWu4QJrMA=
@@ -146,8 +140,6 @@ github.com/vishvananda/netlink v1.3.0 h1:X7l42GfcV4S6E4vHTsw48qbrV+9PVojNfIhZcwQ
 github.com/vishvananda/netlink v1.3.0/go.mod h1:i6NetklAujEcC6fK0JPjT8qSwWyO0HLn4UKG+hGqeJs=
 github.com/vishvananda/netns v0.0.4 h1:Oeaw1EM2JMxD51g9uhtC0D7erkIjgmj8+JZc26m1YX8=
 github.com/vishvananda/netns v0.0.4/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
-github.com/wlynxg/anet v0.0.5 h1:J3VJGi1gvo0JwZ/P1/Yc/8p63SoW98B5dHkYDmpgvvU=
-github.com/wlynxg/anet v0.0.5/go.mod h1:eay5PRQr7fIVAMbTbchTnO9gG65Hg/uYGdc7mguHxoA=
 github.com/xtaci/kcp-go/v5 v5.6.13 h1:FEjtz9+D4p8t2x4WjciGt/jsIuhlWjjgPCCWjrVR4Hk=
 github.com/xtaci/kcp-go/v5 v5.6.13/go.mod h1:75S1AKYYzNUSXIv30h+jPKJYZUwqpfvLshu63nCNSOM=
 github.com/xtaci/lossyconn v0.0.0-20200209145036-adba10fffc37 h1:EWU6Pktpas0n8lLQwDsRyZfmkPeRbdgPtW609es+/9E=
@@ -159,30 +151,28 @@ go.uber.org/mock v0.5.2/go.mod h1:wLlUxC2vVTPTaE3UD51E0BGOAElKrILxhVSDYQLld5o=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20201012173705-84dcc777aaee/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
-golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
+golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
+golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
-golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20201010224723-4f7140c49acb/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
-golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
+golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
+golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.28.0 h1:CrgCKl8PPAVtLnU3c+EDw6x11699EWlsDeWNWKdIOkc=
-golang.org/x/oauth2 v0.28.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
+golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
+golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -190,14 +180,14 @@ golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
-golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
-golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
-golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
+golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
+golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
 golang.org/x/time v0.10.0 h1:3usCWA8tQn0L8+hFJQNgzpWbd89begxN66o1Ojdn5L4=
 golang.org/x/time v0.10.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -205,8 +195,8 @@ golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGm
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k=
-golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=
+golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
+golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeunTOisW56dUokqW/FOteYJJ/yg=
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=

pkg/config/load.go

@@ -394,6 +394,10 @@ func LoadClientConfigResult(path string, strict bool) (*ClientConfigLoadResult,
 		}
 	}
 
+	if err := validateNoDuplicateNames(result.Proxies, result.Visitors); err != nil {
+		return nil, err
+	}
+
 	return result, nil
 }
 
@@ -417,6 +421,31 @@ func LoadClientConfig(path string, strict bool) (
 	return result.Common, proxyCfgs, visitorCfgs, result.IsLegacyFormat, nil
 }
 
+// validateNoDuplicateNames rejects proxies or visitors that share a name. They are
+// keyed by name in the config sources, so a duplicate would otherwise be silently
+// overwritten and never started, with no error or log.
+func validateNoDuplicateNames(proxies []v1.ProxyConfigurer, visitors []v1.VisitorConfigurer) error {
+	proxyNames := make(map[string]struct{}, len(proxies))
+	for _, p := range proxies {
+		name := p.GetBaseConfig().Name
+		if _, ok := proxyNames[name]; ok {
+			return fmt.Errorf("proxy name [%s] is duplicated", name)
+		}
+		proxyNames[name] = struct{}{}
+	}
+
+	visitorNames := make(map[string]struct{}, len(visitors))
+	for _, v := range visitors {
+		name := v.GetBaseConfig().Name
+		if _, ok := visitorNames[name]; ok {
+			return fmt.Errorf("visitor name [%s] is duplicated", name)
+		}
+		visitorNames[name] = struct{}{}
+	}
+
+	return nil
+}
+
 func CompleteProxyConfigurers(proxies []v1.ProxyConfigurer) []v1.ProxyConfigurer {
 	proxyCfgs := proxies
 	for _, c := range proxyCfgs {

pkg/config/load_test.go

@@ -17,6 +17,8 @@ package config
 import (
 	"encoding/json"
 	"fmt"
+	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 
@@ -462,6 +464,111 @@ func TestFilterClientConfigurers_FilterByStartAndEnabled(t *testing.T) {
 	require.Equal("keep", proxies[0].GetBaseConfig().Name)
 }
 
+func TestLoadClientConfigResult_DuplicateNames(t *testing.T) {
+	tests := []struct {
+		name      string
+		content   string
+		errSubstr string
+	}{
+		{
+			name: "duplicate proxy names",
+			content: `
+serverAddr = "127.0.0.1"
+serverPort = 7000
+
+[[proxies]]
+name = "dup"
+type = "tcp"
+localPort = 22
+remotePort = 6000
+
+[[proxies]]
+name = "dup"
+type = "tcp"
+localPort = 3306
+remotePort = 6001
+`,
+			errSubstr: "proxy name [dup] is duplicated",
+		},
+		{
+			name: "duplicate visitor names",
+			content: `
+serverAddr = "127.0.0.1"
+serverPort = 7000
+
+[[visitors]]
+name = "dup"
+type = "stcp"
+serverName = "a"
+secretKey = "secret"
+bindPort = 9001
+
+[[visitors]]
+name = "dup"
+type = "stcp"
+serverName = "b"
+secretKey = "secret"
+bindPort = 9002
+`,
+			errSubstr: "visitor name [dup] is duplicated",
+		},
+		{
+			name: "unique names",
+			content: `
+serverAddr = "127.0.0.1"
+serverPort = 7000
+
+[[proxies]]
+name = "p1"
+type = "tcp"
+localPort = 22
+remotePort = 6000
+
+[[proxies]]
+name = "p2"
+type = "tcp"
+localPort = 3306
+remotePort = 6001
+`,
+		},
+		{
+			name: "same name across proxy and visitor",
+			content: `
+serverAddr = "127.0.0.1"
+serverPort = 7000
+
+[[proxies]]
+name = "same"
+type = "tcp"
+localPort = 22
+remotePort = 6000
+
+[[visitors]]
+name = "same"
+type = "stcp"
+serverName = "a"
+secretKey = "secret"
+bindPort = 9001
+`,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			require := require.New(t)
+			path := filepath.Join(t.TempDir(), "frpc.toml")
+			require.NoError(os.WriteFile(path, []byte(tc.content), 0o600))
+
+			_, err := LoadClientConfigResult(path, false)
+			if tc.errSubstr == "" {
+				require.NoError(err)
+			} else {
+				require.ErrorContains(err, tc.errSubstr)
+			}
+		})
+	}
+}
+
 // TestYAMLEdgeCases tests edge cases for YAML parsing, including non-map types
 func TestYAMLEdgeCases(t *testing.T) {
 	require := require.New(t)

pkg/config/source/config_source.go

@@ -14,11 +14,7 @@
 
 package source
 
-import (
-	"fmt"
-
-	v1 "github.com/fatedier/frp/pkg/config/v1"
-)
+import v1 "github.com/fatedier/frp/pkg/config/v1"
 
 // ConfigSource implements Source for in-memory configuration.
 // All operations are thread-safe.
@@ -39,23 +35,17 @@ func (s *ConfigSource) ReplaceAll(proxies []v1.ProxyConfigurer, visitors []v1.Vi
 
 	nextProxies := make(map[string]v1.ProxyConfigurer, len(proxies))
 	for _, p := range proxies {
-		if p == nil {
-			return fmt.Errorf("proxy cannot be nil")
-		}
-		name := p.GetBaseConfig().Name
-		if name == "" {
-			return fmt.Errorf("proxy name cannot be empty")
+		name, err := validateProxyName(p)
+		if err != nil {
+			return err
 		}
 		nextProxies[name] = p
 	}
 	nextVisitors := make(map[string]v1.VisitorConfigurer, len(visitors))
 	for _, v := range visitors {
-		if v == nil {
-			return fmt.Errorf("visitor cannot be nil")
-		}
-		name := v.GetBaseConfig().Name
-		if name == "" {
-			return fmt.Errorf("visitor name cannot be empty")
+		name, err := validateVisitorName(v)
+		if err != nil {
+			return err
 		}
 		nextVisitors[name] = v
 	}

pkg/config/source/store.go

@@ -43,6 +43,11 @@ var (
 	ErrNotFound      = errors.New("not found")
 )
 
+const (
+	storeKindProxy   = "proxy"
+	storeKindVisitor = "visitor"
+)
+
 func NewStoreSource(cfg StoreSourceConfig) (*StoreSource, error) {
 	if cfg.Path == "" {
 		return nil, fmt.Errorf("path is required")
@@ -172,79 +177,111 @@ func (s *StoreSource) saveToFileUnlocked() error {
 	return nil
 }
 
-func (s *StoreSource) AddProxy(proxy v1.ProxyConfigurer) error {
-	if proxy == nil {
-		return fmt.Errorf("proxy cannot be nil")
+func (s *StoreSource) persistOrRollbackUnlocked(rollback func()) error {
+	if err := s.saveToFileUnlocked(); err != nil {
+		rollback()
+		return fmt.Errorf("failed to persist: %w", err)
+	}
+	return nil
+}
+
+// Store map selectors return the target map for generic helpers.
+func proxyStoreEntries(s *StoreSource) map[string]v1.ProxyConfigurer {
+	return s.proxies
+}
+
+func visitorStoreEntries(s *StoreSource) map[string]v1.VisitorConfigurer {
+	return s.visitors
+}
+
+// Store entry helpers share mutation, persistence, and rollback for proxy and visitor maps.
+// T is intentionally limited by callers to v1.ProxyConfigurer or v1.VisitorConfigurer.
+func addStoreEntry[T any](
+	s *StoreSource,
+	entriesFn func(*StoreSource) map[string]T,
+	kind string,
+	name string,
+	value T,
+) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	entries := entriesFn(s)
+	if _, exists := entries[name]; exists {
+		return fmt.Errorf("%w: %s %q", ErrAlreadyExists, kind, name)
 	}
 
-	name := proxy.GetBaseConfig().Name
+	entries[name] = value
+	return s.persistOrRollbackUnlocked(func() {
+		delete(entries, name)
+	})
+}
+
+func updateStoreEntry[T any](
+	s *StoreSource,
+	entriesFn func(*StoreSource) map[string]T,
+	kind string,
+	name string,
+	value T,
+) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	entries := entriesFn(s)
+	old, exists := entries[name]
+	if !exists {
+		return fmt.Errorf("%w: %s %q", ErrNotFound, kind, name)
+	}
+
+	entries[name] = value
+	return s.persistOrRollbackUnlocked(func() {
+		entries[name] = old
+	})
+}
+
+func removeStoreEntry[T any](
+	s *StoreSource,
+	entriesFn func(*StoreSource) map[string]T,
+	kind string,
+	name string,
+) error {
 	if name == "" {
-		return fmt.Errorf("proxy name cannot be empty")
+		return fmt.Errorf("%s name cannot be empty", kind)
 	}
 
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
-	if _, exists := s.proxies[name]; exists {
-		return fmt.Errorf("%w: proxy %q", ErrAlreadyExists, name)
+	entries := entriesFn(s)
+	old, exists := entries[name]
+	if !exists {
+		return fmt.Errorf("%w: %s %q", ErrNotFound, kind, name)
 	}
 
-	s.proxies[name] = proxy
+	delete(entries, name)
+	return s.persistOrRollbackUnlocked(func() {
+		entries[name] = old
+	})
+}
 
-	if err := s.saveToFileUnlocked(); err != nil {
-		delete(s.proxies, name)
-		return fmt.Errorf("failed to persist: %w", err)
+func (s *StoreSource) AddProxy(proxy v1.ProxyConfigurer) error {
+	name, err := validateProxyName(proxy)
+	if err != nil {
+		return err
 	}
-	return nil
+	return addStoreEntry(s, proxyStoreEntries, storeKindProxy, name, proxy)
 }
 
 func (s *StoreSource) UpdateProxy(proxy v1.ProxyConfigurer) error {
-	if proxy == nil {
-		return fmt.Errorf("proxy cannot be nil")
+	name, err := validateProxyName(proxy)
+	if err != nil {
+		return err
 	}
-
-	name := proxy.GetBaseConfig().Name
-	if name == "" {
-		return fmt.Errorf("proxy name cannot be empty")
-	}
-
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	oldProxy, exists := s.proxies[name]
-	if !exists {
-		return fmt.Errorf("%w: proxy %q", ErrNotFound, name)
-	}
-
-	s.proxies[name] = proxy
-
-	if err := s.saveToFileUnlocked(); err != nil {
-		s.proxies[name] = oldProxy
-		return fmt.Errorf("failed to persist: %w", err)
-	}
-	return nil
+	return updateStoreEntry(s, proxyStoreEntries, storeKindProxy, name, proxy)
 }
 
 func (s *StoreSource) RemoveProxy(name string) error {
-	if name == "" {
-		return fmt.Errorf("proxy name cannot be empty")
-	}
-
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	oldProxy, exists := s.proxies[name]
-	if !exists {
-		return fmt.Errorf("%w: proxy %q", ErrNotFound, name)
-	}
-
-	delete(s.proxies, name)
-
-	if err := s.saveToFileUnlocked(); err != nil {
-		s.proxies[name] = oldProxy
-		return fmt.Errorf("failed to persist: %w", err)
-	}
-	return nil
+	return removeStoreEntry(s, proxyStoreEntries, storeKindProxy, name)
 }
 
 func (s *StoreSource) GetProxy(name string) v1.ProxyConfigurer {
@@ -259,78 +296,23 @@ func (s *StoreSource) GetProxy(name string) v1.ProxyConfigurer {
 }
 
 func (s *StoreSource) AddVisitor(visitor v1.VisitorConfigurer) error {
-	if visitor == nil {
-		return fmt.Errorf("visitor cannot be nil")
+	name, err := validateVisitorName(visitor)
+	if err != nil {
+		return err
 	}
-
-	name := visitor.GetBaseConfig().Name
-	if name == "" {
-		return fmt.Errorf("visitor name cannot be empty")
-	}
-
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	if _, exists := s.visitors[name]; exists {
-		return fmt.Errorf("%w: visitor %q", ErrAlreadyExists, name)
-	}
-
-	s.visitors[name] = visitor
-
-	if err := s.saveToFileUnlocked(); err != nil {
-		delete(s.visitors, name)
-		return fmt.Errorf("failed to persist: %w", err)
-	}
-	return nil
+	return addStoreEntry(s, visitorStoreEntries, storeKindVisitor, name, visitor)
 }
 
 func (s *StoreSource) UpdateVisitor(visitor v1.VisitorConfigurer) error {
-	if visitor == nil {
-		return fmt.Errorf("visitor cannot be nil")
+	name, err := validateVisitorName(visitor)
+	if err != nil {
+		return err
 	}
-
-	name := visitor.GetBaseConfig().Name
-	if name == "" {
-		return fmt.Errorf("visitor name cannot be empty")
-	}
-
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	oldVisitor, exists := s.visitors[name]
-	if !exists {
-		return fmt.Errorf("%w: visitor %q", ErrNotFound, name)
-	}
-
-	s.visitors[name] = visitor
-
-	if err := s.saveToFileUnlocked(); err != nil {
-		s.visitors[name] = oldVisitor
-		return fmt.Errorf("failed to persist: %w", err)
-	}
-	return nil
+	return updateStoreEntry(s, visitorStoreEntries, storeKindVisitor, name, visitor)
 }
 
 func (s *StoreSource) RemoveVisitor(name string) error {
-	if name == "" {
-		return fmt.Errorf("visitor name cannot be empty")
-	}
-
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	oldVisitor, exists := s.visitors[name]
-	if !exists {
-		return fmt.Errorf("%w: visitor %q", ErrNotFound, name)
-	}
-
-	delete(s.visitors, name)
-
-	if err := s.saveToFileUnlocked(); err != nil {
-		s.visitors[name] = oldVisitor
-		return fmt.Errorf("failed to persist: %w", err)
-	}
-	return nil
+	return removeStoreEntry(s, visitorStoreEntries, storeKindVisitor, name)
 }
 
 func (s *StoreSource) GetVisitor(name string) v1.VisitorConfigurer {

pkg/config/source/store_test.go

@@ -17,6 +17,7 @@ package source
 import (
 	"os"
 	"path/filepath"
+	"runtime"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -59,6 +60,101 @@ func TestStoreSource_AddProxyAndVisitor_DoesNotApplyRuntimeDefaults(t *testing.T
 	require.Empty(gotVisitor.(*v1.XTCPVisitorConfig).Protocol)
 }
 
+func TestStoreSource_UpdateAndRemoveProxyAndVisitor(t *testing.T) {
+	require := require.New(t)
+
+	storeSource := newTestStoreSource(t)
+
+	proxyCfg := mockProxy("proxy1")
+	visitorCfg := mockVisitor("visitor1")
+
+	require.NoError(storeSource.AddProxy(proxyCfg))
+	require.NoError(storeSource.AddVisitor(visitorCfg))
+	require.ErrorIs(storeSource.AddProxy(proxyCfg), ErrAlreadyExists)
+	require.ErrorIs(storeSource.AddVisitor(visitorCfg), ErrAlreadyExists)
+	require.ErrorContains(storeSource.RemoveProxy(""), "proxy name cannot be empty")
+	require.ErrorContains(storeSource.RemoveVisitor(""), "visitor name cannot be empty")
+
+	updatedProxy := mockProxy("proxy1").(*v1.TCPProxyConfig)
+	updatedProxy.RemotePort = 19090
+	require.NoError(storeSource.UpdateProxy(updatedProxy))
+	require.Equal(19090, storeSource.GetProxy("proxy1").(*v1.TCPProxyConfig).RemotePort)
+
+	updatedVisitor := mockVisitor("visitor1").(*v1.STCPVisitorConfig)
+	updatedVisitor.ServerName = "updated-server"
+	require.NoError(storeSource.UpdateVisitor(updatedVisitor))
+	require.Equal("updated-server", storeSource.GetVisitor("visitor1").(*v1.STCPVisitorConfig).ServerName)
+
+	require.NoError(storeSource.RemoveProxy("proxy1"))
+	require.Nil(storeSource.GetProxy("proxy1"))
+	require.ErrorIs(storeSource.RemoveProxy("proxy1"), ErrNotFound)
+
+	require.NoError(storeSource.RemoveVisitor("visitor1"))
+	require.Nil(storeSource.GetVisitor("visitor1"))
+	require.ErrorIs(storeSource.RemoveVisitor("visitor1"), ErrNotFound)
+
+	require.ErrorIs(storeSource.UpdateProxy(updatedProxy), ErrNotFound)
+	require.ErrorIs(storeSource.UpdateVisitor(updatedVisitor), ErrNotFound)
+}
+
+func TestStoreSource_MutationRollsBackOnPersistFailure(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("chmod does not make directories unwritable on Windows")
+	}
+	if os.Getuid() == 0 {
+		t.Skip("chmod does not block writes for uid 0")
+	}
+
+	require := require.New(t)
+
+	dir := t.TempDir()
+	path := filepath.Join(dir, "store.json")
+	storeSource, err := NewStoreSource(StoreSourceConfig{Path: path})
+	require.NoError(err)
+
+	proxyCfg := mockProxy("proxy1")
+	visitorCfg := mockVisitor("visitor1")
+	originalRemotePort := proxyCfg.(*v1.TCPProxyConfig).RemotePort
+	originalServerName := visitorCfg.(*v1.STCPVisitorConfig).ServerName
+	require.NoError(storeSource.AddProxy(proxyCfg))
+	require.NoError(storeSource.AddVisitor(visitorCfg))
+
+	require.NoError(os.Chmod(dir, 0o500))
+	t.Cleanup(func() {
+		_ = os.Chmod(dir, 0o700)
+	})
+
+	requirePersistError := func(err error) {
+		t.Helper()
+		require.Error(err)
+		require.ErrorContains(err, "failed to persist")
+		require.NotErrorIs(err, ErrAlreadyExists)
+		require.NotErrorIs(err, ErrNotFound)
+	}
+
+	requirePersistError(storeSource.AddProxy(mockProxy("proxy2")))
+	require.Nil(storeSource.GetProxy("proxy2"))
+
+	updatedProxy := mockProxy("proxy1").(*v1.TCPProxyConfig)
+	updatedProxy.RemotePort = 19090
+	requirePersistError(storeSource.UpdateProxy(updatedProxy))
+	require.Equal(originalRemotePort, storeSource.GetProxy("proxy1").(*v1.TCPProxyConfig).RemotePort)
+
+	requirePersistError(storeSource.RemoveProxy("proxy1"))
+	require.NotNil(storeSource.GetProxy("proxy1"))
+
+	requirePersistError(storeSource.AddVisitor(mockVisitor("visitor2")))
+	require.Nil(storeSource.GetVisitor("visitor2"))
+
+	updatedVisitor := mockVisitor("visitor1").(*v1.STCPVisitorConfig)
+	updatedVisitor.ServerName = "updated-server"
+	requirePersistError(storeSource.UpdateVisitor(updatedVisitor))
+	require.Equal(originalServerName, storeSource.GetVisitor("visitor1").(*v1.STCPVisitorConfig).ServerName)
+
+	requirePersistError(storeSource.RemoveVisitor("visitor1"))
+	require.NotNil(storeSource.GetVisitor("visitor1"))
+}
+
 func TestStoreSource_LoadFromFile_DoesNotApplyRuntimeDefaults(t *testing.T) {
 	require := require.New(t)
 

pkg/config/source/validation.go

@@ -0,0 +1,43 @@
+// Copyright 2026 The frp Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package source
+
+import (
+	"fmt"
+
+	v1 "github.com/fatedier/frp/pkg/config/v1"
+)
+
+func validateProxyName(proxy v1.ProxyConfigurer) (string, error) {
+	if proxy == nil {
+		return "", fmt.Errorf("proxy cannot be nil")
+	}
+	name := proxy.GetBaseConfig().Name
+	if name == "" {
+		return "", fmt.Errorf("proxy name cannot be empty")
+	}
+	return name, nil
+}
+
+func validateVisitorName(visitor v1.VisitorConfigurer) (string, error) {
+	if visitor == nil {
+		return "", fmt.Errorf("visitor cannot be nil")
+	}
+	name := visitor.GetBaseConfig().Name
+	if name == "" {
+		return "", fmt.Errorf("visitor name cannot be empty")
+	}
+	return name, nil
+}

pkg/config/v1/validation/auth.go

@@ -0,0 +1,43 @@
+// Copyright 2026 The frp Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package validation
+
+import (
+	"fmt"
+
+	v1 "github.com/fatedier/frp/pkg/config/v1"
+	"github.com/fatedier/frp/pkg/policy/security"
+)
+
+func (v *ConfigValidator) validateAuthTokenSource(token string, tokenSource *v1.ValueSource) error {
+	var errs error
+	// Preserve the previous client/server validation order for joined errors.
+	if token != "" && tokenSource != nil {
+		errs = AppendError(errs, fmt.Errorf("cannot specify both auth.token and auth.tokenSource"))
+	}
+	if tokenSource == nil {
+		return errs
+	}
+
+	if tokenSource.Type == "exec" {
+		if err := v.ValidateUnsafeFeature(security.TokenSourceExec); err != nil {
+			errs = AppendError(errs, err)
+		}
+	}
+	if err := tokenSource.Validate(); err != nil {
+		errs = AppendError(errs, fmt.Errorf("invalid auth.tokenSource: %v", err))
+	}
+	return errs
+}

pkg/config/v1/validation/auth_test.go

@@ -0,0 +1,228 @@
+// Copyright 2026 The frp Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package validation
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	v1 "github.com/fatedier/frp/pkg/config/v1"
+	"github.com/fatedier/frp/pkg/policy/security"
+)
+
+const (
+	tokenSourceConflictErr = "cannot specify both auth.token and auth.tokenSource"
+	tokenSourceExecErr     = "unsafe feature \"TokenSourceExec\" is not enabled. To enable it, ensure it is allowed in the configuration or command line flags"
+	invalidFileSourceErr   = "invalid auth.tokenSource: file configuration is required when type is 'file'"
+	unsupportedSourceErr   = "invalid auth.tokenSource: unsupported value source type: env (only 'file' and 'exec' are supported)"
+)
+
+func TestValidateAuthTokenSource(t *testing.T) {
+	for _, tc := range authTokenSourceTestCases() {
+		t.Run(tc.name, func(t *testing.T) {
+			validator := newAuthTokenSourceValidator(tc.unsafeAllowed)
+			err := validator.validateAuthTokenSource(tc.token, tc.tokenSource())
+			requireValidationErrors(t, err, tc.wantErrs)
+		})
+	}
+}
+
+func TestValidateClientAuthTokenSource(t *testing.T) {
+	for _, tc := range authTokenSourceTestCases() {
+		t.Run(tc.name, func(t *testing.T) {
+			auth := v1.AuthClientConfig{
+				Method:      v1.AuthMethodToken,
+				Token:       tc.token,
+				TokenSource: tc.tokenSource(),
+			}
+			validator := newAuthTokenSourceValidator(tc.unsafeAllowed)
+			_, err := validator.ValidateClientCommonConfig(validClientConfigWithAuth(auth))
+			requireValidationErrors(t, err, tc.wantErrs)
+		})
+	}
+}
+
+func TestValidateServerAuthTokenSource(t *testing.T) {
+	for _, tc := range authTokenSourceTestCases() {
+		t.Run(tc.name, func(t *testing.T) {
+			auth := v1.AuthServerConfig{
+				Method:      v1.AuthMethodToken,
+				Token:       tc.token,
+				TokenSource: tc.tokenSource(),
+			}
+			validator := newAuthTokenSourceValidator(tc.unsafeAllowed)
+			_, err := validator.ValidateServerConfig(validServerConfigWithAuth(auth))
+			requireValidationErrors(t, err, tc.wantErrs)
+		})
+	}
+}
+
+type authTokenSourceTestCase struct {
+	name          string
+	token         string
+	tokenSource   func() *v1.ValueSource
+	unsafeAllowed bool
+	wantErrs      []string
+}
+
+func authTokenSourceTestCases() []authTokenSourceTestCase {
+	return []authTokenSourceTestCase{
+		{
+			name:        "empty token config",
+			tokenSource: nilTokenSource,
+		},
+		{
+			name:        "valid file tokenSource",
+			tokenSource: validFileTokenSource,
+		},
+		{
+			name:        "literal token without tokenSource",
+			token:       "token",
+			tokenSource: nilTokenSource,
+		},
+		{
+			name:        "literal token conflicts with file tokenSource",
+			token:       "token",
+			tokenSource: validFileTokenSource,
+			wantErrs:    []string{tokenSourceConflictErr},
+		},
+		{
+			name:        "exec tokenSource requires unsafe feature",
+			tokenSource: validExecTokenSource,
+			wantErrs:    []string{tokenSourceExecErr},
+		},
+		{
+			name:          "exec tokenSource with unsafe feature allowed",
+			tokenSource:   validExecTokenSource,
+			unsafeAllowed: true,
+		},
+		{
+			name:        "literal token conflicts with exec tokenSource and unsafe feature disabled",
+			token:       "token",
+			tokenSource: validExecTokenSource,
+			wantErrs: []string{
+				tokenSourceConflictErr,
+				tokenSourceExecErr,
+			},
+		},
+		{
+			name:          "literal token conflicts with exec tokenSource and unsafe feature allowed",
+			token:         "token",
+			tokenSource:   validExecTokenSource,
+			unsafeAllowed: true,
+			wantErrs:      []string{tokenSourceConflictErr},
+		},
+		{
+			name:        "invalid file tokenSource is wrapped",
+			tokenSource: invalidFileTokenSource,
+			wantErrs:    []string{invalidFileSourceErr},
+		},
+		{
+			name:        "unsupported tokenSource type is wrapped",
+			tokenSource: unsupportedTokenSource,
+			wantErrs:    []string{unsupportedSourceErr},
+		},
+	}
+}
+
+func newAuthTokenSourceValidator(unsafeAllowed bool) *ConfigValidator {
+	if !unsafeAllowed {
+		return NewConfigValidator(nil)
+	}
+	return NewConfigValidator(security.NewUnsafeFeatures([]string{security.TokenSourceExec}))
+}
+
+func requireValidationErrors(t *testing.T, err error, wantErrs []string) {
+	t.Helper()
+	if len(wantErrs) == 0 {
+		require.NoError(t, err)
+		return
+	}
+	require.Error(t, err)
+	// Client/server validators may wrap joined errors in another join layer; compare leaf errors.
+	gotErrs := unwrapValidationErrors(err)
+	require.Len(t, gotErrs, len(wantErrs))
+	for i, wantErr := range wantErrs {
+		require.EqualError(t, gotErrs[i], wantErr)
+	}
+}
+
+func unwrapValidationErrors(err error) []error {
+	type joinedError interface {
+		Unwrap() []error
+	}
+	joined, ok := err.(joinedError)
+	if !ok {
+		return []error{err}
+	}
+
+	var errs []error
+	for _, err := range joined.Unwrap() {
+		errs = append(errs, unwrapValidationErrors(err)...)
+	}
+	return errs
+}
+
+// nilTokenSource keeps the shared table shape uniform for cases without a tokenSource.
+func nilTokenSource() *v1.ValueSource {
+	return nil
+}
+
+func validFileTokenSource() *v1.ValueSource {
+	return &v1.ValueSource{
+		Type: "file",
+		File: &v1.FileSource{Path: "token.txt"},
+	}
+}
+
+func validExecTokenSource() *v1.ValueSource {
+	return &v1.ValueSource{
+		Type: "exec",
+		Exec: &v1.ExecSource{Command: "print-token"},
+	}
+}
+
+func invalidFileTokenSource() *v1.ValueSource {
+	return &v1.ValueSource{
+		Type: "file",
+	}
+}
+
+func unsupportedTokenSource() *v1.ValueSource {
+	return &v1.ValueSource{Type: "env"}
+}
+
+func validClientConfigWithAuth(auth v1.AuthClientConfig) *v1.ClientCommonConfig {
+	return &v1.ClientCommonConfig{
+		Auth: auth,
+		Log: v1.LogConfig{
+			Level: "info",
+		},
+		Transport: v1.ClientTransportConfig{
+			Protocol:     "tcp",
+			WireProtocol: "v1",
+		},
+	}
+}
+
+func validServerConfigWithAuth(auth v1.AuthServerConfig) *v1.ServerConfig {
+	return &v1.ServerConfig{
+		Auth: auth,
+		Log: v1.LogConfig{
+			Level: "info",
+		},
+	}
+}

pkg/config/v1/validation/client.go

@@ -68,22 +68,7 @@ func (v *ConfigValidator) validateAuthConfig(c *v1.AuthClientConfig) (Warning, e
 		errs = AppendError(errs, fmt.Errorf("invalid auth additional scopes, optional values are %v", SupportedAuthAdditionalScopes))
 	}
 
-	// Validate token/tokenSource mutual exclusivity
-	if c.Token != "" && c.TokenSource != nil {
-		errs = AppendError(errs, fmt.Errorf("cannot specify both auth.token and auth.tokenSource"))
-	}
-
-	// Validate tokenSource if specified
-	if c.TokenSource != nil {
-		if c.TokenSource.Type == "exec" {
-			if err := v.ValidateUnsafeFeature(security.TokenSourceExec); err != nil {
-				errs = AppendError(errs, err)
-			}
-		}
-		if err := c.TokenSource.Validate(); err != nil {
-			errs = AppendError(errs, fmt.Errorf("invalid auth.tokenSource: %v", err))
-		}
-	}
+	errs = AppendError(errs, v.validateAuthTokenSource(c.Token, c.TokenSource))
 
 	if err := v.validateOIDCConfig(&c.OIDC); err != nil {
 		errs = AppendError(errs, err)

pkg/config/v1/validation/server.go

@@ -21,7 +21,6 @@ import (
 	"github.com/samber/lo"
 
 	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/policy/security"
 )
 
 func (v *ConfigValidator) ValidateServerConfig(c *v1.ServerConfig) (Warning, error) {
@@ -36,22 +35,7 @@ func (v *ConfigValidator) ValidateServerConfig(c *v1.ServerConfig) (Warning, err
 		errs = AppendError(errs, fmt.Errorf("invalid auth additional scopes, optional values are %v", SupportedAuthAdditionalScopes))
 	}
 
-	// Validate token/tokenSource mutual exclusivity
-	if c.Auth.Token != "" && c.Auth.TokenSource != nil {
-		errs = AppendError(errs, fmt.Errorf("cannot specify both auth.token and auth.tokenSource"))
-	}
-
-	// Validate tokenSource if specified
-	if c.Auth.TokenSource != nil {
-		if c.Auth.TokenSource.Type == "exec" {
-			if err := v.ValidateUnsafeFeature(security.TokenSourceExec); err != nil {
-				errs = AppendError(errs, err)
-			}
-		}
-		if err := c.Auth.TokenSource.Validate(); err != nil {
-			errs = AppendError(errs, fmt.Errorf("invalid auth.tokenSource: %v", err))
-		}
-	}
+	errs = AppendError(errs, v.validateAuthTokenSource(c.Auth.Token, c.Auth.TokenSource))
 
 	if err := validateLogConfig(&c.Log); err != nil {
 		errs = AppendError(errs, err)

pkg/metrics/mem/server.go

@@ -18,6 +18,8 @@ import (
 	"sync"
 	"time"
 
+	"k8s.io/utils/clock"
+
 	"github.com/fatedier/frp/pkg/util/log"
 	"github.com/fatedier/frp/pkg/util/metric"
 	server "github.com/fatedier/frp/server/metrics"
@@ -38,11 +40,20 @@ func init() {
 
 type serverMetrics struct {
 	info  *ServerStatistics
+	clock clock.WithTicker
 	mu    sync.Mutex
 }
 
 func newServerMetrics() *serverMetrics {
+	return newServerMetricsWithClock(clock.RealClock{})
+}
+
+func newServerMetricsWithClock(clk clock.WithTicker) *serverMetrics {
+	if clk == nil {
+		clk = clock.RealClock{}
+	}
 	return &serverMetrics{
+		clock: clk,
 		info: &ServerStatistics{
 			TotalTrafficIn:  metric.NewDateCounter(ReserveDays),
 			TotalTrafficOut: metric.NewDateCounter(ReserveDays),
@@ -57,14 +68,23 @@ func newServerMetrics() *serverMetrics {
 }
 
 func (m *serverMetrics) run() {
-	go func() {
+	go m.runUntil(nil)
+}
+
+func (m *serverMetrics) runUntil(stopCh <-chan struct{}) {
+	ticker := m.clock.NewTicker(12 * time.Hour)
+	defer ticker.Stop()
+
 	for {
-			time.Sleep(12 * time.Hour)
-			start := time.Now()
+		select {
+		case <-ticker.C():
+			start := m.clock.Now()
 			count, total := m.clearUselessInfo(time.Duration(7*24) * time.Hour)
-			log.Debugf("clear useless proxy statistics data count %d/%d, cost %v", count, total, time.Since(start))
+			log.Debugf("clear useless proxy statistics data count %d/%d, cost %v", count, total, m.clock.Since(start))
+		case <-stopCh:
+			return
+		}
 	}
-	}()
 }
 
 func (m *serverMetrics) clearUselessInfo(continuousOfflineDuration time.Duration) (int, int) {
@@ -75,9 +95,7 @@ func (m *serverMetrics) clearUselessInfo(continuousOfflineDuration time.Duration
 	defer m.mu.Unlock()
 	total = len(m.info.ProxyStatistics)
 	for name, data := range m.info.ProxyStatistics {
-		if !data.LastCloseTime.IsZero() &&
-			data.LastStartTime.Before(data.LastCloseTime) &&
-			time.Since(data.LastCloseTime) > continuousOfflineDuration {
+		if m.shouldClearProxyStats(data, continuousOfflineDuration) {
 			delete(m.info.ProxyStatistics, name)
 			count++
 			log.Tracef("clear proxy [%s]'s statistics data, lastCloseTime: [%s]", name, data.LastCloseTime.String())
@@ -86,10 +104,20 @@ func (m *serverMetrics) clearUselessInfo(continuousOfflineDuration time.Duration
 	return count, total
 }
 
+func (m *serverMetrics) shouldClearProxyStats(data *ProxyStatistics, continuousOfflineDuration time.Duration) bool {
+	return !data.LastCloseTime.IsZero() &&
+		data.LastStartTime.Before(data.LastCloseTime) &&
+		m.clock.Since(data.LastCloseTime) > continuousOfflineDuration
+}
+
 func (m *serverMetrics) ClearOfflineProxies() (int, int) {
 	return m.clearUselessInfo(0)
 }
 
+func (m *serverMetrics) PruneOfflineProxies() (int, int) {
+	return m.clearUselessInfo(0)
+}
+
 func (m *serverMetrics) NewClient() {
 	m.info.ClientCounts.Inc(1)
 }
@@ -121,7 +149,7 @@ func (m *serverMetrics) NewProxy(name string, proxyType string, user string, cli
 	}
 	proxyStats.User = user
 	proxyStats.ClientID = clientID
-	proxyStats.LastStartTime = time.Now()
+	proxyStats.LastStartTime = m.clock.Now()
 }
 
 func (m *serverMetrics) CloseProxy(name string, proxyType string) {
@@ -131,7 +159,7 @@ func (m *serverMetrics) CloseProxy(name string, proxyType string) {
 		counter.Dec(1)
 	}
 	if proxyStats, ok := m.info.ProxyStatistics[name]; ok {
-		proxyStats.LastCloseTime = time.Now()
+		proxyStats.LastCloseTime = m.clock.Now()
 	}
 }
 
@@ -211,9 +239,11 @@ func toProxyStats(name string, proxyStats *ProxyStatistics) *ProxyStats {
 	}
 	if !proxyStats.LastStartTime.IsZero() {
 		ps.LastStartTime = proxyStats.LastStartTime.Format("01-02 15:04:05")
+		ps.LastStartAt = proxyStats.LastStartTime.Unix()
 	}
 	if !proxyStats.LastCloseTime.IsZero() {
 		ps.LastCloseTime = proxyStats.LastCloseTime.Format("01-02 15:04:05")
+		ps.LastCloseAt = proxyStats.LastCloseTime.Unix()
 	}
 	return ps
 }

pkg/metrics/mem/server_test.go

@@ -0,0 +1,153 @@
+package mem
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	clocktesting "k8s.io/utils/clock/testing"
+)
+
+func TestServerMetricsUsesClockForProxyTimestamps(t *testing.T) {
+	require := require.New(t)
+
+	start := time.Date(2026, time.May, 8, 12, 30, 0, 0, time.UTC)
+	clk := clocktesting.NewFakeClock(start)
+	metrics := newServerMetricsWithClock(clk)
+
+	metrics.NewProxy("proxy", "tcp", "user", "client-id")
+	require.Equal(start, metrics.info.ProxyStatistics["proxy"].LastStartTime)
+
+	closedAt := start.Add(time.Minute)
+	clk.SetTime(closedAt)
+	metrics.CloseProxy("proxy", "tcp")
+	require.Equal(closedAt, metrics.info.ProxyStatistics["proxy"].LastCloseTime)
+
+	stats := metrics.GetProxyByName("proxy")
+	require.Equal(start.Format("01-02 15:04:05"), stats.LastStartTime)
+	require.Equal(closedAt.Format("01-02 15:04:05"), stats.LastCloseTime)
+	require.Equal(start.Unix(), stats.LastStartAt)
+	require.Equal(closedAt.Unix(), stats.LastCloseAt)
+}
+
+func TestServerMetricsClearUselessInfoUsesClock(t *testing.T) {
+	require := require.New(t)
+
+	start := time.Date(2026, time.May, 8, 12, 30, 0, 0, time.UTC)
+	clk := clocktesting.NewFakeClock(start.Add(25 * time.Hour))
+	metrics := newServerMetricsWithClock(clk)
+	metrics.info.ProxyStatistics["proxy"] = &ProxyStatistics{
+		Name:          "proxy",
+		LastStartTime: start.Add(-time.Hour),
+		LastCloseTime: start,
+	}
+
+	count, total := metrics.clearUselessInfo(24 * time.Hour)
+
+	require.Equal(1, count)
+	require.Equal(1, total)
+	require.Empty(metrics.info.ProxyStatistics)
+}
+
+func TestServerMetricsClearOfflineProxiesPreservesLegacyTotal(t *testing.T) {
+	require := require.New(t)
+
+	start := time.Date(2026, time.May, 8, 12, 30, 0, 0, time.UTC)
+	clk := clocktesting.NewFakeClock(start.Add(time.Minute))
+	metrics := newServerMetricsWithClock(clk)
+	metrics.info.ProxyStatistics["offline"] = &ProxyStatistics{
+		Name:          "offline",
+		LastStartTime: start.Add(-time.Hour),
+		LastCloseTime: start,
+	}
+	metrics.info.ProxyStatistics["online"] = &ProxyStatistics{
+		Name:          "online",
+		LastStartTime: start,
+	}
+
+	cleared, total := metrics.ClearOfflineProxies()
+
+	require.Equal(1, cleared)
+	require.Equal(2, total)
+	require.False(metrics.hasProxyStatistics("offline"))
+	require.True(metrics.hasProxyStatistics("online"))
+}
+
+func TestServerMetricsPruneOfflineProxiesReportsTotalStats(t *testing.T) {
+	require := require.New(t)
+
+	start := time.Date(2026, time.May, 8, 12, 30, 0, 0, time.UTC)
+	clk := clocktesting.NewFakeClock(start.Add(time.Minute))
+	metrics := newServerMetricsWithClock(clk)
+	metrics.info.ProxyStatistics["offline"] = &ProxyStatistics{
+		Name:          "offline",
+		LastStartTime: start.Add(-time.Hour),
+		LastCloseTime: start,
+	}
+	metrics.info.ProxyStatistics["online"] = &ProxyStatistics{
+		Name:          "online",
+		LastStartTime: start,
+	}
+	metrics.info.ProxyStatistics["restarted"] = &ProxyStatistics{
+		Name:          "restarted",
+		LastStartTime: start.Add(30 * time.Second),
+		LastCloseTime: start,
+	}
+	metrics.info.ProxyStatistics["same-time"] = &ProxyStatistics{
+		Name:          "same-time",
+		LastStartTime: start,
+		LastCloseTime: start,
+	}
+
+	cleared, total := metrics.PruneOfflineProxies()
+
+	require.Equal(1, cleared)
+	require.Equal(4, total)
+	require.False(metrics.hasProxyStatistics("offline"))
+	require.True(metrics.hasProxyStatistics("online"))
+	require.True(metrics.hasProxyStatistics("restarted"))
+	require.True(metrics.hasProxyStatistics("same-time"))
+
+	cleared, total = metrics.PruneOfflineProxies()
+	require.Equal(0, cleared)
+	require.Equal(3, total)
+}
+
+func TestServerMetricsRunUsesClockTicker(t *testing.T) {
+	require := require.New(t)
+
+	start := time.Date(2026, time.May, 8, 12, 30, 0, 0, time.UTC)
+	clk := clocktesting.NewFakeClock(start)
+	metrics := newServerMetricsWithClock(clk)
+	metrics.info.ProxyStatistics["proxy"] = &ProxyStatistics{
+		Name:          "proxy",
+		LastStartTime: start.Add(-time.Hour),
+		LastCloseTime: start,
+	}
+
+	stopCh := make(chan struct{})
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		metrics.runUntil(stopCh)
+	}()
+	t.Cleanup(func() {
+		close(stopCh)
+		<-done
+	})
+
+	require.Eventually(clk.HasWaiters, time.Second, time.Millisecond)
+	clk.Step(8 * 24 * time.Hour)
+
+	require.Eventually(func() bool {
+		return !metrics.hasProxyStatistics("proxy")
+	}, time.Second, time.Millisecond)
+}
+
+func (m *serverMetrics) hasProxyStatistics(name string) bool {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	_, ok := m.info.ProxyStatistics[name]
+	return ok
+}

pkg/metrics/mem/types.go

@@ -41,6 +41,8 @@ type ProxyStats struct {
 	TodayTrafficOut int64
 	LastStartTime   string
 	LastCloseTime   string
+	LastStartAt     int64
+	LastCloseAt     int64
 	CurConns        int64
 }
 
@@ -85,4 +87,5 @@ type Collector interface {
 	GetProxyByName(proxyName string) *ProxyStats
 	GetProxyTraffic(name string) *ProxyTrafficInfo
 	ClearOfflineProxies() (int, int)
+	PruneOfflineProxies() (int, int)
 }

pkg/msg/handler.go

@@ -112,7 +112,6 @@ type Dispatcher struct {
 	sendCh      chan Message
 	doneCh      chan struct{}
 	msgHandlers map[reflect.Type]func(Message)
-	defaultHandler func(Message)
 }
 
 func NewDispatcher(rw ReadWriter) *Dispatcher {
@@ -151,8 +150,6 @@ func (d *Dispatcher) readLoop() {
 
 		if handler, ok := d.msgHandlers[reflect.TypeOf(m)]; ok {
 			handler(m)
-		} else if d.defaultHandler != nil {
-			d.defaultHandler(m)
 		}
 	}
 }
@@ -170,10 +167,6 @@ func (d *Dispatcher) RegisterHandler(msg Message, handler func(Message)) {
 	d.msgHandlers[reflect.TypeOf(msg)] = handler
 }
 
-func (d *Dispatcher) RegisterDefaultHandler(handler func(Message)) {
-	d.defaultHandler = handler
-}
-
 func (d *Dispatcher) Done() chan struct{} {
 	return d.doneCh
 }

pkg/msg/wire_v2_test.go

@@ -43,9 +43,28 @@ func TestV2ReadWriterRoundTrip(t *testing.T) {
 func TestNewReadWriter(t *testing.T) {
 	require.IsType(t, &V1ReadWriter{}, NewReadWriter(&bytes.Buffer{}, ""))
 	require.IsType(t, &V1ReadWriter{}, NewReadWriter(&bytes.Buffer{}, wire.ProtocolV1))
+	require.IsType(t, &V1ReadWriter{}, NewReadWriter(&bytes.Buffer{}, "unknown"))
 	require.IsType(t, &V2ReadWriter{}, NewReadWriter(&bytes.Buffer{}, wire.ProtocolV2))
 }
 
+func TestNewReadWriterEncoding(t *testing.T) {
+	for _, wireProtocol := range []string{"", wire.ProtocolV1} {
+		var legacy bytes.Buffer
+		legacyRW := NewReadWriter(&legacy, wireProtocol)
+		require.NoError(t, legacyRW.WriteMsg(&UDPPacket{Content: []byte("legacy")}))
+		require.NotEmpty(t, legacy.Bytes())
+		require.Equal(t, TypeUDPPacket, legacy.Bytes()[0])
+	}
+
+	var v2 bytes.Buffer
+	v2RW := NewReadWriter(&v2, wire.ProtocolV2)
+	require.NoError(t, v2RW.WriteMsg(&UDPPacket{Content: []byte("v2")}))
+	frame, err := wire.NewConn(&v2).ReadFrame()
+	require.NoError(t, err)
+	require.Equal(t, wire.FrameTypeMessage, frame.Type)
+	require.Equal(t, V2TypeUDPPacket, binary.BigEndian.Uint16(frame.Payload[:2]))
+}
+
 func TestV2MessageTypeIDsAreStable(t *testing.T) {
 	require.Equal(t, uint16(1), V2TypeLogin)
 	require.Equal(t, uint16(2), V2TypeLoginResp)

pkg/nathole/analysis.go

@@ -21,6 +21,7 @@ import (
 	"time"
 
 	"github.com/samber/lo"
+	"k8s.io/utils/clock"
 )
 
 var (
@@ -144,19 +145,19 @@ func getBehaviorByModeAndIndex(mode int, index int) (RecommandBehavior, Recomman
 	return behaviors[index].A, behaviors[index].B
 }
 
-func getBehaviorScoresByMode(mode int, defaultScore int) []*BehaviorScore {
+func getBehaviorScoresByMode(mode int, defaultScore int) []*behaviorScore {
 	return getBehaviorScoresByMode2(mode, defaultScore, defaultScore)
 }
 
-func getBehaviorScoresByMode2(mode int, senderScore, receiverScore int) []*BehaviorScore {
+func getBehaviorScoresByMode2(mode int, senderScore, receiverScore int) []*behaviorScore {
 	behaviors := getBehaviorByMode(mode)
-	scores := make([]*BehaviorScore, 0, len(behaviors))
+	scores := make([]*behaviorScore, 0, len(behaviors))
 	for i := range behaviors {
 		score := receiverScore
 		if behaviors[i].A.Role == DetectRoleSender {
 			score = senderScore
 		}
-		scores = append(scores, &BehaviorScore{Mode: mode, Index: i, Score: score})
+		scores = append(scores, &behaviorScore{Mode: mode, Index: i, Score: score})
 	}
 	return scores
 }
@@ -170,14 +171,18 @@ type RecommandBehavior struct {
 	ListenRandomPorts int
 }
 
-type MakeHoleRecords struct {
+type makeHoleRecords struct {
 	mu             sync.Mutex
-	scores         []*BehaviorScore
-	LastUpdateTime time.Time
+	scores         []*behaviorScore
+	clock          clock.PassiveClock
+	lastUpdateTime time.Time
 }
 
-func NewMakeHoleRecords(c, v *NatFeature) *MakeHoleRecords {
-	scores := []*BehaviorScore{}
+func newMakeHoleRecordsWithClock(c, v *NatFeature, clk clock.PassiveClock) *makeHoleRecords {
+	if clk == nil {
+		clk = clock.RealClock{}
+	}
+	scores := []*behaviorScore{}
 	easyCount, hardCount, portsChangedRegularCount := ClassifyFeatureCount([]*NatFeature{c, v})
 	appendMode0 := func() {
 		switch {
@@ -212,13 +217,17 @@ func NewMakeHoleRecords(c, v *NatFeature) *MakeHoleRecords {
 		scores = append(scores, getBehaviorScoresByMode(DetectMode1, 1)...)
 		scores = append(scores, getBehaviorScoresByMode(DetectMode3, 1)...)
 	}
-	return &MakeHoleRecords{scores: scores, LastUpdateTime: time.Now()}
+	return &makeHoleRecords{
+		scores:         scores,
+		clock:          clk,
+		lastUpdateTime: clk.Now(),
+	}
 }
 
-func (mhr *MakeHoleRecords) ReportSuccess(mode int, index int) {
+func (mhr *makeHoleRecords) reportSuccess(mode int, index int) {
 	mhr.mu.Lock()
 	defer mhr.mu.Unlock()
-	mhr.LastUpdateTime = time.Now()
+	mhr.lastUpdateTime = mhr.clock.Now()
 	for i := range mhr.scores {
 		score := mhr.scores[i]
 		if score.Mode != mode || score.Index != index {
@@ -231,22 +240,22 @@ func (mhr *MakeHoleRecords) ReportSuccess(mode int, index int) {
 	}
 }
 
-func (mhr *MakeHoleRecords) Recommand() (mode, index int) {
+func (mhr *makeHoleRecords) recommand() (mode, index int) {
 	mhr.mu.Lock()
 	defer mhr.mu.Unlock()
 
 	if len(mhr.scores) == 0 {
 		return 0, 0
 	}
-	maxScore := slices.MaxFunc(mhr.scores, func(a, b *BehaviorScore) int {
+	maxScore := slices.MaxFunc(mhr.scores, func(a, b *behaviorScore) int {
 		return cmp.Compare(a.Score, b.Score)
 	})
 	maxScore.Score--
-	mhr.LastUpdateTime = time.Now()
+	mhr.lastUpdateTime = mhr.clock.Now()
 	return maxScore.Mode, maxScore.Index
 }
 
-type BehaviorScore struct {
+type behaviorScore struct {
 	Mode  int
 	Index int
 	// between -10 and 10
@@ -255,16 +264,25 @@ type BehaviorScore struct {
 
 type Analyzer struct {
 	// key is client ip + visitor ip
-	records             map[string]*MakeHoleRecords
+	records             map[string]*makeHoleRecords
 	dataReserveDuration time.Duration
+	clock               clock.PassiveClock
 
 	mu sync.Mutex
 }
 
 func NewAnalyzer(dataReserveDuration time.Duration) *Analyzer {
+	return newAnalyzerWithClock(dataReserveDuration, clock.RealClock{})
+}
+
+func newAnalyzerWithClock(dataReserveDuration time.Duration, clk clock.PassiveClock) *Analyzer {
+	if clk == nil {
+		clk = clock.RealClock{}
+	}
 	return &Analyzer{
-		records:             make(map[string]*MakeHoleRecords),
+		records:             make(map[string]*makeHoleRecords),
 		dataReserveDuration: dataReserveDuration,
+		clock:               clk,
 	}
 }
 
@@ -272,12 +290,12 @@ func (a *Analyzer) GetRecommandBehaviors(key string, c, v *NatFeature) (mode, in
 	a.mu.Lock()
 	records, ok := a.records[key]
 	if !ok {
-		records = NewMakeHoleRecords(c, v)
+		records = newMakeHoleRecordsWithClock(c, v, a.clock)
 		a.records[key] = records
 	}
 	a.mu.Unlock()
 
-	mode, index = records.Recommand()
+	mode, index = records.recommand()
 	cBehavior, vBehavior := getBehaviorByModeAndIndex(mode, index)
 
 	switch mode {
@@ -307,11 +325,11 @@ func (a *Analyzer) ReportSuccess(key string, mode, index int) {
 	if !ok {
 		return
 	}
-	records.ReportSuccess(mode, index)
+	records.reportSuccess(mode, index)
 }
 
 func (a *Analyzer) Clean() (int, int) {
-	now := time.Now()
+	now := a.clock.Now()
 	total := 0
 	count := 0
 
@@ -321,7 +339,7 @@ func (a *Analyzer) Clean() (int, int) {
 	total = len(a.records)
 	// clean up records that have not been used for a period of time.
 	for key, records := range a.records {
-		if now.Sub(records.LastUpdateTime) > a.dataReserveDuration {
+		if now.Sub(records.lastUpdateTime) > a.dataReserveDuration {
 			delete(a.records, key)
 			count++
 		}

pkg/nathole/analysis_test.go

@@ -0,0 +1,33 @@
+package nathole
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	clocktesting "k8s.io/utils/clock/testing"
+)
+
+func TestAnalyzerUsesClockForRecordTimestamps(t *testing.T) {
+	require := require.New(t)
+
+	start := time.Date(2026, time.May, 8, 12, 30, 0, 0, time.UTC)
+	clk := clocktesting.NewFakeClock(start)
+	analyzer := newAnalyzerWithClock(time.Hour, clk)
+	clientFeature := &NatFeature{NatType: EasyNAT, Behavior: BehaviorNoChange}
+	visitorFeature := &NatFeature{NatType: EasyNAT, Behavior: BehaviorNoChange}
+
+	mode, index, _, _ := analyzer.GetRecommandBehaviors("key", clientFeature, visitorFeature)
+	require.Equal(start, analyzer.records["key"].lastUpdateTime)
+
+	updatedAt := start.Add(time.Minute)
+	clk.SetTime(updatedAt)
+	analyzer.ReportSuccess("key", mode, index)
+	require.Equal(updatedAt, analyzer.records["key"].lastUpdateTime)
+
+	clk.SetTime(start.Add(2 * time.Hour))
+	count, total := analyzer.Clean()
+	require.Equal(1, count)
+	require.Equal(1, total)
+	require.Empty(analyzer.records)
+}

pkg/nathole/controller.go

@@ -326,40 +326,16 @@ func (c *Controller) analysis(session *Session) (*msg.NatHoleResp, *msg.NatHoleR
 	}
 
 	protocol := vm.Protocol
-	vResp := &msg.NatHoleResp{
-		TransactionID:  vm.TransactionID,
-		Sid:            session.sid,
-		Protocol:       protocol,
-		CandidateAddrs: slices.Compact(cm.MappedAddrs),
-		AssistedAddrs:  slices.Compact(cm.AssistedAddrs),
-		DetectBehavior: msg.NatHoleDetectBehavior{
-			Mode:              mode,
-			Role:              vBehavior.Role,
-			TTL:               vBehavior.TTL,
-			SendDelayMs:       vBehavior.SendDelayMs,
-			ReadTimeoutMs:     timeoutMs - vBehavior.SendDelayMs,
-			SendRandomPorts:   vBehavior.PortsRandomNumber,
-			ListenRandomPorts: vBehavior.ListenRandomPorts,
-			CandidatePorts:    getRangePorts(cm.MappedAddrs, cNatFeature.PortsDifference, vBehavior.PortsRangeNumber),
-		},
-	}
-	cResp := &msg.NatHoleResp{
-		TransactionID:  cm.TransactionID,
-		Sid:            session.sid,
-		Protocol:       protocol,
-		CandidateAddrs: slices.Compact(vm.MappedAddrs),
-		AssistedAddrs:  slices.Compact(vm.AssistedAddrs),
-		DetectBehavior: msg.NatHoleDetectBehavior{
-			Mode:              mode,
-			Role:              cBehavior.Role,
-			TTL:               cBehavior.TTL,
-			SendDelayMs:       cBehavior.SendDelayMs,
-			ReadTimeoutMs:     timeoutMs - cBehavior.SendDelayMs,
-			SendRandomPorts:   cBehavior.PortsRandomNumber,
-			ListenRandomPorts: cBehavior.ListenRandomPorts,
-			CandidatePorts:    getRangePorts(vm.MappedAddrs, vNatFeature.PortsDifference, cBehavior.PortsRangeNumber),
-		},
-	}
+	vResp := newNatHoleResponse(
+		vm.TransactionID, session.sid, protocol, mode,
+		cm.MappedAddrs, cm.AssistedAddrs, vBehavior,
+		timeoutMs-vBehavior.SendDelayMs, cNatFeature.PortsDifference,
+	)
+	cResp := newNatHoleResponse(
+		cm.TransactionID, session.sid, protocol, mode,
+		vm.MappedAddrs, vm.AssistedAddrs, cBehavior,
+		timeoutMs-cBehavior.SendDelayMs, vNatFeature.PortsDifference,
+	)
 
 	log.Debugf("sid [%s] visitor nat: %+v, candidateAddrs: %v; client nat: %+v, candidateAddrs: %v, protocol: %s",
 		session.sid, *vNatFeature, vm.MappedAddrs, *cNatFeature, cm.MappedAddrs, protocol)
@@ -368,6 +344,38 @@ func (c *Controller) analysis(session *Session) (*msg.NatHoleResp, *msg.NatHoleR
 	return vResp, cResp, nil
 }
 
+func newNatHoleResponse(
+	transactionID string,
+	sid string,
+	protocol string,
+	mode int,
+	candidateAddrs []string,
+	assistedAddrs []string,
+	behavior RecommandBehavior,
+	readTimeoutMs int,
+	portsDifference int,
+) *msg.NatHoleResp {
+	compactCandidateAddrs := slices.Compact(candidateAddrs)
+	compactAssistedAddrs := slices.Compact(assistedAddrs)
+	return &msg.NatHoleResp{
+		TransactionID:  transactionID,
+		Sid:            sid,
+		Protocol:       protocol,
+		CandidateAddrs: compactCandidateAddrs,
+		AssistedAddrs:  compactAssistedAddrs,
+		DetectBehavior: msg.NatHoleDetectBehavior{
+			Mode:              mode,
+			Role:              behavior.Role,
+			TTL:               behavior.TTL,
+			SendDelayMs:       behavior.SendDelayMs,
+			ReadTimeoutMs:     readTimeoutMs,
+			SendRandomPorts:   behavior.PortsRandomNumber,
+			ListenRandomPorts: behavior.ListenRandomPorts,
+			CandidatePorts:    getRangePorts(candidateAddrs, portsDifference, behavior.PortsRangeNumber),
+		},
+	}
+}
+
 func getRangePorts(addrs []string, difference, maxNumber int) []msg.PortsRange {
 	if maxNumber <= 0 {
 		return nil

pkg/nathole/discovery.go

@@ -15,31 +15,24 @@
 package nathole
 
 import (
+	"errors"
 	"fmt"
 	"net"
 	"time"
 
-	"github.com/pion/stun/v3"
+	"github.com/fatedier/golib/net/stun"
 )
 
 var responseTimeout = 3 * time.Second
 
-type Message struct {
-	Body []byte
-	Addr string
-}
-
 // If the localAddr is empty, it will listen on a random port.
 func Discover(stunServers []string, localAddr string) ([]string, net.Addr, error) {
-	// create a discoverConn and get response from messageChan
 	discoverConn, err := listen(localAddr)
 	if err != nil {
 		return nil, nil, err
 	}
 	defer discoverConn.Close()
 
-	go discoverConn.readLoop()
-
 	addresses := make([]string, 0, len(stunServers))
 	for _, addr := range stunServers {
 		// get external address from stun server
@@ -59,9 +52,8 @@ type stunResponse struct {
 
 type discoverConn struct {
 	conn      *net.UDPConn
-
+	client    *stun.Client
 	localAddr net.Addr
-	messageChan chan *Message
 }
 
 func listen(localAddr string) (*discoverConn, error) {
@@ -77,82 +69,50 @@ func listen(localAddr string) (*discoverConn, error) {
 	if err != nil {
 		return nil, err
 	}
+	client, err := stun.NewClient(conn)
+	if err != nil {
+		_ = conn.Close()
+		return nil, err
+	}
 
 	return &discoverConn{
 		conn:      conn,
+		client:    client,
 		localAddr: conn.LocalAddr(),
-		messageChan: make(chan *Message, 10),
 	}, nil
 }
 
 func (c *discoverConn) Close() error {
-	if c.messageChan != nil {
-		close(c.messageChan)
-		c.messageChan = nil
-	}
 	return c.conn.Close()
 }
 
-func (c *discoverConn) readLoop() {
-	for {
-		buf := make([]byte, 1024)
-		n, addr, err := c.conn.ReadFromUDP(buf)
-		if err != nil {
-			return
-		}
-		buf = buf[:n]
-
-		c.messageChan <- &Message{
-			Body: buf,
-			Addr: addr.String(),
-		}
-	}
-}
-
 func (c *discoverConn) doSTUNRequest(addr string) (*stunResponse, error) {
 	serverAddr, err := net.ResolveUDPAddr("udp4", addr)
 	if err != nil {
 		return nil, err
 	}
-	request, err := stun.Build(stun.TransactionID, stun.BindingRequest)
+	transaction, err := stun.NewBindingTransaction(serverAddr)
 	if err != nil {
 		return nil, err
 	}
-
-	if err = request.NewTransactionID(); err != nil {
+	if err := c.conn.SetReadDeadline(time.Now().Add(responseTimeout)); err != nil {
 		return nil, err
 	}
-	if _, err := c.conn.WriteTo(request.Raw, serverAddr); err != nil {
-		return nil, err
-	}
-
-	var m stun.Message
-	select {
-	case msg := <-c.messageChan:
-		m.Raw = msg.Body
-		if err := m.Decode(); err != nil {
-			return nil, err
-		}
-	case <-time.After(responseTimeout):
+	response, err := c.client.Do(transaction)
+	if err != nil {
+		var netErr net.Error
+		if errors.As(err, &netErr) && netErr.Timeout() {
 			return nil, fmt.Errorf("wait response from stun server timeout")
 		}
-	xorAddrGetter := &stun.XORMappedAddress{}
-	mappedAddrGetter := &stun.MappedAddress{}
-	changedAddrGetter := ChangedAddress{}
-	otherAddrGetter := &stun.OtherAddress{}
+		return nil, err
+	}
 
 	resp := &stunResponse{}
-	if err := mappedAddrGetter.GetFrom(&m); err == nil {
-		resp.externalAddr = mappedAddrGetter.String()
+	if response.MappedAddr != nil {
+		resp.externalAddr = response.MappedAddr.String()
 	}
-	if err := xorAddrGetter.GetFrom(&m); err == nil {
-		resp.externalAddr = xorAddrGetter.String()
-	}
-	if err := changedAddrGetter.GetFrom(&m); err == nil {
-		resp.otherAddr = changedAddrGetter.String()
-	}
-	if err := otherAddrGetter.GetFrom(&m); err == nil {
-		resp.otherAddr = otherAddrGetter.String()
+	if response.OtherAddr != nil {
+		resp.otherAddr = response.OtherAddr.String()
 	}
 	return resp, nil
 }

pkg/nathole/discovery_test.go

@@ -0,0 +1,382 @@
+package nathole
+
+import (
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/fatedier/golib/net/stun"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	testBindingRequest  = 0x0001
+	testBindingSuccess  = 0x0101
+	testBindingError    = 0x0111
+	testMagicCookie     = 0x2112a442
+	testAttrMapped      = 0x0001
+	testAttrChanged     = 0x0005
+	testAttrErrorCode   = 0x0009
+	testAttrXORMapped   = 0x0020
+	testAttrOther       = 0x802c
+	testSTUNHeaderSize  = 20
+	testSTUNServerLimit = time.Second
+)
+
+type testSTUNAttribute struct {
+	typ   uint16
+	value []byte
+}
+
+type testSTUNExchange struct {
+	source *net.UDPAddr
+	err    error
+}
+
+func listenTestUDP4(t *testing.T) *net.UDPConn {
+	t.Helper()
+
+	conn, err := net.ListenUDP("udp4", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1)})
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = conn.Close() })
+	return conn
+}
+
+func serveOneSTUNRequest(
+	server *net.UDPConn,
+	buildResponse func([]byte, *net.UDPAddr) ([]byte, error),
+) <-chan testSTUNExchange {
+	done := make(chan testSTUNExchange, 1)
+	go func() {
+		if err := server.SetDeadline(time.Now().Add(testSTUNServerLimit)); err != nil {
+			done <- testSTUNExchange{err: err}
+			return
+		}
+		buffer := make([]byte, 1024)
+		n, source, err := server.ReadFromUDP(buffer)
+		if err == nil && buildResponse != nil {
+			var response []byte
+			response, err = buildResponse(buffer[:n], source)
+			if err == nil && response != nil {
+				_, err = server.WriteToUDP(response, source)
+			}
+		}
+		done <- testSTUNExchange{source: source, err: err}
+	}()
+	return done
+}
+
+func waitSTUNExchange(t *testing.T, done <-chan testSTUNExchange) *net.UDPAddr {
+	t.Helper()
+
+	select {
+	case exchange := <-done:
+		require.NoError(t, exchange.err)
+		return exchange.source
+	case <-time.After(testSTUNServerLimit):
+		t.Fatal("timed out waiting for local STUN server")
+		return nil
+	}
+}
+
+func makeTestSTUNResponse(request []byte, typ uint16, attributes ...testSTUNAttribute) ([]byte, error) {
+	if len(request) != testSTUNHeaderSize || binary.BigEndian.Uint16(request[0:2]) != testBindingRequest ||
+		binary.BigEndian.Uint32(request[4:8]) != testMagicCookie {
+		return nil, fmt.Errorf("invalid Binding request")
+	}
+
+	length := 0
+	for _, attribute := range attributes {
+		length += 4 + (len(attribute.value)+3)&^3
+	}
+	response := make([]byte, testSTUNHeaderSize, testSTUNHeaderSize+length)
+	binary.BigEndian.PutUint16(response[0:2], typ)
+	binary.BigEndian.PutUint16(response[2:4], uint16(length))
+	binary.BigEndian.PutUint32(response[4:8], testMagicCookie)
+	copy(response[8:20], request[8:20])
+
+	for _, attribute := range attributes {
+		start := len(response)
+		paddedLength := (len(attribute.value) + 3) &^ 3
+		response = append(response, make([]byte, 4+paddedLength)...)
+		binary.BigEndian.PutUint16(response[start:start+2], attribute.typ)
+		binary.BigEndian.PutUint16(response[start+2:start+4], uint16(len(attribute.value)))
+		copy(response[start+4:], attribute.value)
+	}
+	return response, nil
+}
+
+func testIPv4AddressValue(ip net.IP, port int, xor bool) []byte {
+	value := make([]byte, 8)
+	value[1] = 0x01
+	binary.BigEndian.PutUint16(value[2:4], uint16(port))
+	copy(value[4:], ip.To4())
+	if xor {
+		binary.BigEndian.PutUint16(value[2:4], binary.BigEndian.Uint16(value[2:4])^uint16(testMagicCookie>>16))
+		for i := range 4 {
+			value[4+i] ^= byte(uint32(testMagicCookie) >> uint(24-8*i))
+		}
+	}
+	return value
+}
+
+func TestDiscoverReusesLocalPortAndPreservesNATClassification(t *testing.T) {
+	tests := []struct {
+		name             string
+		secondMapped     string
+		secondMappedPort int
+		wantNATType      string
+		wantBehavior     string
+	}{
+		{
+			name:             "same mapped address",
+			secondMapped:     "198.51.100.10:40000",
+			secondMappedPort: 40000,
+			wantNATType:      EasyNAT,
+			wantBehavior:     BehaviorNoChange,
+		},
+		{
+			name:             "different mapped port",
+			secondMapped:     "198.51.100.10:40001",
+			secondMappedPort: 40001,
+			wantNATType:      HardNAT,
+			wantBehavior:     BehaviorPortChanged,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			primary := listenTestUDP4(t)
+			alternate := listenTestUDP4(t)
+			alternateAddr := alternate.LocalAddr().(*net.UDPAddr)
+
+			primaryDone := serveOneSTUNRequest(primary, func(request []byte, _ *net.UDPAddr) ([]byte, error) {
+				return makeTestSTUNResponse(request, testBindingSuccess,
+					testSTUNAttribute{typ: testAttrXORMapped, value: testIPv4AddressValue(net.ParseIP("198.51.100.10"), 40000, true)},
+					testSTUNAttribute{typ: testAttrOther, value: testIPv4AddressValue(alternateAddr.IP, alternateAddr.Port, false)},
+				)
+			})
+			alternateDone := serveOneSTUNRequest(alternate, func(request []byte, _ *net.UDPAddr) ([]byte, error) {
+				return makeTestSTUNResponse(request, testBindingSuccess,
+					testSTUNAttribute{typ: testAttrXORMapped, value: testIPv4AddressValue(net.ParseIP("198.51.100.10"), tt.secondMappedPort, true)},
+				)
+			})
+
+			addresses, localAddr, err := Discover([]string{primary.LocalAddr().String()}, "")
+			require.NoError(t, err)
+			require.Equal(t, []string{"198.51.100.10:40000", tt.secondMapped}, addresses)
+
+			primarySource := waitSTUNExchange(t, primaryDone)
+			alternateSource := waitSTUNExchange(t, alternateDone)
+			require.Equal(t, primarySource.Port, alternateSource.Port)
+			require.Equal(t, localAddr.(*net.UDPAddr).Port, primarySource.Port)
+
+			feature, err := ClassifyNATFeature(addresses, nil)
+			require.NoError(t, err)
+			require.Equal(t, tt.wantNATType, feature.NatType)
+			require.Equal(t, tt.wantBehavior, feature.Behavior)
+		})
+	}
+}
+
+func TestDoSTUNRequestMapsLegacyAndModernAddresses(t *testing.T) {
+	tests := []struct {
+		name         string
+		attributes   []testSTUNAttribute
+		wantExternal string
+		wantOther    string
+	}{
+		{
+			name: "legacy",
+			attributes: []testSTUNAttribute{
+				{typ: testAttrMapped, value: testIPv4AddressValue(net.ParseIP("192.0.2.1"), 1000, false)},
+				{typ: testAttrChanged, value: testIPv4AddressValue(net.ParseIP("192.0.2.2"), 2000, false)},
+			},
+			wantExternal: "192.0.2.1:1000",
+			wantOther:    "192.0.2.2:2000",
+		},
+		{
+			name: "modern takes precedence",
+			attributes: []testSTUNAttribute{
+				{typ: testAttrMapped, value: testIPv4AddressValue(net.ParseIP("192.0.2.1"), 1000, false)},
+				{typ: testAttrXORMapped, value: testIPv4AddressValue(net.ParseIP("198.51.100.1"), 3000, true)},
+				{typ: testAttrChanged, value: testIPv4AddressValue(net.ParseIP("192.0.2.2"), 2000, false)},
+				{typ: testAttrOther, value: testIPv4AddressValue(net.ParseIP("198.51.100.2"), 4000, false)},
+			},
+			wantExternal: "198.51.100.1:3000",
+			wantOther:    "198.51.100.2:4000",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			server := listenTestUDP4(t)
+			done := serveOneSTUNRequest(server, func(request []byte, _ *net.UDPAddr) ([]byte, error) {
+				return makeTestSTUNResponse(request, testBindingSuccess, tt.attributes...)
+			})
+			conn, err := listen("")
+			require.NoError(t, err)
+			t.Cleanup(func() { _ = conn.Close() })
+
+			response, err := conn.doSTUNRequest(server.LocalAddr().String())
+			require.NoError(t, err)
+			require.Equal(t, tt.wantExternal, response.externalAddr)
+			require.Equal(t, tt.wantOther, response.otherAddr)
+			waitSTUNExchange(t, done)
+		})
+	}
+}
+
+func TestSTUNResponseErrorsAndMissingAddresses(t *testing.T) {
+	tests := []struct {
+		name          string
+		buildResponse func([]byte, *net.UDPAddr) ([]byte, error)
+		request       func(*discoverConn, string) error
+		checkError    func(*testing.T, error)
+	}{
+		{
+			name: "correlated malformed response",
+			buildResponse: func(request []byte, _ *net.UDPAddr) ([]byte, error) {
+				response, err := makeTestSTUNResponse(request, testBindingSuccess)
+				if err == nil {
+					binary.BigEndian.PutUint16(response[2:4], 4)
+				}
+				return response, err
+			},
+			request: func(conn *discoverConn, server string) error {
+				_, err := conn.doSTUNRequest(server)
+				return err
+			},
+			checkError: func(t *testing.T, err error) {
+				require.ErrorIs(t, err, stun.ErrMalformedResponse)
+			},
+		},
+		{
+			name: "Binding error response",
+			buildResponse: func(request []byte, _ *net.UDPAddr) ([]byte, error) {
+				return makeTestSTUNResponse(request, testBindingError, testSTUNAttribute{
+					typ:   testAttrErrorCode,
+					value: []byte{0, 0, 4, 20, 'U', 'n', 'k', 'n', 'o', 'w', 'n'},
+				})
+			},
+			request: func(conn *discoverConn, server string) error {
+				_, err := conn.doSTUNRequest(server)
+				return err
+			},
+			checkError: func(t *testing.T, err error) {
+				var responseErr *stun.ResponseError
+				require.ErrorAs(t, err, &responseErr)
+				require.Equal(t, 420, responseErr.Code)
+			},
+		},
+		{
+			name: "missing mapped address",
+			buildResponse: func(request []byte, _ *net.UDPAddr) ([]byte, error) {
+				return makeTestSTUNResponse(request, testBindingSuccess,
+					testSTUNAttribute{typ: testAttrOther, value: testIPv4AddressValue(net.ParseIP("192.0.2.2"), 2000, false)},
+				)
+			},
+			request: func(conn *discoverConn, server string) error {
+				_, err := conn.discoverFromStunServer(server)
+				return err
+			},
+			checkError: func(t *testing.T, err error) {
+				require.EqualError(t, err, "no external address found")
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			server := listenTestUDP4(t)
+			done := serveOneSTUNRequest(server, tt.buildResponse)
+			conn, err := listen("")
+			require.NoError(t, err)
+			t.Cleanup(func() { _ = conn.Close() })
+
+			err = tt.request(conn, server.LocalAddr().String())
+			tt.checkError(t, err)
+			waitSTUNExchange(t, done)
+		})
+	}
+
+	t.Run("missing other address", func(t *testing.T) {
+		server := listenTestUDP4(t)
+		done := serveOneSTUNRequest(server, func(request []byte, _ *net.UDPAddr) ([]byte, error) {
+			return makeTestSTUNResponse(request, testBindingSuccess,
+				testSTUNAttribute{typ: testAttrXORMapped, value: testIPv4AddressValue(net.ParseIP("198.51.100.1"), 3000, true)},
+			)
+		})
+
+		_, err := Prepare([]string{server.LocalAddr().String()}, PrepareOptions{})
+		require.EqualError(t, err, "discover error: not enough addresses")
+		waitSTUNExchange(t, done)
+	})
+}
+
+func TestSTUNTimeoutUsesCallerDeadlineWithoutRetry(t *testing.T) {
+	originalTimeout := responseTimeout
+	responseTimeout = 50 * time.Millisecond
+	t.Cleanup(func() { responseTimeout = originalTimeout })
+
+	server := listenTestUDP4(t)
+	done := serveOneSTUNRequest(server, nil)
+	conn, err := listen("")
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = conn.Close() })
+
+	_, err = conn.doSTUNRequest(server.LocalAddr().String())
+	require.EqualError(t, err, "wait response from stun server timeout")
+	waitSTUNExchange(t, done)
+
+	require.NoError(t, server.SetReadDeadline(time.Now().Add(50*time.Millisecond)))
+	_, _, err = server.ReadFromUDP(make([]byte, 1))
+	var netErr net.Error
+	require.ErrorAs(t, err, &netErr)
+	require.True(t, netErr.Timeout())
+}
+
+func TestSTUNClientLeavesSocketAndDeadlineWithCaller(t *testing.T) {
+	originalTimeout := responseTimeout
+	responseTimeout = 100 * time.Millisecond
+	t.Cleanup(func() { responseTimeout = originalTimeout })
+
+	server := listenTestUDP4(t)
+	unrelated := listenTestUDP4(t)
+	done := serveOneSTUNRequest(server, func(request []byte, source *net.UDPAddr) ([]byte, error) {
+		response, err := makeTestSTUNResponse(request, testBindingSuccess,
+			testSTUNAttribute{typ: testAttrXORMapped, value: testIPv4AddressValue(net.ParseIP("198.51.100.5"), 5000, true)},
+		)
+		if err != nil {
+			return nil, err
+		}
+		if _, err := unrelated.WriteToUDP(response, source); err != nil {
+			return nil, err
+		}
+		return response, nil
+	})
+	conn, err := listen("")
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = conn.Close() })
+
+	response, err := conn.doSTUNRequest(server.LocalAddr().String())
+	require.NoError(t, err)
+	require.Equal(t, "198.51.100.5:5000", response.externalAddr)
+	waitSTUNExchange(t, done)
+
+	_, _, err = conn.conn.ReadFromUDP(make([]byte, 1))
+	var netErr net.Error
+	require.True(t, errors.As(err, &netErr))
+	require.True(t, netErr.Timeout())
+
+	require.NoError(t, conn.conn.SetDeadline(time.Time{}))
+	require.NoError(t, server.SetReadDeadline(time.Now().Add(testSTUNServerLimit)))
+	_, err = conn.conn.WriteToUDP([]byte{1}, server.LocalAddr().(*net.UDPAddr))
+	require.NoError(t, err)
+	_, source, err := server.ReadFromUDP(make([]byte, 1))
+	require.NoError(t, err)
+	require.Equal(t, conn.localAddr.(*net.UDPAddr).Port, source.Port)
+}

pkg/nathole/utils.go

@@ -18,10 +18,8 @@ import (
 	"bytes"
 	"fmt"
 	"net"
-	"strconv"
 
 	"github.com/fatedier/golib/crypto"
-	"github.com/pion/stun/v3"
 
 	"github.com/fatedier/frp/pkg/msg"
 )
@@ -48,20 +46,6 @@ func DecodeMessageInto(data, key []byte, m msg.Message) error {
 	return msg.ReadMsgInto(bytes.NewReader(buf), m)
 }
 
-type ChangedAddress struct {
-	IP   net.IP
-	Port int
-}
-
-func (s *ChangedAddress) GetFrom(m *stun.Message) error {
-	a := (*stun.MappedAddress)(s)
-	return a.GetFromAs(m, stun.AttrChangedAddress)
-}
-
-func (s *ChangedAddress) String() string {
-	return net.JoinHostPort(s.IP.String(), strconv.Itoa(s.Port))
-}
-
 func ListAllLocalIPs() ([]net.IP, error) {
 	addrs, err := net.InterfaceAddrs()
 	if err != nil {

pkg/plugin/client/http2http.go

@@ -17,17 +17,9 @@
 package client
 
 import (
-	"context"
-	stdlog "log"
-	"net/http"
 	"net/http/httputil"
-	"time"
-
-	"github.com/fatedier/golib/pool"
 
 	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/util/log"
-	netpkg "github.com/fatedier/frp/pkg/util/net"
 )
 
 func init() {
@@ -37,57 +29,28 @@ func init() {
 type HTTP2HTTPPlugin struct {
 	opts *v1.HTTP2HTTPPluginOptions
 
-	l *Listener
-	s *http.Server
+	*httpBridgePlugin
 }
 
 func NewHTTP2HTTPPlugin(_ PluginContext, options v1.ClientPluginOptions) (Plugin, error) {
 	opts := options.(*v1.HTTP2HTTPPluginOptions)
 
-	listener := NewProxyListener()
-
 	p := &HTTP2HTTPPlugin{
 		opts: opts,
-		l:    listener,
 	}
 
-	rp := &httputil.ReverseProxy{
-		Rewrite: func(r *httputil.ProxyRequest) {
+	rp := newHTTPBridgeReverseProxy(
+		func(r *httputil.ProxyRequest) {
 			req := r.Out
-			req.URL.Scheme = "http"
-			req.URL.Host = p.opts.LocalAddr
-			if p.opts.HostHeaderRewrite != "" {
-				req.Host = p.opts.HostHeaderRewrite
-			}
-			for k, v := range p.opts.RequestHeaders.Set {
-				req.Header.Set(k, v)
-			}
+			rewriteHTTPPluginRequest(req, "http", p.opts.LocalAddr, p.opts.HostHeaderRewrite, p.opts.RequestHeaders)
 		},
-		BufferPool: pool.NewBuffer(32 * 1024),
-		ErrorLog:   stdlog.New(log.NewWriteLogger(log.WarnLevel, 2), "", 0),
-	}
-
-	p.s = &http.Server{
-		Handler:           rp,
-		ReadHeaderTimeout: 60 * time.Second,
-	}
-
-	go func() {
-		_ = p.s.Serve(listener)
-	}()
+		nil,
+	)
+	p.httpBridgePlugin = newHTTPBridgePluginServer(rp, false)
 
 	return p, nil
 }
 
-func (p *HTTP2HTTPPlugin) Handle(_ context.Context, connInfo *ConnectionInfo) {
-	wrapConn := netpkg.WrapReadWriteCloserToConn(connInfo.Conn, connInfo.UnderlyingConn)
-	_ = p.l.PutConn(wrapConn)
-}
-
 func (p *HTTP2HTTPPlugin) Name() string {
 	return v1.PluginHTTP2HTTP
 }
-
-func (p *HTTP2HTTPPlugin) Close() error {
-	return p.s.Close()
-}

pkg/plugin/client/http2https.go

@@ -17,18 +17,11 @@
 package client
 
 import (
-	"context"
 	"crypto/tls"
-	stdlog "log"
 	"net/http"
 	"net/http/httputil"
-	"time"
-
-	"github.com/fatedier/golib/pool"
 
 	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/util/log"
-	netpkg "github.com/fatedier/frp/pkg/util/net"
 )
 
 func init() {
@@ -38,65 +31,35 @@ func init() {
 type HTTP2HTTPSPlugin struct {
 	opts *v1.HTTP2HTTPSPluginOptions
 
-	l *Listener
-	s *http.Server
+	*httpBridgePlugin
 }
 
 func NewHTTP2HTTPSPlugin(_ PluginContext, options v1.ClientPluginOptions) (Plugin, error) {
 	opts := options.(*v1.HTTP2HTTPSPluginOptions)
 
-	listener := NewProxyListener()
-
 	p := &HTTP2HTTPSPlugin{
 		opts: opts,
-		l:    listener,
 	}
 
 	tr := &http.Transport{
 		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
 	}
 
-	rp := &httputil.ReverseProxy{
-		Rewrite: func(r *httputil.ProxyRequest) {
+	rp := newHTTPBridgeReverseProxy(
+		func(r *httputil.ProxyRequest) {
 			r.Out.Header["X-Forwarded-For"] = r.In.Header["X-Forwarded-For"]
 			r.Out.Header["X-Forwarded-Host"] = r.In.Header["X-Forwarded-Host"]
 			r.Out.Header["X-Forwarded-Proto"] = r.In.Header["X-Forwarded-Proto"]
 			req := r.Out
-			req.URL.Scheme = "https"
-			req.URL.Host = p.opts.LocalAddr
-			if p.opts.HostHeaderRewrite != "" {
-				req.Host = p.opts.HostHeaderRewrite
-			}
-			for k, v := range p.opts.RequestHeaders.Set {
-				req.Header.Set(k, v)
-			}
+			rewriteHTTPPluginRequest(req, "https", p.opts.LocalAddr, p.opts.HostHeaderRewrite, p.opts.RequestHeaders)
 		},
-		Transport:  tr,
-		BufferPool: pool.NewBuffer(32 * 1024),
-		ErrorLog:   stdlog.New(log.NewWriteLogger(log.WarnLevel, 2), "", 0),
-	}
-
-	p.s = &http.Server{
-		Handler:           rp,
-		ReadHeaderTimeout: 60 * time.Second,
-	}
-
-	go func() {
-		_ = p.s.Serve(listener)
-	}()
+		tr,
+	)
+	p.httpBridgePlugin = newHTTPBridgePluginServer(rp, false)
 
 	return p, nil
 }
 
-func (p *HTTP2HTTPSPlugin) Handle(_ context.Context, connInfo *ConnectionInfo) {
-	wrapConn := netpkg.WrapReadWriteCloserToConn(connInfo.Conn, connInfo.UnderlyingConn)
-	_ = p.l.PutConn(wrapConn)
-}
-
 func (p *HTTP2HTTPSPlugin) Name() string {
 	return v1.PluginHTTP2HTTPS
 }
-
-func (p *HTTP2HTTPSPlugin) Close() error {
-	return p.s.Close()
-}

pkg/plugin/client/http_common.go

@@ -0,0 +1,126 @@
+// Copyright 2026 The frp Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build !frps
+
+package client
+
+import (
+	"context"
+	stdlog "log"
+	"net/http"
+	"net/http/httputil"
+	"time"
+
+	"github.com/fatedier/golib/pool"
+
+	v1 "github.com/fatedier/frp/pkg/config/v1"
+	"github.com/fatedier/frp/pkg/plugin/client/internal/httpsserver"
+	"github.com/fatedier/frp/pkg/util/log"
+	netpkg "github.com/fatedier/frp/pkg/util/net"
+)
+
+const httpBridgeReadHeaderTimeout = 60 * time.Second
+
+func rewriteHTTPPluginRequest(
+	req *http.Request,
+	scheme string,
+	localAddr string,
+	hostHeaderRewrite string,
+	requestHeaders v1.HeaderOperations,
+) {
+	req.URL.Scheme = scheme
+	req.URL.Host = localAddr
+	if hostHeaderRewrite != "" {
+		req.Host = hostHeaderRewrite
+	}
+	for k, v := range requestHeaders.Set {
+		req.Header.Set(k, v)
+	}
+}
+
+type httpBridgePlugin struct {
+	l *Listener
+	s *http.Server
+
+	useSourceRemoteAddr bool
+}
+
+func newHTTPBridgePluginServer(handler http.Handler, useSourceRemoteAddr bool) *httpBridgePlugin {
+	listener := NewProxyListener()
+	p := &httpBridgePlugin{
+		l:                   listener,
+		useSourceRemoteAddr: useSourceRemoteAddr,
+	}
+	p.s = &http.Server{
+		Handler:           handler,
+		ReadHeaderTimeout: httpBridgeReadHeaderTimeout,
+	}
+	go func() {
+		_ = p.s.Serve(listener)
+	}()
+	return p
+}
+
+func newHTTPSBridgePluginServer(
+	handler http.Handler,
+	crtPath string,
+	keyPath string,
+	enableHTTP2 *bool,
+	useSourceRemoteAddr bool,
+) (*httpBridgePlugin, error) {
+	listener := NewProxyListener()
+	server, err := httpsserver.New(handler, crtPath, keyPath, enableHTTP2)
+	if err != nil {
+		return nil, err
+	}
+	p := &httpBridgePlugin{
+		l:                   listener,
+		s:                   server,
+		useSourceRemoteAddr: useSourceRemoteAddr,
+	}
+	go func() {
+		_ = p.s.ServeTLS(listener, "", "")
+	}()
+	return p, nil
+}
+
+func newHTTPBridgeReverseProxy(
+	rewrite func(*httputil.ProxyRequest),
+	transport http.RoundTripper,
+) *httputil.ReverseProxy {
+	rp := &httputil.ReverseProxy{
+		Rewrite:    rewrite,
+		BufferPool: pool.NewBuffer(32 * 1024),
+		ErrorLog:   stdlog.New(log.NewWriteLogger(log.WarnLevel, 2), "", 0),
+	}
+	if transport != nil {
+		rp.Transport = transport
+	}
+	return rp
+}
+
+func (p *httpBridgePlugin) Handle(_ context.Context, connInfo *ConnectionInfo) {
+	wrapConn := netpkg.WrapReadWriteCloserToConn(connInfo.Conn, connInfo.UnderlyingConn)
+	if p.useSourceRemoteAddr && connInfo.SrcAddr != nil {
+		wrapConn.SetRemoteAddr(connInfo.SrcAddr)
+	}
+	_ = p.l.PutConn(wrapConn)
+}
+
+func (p *httpBridgePlugin) Close() error {
+	err := p.s.Close()
+	_ = p.l.Close()
+	return err
+}

pkg/plugin/client/https2http.go

@@ -17,22 +17,9 @@
 package client
 
 import (
-	"context"
-	"crypto/tls"
-	"fmt"
-	stdlog "log"
-	"net/http"
 	"net/http/httputil"
-	"time"
-
-	"github.com/fatedier/golib/pool"
-	"github.com/samber/lo"
 
 	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/transport"
-	httppkg "github.com/fatedier/frp/pkg/util/http"
-	"github.com/fatedier/frp/pkg/util/log"
-	netpkg "github.com/fatedier/frp/pkg/util/net"
 )
 
 func init() {
@@ -42,80 +29,35 @@ func init() {
 type HTTPS2HTTPPlugin struct {
 	opts *v1.HTTPS2HTTPPluginOptions
 
-	l *Listener
-	s *http.Server
+	*httpBridgePlugin
 }
 
 func NewHTTPS2HTTPPlugin(_ PluginContext, options v1.ClientPluginOptions) (Plugin, error) {
 	opts := options.(*v1.HTTPS2HTTPPluginOptions)
-	listener := NewProxyListener()
 
 	p := &HTTPS2HTTPPlugin{
 		opts: opts,
-		l:    listener,
 	}
 
-	rp := &httputil.ReverseProxy{
-		Rewrite: func(r *httputil.ProxyRequest) {
+	rp := newHTTPBridgeReverseProxy(
+		func(r *httputil.ProxyRequest) {
 			r.Out.Header["X-Forwarded-For"] = r.In.Header["X-Forwarded-For"]
 			r.SetXForwarded()
 			req := r.Out
-			req.URL.Scheme = "http"
-			req.URL.Host = p.opts.LocalAddr
-			if p.opts.HostHeaderRewrite != "" {
-				req.Host = p.opts.HostHeaderRewrite
-			}
-			for k, v := range p.opts.RequestHeaders.Set {
-				req.Header.Set(k, v)
-			}
+			rewriteHTTPPluginRequest(req, "http", p.opts.LocalAddr, p.opts.HostHeaderRewrite, p.opts.RequestHeaders)
 		},
-		BufferPool: pool.NewBuffer(32 * 1024),
-		ErrorLog:   stdlog.New(log.NewWriteLogger(log.WarnLevel, 2), "", 0),
-	}
-	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.TLS != nil {
-			tlsServerName, _ := httppkg.CanonicalHost(r.TLS.ServerName)
-			host, _ := httppkg.CanonicalHost(r.Host)
-			if tlsServerName != "" && tlsServerName != host {
-				w.WriteHeader(http.StatusMisdirectedRequest)
-				return
-			}
-		}
-		rp.ServeHTTP(w, r)
-	})
+		nil,
+	)
 
-	tlsConfig, err := transport.NewServerTLSConfig(p.opts.CrtPath, p.opts.KeyPath, "")
+	server, err := newHTTPSBridgePluginServer(rp, p.opts.CrtPath, p.opts.KeyPath, opts.EnableHTTP2, true)
 	if err != nil {
-		return nil, fmt.Errorf("gen TLS config error: %v", err)
+		return nil, err
 	}
+	p.httpBridgePlugin = server
 
-	p.s = &http.Server{
-		Handler:           handler,
-		ReadHeaderTimeout: 60 * time.Second,
-		TLSConfig:         tlsConfig,
-	}
-	if !lo.FromPtr(opts.EnableHTTP2) {
-		p.s.TLSNextProto = make(map[string]func(*http.Server, *tls.Conn, http.Handler))
-	}
-
-	go func() {
-		_ = p.s.ServeTLS(listener, "", "")
-	}()
 	return p, nil
 }
 
-func (p *HTTPS2HTTPPlugin) Handle(_ context.Context, connInfo *ConnectionInfo) {
-	wrapConn := netpkg.WrapReadWriteCloserToConn(connInfo.Conn, connInfo.UnderlyingConn)
-	if connInfo.SrcAddr != nil {
-		wrapConn.SetRemoteAddr(connInfo.SrcAddr)
-	}
-	_ = p.l.PutConn(wrapConn)
-}
-
 func (p *HTTPS2HTTPPlugin) Name() string {
 	return v1.PluginHTTPS2HTTP
 }
-
-func (p *HTTPS2HTTPPlugin) Close() error {
-	return p.s.Close()
-}

pkg/plugin/client/https2https.go

@@ -17,22 +17,11 @@
 package client
 
 import (
-	"context"
 	"crypto/tls"
-	"fmt"
-	stdlog "log"
 	"net/http"
 	"net/http/httputil"
-	"time"
-
-	"github.com/fatedier/golib/pool"
-	"github.com/samber/lo"
 
 	v1 "github.com/fatedier/frp/pkg/config/v1"
-	"github.com/fatedier/frp/pkg/transport"
-	httppkg "github.com/fatedier/frp/pkg/util/http"
-	"github.com/fatedier/frp/pkg/util/log"
-	netpkg "github.com/fatedier/frp/pkg/util/net"
 )
 
 func init() {
@@ -42,86 +31,39 @@ func init() {
 type HTTPS2HTTPSPlugin struct {
 	opts *v1.HTTPS2HTTPSPluginOptions
 
-	l *Listener
-	s *http.Server
+	*httpBridgePlugin
 }
 
 func NewHTTPS2HTTPSPlugin(_ PluginContext, options v1.ClientPluginOptions) (Plugin, error) {
 	opts := options.(*v1.HTTPS2HTTPSPluginOptions)
 
-	listener := NewProxyListener()
-
 	p := &HTTPS2HTTPSPlugin{
 		opts: opts,
-		l:    listener,
 	}
 
 	tr := &http.Transport{
 		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
 	}
 
-	rp := &httputil.ReverseProxy{
-		Rewrite: func(r *httputil.ProxyRequest) {
+	rp := newHTTPBridgeReverseProxy(
+		func(r *httputil.ProxyRequest) {
 			r.Out.Header["X-Forwarded-For"] = r.In.Header["X-Forwarded-For"]
 			r.SetXForwarded()
 			req := r.Out
-			req.URL.Scheme = "https"
-			req.URL.Host = p.opts.LocalAddr
-			if p.opts.HostHeaderRewrite != "" {
-				req.Host = p.opts.HostHeaderRewrite
-			}
-			for k, v := range p.opts.RequestHeaders.Set {
-				req.Header.Set(k, v)
-			}
+			rewriteHTTPPluginRequest(req, "https", p.opts.LocalAddr, p.opts.HostHeaderRewrite, p.opts.RequestHeaders)
 		},
-		Transport:  tr,
-		BufferPool: pool.NewBuffer(32 * 1024),
-		ErrorLog:   stdlog.New(log.NewWriteLogger(log.WarnLevel, 2), "", 0),
-	}
-	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.TLS != nil {
-			tlsServerName, _ := httppkg.CanonicalHost(r.TLS.ServerName)
-			host, _ := httppkg.CanonicalHost(r.Host)
-			if tlsServerName != "" && tlsServerName != host {
-				w.WriteHeader(http.StatusMisdirectedRequest)
-				return
-			}
-		}
-		rp.ServeHTTP(w, r)
-	})
+		tr,
+	)
 
-	tlsConfig, err := transport.NewServerTLSConfig(p.opts.CrtPath, p.opts.KeyPath, "")
+	server, err := newHTTPSBridgePluginServer(rp, p.opts.CrtPath, p.opts.KeyPath, opts.EnableHTTP2, true)
 	if err != nil {
-		return nil, fmt.Errorf("gen TLS config error: %v", err)
+		return nil, err
 	}
+	p.httpBridgePlugin = server
 
-	p.s = &http.Server{
-		Handler:           handler,
-		ReadHeaderTimeout: 60 * time.Second,
-		TLSConfig:         tlsConfig,
-	}
-	if !lo.FromPtr(opts.EnableHTTP2) {
-		p.s.TLSNextProto = make(map[string]func(*http.Server, *tls.Conn, http.Handler))
-	}
-
-	go func() {
-		_ = p.s.ServeTLS(listener, "", "")
-	}()
 	return p, nil
 }
 
-func (p *HTTPS2HTTPSPlugin) Handle(_ context.Context, connInfo *ConnectionInfo) {
-	wrapConn := netpkg.WrapReadWriteCloserToConn(connInfo.Conn, connInfo.UnderlyingConn)
-	if connInfo.SrcAddr != nil {
-		wrapConn.SetRemoteAddr(connInfo.SrcAddr)
-	}
-	_ = p.l.PutConn(wrapConn)
-}
-
 func (p *HTTPS2HTTPSPlugin) Name() string {
 	return v1.PluginHTTPS2HTTPS
 }
-
-func (p *HTTPS2HTTPSPlugin) Close() error {
-	return p.s.Close()
-}

pkg/plugin/client/internal/httpsserver/server.go

@@ -0,0 +1,60 @@
+// Copyright 2026 The frp Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build !frps
+
+package httpsserver
+
+import (
+	"crypto/tls"
+	"fmt"
+	"net/http"
+	"time"
+
+	"github.com/samber/lo"
+
+	"github.com/fatedier/frp/pkg/transport"
+	httppkg "github.com/fatedier/frp/pkg/util/http"
+)
+
+func New(handler http.Handler, crtPath, keyPath string, enableHTTP2 *bool) (*http.Server, error) {
+	tlsConfig, err := transport.NewServerTLSConfig(crtPath, keyPath, "")
+	if err != nil {
+		return nil, fmt.Errorf("gen TLS config error: %v", err)
+	}
+
+	server := &http.Server{
+		Handler:           withMisdirectedRequestCheck(handler),
+		ReadHeaderTimeout: 60 * time.Second,
+		TLSConfig:         tlsConfig,
+	}
+	if !lo.FromPtr(enableHTTP2) {
+		server.TLSNextProto = make(map[string]func(*http.Server, *tls.Conn, http.Handler))
+	}
+	return server, nil
+}
+
+func withMisdirectedRequestCheck(handler http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.TLS != nil {
+			tlsServerName, _ := httppkg.CanonicalHost(r.TLS.ServerName)
+			host, _ := httppkg.CanonicalHost(r.Host)
+			if tlsServerName != "" && tlsServerName != host {
+				w.WriteHeader(http.StatusMisdirectedRequest)
+				return
+			}
+		}
+		handler.ServeHTTP(w, r)
+	})
+}

pkg/plugin/client/tls2raw.go

@@ -72,6 +72,15 @@ func (p *TLS2RawPlugin) Handle(ctx context.Context, connInfo *ConnectionInfo) {
 		return
 	}
 
+	if connInfo.ProxyProtocolHeader != nil {
+		if _, err := connInfo.ProxyProtocolHeader.WriteTo(rawConn); err != nil {
+			xl.Warnf("tls2raw write proxy protocol header to local conn error: %v", err)
+			rawConn.Close()
+			tlsConn.Close()
+			return
+		}
+	}
+
 	libio.Join(tlsConn, rawConn)
 }
 

pkg/plugin/server/manager.go

@@ -44,6 +44,67 @@ func NewManager() *Manager {
 	}
 }
 
+func newPluginRequestContext() (context.Context, *xlog.Logger) {
+	reqid, _ := util.RandID()
+	xl := xlog.New().AppendPrefix("reqid: " + reqid)
+	ctx := xlog.NewContext(context.Background(), xl)
+	return NewReqidContext(ctx, reqid), xl
+}
+
+type pluginErrorLogMode bool
+
+const (
+	// Warn is the zero value because it is the default for mutable plugin operations.
+	pluginErrorLogWarn pluginErrorLogMode = false
+	pluginErrorLogInfo pluginErrorLogMode = true
+)
+
+func logPluginError(xl *xlog.Logger, p Plugin, op string, err error, mode pluginErrorLogMode) {
+	if mode == pluginErrorLogInfo {
+		xl.Infof("send %s request to plugin [%s] error: %v", op, p.Name(), err)
+		return
+	}
+	xl.Warnf("send %s request to plugin [%s] error: %v", op, p.Name(), err)
+}
+
+func handleMutableContent[T any](
+	plugins []Plugin,
+	op string,
+	content *T,
+	logMode pluginErrorLogMode,
+) (*T, error) {
+	if len(plugins) == 0 {
+		return content, nil
+	}
+
+	var (
+		res = &Response{
+			Reject:   false,
+			Unchange: true,
+		}
+		retContent any
+		err        error
+	)
+	ctx, xl := newPluginRequestContext()
+
+	for _, p := range plugins {
+		res, retContent, err = p.Handle(ctx, op, *content)
+		if err != nil {
+			logPluginError(xl, p, op, err, logMode)
+			return nil, errors.New("send " + op + " request to plugin error")
+		}
+		if res.Reject {
+			return nil, fmt.Errorf("%s", res.RejectReason)
+		}
+		if !res.Unchange {
+			// Preserve the existing Plugin contract: changed content must be *T.
+			// Buggy Plugin implementations still panic here, by design.
+			content = retContent.(*T)
+		}
+	}
+	return content, nil
+}
+
 func (m *Manager) Register(p Plugin) {
 	if p.IsSupport(OpLogin) {
 		m.loginPlugins = append(m.loginPlugins, p)
@@ -66,71 +127,11 @@ func (m *Manager) Register(p Plugin) {
 }
 
 func (m *Manager) Login(content *LoginContent) (*LoginContent, error) {
-	if len(m.loginPlugins) == 0 {
-		return content, nil
-	}
-
-	var (
-		res = &Response{
-			Reject:   false,
-			Unchange: true,
-		}
-		retContent any
-		err        error
-	)
-	reqid, _ := util.RandID()
-	xl := xlog.New().AppendPrefix("reqid: " + reqid)
-	ctx := xlog.NewContext(context.Background(), xl)
-	ctx = NewReqidContext(ctx, reqid)
-
-	for _, p := range m.loginPlugins {
-		res, retContent, err = p.Handle(ctx, OpLogin, *content)
-		if err != nil {
-			xl.Warnf("send Login request to plugin [%s] error: %v", p.Name(), err)
-			return nil, errors.New("send Login request to plugin error")
-		}
-		if res.Reject {
-			return nil, fmt.Errorf("%s", res.RejectReason)
-		}
-		if !res.Unchange {
-			content = retContent.(*LoginContent)
-		}
-	}
-	return content, nil
+	return handleMutableContent(m.loginPlugins, OpLogin, content, pluginErrorLogWarn)
 }
 
 func (m *Manager) NewProxy(content *NewProxyContent) (*NewProxyContent, error) {
-	if len(m.newProxyPlugins) == 0 {
-		return content, nil
-	}
-
-	var (
-		res = &Response{
-			Reject:   false,
-			Unchange: true,
-		}
-		retContent any
-		err        error
-	)
-	reqid, _ := util.RandID()
-	xl := xlog.New().AppendPrefix("reqid: " + reqid)
-	ctx := xlog.NewContext(context.Background(), xl)
-	ctx = NewReqidContext(ctx, reqid)
-
-	for _, p := range m.newProxyPlugins {
-		res, retContent, err = p.Handle(ctx, OpNewProxy, *content)
-		if err != nil {
-			xl.Warnf("send NewProxy request to plugin [%s] error: %v", p.Name(), err)
-			return nil, errors.New("send NewProxy request to plugin error")
-		}
-		if res.Reject {
-			return nil, fmt.Errorf("%s", res.RejectReason)
-		}
-		if !res.Unchange {
-			content = retContent.(*NewProxyContent)
-		}
-	}
-	return content, nil
+	return handleMutableContent(m.newProxyPlugins, OpNewProxy, content, pluginErrorLogWarn)
 }
 
 func (m *Manager) CloseProxy(content *CloseProxyContent) error {
@@ -139,10 +140,7 @@ func (m *Manager) CloseProxy(content *CloseProxyContent) error {
 	}
 
 	errs := make([]string, 0)
-	reqid, _ := util.RandID()
-	xl := xlog.New().AppendPrefix("reqid: " + reqid)
-	ctx := xlog.NewContext(context.Background(), xl)
-	ctx = NewReqidContext(ctx, reqid)
+	ctx, xl := newPluginRequestContext()
 
 	for _, p := range m.closeProxyPlugins {
 		_, _, err := p.Handle(ctx, OpCloseProxy, *content)
@@ -159,103 +157,14 @@ func (m *Manager) CloseProxy(content *CloseProxyContent) error {
 }
 
 func (m *Manager) Ping(content *PingContent) (*PingContent, error) {
-	if len(m.pingPlugins) == 0 {
-		return content, nil
-	}
-
-	var (
-		res = &Response{
-			Reject:   false,
-			Unchange: true,
-		}
-		retContent any
-		err        error
-	)
-	reqid, _ := util.RandID()
-	xl := xlog.New().AppendPrefix("reqid: " + reqid)
-	ctx := xlog.NewContext(context.Background(), xl)
-	ctx = NewReqidContext(ctx, reqid)
-
-	for _, p := range m.pingPlugins {
-		res, retContent, err = p.Handle(ctx, OpPing, *content)
-		if err != nil {
-			xl.Warnf("send Ping request to plugin [%s] error: %v", p.Name(), err)
-			return nil, errors.New("send Ping request to plugin error")
-		}
-		if res.Reject {
-			return nil, fmt.Errorf("%s", res.RejectReason)
-		}
-		if !res.Unchange {
-			content = retContent.(*PingContent)
-		}
-	}
-	return content, nil
+	return handleMutableContent(m.pingPlugins, OpPing, content, pluginErrorLogWarn)
 }
 
 func (m *Manager) NewWorkConn(content *NewWorkConnContent) (*NewWorkConnContent, error) {
-	if len(m.newWorkConnPlugins) == 0 {
-		return content, nil
-	}
-
-	var (
-		res = &Response{
-			Reject:   false,
-			Unchange: true,
-		}
-		retContent any
-		err        error
-	)
-	reqid, _ := util.RandID()
-	xl := xlog.New().AppendPrefix("reqid: " + reqid)
-	ctx := xlog.NewContext(context.Background(), xl)
-	ctx = NewReqidContext(ctx, reqid)
-
-	for _, p := range m.newWorkConnPlugins {
-		res, retContent, err = p.Handle(ctx, OpNewWorkConn, *content)
-		if err != nil {
-			xl.Warnf("send NewWorkConn request to plugin [%s] error: %v", p.Name(), err)
-			return nil, errors.New("send NewWorkConn request to plugin error")
-		}
-		if res.Reject {
-			return nil, fmt.Errorf("%s", res.RejectReason)
-		}
-		if !res.Unchange {
-			content = retContent.(*NewWorkConnContent)
-		}
-	}
-	return content, nil
+	return handleMutableContent(m.newWorkConnPlugins, OpNewWorkConn, content, pluginErrorLogWarn)
 }
 
 func (m *Manager) NewUserConn(content *NewUserConnContent) (*NewUserConnContent, error) {
-	if len(m.newUserConnPlugins) == 0 {
-		return content, nil
-	}
-
-	var (
-		res = &Response{
-			Reject:   false,
-			Unchange: true,
-		}
-		retContent any
-		err        error
-	)
-	reqid, _ := util.RandID()
-	xl := xlog.New().AppendPrefix("reqid: " + reqid)
-	ctx := xlog.NewContext(context.Background(), xl)
-	ctx = NewReqidContext(ctx, reqid)
-
-	for _, p := range m.newUserConnPlugins {
-		res, retContent, err = p.Handle(ctx, OpNewUserConn, *content)
-		if err != nil {
-			xl.Infof("send NewUserConn request to plugin [%s] error: %v", p.Name(), err)
-			return nil, errors.New("send NewUserConn request to plugin error")
-		}
-		if res.Reject {
-			return nil, fmt.Errorf("%s", res.RejectReason)
-		}
-		if !res.Unchange {
-			content = retContent.(*NewUserConnContent)
-		}
-	}
-	return content, nil
+	// Preserve the pre-refactor log level for NewUserConn plugin errors.
+	return handleMutableContent(m.newUserConnPlugins, OpNewUserConn, content, pluginErrorLogInfo)
 }

pkg/plugin/server/manager_test.go

@@ -0,0 +1,336 @@
+// Copyright 2019 fatedier, fatedier@gmail.com
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package server
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	goliblog "github.com/fatedier/golib/log"
+
+	"github.com/fatedier/frp/pkg/msg"
+	frplog "github.com/fatedier/frp/pkg/util/log"
+)
+
+type testPlugin struct {
+	name    string
+	ops     map[string]bool
+	handler func(context.Context, string, any) (*Response, any, error)
+}
+
+// Log-capturing subtests serialize global logger swaps; do not use t.Parallel.
+var logCaptureMu sync.Mutex
+
+type logCapture struct {
+	bytes.Buffer
+	levels []goliblog.Level
+}
+
+func (p testPlugin) Name() string {
+	return p.name
+}
+
+func (p testPlugin) IsSupport(op string) bool {
+	return p.ops[op]
+}
+
+func (p testPlugin) Handle(ctx context.Context, op string, content any) (*Response, any, error) {
+	return p.handler(ctx, op, content)
+}
+
+func (w *logCapture) WriteLog(p []byte, level goliblog.Level, _ time.Time) (int, error) {
+	w.levels = append(w.levels, level)
+	return w.Write(p)
+}
+
+func captureLogOutput(t *testing.T) *logCapture {
+	t.Helper()
+
+	logCaptureMu.Lock()
+	logOutput := &logCapture{}
+	oldLogger := frplog.Logger
+	frplog.Logger = goliblog.New(
+		goliblog.WithOutput(logOutput),
+		goliblog.WithLevel(goliblog.TraceLevel),
+		goliblog.WithCaller(false),
+	)
+	t.Cleanup(func() {
+		frplog.Logger = oldLogger
+		logCaptureMu.Unlock()
+	})
+	return logOutput
+}
+
+var mutablePluginOps = []struct {
+	name string
+	op   string
+}{
+	{name: "login", op: OpLogin},
+	{name: "new proxy", op: OpNewProxy},
+	{name: "ping", op: OpPing},
+	{name: "new work conn", op: OpNewWorkConn},
+	{name: "new user conn", op: OpNewUserConn},
+}
+
+func callMutableWithUser(m *Manager, op string, user string) (string, error) {
+	switch op {
+	case OpLogin:
+		got, err := m.Login(&LoginContent{Login: msg.Login{User: user}})
+		if got == nil {
+			return "", err
+		}
+		return got.User, err
+	case OpNewProxy:
+		got, err := m.NewProxy(&NewProxyContent{User: UserInfo{User: user}})
+		if got == nil {
+			return "", err
+		}
+		return got.User.User, err
+	case OpPing:
+		got, err := m.Ping(&PingContent{User: UserInfo{User: user}})
+		if got == nil {
+			return "", err
+		}
+		return got.User.User, err
+	case OpNewWorkConn:
+		got, err := m.NewWorkConn(&NewWorkConnContent{User: UserInfo{User: user}})
+		if got == nil {
+			return "", err
+		}
+		return got.User.User, err
+	case OpNewUserConn:
+		got, err := m.NewUserConn(&NewUserConnContent{User: UserInfo{User: user}})
+		if got == nil {
+			return "", err
+		}
+		return got.User.User, err
+	default:
+		panic("unsupported mutable op: " + op)
+	}
+}
+
+func mutableUser(t *testing.T, op string, content any) string {
+	t.Helper()
+
+	switch op {
+	case OpLogin:
+		return content.(LoginContent).User
+	case OpNewProxy:
+		return content.(NewProxyContent).User.User
+	case OpPing:
+		return content.(PingContent).User.User
+	case OpNewWorkConn:
+		return content.(NewWorkConnContent).User.User
+	case OpNewUserConn:
+		return content.(NewUserConnContent).User.User
+	default:
+		t.Fatalf("unsupported mutable op: %s", op)
+		return ""
+	}
+}
+
+func mutateMutableContent(t *testing.T, op string, content any, user string) any {
+	t.Helper()
+
+	switch op {
+	case OpLogin:
+		got := content.(LoginContent)
+		got.User = user
+		return &got
+	case OpNewProxy:
+		got := content.(NewProxyContent)
+		got.User.User = user
+		return &got
+	case OpPing:
+		got := content.(PingContent)
+		got.User.User = user
+		return &got
+	case OpNewWorkConn:
+		got := content.(NewWorkConnContent)
+		got.User.User = user
+		return &got
+	case OpNewUserConn:
+		got := content.(NewUserConnContent)
+		got.User.User = user
+		return &got
+	default:
+		t.Fatalf("unsupported mutable op: %s", op)
+		return nil
+	}
+}
+
+func TestManagerMutableContentAcrossOps(t *testing.T) {
+	for _, tt := range mutablePluginOps {
+		t.Run(tt.name, func(t *testing.T) {
+			m := NewManager()
+			m.Register(testPlugin{
+				name: "mutate",
+				ops:  map[string]bool{tt.op: true},
+				handler: func(ctx context.Context, op string, content any) (*Response, any, error) {
+					if op != tt.op {
+						t.Fatalf("unexpected op: %s", op)
+					}
+					if GetReqidFromContext(ctx) == "" {
+						t.Fatal("expected request id in context")
+					}
+					if got := mutableUser(t, tt.op, content); got != "initial" {
+						t.Fatalf("expected initial user, got %q", got)
+					}
+					return &Response{Unchange: false}, mutateMutableContent(t, tt.op, content, "mutated"), nil
+				},
+			})
+			m.Register(testPlugin{
+				name: "observe",
+				ops:  map[string]bool{tt.op: true},
+				handler: func(ctx context.Context, op string, content any) (*Response, any, error) {
+					if op != tt.op {
+						t.Fatalf("unexpected op: %s", op)
+					}
+					if GetReqidFromContext(ctx) == "" {
+						t.Fatal("expected request id in context")
+					}
+					if got := mutableUser(t, tt.op, content); got != "mutated" {
+						t.Fatalf("expected mutated user, got %q", got)
+					}
+					return &Response{Unchange: true}, mutateMutableContent(t, tt.op, content, "ignored"), nil
+				},
+			})
+
+			got, err := callMutableWithUser(m, tt.op, "initial")
+			if err != nil {
+				t.Fatalf("mutable op failed: %v", err)
+			}
+			if got != "mutated" {
+				t.Fatalf("expected mutated user, got %q", got)
+			}
+		})
+	}
+}
+
+func TestManagerMutableContentRejectStopsChain(t *testing.T) {
+	m := NewManager()
+
+	var called bool
+	m.Register(testPlugin{
+		name: "reject",
+		ops:  map[string]bool{OpPing: true},
+		handler: func(context.Context, string, any) (*Response, any, error) {
+			return &Response{Reject: true, RejectReason: "blocked"}, nil, nil
+		},
+	})
+	m.Register(testPlugin{
+		name: "unused",
+		ops:  map[string]bool{OpPing: true},
+		handler: func(context.Context, string, any) (*Response, any, error) {
+			called = true
+			return &Response{Unchange: true}, nil, nil
+		},
+	})
+
+	got, err := m.Ping(&PingContent{})
+	if err == nil {
+		t.Fatal("expected reject error")
+	}
+	if got != nil {
+		t.Fatalf("expected no returned content, got %#v", got)
+	}
+	if err.Error() != "blocked" {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if called {
+		t.Fatal("expected plugin chain to stop after reject")
+	}
+}
+
+func TestManagerMutableContentPluginErrorLogLevel(t *testing.T) {
+	tests := []struct {
+		name  string
+		op    string
+		level goliblog.Level
+	}{
+		{name: "default warning", op: OpLogin, level: goliblog.WarnLevel},
+		{name: "new user conn info", op: OpNewUserConn, level: goliblog.InfoLevel},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			logOutput := captureLogOutput(t)
+			m := NewManager()
+			m.Register(testPlugin{
+				name: "error",
+				ops:  map[string]bool{tt.op: true},
+				handler: func(context.Context, string, any) (*Response, any, error) {
+					return nil, nil, errors.New("boom")
+				},
+			})
+
+			_, err := callMutableWithUser(m, tt.op, "initial")
+			if err == nil {
+				t.Fatal("expected plugin error")
+			}
+			if want := "send " + tt.op + " request to plugin error"; err.Error() != want {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if len(logOutput.levels) != 1 || logOutput.levels[0] != tt.level {
+				t.Fatalf("expected log level %v, got %v in %q", tt.level, logOutput.levels, logOutput.String())
+			}
+		})
+	}
+}
+
+func TestManagerCloseProxyAggregatesErrors(t *testing.T) {
+	logOutput := captureLogOutput(t)
+	m := NewManager()
+
+	for _, name := range []string{"first", "second"} {
+		m.Register(testPlugin{
+			name: name,
+			ops:  map[string]bool{OpCloseProxy: true},
+			handler: func(ctx context.Context, op string, content any) (*Response, any, error) {
+				if GetReqidFromContext(ctx) == "" {
+					t.Fatal("expected request id in context")
+				}
+				if op != OpCloseProxy {
+					t.Fatalf("unexpected op: %s", op)
+				}
+				return nil, nil, errors.New(name + " error")
+			},
+		})
+	}
+
+	err := m.CloseProxy(&CloseProxyContent{})
+	if err == nil {
+		t.Fatal("expected close proxy error")
+	}
+	if !strings.HasPrefix(err.Error(), "send CloseProxy request to plugin errors: ") {
+		t.Fatalf("unexpected close proxy error prefix: %v", err)
+	}
+	if !strings.Contains(err.Error(), "[first]: first error") || !strings.Contains(err.Error(), "[second]: second error") {
+		t.Fatalf("missing aggregated errors: %v", err)
+	}
+	if len(logOutput.levels) != 2 {
+		t.Fatalf("expected two warning logs, got %v", logOutput.levels)
+	}
+	for _, level := range logOutput.levels {
+		if level != goliblog.WarnLevel {
+			t.Fatalf("expected warning log level, got %v", logOutput.levels)
+		}
+	}
+}

pkg/proto/udp/udp.go

@@ -140,6 +140,8 @@ func Forwarder(dstAddr *net.UDPAddr, readCh <-chan *msg.UDPPacket, sendCh chan<-
 			_, err = udpConn.Write(buf)
 			if err != nil {
 				udpConn.Close()
+			} else {
+				_ = udpConn.SetReadDeadline(time.Now().Add(30 * time.Second))
 			}
 
 			if !ok {

pkg/proto/wire/crypto.go

@@ -0,0 +1,197 @@
+// Copyright 2026 The frp Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package wire
+
+import (
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/binary"
+	"encoding/json"
+	"fmt"
+	"hash"
+	"runtime"
+
+	"golang.org/x/sys/cpu"
+)
+
+const (
+	AEADAlgorithmAES256GCM         = "aes-256-gcm"
+	AEADAlgorithmXChaCha20Poly1305 = "xchacha20-poly1305"
+
+	CryptoRandomSize = 32
+
+	cryptoTranscriptLabel = "frp wire v2 crypto transcript"
+)
+
+var supportedAEADAlgorithms = []string{
+	AEADAlgorithmAES256GCM,
+	AEADAlgorithmXChaCha20Poly1305,
+}
+
+type CryptoContext struct {
+	Algorithm      string
+	TranscriptHash []byte
+}
+
+func NewClientHello(bootstrap BootstrapInfo) (ClientHello, error) {
+	clientRandom, err := newCryptoRandom()
+	if err != nil {
+		return ClientHello{}, err
+	}
+	return clientHelloWithCryptoRandom(bootstrap, clientRandom), nil
+}
+
+func NewServerHello(clientHello ClientHello) (ServerHello, error) {
+	if err := ValidateClientHello(clientHello); err != nil {
+		return ServerHello{}, err
+	}
+	algorithm, ok := SelectAEADAlgorithm(clientHello.Capabilities.Crypto.Algorithms)
+	if !ok {
+		return ServerHello{}, fmt.Errorf("no supported crypto algorithm")
+	}
+	serverRandom, err := newCryptoRandom()
+	if err != nil {
+		return ServerHello{}, err
+	}
+	return ServerHello{
+		Selected: ServerSelection{
+			Message: MessageSelection{
+				Codec: MessageCodecJSON,
+			},
+			Crypto: CryptoSelection{
+				Algorithm:    algorithm,
+				ServerRandom: serverRandom,
+			},
+		},
+	}, nil
+}
+
+func ValidateCryptoCapabilities(c CryptoCapabilities) error {
+	if len(c.ClientRandom) != CryptoRandomSize {
+		return fmt.Errorf("invalid crypto client random length %d, want %d", len(c.ClientRandom), CryptoRandomSize)
+	}
+	if _, ok := SelectAEADAlgorithm(c.Algorithms); !ok {
+		return fmt.Errorf("no supported crypto algorithm")
+	}
+	return nil
+}
+
+func ValidateServerHelloForClient(clientHello ClientHello, serverHello ServerHello) error {
+	if serverHello.Selected.Message.Codec != MessageCodecJSON {
+		return fmt.Errorf("unsupported selected message codec: %s", serverHello.Selected.Message.Codec)
+	}
+	cryptoSelection := serverHello.Selected.Crypto
+	if !IsSupportedAEADAlgorithm(cryptoSelection.Algorithm) {
+		return fmt.Errorf("unknown selected crypto algorithm: %s", cryptoSelection.Algorithm)
+	}
+	if !Supports(clientHello.Capabilities.Crypto.Algorithms, cryptoSelection.Algorithm) {
+		return fmt.Errorf("selected crypto algorithm was not advertised by client: %s", cryptoSelection.Algorithm)
+	}
+	if len(cryptoSelection.ServerRandom) != CryptoRandomSize {
+		return fmt.Errorf("invalid crypto server random length %d, want %d", len(cryptoSelection.ServerRandom), CryptoRandomSize)
+	}
+	return nil
+}
+
+func NewCryptoContext(algorithm string, clientHelloPayload, serverHelloPayload []byte) *CryptoContext {
+	return &CryptoContext{
+		Algorithm:      algorithm,
+		TranscriptHash: HashCryptoTranscript(clientHelloPayload, serverHelloPayload),
+	}
+}
+
+func NewClientCryptoContext(clientHelloPayload, serverHelloPayload []byte) (*CryptoContext, error) {
+	var clientHello ClientHello
+	if err := json.Unmarshal(clientHelloPayload, &clientHello); err != nil {
+		return nil, fmt.Errorf("decode ClientHello transcript: %w", err)
+	}
+	var serverHello ServerHello
+	if err := json.Unmarshal(serverHelloPayload, &serverHello); err != nil {
+		return nil, fmt.Errorf("decode ServerHello transcript: %w", err)
+	}
+	if err := ValidateServerHelloForClient(clientHello, serverHello); err != nil {
+		return nil, err
+	}
+
+	return NewCryptoContext(serverHello.Selected.Crypto.Algorithm, clientHelloPayload, serverHelloPayload), nil
+}
+
+func HashCryptoTranscript(clientHelloPayload, serverHelloPayload []byte) []byte {
+	h := sha256.New()
+	_, _ = h.Write([]byte(cryptoTranscriptLabel))
+	writeCryptoTranscriptPart(h, "client hello", clientHelloPayload)
+	writeCryptoTranscriptPart(h, "server hello", serverHelloPayload)
+	return h.Sum(nil)
+}
+
+func writeCryptoTranscriptPart(h hash.Hash, label string, payload []byte) {
+	var length [8]byte
+	binary.BigEndian.PutUint64(length[:], uint64(len(payload)))
+	_, _ = h.Write([]byte{0})
+	_, _ = h.Write([]byte(label))
+	_, _ = h.Write([]byte{0})
+	_, _ = h.Write(length[:])
+	_, _ = h.Write(payload)
+}
+
+func PreferredAEADAlgorithms() []string {
+	if hasFastAESGCM() {
+		return []string{AEADAlgorithmAES256GCM, AEADAlgorithmXChaCha20Poly1305}
+	}
+	return []string{AEADAlgorithmXChaCha20Poly1305, AEADAlgorithmAES256GCM}
+}
+
+func SelectAEADAlgorithm(clientAlgorithms []string) (string, bool) {
+	for _, algorithm := range clientAlgorithms {
+		if IsSupportedAEADAlgorithm(algorithm) {
+			return algorithm, true
+		}
+	}
+	return "", false
+}
+
+func IsSupportedAEADAlgorithm(algorithm string) bool {
+	return Supports(supportedAEADAlgorithms, algorithm)
+}
+
+func newCryptoRandom() ([]byte, error) {
+	b := make([]byte, CryptoRandomSize)
+	if _, err := rand.Read(b); err != nil {
+		return nil, fmt.Errorf("generate crypto random: %w", err)
+	}
+	return b, nil
+}
+
+func hasFastAESGCM() bool {
+	switch runtime.GOARCH {
+	case "amd64":
+		return cpu.X86.HasAES &&
+			cpu.X86.HasPCLMULQDQ &&
+			cpu.X86.HasSSE41 &&
+			cpu.X86.HasSSSE3
+	case "arm64":
+		return cpu.ARM64.HasAES && cpu.ARM64.HasPMULL
+	case "s390x":
+		return cpu.S390X.HasAES &&
+			cpu.S390X.HasAESCTR &&
+			cpu.S390X.HasGHASH
+	case "ppc64", "ppc64le":
+		// Go's ppc64/ppc64le port targets POWER8+, which has AES instructions;
+		// x/sys/cpu does not expose a PPC64 AES feature flag.
+		return true
+	default:
+		return false
+	}
+}

pkg/proto/wire/wire.go

@@ -120,15 +120,23 @@ func (c *Conn) UnmarshalFrame(f *Frame, out any) error {
 	return json.Unmarshal(f.Payload, out)
 }
 
-func (c *Conn) WriteJSONFrame(frameType uint16, in any) error {
+func NewJSONFrame(frameType uint16, in any) (*Frame, error) {
 	payload, err := json.Marshal(in)
+	if err != nil {
+		return nil, err
+	}
+	return &Frame{
+		Type:    frameType,
+		Payload: payload,
+	}, nil
+}
+
+func (c *Conn) WriteJSONFrame(frameType uint16, in any) error {
+	f, err := NewJSONFrame(frameType, in)
 	if err != nil {
 		return err
 	}
-	return c.WriteFrame(&Frame{
-		Type:    frameType,
-		Payload: payload,
-	})
+	return c.WriteFrame(f)
 }
 
 func WriteMagic(w io.Writer) error {
@@ -170,12 +178,18 @@ type ClientHello struct {
 
 type ClientCapabilities struct {
 	Message MessageCapabilities `json:"message,omitempty"`
+	Crypto  CryptoCapabilities  `json:"crypto,omitempty"`
 }
 
 type MessageCapabilities struct {
 	Codecs []string `json:"codecs,omitempty"`
 }
 
+type CryptoCapabilities struct {
+	Algorithms   []string `json:"algorithms,omitempty"`
+	ClientRandom []byte   `json:"clientRandom,omitempty"`
+}
+
 type ServerHello struct {
 	Selected ServerSelection `json:"selected,omitempty"`
 	Error    string          `json:"error,omitempty"`
@@ -183,19 +197,29 @@ type ServerHello struct {
 
 type ServerSelection struct {
 	Message MessageSelection `json:"message,omitempty"`
+	Crypto  CryptoSelection  `json:"crypto,omitempty"`
 }
 
 type MessageSelection struct {
 	Codec string `json:"codec,omitempty"`
 }
 
-func DefaultClientHello(bootstrap BootstrapInfo) ClientHello {
+type CryptoSelection struct {
+	Algorithm    string `json:"algorithm,omitempty"`
+	ServerRandom []byte `json:"serverRandom,omitempty"`
+}
+
+func clientHelloWithCryptoRandom(bootstrap BootstrapInfo, clientRandom []byte) ClientHello {
 	return ClientHello{
 		Bootstrap: bootstrap,
 		Capabilities: ClientCapabilities{
 			Message: MessageCapabilities{
 				Codecs: []string{MessageCodecJSON},
 			},
+			Crypto: CryptoCapabilities{
+				Algorithms:   PreferredAEADAlgorithms(),
+				ClientRandom: clientRandom,
+			},
 		},
 	}
 }
@@ -218,5 +242,5 @@ func ValidateClientHello(h ClientHello) error {
 	if !Supports(h.Capabilities.Message.Codecs, MessageCodecJSON) {
 		return fmt.Errorf("unsupported message codec")
 	}
-	return nil
+	return ValidateCryptoCapabilities(h.Capabilities.Crypto)
 }

pkg/proto/wire/wire_test.go

@@ -28,7 +28,7 @@ func TestFrameRoundTrip(t *testing.T) {
 	var buf bytes.Buffer
 	conn := NewConn(&buf)
 
-	in := DefaultClientHello(BootstrapInfo{
+	in := mustClientHello(t, BootstrapInfo{
 		Transport: "tcp",
 		TLS:       true,
 		TCPMux:    true,
@@ -112,9 +112,122 @@ func TestCheckMagicV1PreservesReadBytes(t *testing.T) {
 }
 
 func TestValidateClientHello(t *testing.T) {
-	require.NoError(t, ValidateClientHello(DefaultClientHello(BootstrapInfo{})))
+	hello := mustClientHello(t, BootstrapInfo{})
+	require.NoError(t, ValidateClientHello(hello))
+	require.Len(t, hello.Capabilities.Crypto.ClientRandom, CryptoRandomSize)
+	require.ElementsMatch(t, []string{
+		AEADAlgorithmAES256GCM,
+		AEADAlgorithmXChaCha20Poly1305,
+	}, hello.Capabilities.Crypto.Algorithms)
 
-	hello := DefaultClientHello(BootstrapInfo{})
 	hello.Capabilities.Message.Codecs = []string{"unknown"}
 	require.ErrorContains(t, ValidateClientHello(hello), "unsupported message codec")
 }
+
+func TestValidateClientHelloRejectsInvalidCrypto(t *testing.T) {
+	hello := mustClientHello(t, BootstrapInfo{})
+	hello.Capabilities.Crypto.ClientRandom = hello.Capabilities.Crypto.ClientRandom[:CryptoRandomSize-1]
+	require.ErrorContains(t, ValidateClientHello(hello), "invalid crypto client random length")
+
+	hello = mustClientHello(t, BootstrapInfo{})
+	hello.Capabilities.Crypto.Algorithms = []string{"unknown"}
+	require.ErrorContains(t, ValidateClientHello(hello), "no supported crypto algorithm")
+}
+
+func TestPreferredAEADAlgorithms(t *testing.T) {
+	require.ElementsMatch(t, []string{
+		AEADAlgorithmAES256GCM,
+		AEADAlgorithmXChaCha20Poly1305,
+	}, PreferredAEADAlgorithms())
+}
+
+func TestNewServerHelloSelectsFirstSupportedAEADAlgorithm(t *testing.T) {
+	hello := mustClientHello(t, BootstrapInfo{})
+	hello.Capabilities.Crypto.Algorithms = []string{"future-aead", AEADAlgorithmXChaCha20Poly1305, AEADAlgorithmAES256GCM}
+
+	serverHello, err := NewServerHello(hello)
+	require.NoError(t, err)
+	require.Equal(t, MessageCodecJSON, serverHello.Selected.Message.Codec)
+	require.Equal(t, AEADAlgorithmXChaCha20Poly1305, serverHello.Selected.Crypto.Algorithm)
+	require.Len(t, serverHello.Selected.Crypto.ServerRandom, CryptoRandomSize)
+}
+
+func TestNewClientCryptoContextValidatesServerHello(t *testing.T) {
+	hello := mustClientHello(t, BootstrapInfo{})
+	serverHello, err := NewServerHello(hello)
+	require.NoError(t, err)
+	clientHelloPayload, serverHelloPayload := mustCryptoTranscriptPayloads(t, hello, serverHello)
+
+	ctx, err := NewClientCryptoContext(clientHelloPayload, serverHelloPayload)
+	require.NoError(t, err)
+	require.Equal(t, serverHello.Selected.Crypto.Algorithm, ctx.Algorithm)
+	require.Len(t, ctx.TranscriptHash, 32)
+
+	tampered := serverHello
+	tampered.Selected.Crypto.ServerRandom = append([]byte(nil), serverHello.Selected.Crypto.ServerRandom...)
+	tampered.Selected.Crypto.ServerRandom[0] ^= 0xff
+	_, tamperedServerHelloPayload := mustCryptoTranscriptPayloads(t, hello, tampered)
+	tamperedCtx, err := NewClientCryptoContext(clientHelloPayload, tamperedServerHelloPayload)
+	require.NoError(t, err)
+	require.NotEqual(t, ctx.TranscriptHash, tamperedCtx.TranscriptHash)
+}
+
+func TestNewCryptoContextBindsFullClientHelloPayload(t *testing.T) {
+	hello := mustClientHello(t, BootstrapInfo{
+		Transport: "tcp",
+		TLS:       true,
+		TCPMux:    true,
+	})
+	serverHello, err := NewServerHello(hello)
+	require.NoError(t, err)
+	clientHelloPayload, serverHelloPayload := mustCryptoTranscriptPayloads(t, hello, serverHello)
+
+	ctx := NewCryptoContext(serverHello.Selected.Crypto.Algorithm, clientHelloPayload, serverHelloPayload)
+
+	tamperedHello := hello
+	tamperedHello.Bootstrap.TLS = false
+	tamperedClientHelloPayload, _ := mustCryptoTranscriptPayloads(t, tamperedHello, serverHello)
+	tamperedCtx := NewCryptoContext(serverHello.Selected.Crypto.Algorithm, tamperedClientHelloPayload, serverHelloPayload)
+	require.NotEqual(t, ctx.TranscriptHash, tamperedCtx.TranscriptHash)
+}
+
+func TestNewClientCryptoContextRejectsUnknownServerSelection(t *testing.T) {
+	hello := mustClientHello(t, BootstrapInfo{})
+	serverHello, err := NewServerHello(hello)
+	require.NoError(t, err)
+
+	serverHello.Selected.Crypto.Algorithm = "unknown"
+	clientHelloPayload, serverHelloPayload := mustCryptoTranscriptPayloads(t, hello, serverHello)
+	_, err = NewClientCryptoContext(clientHelloPayload, serverHelloPayload)
+	require.ErrorContains(t, err, "unknown selected crypto algorithm")
+}
+
+func TestNewClientCryptoContextRejectsUnadvertisedServerSelection(t *testing.T) {
+	hello := mustClientHello(t, BootstrapInfo{})
+	hello.Capabilities.Crypto.Algorithms = []string{AEADAlgorithmAES256GCM}
+	serverHello, err := NewServerHello(hello)
+	require.NoError(t, err)
+
+	serverHello.Selected.Crypto.Algorithm = AEADAlgorithmXChaCha20Poly1305
+	clientHelloPayload, serverHelloPayload := mustCryptoTranscriptPayloads(t, hello, serverHello)
+	_, err = NewClientCryptoContext(clientHelloPayload, serverHelloPayload)
+	require.ErrorContains(t, err, "selected crypto algorithm was not advertised by client")
+}
+
+func mustClientHello(t *testing.T, bootstrap BootstrapInfo) ClientHello {
+	t.Helper()
+
+	hello, err := NewClientHello(bootstrap)
+	require.NoError(t, err)
+	return hello
+}
+
+func mustCryptoTranscriptPayloads(t *testing.T, hello ClientHello, serverHello ServerHello) ([]byte, []byte) {
+	t.Helper()
+
+	clientHelloFrame, err := NewJSONFrame(FrameTypeClientHello, hello)
+	require.NoError(t, err)
+	serverHelloFrame, err := NewJSONFrame(FrameTypeServerHello, serverHello)
+	require.NoError(t, err)
+	return clientHelloFrame.Payload, serverHelloFrame.Payload
+}

pkg/ssh/server.go

@@ -16,7 +16,6 @@ package ssh
 
 import (
 	"context"
-	"encoding/binary"
 	"errors"
 	"fmt"
 	"net"
@@ -52,6 +51,11 @@ type tcpipForward struct {
 	Port uint32
 }
 
+// https://datatracker.ietf.org/doc/html/rfc4254#section-6.5
+type execPayload struct {
+	Command string
+}
+
 // https://datatracker.ietf.org/doc/html/rfc4254#page-16
 type forwardedTCPPayload struct {
 	Addr string
@@ -309,14 +313,13 @@ func (s *TunnelServer) handleNewChannel(channel ssh.NewChannel, extraPayloadCh c
 		if req.WantReply {
 			_ = req.Reply(true, nil)
 		}
-		if req.Type != "exec" || len(req.Payload) <= 4 {
+		if req.Type != "exec" {
 			continue
 		}
-		end := 4 + binary.BigEndian.Uint32(req.Payload[:4])
-		if len(req.Payload) < int(end) {
+		extraPayload, ok := parseExecPayload(req.Payload)
+		if !ok {
 			continue
 		}
-		extraPayload := string(req.Payload[4:end])
 		select {
 		case extraPayloadCh <- extraPayload:
 		default:
@@ -324,6 +327,14 @@ func (s *TunnelServer) handleNewChannel(channel ssh.NewChannel, extraPayloadCh c
 	}
 }
 
+func parseExecPayload(payload []byte) (string, bool) {
+	var msg execPayload
+	if err := ssh.Unmarshal(payload, &msg); err != nil {
+		return "", false
+	}
+	return msg.Command, true
+}
+
 func (s *TunnelServer) keepAlive(ch ssh.Channel) {
 	tk := time.NewTicker(time.Second * 30)
 	defer tk.Stop()

pkg/ssh/server_test.go

@@ -0,0 +1,71 @@
+// Copyright 2026 The frp Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package ssh
+
+import (
+	"encoding/binary"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	cryptossh "golang.org/x/crypto/ssh"
+)
+
+func TestParseExecPayload(t *testing.T) {
+	payload := cryptossh.Marshal(&execPayload{Command: "tcp --remote_port 6000"})
+
+	got, ok := parseExecPayload(payload)
+
+	require.True(t, ok)
+	require.Equal(t, "tcp --remote_port 6000", got)
+}
+
+func TestParseExecPayloadRejectsMalformedPayloads(t *testing.T) {
+	overflowLength := make([]byte, 5)
+	binary.BigEndian.PutUint32(overflowLength[:4], ^uint32(0))
+
+	for _, tc := range []struct {
+		name    string
+		payload []byte
+	}{
+		{
+			name:    "empty",
+			payload: nil,
+		},
+		{
+			name:    "short length prefix",
+			payload: []byte{0, 0, 0},
+		},
+		{
+			name:    "declared length exceeds remaining payload",
+			payload: []byte{0, 0, 0, 2, 'x'},
+		},
+		{
+			name:    "overflow length",
+			payload: overflowLength,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var (
+				got string
+				ok  bool
+			)
+			require.NotPanics(t, func() {
+				got, ok = parseExecPayload(tc.payload)
+			})
+			require.False(t, ok)
+			require.Empty(t, got)
+		})
+	}
+}

pkg/util/http/handler.go

@@ -26,6 +26,12 @@ type GeneralResponse struct {
 	Msg  string
 }
 
+type V2Response struct {
+	Code int    `json:"code"`
+	Msg  string `json:"msg"`
+	Data any    `json:"data"`
+}
+
 // APIHandler is a handler function that returns a response object or an error.
 type APIHandler func(ctx *Context) (any, error)
 
@@ -64,3 +70,27 @@ func MakeHTTPHandlerFunc(handler APIHandler) http.HandlerFunc {
 		}
 	}
 }
+
+// MakeHTTPHandlerFuncV2 wraps a handler response in the dashboard API v2 envelope.
+func MakeHTTPHandlerFuncV2(handler APIHandler) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		ctx := NewContext(w, r)
+		res, err := handler(ctx)
+		if err != nil {
+			log.Warnf("http response [%s]: error: %v", r.URL.Path, err)
+			code := http.StatusInternalServerError
+			if e, ok := err.(*Error); ok {
+				code = e.Code
+			}
+
+			w.Header().Set("Content-Type", "application/json")
+			w.WriteHeader(code)
+			_ = json.NewEncoder(w).Encode(V2Response{Code: code, Msg: err.Error(), Data: nil})
+			return
+		}
+
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		_ = json.NewEncoder(w).Encode(V2Response{Code: http.StatusOK, Msg: "success", Data: res})
+	}
+}

pkg/util/metric/date_counter.go

@@ -17,6 +17,8 @@ package metric
 import (
 	"sync"
 	"time"
+
+	"k8s.io/utils/clock"
 )
 
 type DateCounter interface {
@@ -38,27 +40,33 @@ func NewDateCounter(reserveDays int64) DateCounter {
 type StandardDateCounter struct {
 	reserveDays int64
 	counts      []int64
+	clock       clock.PassiveClock
 
 	lastUpdateDate time.Time
 	mu             sync.Mutex
 }
 
 func newStandardDateCounter(reserveDays int64) *StandardDateCounter {
-	now := time.Now()
-	now = time.Date(now.Year(), now.Month(), now.Day(), 0, 0, 0, 0, now.Location())
-	s := &StandardDateCounter{
+	return newStandardDateCounterWithClock(reserveDays, clock.RealClock{})
+}
+
+func newStandardDateCounterWithClock(reserveDays int64, clk clock.PassiveClock) *StandardDateCounter {
+	if clk == nil {
+		clk = clock.RealClock{}
+	}
+	return &StandardDateCounter{
 		reserveDays:    reserveDays,
 		counts:         make([]int64, reserveDays),
-		lastUpdateDate: now,
+		clock:          clk,
+		lastUpdateDate: startOfDay(clk.Now()),
 	}
-	return s
 }
 
 func (c *StandardDateCounter) TodayCount() int64 {
 	c.mu.Lock()
 	defer c.mu.Unlock()
 
-	c.rotate(time.Now())
+	c.rotate(c.clock.Now())
 	return c.counts[0]
 }
 
@@ -70,65 +78,61 @@ func (c *StandardDateCounter) GetLastDaysCount(lastdays int64) []int64 {
 
 	c.mu.Lock()
 	defer c.mu.Unlock()
-	c.rotate(time.Now())
-	for i := 0; i < int(lastdays); i++ {
-		counts[i] = c.counts[i]
-	}
+	c.rotate(c.clock.Now())
+	copy(counts, c.counts)
 	return counts
 }
 
 func (c *StandardDateCounter) Inc(count int64) {
 	c.mu.Lock()
 	defer c.mu.Unlock()
-	c.rotate(time.Now())
+	c.rotate(c.clock.Now())
 	c.counts[0] += count
 }
 
 func (c *StandardDateCounter) Dec(count int64) {
 	c.mu.Lock()
 	defer c.mu.Unlock()
-	c.rotate(time.Now())
+	c.rotate(c.clock.Now())
 	c.counts[0] -= count
 }
 
 func (c *StandardDateCounter) Snapshot() DateCounter {
 	c.mu.Lock()
 	defer c.mu.Unlock()
-	tmp := newStandardDateCounter(c.reserveDays)
-	for i := 0; i < int(c.reserveDays); i++ {
-		tmp.counts[i] = c.counts[i]
-	}
+	tmp := newStandardDateCounterWithClock(c.reserveDays, c.clock)
+	copy(tmp.counts, c.counts)
 	return tmp
 }
 
 func (c *StandardDateCounter) Clear() {
 	c.mu.Lock()
 	defer c.mu.Unlock()
-	for i := 0; i < int(c.reserveDays); i++ {
-		c.counts[i] = 0
-	}
+	clear(c.counts)
 }
 
 // rotate
 // Must hold the lock before calling this function.
 func (c *StandardDateCounter) rotate(now time.Time) {
-	now = time.Date(now.Year(), now.Month(), now.Day(), 0, 0, 0, 0, now.Location())
+	now = startOfDay(now)
 	days := int(now.Sub(c.lastUpdateDate).Hours() / 24)
-
-	defer func() {
-		c.lastUpdateDate = now
-	}()
+	reserveDays := int(c.reserveDays)
 
 	if days <= 0 {
 		return
-	} else if days >= int(c.reserveDays) {
+	} else if days >= reserveDays {
 		c.counts = make([]int64, c.reserveDays)
+		c.lastUpdateDate = now
 		return
 	}
 	newCounts := make([]int64, c.reserveDays)
 
-	for i := days; i < int(c.reserveDays); i++ {
-		newCounts[i] = c.counts[i-days]
-	}
+	copy(newCounts[days:], c.counts[:reserveDays-days])
 	c.counts = newCounts
+	c.lastUpdateDate = now
+}
+
+// startOfDay returns midnight in t's location.
+func startOfDay(t time.Time) time.Time {
+	return time.Date(t.Year(), t.Month(), t.Day(), 0, 0, 0, 0, t.Location())
 }

pkg/util/metric/date_counter_test.go

@@ -1,9 +1,12 @@
 package metric
 
 import (
+	"sync"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/require"
+	clocktesting "k8s.io/utils/clock/testing"
 )
 
 func TestDateCounter(t *testing.T) {
@@ -25,3 +28,107 @@ func TestDateCounter(t *testing.T) {
 	dcTmp := dc.Snapshot()
 	require.EqualValues(5, dcTmp.TodayCount())
 }
+
+func TestDateCounterRotate(t *testing.T) {
+	loc := time.FixedZone("test", 8*60*60)
+	lastUpdateDate := time.Date(2026, time.May, 8, 0, 0, 0, 0, loc)
+
+	tests := []struct {
+		name               string
+		now                time.Time
+		want               []int64
+		wantLastUpdateDate time.Time
+	}{
+		{
+			name:               "same day",
+			now:                time.Date(2026, time.May, 8, 12, 30, 0, 0, loc),
+			want:               []int64{10, 7, 3},
+			wantLastUpdateDate: lastUpdateDate,
+		},
+		{
+			name:               "clock skew",
+			now:                time.Date(2026, time.May, 7, 12, 30, 0, 0, loc),
+			want:               []int64{10, 7, 3},
+			wantLastUpdateDate: lastUpdateDate,
+		},
+		{
+			name:               "one day",
+			now:                time.Date(2026, time.May, 9, 12, 30, 0, 0, loc),
+			want:               []int64{0, 10, 7},
+			wantLastUpdateDate: time.Date(2026, time.May, 9, 0, 0, 0, 0, loc),
+		},
+		{
+			name:               "two days",
+			now:                time.Date(2026, time.May, 10, 12, 30, 0, 0, loc),
+			want:               []int64{0, 0, 10},
+			wantLastUpdateDate: time.Date(2026, time.May, 10, 0, 0, 0, 0, loc),
+		},
+		{
+			name:               "all reserved days elapsed",
+			now:                time.Date(2026, time.May, 11, 12, 30, 0, 0, loc),
+			want:               []int64{0, 0, 0},
+			wantLastUpdateDate: time.Date(2026, time.May, 11, 0, 0, 0, 0, loc),
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			require := require.New(t)
+
+			dc := newStandardDateCounter(3)
+			dc.counts = []int64{10, 7, 3}
+			dc.lastUpdateDate = lastUpdateDate
+
+			dc.mu.Lock()
+			dc.rotate(tt.now)
+			dc.mu.Unlock()
+
+			require.Equal(tt.want, dc.counts)
+			require.Equal(tt.wantLastUpdateDate, dc.lastUpdateDate)
+		})
+	}
+}
+
+func TestDateCounterGetLastDaysCountReturnsCopy(t *testing.T) {
+	require := require.New(t)
+
+	clk := clocktesting.NewFakeClock(time.Date(2026, time.May, 8, 12, 30, 0, 0, time.Local))
+	dc := newStandardDateCounterWithClock(3, clk)
+	dc.counts = []int64{10, 7, 3}
+
+	counts := dc.GetLastDaysCount(2)
+	require.Equal([]int64{10, 7}, counts)
+
+	counts[0] = 100
+	require.Equal([]int64{10, 7}, dc.GetLastDaysCount(2))
+}
+
+func TestDateCounterClear(t *testing.T) {
+	require := require.New(t)
+
+	dc := newStandardDateCounter(3)
+	dc.counts = []int64{10, 7, 3}
+
+	dc.Clear()
+
+	require.Equal([]int64{0, 0, 0}, dc.counts)
+}
+
+func TestDateCounterConcurrentAccess(t *testing.T) {
+	clk := clocktesting.NewFakeClock(time.Date(2026, time.May, 8, 12, 30, 0, 0, time.Local))
+	dc := newStandardDateCounterWithClock(3, clk)
+
+	var wg sync.WaitGroup
+	for range 8 {
+		wg.Go(func() {
+			for range 100 {
+				dc.Inc(1)
+				dc.Dec(1)
+				_ = dc.TodayCount()
+				_ = dc.GetLastDaysCount(3)
+				_ = dc.Snapshot()
+			}
+		})
+	}
+	wg.Wait()
+}

pkg/util/net/conn.go

@@ -16,13 +16,15 @@ package net
 
 import (
 	"context"
+	"crypto/hkdf"
+	"crypto/sha256"
 	"errors"
 	"io"
 	"net"
 	"sync/atomic"
 	"time"
 
-	"github.com/fatedier/golib/crypto"
+	libcrypto "github.com/fatedier/golib/crypto"
 	quic "github.com/quic-go/quic-go"
 
 	"github.com/fatedier/frp/pkg/util/xlog"
@@ -241,8 +243,8 @@ func (conn *wrapQuicStream) Close() error {
 }
 
 func NewCryptoReadWriter(rw io.ReadWriter, key []byte) (io.ReadWriter, error) {
-	encReader := crypto.NewReader(rw, key)
-	encWriter, err := crypto.NewWriter(rw, key)
+	encReader := libcrypto.NewReader(rw, key)
+	encWriter, err := libcrypto.NewWriter(rw, key)
 	if err != nil {
 		return nil, err
 	}
@@ -254,3 +256,85 @@ func NewCryptoReadWriter(rw io.ReadWriter, key []byte) (io.ReadWriter, error) {
 		Writer: encWriter,
 	}, nil
 }
+
+type AEADCryptoRole int
+
+const (
+	AEADCryptoRoleClient AEADCryptoRole = iota + 1
+	AEADCryptoRoleServer
+)
+
+const (
+	aeadControlHKDFInfoPrefix   = "frp wire v2 control aead"
+	aeadDirectionClientToServer = "client-to-server"
+	aeadDirectionServerToClient = "server-to-client"
+)
+
+// NewAEADCryptoReadWriter wraps rw with framed AEAD encryption for the v2
+// control channel. Frames and their order are authenticated, but end-of-stream
+// is not: a clean EOF at a frame boundary is returned as normal EOF by the
+// underlying AEAD stream. Protocols that need truncation detection for finite
+// objects must add their own authenticated final message.
+func NewAEADCryptoReadWriter(
+	rw io.ReadWriter,
+	key []byte,
+	role AEADCryptoRole,
+	algorithm string,
+	transcriptHash []byte,
+) (io.ReadWriter, error) {
+	clientToServerKey, serverToClientKey, err := deriveAEADControlKeys(key, algorithm, transcriptHash)
+	if err != nil {
+		return nil, err
+	}
+
+	var readKey, writeKey []byte
+	switch role {
+	case AEADCryptoRoleClient:
+		readKey = serverToClientKey
+		writeKey = clientToServerKey
+	case AEADCryptoRoleServer:
+		readKey = clientToServerKey
+		writeKey = serverToClientKey
+	default:
+		return nil, errors.New("invalid aead crypto role")
+	}
+
+	encReader, err := libcrypto.NewAEADStreamReader(rw, libcrypto.AEADStreamOptions{
+		Algorithm: libcrypto.AEADAlgorithm(algorithm),
+		Key:       readKey,
+	})
+	if err != nil {
+		return nil, err
+	}
+	encWriter, err := libcrypto.NewAEADStreamWriter(rw, libcrypto.AEADStreamOptions{
+		Algorithm: libcrypto.AEADAlgorithm(algorithm),
+		Key:       writeKey,
+	})
+	if err != nil {
+		return nil, err
+	}
+	return struct {
+		io.Reader
+		io.Writer
+	}{
+		Reader: encReader,
+		Writer: encWriter,
+	}, nil
+}
+
+func deriveAEADControlKeys(key []byte, algorithm string, transcriptHash []byte) (clientToServerKey, serverToClientKey []byte, err error) {
+	clientToServerKey, err = deriveAEADControlKey(key, algorithm, transcriptHash, aeadDirectionClientToServer)
+	if err != nil {
+		return nil, nil, err
+	}
+	serverToClientKey, err = deriveAEADControlKey(key, algorithm, transcriptHash, aeadDirectionServerToClient)
+	if err != nil {
+		return nil, nil, err
+	}
+	return clientToServerKey, serverToClientKey, nil
+}
+
+func deriveAEADControlKey(key []byte, algorithm string, transcriptHash []byte, direction string) ([]byte, error) {
+	info := aeadControlHKDFInfoPrefix + " " + algorithm + " " + direction
+	return hkdf.Key(sha256.New, key, transcriptHash, info, libcrypto.AEADKeySize)
+}

pkg/util/net/conn_test.go

@@ -0,0 +1,124 @@
+// Copyright 2026 The frp Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package net
+
+import (
+	"bytes"
+	"io"
+	stdnet "net"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/fatedier/frp/pkg/proto/wire"
+)
+
+func TestNewAEADCryptoReadWriterRoundTrip(t *testing.T) {
+	clientConn, serverConn := stdnet.Pipe()
+	defer clientConn.Close()
+	defer serverConn.Close()
+
+	key := []byte("token")
+	transcriptHash := bytes.Repeat([]byte{0x11}, 32)
+	clientRW, err := NewAEADCryptoReadWriter(
+		clientConn,
+		key,
+		AEADCryptoRoleClient,
+		wire.AEADAlgorithmXChaCha20Poly1305,
+		transcriptHash,
+	)
+	require.NoError(t, err)
+	serverRW, err := NewAEADCryptoReadWriter(
+		serverConn,
+		key,
+		AEADCryptoRoleServer,
+		wire.AEADAlgorithmXChaCha20Poly1305,
+		transcriptHash,
+	)
+	require.NoError(t, err)
+
+	clientErrCh := make(chan error, 1)
+	go func() {
+		if _, err := clientRW.Write([]byte("ping")); err != nil {
+			clientErrCh <- err
+			return
+		}
+		buf := make([]byte, len("pong"))
+		_, err := io.ReadFull(clientRW, buf)
+		clientErrCh <- err
+	}()
+
+	buf := make([]byte, len("ping"))
+	_, err = io.ReadFull(serverRW, buf)
+	require.NoError(t, err)
+	require.Equal(t, "ping", string(buf))
+	_, err = serverRW.Write([]byte("pong"))
+	require.NoError(t, err)
+	require.NoError(t, <-clientErrCh)
+}
+
+func TestNewAEADCryptoReadWriterRejectsDifferentTranscript(t *testing.T) {
+	clientConn, serverConn := stdnet.Pipe()
+	defer clientConn.Close()
+	defer serverConn.Close()
+	require.NoError(t, clientConn.SetDeadline(time.Now().Add(time.Second)))
+	require.NoError(t, serverConn.SetDeadline(time.Now().Add(time.Second)))
+
+	key := []byte("token")
+	clientRW, err := NewAEADCryptoReadWriter(
+		clientConn,
+		key,
+		AEADCryptoRoleClient,
+		wire.AEADAlgorithmAES256GCM,
+		bytes.Repeat([]byte{0x22}, 32),
+	)
+	require.NoError(t, err)
+	serverRW, err := NewAEADCryptoReadWriter(
+		serverConn,
+		key,
+		AEADCryptoRoleServer,
+		wire.AEADAlgorithmAES256GCM,
+		bytes.Repeat([]byte{0x33}, 32),
+	)
+	require.NoError(t, err)
+
+	writeErrCh := make(chan error, 1)
+	go func() {
+		_, err := clientRW.Write([]byte("ping"))
+		writeErrCh <- err
+	}()
+
+	buf := make([]byte, len("ping"))
+	_, err = io.ReadFull(serverRW, buf)
+	require.Error(t, err)
+	require.NoError(t, <-writeErrCh)
+}
+
+func TestDeriveAEADControlKeysUsesDistinctDirections(t *testing.T) {
+	clientToServerKey, serverToClientKey, err := deriveAEADControlKeys(
+		[]byte("token"),
+		wire.AEADAlgorithmXChaCha20Poly1305,
+		bytes.Repeat([]byte{0x44}, 32),
+	)
+	require.NoError(t, err)
+	require.Equal(t, []byte{
+		0xa0, 0x58, 0xcd, 0x02, 0x5d, 0x96, 0x98, 0x5f,
+		0xeb, 0xeb, 0xff, 0x79, 0xa1, 0x9f, 0x62, 0xb7,
+		0x15, 0xe0, 0x53, 0x91, 0x3d, 0xfc, 0x74, 0x77,
+		0x05, 0x91, 0x4c, 0x62, 0x4b, 0xf3, 0xd4, 0x95,
+	}, clientToServerKey)
+	require.NotEqual(t, clientToServerKey, serverToClientKey)
+}

pkg/util/net/dial.go

@@ -45,6 +45,11 @@ func DialHookWebsocket(protocol string, host string) libnet.AfterHookFunc {
 		if err != nil {
 			return nil, nil, err
 		}
+		// The tunnel payload is a raw byte stream (yamux), not UTF-8 text.
+		// Send it as binary frames; otherwise RFC 6455-compliant intermediaries
+		// (e.g. API gateways/reverse proxies) UTF-8-validate the default text
+		// frames and close the connection on invalid bytes.
+		conn.PayloadType = websocket.BinaryFrame
 		return ctx, conn, nil
 	}
 }

pkg/util/net/websocket.go

@@ -32,6 +32,11 @@ func NewWebsocketListener(ln net.Listener) (wl *WebsocketListener) {
 
 	muxer := http.NewServeMux()
 	muxer.Handle(FrpWebsocketPath, websocket.Handler(func(c *websocket.Conn) {
+		// The tunnel payload is a raw byte stream (yamux), not UTF-8 text.
+		// Send it as binary frames; otherwise RFC 6455-compliant intermediaries
+		// (e.g. API gateways/reverse proxies) UTF-8-validate the default text
+		// frames and close the connection on invalid bytes.
+		c.PayloadType = websocket.BinaryFrame
 		notifyCh := make(chan struct{})
 		conn := WrapCloseNotifyConn(c, func(_ error) {
 			close(notifyCh)

pkg/util/tcpmux/httpconnect.go

@@ -39,11 +39,14 @@ type HTTPConnectTCPMuxer struct {
 func NewHTTPConnectTCPMuxer(listener net.Listener, passthrough bool, timeout time.Duration) (*HTTPConnectTCPMuxer, error) {
 	ret := &HTTPConnectTCPMuxer{passthrough: passthrough}
 	mux, err := vhost.NewMuxer(listener, ret.getHostFromHTTPConnect, timeout)
+	if err != nil {
+		return nil, err
+	}
 	mux.SetCheckAuthFunc(ret.auth).
 		SetSuccessHookFunc(ret.sendConnectResponse).
 		SetFailHookFunc(vhostFailed)
 	ret.Muxer = mux
-	return ret, err
+	return ret, nil
 }
 
 func (muxer *HTTPConnectTCPMuxer) readHTTPConnectRequest(rd io.Reader) (host, httpUser, httpPwd string, err error) {

pkg/util/version/version.go

@@ -14,7 +14,7 @@
 
 package version
 
-var version = "0.69.0"
+var version = "0.70.1"
 
 func Full() string {
 	return version

pkg/util/vhost/http.go

@@ -24,13 +24,10 @@ import (
 	"net/http"
 	"net/http/httputil"
 	"net/url"
-	"strings"
 	"time"
 
 	libio "github.com/fatedier/golib/io"
 	"github.com/fatedier/golib/pool"
-	"golang.org/x/net/http2"
-	"golang.org/x/net/http2/h2c"
 
 	httppkg "github.com/fatedier/frp/pkg/util/http"
 	"github.com/fatedier/frp/pkg/util/log"
@@ -140,7 +137,7 @@ func NewHTTPReverseProxy(option HTTPReverseProxyOptions, vhostRouter *Routers) *
 			_, _ = rw.Write(getNotFoundPageContent())
 		},
 	}
-	rp.proxy = h2c.NewHandler(proxy, &http2.Server{})
+	rp.proxy = proxy
 	return rp
 }
 
@@ -160,7 +157,7 @@ func (rp *HTTPReverseProxy) UnRegister(routeCfg RouteConfig) {
 }
 
 func (rp *HTTPReverseProxy) GetRouteConfig(domain, location, routeByHTTPUser string) *RouteConfig {
-	vr, ok := rp.getVhost(domain, location, routeByHTTPUser)
+	vr, ok := rp.vhostRouter.getByRoute(domain, location, routeByHTTPUser)
 	if ok {
 		log.Debugf("get new http request host [%s] path [%s] httpuser [%s]", domain, location, routeByHTTPUser)
 		return vr.payload.(*RouteConfig)
@@ -171,7 +168,7 @@ func (rp *HTTPReverseProxy) GetRouteConfig(domain, location, routeByHTTPUser str
 // CreateConnection create a new connection by route config
 func (rp *HTTPReverseProxy) CreateConnection(reqRouteInfo *RequestRouteInfo, byEndpoint bool) (net.Conn, error) {
 	host, _ := httppkg.CanonicalHost(reqRouteInfo.Host)
-	vr, ok := rp.getVhost(host, reqRouteInfo.URL, reqRouteInfo.HTTPUser)
+	vr, ok := rp.vhostRouter.getByRoute(host, reqRouteInfo.URL, reqRouteInfo.HTTPUser)
 	if ok {
 		if byEndpoint {
 			fn := vr.payload.(*RouteConfig).CreateConnByEndpointFn
@@ -208,50 +205,6 @@ func checkRouteAuthByRequest(req *http.Request, rc *RouteConfig) bool {
 	return ok && user == rc.Username && passwd == rc.Password
 }
 
-// getVhost tries to get vhost router by route policy.
-func (rp *HTTPReverseProxy) getVhost(domain, location, routeByHTTPUser string) (*Router, bool) {
-	findRouter := func(inDomain, inLocation, inRouteByHTTPUser string) (*Router, bool) {
-		vr, ok := rp.vhostRouter.Get(inDomain, inLocation, inRouteByHTTPUser)
-		if ok {
-			return vr, ok
-		}
-		// Try to check if there is one proxy that doesn't specify routerByHTTPUser, it means match all.
-		vr, ok = rp.vhostRouter.Get(inDomain, inLocation, "")
-		if ok {
-			return vr, ok
-		}
-		return nil, false
-	}
-
-	// First we check the full hostname
-	// if not exist, then check the wildcard_domain such as *.example.com
-	vr, ok := findRouter(domain, location, routeByHTTPUser)
-	if ok {
-		return vr, ok
-	}
-
-	// e.g. domain = test.example.com, try to match wildcard domains.
-	// *.example.com
-	// *.com
-	domainSplit := strings.Split(domain, ".")
-	for len(domainSplit) >= 3 {
-		domainSplit[0] = "*"
-		domain = strings.Join(domainSplit, ".")
-		vr, ok = findRouter(domain, location, routeByHTTPUser)
-		if ok {
-			return vr, true
-		}
-		domainSplit = domainSplit[1:]
-	}
-
-	// Finally, try to check if there is one proxy that domain is "*" means match all domains.
-	vr, ok = findRouter("*", location, routeByHTTPUser)
-	if ok {
-		return vr, true
-	}
-	return nil, false
-}
-
 func (rp *HTTPReverseProxy) connectHandler(rw http.ResponseWriter, req *http.Request) {
 	hj, ok := rw.(http.Hijacker)
 	if !ok {

pkg/util/vhost/http_test.go

@@ -1,14 +1,94 @@
 package vhost
 
 import (
+	"bufio"
+	"fmt"
+	"net"
+	"net/http"
 	"net/http/httptest"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/require"
 
 	httppkg "github.com/fatedier/frp/pkg/util/http"
 )
 
+func TestHTTPServerProtocols(t *testing.T) {
+	rp := NewHTTPReverseProxy(HTTPReverseProxyOptions{}, NewRouters())
+	protocols := new(http.Protocols)
+	protocols.SetHTTP1(true)
+	protocols.SetUnencryptedHTTP2(true)
+	server := &http.Server{
+		Handler:           rp,
+		ReadHeaderTimeout: time.Second,
+		Protocols:         protocols,
+	}
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+
+	serveErr := make(chan error, 1)
+	go func() {
+		serveErr <- server.Serve(listener)
+	}()
+	defer func() {
+		require.NoError(t, server.Close())
+		require.ErrorIs(t, <-serveErr, http.ErrServerClosed)
+	}()
+
+	require.True(t, server.Protocols.HTTP1())
+	require.True(t, server.Protocols.UnencryptedHTTP2())
+
+	t.Run("HTTP/1.1", func(t *testing.T) {
+		transport := &http.Transport{Protocols: httpProtocols(true, false)}
+		defer transport.CloseIdleConnections()
+		client := &http.Client{Transport: transport}
+		response, err := client.Get("http://" + listener.Addr().String() + "/")
+		require.NoError(t, err)
+		defer response.Body.Close()
+
+		require.Equal(t, "HTTP/1.1", response.Proto)
+		require.Equal(t, http.StatusNotFound, response.StatusCode)
+	})
+
+	t.Run("HTTP/2 prior knowledge", func(t *testing.T) {
+		transport := &http.Transport{Protocols: httpProtocols(false, true)}
+		defer transport.CloseIdleConnections()
+		client := &http.Client{Transport: transport}
+		response, err := client.Get("http://" + listener.Addr().String() + "/")
+		require.NoError(t, err)
+		defer response.Body.Close()
+
+		require.Equal(t, "HTTP/2.0", response.Proto)
+		require.Equal(t, http.StatusNotFound, response.StatusCode)
+	})
+
+	t.Run("HTTP/1.1 Upgrade h2c", func(t *testing.T) {
+		conn, err := net.Dial("tcp", listener.Addr().String())
+		require.NoError(t, err)
+		defer conn.Close()
+
+		_, err = fmt.Fprintf(conn,
+			"GET / HTTP/1.1\r\nHost: %s\r\n"+
+				"Connection: Upgrade, HTTP2-Settings\r\nUpgrade: h2c\r\n"+
+				"HTTP2-Settings: AAMAAABkAAQCAAAAAAIAAAAA\r\n\r\n",
+			listener.Addr())
+		require.NoError(t, err)
+		response, err := http.ReadResponse(bufio.NewReader(conn), nil)
+		require.NoError(t, err)
+		defer response.Body.Close()
+
+		require.NotEqual(t, http.StatusSwitchingProtocols, response.StatusCode)
+	})
+}
+
+func httpProtocols(http1, unencryptedHTTP2 bool) *http.Protocols {
+	protocols := new(http.Protocols)
+	protocols.SetHTTP1(http1)
+	protocols.SetUnencryptedHTTP2(unencryptedHTTP2)
+	return protocols
+}
+
 func TestCheckRouteAuthByRequest(t *testing.T) {
 	rc := &RouteConfig{
 		Username: "alice",

pkg/util/vhost/https.go

@@ -29,11 +29,11 @@ type HTTPSMuxer struct {
 
 func NewHTTPSMuxer(listener net.Listener, timeout time.Duration) (*HTTPSMuxer, error) {
 	mux, err := NewMuxer(listener, GetHTTPSHostname, timeout)
-	mux.SetFailHookFunc(vhostFailed)
 	if err != nil {
 		return nil, err
 	}
-	return &HTTPSMuxer{mux}, err
+	mux.SetFailHookFunc(vhostFailed)
+	return &HTTPSMuxer{mux}, nil
 }
 
 func GetHTTPSHostname(c net.Conn) (_ net.Conn, _ map[string]string, err error) {

pkg/util/vhost/https_test.go

@@ -16,23 +16,53 @@ func TestGetHTTPSHostname(t *testing.T) {
 	require.NoError(err)
 	defer l.Close()
 
-	var conn net.Conn
+	connCh := make(chan net.Conn, 1)
+	acceptErrCh := make(chan error, 1)
 	go func() {
-		conn, _ = l.Accept()
-		require.NotNil(conn)
+		conn, err := l.Accept()
+		if err != nil {
+			acceptErrCh <- err
+			return
+		}
+		connCh <- conn
 	}()
 
+	clientErrCh := make(chan error, 1)
 	go func() {
 		time.Sleep(100 * time.Millisecond)
-		tls.Dial("tcp", l.Addr().String(), &tls.Config{
+		conn, err := tls.Dial("tcp", l.Addr().String(), &tls.Config{
 			InsecureSkipVerify: true,
 			ServerName:         "example.com",
 		})
+		if conn != nil {
+			_ = conn.Close()
+		}
+		clientErrCh <- err
 	}()
 
-	time.Sleep(200 * time.Millisecond)
-	_, infos, err := GetHTTPSHostname(conn)
+	var conn net.Conn
+	select {
+	case conn = <-connCh:
+	case err := <-acceptErrCh:
+		require.NoError(err)
+	case <-time.After(time.Second):
+		t.Fatal("timed out waiting for accepted connection")
+	}
+	require.NotNil(conn)
+
+	serverConn, infos, err := GetHTTPSHostname(conn)
+	if serverConn != nil {
+		_ = serverConn.Close()
+	} else {
+		_ = conn.Close()
+	}
 	require.NoError(err)
 	require.Equal("example.com", infos["Host"])
 	require.Equal("https", infos["Scheme"])
+
+	select {
+	case <-clientErrCh:
+	case <-time.After(time.Second):
+		t.Fatal("timed out waiting for TLS client")
+	}
 }

pkg/util/vhost/router.go

@@ -93,12 +93,19 @@ func (r *Routers) Del(domain, location, httpUser string) {
 	routersByHTTPUser[httpUser] = newVrs
 }
 
+// Get returns the best location match for an exact host and exact HTTP user.
+// It does not apply all-users, wildcard-domain, or catch-all-domain fallback.
 func (r *Routers) Get(host, path, httpUser string) (vr *Router, exist bool) {
 	host = strings.ToLower(host)
 
 	r.mutex.RLock()
 	defer r.mutex.RUnlock()
 
+	return r.getLocked(host, path, httpUser)
+}
+
+// getLocked performs an exact-host lookup; host must already be lower-cased.
+func (r *Routers) getLocked(host, path, httpUser string) (vr *Router, exist bool) {
 	routersByHTTPUser, found := r.indexByDomain[host]
 	if !found {
 		return
@@ -117,6 +124,49 @@ func (r *Routers) Get(host, path, httpUser string) (vr *Router, exist bool) {
 	return
 }
 
+func (r *Routers) getByRoute(host, path, httpUser string) (*Router, bool) {
+	host = strings.ToLower(host)
+
+	r.mutex.RLock()
+	defer r.mutex.RUnlock()
+
+	// First we check the full hostname; if it doesn't exist, then check wildcard domains.
+	// For example, test.example.com checks *.example.com before falling back to "*".
+	vr, ok := r.getExactOrAllUsersLocked(host, path, httpUser)
+	if ok {
+		return vr, true
+	}
+
+	hostSplit := strings.Split(host, ".")
+	// Keep two-label hosts out of the wildcard walk, so example.com does not match *.com.
+	for len(hostSplit) >= 3 {
+		// Replace the leftmost remaining label with the wildcard marker.
+		hostSplit[0] = "*"
+		host = strings.Join(hostSplit, ".")
+		vr, ok = r.getExactOrAllUsersLocked(host, path, httpUser)
+		if ok {
+			return vr, true
+		}
+		hostSplit = hostSplit[1:]
+	}
+
+	// Finally, try to check if there is one proxy whose domain is "*", which means match all domains.
+	return r.getExactOrAllUsersLocked("*", path, httpUser)
+}
+
+func (r *Routers) getExactOrAllUsersLocked(host, path, httpUser string) (*Router, bool) {
+	vr, ok := r.getLocked(host, path, httpUser)
+	if ok {
+		return vr, true
+	}
+	// Try to check if there is one proxy that doesn't specify routeByHTTPUser, it means match all.
+	vr, ok = r.getLocked(host, path, "")
+	if ok {
+		return vr, true
+	}
+	return nil, false
+}
+
 func (r *Routers) exist(host, path, httpUser string) (route *Router, exist bool) {
 	routersByHTTPUser, found := r.indexByDomain[host]
 	if !found {

pkg/util/vhost/router_test.go

@@ -0,0 +1,257 @@
+// Copyright 2017 fatedier, fatedier@gmail.com
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package vhost
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestRoutersGet(t *testing.T) {
+	routers := NewRouters()
+	require.NoError(t, routers.Add("example.com", "/api", "alice", "exact-user"))
+	require.NoError(t, routers.Add("example.com", "/public", "", "exact-all-users"))
+	require.NoError(t, routers.Add("*.example.com", "/api", "", "wildcard-all-users"))
+	require.NoError(t, routers.Add("*", "/api", "", "all-domains"))
+
+	t.Run("exact host and user match with normalized domain", func(t *testing.T) {
+		router, ok := routers.Get("EXAMPLE.COM", "/api/users", "alice")
+		require.True(t, ok)
+		require.Equal(t, "exact-user", router.payload)
+	})
+
+	t.Run("exact host and empty user match", func(t *testing.T) {
+		router, ok := routers.Get("EXAMPLE.COM", "/public/docs", "")
+		require.True(t, ok)
+		require.Equal(t, "exact-all-users", router.payload)
+	})
+
+	t.Run("does not fall back from named user to empty user", func(t *testing.T) {
+		// Get intentionally requires an exact HTTP user; route-level fallbacks live in getByRoute.
+		_, ok := routers.Get("EXAMPLE.COM", "/public/docs", "alice")
+		require.False(t, ok)
+	})
+
+	t.Run("does not fall back to wildcard domains", func(t *testing.T) {
+		_, ok := routers.Get("foo.example.com", "/api/users", "")
+		require.False(t, ok)
+	})
+
+	t.Run("does not fall back to catch-all domain", func(t *testing.T) {
+		_, ok := routers.Get("missing.test", "/api/users", "")
+		require.False(t, ok)
+	})
+}
+
+func TestRoutersGetByRoute(t *testing.T) {
+	routers := NewRouters()
+	require.NoError(t, routers.Add("example.com", "/api", "alice", "exact-user"))
+	require.NoError(t, routers.Add("example.com", "/api", "", "exact-all-users"))
+	require.NoError(t, routers.Add("exact.example.com", "/api", "", "exact-subdomain"))
+	require.NoError(t, routers.Add("*.example.com", "/api", "", "wildcard-all-users"))
+	require.NoError(t, routers.Add("*.foo.example.com", "/api", "", "specific-wildcard"))
+	require.NoError(t, routers.Add("*.bar.com", "/api", "", "wildcard-parent-domain"))
+	require.NoError(t, routers.Add("*", "/admin", "root", "all-domains-user"))
+	require.NoError(t, routers.Add("*", "/", "", "all-domains"))
+
+	tests := []struct {
+		name     string
+		domain   string
+		location string
+		httpUser string
+		want     string
+	}{
+		{
+			name:     "exact domain and http user",
+			domain:   "example.com",
+			location: "/api/users",
+			httpUser: "alice",
+			want:     "exact-user",
+		},
+		{
+			name:     "exact domain falls back to all users",
+			domain:   "example.com",
+			location: "/api/users",
+			httpUser: "bob",
+			want:     "exact-all-users",
+		},
+		{
+			name:     "wildcard domain uses all users fallback",
+			domain:   "foo.example.com",
+			location: "/api/users",
+			httpUser: "bob",
+			want:     "wildcard-all-users",
+		},
+		{
+			name:     "mixed-case domain is normalized",
+			domain:   "Foo.Example.Com",
+			location: "/api/users",
+			httpUser: "bob",
+			want:     "wildcard-all-users",
+		},
+		{
+			name:     "exact domain wins over wildcard domain",
+			domain:   "exact.example.com",
+			location: "/api/users",
+			httpUser: "bob",
+			want:     "exact-subdomain",
+		},
+		{
+			name:     "more specific wildcard wins over broader wildcard",
+			domain:   "bar.foo.example.com",
+			location: "/api/users",
+			httpUser: "bob",
+			want:     "specific-wildcard",
+		},
+		{
+			name:     "wildcard walk checks parent domains",
+			domain:   "a.b.bar.com",
+			location: "/api/users",
+			httpUser: "bob",
+			want:     "wildcard-parent-domain",
+		},
+		{
+			name:     "catch-all domain fallback",
+			domain:   "foo.test.com",
+			location: "/other",
+			httpUser: "bob",
+			want:     "all-domains",
+		},
+		{
+			name:     "catch-all domain honors http user",
+			domain:   "foo.test.com",
+			location: "/admin/panel",
+			httpUser: "root",
+			want:     "all-domains-user",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			router, ok := routers.getByRoute(tt.domain, tt.location, tt.httpUser)
+			require.True(t, ok)
+			require.Equal(t, tt.want, router.payload)
+		})
+	}
+}
+
+func TestRoutersGetByRouteNoMatch(t *testing.T) {
+	routers := NewRouters()
+	require.NoError(t, routers.Add("*.example.com", "/api", "", "wildcard-all-users"))
+	require.NoError(t, routers.Add("*.com", "/api", "", "top-level-wildcard"))
+
+	tests := []struct {
+		name     string
+		domain   string
+		location string
+	}{
+		{
+			name:     "two-label domain does not enter wildcard walk",
+			domain:   "example.com",
+			location: "/api/users",
+		},
+		{
+			name:     "missing catch-all remains no match",
+			domain:   "foo.test.com",
+			location: "/api/users",
+		},
+		{
+			name:     "wrong path remains no match",
+			domain:   "foo.example.com",
+			location: "/other",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			router, ok := routers.getByRoute(tt.domain, tt.location, "bob")
+			require.False(t, ok)
+			require.Nil(t, router)
+		})
+	}
+}
+
+func TestRoutersConcurrentGetByRouteAndAdd(t *testing.T) {
+	routers := NewRouters()
+	require.NoError(t, routers.Add("*.example.com", "/api", "", "wildcard"))
+
+	const readers = 8
+	const iterations = 200
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	start := make(chan struct{})
+	errCh := make(chan error, readers+1)
+	var wg sync.WaitGroup
+
+	for id := range readers {
+		wg.Go(func() {
+			<-start
+			for j := range iterations {
+				select {
+				case <-ctx.Done():
+					return
+				default:
+				}
+				router, ok := routers.getByRoute("foo.example.com", "/api/users", "")
+				if !ok || router == nil || router.payload != "wildcard" {
+					errCh <- fmt.Errorf("reader %d iteration %d got router=%v ok=%v", id, j, router, ok)
+					return
+				}
+			}
+		})
+	}
+
+	wg.Go(func() {
+		<-start
+		for i := range iterations {
+			select {
+			case <-ctx.Done():
+				return
+			default:
+			}
+			err := routers.Add(fmt.Sprintf("host-%d.example.com", i), "/api", "", i)
+			if err != nil {
+				errCh <- err
+				return
+			}
+		}
+	})
+
+	close(start)
+
+	done := make(chan struct{})
+	go func() {
+		wg.Wait()
+		close(done)
+	}()
+
+	select {
+	case <-done:
+	case <-time.After(5 * time.Second):
+		cancel()
+		t.Fatal("concurrent route lookup and add timed out")
+	}
+
+	close(errCh)
+	for err := range errCh {
+		require.NoError(t, err)
+	}
+}

pkg/util/vhost/vhost.go

@@ -148,42 +148,10 @@ func (v *Muxer) Listen(ctx context.Context, cfg *RouteConfig) (l *Listener, err
 }
 
 func (v *Muxer) getListener(name, path, httpUser string) (*Listener, bool) {
-	findRouter := func(inName, inPath, inHTTPUser string) (*Listener, bool) {
-		vr, ok := v.registryRouter.Get(inName, inPath, inHTTPUser)
+	vr, ok := v.registryRouter.getByRoute(name, path, httpUser)
 	if ok {
 		return vr.payload.(*Listener), true
 	}
-		// Try to check if there is one proxy that doesn't specify routerByHTTPUser, it means match all.
-		vr, ok = v.registryRouter.Get(inName, inPath, "")
-		if ok {
-			return vr.payload.(*Listener), true
-		}
-		return nil, false
-	}
-
-	// first we check the full hostname
-	// if not exist, then check the wildcard_domain such as *.example.com
-	l, ok := findRouter(name, path, httpUser)
-	if ok {
-		return l, true
-	}
-
-	domainSplit := strings.Split(name, ".")
-	for len(domainSplit) >= 3 {
-		domainSplit[0] = "*"
-		name = strings.Join(domainSplit, ".")
-
-		l, ok = findRouter(name, path, httpUser)
-		if ok {
-			return l, true
-		}
-		domainSplit = domainSplit[1:]
-	}
-	// Finally, try to check if there is one proxy that domain is "*" means match all domains.
-	l, ok = findRouter("*", path, httpUser)
-	if ok {
-		return l, true
-	}
 	return nil, false
 }
 

pkg/util/wait/backoff.go

@@ -18,6 +18,8 @@ import (
 	"math/rand/v2"
 	"time"
 
+	"k8s.io/utils/clock"
+
 	"github.com/fatedier/frp/pkg/util/util"
 )
 
@@ -48,6 +50,7 @@ type FastBackoffOptions struct {
 
 type fastBackoffImpl struct {
 	options FastBackoffOptions
+	clock   clock.PassiveClock
 
 	lastCalledTime      time.Time
 	consecutiveErrCount int
@@ -57,18 +60,26 @@ type fastBackoffImpl struct {
 }
 
 func NewFastBackoffManager(options FastBackoffOptions) BackoffManager {
+	return newFastBackoffManagerWithClock(options, clock.RealClock{})
+}
+
+func newFastBackoffManagerWithClock(options FastBackoffOptions, clk clock.PassiveClock) BackoffManager {
+	if clk == nil {
+		clk = clock.RealClock{}
+	}
 	return &fastBackoffImpl{
 		options:                 options,
+		clock:                   clk,
 		countsInFastRetryWindow: 1,
 	}
 }
 
 func (f *fastBackoffImpl) Backoff(previousDuration time.Duration, previousConditionError bool) time.Duration {
 	if f.lastCalledTime.IsZero() {
-		f.lastCalledTime = time.Now()
+		f.lastCalledTime = f.clock.Now()
 		return f.options.Duration
 	}
-	now := time.Now()
+	now := f.clock.Now()
 	f.lastCalledTime = now
 
 	if previousConditionError {

pkg/util/wait/backoff_test.go

@@ -0,0 +1,27 @@
+package wait
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	clocktesting "k8s.io/utils/clock/testing"
+)
+
+func TestFastBackoffManagerUsesClock(t *testing.T) {
+	require := require.New(t)
+
+	start := time.Date(2026, time.May, 8, 12, 30, 0, 0, time.UTC)
+	clk := clocktesting.NewFakeClock(start)
+	backoff := newFastBackoffManagerWithClock(FastBackoffOptions{
+		Duration: time.Second,
+	}, clk).(*fastBackoffImpl)
+
+	require.Equal(time.Second, backoff.Backoff(0, false))
+	require.Equal(start, backoff.lastCalledTime)
+
+	next := start.Add(time.Minute)
+	clk.SetTime(next)
+	require.Equal(time.Second, backoff.Backoff(time.Second, false))
+	require.Equal(next, backoff.lastCalledTime)
+}

pkg/util/xlog/log_writer.go

@@ -19,7 +19,6 @@ import "strings"
 // LogWriter forwards writes to frp's logger at configurable level.
 // It is safe for concurrent use as long as the underlying Logger is thread-safe.
 type LogWriter struct {
-	xl      *Logger
 	logFunc func(string)
 }
 
@@ -31,35 +30,30 @@ func (w LogWriter) Write(p []byte) (n int, err error) {
 
 func NewTraceWriter(xl *Logger) LogWriter {
 	return LogWriter{
-		xl:      xl,
 		logFunc: func(msg string) { xl.Tracef("%s", msg) },
 	}
 }
 
 func NewDebugWriter(xl *Logger) LogWriter {
 	return LogWriter{
-		xl:      xl,
 		logFunc: func(msg string) { xl.Debugf("%s", msg) },
 	}
 }
 
 func NewInfoWriter(xl *Logger) LogWriter {
 	return LogWriter{
-		xl:      xl,
 		logFunc: func(msg string) { xl.Infof("%s", msg) },
 	}
 }
 
 func NewWarnWriter(xl *Logger) LogWriter {
 	return LogWriter{
-		xl:      xl,
 		logFunc: func(msg string) { xl.Warnf("%s", msg) },
 	}
 }
 
 func NewErrorWriter(xl *Logger) LogWriter {
 	return LogWriter{
-		xl:      xl,
 		logFunc: func(msg string) { xl.Errorf("%s", msg) },
 	}
 }

pkg/vnet/controller.go

@@ -286,7 +286,6 @@ func (r *clientRouter) addRoute(name string, routes []net.IPNet, conn io.ReadWri
 	r.mu.Lock()
 	defer r.mu.Unlock()
 	r.routes[name] = &routeElement{
-		name:   name,
 		routes: routes,
 		conn:   conn,
 	}
@@ -383,7 +382,6 @@ func (r *serverRouter) cleanupConnIPs(conn io.Writer) {
 }
 
 type routeElement struct {
-	name   string
 	routes []net.IPNet
 	conn   io.ReadWriteCloser
 }

server/api_router.go

@@ -48,6 +48,17 @@ func (svr *Service) registerRouteHandlers(helper *httppkg.RouterRegisterHelper)
 	subRouter.HandleFunc("/api/clients/{key}", httppkg.MakeHTTPHandlerFunc(apiController.APIClientDetail)).Methods("GET")
 	subRouter.HandleFunc("/api/proxies", httppkg.MakeHTTPHandlerFunc(apiController.DeleteProxies)).Methods("DELETE")
 
+	subRouter.HandleFunc("/api/v2/users", httppkg.MakeHTTPHandlerFuncV2(apiController.APIV2UserList)).Methods("GET")
+	subRouter.HandleFunc("/api/v2/system/info", httppkg.MakeHTTPHandlerFuncV2(apiController.APIV2SystemInfo)).Methods("GET")
+	subRouter.HandleFunc("/api/v2/system/prune", httppkg.MakeHTTPHandlerFuncV2(apiController.APIV2SystemPrune)).Methods("POST")
+	subRouter.HandleFunc("/api/v2/clients", httppkg.MakeHTTPHandlerFuncV2(apiController.APIV2ClientList)).Methods("GET")
+	v2EncodedPathRouter := subRouter.NewRoute().Subrouter()
+	v2EncodedPathRouter.UseEncodedPath()
+	v2EncodedPathRouter.HandleFunc("/api/v2/clients/{key}", httppkg.MakeHTTPHandlerFuncV2(apiController.APIV2ClientDetail)).Methods("GET")
+	subRouter.HandleFunc("/api/v2/proxies", httppkg.MakeHTTPHandlerFuncV2(apiController.APIV2ProxyList)).Methods("GET")
+	v2EncodedPathRouter.HandleFunc("/api/v2/proxies/{name}/traffic", httppkg.MakeHTTPHandlerFuncV2(apiController.APIV2ProxyTraffic)).Methods("GET")
+	v2EncodedPathRouter.HandleFunc("/api/v2/proxies/{name}", httppkg.MakeHTTPHandlerFuncV2(apiController.APIV2ProxyDetail)).Methods("GET")
+
 	// view
 	subRouter.Handle("/favicon.ico", http.FileServer(helper.AssetsFS)).Methods("GET")
 	subRouter.PathPrefix("/static/").Handler(

server/control.go

@@ -17,6 +17,7 @@ package server
 import (
 	"context"
 	"fmt"
+	"net"
 	"runtime/debug"
 	"sync"
 	"sync/atomic"
@@ -40,55 +41,311 @@ import (
 	"github.com/fatedier/frp/server/registry"
 )
 
+type ControlID uint64
+
+var nextControlID atomic.Uint64
+
+type controlEntry struct {
+	ctl *Control
+	id  ControlID
+	// runMu serializes lifecycle and routing decisions for one run ID.
+	// Replacements inherit it; removing the entry releases the manager's reference.
+	runMu *sync.Mutex
+
+	registryOnline    bool
+	registryControlID ControlID
+}
+
 type ControlManager struct {
 	// controls indexed by run id
-	ctlsByRunID map[string]*Control
+	ctlsByRunID map[string]*controlEntry
+	registry    *registry.ClientRegistry
+	closed      bool
 
 	mu sync.RWMutex
 }
 
-func NewControlManager() *ControlManager {
+func NewControlManager(clientRegistry *registry.ClientRegistry) *ControlManager {
 	return &ControlManager{
-		ctlsByRunID: make(map[string]*Control),
+		ctlsByRunID: make(map[string]*controlEntry),
+		registry:    clientRegistry,
 	}
 }
 
-func (cm *ControlManager) Add(runID string, ctl *Control) (old *Control) {
-	cm.mu.Lock()
-	defer cm.mu.Unlock()
-
-	var ok bool
-	old, ok = cm.ctlsByRunID[runID]
-	if ok {
-		old.Replaced(ctl)
+// lockCurrentRun returns the current entry with its run gate held. It never
+// waits for the gate while holding cm.mu and revalidates the gate after waiting.
+// The global order is runMu, cm.mu, ctl.lifecycleMu, then registry locks.
+func (cm *ControlManager) lockCurrentRun(runID string, allowClosed bool) (*controlEntry, bool) {
+	cm.mu.RLock()
+	entry, ok := cm.ctlsByRunID[runID]
+	if cm.closed && !allowClosed {
+		ok = false
 	}
-	cm.ctlsByRunID[runID] = ctl
-	return
+	cm.mu.RUnlock()
+	if !ok {
+		return nil, false
+	}
+
+	runMu := entry.runMu
+	runMu.Lock()
+	cm.mu.RLock()
+	entry, ok = cm.ctlsByRunID[runID]
+	if (cm.closed && !allowClosed) || !ok || entry.runMu != runMu {
+		ok = false
+	}
+	cm.mu.RUnlock()
+	if !ok {
+		runMu.Unlock()
+		return nil, false
+	}
+	return entry, true
 }
 
-// we should make sure if it's the same control to prevent delete a new one
-func (cm *ControlManager) Del(runID string, ctl *Control) {
+// Add makes ctl the pending current generation and records the predecessor
+// finalization barrier it must wait for before activation.
+func (cm *ControlManager) Add(ctl *Control) error {
+	for {
+		// Never wait for a run gate while holding cm.mu.
+		cm.mu.RLock()
+		old := cm.ctlsByRunID[ctl.runID]
+		cm.mu.RUnlock()
+		if old != nil {
+			old.runMu.Lock()
+		}
+
+		cm.mu.Lock()
+		if cm.closed {
+			cm.mu.Unlock()
+			if old != nil {
+				old.runMu.Unlock()
+			}
+			return fmt.Errorf("control manager is closed")
+		}
+		if cm.ctlsByRunID[ctl.runID] != old {
+			cm.mu.Unlock()
+			if old != nil {
+				old.runMu.Unlock()
+			}
+			continue
+		}
+
+		id := ControlID(nextControlID.Add(1))
+		if err := ctl.admit(cm, id); err != nil {
+			cm.mu.Unlock()
+			if old != nil {
+				old.runMu.Unlock()
+			}
+			return err
+		}
+
+		runMu := &sync.Mutex{}
+		if old != nil {
+			runMu = old.runMu
+		}
+		entry := &controlEntry{ctl: ctl, id: id, runMu: runMu}
+		var (
+			oldCtl  *Control
+			barrier <-chan struct{}
+		)
+		if old != nil {
+			oldCtl = old.ctl
+			barrier = oldCtl.markReplaced()
+			ctl.setHandoffBarrier(barrier)
+			entry.registryOnline = old.registryOnline
+			entry.registryControlID = old.registryControlID
+		}
+		cm.ctlsByRunID[ctl.runID] = entry
+		cm.mu.Unlock()
+		if old != nil {
+			old.runMu.Unlock()
+		}
+
+		if oldCtl != nil {
+			oldCtl.Replaced(ctl)
+		}
+		return nil
+	}
+}
+
+// Activate registers ctl as online only if it is still the pending current
+// generation.
+func (cm *ControlManager) Activate(ctl *Control) (bool, error) {
+	entry, ok := cm.lockCurrentRun(ctl.runID, false)
+	if !ok {
+		return false, nil
+	}
+	defer entry.runMu.Unlock()
 	cm.mu.Lock()
 	defer cm.mu.Unlock()
-	if c, ok := cm.ctlsByRunID[runID]; ok && c == ctl {
-		delete(cm.ctlsByRunID, runID)
+
+	if cm.closed || cm.ctlsByRunID[ctl.runID] != entry || entry.ctl != ctl || entry.id != ctl.controlID {
+		return false, nil
 	}
+
+	ctl.lifecycleMu.Lock()
+	defer ctl.lifecycleMu.Unlock()
+	if ctl.state != controlStatePending {
+		return false, nil
+	}
+	if ctl.activated {
+		return true, nil
+	}
+
+	loginMsg := ctl.sessionCtx.LoginMsg
+	remoteAddr := ctl.sessionCtx.Conn.RemoteAddr().String()
+	if host, _, err := net.SplitHostPort(remoteAddr); err == nil {
+		remoteAddr = host
+	}
+	_, conflict := cm.registry.RegisterWithControlID(
+		loginMsg.User,
+		loginMsg.ClientID,
+		ctl.runID,
+		loginMsg.Hostname,
+		loginMsg.Version,
+		remoteAddr,
+		ctl.sessionCtx.WireProtocol,
+		uint64(entry.id),
+	)
+	if conflict {
+		return true, fmt.Errorf("client_id [%s] for user [%s] is already online", loginMsg.ClientID, loginMsg.User)
+	}
+
+	entry.registryOnline = true
+	entry.registryControlID = entry.id
+	ctl.activated = true
+	return true, nil
+}
+
+// completeLogin reserves ctl's current ownership with its run gate while the
+// bounded successful LoginResp write runs, then transitions it to running.
+// The callback must only perform that bounded write; it must not call back into
+// the control manager or the same control lifecycle.
+func (cm *ControlManager) completeLogin(ctl *Control, writeSuccess func() error) (bool, error) {
+	entry, ok := cm.lockCurrentRun(ctl.runID, false)
+	if !ok {
+		return false, nil
+	}
+	defer entry.runMu.Unlock()
+	if entry.ctl != ctl || entry.id != ctl.controlID {
+		return false, nil
+	}
+
+	ctl.lifecycleMu.Lock()
+	defer ctl.lifecycleMu.Unlock()
+	if ctl.state != controlStatePending || !ctl.activated {
+		return false, nil
+	}
+	if err := writeSuccess(); err != nil {
+		return false, err
+	}
+	if !ctl.startLocked() {
+		return false, nil
+	}
+	return true, nil
+}
+
+// Remove deletes and offlines ctl only if it is still the current generation.
+func (cm *ControlManager) Remove(ctl *Control) bool {
+	entry, ok := cm.lockCurrentRun(ctl.runID, true)
+	if !ok {
+		return false
+	}
+	defer entry.runMu.Unlock()
+	cm.mu.Lock()
+	defer cm.mu.Unlock()
+
+	if cm.ctlsByRunID[ctl.runID] != entry || entry.ctl != ctl || entry.id != ctl.controlID {
+		return false
+	}
+	delete(cm.ctlsByRunID, ctl.runID)
+	if entry.registryOnline {
+		cm.registry.MarkOfflineByRunIDAndControlID(ctl.runID, uint64(entry.registryControlID))
+	}
+	return true
 }
 
 func (cm *ControlManager) GetByID(runID string) (ctl *Control, ok bool) {
+	entry, ok := cm.lockCurrentRun(runID, false)
+	if !ok {
+		return nil, false
+	}
+	defer entry.runMu.Unlock()
+	ctl = entry.ctl
+
+	ctl.lifecycleMu.Lock()
+	defer ctl.lifecycleMu.Unlock()
+	if ctl.state != controlStateRunning {
+		return nil, false
+	}
+	return ctl, true
+}
+
+// admitVisitorByRunID commits a visitor admission against the current running
+// control while its run and lifecycle ownership are held. The callback must
+// only perform the in-memory, buffered visitor admission.
+func (cm *ControlManager) admitVisitorByRunID(runID string, admit func(user string) error) (bool, error) {
+	entry, ok := cm.lockCurrentRun(runID, false)
+	if !ok {
+		return false, nil
+	}
+	defer entry.runMu.Unlock()
+	ctl := entry.ctl
+
+	ctl.lifecycleMu.Lock()
+	defer ctl.lifecycleMu.Unlock()
+	if ctl.state != controlStateRunning {
+		return false, nil
+	}
+	return true, admit(ctl.sessionCtx.LoginMsg.User)
+}
+
+// RegisterWorkConn transfers conn to ctl only if ctl is still the current
+// running generation. On error, ownership remains with the caller.
+func (cm *ControlManager) RegisterWorkConn(ctl *Control, conn *proxy.WorkConn) error {
+	entry, ok := cm.lockCurrentRun(ctl.runID, false)
+	if !ok {
 		cm.mu.RLock()
-	defer cm.mu.RUnlock()
-	ctl, ok = cm.ctlsByRunID[runID]
-	return
+		closed := cm.closed
+		cm.mu.RUnlock()
+		if closed {
+			return fmt.Errorf("control manager is closed")
+		}
+		return fmt.Errorf("client control for run id [%s] is no longer current", ctl.runID)
+	}
+	defer entry.runMu.Unlock()
+	if entry.ctl != ctl || entry.id != ctl.controlID {
+		return fmt.Errorf("client control for run id [%s] is no longer current", ctl.runID)
+	}
+
+	ctl.lifecycleMu.Lock()
+	defer ctl.lifecycleMu.Unlock()
+	if ctl.state != controlStateRunning {
+		return fmt.Errorf("client control for run id [%s] is not running", ctl.runID)
+	}
+
+	select {
+	case ctl.workConnCh <- conn:
+		ctl.xl.Debugf("new work connection registered")
+		return nil
+	default:
+		ctl.xl.Debugf("work connection pool is full, discarding")
+		return fmt.Errorf("work connection pool is full, discarding")
+	}
 }
 
 func (cm *ControlManager) Close() error {
 	cm.mu.Lock()
-	defer cm.mu.Unlock()
-	for _, ctl := range cm.ctlsByRunID {
-		ctl.Close()
+	cm.closed = true
+	ctls := make([]*Control, 0, len(cm.ctlsByRunID))
+	for _, entry := range cm.ctlsByRunID {
+		ctls = append(ctls, entry.ctl)
+	}
+	cm.mu.Unlock()
+
+	for _, ctl := range ctls {
+		cm.Remove(ctl)
+		_ = ctl.Close()
 	}
-	cm.ctlsByRunID = make(map[string]*Control)
 	return nil
 }
 
@@ -110,10 +367,20 @@ type SessionContext struct {
 	LoginMsg *msg.Login
 	// server configuration
 	ServerCfg *v1.ServerConfig
-	// client registry
-	ClientRegistry *registry.ClientRegistry
+	// negotiated wire protocol for this client session
+	WireProtocol string
 }
 
+type controlState uint8
+
+const (
+	controlStateCreated controlState = iota
+	controlStatePending
+	controlStateRunning
+	controlStateClosing
+	controlStateClosed
+)
+
 type Control struct {
 	// session context
 	sessionCtx *SessionContext
@@ -140,16 +407,26 @@ type Control struct {
 	// last time got the Ping message
 	lastPing atomic.Value
 
-	// A new run id will be generated when a new client login.
-	// If run id got from login message has same run id, it means it's the same client, so we can
-	// replace old controller instantly.
+	// runID never changes during the lifetime of a control. controlID is assigned
+	// once by ControlManager and distinguishes same-runID generations.
 	runID     string
+	controlID ControlID
+	manager   *ControlManager
+
+	lifecycleMu    sync.Mutex
+	state          controlState
+	activated      bool
+	handoffBarrier <-chan struct{}
+
+	interruptOnce sync.Once
+	interruptErr  error
 
 	mu sync.RWMutex
 
 	xl            *xlog.Logger
 	ctx           context.Context
 	doneCh        chan struct{}
+	serverMetrics metrics.ServerMetrics
 }
 
 func NewControl(ctx context.Context, sessionCtx *SessionContext) (*Control, error) {
@@ -161,9 +438,11 @@ func NewControl(ctx context.Context, sessionCtx *SessionContext) (*Control, erro
 		poolCount:     poolCount,
 		portsUsedNum:  0,
 		runID:         sessionCtx.LoginMsg.RunID,
+		state:         controlStateCreated,
 		xl:            xlog.FromContextSafe(ctx),
 		ctx:           ctx,
 		doneCh:        make(chan struct{}),
+		serverMetrics: metrics.Server,
 	}
 	ctl.lastPing.Store(time.Now())
 
@@ -173,48 +452,121 @@ func NewControl(ctx context.Context, sessionCtx *SessionContext) (*Control, erro
 	return ctl, nil
 }
 
-// Start starts the control session workers after login succeeds.
-func (ctl *Control) Start() {
-	go func() {
-		for i := 0; i < ctl.poolCount; i++ {
-			// ignore error here, that means that this control is closed
-			_ = ctl.msgDispatcher.Send(&msg.ReqWorkConn{})
+func (ctl *Control) RunID() string {
+	return ctl.runID
+}
+
+func (ctl *Control) ID() ControlID {
+	ctl.lifecycleMu.Lock()
+	defer ctl.lifecycleMu.Unlock()
+	return ctl.controlID
+}
+
+func (ctl *Control) admit(manager *ControlManager, id ControlID) error {
+	ctl.lifecycleMu.Lock()
+	defer ctl.lifecycleMu.Unlock()
+	if ctl.state != controlStateCreated {
+		return fmt.Errorf("control [%s] is not in created state", ctl.runID)
 	}
-	}()
+	ctl.manager = manager
+	ctl.controlID = id
+	ctl.state = controlStatePending
+	return nil
+}
+
+func (ctl *Control) setHandoffBarrier(barrier <-chan struct{}) {
+	ctl.lifecycleMu.Lock()
+	ctl.handoffBarrier = barrier
+	ctl.lifecycleMu.Unlock()
+}
+
+func (ctl *Control) WaitForHandoff() {
+	ctl.lifecycleMu.Lock()
+	barrier := ctl.handoffBarrier
+	ctl.lifecycleMu.Unlock()
+	if barrier != nil {
+		<-barrier
+	}
+}
+
+// Start starts the control session workers after login succeeds.
+func (ctl *Control) Start() bool {
+	ctl.lifecycleMu.Lock()
+	defer ctl.lifecycleMu.Unlock()
+	return ctl.startLocked()
+}
+
+func (ctl *Control) startLocked() bool {
+	if ctl.state != controlStatePending || !ctl.activated {
+		return false
+	}
+	ctl.state = controlStateRunning
 	go ctl.worker()
+	return true
 }
 
 func (ctl *Control) Close() error {
-	ctl.sessionCtx.Conn.Close()
-	return nil
+	ctl.lifecycleMu.Lock()
+	switch ctl.state {
+	case controlStateCreated, controlStatePending:
+		ctl.state = controlStateClosing
+		ctl.finishLocked()
+	case controlStateRunning:
+		ctl.state = controlStateClosing
+	}
+	ctl.lifecycleMu.Unlock()
+	return ctl.interruptReadAndClose()
 }
 
 func (ctl *Control) Replaced(newCtl *Control) {
-	xl := ctl.xl
-	xl.Infof("replaced by client [%s]", newCtl.runID)
-	ctl.runID = ""
-	ctl.sessionCtx.Conn.Close()
+	ctl.markReplaced()
+	ctl.xl.Infof("replaced by client [%s] (control ID %d)", newCtl.runID, newCtl.ID())
+	_ = ctl.interruptReadAndClose()
 }
 
-func (ctl *Control) RegisterWorkConn(conn *proxy.WorkConn) error {
-	xl := ctl.xl
-	defer func() {
-		if err := recover(); err != nil {
-			xl.Errorf("panic error: %v", err)
-			xl.Errorf(string(debug.Stack()))
-		}
-	}()
+// markReplaced returns the transitive predecessor barrier. A pending control
+// has no worker, so it finishes immediately and passes its inherited barrier
+// to the replacement. A running control is finished only by its worker.
+func (ctl *Control) markReplaced() <-chan struct{} {
+	ctl.lifecycleMu.Lock()
+	defer ctl.lifecycleMu.Unlock()
 
-	select {
-	case ctl.workConnCh <- conn:
-		xl.Debugf("new work connection registered")
+	switch ctl.state {
+	case controlStateCreated:
+		ctl.state = controlStateClosing
+		ctl.finishLocked()
 		return nil
+	case controlStatePending:
+		barrier := ctl.handoffBarrier
+		ctl.state = controlStateClosing
+		ctl.finishLocked()
+		return barrier
+	case controlStateRunning:
+		ctl.state = controlStateClosing
+		return ctl.doneCh
+	case controlStateClosing, controlStateClosed:
+		return ctl.doneCh
 	default:
-		xl.Debugf("work connection pool is full, discarding")
-		return fmt.Errorf("work connection pool is full, discarding")
+		return ctl.doneCh
 	}
 }
 
+func (ctl *Control) interruptReadAndClose() error {
+	ctl.interruptOnce.Do(func() {
+		_ = ctl.sessionCtx.Conn.SetReadDeadline(time.Now())
+		ctl.interruptErr = ctl.sessionCtx.Conn.Close()
+	})
+	return ctl.interruptErr
+}
+
+func (ctl *Control) finishLocked() {
+	if ctl.state == controlStateClosed {
+		return
+	}
+	ctl.state = controlStateClosed
+	close(ctl.doneCh)
+}
+
 // When frps get one user connection, we get one work connection from the pool and return it.
 // If no workConn available in the pool, send message to frpc to get one or more
 // and wait until it is available.
@@ -269,10 +621,10 @@ func (ctl *Control) heartbeatWorker() {
 	}
 
 	xl := ctl.xl
-	go wait.Until(func() {
+	wait.Until(func() {
 		if time.Since(ctl.lastPing.Load().(time.Time)) > time.Duration(ctl.sessionCtx.ServerCfg.Transport.HeartbeatTimeout)*time.Second {
 			xl.Warnf("heartbeat timeout")
-			ctl.sessionCtx.Conn.Close()
+			_ = ctl.Close()
 			return
 		}
 	}, time.Second, ctl.doneCh)
@@ -287,14 +639,14 @@ func (ctl *Control) loginUserInfo() plugin.UserInfo {
 	return plugin.UserInfo{
 		User:  ctl.sessionCtx.LoginMsg.User,
 		Metas: ctl.sessionCtx.LoginMsg.Metas,
-		RunID: ctl.sessionCtx.LoginMsg.RunID,
+		RunID: ctl.runID,
 	}
 }
 
 func (ctl *Control) closeProxy(pxy proxy.Proxy) {
 	pxy.Close()
 	ctl.sessionCtx.PxyManager.Del(pxy.GetName())
-	metrics.Server.CloseProxy(pxy.GetName(), pxy.GetConfigurer().GetBaseConfig().Type)
+	ctl.serverMetrics.CloseProxy(pxy.GetName(), pxy.GetConfigurer().GetBaseConfig().Type)
 
 	notifyContent := &plugin.CloseProxyContent{
 		User: ctl.loginUserInfo(),
@@ -309,12 +661,24 @@ func (ctl *Control) closeProxy(pxy proxy.Proxy) {
 
 func (ctl *Control) worker() {
 	xl := ctl.xl
+	ctl.serverMetrics.NewClient()
 
 	go ctl.heartbeatWorker()
 	go ctl.msgDispatcher.Run()
+	go func() {
+		for i := 0; i < ctl.poolCount; i++ {
+			// Ignore the error: it means this control is already closing.
+			_ = ctl.msgDispatcher.Send(&msg.ReqWorkConn{})
+		}
+	}()
 
 	<-ctl.msgDispatcher.Done()
-	ctl.sessionCtx.Conn.Close()
+	ctl.lifecycleMu.Lock()
+	if ctl.state == controlStateRunning {
+		ctl.state = controlStateClosing
+	}
+	ctl.lifecycleMu.Unlock()
+	_ = ctl.interruptReadAndClose()
 
 	ctl.mu.Lock()
 	close(ctl.workConnCh)
@@ -329,10 +693,14 @@ func (ctl *Control) worker() {
 		ctl.closeProxy(pxy)
 	}
 
-	metrics.Server.CloseClient()
-	ctl.sessionCtx.ClientRegistry.MarkOfflineByRunID(ctl.runID)
+	ctl.serverMetrics.CloseClient()
+	if ctl.manager != nil {
+		ctl.manager.Remove(ctl)
+	}
 	xl.Infof("client exit success")
-	close(ctl.doneCh)
+	ctl.lifecycleMu.Lock()
+	ctl.finishLocked()
+	ctl.lifecycleMu.Unlock()
 }
 
 func (ctl *Control) registerMsgHandlers() {
@@ -372,9 +740,9 @@ func (ctl *Control) handleNewProxy(m msg.Message) {
 		xl.Infof("new proxy [%s] type [%s] success", inMsg.ProxyName, inMsg.ProxyType)
 		clientID := ctl.sessionCtx.LoginMsg.ClientID
 		if clientID == "" {
-			clientID = ctl.sessionCtx.LoginMsg.RunID
+			clientID = ctl.runID
 		}
-		metrics.Server.NewProxy(inMsg.ProxyName, inMsg.ProxyType, ctl.sessionCtx.LoginMsg.User, clientID)
+		ctl.serverMetrics.NewProxy(inMsg.ProxyName, inMsg.ProxyType, ctl.sessionCtx.LoginMsg.User, clientID)
 	}
 	_ = ctl.msgDispatcher.Send(resp)
 }
@@ -452,6 +820,7 @@ func (ctl *Control) RegisterProxy(pxyMsg *msg.NewProxy) (remoteAddr string, err
 		Configurer:         pxyConf,
 		ServerCfg:          ctl.sessionCtx.ServerCfg,
 		EncryptionKey:      ctl.sessionCtx.EncryptionKey,
+		WireProtocol:       ctl.sessionCtx.WireProtocol,
 	})
 	if err != nil {
 		return remoteAddr, err

server/control_test.go

@@ -0,0 +1,543 @@
+// Copyright 2026 The frp Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package server
+
+import (
+	"context"
+	"errors"
+	"net"
+	"os"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/fatedier/frp/pkg/auth"
+	v1 "github.com/fatedier/frp/pkg/config/v1"
+	"github.com/fatedier/frp/pkg/msg"
+	plugin "github.com/fatedier/frp/pkg/plugin/server"
+	"github.com/fatedier/frp/server/controller"
+	"github.com/fatedier/frp/server/proxy"
+	"github.com/fatedier/frp/server/registry"
+)
+
+func TestControlPendingReplacementFinishesWithoutStarting(t *testing.T) {
+	clientRegistry := registry.NewClientRegistry()
+	manager := NewControlManager(clientRegistry)
+	metrics := newCountingServerMetrics()
+	oldCtl, oldConn := newLifecycleTestControl(t, "same-run", "client", metrics)
+	newCtl, _ := newLifecycleTestControl(t, "same-run", "client", metrics)
+
+	mustAddAndActivate(t, manager, oldCtl)
+
+	err := manager.Add(newCtl)
+	require.NoError(t, err)
+	waitForControlDone(t, oldCtl)
+	require.False(t, oldCtl.Start())
+	require.Equal(t, []string{"deadline", "close"}, oldConn.eventsSnapshot())
+	require.Equal(t, int64(0), metrics.newClients())
+	require.Equal(t, int64(0), metrics.closedClients())
+}
+
+func TestControlRunningReplacementFinishesInWorker(t *testing.T) {
+	clientRegistry := registry.NewClientRegistry()
+	manager := NewControlManager(clientRegistry)
+	metrics := newCountingServerMetrics()
+	oldCtl, oldConn := newLifecycleTestControl(t, "same-run", "client", metrics)
+	newCtl, _ := newLifecycleTestControl(t, "same-run", "client", metrics)
+
+	mustAddAndActivate(t, manager, oldCtl)
+	require.True(t, oldCtl.Start())
+	waitForSignal(t, oldConn.readStarted, "control reader to start")
+
+	err := manager.Add(newCtl)
+	require.NoError(t, err)
+	waitForControlDone(t, oldCtl)
+	require.Equal(t, []string{"deadline", "close"}, oldConn.eventsSnapshot())
+	require.Equal(t, int64(1), metrics.newClients())
+	require.Equal(t, int64(1), metrics.closedClients())
+
+	_, ok := manager.GetByID("same-run")
+	require.False(t, ok)
+	require.Same(t, newCtl, currentControlForTest(manager, "same-run"))
+	info, ok := clientRegistry.GetByKey("client")
+	require.True(t, ok)
+	require.True(t, info.Online)
+	require.Equal(t, uint64(oldCtl.ID()), info.ControlID)
+
+	active, err := manager.Activate(newCtl)
+	require.NoError(t, err)
+	require.True(t, active)
+	_, ok = manager.GetByID("same-run")
+	require.False(t, ok)
+	info, ok = clientRegistry.GetByKey("client")
+	require.True(t, ok)
+	require.Equal(t, uint64(newCtl.ID()), info.ControlID)
+}
+
+func TestControlClosePendingAndRunning(t *testing.T) {
+	t.Run("pending", func(t *testing.T) {
+		manager := NewControlManager(registry.NewClientRegistry())
+		metrics := newCountingServerMetrics()
+		ctl, conn := newLifecycleTestControl(t, "pending", "pending", metrics)
+		err := manager.Add(ctl)
+		require.NoError(t, err)
+
+		require.NoError(t, ctl.Close())
+		waitForControlDone(t, ctl)
+		require.Equal(t, []string{"deadline", "close"}, conn.eventsSnapshot())
+		require.Equal(t, int64(0), metrics.newClients())
+		require.Equal(t, int64(0), metrics.closedClients())
+	})
+
+	t.Run("running", func(t *testing.T) {
+		manager := NewControlManager(registry.NewClientRegistry())
+		metrics := newCountingServerMetrics()
+		ctl, conn := newLifecycleTestControl(t, "running", "running", metrics)
+		mustAddAndActivate(t, manager, ctl)
+		require.True(t, ctl.Start())
+		waitForSignal(t, conn.readStarted, "control reader to start")
+
+		require.NoError(t, ctl.Close())
+		waitForControlDone(t, ctl)
+		require.Equal(t, []string{"deadline", "close"}, conn.eventsSnapshot())
+		require.Equal(t, int64(1), metrics.newClients())
+		require.Equal(t, int64(1), metrics.closedClients())
+	})
+}
+
+func TestControlCloseAndReplacedAreIdempotent(t *testing.T) {
+	manager := NewControlManager(registry.NewClientRegistry())
+	metrics := newCountingServerMetrics()
+	ctl, conn := newLifecycleTestControl(t, "same-run", "client", metrics)
+	replacement, _ := newLifecycleTestControl(t, "same-run", "client", metrics)
+
+	err := manager.Add(ctl)
+	require.NoError(t, err)
+	err = manager.Add(replacement)
+	require.NoError(t, err)
+	require.NoError(t, ctl.Close())
+	ctl.Replaced(replacement)
+	require.NoError(t, ctl.Close())
+	waitForControlDone(t, ctl)
+
+	require.Equal(t, []string{"deadline", "close"}, conn.eventsSnapshot())
+	require.Equal(t, int64(0), metrics.newClients())
+	require.Equal(t, int64(0), metrics.closedClients())
+}
+
+func TestControlHeartbeatTimeoutInterruptsRead(t *testing.T) {
+	manager := NewControlManager(registry.NewClientRegistry())
+	metrics := newCountingServerMetrics()
+	ctl, conn := newLifecycleTestControl(t, "heartbeat", "heartbeat", metrics)
+	ctl.sessionCtx.ServerCfg.Transport.HeartbeatTimeout = 1
+	ctl.lastPing.Store(time.Now().Add(-2 * time.Second))
+
+	mustAddAndActivate(t, manager, ctl)
+	require.True(t, ctl.Start())
+	waitForSignal(t, conn.readStarted, "control reader to start")
+	waitForControlDone(t, ctl)
+
+	require.Equal(t, []string{"deadline", "close"}, conn.eventsSnapshot())
+	require.Equal(t, int64(1), metrics.newClients())
+	require.Equal(t, int64(1), metrics.closedClients())
+}
+
+func TestControlStartReplacementRacePairsMetrics(t *testing.T) {
+	for range 100 {
+		clientRegistry := registry.NewClientRegistry()
+		manager := NewControlManager(clientRegistry)
+		metrics := newCountingServerMetrics()
+		ctl, _ := newLifecycleTestControl(t, "same-run", "client", metrics)
+		replacement, _ := newLifecycleTestControl(t, "same-run", "client", metrics)
+
+		mustAddAndActivate(t, manager, ctl)
+
+		startGate := make(chan struct{})
+		startedCh := make(chan bool, 1)
+		addErrCh := make(chan error, 1)
+		go func() {
+			<-startGate
+			startedCh <- ctl.Start()
+		}()
+		go func() {
+			<-startGate
+			addErr := manager.Add(replacement)
+			addErrCh <- addErr
+		}()
+		close(startGate)
+
+		started := <-startedCh
+		require.NoError(t, <-addErrCh)
+		waitForControlDone(t, ctl)
+		if started {
+			require.Equal(t, int64(1), metrics.newClients())
+			require.Equal(t, int64(1), metrics.closedClients())
+		} else {
+			require.Equal(t, int64(0), metrics.newClients())
+			require.Equal(t, int64(0), metrics.closedClients())
+		}
+	}
+}
+
+func TestControlManagerRejectsStaleActivateAndRemove(t *testing.T) {
+	clientRegistry := registry.NewClientRegistry()
+	manager := NewControlManager(clientRegistry)
+	metrics := newCountingServerMetrics()
+	oldCtl, _ := newLifecycleTestControl(t, "same-run", "client", metrics)
+	newCtl, _ := newLifecycleTestControl(t, "same-run", "client", metrics)
+
+	mustAddAndActivate(t, manager, oldCtl)
+	err := manager.Add(newCtl)
+	require.NoError(t, err)
+	require.Greater(t, uint64(newCtl.ID()), uint64(oldCtl.ID()))
+
+	active, err := manager.Activate(oldCtl)
+	require.NoError(t, err)
+	require.False(t, active)
+	require.False(t, manager.Remove(oldCtl))
+
+	_, ok := manager.GetByID("same-run")
+	require.False(t, ok)
+	require.Same(t, newCtl, currentControlForTest(manager, "same-run"))
+	info, ok := clientRegistry.GetByKey("client")
+	require.True(t, ok)
+	require.True(t, info.Online)
+	require.Equal(t, uint64(oldCtl.ID()), info.ControlID)
+
+	active, err = manager.Activate(newCtl)
+	require.NoError(t, err)
+	require.True(t, active)
+	info, ok = clientRegistry.GetByKey("client")
+	require.True(t, ok)
+	require.True(t, info.Online)
+	require.Equal(t, uint64(newCtl.ID()), info.ControlID)
+}
+
+func TestControlManagerPreservesClientIDConflict(t *testing.T) {
+	clientRegistry := registry.NewClientRegistry()
+	manager := NewControlManager(clientRegistry)
+	metrics := newCountingServerMetrics()
+	first, _ := newLifecycleTestControl(t, "run-one", "shared-client", metrics)
+	conflicting, _ := newLifecycleTestControl(t, "run-two", "shared-client", metrics)
+
+	mustAddAndActivate(t, manager, first)
+	err := manager.Add(conflicting)
+	require.NoError(t, err)
+	active, err := manager.Activate(conflicting)
+	require.True(t, active)
+	require.ErrorContains(t, err, "already online")
+
+	require.True(t, manager.Remove(conflicting))
+	info, ok := clientRegistry.GetByKey("shared-client")
+	require.True(t, ok)
+	require.True(t, info.Online)
+	require.Equal(t, "run-one", info.RunID)
+}
+
+func TestControlManagerFailedLoginWriteReleasesRunWithoutStarting(t *testing.T) {
+	clientRegistry := registry.NewClientRegistry()
+	manager := NewControlManager(clientRegistry)
+	metrics := newCountingServerMetrics()
+	ctl, _ := newLifecycleTestControl(t, "same-run", "client", metrics)
+	replacement, _ := newLifecycleTestControl(t, "same-run", "client", metrics)
+
+	mustAddAndActivate(t, manager, ctl)
+
+	writeErr := errors.New("write failed")
+	committed, err := manager.completeLogin(ctl, func() error { return writeErr })
+	require.ErrorIs(t, err, writeErr)
+	require.False(t, committed)
+
+	err = manager.Add(replacement)
+	require.NoError(t, err)
+	waitForControlDone(t, ctl)
+	require.Same(t, replacement, currentControlForTest(manager, "same-run"))
+	require.Equal(t, int64(0), metrics.newClients())
+	require.Equal(t, int64(0), metrics.closedClients())
+	require.True(t, manager.Remove(replacement))
+	info, ok := clientRegistry.GetByKey("client")
+	require.True(t, ok)
+	require.False(t, info.Online)
+	require.Empty(t, info.RunID)
+	require.Zero(t, info.ControlID)
+	require.False(t, info.DisconnectedAt.IsZero())
+	require.NoError(t, replacement.Close())
+}
+
+func TestControlManagerCloseWaitsForInFlightLoginRun(t *testing.T) {
+	clientRegistry := registry.NewClientRegistry()
+	manager := NewControlManager(clientRegistry)
+	metrics := newCountingServerMetrics()
+	ctl, _ := newLifecycleTestControl(t, "same-run", "client", metrics)
+
+	mustAddAndActivate(t, manager, ctl)
+
+	writeEntered := make(chan struct{})
+	resumeWrite := make(chan struct{})
+	loginDone := make(chan struct {
+		committed bool
+		err       error
+	}, 1)
+	go func() {
+		committed, loginErr := manager.completeLogin(ctl, func() error {
+			close(writeEntered)
+			<-resumeWrite
+			return nil
+		})
+		loginDone <- struct {
+			committed bool
+			err       error
+		}{committed: committed, err: loginErr}
+	}()
+	waitForSignal(t, writeEntered, "LoginResp write")
+
+	closeDone := make(chan error, 1)
+	go func() { closeDone <- manager.Close() }()
+	waitForManagerClosed(t, manager)
+	select {
+	case err := <-closeDone:
+		t.Fatalf("manager close completed during LoginResp write: %v", err)
+	default:
+	}
+
+	close(resumeWrite)
+	result := <-loginDone
+	require.NoError(t, result.err)
+	require.True(t, result.committed)
+	require.NoError(t, <-closeDone)
+	waitForControlDone(t, ctl)
+	require.Nil(t, currentControlForTest(manager, "same-run"))
+	require.Equal(t, int64(1), metrics.newClients())
+	require.Equal(t, int64(1), metrics.closedClients())
+	info, ok := clientRegistry.GetByKey("client")
+	require.True(t, ok)
+	require.False(t, info.Online)
+}
+
+func newLifecycleTestControl(
+	t *testing.T,
+	runID string,
+	clientID string,
+	serverMetrics *countingServerMetrics,
+) (*Control, *deadlineReadConn) {
+	t.Helper()
+	conn := newDeadlineReadConn()
+	msgConn := msg.NewConn(conn, msg.NewV1ReadWriter(conn))
+	ctl, err := NewControl(context.Background(), &SessionContext{
+		RC:            &controller.ResourceController{},
+		PxyManager:    proxy.NewManager(),
+		PluginManager: plugin.NewManager(),
+		AuthVerifier:  auth.AlwaysPassVerifier,
+		Conn:          msgConn,
+		LoginMsg: &msg.Login{
+			RunID:    runID,
+			ClientID: clientID,
+		},
+		ServerCfg: &v1.ServerConfig{},
+	})
+	require.NoError(t, err)
+	ctl.serverMetrics = serverMetrics
+	t.Cleanup(func() { _ = ctl.Close() })
+	return ctl, conn
+}
+
+func mustAddAndActivate(t *testing.T, manager *ControlManager, ctl *Control) {
+	t.Helper()
+	require.NoError(t, manager.Add(ctl))
+	active, err := manager.Activate(ctl)
+	require.NoError(t, err)
+	require.True(t, active)
+}
+
+func waitForControlDone(t *testing.T, ctl *Control) {
+	t.Helper()
+	done := make(chan struct{})
+	go func() {
+		ctl.WaitClosed()
+		close(done)
+	}()
+	waitForSignal(t, done, "control to finish")
+}
+
+func currentControlForTest(manager *ControlManager, runID string) *Control {
+	manager.mu.RLock()
+	defer manager.mu.RUnlock()
+	entry := manager.ctlsByRunID[runID]
+	if entry == nil {
+		return nil
+	}
+	return entry.ctl
+}
+
+func currentRunGateForTest(manager *ControlManager, runID string) *sync.Mutex {
+	manager.mu.RLock()
+	defer manager.mu.RUnlock()
+	entry := manager.ctlsByRunID[runID]
+	if entry == nil {
+		return nil
+	}
+	return entry.runMu
+}
+
+func waitForManagerClosed(t *testing.T, manager *ControlManager) {
+	t.Helper()
+	deadline := time.Now().Add(3 * time.Second)
+	for time.Now().Before(deadline) {
+		manager.mu.RLock()
+		closed := manager.closed
+		manager.mu.RUnlock()
+		if closed {
+			return
+		}
+	}
+	t.Fatal("timed out waiting for control manager to close")
+}
+
+func waitForSignal(t *testing.T, ch <-chan struct{}, description string) {
+	t.Helper()
+	select {
+	case <-ch:
+	case <-time.After(3 * time.Second):
+		t.Fatalf("timed out waiting for %s", description)
+	}
+}
+
+type deadlineReadConn struct {
+	readStarted chan struct{}
+	unblockRead chan struct{}
+
+	readOnce     sync.Once
+	unblockOnce  sync.Once
+	deadlineOnce sync.Once
+	closeOnce    sync.Once
+
+	eventsMu sync.Mutex
+	events   []string
+}
+
+func newDeadlineReadConn() *deadlineReadConn {
+	return &deadlineReadConn{
+		readStarted: make(chan struct{}),
+		unblockRead: make(chan struct{}),
+	}
+}
+
+func (c *deadlineReadConn) Read([]byte) (int, error) {
+	c.readOnce.Do(func() { close(c.readStarted) })
+	<-c.unblockRead
+	return 0, os.ErrDeadlineExceeded
+}
+
+func (*deadlineReadConn) Write(p []byte) (int, error) { return len(p), nil }
+
+func (c *deadlineReadConn) Close() error {
+	c.closeOnce.Do(func() {
+		c.recordEvent("close")
+		c.unblockOnce.Do(func() { close(c.unblockRead) })
+	})
+	return nil
+}
+
+func (*deadlineReadConn) LocalAddr() net.Addr  { return lifecycleTestAddr("local") }
+func (*deadlineReadConn) RemoteAddr() net.Addr { return lifecycleTestAddr("remote") }
+
+func (c *deadlineReadConn) SetDeadline(deadline time.Time) error {
+	if err := c.SetReadDeadline(deadline); err != nil {
+		return err
+	}
+	return c.SetWriteDeadline(deadline)
+}
+
+func (c *deadlineReadConn) SetReadDeadline(deadline time.Time) error {
+	if deadline.IsZero() {
+		return nil
+	}
+	c.deadlineOnce.Do(func() {
+		c.recordEvent("deadline")
+		c.unblockOnce.Do(func() { close(c.unblockRead) })
+	})
+	return nil
+}
+
+func (*deadlineReadConn) SetWriteDeadline(time.Time) error { return nil }
+
+func (c *deadlineReadConn) recordEvent(event string) {
+	c.eventsMu.Lock()
+	c.events = append(c.events, event)
+	c.eventsMu.Unlock()
+}
+
+func (c *deadlineReadConn) eventsSnapshot() []string {
+	c.eventsMu.Lock()
+	defer c.eventsMu.Unlock()
+	return append([]string(nil), c.events...)
+}
+
+type lifecycleTestAddr string
+
+func (a lifecycleTestAddr) Network() string { return string(a) }
+func (a lifecycleTestAddr) String() string  { return string(a) }
+
+type countingServerMetrics struct {
+	mu          sync.Mutex
+	newCount    int64
+	closeCount  int64
+	closeEnter  chan struct{}
+	closeResume chan struct{}
+	closeOnce   sync.Once
+}
+
+func newCountingServerMetrics() *countingServerMetrics {
+	return &countingServerMetrics{}
+}
+
+func (m *countingServerMetrics) NewClient() {
+	m.mu.Lock()
+	m.newCount++
+	m.mu.Unlock()
+}
+
+func (m *countingServerMetrics) CloseClient() {
+	m.mu.Lock()
+	m.closeCount++
+	closeEnter := m.closeEnter
+	closeResume := m.closeResume
+	m.mu.Unlock()
+	if closeEnter != nil {
+		m.closeOnce.Do(func() { close(closeEnter) })
+		<-closeResume
+	}
+}
+
+func (*countingServerMetrics) NewProxy(string, string, string, string) {}
+func (*countingServerMetrics) CloseProxy(string, string)               {}
+func (*countingServerMetrics) OpenConnection(string, string)           {}
+func (*countingServerMetrics) CloseConnection(string, string)          {}
+func (*countingServerMetrics) AddTrafficIn(string, string, int64)      {}
+func (*countingServerMetrics) AddTrafficOut(string, string, int64)     {}
+
+func (m *countingServerMetrics) newClients() int64 {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	return m.newCount
+}
+
+func (m *countingServerMetrics) closedClients() int64 {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	return m.closeCount
+}

server/http/controller.go

@@ -58,8 +58,12 @@ func NewController(
 
 // /api/serverinfo
 func (c *Controller) APIServerInfo(ctx *httppkg.Context) (any, error) {
+	return c.buildServerInfoResp(), nil
+}
+
+func (c *Controller) buildServerInfoResp() model.ServerInfoResp {
 	serverStats := mem.StatsCollector.GetServer()
-	svrResp := model.ServerInfoResp{
+	return model.ServerInfoResp{
 		Version:               version.Full(),
 		BindPort:              c.serverCfg.BindPort,
 		VhostHTTPPort:         c.serverCfg.VhostHTTPPort,
@@ -80,8 +84,6 @@ func (c *Controller) APIServerInfo(ctx *httppkg.Context) (any, error) {
 		ClientCounts:    serverStats.ClientCounts,
 		ProxyTypeCounts: serverStats.ProxyTypeCounts,
 	}
-
-	return svrResp, nil
 }
 
 // /api/clients

server/http/controller_v2.go

@@ -0,0 +1,647 @@
+// Copyright 2026 The frp Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package http
+
+import (
+	"cmp"
+	"fmt"
+	"maps"
+	"math"
+	"net/http"
+	"net/url"
+	"slices"
+	"strconv"
+	"strings"
+	"time"
+
+	v1 "github.com/fatedier/frp/pkg/config/v1"
+	"github.com/fatedier/frp/pkg/metrics/mem"
+	httppkg "github.com/fatedier/frp/pkg/util/http"
+	"github.com/fatedier/frp/server/http/model"
+	"github.com/fatedier/frp/server/registry"
+)
+
+const (
+	defaultV2Page     = 1
+	defaultV2PageSize = 50
+	maxV2PageSize     = 200
+
+	v2SystemPruneTypeOfflineProxies = "offline_proxies"
+	v2ProxyTrafficDefaultDays       = 7
+	v2ProxyTrafficUnit              = "bytes"
+	v2ProxyTrafficGranularity       = "day"
+)
+
+var apiV2ProxyTypes = []string{
+	string(v1.ProxyTypeTCP),
+	string(v1.ProxyTypeUDP),
+	string(v1.ProxyTypeHTTP),
+	string(v1.ProxyTypeHTTPS),
+	string(v1.ProxyTypeTCPMUX),
+	string(v1.ProxyTypeSTCP),
+	string(v1.ProxyTypeXTCP),
+	string(v1.ProxyTypeSUDP),
+}
+
+// /api/v2/system/info
+func (c *Controller) APIV2SystemInfo(ctx *httppkg.Context) (any, error) {
+	info := c.buildServerInfoResp()
+	proxyTypeCounts := info.ProxyTypeCounts
+	if proxyTypeCounts == nil {
+		proxyTypeCounts = map[string]int64{}
+	}
+
+	return model.V2SystemInfoResp{
+		Version: info.Version,
+		Config: model.V2SystemInfoConfigResp{
+			BindPort:              info.BindPort,
+			VhostHTTPPort:         info.VhostHTTPPort,
+			VhostHTTPSPort:        info.VhostHTTPSPort,
+			TCPMuxHTTPConnectPort: info.TCPMuxHTTPConnectPort,
+			KCPBindPort:           info.KCPBindPort,
+			QUICBindPort:          info.QUICBindPort,
+			SubdomainHost:         info.SubdomainHost,
+			MaxPoolCount:          info.MaxPoolCount,
+			MaxPortsPerClient:     info.MaxPortsPerClient,
+			HeartbeatTimeout:      info.HeartBeatTimeout,
+			AllowPortsStr:         info.AllowPortsStr,
+			TLSForce:              info.TLSForce,
+		},
+		Status: model.V2SystemInfoStatusResp{
+			TotalTrafficIn:  info.TotalTrafficIn,
+			TotalTrafficOut: info.TotalTrafficOut,
+			CurConns:        info.CurConns,
+			ClientCounts:    info.ClientCounts,
+			ProxyTypeCounts: proxyTypeCounts,
+		},
+	}, nil
+}
+
+// /api/v2/system/prune
+func (c *Controller) APIV2SystemPrune(ctx *httppkg.Context) (any, error) {
+	pruneType, err := parseV2SystemPruneType(ctx.Query("type"))
+	if err != nil {
+		return nil, err
+	}
+
+	cleared, total := mem.StatsCollector.PruneOfflineProxies()
+	return model.V2SystemPruneResp{
+		Type:    pruneType,
+		Cleared: cleared,
+		Total:   total,
+	}, nil
+}
+
+// /api/v2/users
+func (c *Controller) APIV2UserList(ctx *httppkg.Context) (any, error) {
+	page, pageSize, err := parseV2PageParams(ctx)
+	if err != nil {
+		return nil, err
+	}
+	if c.clientRegistry == nil {
+		return nil, fmt.Errorf("client registry unavailable")
+	}
+
+	userStats := make(map[string]*model.V2UserResp)
+	for _, info := range c.clientRegistry.List() {
+		item := getOrCreateV2User(userStats, info.User)
+		item.ClientCount++
+	}
+	for _, proxyInfo := range c.listV2ProxyStats("") {
+		item := getOrCreateV2User(userStats, proxyInfo.User)
+		item.ProxyCount++
+	}
+
+	q := strings.ToLower(ctx.Query("q"))
+	items := make([]model.V2UserResp, 0, len(userStats))
+	for _, item := range userStats {
+		if q != "" && !strings.Contains(strings.ToLower(item.User), q) {
+			continue
+		}
+		items = append(items, *item)
+	}
+	slices.SortFunc(items, func(a, b model.V2UserResp) int {
+		return cmp.Compare(a.User, b.User)
+	})
+
+	return buildV2PageResp(items, page, pageSize), nil
+}
+
+// /api/v2/clients
+func (c *Controller) APIV2ClientList(ctx *httppkg.Context) (any, error) {
+	page, pageSize, err := parseV2PageParams(ctx)
+	if err != nil {
+		return nil, err
+	}
+	if c.clientRegistry == nil {
+		return nil, fmt.Errorf("client registry unavailable")
+	}
+	statusFilter, err := parseV2StatusFilter(ctx.Query("status"))
+	if err != nil {
+		return nil, err
+	}
+
+	userFilter, filterByUser := queryValue(ctx, "user")
+	clientIDFilter := ctx.Query("clientID")
+	runIDFilter := ctx.Query("runID")
+	q := strings.ToLower(ctx.Query("q"))
+
+	records := c.clientRegistry.List()
+	items := make([]model.ClientInfoResp, 0, len(records))
+	for _, info := range records {
+		if filterByUser && info.User != userFilter {
+			continue
+		}
+		if clientIDFilter != "" && info.ClientID() != clientIDFilter {
+			continue
+		}
+		if runIDFilter != "" && info.RunID != runIDFilter {
+			continue
+		}
+		if !matchV2StatusFilter(info.Online, statusFilter) {
+			continue
+		}
+		resp := buildClientInfoResp(info)
+		if q != "" && !matchV2ClientQuery(resp, q) {
+			continue
+		}
+		items = append(items, resp)
+	}
+
+	slices.SortFunc(items, func(a, b model.ClientInfoResp) int {
+		if v := cmp.Compare(a.User, b.User); v != 0 {
+			return v
+		}
+		if v := cmp.Compare(a.ClientID, b.ClientID); v != 0 {
+			return v
+		}
+		return cmp.Compare(a.Key, b.Key)
+	})
+
+	return buildV2PageResp(items, page, pageSize), nil
+}
+
+// /api/v2/clients/{key}
+func (c *Controller) APIV2ClientDetail(ctx *httppkg.Context) (any, error) {
+	key, err := decodeV2PathParam(ctx, "key", "client key")
+	if err != nil {
+		return nil, err
+	}
+
+	if c.clientRegistry == nil {
+		return nil, fmt.Errorf("client registry unavailable")
+	}
+
+	info, ok := c.clientRegistry.GetByKey(key)
+	if !ok {
+		return nil, httppkg.NewError(http.StatusNotFound, fmt.Sprintf("client %s not found", key))
+	}
+
+	resp := buildClientInfoResp(info)
+	status := c.buildV2ClientStatus(info)
+	return model.V2ClientDetailResp{
+		ClientInfoResp: resp,
+		Status:         status,
+	}, nil
+}
+
+// /api/v2/proxies
+func (c *Controller) APIV2ProxyList(ctx *httppkg.Context) (any, error) {
+	page, pageSize, err := parseV2PageParams(ctx)
+	if err != nil {
+		return nil, err
+	}
+	statusFilter, err := parseV2StatusFilter(ctx.Query("status"))
+	if err != nil {
+		return nil, err
+	}
+
+	proxyType, err := parseV2ProxyTypeFilter(ctx.Query("type"))
+	if err != nil {
+		return nil, err
+	}
+	userFilter, filterByUser := queryValue(ctx, "user")
+	clientIDFilter := ctx.Query("clientID")
+	q := strings.ToLower(ctx.Query("q"))
+
+	stats := c.listV2ProxyStats(proxyType)
+	items := make([]model.V2ProxyResp, 0, len(stats))
+	for _, ps := range stats {
+		resp := c.buildV2ProxyResp(ps)
+		if filterByUser && resp.User != userFilter {
+			continue
+		}
+		if clientIDFilter != "" && resp.ClientID != clientIDFilter {
+			continue
+		}
+		if !matchV2StatusFilter(resp.Status.State == "online", statusFilter) {
+			continue
+		}
+		if q != "" && !matchV2ProxyQuery(resp, q) {
+			continue
+		}
+		items = append(items, resp)
+	}
+
+	slices.SortFunc(items, func(a, b model.V2ProxyResp) int {
+		if v := cmp.Compare(a.Spec.Type, b.Spec.Type); v != 0 {
+			return v
+		}
+		return cmp.Compare(a.Name, b.Name)
+	})
+
+	return buildV2PageResp(items, page, pageSize), nil
+}
+
+// /api/v2/proxies/{name}
+func (c *Controller) APIV2ProxyDetail(ctx *httppkg.Context) (any, error) {
+	name, err := decodeV2PathParam(ctx, "name", "proxy name")
+	if err != nil {
+		return nil, err
+	}
+
+	ps := mem.StatsCollector.GetProxyByName(name)
+	if ps == nil {
+		return nil, httppkg.NewError(http.StatusNotFound, "no proxy info found")
+	}
+	return c.buildV2ProxyResp(ps), nil
+}
+
+// /api/v2/proxies/{name}/traffic
+func (c *Controller) APIV2ProxyTraffic(ctx *httppkg.Context) (any, error) {
+	name, err := decodeV2PathParam(ctx, "name", "proxy name")
+	if err != nil {
+		return nil, err
+	}
+
+	proxyTrafficInfo := mem.StatsCollector.GetProxyTraffic(name)
+	if proxyTrafficInfo == nil {
+		return nil, httppkg.NewError(http.StatusNotFound, "no proxy info found")
+	}
+
+	return buildV2ProxyTrafficResp(name, proxyTrafficInfo, time.Now()), nil
+}
+
+func decodeV2PathParam(ctx *httppkg.Context, key string, label string) (string, error) {
+	raw := ctx.Param(key)
+	if raw == "" {
+		return "", fmt.Errorf("missing %s", label)
+	}
+	decoded, err := url.PathUnescape(raw)
+	if err != nil {
+		return "", httppkg.NewError(http.StatusBadRequest, fmt.Sprintf("invalid %s", label))
+	}
+	return decoded, nil
+}
+
+func getOrCreateV2User(items map[string]*model.V2UserResp, user string) *model.V2UserResp {
+	item, ok := items[user]
+	if !ok {
+		item = &model.V2UserResp{User: user}
+		items[user] = item
+	}
+	return item
+}
+
+func parseV2PageParams(ctx *httppkg.Context) (int, int, error) {
+	page, err := parseV2PositiveInt(ctx.Query("page"), defaultV2Page, "page")
+	if err != nil {
+		return 0, 0, err
+	}
+	pageSize, err := parseV2PositiveInt(ctx.Query("pageSize"), defaultV2PageSize, "pageSize")
+	if err != nil {
+		return 0, 0, err
+	}
+	if pageSize > maxV2PageSize {
+		return 0, 0, httppkg.NewError(http.StatusBadRequest, fmt.Sprintf("pageSize must be between 1 and %d", maxV2PageSize))
+	}
+	if page > math.MaxInt/pageSize {
+		return 0, 0, httppkg.NewError(http.StatusBadRequest, "page is too large")
+	}
+	return page, pageSize, nil
+}
+
+func parseV2PositiveInt(raw string, defaultValue int, name string) (int, error) {
+	if raw == "" {
+		return defaultValue, nil
+	}
+	value, err := strconv.Atoi(raw)
+	if err != nil || value < 1 {
+		return 0, httppkg.NewError(http.StatusBadRequest, fmt.Sprintf("%s must be a positive integer", name))
+	}
+	return value, nil
+}
+
+func parseV2StatusFilter(raw string) (string, error) {
+	status := strings.ToLower(raw)
+	switch status {
+	case "", "all", "online", "offline":
+		return status, nil
+	default:
+		return "", httppkg.NewError(http.StatusBadRequest, "status must be one of all, online, offline")
+	}
+}
+
+func parseV2ProxyTypeFilter(raw string) (string, error) {
+	proxyType := strings.ToLower(raw)
+	if proxyType == "" {
+		return "", nil
+	}
+	if slices.Contains(apiV2ProxyTypes, proxyType) {
+		return proxyType, nil
+	}
+	return "", httppkg.NewError(http.StatusBadRequest, "type must be one of tcp, udp, http, https, tcpmux, stcp, xtcp, sudp")
+}
+
+func parseV2SystemPruneType(raw string) (string, error) {
+	pruneType := strings.ToLower(raw)
+	switch pruneType {
+	case "":
+		return "", httppkg.NewError(http.StatusBadRequest, "type is required")
+	case v2SystemPruneTypeOfflineProxies:
+		return pruneType, nil
+	default:
+		return "", httppkg.NewError(http.StatusBadRequest, "type must be one of offline_proxies")
+	}
+}
+
+func matchV2StatusFilter(online bool, filter string) bool {
+	switch filter {
+	case "", "all":
+		return true
+	case "online":
+		return online
+	case "offline":
+		return !online
+	default:
+		return true
+	}
+}
+
+func buildV2PageResp[T any](items []T, page, pageSize int) model.V2PageResp[T] {
+	total := len(items)
+	return model.V2PageResp[T]{
+		Total:    total,
+		Page:     page,
+		PageSize: pageSize,
+		Items:    paginateV2Items(items, page, pageSize),
+	}
+}
+
+func paginateV2Items[T any](items []T, page, pageSize int) []T {
+	start := (page - 1) * pageSize
+	if start >= len(items) {
+		return []T{}
+	}
+	end := min(start+pageSize, len(items))
+	return items[start:end]
+}
+
+func queryValue(ctx *httppkg.Context, key string) (string, bool) {
+	values, ok := ctx.Req.URL.Query()[key]
+	if !ok {
+		return "", false
+	}
+	if len(values) == 0 {
+		return "", true
+	}
+	return values[0], true
+}
+
+func matchV2ClientQuery(item model.ClientInfoResp, q string) bool {
+	return containsV2Query(q,
+		item.Key,
+		item.User,
+		item.ClientID,
+		item.RunID,
+		item.Version,
+		item.WireProtocol,
+		item.Hostname,
+		item.ClientIP,
+	)
+}
+
+func matchV2ProxyQuery(item model.V2ProxyResp, q string) bool {
+	values := []string{
+		item.Name,
+		item.Spec.Type,
+		item.User,
+		item.ClientID,
+		item.Status.State,
+	}
+
+	switch item.Spec.Type {
+	case string(v1.ProxyTypeTCP):
+		if item.Spec.TCP != nil && item.Spec.TCP.RemotePort != nil {
+			values = append(values, strconv.Itoa(*item.Spec.TCP.RemotePort))
+		}
+	case string(v1.ProxyTypeUDP):
+		if item.Spec.UDP != nil && item.Spec.UDP.RemotePort != nil {
+			values = append(values, strconv.Itoa(*item.Spec.UDP.RemotePort))
+		}
+	case string(v1.ProxyTypeHTTP):
+		if item.Spec.HTTP != nil {
+			values = append(values, item.Spec.HTTP.CustomDomains...)
+			values = append(values, item.Spec.HTTP.Subdomain)
+		}
+	case string(v1.ProxyTypeHTTPS):
+		if item.Spec.HTTPS != nil {
+			values = append(values, item.Spec.HTTPS.CustomDomains...)
+			values = append(values, item.Spec.HTTPS.Subdomain)
+		}
+	case string(v1.ProxyTypeTCPMUX):
+		if item.Spec.TCPMux != nil {
+			values = append(values, item.Spec.TCPMux.CustomDomains...)
+			values = append(values, item.Spec.TCPMux.Subdomain)
+		}
+	}
+
+	return containsV2Query(q, values...)
+}
+
+func containsV2Query(q string, values ...string) bool {
+	for _, value := range values {
+		if strings.Contains(strings.ToLower(value), q) {
+			return true
+		}
+	}
+	return false
+}
+
+func (c *Controller) listV2ProxyStats(proxyType string) []*mem.ProxyStats {
+	if proxyType != "" {
+		return mem.StatsCollector.GetProxiesByType(proxyType)
+	}
+
+	items := make([]*mem.ProxyStats, 0)
+	for _, t := range apiV2ProxyTypes {
+		items = append(items, mem.StatsCollector.GetProxiesByType(t)...)
+	}
+	return items
+}
+
+func buildV2ProxyTrafficResp(name string, traffic *mem.ProxyTrafficInfo, now time.Time) model.V2ProxyTrafficResp {
+	history := make([]model.V2ProxyTrafficPointResp, 0, v2ProxyTrafficDefaultDays)
+	for age := v2ProxyTrafficDefaultDays - 1; age >= 0; age-- {
+		history = append(history, model.V2ProxyTrafficPointResp{
+			Date:       now.AddDate(0, 0, -age).Format(time.DateOnly),
+			TrafficIn:  v2TrafficValueAt(traffic.TrafficIn, age),
+			TrafficOut: v2TrafficValueAt(traffic.TrafficOut, age),
+		})
+	}
+
+	return model.V2ProxyTrafficResp{
+		Name:        name,
+		Unit:        v2ProxyTrafficUnit,
+		Granularity: v2ProxyTrafficGranularity,
+		History:     history,
+	}
+}
+
+func v2TrafficValueAt(values []int64, todayFirstIndex int) int64 {
+	if todayFirstIndex >= len(values) {
+		return 0
+	}
+	return values[todayFirstIndex]
+}
+
+func (c *Controller) buildV2ClientStatus(info registry.ClientInfo) model.V2ClientStatusResp {
+	status := model.V2ClientStatusResp{State: "offline"}
+	if info.Online {
+		status.State = "online"
+	}
+
+	user := info.User
+	clientID := info.ClientID()
+	for _, ps := range c.listV2ProxyStats("") {
+		if ps.User != user || ps.ClientID != clientID {
+			continue
+		}
+		status.CurConns += ps.CurConns
+		status.ProxyCount++
+	}
+	return status
+}
+
+func (c *Controller) buildV2ProxyResp(ps *mem.ProxyStats) model.V2ProxyResp {
+	state := "offline"
+	var cfg v1.ProxyConfigurer
+	if c.pxyManager != nil {
+		if pxy, ok := c.pxyManager.GetByName(ps.Name); ok {
+			state = "online"
+			cfg = pxy.GetConfigurer()
+		}
+	}
+
+	return model.V2ProxyResp{
+		Name:     ps.Name,
+		User:     ps.User,
+		ClientID: ps.ClientID,
+		Spec:     buildV2ProxySpec(ps.Type, cfg),
+		Status: model.V2ProxyStatusResp{
+			State:           state,
+			TodayTrafficIn:  ps.TodayTrafficIn,
+			TodayTrafficOut: ps.TodayTrafficOut,
+			CurConns:        ps.CurConns,
+			LastStartAt:     ps.LastStartAt,
+			LastCloseAt:     ps.LastCloseAt,
+		},
+	}
+}
+
+func buildV2ProxySpec(proxyType string, cfg v1.ProxyConfigurer) model.V2ProxySpec {
+	spec := model.V2ProxySpec{Type: proxyType}
+
+	switch proxyType {
+	case string(v1.ProxyTypeTCP):
+		block := &model.V2TCPProxySpec{}
+		if c, ok := cfg.(*v1.TCPProxyConfig); ok {
+			block.V2ProxyBaseSpec = buildV2ProxyBaseSpec(c.GetBaseConfig())
+			block.RemotePort = &c.RemotePort
+		}
+		spec.TCP = block
+	case string(v1.ProxyTypeUDP):
+		block := &model.V2UDPProxySpec{}
+		if c, ok := cfg.(*v1.UDPProxyConfig); ok {
+			block.V2ProxyBaseSpec = buildV2ProxyBaseSpec(c.GetBaseConfig())
+			block.RemotePort = &c.RemotePort
+		}
+		spec.UDP = block
+	case string(v1.ProxyTypeHTTP):
+		block := &model.V2HTTPProxySpec{}
+		if c, ok := cfg.(*v1.HTTPProxyConfig); ok {
+			block.V2ProxyBaseSpec = buildV2ProxyBaseSpec(c.GetBaseConfig())
+			block.CustomDomains = slices.Clone(c.CustomDomains)
+			block.Subdomain = c.SubDomain
+			block.Locations = slices.Clone(c.Locations)
+			block.HostHeaderRewrite = c.HostHeaderRewrite
+		}
+		spec.HTTP = block
+	case string(v1.ProxyTypeHTTPS):
+		block := &model.V2HTTPSProxySpec{}
+		if c, ok := cfg.(*v1.HTTPSProxyConfig); ok {
+			block.V2ProxyBaseSpec = buildV2ProxyBaseSpec(c.GetBaseConfig())
+			block.CustomDomains = slices.Clone(c.CustomDomains)
+			block.Subdomain = c.SubDomain
+		}
+		spec.HTTPS = block
+	case string(v1.ProxyTypeTCPMUX):
+		block := &model.V2TCPMuxProxySpec{}
+		if c, ok := cfg.(*v1.TCPMuxProxyConfig); ok {
+			block.V2ProxyBaseSpec = buildV2ProxyBaseSpec(c.GetBaseConfig())
+			block.CustomDomains = slices.Clone(c.CustomDomains)
+			block.Subdomain = c.SubDomain
+			block.Multiplexer = c.Multiplexer
+			block.RouteByHTTPUser = c.RouteByHTTPUser
+		}
+		spec.TCPMux = block
+	case string(v1.ProxyTypeSTCP):
+		block := &model.V2STCPProxySpec{}
+		if c, ok := cfg.(*v1.STCPProxyConfig); ok {
+			block.V2ProxyBaseSpec = buildV2ProxyBaseSpec(c.GetBaseConfig())
+		}
+		spec.STCP = block
+	case string(v1.ProxyTypeSUDP):
+		block := &model.V2SUDPProxySpec{}
+		if c, ok := cfg.(*v1.SUDPProxyConfig); ok {
+			block.V2ProxyBaseSpec = buildV2ProxyBaseSpec(c.GetBaseConfig())
+		}
+		spec.SUDP = block
+	case string(v1.ProxyTypeXTCP):
+		block := &model.V2XTCPProxySpec{}
+		if c, ok := cfg.(*v1.XTCPProxyConfig); ok {
+			block.V2ProxyBaseSpec = buildV2ProxyBaseSpec(c.GetBaseConfig())
+		}
+		spec.XTCP = block
+	}
+
+	return spec
+}
+
+func buildV2ProxyBaseSpec(base *v1.ProxyBaseConfig) model.V2ProxyBaseSpec {
+	return model.V2ProxyBaseSpec{
+		Annotations: maps.Clone(base.Annotations),
+		Metadatas:   maps.Clone(base.Metadatas),
+		Transport: &model.V2ProxyTransportSpec{
+			UseEncryption:      base.Transport.UseEncryption,
+			UseCompression:     base.Transport.UseCompression,
+			BandwidthLimit:     base.Transport.BandwidthLimit.String(),
+			BandwidthLimitMode: base.Transport.BandwidthLimitMode,
+		},
+		LoadBalancer: &model.V2ProxyLoadBalancerSpec{
+			Group: base.LoadBalancer.Group,
+		},
+	}
+}

server/http/controller_v2_proxy_spec_test.go

@@ -0,0 +1,393 @@
+// Copyright 2026 The frp Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package http
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	configtypes "github.com/fatedier/frp/pkg/config/types"
+	v1 "github.com/fatedier/frp/pkg/config/v1"
+	"github.com/fatedier/frp/pkg/metrics/mem"
+	"github.com/fatedier/frp/server/http/model"
+)
+
+func TestBuildV2ProxySpecAllTypesAndRedaction(t *testing.T) {
+	tests := []struct {
+		proxyType string
+		cfg       v1.ProxyConfigurer
+		blockKeys []string
+	}{
+		{
+			proxyType: "tcp",
+			cfg: &v1.TCPProxyConfig{
+				ProxyBaseConfig: newV2ProxyTestBaseConfig(t, "tcp"),
+				RemotePort:      6000,
+			},
+			blockKeys: []string{"annotations", "loadBalancer", "metadatas", "remotePort", "transport"},
+		},
+		{
+			proxyType: "udp",
+			cfg: &v1.UDPProxyConfig{
+				ProxyBaseConfig: newV2ProxyTestBaseConfig(t, "udp"),
+				RemotePort:      7000,
+			},
+			blockKeys: []string{"annotations", "loadBalancer", "metadatas", "remotePort", "transport"},
+		},
+		{
+			proxyType: "http",
+			cfg: &v1.HTTPProxyConfig{
+				ProxyBaseConfig:   newV2ProxyTestBaseConfig(t, "http"),
+				DomainConfig:      v1.DomainConfig{CustomDomains: []string{"app.example.com"}, SubDomain: "app"},
+				Locations:         []string{"/api"},
+				HTTPUser:          "secret-http-user",
+				HTTPPassword:      "secret-http-password",
+				HostHeaderRewrite: "backend.example.com",
+				RequestHeaders:    v1.HeaderOperations{Set: map[string]string{"X-Secret": "secret-request-header"}},
+				ResponseHeaders:   v1.HeaderOperations{Set: map[string]string{"X-Secret": "secret-response-header"}},
+				RouteByHTTPUser:   "secret-http-route-user",
+			},
+			blockKeys: []string{"annotations", "customDomains", "hostHeaderRewrite", "loadBalancer", "locations", "metadatas", "subdomain", "transport"},
+		},
+		{
+			proxyType: "https",
+			cfg: &v1.HTTPSProxyConfig{
+				ProxyBaseConfig: newV2ProxyTestBaseConfig(t, "https"),
+				DomainConfig:    v1.DomainConfig{CustomDomains: []string{"secure.example.com"}, SubDomain: "secure"},
+			},
+			blockKeys: []string{"annotations", "customDomains", "loadBalancer", "metadatas", "subdomain", "transport"},
+		},
+		{
+			proxyType: "tcpmux",
+			cfg: &v1.TCPMuxProxyConfig{
+				ProxyBaseConfig: newV2ProxyTestBaseConfig(t, "tcpmux"),
+				DomainConfig:    v1.DomainConfig{CustomDomains: []string{"mux.example.com"}, SubDomain: "mux"},
+				HTTPUser:        strings.Join([]string{"secret", "mux-http-user"}, "-"),
+				HTTPPassword:    strings.Join([]string{"secret", "mux-http-password"}, "-"),
+				RouteByHTTPUser: "displayed-mux-user",
+				Multiplexer:     "httpconnect",
+			},
+			blockKeys: []string{"annotations", "customDomains", "loadBalancer", "metadatas", "multiplexer", "routeByHTTPUser", "subdomain", "transport"},
+		},
+		{
+			proxyType: "stcp",
+			cfg: &v1.STCPProxyConfig{
+				ProxyBaseConfig: newV2ProxyTestBaseConfig(t, "stcp"),
+				Secretkey:       strings.Join([]string{"secret", "stcp-key"}, "-"),
+				AllowUsers:      []string{strings.Join([]string{"secret", "stcp-user"}, "-")},
+			},
+			blockKeys: []string{"annotations", "loadBalancer", "metadatas", "transport"},
+		},
+		{
+			proxyType: "sudp",
+			cfg: &v1.SUDPProxyConfig{
+				ProxyBaseConfig: newV2ProxyTestBaseConfig(t, "sudp"),
+				Secretkey:       strings.Join([]string{"secret", "sudp-key"}, "-"),
+				AllowUsers:      []string{strings.Join([]string{"secret", "sudp-user"}, "-")},
+			},
+			blockKeys: []string{"annotations", "loadBalancer", "metadatas", "transport"},
+		},
+		{
+			proxyType: "xtcp",
+			cfg: &v1.XTCPProxyConfig{
+				ProxyBaseConfig: newV2ProxyTestBaseConfig(t, "xtcp"),
+				Secretkey:       strings.Join([]string{"secret", "xtcp-key"}, "-"),
+				AllowUsers:      []string{strings.Join([]string{"secret", "xtcp-user"}, "-")},
+			},
+			blockKeys: []string{"annotations", "loadBalancer", "metadatas", "transport"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.proxyType, func(t *testing.T) {
+			spec := buildV2ProxySpec(tt.proxyType, tt.cfg)
+			raw := mustMarshalJSON(t, spec)
+
+			var specObject map[string]json.RawMessage
+			if err := json.Unmarshal(raw, &specObject); err != nil {
+				t.Fatalf("unmarshal spec failed: %v", err)
+			}
+			assertRawJSONKeys(t, specObject, tt.proxyType, "type")
+
+			var gotType string
+			if err := json.Unmarshal(specObject["type"], &gotType); err != nil {
+				t.Fatalf("unmarshal spec type failed: %v", err)
+			}
+			if gotType != tt.proxyType {
+				t.Fatalf("spec type mismatch, want %q got %q", tt.proxyType, gotType)
+			}
+
+			var block map[string]json.RawMessage
+			if err := json.Unmarshal(specObject[tt.proxyType], &block); err != nil {
+				t.Fatalf("unmarshal active block failed: %v", err)
+			}
+			assertRawJSONKeys(t, block, tt.blockKeys...)
+			assertV2ProxyCommonSpec(t, block)
+			assertV2ProxyTypeFields(t, tt.proxyType, specObject[tt.proxyType])
+			assertNoV2ProxySensitiveFields(t, block)
+
+			content := string(raw)
+			for _, secret := range []string{
+				"secret-proxy-name",
+				"secret-group-key",
+				"secret-local-host",
+				"secret-plugin-user",
+				"secret-plugin-password",
+				"secret-health-path",
+				"secret-http-user",
+				"secret-http-password",
+				"secret-request-header",
+				"secret-response-header",
+				"secret-http-route-user",
+				"secret-mux-http-user",
+				"secret-mux-http-password",
+				"secret-stcp-key",
+				"secret-stcp-user",
+				"secret-sudp-key",
+				"secret-sudp-user",
+				"secret-xtcp-key",
+				"secret-xtcp-user",
+			} {
+				if strings.Contains(content, secret) {
+					t.Fatalf("sensitive value %q leaked in spec: %s", secret, content)
+				}
+			}
+		})
+	}
+}
+
+func assertV2ProxyTypeFields(t *testing.T, proxyType string, raw json.RawMessage) {
+	t.Helper()
+
+	switch proxyType {
+	case "tcp":
+		var block model.V2TCPProxySpec
+		if err := json.Unmarshal(raw, &block); err != nil {
+			t.Fatalf("unmarshal tcp block failed: %v", err)
+		}
+		if block.RemotePort == nil || *block.RemotePort != 6000 {
+			t.Fatalf("tcp remote port mismatch: %#v", block.RemotePort)
+		}
+	case "udp":
+		var block model.V2UDPProxySpec
+		if err := json.Unmarshal(raw, &block); err != nil {
+			t.Fatalf("unmarshal udp block failed: %v", err)
+		}
+		if block.RemotePort == nil || *block.RemotePort != 7000 {
+			t.Fatalf("udp remote port mismatch: %#v", block.RemotePort)
+		}
+	case "http":
+		var block model.V2HTTPProxySpec
+		if err := json.Unmarshal(raw, &block); err != nil {
+			t.Fatalf("unmarshal http block failed: %v", err)
+		}
+		if len(block.CustomDomains) != 1 || block.CustomDomains[0] != "app.example.com" ||
+			block.Subdomain != "app" || len(block.Locations) != 1 || block.Locations[0] != "/api" ||
+			block.HostHeaderRewrite != "backend.example.com" {
+			t.Fatalf("http fields mismatch: %#v", block)
+		}
+	case "https":
+		var block model.V2HTTPSProxySpec
+		if err := json.Unmarshal(raw, &block); err != nil {
+			t.Fatalf("unmarshal https block failed: %v", err)
+		}
+		if len(block.CustomDomains) != 1 || block.CustomDomains[0] != "secure.example.com" || block.Subdomain != "secure" {
+			t.Fatalf("https fields mismatch: %#v", block)
+		}
+	case "tcpmux":
+		var block model.V2TCPMuxProxySpec
+		if err := json.Unmarshal(raw, &block); err != nil {
+			t.Fatalf("unmarshal tcpmux block failed: %v", err)
+		}
+		if len(block.CustomDomains) != 1 || block.CustomDomains[0] != "mux.example.com" ||
+			block.Subdomain != "mux" || block.Multiplexer != "httpconnect" || block.RouteByHTTPUser != "displayed-mux-user" {
+			t.Fatalf("tcpmux fields mismatch: %#v", block)
+		}
+	}
+}
+
+func TestBuildV2ProxyRespOfflineTypedShells(t *testing.T) {
+	for _, proxyType := range apiV2ProxyTypes {
+		t.Run(proxyType, func(t *testing.T) {
+			resp := (&Controller{}).buildV2ProxyResp(&mem.ProxyStats{
+				Name: "offline-" + proxyType,
+				Type: proxyType,
+			})
+			if resp.Status.State != "offline" {
+				t.Fatalf("offline phase mismatch: %#v", resp.Status)
+			}
+
+			var specObject map[string]json.RawMessage
+			if err := json.Unmarshal(mustMarshalJSON(t, resp.Spec), &specObject); err != nil {
+				t.Fatalf("unmarshal offline spec failed: %v", err)
+			}
+			assertRawJSONKeys(t, specObject, proxyType, "type")
+			assertRawJSONKeysFromMessage(t, specObject[proxyType])
+		})
+	}
+}
+
+func TestBuildV2ProxySpecDoesNotPopulateMismatchedBlock(t *testing.T) {
+	spec := buildV2ProxySpec("tcp", &v1.UDPProxyConfig{
+		ProxyBaseConfig: newV2ProxyTestBaseConfig(t, "udp"),
+		RemotePort:      7000,
+	})
+
+	var specObject map[string]json.RawMessage
+	if err := json.Unmarshal(mustMarshalJSON(t, spec), &specObject); err != nil {
+		t.Fatalf("unmarshal mismatched spec failed: %v", err)
+	}
+	assertRawJSONKeys(t, specObject, "tcp", "type")
+	assertRawJSONKeysFromMessage(t, specObject["tcp"])
+}
+
+func newV2ProxyTestBaseConfig(t *testing.T, proxyType string) v1.ProxyBaseConfig {
+	t.Helper()
+
+	bandwidthLimit, err := configtypes.NewBandwidthQuantity("10MB")
+	if err != nil {
+		t.Fatalf("create bandwidth limit failed: %v", err)
+	}
+	enabled := false
+	return v1.ProxyBaseConfig{
+		Name:        "secret-proxy-name",
+		Type:        proxyType,
+		Enabled:     &enabled,
+		Annotations: map[string]string{"annotation-key": "annotation-value"},
+		Metadatas:   map[string]string{"metadata-key": "metadata-value"},
+		Transport: v1.ProxyTransport{
+			UseEncryption:        true,
+			UseCompression:       true,
+			BandwidthLimit:       bandwidthLimit,
+			BandwidthLimitMode:   configtypes.BandwidthLimitModeServer,
+			ProxyProtocolVersion: "v2",
+		},
+		LoadBalancer: v1.LoadBalancerConfig{
+			Group:    "public-group",
+			GroupKey: "secret-group-key",
+		},
+		HealthCheck: v1.HealthCheckConfig{
+			Type: "http",
+			Path: "secret-health-path",
+		},
+		ProxyBackend: v1.ProxyBackend{
+			LocalIP:   "secret-local-host",
+			LocalPort: 8080,
+			Plugin: v1.TypedClientPluginOptions{
+				Type: v1.PluginHTTPProxy,
+				ClientPluginOptions: &v1.HTTPProxyPluginOptions{
+					Type:         v1.PluginHTTPProxy,
+					HTTPUser:     "secret-plugin-user",
+					HTTPPassword: "secret-plugin-password",
+				},
+			},
+		},
+	}
+}
+
+func assertV2ProxyCommonSpec(t *testing.T, block map[string]json.RawMessage) {
+	t.Helper()
+
+	var annotations map[string]string
+	if err := json.Unmarshal(block["annotations"], &annotations); err != nil {
+		t.Fatalf("unmarshal annotations failed: %v", err)
+	}
+	if annotations["annotation-key"] != "annotation-value" {
+		t.Fatalf("annotations mismatch: %#v", annotations)
+	}
+
+	var metadatas map[string]string
+	if err := json.Unmarshal(block["metadatas"], &metadatas); err != nil {
+		t.Fatalf("unmarshal metadatas failed: %v", err)
+	}
+	if metadatas["metadata-key"] != "metadata-value" {
+		t.Fatalf("metadatas mismatch: %#v", metadatas)
+	}
+
+	assertRawJSONKeysFromMessage(t, block["transport"],
+		"bandwidthLimit",
+		"bandwidthLimitMode",
+		"useCompression",
+		"useEncryption",
+	)
+	var transport model.V2ProxyTransportSpec
+	if err := json.Unmarshal(block["transport"], &transport); err != nil {
+		t.Fatalf("unmarshal transport failed: %v", err)
+	}
+	if !transport.UseEncryption || !transport.UseCompression ||
+		transport.BandwidthLimit != "10MB" || transport.BandwidthLimitMode != "server" {
+		t.Fatalf("transport mismatch: %#v", transport)
+	}
+
+	assertRawJSONKeysFromMessage(t, block["loadBalancer"], "group")
+	var loadBalancer model.V2ProxyLoadBalancerSpec
+	if err := json.Unmarshal(block["loadBalancer"], &loadBalancer); err != nil {
+		t.Fatalf("unmarshal load balancer failed: %v", err)
+	}
+	if loadBalancer.Group != "public-group" {
+		t.Fatalf("load balancer mismatch: %#v", loadBalancer)
+	}
+}
+
+func assertNoV2ProxySensitiveFields(t *testing.T, value any) {
+	t.Helper()
+
+	forbidden := map[string]struct{}{
+		"allowUsers":           {},
+		"enabled":              {},
+		"groupKey":             {},
+		"healthCheck":          {},
+		"httpPassword":         {},
+		"httpUser":             {},
+		"localIP":              {},
+		"localPort":            {},
+		"name":                 {},
+		"natTraversal":         {},
+		"plugin":               {},
+		"proxyProtocolVersion": {},
+		"requestHeaders":       {},
+		"responseHeaders":      {},
+		"secretKey":            {},
+		"type":                 {},
+	}
+
+	var walk func(any)
+	walk = func(current any) {
+		switch current := current.(type) {
+		case map[string]any:
+			for key, nested := range current {
+				if _, ok := forbidden[key]; ok {
+					t.Fatalf("sensitive field %q leaked in active block", key)
+				}
+				walk(nested)
+			}
+		case []any:
+			for _, nested := range current {
+				walk(nested)
+			}
+		}
+	}
+
+	raw, err := json.Marshal(value)
+	if err != nil {
+		t.Fatalf("marshal active block failed: %v", err)
+	}
+	var decoded any
+	if err := json.Unmarshal(raw, &decoded); err != nil {
+		t.Fatalf("decode active block failed: %v", err)
+	}
+	walk(decoded)
+}

server/http/controller_v2_test.go

@@ -0,0 +1,908 @@
+// Copyright 2026 The frp Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package http
+
+import (
+	"encoding/json"
+	"fmt"
+	"math"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+	"time"
+
+	"github.com/gorilla/mux"
+
+	"github.com/fatedier/frp/pkg/config/types"
+	v1 "github.com/fatedier/frp/pkg/config/v1"
+	"github.com/fatedier/frp/pkg/metrics/mem"
+	httppkg "github.com/fatedier/frp/pkg/util/http"
+	"github.com/fatedier/frp/server/http/model"
+	serverproxy "github.com/fatedier/frp/server/proxy"
+	"github.com/fatedier/frp/server/registry"
+)
+
+type v2EnvelopeForTest[T any] struct {
+	Code int    `json:"code"`
+	Msg  string `json:"msg"`
+	Data T      `json:"data"`
+}
+
+type fakeStatsCollector struct {
+	server    *mem.ServerStats
+	proxies   map[string]*mem.ProxyStats
+	traffic   map[string]*mem.ProxyTrafficInfo
+	pruneable map[string]bool
+}
+
+func (f *fakeStatsCollector) GetServer() *mem.ServerStats {
+	if f.server != nil {
+		return f.server
+	}
+	return &mem.ServerStats{ProxyTypeCounts: map[string]int64{}}
+}
+
+func (f *fakeStatsCollector) GetProxiesByType(proxyType string) []*mem.ProxyStats {
+	items := make([]*mem.ProxyStats, 0)
+	for _, ps := range f.proxies {
+		if ps.Type == proxyType {
+			items = append(items, ps)
+		}
+	}
+	return items
+}
+
+func (f *fakeStatsCollector) GetProxiesByTypeAndName(proxyType string, proxyName string) *mem.ProxyStats {
+	ps := f.proxies[proxyName]
+	if ps != nil && ps.Type == proxyType {
+		return ps
+	}
+	return nil
+}
+
+func (f *fakeStatsCollector) GetProxyByName(proxyName string) *mem.ProxyStats {
+	return f.proxies[proxyName]
+}
+
+func (f *fakeStatsCollector) GetProxyTraffic(name string) *mem.ProxyTrafficInfo {
+	return f.traffic[name]
+}
+
+func (f *fakeStatsCollector) ClearOfflineProxies() (int, int) {
+	return 0, len(f.proxies)
+}
+
+func (f *fakeStatsCollector) PruneOfflineProxies() (int, int) {
+	total := len(f.proxies)
+	cleared := 0
+	for name := range f.pruneable {
+		if _, ok := f.proxies[name]; ok {
+			delete(f.proxies, name)
+			cleared++
+		}
+	}
+	f.pruneable = map[string]bool{}
+	return cleared, total
+}
+
+func TestAPIV2SystemInfoEnvelope(t *testing.T) {
+	oldStatsCollector := mem.StatsCollector
+	mem.StatsCollector = &fakeStatsCollector{
+		server: &mem.ServerStats{
+			TotalTrafficIn:  1024,
+			TotalTrafficOut: 2048,
+			CurConns:        3,
+			ClientCounts:    4,
+			ProxyTypeCounts: map[string]int64{
+				"tcp":  2,
+				"http": 1,
+			},
+		},
+		proxies: map[string]*mem.ProxyStats{},
+	}
+	t.Cleanup(func() {
+		mem.StatsCollector = oldStatsCollector
+	})
+
+	controller := NewController(&v1.ServerConfig{
+		BindPort:              7000,
+		VhostHTTPPort:         8080,
+		VhostHTTPSPort:        8443,
+		TCPMuxHTTPConnectPort: 9000,
+		KCPBindPort:           7001,
+		QUICBindPort:          7002,
+		SubDomainHost:         "example.com",
+		MaxPortsPerClient:     8,
+		AllowPorts: []types.PortsRange{
+			{Start: 1000, End: 1002},
+			{Single: 2000},
+		},
+		Transport: v1.ServerTransportConfig{
+			MaxPoolCount:     5,
+			HeartbeatTimeout: 90,
+			TLS: v1.TLSServerConfig{
+				Force: true,
+			},
+		},
+	}, registry.NewClientRegistry(), serverproxy.NewManager())
+	router := newV2TestRouter(controller)
+
+	resp := performRequest(router, "/api/v2/system/info")
+	if resp.Code != http.StatusOK {
+		t.Fatalf("status mismatch, want %d got %d", http.StatusOK, resp.Code)
+	}
+
+	rawResp := decodeResponse[v2EnvelopeForTest[map[string]json.RawMessage]](t, resp)
+	if rawResp.Code != http.StatusOK || rawResp.Msg != "success" {
+		t.Fatalf("envelope mismatch: %#v", rawResp)
+	}
+	assertRawJSONKeys(t, rawResp.Data, "config", "status", "version")
+	assertRawJSONKeysFromMessage(t, rawResp.Data["config"],
+		"allowPortsStr",
+		"bindPort",
+		"heartbeatTimeout",
+		"kcpBindPort",
+		"maxPoolCount",
+		"maxPortsPerClient",
+		"quicBindPort",
+		"subdomainHost",
+		"tcpmuxHTTPConnectPort",
+		"tlsForce",
+		"vhostHTTPPort",
+		"vhostHTTPSPort",
+	)
+	assertRawJSONKeysFromMessage(t, rawResp.Data["status"],
+		"clientCounts",
+		"curConns",
+		"proxyTypeCount",
+		"totalTrafficIn",
+		"totalTrafficOut",
+	)
+
+	systemResp := decodeResponse[v2EnvelopeForTest[model.V2SystemInfoResp]](t, resp)
+	if systemResp.Data.Version == "" {
+		t.Fatal("version should be set at top level")
+	}
+	if systemResp.Data.Config.BindPort != 7000 ||
+		systemResp.Data.Config.VhostHTTPPort != 8080 ||
+		systemResp.Data.Config.VhostHTTPSPort != 8443 ||
+		systemResp.Data.Config.TCPMuxHTTPConnectPort != 9000 ||
+		systemResp.Data.Config.KCPBindPort != 7001 ||
+		systemResp.Data.Config.QUICBindPort != 7002 ||
+		systemResp.Data.Config.SubdomainHost != "example.com" ||
+		systemResp.Data.Config.MaxPoolCount != 5 ||
+		systemResp.Data.Config.MaxPortsPerClient != 8 ||
+		systemResp.Data.Config.HeartbeatTimeout != 90 ||
+		systemResp.Data.Config.AllowPortsStr != "1000-1002,2000" ||
+		!systemResp.Data.Config.TLSForce {
+		t.Fatalf("config mismatch: %#v", systemResp.Data.Config)
+	}
+	if systemResp.Data.Status.TotalTrafficIn != 1024 ||
+		systemResp.Data.Status.TotalTrafficOut != 2048 ||
+		systemResp.Data.Status.CurConns != 3 ||
+		systemResp.Data.Status.ClientCounts != 4 ||
+		systemResp.Data.Status.ProxyTypeCounts["tcp"] != 2 ||
+		systemResp.Data.Status.ProxyTypeCounts["http"] != 1 {
+		t.Fatalf("status mismatch: %#v", systemResp.Data.Status)
+	}
+}
+
+func TestAPIV2SystemPruneOfflineProxies(t *testing.T) {
+	oldStatsCollector := mem.StatsCollector
+	collector := &fakeStatsCollector{
+		proxies: map[string]*mem.ProxyStats{
+			"tcp-offline":    {Name: "tcp-offline", Type: "tcp"},
+			"http-offline":   {Name: "http-offline", Type: "http"},
+			"udp-offline":    {Name: "udp-offline", Type: "udp"},
+			"tcp-online":     {Name: "tcp-online", Type: "tcp"},
+			"http-online":    {Name: "http-online", Type: "http"},
+			"udp-online":     {Name: "udp-online", Type: "udp"},
+			"stcp-restarted": {Name: "stcp-restarted", Type: "stcp"},
+			"xtcp-restarted": {Name: "xtcp-restarted", Type: "xtcp"},
+			"sudp-same-time": {Name: "sudp-same-time", Type: "sudp"},
+			"tcpmux-running": {Name: "tcpmux-running", Type: "tcpmux"},
+		},
+		pruneable: map[string]bool{
+			"tcp-offline":  true,
+			"http-offline": true,
+			"udp-offline":  true,
+		},
+	}
+	mem.StatsCollector = collector
+	t.Cleanup(func() {
+		mem.StatsCollector = oldStatsCollector
+	})
+
+	controller := NewController(&v1.ServerConfig{}, registry.NewClientRegistry(), serverproxy.NewManager())
+	router := newV2TestRouter(controller)
+
+	resp := performRequestWithMethod(router, http.MethodPost, "/api/v2/system/prune?type=offline_proxies")
+	if resp.Code != http.StatusOK {
+		t.Fatalf("status mismatch, want %d got %d, body: %s", http.StatusOK, resp.Code, resp.Body.String())
+	}
+	rawResp := decodeResponse[v2EnvelopeForTest[map[string]json.RawMessage]](t, resp)
+	if rawResp.Code != http.StatusOK || rawResp.Msg != "success" {
+		t.Fatalf("envelope mismatch: %#v", rawResp)
+	}
+	assertRawJSONKeys(t, rawResp.Data, "cleared", "total", "type")
+	pruneResp := decodeResponse[v2EnvelopeForTest[model.V2SystemPruneResp]](t, resp)
+	if pruneResp.Data.Type != "offline_proxies" || pruneResp.Data.Cleared != 3 || pruneResp.Data.Total != 10 {
+		t.Fatalf("prune response mismatch: %#v", pruneResp.Data)
+	}
+	if _, ok := collector.proxies["tcp-offline"]; ok {
+		t.Fatal("pruned proxy statistics should be removed")
+	}
+	if _, ok := collector.proxies["tcp-online"]; !ok {
+		t.Fatal("online proxy statistics should remain")
+	}
+
+	resp = performRequestWithMethod(router, http.MethodPost, "/api/v2/system/prune?type=offline_proxies")
+	if resp.Code != http.StatusOK {
+		t.Fatalf("second prune status mismatch, want %d got %d", http.StatusOK, resp.Code)
+	}
+	pruneResp = decodeResponse[v2EnvelopeForTest[model.V2SystemPruneResp]](t, resp)
+	if pruneResp.Data.Cleared != 0 || pruneResp.Data.Total != 7 {
+		t.Fatalf("second prune response mismatch: %#v", pruneResp.Data)
+	}
+}
+
+func TestAPIV2SystemPruneTypeErrorsUseEnvelope(t *testing.T) {
+	controller := newV2TestController(t)
+	router := newV2TestRouter(controller)
+
+	resp := performRequestWithMethod(router, http.MethodPost, "/api/v2/system/prune")
+	if resp.Code != http.StatusBadRequest {
+		t.Fatalf("missing type status mismatch, want %d got %d", http.StatusBadRequest, resp.Code)
+	}
+	errResp := decodeResponse[httppkg.V2Response](t, resp)
+	if errResp.Code != http.StatusBadRequest || errResp.Msg != "type is required" || errResp.Data != nil {
+		t.Fatalf("missing type error envelope mismatch: %#v", errResp)
+	}
+
+	resp = performRequestWithMethod(router, http.MethodPost, "/api/v2/system/prune?type=clients")
+	if resp.Code != http.StatusBadRequest {
+		t.Fatalf("invalid type status mismatch, want %d got %d", http.StatusBadRequest, resp.Code)
+	}
+	errResp = decodeResponse[httppkg.V2Response](t, resp)
+	if errResp.Code != http.StatusBadRequest || errResp.Msg != "type must be one of offline_proxies" || errResp.Data != nil {
+		t.Fatalf("invalid type error envelope mismatch: %#v", errResp)
+	}
+}
+
+func TestAPIV2ClientListEnvelopePaginationAndFilters(t *testing.T) {
+	controller := newV2TestController(t)
+	router := newV2TestRouter(controller)
+
+	resp := performRequest(router, "/api/v2/clients?page=1&pageSize=1")
+	if resp.Code != http.StatusOK {
+		t.Fatalf("status mismatch, want %d got %d", http.StatusOK, resp.Code)
+	}
+	pageResp := decodeResponse[v2EnvelopeForTest[model.V2PageResp[model.ClientInfoResp]]](t, resp)
+	if pageResp.Code != http.StatusOK || pageResp.Msg != "success" {
+		t.Fatalf("envelope mismatch: %#v", pageResp)
+	}
+	if pageResp.Data.Total != 3 || pageResp.Data.Page != 1 || pageResp.Data.PageSize != 1 || len(pageResp.Data.Items) != 1 {
+		t.Fatalf("page data mismatch: %#v", pageResp.Data)
+	}
+	if got := pageResp.Data.Items[0].User; got != "" {
+		t.Fatalf("first sorted user mismatch, want empty got %q", got)
+	}
+
+	resp = performRequest(router, "/api/v2/clients?user=&page=1&pageSize=50")
+	emptyUserResp := decodeResponse[v2EnvelopeForTest[model.V2PageResp[model.ClientInfoResp]]](t, resp)
+	if emptyUserResp.Data.Total != 1 || emptyUserResp.Data.Items[0].User != "" {
+		t.Fatalf("empty user filter mismatch: %#v", emptyUserResp.Data)
+	}
+
+	resp = performRequest(router, "/api/v2/clients?user=alice&status=online&q=alice-host")
+	aliceResp := decodeResponse[v2EnvelopeForTest[model.V2PageResp[model.ClientInfoResp]]](t, resp)
+	if aliceResp.Data.Total != 1 || aliceResp.Data.Items[0].User != "alice" {
+		t.Fatalf("alice filter mismatch: %#v", aliceResp.Data)
+	}
+
+	resp = performRequest(router, "/api/v2/clients?status=offline")
+	offlineResp := decodeResponse[v2EnvelopeForTest[model.V2PageResp[model.ClientInfoResp]]](t, resp)
+	if offlineResp.Data.Total != 1 || offlineResp.Data.Items[0].User != "bob" {
+		t.Fatalf("offline filter mismatch: %#v", offlineResp.Data)
+	}
+}
+
+func TestAPIV2PageParamErrorsUseEnvelope(t *testing.T) {
+	controller := newV2TestController(t)
+	router := newV2TestRouter(controller)
+
+	resp := performRequest(router, "/api/v2/clients?page=0")
+	if resp.Code != http.StatusBadRequest {
+		t.Fatalf("status mismatch, want %d got %d", http.StatusBadRequest, resp.Code)
+	}
+	errResp := decodeResponse[httppkg.V2Response](t, resp)
+	if errResp.Code != http.StatusBadRequest || errResp.Data != nil {
+		t.Fatalf("error envelope mismatch: %#v", errResp)
+	}
+
+	resp = performRequest(router, "/api/v2/clients?pageSize=201")
+	if resp.Code != http.StatusBadRequest {
+		t.Fatalf("status mismatch, want %d got %d", http.StatusBadRequest, resp.Code)
+	}
+
+	resp = performRequest(router, fmt.Sprintf("/api/v2/clients?page=%d&pageSize=2", math.MaxInt))
+	if resp.Code != http.StatusBadRequest {
+		t.Fatalf("status mismatch for overflowing page offset, want %d got %d", http.StatusBadRequest, resp.Code)
+	}
+}
+
+func TestAPIV2ClientDetailEnvelope(t *testing.T) {
+	controller := newV2TestController(t)
+	router := newV2TestRouter(controller)
+
+	resp := performRequest(router, "/api/v2/clients/alice.client-a")
+	if resp.Code != http.StatusOK {
+		t.Fatalf("status mismatch, want %d got %d", http.StatusOK, resp.Code)
+	}
+	detailResp := decodeResponse[v2EnvelopeForTest[model.V2ClientDetailResp]](t, resp)
+	if detailResp.Data.User != "alice" || detailResp.Data.ClientID != "client-a" {
+		t.Fatalf("client detail mismatch: %#v", detailResp.Data)
+	}
+	if detailResp.Data.Status.State != "online" || detailResp.Data.Status.CurConns != 5 || detailResp.Data.Status.ProxyCount != 2 {
+		t.Fatalf("client detail status mismatch: %#v", detailResp.Data.Status)
+	}
+}
+
+func TestAPIV2ClientDetailEncodedKey(t *testing.T) {
+	oldStatsCollector := mem.StatsCollector
+	mem.StatsCollector = &fakeStatsCollector{
+		proxies: map[string]*mem.ProxyStats{
+			"tcp-url": {
+				Name:     "tcp-url",
+				Type:     "tcp",
+				User:     "url",
+				ClientID: "client/a?b#c",
+				CurConns: 7,
+			},
+		},
+	}
+	t.Cleanup(func() {
+		mem.StatsCollector = oldStatsCollector
+	})
+
+	clientRegistry := registry.NewClientRegistry()
+	clientRegistry.Register("url", "client/a?b#c", "run-url", "url-host", "1.0.0", "127.0.0.4", "v2")
+	controller := NewController(&v1.ServerConfig{}, clientRegistry, serverproxy.NewManager())
+	router := newV2TestRouter(controller)
+
+	encodedKey := url.PathEscape("url.client/a?b#c")
+	resp := performRequest(router, "/api/v2/clients/"+encodedKey)
+	if resp.Code != http.StatusOK {
+		t.Fatalf("encoded client key status mismatch, want %d got %d, body: %s", http.StatusOK, resp.Code, resp.Body.String())
+	}
+	encodedResp := decodeResponse[v2EnvelopeForTest[model.V2ClientDetailResp]](t, resp)
+	if encodedResp.Data.User != "url" || encodedResp.Data.ClientID != "client/a?b#c" {
+		t.Fatalf("encoded client detail mismatch: %#v", encodedResp.Data)
+	}
+	if encodedResp.Data.Status.CurConns != 7 || encodedResp.Data.Status.ProxyCount != 1 {
+		t.Fatalf("encoded client detail status mismatch: %#v", encodedResp.Data.Status)
+	}
+}
+
+func TestAPIV2ProxyListDetailAndUsers(t *testing.T) {
+	controller := newV2TestController(t)
+	router := newV2TestRouter(controller)
+
+	resp := performRequest(router, "/api/v2/proxies?type=invalid")
+	if resp.Code != http.StatusBadRequest {
+		t.Fatalf("invalid proxy type status mismatch, want %d got %d", http.StatusBadRequest, resp.Code)
+	}
+	errResp := decodeResponse[httppkg.V2Response](t, resp)
+	if errResp.Code != http.StatusBadRequest || errResp.Data != nil {
+		t.Fatalf("invalid proxy type error envelope mismatch: %#v", errResp)
+	}
+
+	resp = performRequest(router, "/api/v2/proxies?type=tcp&user=&page=1&pageSize=50")
+	proxyResp := decodeResponse[v2EnvelopeForTest[model.V2PageResp[model.V2ProxyResp]]](t, resp)
+	if proxyResp.Data.Total != 1 {
+		t.Fatalf("proxy filter total mismatch: %#v", proxyResp.Data)
+	}
+	proxyItem := proxyResp.Data.Items[0]
+	if proxyItem.Name != "tcp-empty" || proxyItem.Spec.Type != "tcp" || proxyItem.User != "" || proxyItem.Status.State != "offline" {
+		t.Fatalf("proxy item mismatch: %#v", proxyItem)
+	}
+	rawProxyResp := decodeResponse[v2EnvelopeForTest[model.V2PageResp[map[string]json.RawMessage]]](t, resp)
+	assertRawJSONKeys(t, rawProxyResp.Data.Items[0], "clientID", "name", "spec", "status", "user")
+	var rawListSpec map[string]json.RawMessage
+	if err := json.Unmarshal(rawProxyResp.Data.Items[0]["spec"], &rawListSpec); err != nil {
+		t.Fatalf("unmarshal list proxy spec failed: %v", err)
+	}
+	assertRawJSONKeys(t, rawListSpec, "tcp", "type")
+	assertRawJSONKeysFromMessage(t, rawListSpec["tcp"])
+
+	resp = performRequest(router, "/api/v2/proxies/tcp-alice")
+	rawProxyDetailResp := decodeResponse[v2EnvelopeForTest[map[string]json.RawMessage]](t, resp)
+	assertRawJSONKeysFromMessage(t, rawProxyDetailResp.Data["status"],
+		"curConns",
+		"lastCloseAt",
+		"lastStartAt",
+		"phase",
+		"todayTrafficIn",
+		"todayTrafficOut",
+	)
+	proxyDetailResp := decodeResponse[v2EnvelopeForTest[model.V2ProxyResp]](t, resp)
+	if proxyDetailResp.Data.Name != "tcp-alice" || proxyDetailResp.Data.User != "alice" {
+		t.Fatalf("proxy detail mismatch: %#v", proxyDetailResp.Data)
+	}
+	assertRawJSONKeys(t, rawProxyDetailResp.Data, "clientID", "name", "spec", "status", "user")
+	var rawDetailSpec map[string]json.RawMessage
+	if err := json.Unmarshal(rawProxyDetailResp.Data["spec"], &rawDetailSpec); err != nil {
+		t.Fatalf("unmarshal detail proxy spec failed: %v", err)
+	}
+	assertRawJSONKeys(t, rawDetailSpec, "tcp", "type")
+	assertRawJSONKeysFromMessage(t, rawDetailSpec["tcp"])
+	if proxyDetailResp.Data.Status.LastStartAt != 1783504200 || proxyDetailResp.Data.Status.LastCloseAt != 1783504300 {
+		t.Fatalf("proxy detail timestamp mismatch: %#v", proxyDetailResp.Data.Status)
+	}
+
+	resp = performRequest(router, "/api/v2/users?page=1&pageSize=50")
+	userResp := decodeResponse[v2EnvelopeForTest[model.V2PageResp[model.V2UserResp]]](t, resp)
+	if userResp.Data.Total != 3 {
+		t.Fatalf("user total mismatch: %#v", userResp.Data)
+	}
+	expectedProxyCounts := map[string]int{
+		"":      1,
+		"alice": 2,
+		"bob":   1,
+	}
+	for _, item := range userResp.Data.Items {
+		if item.ClientCount != 1 || item.ProxyCount != expectedProxyCounts[item.User] {
+			t.Fatalf("user counts mismatch: %#v", item)
+		}
+	}
+}
+
+func TestAPIV2ProxyTrafficEnvelopeSchemaAndHistory(t *testing.T) {
+	oldStatsCollector := mem.StatsCollector
+	mem.StatsCollector = &fakeStatsCollector{
+		proxies: map[string]*mem.ProxyStats{
+			"ssh": {Name: "ssh", Type: "tcp"},
+		},
+		traffic: map[string]*mem.ProxyTrafficInfo{
+			"ssh": {
+				Name:       "ssh",
+				TrafficIn:  []int64{70, 60, 50, 40, 30, 20, 10},
+				TrafficOut: []int64{700, 600, 500, 400, 300, 200, 100},
+			},
+		},
+	}
+	t.Cleanup(func() {
+		mem.StatsCollector = oldStatsCollector
+	})
+
+	controller := NewController(&v1.ServerConfig{}, registry.NewClientRegistry(), serverproxy.NewManager())
+	router := newV2TestRouter(controller)
+
+	resp := performRequest(router, "/api/v2/proxies/ssh/traffic")
+	if resp.Code != http.StatusOK {
+		t.Fatalf("status mismatch, want %d got %d, body: %s", http.StatusOK, resp.Code, resp.Body.String())
+	}
+	rawResp := decodeResponse[v2EnvelopeForTest[map[string]json.RawMessage]](t, resp)
+	if rawResp.Code != http.StatusOK || rawResp.Msg != "success" {
+		t.Fatalf("envelope mismatch: %#v", rawResp)
+	}
+	assertRawJSONKeys(t, rawResp.Data, "granularity", "history", "name", "unit")
+
+	trafficResp := decodeResponse[v2EnvelopeForTest[model.V2ProxyTrafficResp]](t, resp)
+	if trafficResp.Data.Name != "ssh" || trafficResp.Data.Unit != "bytes" || trafficResp.Data.Granularity != "day" {
+		t.Fatalf("traffic metadata mismatch: %#v", trafficResp.Data)
+	}
+	if len(trafficResp.Data.History) != 7 {
+		t.Fatalf("history length mismatch, want 7 got %d: %#v", len(trafficResp.Data.History), trafficResp.Data.History)
+	}
+
+	wantIn := []int64{10, 20, 30, 40, 50, 60, 70}
+	wantOut := []int64{100, 200, 300, 400, 500, 600, 700}
+	var prevDate time.Time
+	for i, point := range trafficResp.Data.History {
+		assertRawJSONKeysFromMessage(t, mustMarshalJSON(t, point), "date", "trafficIn", "trafficOut")
+		if point.TrafficIn != wantIn[i] || point.TrafficOut != wantOut[i] {
+			t.Fatalf("history[%d] traffic mismatch: %#v", i, point)
+		}
+		parsedDate, err := time.Parse(time.DateOnly, point.Date)
+		if err != nil {
+			t.Fatalf("history[%d] date should be yyyy-mm-dd, got %q: %v", i, point.Date, err)
+		}
+		if i > 0 && !parsedDate.Equal(prevDate.AddDate(0, 0, 1)) {
+			t.Fatalf("history dates should be oldest to newest, got %s after %s", point.Date, prevDate.Format(time.DateOnly))
+		}
+		prevDate = parsedDate
+	}
+}
+
+func TestAPIV2ProxyTrafficNotFoundEnvelope(t *testing.T) {
+	controller := newV2TestController(t)
+	router := newV2TestRouter(controller)
+
+	resp := performRequest(router, "/api/v2/proxies/missing/traffic")
+	if resp.Code != http.StatusNotFound {
+		t.Fatalf("status mismatch, want %d got %d, body: %s", http.StatusNotFound, resp.Code, resp.Body.String())
+	}
+	errResp := decodeResponse[httppkg.V2Response](t, resp)
+	if errResp.Code != http.StatusNotFound || errResp.Msg != "no proxy info found" || errResp.Data != nil {
+		t.Fatalf("not found envelope mismatch: %#v", errResp)
+	}
+}
+
+func TestAPIV2ProxyDetailAndTrafficEncodedName(t *testing.T) {
+	name := "folder/ssh?x#y"
+	oldStatsCollector := mem.StatsCollector
+	mem.StatsCollector = &fakeStatsCollector{
+		proxies: map[string]*mem.ProxyStats{
+			name: {Name: name, Type: "tcp", User: "encoded"},
+		},
+		traffic: map[string]*mem.ProxyTrafficInfo{
+			name: {
+				Name:       name,
+				TrafficIn:  []int64{1},
+				TrafficOut: []int64{2},
+			},
+		},
+	}
+	t.Cleanup(func() {
+		mem.StatsCollector = oldStatsCollector
+	})
+
+	controller := NewController(&v1.ServerConfig{}, registry.NewClientRegistry(), serverproxy.NewManager())
+	router := newV2TestRouter(controller)
+	encodedName := url.PathEscape(name)
+
+	resp := performRequest(router, "/api/v2/proxies/"+encodedName)
+	if resp.Code != http.StatusOK {
+		t.Fatalf("encoded proxy detail status mismatch, want %d got %d, body: %s", http.StatusOK, resp.Code, resp.Body.String())
+	}
+	detailResp := decodeResponse[v2EnvelopeForTest[model.V2ProxyResp]](t, resp)
+	if detailResp.Data.Name != name || detailResp.Data.User != "encoded" {
+		t.Fatalf("encoded proxy detail mismatch: %#v", detailResp.Data)
+	}
+
+	resp = performRequest(router, "/api/v2/proxies/"+encodedName+"/traffic")
+	if resp.Code != http.StatusOK {
+		t.Fatalf("encoded traffic status mismatch, want %d got %d, body: %s", http.StatusOK, resp.Code, resp.Body.String())
+	}
+	trafficResp := decodeResponse[v2EnvelopeForTest[model.V2ProxyTrafficResp]](t, resp)
+	if trafficResp.Data.Name != name {
+		t.Fatalf("encoded traffic name mismatch: %#v", trafficResp.Data)
+	}
+	if got := trafficResp.Data.History[len(trafficResp.Data.History)-1]; got.TrafficIn != 1 || got.TrafficOut != 2 {
+		t.Fatalf("encoded traffic latest point mismatch: %#v", got)
+	}
+}
+
+func TestAPIV2ProxyTrafficInvalidEncodedNameUses400Envelope(t *testing.T) {
+	controller := newV2TestController(t)
+	handler := httppkg.MakeHTTPHandlerFuncV2(controller.APIV2ProxyTraffic)
+	req := httptest.NewRequest(http.MethodGet, "/api/v2/proxies/%25ZZ/traffic", nil)
+	req = mux.SetURLVars(req, map[string]string{"name": "%ZZ"})
+	resp := httptest.NewRecorder()
+	handler.ServeHTTP(resp, req)
+
+	if resp.Code != http.StatusBadRequest {
+		t.Fatalf("status mismatch, want %d got %d, body: %s", http.StatusBadRequest, resp.Code, resp.Body.String())
+	}
+	errResp := decodeResponse[httppkg.V2Response](t, resp)
+	if errResp.Code != http.StatusBadRequest || errResp.Msg != "invalid proxy name" || errResp.Data != nil {
+		t.Fatalf("invalid encoded name envelope mismatch: %#v", errResp)
+	}
+}
+
+func TestMatchV2ProxyQueryMatchesSpecFields(t *testing.T) {
+	tests := []struct {
+		name string
+		item model.V2ProxyResp
+		q    string
+		want bool
+	}{
+		{
+			name: "tcp remote port",
+			item: model.V2ProxyResp{Name: "tcp-proxy", Spec: model.V2ProxySpec{
+				Type: "tcp",
+				TCP:  &model.V2TCPProxySpec{RemotePort: v2TestIntPtr(6000)},
+			}},
+			q:    "6000",
+			want: true,
+		},
+		{
+			name: "udp remote port",
+			item: model.V2ProxyResp{Name: "udp-proxy", Spec: model.V2ProxySpec{
+				Type: "udp",
+				UDP:  &model.V2UDPProxySpec{RemotePort: v2TestIntPtr(7000)},
+			}},
+			q:    "7000",
+			want: true,
+		},
+		{
+			name: "remote port does not match colon form",
+			item: model.V2ProxyResp{Name: "tcp-proxy", Spec: model.V2ProxySpec{
+				Type: "tcp",
+				TCP:  &model.V2TCPProxySpec{RemotePort: v2TestIntPtr(6000)},
+			}},
+			q:    ":6000",
+			want: false,
+		},
+		{
+			name: "http custom domain",
+			item: model.V2ProxyResp{Name: "http-proxy", Spec: model.V2ProxySpec{
+				Type: "http",
+				HTTP: &model.V2HTTPProxySpec{CustomDomains: []string{"app.example.com"}},
+			}},
+			q:    "app.example.com",
+			want: true,
+		},
+		{
+			name: "https subdomain",
+			item: model.V2ProxyResp{Name: "https-proxy", Spec: model.V2ProxySpec{
+				Type:  "https",
+				HTTPS: &model.V2HTTPSProxySpec{Subdomain: "portal"},
+			}},
+			q:    "portal",
+			want: true,
+		},
+		{
+			name: "subdomain does not match expanded host",
+			item: model.V2ProxyResp{Name: "https-proxy", Spec: model.V2ProxySpec{
+				Type:  "https",
+				HTTPS: &model.V2HTTPSProxySpec{Subdomain: "portal"},
+			}},
+			q:    "portal.example.com",
+			want: false,
+		},
+		{
+			name: "tcpmux custom domain",
+			item: model.V2ProxyResp{Name: "tcpmux-proxy", Spec: model.V2ProxySpec{
+				Type:   "tcpmux",
+				TCPMux: &model.V2TCPMuxProxySpec{CustomDomains: []string{"mux.example.com"}},
+			}},
+			q:    "mux.example.com",
+			want: true,
+		},
+		{
+			name: "offline shell does not match online spec fields",
+			item: model.V2ProxyResp{Name: "offline-proxy", Spec: model.V2ProxySpec{
+				Type: "tcp",
+				TCP:  &model.V2TCPProxySpec{},
+			}},
+			q:    "6000",
+			want: false,
+		},
+		{
+			name: "offline shell does not contribute zero remote port",
+			item: model.V2ProxyResp{Name: "offline-proxy", Spec: model.V2ProxySpec{
+				Type: "tcp",
+				TCP:  &model.V2TCPProxySpec{},
+			}},
+			q:    "0",
+			want: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := matchV2ProxyQuery(tt.item, tt.q); got != tt.want {
+				t.Fatalf("matchV2ProxyQuery() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestLegacyAPIResponsesRemainBare(t *testing.T) {
+	controller := newV2TestController(t)
+	router := newV2TestRouter(controller)
+
+	resp := performRequest(router, "/api/serverinfo")
+	var serverInfo model.ServerInfoResp
+	if err := json.Unmarshal(resp.Body.Bytes(), &serverInfo); err != nil {
+		t.Fatalf("legacy serverinfo should be a bare object: %v, body: %s", err, resp.Body.String())
+	}
+	if serverInfo.Version == "" {
+		t.Fatal("legacy serverinfo version should be set")
+	}
+	var serverInfoRaw map[string]json.RawMessage
+	if err := json.Unmarshal(resp.Body.Bytes(), &serverInfoRaw); err != nil {
+		t.Fatalf("unmarshal legacy serverinfo object failed: %v", err)
+	}
+	if _, ok := serverInfoRaw["data"]; ok {
+		t.Fatalf("legacy serverinfo should not use v2 envelope: %s", resp.Body.String())
+	}
+	if _, ok := serverInfoRaw["config"]; ok {
+		t.Fatalf("legacy serverinfo should stay flat, got config in: %s", resp.Body.String())
+	}
+
+	resp = performRequest(router, "/api/clients")
+	var clients []model.ClientInfoResp
+	if err := json.Unmarshal(resp.Body.Bytes(), &clients); err != nil {
+		t.Fatalf("legacy clients should be a bare array: %v, body: %s", err, resp.Body.String())
+	}
+	if len(clients) != 3 {
+		t.Fatalf("legacy clients total mismatch, want 3 got %d", len(clients))
+	}
+
+	resp = performRequest(router, "/api/proxy/tcp")
+	var proxies model.GetProxyInfoResp
+	if err := json.Unmarshal(resp.Body.Bytes(), &proxies); err != nil {
+		t.Fatalf("legacy proxy response should be {proxies}: %v, body: %s", err, resp.Body.String())
+	}
+	if len(proxies.Proxies) != 2 {
+		t.Fatalf("legacy tcp proxy total mismatch, want 2 got %d", len(proxies.Proxies))
+	}
+	var envelope httppkg.V2Response
+	if err := json.Unmarshal(resp.Body.Bytes(), &envelope); err == nil && envelope.Code != 0 {
+		t.Fatalf("legacy proxy response should not use v2 envelope: %#v", envelope)
+	}
+
+	resp = performRequest(router, "/api/traffic/tcp-alice")
+	var traffic model.GetProxyTrafficResp
+	if err := json.Unmarshal(resp.Body.Bytes(), &traffic); err != nil {
+		t.Fatalf("legacy traffic should be a bare object: %v, body: %s", err, resp.Body.String())
+	}
+	if traffic.Name != "tcp-alice" ||
+		len(traffic.TrafficIn) != 2 || traffic.TrafficIn[0] != 7 || traffic.TrafficIn[1] != 6 ||
+		len(traffic.TrafficOut) != 2 || traffic.TrafficOut[0] != 70 || traffic.TrafficOut[1] != 60 {
+		t.Fatalf("legacy traffic should preserve today-first arrays, got: %#v", traffic)
+	}
+	var trafficRaw map[string]json.RawMessage
+	if err := json.Unmarshal(resp.Body.Bytes(), &trafficRaw); err != nil {
+		t.Fatalf("unmarshal legacy traffic object failed: %v", err)
+	}
+	if _, ok := trafficRaw["data"]; ok {
+		t.Fatalf("legacy traffic should not use v2 envelope: %s", resp.Body.String())
+	}
+}
+
+func v2TestIntPtr(value int) *int {
+	return &value
+}
+
+func newV2TestController(t *testing.T) *Controller {
+	t.Helper()
+
+	oldStatsCollector := mem.StatsCollector
+	mem.StatsCollector = &fakeStatsCollector{
+		proxies: map[string]*mem.ProxyStats{
+			"tcp-empty": {
+				Name:            "tcp-empty",
+				Type:            "tcp",
+				User:            "",
+				ClientID:        "legacy-client",
+				TodayTrafficIn:  10,
+				TodayTrafficOut: 20,
+				CurConns:        1,
+			},
+			"tcp-alice": {
+				Name:            "tcp-alice",
+				Type:            "tcp",
+				User:            "alice",
+				ClientID:        "client-a",
+				TodayTrafficIn:  30,
+				TodayTrafficOut: 40,
+				CurConns:        2,
+				LastStartTime:   "07-08 12:30:00",
+				LastCloseTime:   "07-08 12:31:40",
+				LastStartAt:     1783504200,
+				LastCloseAt:     1783504300,
+			},
+			"http-alice": {
+				Name:     "http-alice",
+				Type:     "http",
+				User:     "alice",
+				ClientID: "client-a",
+				CurConns: 3,
+			},
+			"udp-bob": {
+				Name:     "udp-bob",
+				Type:     "udp",
+				User:     "bob",
+				ClientID: "client-b",
+			},
+		},
+		traffic: map[string]*mem.ProxyTrafficInfo{
+			"tcp-alice": {
+				Name:       "tcp-alice",
+				TrafficIn:  []int64{7, 6},
+				TrafficOut: []int64{70, 60},
+			},
+		},
+	}
+	t.Cleanup(func() {
+		mem.StatsCollector = oldStatsCollector
+	})
+
+	clientRegistry := registry.NewClientRegistry()
+	clientRegistry.Register("", "legacy-client", "run-empty", "empty-host", "1.0.0", "127.0.0.1", "v1")
+	clientRegistry.Register("alice", "client-a", "run-a", "alice-host", "1.0.0", "127.0.0.2", "v2")
+	clientRegistry.Register("bob", "client-b", "run-b", "bob-host", "1.0.0", "127.0.0.3", "v1")
+	clientRegistry.MarkOfflineByRunID("run-b")
+
+	return NewController(&v1.ServerConfig{}, clientRegistry, serverproxy.NewManager())
+}
+
+func newV2TestRouter(controller *Controller) *mux.Router {
+	router := mux.NewRouter()
+	router.HandleFunc("/api/v2/users", httppkg.MakeHTTPHandlerFuncV2(controller.APIV2UserList)).Methods(http.MethodGet)
+	router.HandleFunc("/api/v2/system/info", httppkg.MakeHTTPHandlerFuncV2(controller.APIV2SystemInfo)).Methods(http.MethodGet)
+	router.HandleFunc("/api/v2/system/prune", httppkg.MakeHTTPHandlerFuncV2(controller.APIV2SystemPrune)).Methods(http.MethodPost)
+	router.HandleFunc("/api/v2/clients", httppkg.MakeHTTPHandlerFuncV2(controller.APIV2ClientList)).Methods(http.MethodGet)
+	encodedPathRouter := router.NewRoute().Subrouter()
+	encodedPathRouter.UseEncodedPath()
+	encodedPathRouter.HandleFunc("/api/v2/clients/{key}", httppkg.MakeHTTPHandlerFuncV2(controller.APIV2ClientDetail)).Methods(http.MethodGet)
+	router.HandleFunc("/api/v2/proxies", httppkg.MakeHTTPHandlerFuncV2(controller.APIV2ProxyList)).Methods(http.MethodGet)
+	encodedPathRouter.HandleFunc("/api/v2/proxies/{name}/traffic", httppkg.MakeHTTPHandlerFuncV2(controller.APIV2ProxyTraffic)).Methods(http.MethodGet)
+	encodedPathRouter.HandleFunc("/api/v2/proxies/{name}", httppkg.MakeHTTPHandlerFuncV2(controller.APIV2ProxyDetail)).Methods(http.MethodGet)
+	router.HandleFunc("/api/serverinfo", httppkg.MakeHTTPHandlerFunc(controller.APIServerInfo)).Methods(http.MethodGet)
+	router.HandleFunc("/api/clients", httppkg.MakeHTTPHandlerFunc(controller.APIClientList)).Methods(http.MethodGet)
+	router.HandleFunc("/api/proxy/{type}", httppkg.MakeHTTPHandlerFunc(controller.APIProxyByType)).Methods(http.MethodGet)
+	router.HandleFunc("/api/traffic/{name}", httppkg.MakeHTTPHandlerFunc(controller.APIProxyTraffic)).Methods(http.MethodGet)
+	return router
+}
+
+func performRequest(handler http.Handler, target string) *httptest.ResponseRecorder {
+	return performRequestWithMethod(handler, http.MethodGet, target)
+}
+
+func performRequestWithMethod(handler http.Handler, method, target string) *httptest.ResponseRecorder {
+	req := httptest.NewRequest(method, target, nil)
+	resp := httptest.NewRecorder()
+	handler.ServeHTTP(resp, req)
+	return resp
+}
+
+func decodeResponse[T any](t *testing.T, resp *httptest.ResponseRecorder) T {
+	t.Helper()
+
+	var out T
+	if err := json.Unmarshal(resp.Body.Bytes(), &out); err != nil {
+		t.Fatalf("unmarshal response failed: %v, body: %s", err, resp.Body.String())
+	}
+	return out
+}
+
+func assertRawJSONKeys(t *testing.T, raw map[string]json.RawMessage, want ...string) {
+	t.Helper()
+
+	if len(raw) != len(want) {
+		t.Fatalf("json keys mismatch, want %v got %v", want, raw)
+	}
+	for _, key := range want {
+		if _, ok := raw[key]; !ok {
+			t.Fatalf("json key %q missing from %v", key, raw)
+		}
+	}
+}
+
+func assertRawJSONKeysFromMessage(t *testing.T, raw json.RawMessage, want ...string) {
+	t.Helper()
+
+	var out map[string]json.RawMessage
+	if err := json.Unmarshal(raw, &out); err != nil {
+		t.Fatalf("unmarshal raw json object failed: %v, body: %s", err, string(raw))
+	}
+	assertRawJSONKeys(t, out, want...)
+}
+
+func mustMarshalJSON(t *testing.T, value any) json.RawMessage {
+	t.Helper()
+
+	out, err := json.Marshal(value)
+	if err != nil {
+		t.Fatalf("marshal json failed: %v", err)
+	}
+	return out
+}

server/http/model/v2.go

@@ -0,0 +1,179 @@
+// Copyright 2026 The frp Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package model
+
+type V2PageResp[T any] struct {
+	Total    int `json:"total"`
+	Page     int `json:"page"`
+	PageSize int `json:"pageSize"`
+	Items    []T `json:"items"`
+}
+
+type V2SystemInfoResp struct {
+	Version string                 `json:"version"`
+	Config  V2SystemInfoConfigResp `json:"config"`
+	Status  V2SystemInfoStatusResp `json:"status"`
+}
+
+type V2SystemInfoConfigResp struct {
+	BindPort              int    `json:"bindPort"`
+	VhostHTTPPort         int    `json:"vhostHTTPPort"`
+	VhostHTTPSPort        int    `json:"vhostHTTPSPort"`
+	TCPMuxHTTPConnectPort int    `json:"tcpmuxHTTPConnectPort"`
+	KCPBindPort           int    `json:"kcpBindPort"`
+	QUICBindPort          int    `json:"quicBindPort"`
+	SubdomainHost         string `json:"subdomainHost"`
+	MaxPoolCount          int64  `json:"maxPoolCount"`
+	MaxPortsPerClient     int64  `json:"maxPortsPerClient"`
+	HeartbeatTimeout      int64  `json:"heartbeatTimeout"`
+	AllowPortsStr         string `json:"allowPortsStr"`
+	TLSForce              bool   `json:"tlsForce"`
+}
+
+type V2SystemInfoStatusResp struct {
+	TotalTrafficIn  int64            `json:"totalTrafficIn"`
+	TotalTrafficOut int64            `json:"totalTrafficOut"`
+	CurConns        int64            `json:"curConns"`
+	ClientCounts    int64            `json:"clientCounts"`
+	ProxyTypeCounts map[string]int64 `json:"proxyTypeCount"`
+}
+
+type V2SystemPruneResp struct {
+	Type    string `json:"type"`
+	Cleared int    `json:"cleared"`
+	Total   int    `json:"total"`
+}
+
+type V2UserResp struct {
+	User        string `json:"user"`
+	ClientCount int    `json:"clientCount"`
+	ProxyCount  int    `json:"proxyCount"`
+}
+
+type V2ClientDetailResp struct {
+	ClientInfoResp
+	Status V2ClientStatusResp `json:"status"`
+}
+
+type V2ClientStatusResp struct {
+	State      string `json:"phase"`
+	CurConns   int64  `json:"curConns"`
+	ProxyCount int64  `json:"proxyCount"`
+}
+
+type V2ProxyResp struct {
+	Name     string            `json:"name"`
+	User     string            `json:"user"`
+	ClientID string            `json:"clientID"`
+	Spec     V2ProxySpec       `json:"spec"`
+	Status   V2ProxyStatusResp `json:"status"`
+}
+
+type V2ProxySpec struct {
+	Type string `json:"type"`
+
+	TCP    *V2TCPProxySpec    `json:"tcp,omitempty"`
+	UDP    *V2UDPProxySpec    `json:"udp,omitempty"`
+	HTTP   *V2HTTPProxySpec   `json:"http,omitempty"`
+	HTTPS  *V2HTTPSProxySpec  `json:"https,omitempty"`
+	TCPMux *V2TCPMuxProxySpec `json:"tcpmux,omitempty"`
+	STCP   *V2STCPProxySpec   `json:"stcp,omitempty"`
+	SUDP   *V2SUDPProxySpec   `json:"sudp,omitempty"`
+	XTCP   *V2XTCPProxySpec   `json:"xtcp,omitempty"`
+}
+
+type V2ProxyBaseSpec struct {
+	Annotations  map[string]string        `json:"annotations,omitempty"`
+	Metadatas    map[string]string        `json:"metadatas,omitempty"`
+	Transport    *V2ProxyTransportSpec    `json:"transport,omitempty"`
+	LoadBalancer *V2ProxyLoadBalancerSpec `json:"loadBalancer,omitempty"`
+}
+
+type V2ProxyTransportSpec struct {
+	UseEncryption      bool   `json:"useEncryption"`
+	UseCompression     bool   `json:"useCompression"`
+	BandwidthLimit     string `json:"bandwidthLimit"`
+	BandwidthLimitMode string `json:"bandwidthLimitMode"`
+}
+
+type V2ProxyLoadBalancerSpec struct {
+	Group string `json:"group"`
+}
+
+type V2TCPProxySpec struct {
+	V2ProxyBaseSpec
+	RemotePort *int `json:"remotePort,omitempty"`
+}
+
+type V2UDPProxySpec struct {
+	V2ProxyBaseSpec
+	RemotePort *int `json:"remotePort,omitempty"`
+}
+
+type V2HTTPProxySpec struct {
+	V2ProxyBaseSpec
+	CustomDomains     []string `json:"customDomains,omitempty"`
+	Subdomain         string   `json:"subdomain,omitempty"`
+	Locations         []string `json:"locations,omitempty"`
+	HostHeaderRewrite string   `json:"hostHeaderRewrite,omitempty"`
+}
+
+type V2HTTPSProxySpec struct {
+	V2ProxyBaseSpec
+	CustomDomains []string `json:"customDomains,omitempty"`
+	Subdomain     string   `json:"subdomain,omitempty"`
+}
+
+type V2TCPMuxProxySpec struct {
+	V2ProxyBaseSpec
+	CustomDomains   []string `json:"customDomains,omitempty"`
+	Subdomain       string   `json:"subdomain,omitempty"`
+	Multiplexer     string   `json:"multiplexer,omitempty"`
+	RouteByHTTPUser string   `json:"routeByHTTPUser,omitempty"`
+}
+
+type V2STCPProxySpec struct {
+	V2ProxyBaseSpec
+}
+
+type V2SUDPProxySpec struct {
+	V2ProxyBaseSpec
+}
+
+type V2XTCPProxySpec struct {
+	V2ProxyBaseSpec
+}
+
+type V2ProxyStatusResp struct {
+	State           string `json:"phase"`
+	TodayTrafficIn  int64  `json:"todayTrafficIn"`
+	TodayTrafficOut int64  `json:"todayTrafficOut"`
+	CurConns        int64  `json:"curConns"`
+	LastStartAt     int64  `json:"lastStartAt,omitempty"`
+	LastCloseAt     int64  `json:"lastCloseAt,omitempty"`
+}
+
+type V2ProxyTrafficResp struct {
+	Name        string                    `json:"name"`
+	Unit        string                    `json:"unit"`
+	Granularity string                    `json:"granularity"`
+	History     []V2ProxyTrafficPointResp `json:"history"`
+}
+
+type V2ProxyTrafficPointResp struct {
+	Date       string `json:"date"`
+	TrafficIn  int64  `json:"trafficIn"`
+	TrafficOut int64  `json:"trafficOut"`
+}

server/ports/ports.go

@@ -7,6 +7,8 @@ import (
 	"sync"
 	"time"
 
+	"k8s.io/utils/clock"
+
 	"github.com/fatedier/frp/pkg/config/types"
 )
 
@@ -38,16 +40,25 @@ type Manager struct {
 
 	bindAddr string
 	netType  string
+	clock    clock.WithTicker
 	mu       sync.Mutex
 }
 
 func NewManager(netType string, bindAddr string, allowPorts []types.PortsRange) *Manager {
+	return newManagerWithClock(netType, bindAddr, allowPorts, clock.RealClock{})
+}
+
+func newManagerWithClock(netType string, bindAddr string, allowPorts []types.PortsRange, clk clock.WithTicker) *Manager {
+	if clk == nil {
+		clk = clock.RealClock{}
+	}
 	pm := &Manager{
 		reservedPorts: make(map[string]*PortCtx),
 		usedPorts:     make(map[int]*PortCtx),
 		freePorts:     make(map[int]struct{}),
 		bindAddr:      bindAddr,
 		netType:       netType,
+		clock:         clk,
 	}
 	if len(allowPorts) > 0 {
 		for _, pair := range allowPorts {
@@ -72,7 +83,7 @@ func (pm *Manager) Acquire(name string, port int) (realPort int, err error) {
 	portCtx := &PortCtx{
 		ProxyName:  name,
 		Closed:     false,
-		UpdateTime: time.Now(),
+		UpdateTime: pm.clock.Now(),
 	}
 
 	var ok bool
@@ -90,9 +101,7 @@ func (pm *Manager) Acquire(name string, port int) (realPort int, err error) {
 		if ctx, ok := pm.reservedPorts[name]; ok {
 			if pm.isPortAvailable(ctx.Port) {
 				realPort = ctx.Port
-				pm.usedPorts[realPort] = portCtx
-				pm.reservedPorts[name] = portCtx
-				delete(pm.freePorts, realPort)
+				pm.markPortAcquiredLocked(name, realPort, portCtx)
 				return
 			}
 		}
@@ -109,9 +118,7 @@ func (pm *Manager) Acquire(name string, port int) (realPort int, err error) {
 			}
 			if pm.isPortAvailable(k) {
 				realPort = k
-				pm.usedPorts[realPort] = portCtx
-				pm.reservedPorts[name] = portCtx
-				delete(pm.freePorts, realPort)
+				pm.markPortAcquiredLocked(name, realPort, portCtx)
 				break
 			}
 		}
@@ -123,9 +130,7 @@ func (pm *Manager) Acquire(name string, port int) (realPort int, err error) {
 		if _, ok = pm.freePorts[port]; ok {
 			if pm.isPortAvailable(port) {
 				realPort = port
-				pm.usedPorts[realPort] = portCtx
-				pm.reservedPorts[name] = portCtx
-				delete(pm.freePorts, realPort)
+				pm.markPortAcquiredLocked(name, realPort, portCtx)
 			} else {
 				err = ErrPortUnAvailable
 			}
@@ -140,6 +145,13 @@ func (pm *Manager) Acquire(name string, port int) (realPort int, err error) {
 	return
 }
 
+// markPortAcquiredLocked records a successful acquisition. pm.mu must be held.
+func (pm *Manager) markPortAcquiredLocked(name string, port int, portCtx *PortCtx) {
+	pm.usedPorts[port] = portCtx
+	pm.reservedPorts[name] = portCtx
+	delete(pm.freePorts, port)
+}
+
 func (pm *Manager) isPortAvailable(port int) bool {
 	if pm.netType == "udp" {
 		addr, err := net.ResolveUDPAddr("udp", net.JoinHostPort(pm.bindAddr, strconv.Itoa(port)))
@@ -169,20 +181,36 @@ func (pm *Manager) Release(port int) {
 		pm.freePorts[port] = struct{}{}
 		delete(pm.usedPorts, port)
 		ctx.Closed = true
-		ctx.UpdateTime = time.Now()
+		ctx.UpdateTime = pm.clock.Now()
 	}
 }
 
 // Release reserved port if it isn't used in last 24 hours.
 func (pm *Manager) cleanReservedPortsWorker() {
+	pm.cleanReservedPortsWorkerUntil(nil)
+}
+
+func (pm *Manager) cleanReservedPortsWorkerUntil(stopCh <-chan struct{}) {
+	ticker := pm.clock.NewTicker(CleanReservedPortsInterval)
+	defer ticker.Stop()
+
 	for {
-		time.Sleep(CleanReservedPortsInterval)
+		select {
+		case <-ticker.C():
+			pm.cleanReservedPortsOnce()
+		case <-stopCh:
+			return
+		}
+	}
+}
+
+func (pm *Manager) cleanReservedPortsOnce() {
 	pm.mu.Lock()
+	defer pm.mu.Unlock()
+
 	for name, ctx := range pm.reservedPorts {
-			if ctx.Closed && time.Since(ctx.UpdateTime) > MaxPortReservedDuration {
+		if ctx.Closed && pm.clock.Since(ctx.UpdateTime) > MaxPortReservedDuration {
 			delete(pm.reservedPorts, name)
 		}
 	}
-		pm.mu.Unlock()
-	}
 }

server/ports/ports_test.go

@@ -0,0 +1,72 @@
+package ports
+
+import (
+	"net"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	clocktesting "k8s.io/utils/clock/testing"
+
+	"github.com/fatedier/frp/pkg/config/types"
+)
+
+func TestManagerUsesClockForPortTimestamps(t *testing.T) {
+	require := require.New(t)
+
+	port := freeTCPPort(t)
+	start := time.Date(2026, time.May, 8, 12, 30, 0, 0, time.UTC)
+	clk := clocktesting.NewFakeClock(start)
+	pm := newManagerWithClock("tcp", "127.0.0.1", []types.PortsRange{{Single: port}}, clk)
+
+	realPort, err := pm.Acquire("proxy", port)
+	require.NoError(err)
+	require.Equal(port, realPort)
+	require.Equal(start, pm.usedPorts[port].UpdateTime)
+
+	releasedAt := start.Add(time.Minute)
+	clk.SetTime(releasedAt)
+	pm.Release(port)
+
+	require.Equal(releasedAt, pm.reservedPorts["proxy"].UpdateTime)
+}
+
+func TestManagerCleanReservedPortsWorkerUsesClockTicker(t *testing.T) {
+	require := require.New(t)
+
+	port := freeTCPPort(t)
+	start := time.Date(2026, time.May, 8, 12, 30, 0, 0, time.UTC)
+	clk := clocktesting.NewFakeClock(start)
+	pm := newManagerWithClock("tcp", "127.0.0.1", []types.PortsRange{{Single: port}}, clk)
+
+	realPort, err := pm.Acquire("proxy", port)
+	require.NoError(err)
+	require.Equal(port, realPort)
+	pm.Release(port)
+	require.True(pm.hasReservedPort("proxy"))
+
+	require.Eventually(clk.HasWaiters, time.Second, time.Millisecond)
+	clk.Step(MaxPortReservedDuration + CleanReservedPortsInterval + time.Minute)
+
+	require.Eventually(func() bool {
+		return !pm.hasReservedPort("proxy")
+	}, time.Second, time.Millisecond)
+}
+
+func (pm *Manager) hasReservedPort(name string) bool {
+	pm.mu.Lock()
+	defer pm.mu.Unlock()
+
+	_, ok := pm.reservedPorts[name]
+	return ok
+}
+
+func freeTCPPort(t *testing.T) int {
+	t.Helper()
+
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	defer listener.Close()
+
+	return listener.Addr().(*net.TCPAddr).Port
+}

server/proxy/proxy.go

@@ -16,6 +16,7 @@ package proxy
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"net"
@@ -31,6 +32,7 @@ import (
 	v1 "github.com/fatedier/frp/pkg/config/v1"
 	"github.com/fatedier/frp/pkg/msg"
 	plugin "github.com/fatedier/frp/pkg/plugin/server"
+	"github.com/fatedier/frp/pkg/proto/wire"
 	"github.com/fatedier/frp/pkg/util/limit"
 	netpkg "github.com/fatedier/frp/pkg/util/net"
 	"github.com/fatedier/frp/pkg/util/xlog"
@@ -92,6 +94,7 @@ type BaseProxy struct {
 	userInfo      plugin.UserInfo
 	loginMsg      *msg.Login
 	configurer    v1.ProxyConfigurer
+	wireProtocol  string
 
 	mu  sync.RWMutex
 	xl  *xlog.Logger
@@ -315,13 +318,147 @@ func (pxy *BaseProxy) handleUserTCPConnection(userConn net.Conn) {
 	name := pxy.GetName()
 	proxyType := cfg.Type
 	metrics.Server.OpenConnection(name, proxyType)
-	inCount, outCount, _ := libio.Join(local, userConn)
+	inCount, outCount, _ := pxy.joinUserConnection(local, userConn, proxyType, xl)
 	metrics.Server.CloseConnection(name, proxyType)
 	metrics.Server.AddTrafficIn(name, proxyType, inCount)
 	metrics.Server.AddTrafficOut(name, proxyType, outCount)
 	xl.Debugf("join connections closed")
 }
 
+func (pxy *BaseProxy) joinUserConnection(local io.ReadWriteCloser, userConn net.Conn, proxyType string, xl *xlog.Logger) (int64, int64, []error) {
+	visitorWireProtocol := wireProtocolFromConn(userConn)
+	if proxyType == string(v1.ProxyTypeSUDP) && isMixedWireProtocol(pxy.wireProtocol, visitorWireProtocol) {
+		xl.Infof("bridge mixed SUDP payload codecs, proxy wireProtocol [%s], visitor wireProtocol [%s]",
+			normalizeWireProtocol(pxy.wireProtocol), normalizeWireProtocol(visitorWireProtocol))
+		return joinSUDPMessageBridge(local, userConn, pxy.wireProtocol, visitorWireProtocol, xl)
+	}
+	return libio.Join(local, userConn)
+}
+
+type wireProtocolGetter interface {
+	WireProtocol() string
+}
+
+func wireProtocolFromConn(conn net.Conn) string {
+	if getter, ok := conn.(wireProtocolGetter); ok {
+		return getter.WireProtocol()
+	}
+	return ""
+}
+
+func isMixedWireProtocol(left, right string) bool {
+	return normalizeWireProtocol(left) != normalizeWireProtocol(right)
+}
+
+func normalizeWireProtocol(wireProtocol string) string {
+	if wireProtocol == wire.ProtocolV2 {
+		return wire.ProtocolV2
+	}
+	return wire.ProtocolV1
+}
+
+func joinSUDPMessageBridge(
+	proxyConn io.ReadWriteCloser,
+	visitorConn io.ReadWriteCloser,
+	proxyWireProtocol string,
+	visitorWireProtocol string,
+	xl *xlog.Logger,
+) (inCount int64, outCount int64, errs []error) {
+	// The mixed bridge decodes and re-encodes messages, so raw framed byte counts
+	// are not available. Count UDP payload bytes and ignore heartbeat traffic.
+	proxyRW := msg.NewReadWriter(proxyConn, proxyWireProtocol)
+	visitorRW := msg.NewReadWriter(visitorConn, visitorWireProtocol)
+
+	var (
+		once       sync.Once
+		wait       sync.WaitGroup
+		recordErrs = make([]error, 2)
+	)
+	closeBoth := func() {
+		_ = proxyConn.Close()
+		_ = visitorConn.Close()
+	}
+
+	wait.Add(2)
+	go func() {
+		defer wait.Done()
+		defer once.Do(closeBoth)
+		recordErrs[0] = bridgeSUDPProxyToVisitor(proxyRW, visitorRW, &outCount, xl)
+	}()
+	go func() {
+		defer wait.Done()
+		defer once.Do(closeBoth)
+		recordErrs[1] = bridgeSUDPVisitorToProxy(visitorRW, proxyRW, &inCount, xl)
+	}()
+	wait.Wait()
+
+	for _, err := range recordErrs {
+		if err != nil {
+			errs = append(errs, err)
+		}
+	}
+	return
+}
+
+func bridgeSUDPProxyToVisitor(from msg.ReadWriter, to msg.ReadWriter, count *int64, xl *xlog.Logger) error {
+	for {
+		rawMsg, err := from.ReadMsg()
+		if err != nil {
+			return normalizeSUDPBridgeError(err)
+		}
+
+		switch m := rawMsg.(type) {
+		case *msg.UDPPacket:
+			if err := to.WriteMsg(m); err != nil {
+				return normalizeSUDPBridgeError(err)
+			}
+			*count += int64(len(m.Content))
+		case *msg.Ping:
+			traceSUDPBridge(xl, "bridge SUDP ping from proxy to visitor")
+			if err := to.WriteMsg(m); err != nil {
+				return normalizeSUDPBridgeError(err)
+			}
+		default:
+			return fmt.Errorf("unexpected SUDP proxy message %T", rawMsg)
+		}
+	}
+}
+
+func bridgeSUDPVisitorToProxy(from msg.ReadWriter, to msg.ReadWriter, count *int64, xl *xlog.Logger) error {
+	for {
+		rawMsg, err := from.ReadMsg()
+		if err != nil {
+			return normalizeSUDPBridgeError(err)
+		}
+
+		switch m := rawMsg.(type) {
+		case *msg.UDPPacket:
+			if err := to.WriteMsg(m); err != nil {
+				return normalizeSUDPBridgeError(err)
+			}
+			*count += int64(len(m.Content))
+		case *msg.Ping:
+			traceSUDPBridge(xl, "drop SUDP ping from visitor to proxy")
+			continue
+		default:
+			return fmt.Errorf("unexpected SUDP visitor message %T", rawMsg)
+		}
+	}
+}
+
+func normalizeSUDPBridgeError(err error) error {
+	if err == nil || errors.Is(err, io.EOF) || errors.Is(err, net.ErrClosed) {
+		return nil
+	}
+	return err
+}
+
+func traceSUDPBridge(xl *xlog.Logger, format string, args ...any) {
+	if xl != nil {
+		xl.Tracef(format, args...)
+	}
+}
+
 type Options struct {
 	UserInfo           plugin.UserInfo
 	LoginMsg           *msg.Login
@@ -331,6 +468,7 @@ type Options struct {
 	Configurer         v1.ProxyConfigurer
 	ServerCfg          *v1.ServerConfig
 	EncryptionKey      []byte
+	WireProtocol       string
 }
 
 func NewProxy(ctx context.Context, options *Options) (pxy Proxy, err error) {
@@ -357,6 +495,7 @@ func NewProxy(ctx context.Context, options *Options) (pxy Proxy, err error) {
 		userInfo:      options.UserInfo,
 		loginMsg:      options.LoginMsg,
 		configurer:    configurer,
+		wireProtocol:  options.WireProtocol,
 	}
 
 	factory := proxyFactoryRegistry[reflect.TypeOf(configurer)]

server/proxy/proxy_test.go

@@ -15,12 +15,15 @@
 package proxy
 
 import (
+	"context"
 	"net"
 	"testing"
 
 	"github.com/stretchr/testify/require"
 
+	v1 "github.com/fatedier/frp/pkg/config/v1"
 	"github.com/fatedier/frp/pkg/msg"
+	"github.com/fatedier/frp/pkg/proto/wire"
 )
 
 func TestWorkConnStartWritesStartWorkConn(t *testing.T) {
@@ -51,3 +54,56 @@ func TestWorkConnStartWritesStartWorkConn(t *testing.T) {
 	require.NoError(t, result.err)
 	require.Same(t, serverMsgConn, result.conn)
 }
+
+func TestGetWorkConnFromPoolStartWorkConnUnchangedForUDPWireV2(t *testing.T) {
+	startMsg := getStartWorkConnFromPool(t, &v1.UDPProxyConfig{
+		ProxyBaseConfig: v1.ProxyBaseConfig{Name: "udp", Type: string(v1.ProxyTypeUDP)},
+	}, wire.ProtocolV2)
+
+	require.Equal(t, msg.StartWorkConn{ProxyName: "udp"}, startMsg)
+}
+
+func TestGetWorkConnFromPoolLeavesRawTCPPayloadUnframed(t *testing.T) {
+	startMsg := getStartWorkConnFromPool(t, &v1.TCPProxyConfig{
+		ProxyBaseConfig: v1.ProxyBaseConfig{Name: "tcp", Type: string(v1.ProxyTypeTCP)},
+	}, wire.ProtocolV2)
+
+	require.Equal(t, msg.StartWorkConn{ProxyName: "tcp"}, startMsg)
+}
+
+func getStartWorkConnFromPool(t *testing.T, cfg v1.ProxyConfigurer, wireProtocol string) msg.StartWorkConn {
+	t.Helper()
+
+	client, server := net.Pipe()
+	t.Cleanup(func() {
+		client.Close()
+		server.Close()
+	})
+
+	serverMsgConn := msg.NewConn(server, msg.NewV2ReadWriter(server))
+	clientMsgConn := msg.NewConn(client, msg.NewV2ReadWriter(client))
+	pxy := &BaseProxy{
+		name:         cfg.GetBaseConfig().Name,
+		configurer:   cfg,
+		poolCount:    0,
+		ctx:          context.Background(),
+		wireProtocol: wireProtocol,
+		getWorkConnFn: func() (*WorkConn, error) {
+			return NewWorkConn(serverMsgConn), nil
+		},
+	}
+
+	errCh := make(chan error, 1)
+	go func() {
+		conn, err := pxy.GetWorkConnFromPool(nil, nil)
+		if conn != nil {
+			conn.Close()
+		}
+		errCh <- err
+	}()
+
+	var startMsg msg.StartWorkConn
+	require.NoError(t, clientMsgConn.ReadMsgInto(&startMsg))
+	require.NoError(t, <-errCh)
+	return startMsg
+}

server/proxy/sudp_test.go

@@ -0,0 +1,141 @@
+// Copyright 2026 The frp Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package proxy
+
+import (
+	"bufio"
+	"bytes"
+	"encoding/binary"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/fatedier/frp/pkg/msg"
+	"github.com/fatedier/frp/pkg/proto/wire"
+)
+
+func TestSUDPBridgeTranscodesProxyV1ToVisitorV2(t *testing.T) {
+	var in, out bytes.Buffer
+	writeSUDPBridgeMsg(t, &in, wire.ProtocolV1, &msg.UDPPacket{Content: []byte("proxy-to-visitor")})
+
+	var count int64
+	err := bridgeSUDPProxyToVisitor(
+		msg.NewReadWriter(&in, wire.ProtocolV1),
+		msg.NewReadWriter(&out, wire.ProtocolV2),
+		&count,
+		nil,
+	)
+	require.NoError(t, err)
+	require.Equal(t, int64(len("proxy-to-visitor")), count)
+
+	frame, err := wire.NewConn(&out).ReadFrame()
+	require.NoError(t, err)
+	require.Equal(t, wire.FrameTypeMessage, frame.Type)
+	require.GreaterOrEqual(t, len(frame.Payload), 2)
+	require.Equal(t, msg.V2TypeUDPPacket, binary.BigEndian.Uint16(frame.Payload[:2]))
+
+	var got msg.UDPPacket
+	require.NoError(t, msg.DecodeV2MessageFrameInto(frame, &got))
+	require.Equal(t, []byte("proxy-to-visitor"), got.Content)
+}
+
+func TestSUDPBridgeTranscodesVisitorV2ToProxyV1(t *testing.T) {
+	var in, out bytes.Buffer
+	writeSUDPBridgeMsg(t, &in, wire.ProtocolV2, &msg.UDPPacket{Content: []byte("visitor-to-proxy")})
+
+	var count int64
+	err := bridgeSUDPVisitorToProxy(
+		msg.NewReadWriter(&in, wire.ProtocolV2),
+		msg.NewReadWriter(&out, wire.ProtocolV1),
+		&count,
+		nil,
+	)
+	require.NoError(t, err)
+	require.Equal(t, int64(len("visitor-to-proxy")), count)
+
+	reader := bufio.NewReader(&out)
+	typeByte, err := reader.ReadByte()
+	require.NoError(t, err)
+	require.Equal(t, msg.TypeUDPPacket, typeByte)
+	require.NoError(t, reader.UnreadByte())
+
+	var got msg.UDPPacket
+	require.NoError(t, msg.ReadMsgInto(reader, &got))
+	require.Equal(t, []byte("visitor-to-proxy"), got.Content)
+}
+
+func TestSUDPBridgeForwardsProxyPing(t *testing.T) {
+	var in, out bytes.Buffer
+	writeSUDPBridgeMsg(t, &in, wire.ProtocolV1, &msg.Ping{})
+
+	var count int64
+	err := bridgeSUDPProxyToVisitor(
+		msg.NewReadWriter(&in, wire.ProtocolV1),
+		msg.NewReadWriter(&out, wire.ProtocolV2),
+		&count,
+		nil,
+	)
+	require.NoError(t, err)
+	require.Zero(t, count)
+
+	rawMsg, err := msg.NewReadWriter(&out, wire.ProtocolV2).ReadMsg()
+	require.NoError(t, err)
+	require.IsType(t, &msg.Ping{}, rawMsg)
+}
+
+func TestSUDPBridgeDropsVisitorPing(t *testing.T) {
+	var in, out bytes.Buffer
+	writeSUDPBridgeMsg(t, &in, wire.ProtocolV2, &msg.Ping{})
+
+	var count int64
+	err := bridgeSUDPVisitorToProxy(
+		msg.NewReadWriter(&in, wire.ProtocolV2),
+		msg.NewReadWriter(&out, wire.ProtocolV1),
+		&count,
+		nil,
+	)
+	require.NoError(t, err)
+	require.Zero(t, count)
+	require.Empty(t, out.Bytes())
+}
+
+func TestSUDPBridgeRejectsUnknownVisitorMessage(t *testing.T) {
+	var in, out bytes.Buffer
+	writeSUDPBridgeMsg(t, &in, wire.ProtocolV2, &msg.Pong{})
+
+	var count int64
+	err := bridgeSUDPVisitorToProxy(
+		msg.NewReadWriter(&in, wire.ProtocolV2),
+		msg.NewReadWriter(&out, wire.ProtocolV1),
+		&count,
+		nil,
+	)
+	require.ErrorContains(t, err, "unexpected SUDP visitor message *msg.Pong")
+	require.Zero(t, count)
+	require.Empty(t, out.Bytes())
+}
+
+func TestSUDPBridgeDetectsMixedWireProtocol(t *testing.T) {
+	require.False(t, isMixedWireProtocol("", wire.ProtocolV1))
+	require.False(t, isMixedWireProtocol(wire.ProtocolV2, wire.ProtocolV2))
+	require.True(t, isMixedWireProtocol("", wire.ProtocolV2))
+	require.True(t, isMixedWireProtocol(wire.ProtocolV2, wire.ProtocolV1))
+}
+
+func writeSUDPBridgeMsg(t *testing.T, buf *bytes.Buffer, wireProtocol string, m msg.Message) {
+	t.Helper()
+
+	require.NoError(t, msg.NewReadWriter(buf, wireProtocol).WriteMsg(m))
+}

server/proxy/udp.go

@@ -108,7 +108,7 @@ func (pxy *UDPProxy) Run() (remoteAddr string, err error) {
 	pxy.checkCloseCh = make(chan int)
 
 	// read message from workConn, if it returns any error, notify proxy to start a new workConn
-	workConnReaderFn := func(conn net.Conn) {
+	workConnReaderFn := func(payloadConn *msg.Conn) {
 		for {
 			var (
 				rawMsg msg.Message
@@ -116,10 +116,10 @@ func (pxy *UDPProxy) Run() (remoteAddr string, err error) {
 			)
 			xl.Tracef("loop waiting message from udp workConn")
 			// client will send heartbeat in workConn for keeping alive
-			_ = conn.SetReadDeadline(time.Now().Add(time.Duration(60) * time.Second))
-			if rawMsg, errRet = msg.ReadMsg(conn); errRet != nil {
+			_ = payloadConn.SetReadDeadline(time.Now().Add(time.Duration(60) * time.Second))
+			if rawMsg, errRet = payloadConn.ReadMsg(); errRet != nil {
 				xl.Warnf("read from workConn for udp error: %v", errRet)
-				_ = conn.Close()
+				_ = payloadConn.Close()
 				// notify proxy to start a new work connection
 				// ignore error here, it means the proxy is closed
 				_ = errors.PanicToError(func() {
@@ -127,7 +127,7 @@ func (pxy *UDPProxy) Run() (remoteAddr string, err error) {
 				})
 				return
 			}
-			if err := conn.SetReadDeadline(time.Time{}); err != nil {
+			if err := payloadConn.SetReadDeadline(time.Time{}); err != nil {
 				xl.Warnf("set read deadline error: %v", err)
 			}
 			switch m := rawMsg.(type) {
@@ -144,7 +144,7 @@ func (pxy *UDPProxy) Run() (remoteAddr string, err error) {
 						int64(len(m.Content)),
 					)
 				}); errRet != nil {
-					conn.Close()
+					_ = payloadConn.Close()
 					xl.Infof("reader goroutine for udp work connection closed")
 					return
 				}
@@ -153,7 +153,7 @@ func (pxy *UDPProxy) Run() (remoteAddr string, err error) {
 	}
 
 	// send message to workConn
-	workConnSenderFn := func(conn net.Conn, ctx context.Context) {
+	workConnSenderFn := func(payloadConn *msg.Conn, ctx context.Context) {
 		var errRet error
 		for {
 			select {
@@ -162,9 +162,9 @@ func (pxy *UDPProxy) Run() (remoteAddr string, err error) {
 					xl.Infof("sender goroutine for udp work connection closed")
 					return
 				}
-				if errRet = msg.WriteMsg(conn, udpMsg); errRet != nil {
+				if errRet = payloadConn.WriteMsg(udpMsg); errRet != nil {
 					xl.Infof("sender goroutine for udp work connection closed: %v", errRet)
-					conn.Close()
+					_ = payloadConn.Close()
 					return
 				}
 				xl.Tracef("send message to udp workConn, len: %d", len(udpMsg.Content))
@@ -223,9 +223,11 @@ func (pxy *UDPProxy) Run() (remoteAddr string, err error) {
 			}
 
 			pxy.workConn = netpkg.WrapReadWriteCloserToConn(rwc, workConn)
+			// Plain UDP payload follows the negotiated wire protocol for message framing.
+			payloadConn := msg.NewConn(pxy.workConn, msg.NewReadWriter(pxy.workConn, pxy.wireProtocol))
 			ctx, cancel := context.WithCancel(context.Background())
-			go workConnReaderFn(pxy.workConn)
-			go workConnSenderFn(pxy.workConn, ctx)
+			go workConnReaderFn(payloadConn)
+			go workConnSenderFn(payloadConn, ctx)
 			_, ok := <-pxy.checkCloseCh
 			cancel()
 			if !ok {

server/proxy/xtcp.go

@@ -16,6 +16,7 @@ package proxy
 
 import (
 	"fmt"
+	"net"
 	"reflect"
 	"sync"
 
@@ -73,10 +74,7 @@ func (pxy *XTCPProxy) Run() (remoteAddr string, err error) {
 				if errRet != nil {
 					continue
 				}
-				m := &msg.NatHoleSid{
-					Sid: sid,
-				}
-				errRet = msg.WriteMsg(workConn, m)
+				errRet = writeNatHoleSid(workConn, pxy.wireProtocol, sid)
 				if errRet != nil {
 					xl.Warnf("write nat hole sid package error, %v", errRet)
 				}
@@ -87,6 +85,13 @@ func (pxy *XTCPProxy) Run() (remoteAddr string, err error) {
 	return
 }
 
+func writeNatHoleSid(workConn net.Conn, wireProtocol string, sid string) error {
+	workMsgConn := msg.NewConn(workConn, msg.NewReadWriter(workConn, wireProtocol))
+	return workMsgConn.WriteMsg(&msg.NatHoleSid{
+		Sid: sid,
+	})
+}
+
 func (pxy *XTCPProxy) Close() {
 	pxy.closeOnce.Do(func() {
 		pxy.BaseProxy.Close()

server/proxy/xtcp_test.go

@@ -0,0 +1,93 @@
+// Copyright 2026 The frp Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package proxy
+
+import (
+	"bufio"
+	"encoding/binary"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/fatedier/frp/pkg/msg"
+	"github.com/fatedier/frp/pkg/proto/wire"
+)
+
+func TestWriteNatHoleSidUsesWireV2MessageFrame(t *testing.T) {
+	client, server := net.Pipe()
+	defer client.Close()
+	defer server.Close()
+	setPipeDeadline(t, client, server)
+
+	errCh := make(chan error, 1)
+	go func() {
+		errCh <- writeNatHoleSid(server, wire.ProtocolV2, "sid-v2")
+	}()
+
+	frame, err := wire.NewConn(client).ReadFrame()
+	require.NoError(t, err)
+	require.Equal(t, wire.FrameTypeMessage, frame.Type)
+	require.GreaterOrEqual(t, len(frame.Payload), 2)
+	require.Equal(t, msg.V2TypeNatHoleSid, binary.BigEndian.Uint16(frame.Payload[:2]))
+
+	var out msg.NatHoleSid
+	require.NoError(t, msg.DecodeV2MessageFrameInto(frame, &out))
+	require.Equal(t, "sid-v2", out.Sid)
+	require.NoError(t, <-errCh)
+}
+
+func TestWriteNatHoleSidUsesLegacyCodecForWireV1AndDefault(t *testing.T) {
+	for _, tc := range []struct {
+		name         string
+		wireProtocol string
+	}{
+		{name: "default", wireProtocol: ""},
+		{name: "v1", wireProtocol: wire.ProtocolV1},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			client, server := net.Pipe()
+			defer client.Close()
+			defer server.Close()
+			setPipeDeadline(t, client, server)
+
+			errCh := make(chan error, 1)
+			go func() {
+				errCh <- writeNatHoleSid(server, tc.wireProtocol, "sid-legacy")
+			}()
+
+			reader := bufio.NewReader(client)
+			typeByte, err := reader.ReadByte()
+			require.NoError(t, err)
+			require.Equal(t, msg.TypeNatHoleSid, typeByte)
+			require.NoError(t, reader.UnreadByte())
+
+			var out msg.NatHoleSid
+			require.NoError(t, msg.ReadMsgInto(reader, &out))
+			require.Equal(t, "sid-legacy", out.Sid)
+			require.NoError(t, <-errCh)
+		})
+	}
+}
+
+func setPipeDeadline(t *testing.T, conns ...net.Conn) {
+	t.Helper()
+
+	deadline := time.Now().Add(time.Second)
+	for _, conn := range conns {
+		require.NoError(t, conn.SetDeadline(deadline))
+	}
+}

server/registry/registry.go

@@ -18,6 +18,8 @@ import (
 	"fmt"
 	"sync"
 	"time"
+
+	"k8s.io/utils/clock"
 )
 
 // ClientInfo captures metadata about a connected frpc instance.
@@ -26,6 +28,7 @@ type ClientInfo struct {
 	User             string
 	RawClientID      string
 	RunID            string
+	ControlID        uint64
 	Hostname         string
 	IP               string
 	Version          string
@@ -42,17 +45,36 @@ type ClientRegistry struct {
 	mu       sync.RWMutex
 	clients  map[string]*ClientInfo
 	runIndex map[string]string
+	clock    clock.PassiveClock
 }
 
 func NewClientRegistry() *ClientRegistry {
+	return newClientRegistryWithClock(clock.RealClock{})
+}
+
+func newClientRegistryWithClock(clk clock.PassiveClock) *ClientRegistry {
+	if clk == nil {
+		clk = clock.RealClock{}
+	}
 	return &ClientRegistry{
 		clients:  make(map[string]*ClientInfo),
 		runIndex: make(map[string]string),
+		clock:    clk,
 	}
 }
 
 // Register stores/updates metadata for a client and returns the registry key plus whether it conflicts with an online client.
 func (cr *ClientRegistry) Register(user, rawClientID, runID, hostname, version, remoteAddr, wireProtocol string) (key string, conflict bool) {
+	return cr.RegisterWithControlID(user, rawClientID, runID, hostname, version, remoteAddr, wireProtocol, 0)
+}
+
+// RegisterWithControlID is the generation-aware form used by ControlManager.
+// A control ID is process-local and prevents an older control generation from
+// changing the registry entry now owned by a newer generation with the same run ID.
+func (cr *ClientRegistry) RegisterWithControlID(
+	user, rawClientID, runID, hostname, version, remoteAddr, wireProtocol string,
+	controlID uint64,
+) (key string, conflict bool) {
 	if runID == "" {
 		return "", false
 	}
@@ -64,7 +86,7 @@ func (cr *ClientRegistry) Register(user, rawClientID, runID, hostname, version,
 	key = cr.composeClientKey(user, effectiveID)
 	enforceUnique := rawClientID != ""
 
-	now := time.Now()
+	now := cr.clock.Now()
 	cr.mu.Lock()
 	defer cr.mu.Unlock()
 
@@ -72,6 +94,16 @@ func (cr *ClientRegistry) Register(user, rawClientID, runID, hostname, version,
 	if enforceUnique && exists && info.Online && info.RunID != "" && info.RunID != runID {
 		return key, true
 	}
+	if previousKey, ok := cr.runIndex[runID]; ok && previousKey != key {
+		if previous, ok := cr.clients[previousKey]; ok && previous.RunID == runID {
+			if previous.RawClientID == "" {
+				delete(cr.clients, previousKey)
+			} else {
+				setClientOffline(previous, now)
+			}
+		}
+		delete(cr.runIndex, runID)
+	}
 
 	if !exists {
 		info = &ClientInfo{
@@ -86,6 +118,7 @@ func (cr *ClientRegistry) Register(user, rawClientID, runID, hostname, version,
 
 	info.RawClientID = rawClientID
 	info.RunID = runID
+	info.ControlID = controlID
 	info.Hostname = hostname
 	info.IP = remoteAddr
 	info.Version = version
@@ -103,6 +136,16 @@ func (cr *ClientRegistry) Register(user, rawClientID, runID, hostname, version,
 
 // MarkOfflineByRunID marks the client as offline when the corresponding control disconnects.
 func (cr *ClientRegistry) MarkOfflineByRunID(runID string) {
+	cr.markOfflineByRunID(runID, 0, false)
+}
+
+// MarkOfflineByRunIDAndControlID marks a client offline only when the registry
+// entry still belongs to the supplied control generation.
+func (cr *ClientRegistry) MarkOfflineByRunIDAndControlID(runID string, controlID uint64) {
+	cr.markOfflineByRunID(runID, controlID, true)
+}
+
+func (cr *ClientRegistry) markOfflineByRunID(runID string, controlID uint64, matchControlID bool) {
 	cr.mu.Lock()
 	defer cr.mu.Unlock()
 
@@ -110,17 +153,23 @@ func (cr *ClientRegistry) MarkOfflineByRunID(runID string) {
 	if !ok {
 		return
 	}
-	if info, ok := cr.clients[key]; ok && info.RunID == runID {
+	if info, ok := cr.clients[key]; ok && info.RunID == runID && (!matchControlID || info.ControlID == controlID) {
 		if info.RawClientID == "" {
 			delete(cr.clients, key)
 		} else {
-			info.RunID = ""
-			info.Online = false
-			now := time.Now()
-			info.DisconnectedAt = now
+			setClientOffline(info, cr.clock.Now())
 		}
 	}
+	if info, ok := cr.clients[key]; !ok || info.RunID != runID {
 		delete(cr.runIndex, runID)
+	}
+}
+
+func setClientOffline(info *ClientInfo, now time.Time) {
+	info.RunID = ""
+	info.ControlID = 0
+	info.Online = false
+	info.DisconnectedAt = now
 }
 
 // List returns a snapshot of all known clients.

server/registry/registry_test.go

@@ -16,6 +16,9 @@ package registry
 
 import (
 	"testing"
+	"time"
+
+	clocktesting "k8s.io/utils/clock/testing"
 
 	"github.com/fatedier/frp/pkg/proto/wire"
 )
@@ -35,3 +38,123 @@ func TestClientRegistryRegisterStoresWireProtocol(t *testing.T) {
 		t.Fatalf("wire protocol mismatch, want %q got %q", wire.ProtocolV2, info.WireProtocol)
 	}
 }
+
+func TestClientRegistryUsesClockForTimestamps(t *testing.T) {
+	start := time.Date(2026, time.May, 8, 12, 30, 0, 0, time.UTC)
+	clk := clocktesting.NewFakeClock(start)
+	registry := newClientRegistryWithClock(clk)
+
+	key, conflict := registry.Register("user", "client-id", "run-id", "host", "1.0.0", "127.0.0.1", wire.ProtocolV2)
+	if conflict {
+		t.Fatal("unexpected client conflict")
+	}
+
+	info, ok := registry.GetByKey(key)
+	if !ok {
+		t.Fatalf("client %q not found", key)
+	}
+	if !info.FirstConnectedAt.Equal(start) {
+		t.Fatalf("first connected time mismatch, want %s got %s", start, info.FirstConnectedAt)
+	}
+	if !info.LastConnectedAt.Equal(start) {
+		t.Fatalf("last connected time mismatch, want %s got %s", start, info.LastConnectedAt)
+	}
+
+	disconnectedAt := start.Add(time.Minute)
+	clk.SetTime(disconnectedAt)
+	registry.MarkOfflineByRunID("run-id")
+
+	info, ok = registry.GetByKey(key)
+	if !ok {
+		t.Fatalf("client %q not found after disconnect", key)
+	}
+	if !info.DisconnectedAt.Equal(disconnectedAt) {
+		t.Fatalf("disconnected time mismatch, want %s got %s", disconnectedAt, info.DisconnectedAt)
+	}
+}
+
+func TestClientRegistryControlIDPreventsStaleOffline(t *testing.T) {
+	registry := NewClientRegistry()
+	key, conflict := registry.RegisterWithControlID(
+		"user", "client-id", "run-id", "old-host", "1.0.0", "127.0.0.1", wire.ProtocolV1, 1,
+	)
+	if conflict {
+		t.Fatal("unexpected client conflict")
+	}
+	_, conflict = registry.RegisterWithControlID(
+		"user", "client-id", "run-id", "new-host", "1.0.1", "127.0.0.2", wire.ProtocolV2, 2,
+	)
+	if conflict {
+		t.Fatal("same run ID replacement should not conflict")
+	}
+
+	registry.MarkOfflineByRunIDAndControlID("run-id", 1)
+	info, ok := registry.GetByKey(key)
+	if !ok {
+		t.Fatalf("client %q not found", key)
+	}
+	if !info.Online || info.ControlID != 2 || info.Hostname != "new-host" {
+		t.Fatalf("stale offline changed current generation: %+v", info)
+	}
+
+	registry.MarkOfflineByRunIDAndControlID("run-id", 2)
+	info, ok = registry.GetByKey(key)
+	if !ok {
+		t.Fatalf("client %q not found after disconnect", key)
+	}
+	if info.Online || info.ControlID != 0 || info.RunID != "" {
+		t.Fatalf("current generation was not marked offline: %+v", info)
+	}
+}
+
+func TestClientRegistryClientIDConflictSemantics(t *testing.T) {
+	registry := NewClientRegistry()
+	_, conflict := registry.RegisterWithControlID(
+		"user", "client-id", "run-one", "host", "1.0.0", "127.0.0.1", wire.ProtocolV1, 1,
+	)
+	if conflict {
+		t.Fatal("unexpected initial client conflict")
+	}
+	_, conflict = registry.RegisterWithControlID(
+		"user", "client-id", "run-two", "host", "1.0.0", "127.0.0.2", wire.ProtocolV1, 2,
+	)
+	if !conflict {
+		t.Fatal("different online run IDs with the same explicit client ID must conflict")
+	}
+
+	registry.MarkOfflineByRunIDAndControlID("run-one", 1)
+	_, conflict = registry.RegisterWithControlID(
+		"user", "client-id", "run-two", "host", "1.0.0", "127.0.0.2", wire.ProtocolV1, 2,
+	)
+	if conflict {
+		t.Fatal("offline explicit client ID should be reusable")
+	}
+}
+
+func TestClientRegistrySameRunIDMovesBetweenClientKeys(t *testing.T) {
+	registry := NewClientRegistry()
+	oldKey, conflict := registry.RegisterWithControlID(
+		"user", "old-client", "run-id", "old-host", "1.0.0", "127.0.0.1", wire.ProtocolV1, 1,
+	)
+	if conflict {
+		t.Fatal("unexpected initial client conflict")
+	}
+	newKey, conflict := registry.RegisterWithControlID(
+		"user", "new-client", "run-id", "new-host", "1.0.1", "127.0.0.2", wire.ProtocolV2, 2,
+	)
+	if conflict {
+		t.Fatal("same run ID moving to a new client key should not conflict")
+	}
+
+	oldInfo, ok := registry.GetByKey(oldKey)
+	if !ok {
+		t.Fatalf("old explicit client %q should remain as offline history", oldKey)
+	}
+	if oldInfo.Online || oldInfo.RunID != "" || oldInfo.ControlID != 0 {
+		t.Fatalf("old client key remained online: %+v", oldInfo)
+	}
+	newInfo, ok := registry.GetByKey(newKey)
+	if !ok || !newInfo.Online || newInfo.RunID != "run-id" || newInfo.ControlID != 2 {
+		t.Fatalf("new client key was not registered: %+v", newInfo)
+	}
+}

server/service.go

@@ -18,6 +18,7 @@ import (
 	"bytes"
 	"context"
 	"crypto/tls"
+	"errors"
 	"fmt"
 	"io"
 	"net"
@@ -51,7 +52,6 @@ import (
 	"github.com/fatedier/frp/pkg/util/xlog"
 	"github.com/fatedier/frp/server/controller"
 	"github.com/fatedier/frp/server/group"
-	"github.com/fatedier/frp/server/metrics"
 	"github.com/fatedier/frp/server/ports"
 	"github.com/fatedier/frp/server/proxy"
 	"github.com/fatedier/frp/server/registry"
@@ -60,9 +60,12 @@ import (
 
 const (
 	connReadTimeout       time.Duration = 10 * time.Second
+	connWriteTimeout      time.Duration = 5 * time.Second
 	vhostReadWriteTimeout time.Duration = 30 * time.Second
 )
 
+var errControlReplaced = errors.New("control was replaced during login")
+
 func init() {
 	crypto.DefaultSalt = "frp"
 	// Disable quic-go's receive buffer warning.
@@ -160,9 +163,10 @@ func NewService(cfg *v1.ServerConfig) (*Service, error) {
 		return nil, err
 	}
 
+	clientRegistry := registry.NewClientRegistry()
 	svr := &Service{
-		ctlManager:     NewControlManager(),
-		clientRegistry: registry.NewClientRegistry(),
+		ctlManager:     NewControlManager(clientRegistry),
+		clientRegistry: clientRegistry,
 		pxyManager:     proxy.NewManager(),
 		pluginManager:  plugin.NewManager(),
 		rc: &controller.ResourceController{
@@ -296,10 +300,14 @@ func NewService(cfg *v1.ServerConfig) (*Service, error) {
 		svr.rc.HTTPReverseProxy = rp
 
 		address := net.JoinHostPort(cfg.ProxyBindAddr, strconv.Itoa(cfg.VhostHTTPPort))
+		protocols := new(http.Protocols)
+		protocols.SetHTTP1(true)
+		protocols.SetUnencryptedHTTP2(true)
 		server := &http.Server{
 			Addr:              address,
 			Handler:           rp,
 			ReadHeaderTimeout: 60 * time.Second,
+			Protocols:         protocols,
 		}
 		var l net.Listener
 		if httpMuxOn {
@@ -456,7 +464,7 @@ func (svr *Service) handleConnection(ctx context.Context, conn net.Conn, interna
 			controlConn := acceptedConn.conn
 			if !internal {
 				var controlRW io.ReadWriter
-				controlRW, err = netpkg.NewCryptoReadWriter(conn, svr.auth.EncryptionKey())
+				controlRW, err = acceptedConn.newControlReadWriter(conn, svr.auth.EncryptionKey())
 				if err == nil {
 					controlConn = acceptedConn.messageConnFor(controlRW)
 				}
@@ -468,31 +476,38 @@ func (svr *Service) handleConnection(ctx context.Context, conn net.Conn, interna
 
 		if err != nil {
 			xl.Warnf("register control error: %v", err)
-			_ = acceptedConn.conn.WriteMsg(&msg.LoginResp{
+			if ctl != nil {
+				svr.ctlManager.Remove(ctl)
+			}
+			if writeErr := writeWithDeadline(conn, connWriteTimeout, func() error {
+				return acceptedConn.conn.WriteMsg(&msg.LoginResp{
 					Version: version.Full(),
 					Error:   util.GenerateResponseErrorString("register control error", err, lo.FromPtr(svr.cfg.DetailedErrorsToClient)),
 				})
+			}); writeErr != nil {
+				xl.Warnf("write login error response error: %v", writeErr)
+			}
+			if ctl != nil {
+				_ = ctl.Close()
+			} else {
 				conn.Close()
+			}
 			return
 		}
-		if err = acceptedConn.conn.WriteMsg(&msg.LoginResp{
+		if err = svr.completeControlLogin(ctl, func() error {
+			return writeWithDeadline(conn, connWriteTimeout, func() error {
+				return acceptedConn.conn.WriteMsg(&msg.LoginResp{
 					Version: version.Full(),
 					RunID:   ctl.runID,
 					Error:   "",
+				})
+			})
 		}); err != nil {
-			xl.Warnf("write login response error: %v", err)
-			svr.ctlManager.Del(m.RunID, ctl)
-			svr.clientRegistry.MarkOfflineByRunID(m.RunID)
-			conn.Close()
+			xl.Warnf("complete control login error: %v", err)
+			svr.ctlManager.Remove(ctl)
+			_ = ctl.Close()
 			return
 		}
-		ctl.Start()
-		metrics.Server.NewClient()
-		go func() {
-			// block until control closed
-			ctl.WaitClosed()
-			svr.ctlManager.Del(m.RunID, ctl)
-		}()
 	case *msg.NewWorkConn:
 		if err := svr.RegisterWorkConn(acceptedConn.conn, m); err != nil {
 			_ = acceptedConn.conn.WriteMsg(&msg.StartWorkConn{
@@ -501,7 +516,7 @@ func (svr *Service) handleConnection(ctx context.Context, conn net.Conn, interna
 			conn.Close()
 		}
 	case *msg.NewVisitorConn:
-		if err = svr.RegisterVisitorConn(conn, m); err != nil {
+		if err = svr.RegisterVisitorConn(conn, m, acceptedConn.wireProtocol); err != nil {
 			xl.Warnf("register visitor conn error: %v", err)
 			_ = acceptedConn.conn.WriteMsg(&msg.NewVisitorConnResp{
 				ProxyName: m.ProxyName,
@@ -520,9 +535,21 @@ func (svr *Service) handleConnection(ctx context.Context, conn net.Conn, interna
 	}
 }
 
+func (svr *Service) completeControlLogin(ctl *Control, writeSuccess func() error) error {
+	committed, err := svr.ctlManager.completeLogin(ctl, writeSuccess)
+	if err != nil {
+		return err
+	}
+	if !committed {
+		return errControlReplaced
+	}
+	return nil
+}
+
 type acceptedConnection struct {
 	conn          *msg.Conn
 	wireProtocol  string
+	cryptoContext *wire.CryptoContext
 	firstMsg      msg.Message
 }
 
@@ -544,7 +571,7 @@ func (svr *Service) acceptConnection(ctx context.Context, conn net.Conn) (*accep
 		wireConn := wire.NewConn(conn)
 		rw := msg.NewV2ReadWriterWithConn(wireConn)
 		acceptedConn.conn = msg.NewConn(conn, rw)
-		acceptedConn.firstMsg, err = acceptedConn.readFirstV2Msg(wireConn)
+		acceptedConn.firstMsg, err = acceptedConn.readFirstV2Msg(conn, wireConn)
 	} else {
 		rw := msg.NewV1ReadWriter(conn)
 		acceptedConn.conn = msg.NewConn(conn, rw)
@@ -557,17 +584,41 @@ func (svr *Service) acceptConnection(ctx context.Context, conn net.Conn) (*accep
 	return acceptedConn, nil
 }
 
+func writeWithDeadline(conn net.Conn, timeout time.Duration, writeFn func() error) error {
+	_ = conn.SetWriteDeadline(time.Now().Add(timeout))
+	defer func() {
+		_ = conn.SetWriteDeadline(time.Time{})
+	}()
+	return writeFn()
+}
+
 func (ac *acceptedConnection) messageConnFor(rw io.ReadWriter) *msg.Conn {
 	return msg.NewConn(ac.conn, msg.NewReadWriter(rw, ac.wireProtocol))
 }
 
-func (ac *acceptedConnection) readFirstV2Msg(wireConn *wire.Conn) (msg.Message, error) {
+func (ac *acceptedConnection) newControlReadWriter(rw io.ReadWriter, key []byte) (io.ReadWriter, error) {
+	if ac.wireProtocol == wire.ProtocolV2 {
+		if ac.cryptoContext == nil {
+			return nil, fmt.Errorf("missing v2 crypto negotiation")
+		}
+		return netpkg.NewAEADCryptoReadWriter(
+			rw,
+			key,
+			netpkg.AEADCryptoRoleServer,
+			ac.cryptoContext.Algorithm,
+			ac.cryptoContext.TranscriptHash,
+		)
+	}
+	return netpkg.NewCryptoReadWriter(rw, key)
+}
+
+func (ac *acceptedConnection) readFirstV2Msg(conn net.Conn, wireConn *wire.Conn) (msg.Message, error) {
 	frame, err := wireConn.ReadFrame()
 	if err != nil {
 		return nil, fmt.Errorf("read v2 frame: %w", err)
 	}
 	if frame.Type == wire.FrameTypeClientHello {
-		if err := ac.handleClientHello(wireConn, frame); err != nil {
+		if err := ac.handleClientHello(conn, wireConn, frame); err != nil {
 			return nil, err
 		}
 		frame, err = wireConn.ReadFrame()
@@ -583,21 +634,38 @@ func (ac *acceptedConnection) readFirstV2Msg(wireConn *wire.Conn) (msg.Message,
 	return m, nil
 }
 
-func (ac *acceptedConnection) handleClientHello(wireConn *wire.Conn, frame *wire.Frame) error {
+func (ac *acceptedConnection) handleClientHello(conn net.Conn, wireConn *wire.Conn, frame *wire.Frame) error {
 	var hello wire.ClientHello
 	if err := wireConn.UnmarshalFrame(frame, &hello); err != nil {
 		return fmt.Errorf("decode ClientHello: %w", err)
 	}
 
-	serverHello := wire.DefaultServerHello()
-	if err := wire.ValidateClientHello(hello); err != nil {
+	serverHello, err := wire.NewServerHello(hello)
+	if err != nil {
+		serverHello = wire.DefaultServerHello()
 		serverHello.Error = err.Error()
-		_ = wireConn.WriteJSONFrame(wire.FrameTypeServerHello, serverHello)
+		if writeErr := writeWithDeadline(conn, connWriteTimeout, func() error {
+			return wireConn.WriteJSONFrame(wire.FrameTypeServerHello, serverHello)
+		}); writeErr != nil {
+			return fmt.Errorf("%w; write ServerHello error: %v", err, writeErr)
+		}
 		return err
 	}
-	if err := wireConn.WriteJSONFrame(wire.FrameTypeServerHello, serverHello); err != nil {
+	serverHelloFrame, err := wire.NewJSONFrame(wire.FrameTypeServerHello, serverHello)
+	if err != nil {
+		return fmt.Errorf("encode ServerHello: %w", err)
+	}
+	cryptoContext := wire.NewCryptoContext(
+		serverHello.Selected.Crypto.Algorithm,
+		frame.Payload,
+		serverHelloFrame.Payload,
+	)
+	if err := writeWithDeadline(conn, connWriteTimeout, func() error {
+		return wireConn.WriteFrame(serverHelloFrame)
+	}); err != nil {
 		return fmt.Errorf("write ServerHello: %w", err)
 	}
+	ac.cryptoContext = cryptoContext
 	return nil
 }
 
@@ -727,7 +795,7 @@ func (svr *Service) RegisterControl(
 		Conn:          ctlConn,
 		LoginMsg:      loginMsg,
 		ServerCfg:     svr.cfg,
-		ClientRegistry: svr.clientRegistry,
+		WireProtocol:  wireProtocol,
 	})
 	if err != nil {
 		xl.Warnf("create new controller error: %v", err)
@@ -735,18 +803,17 @@ func (svr *Service) RegisterControl(
 		return nil, fmt.Errorf("unexpected error when creating new controller")
 	}
 
-	if oldCtl := svr.ctlManager.Add(loginMsg.RunID, ctl); oldCtl != nil {
-		oldCtl.WaitClosed()
+	if err := svr.ctlManager.Add(ctl); err != nil {
+		return ctl, err
 	}
+	ctl.WaitForHandoff()
 
-	remoteAddr := ctlConn.RemoteAddr().String()
-	if host, _, err := net.SplitHostPort(remoteAddr); err == nil {
-		remoteAddr = host
+	active, err := svr.ctlManager.Activate(ctl)
+	if err != nil {
+		return ctl, err
 	}
-	_, conflict := svr.clientRegistry.Register(loginMsg.User, loginMsg.ClientID, loginMsg.RunID, loginMsg.Hostname, loginMsg.Version, remoteAddr, wireProtocol)
-	if conflict {
-		svr.ctlManager.Del(loginMsg.RunID, ctl)
-		return nil, fmt.Errorf("client_id [%s] for user [%s] is already online", loginMsg.ClientID, loginMsg.User)
+	if !active {
+		return ctl, errControlReplaced
 	}
 
 	return ctl, nil
@@ -780,20 +847,25 @@ func (svr *Service) RegisterWorkConn(workConn *msg.Conn, newMsg *msg.NewWorkConn
 		xl.Warnf("invalid NewWorkConn with run id [%s]", newMsg.RunID)
 		return err
 	}
-	return ctl.RegisterWorkConn(proxy.NewWorkConn(workConn))
+	return svr.ctlManager.RegisterWorkConn(ctl, proxy.NewWorkConn(workConn))
 }
 
-func (svr *Service) RegisterVisitorConn(visitorConn net.Conn, newMsg *msg.NewVisitorConn) error {
-	visitorUser := ""
+func (svr *Service) RegisterVisitorConn(visitorConn net.Conn, newMsg *msg.NewVisitorConn, wireProtocol string) error {
+	admit := func(visitorUser string) error {
+		return svr.rc.VisitorManager.NewConn(newMsg.ProxyName, visitorConn, newMsg.Timestamp, newMsg.SignKey,
+			newMsg.UseEncryption, newMsg.UseCompression, visitorUser, wireProtocol)
+	}
 	// TODO(deprecation): Compatible with old versions, can be without runID, user is empty. In later versions, it will be mandatory to include runID.
 	// If runID is required, it is not compatible with versions prior to v0.50.0.
 	if newMsg.RunID != "" {
-		ctl, exist := svr.ctlManager.GetByID(newMsg.RunID)
-		if !exist {
+		admitted, err := svr.ctlManager.admitVisitorByRunID(newMsg.RunID, admit)
+		if err != nil {
+			return err
+		}
+		if !admitted {
 			return fmt.Errorf("no client control found for run id [%s]", newMsg.RunID)
 		}
-		visitorUser = ctl.sessionCtx.LoginMsg.User
+		return nil
 	}
-	return svr.rc.VisitorManager.NewConn(newMsg.ProxyName, visitorConn, newMsg.Timestamp, newMsg.SignKey,
-		newMsg.UseEncryption, newMsg.UseCompression, visitorUser)
+	return admit("")
 }

server/service_test.go

@@ -0,0 +1,646 @@
+// Copyright 2026 The frp Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package server
+
+import (
+	"context"
+	"errors"
+	"net"
+	"net/http"
+	"runtime"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/fatedier/golib/net/mux"
+	"github.com/stretchr/testify/require"
+
+	"github.com/fatedier/frp/pkg/auth"
+	v1 "github.com/fatedier/frp/pkg/config/v1"
+	"github.com/fatedier/frp/pkg/msg"
+	plugin "github.com/fatedier/frp/pkg/plugin/server"
+	"github.com/fatedier/frp/pkg/proto/wire"
+	"github.com/fatedier/frp/pkg/util/util"
+	"github.com/fatedier/frp/server/controller"
+	"github.com/fatedier/frp/server/proxy"
+	"github.com/fatedier/frp/server/registry"
+	"github.com/fatedier/frp/server/visitor"
+)
+
+func TestWriteWithDeadlineTimesOutAndClearsDeadline(t *testing.T) {
+	serverConn, clientConn := net.Pipe()
+	defer serverConn.Close()
+	defer clientConn.Close()
+
+	err := writeWithDeadline(serverConn, 50*time.Millisecond, func() error {
+		_, writeErr := serverConn.Write([]byte("x"))
+		return writeErr
+	})
+	require.Error(t, err)
+
+	var netErr net.Error
+	require.True(t, errors.As(err, &netErr))
+	require.True(t, netErr.Timeout())
+
+	readCh := make(chan byte, 1)
+	errCh := make(chan error, 1)
+	go func() {
+		buf := make([]byte, 1)
+		if _, readErr := clientConn.Read(buf); readErr != nil {
+			errCh <- readErr
+			return
+		}
+		readCh <- buf[0]
+	}()
+
+	_, err = serverConn.Write([]byte("y"))
+	require.NoError(t, err)
+
+	select {
+	case b := <-readCh:
+		require.Equal(t, byte('y'), b)
+	case err := <-errCh:
+		require.NoError(t, err)
+	case <-time.After(time.Second):
+		t.Fatal("timed out waiting for write after deadline reset")
+	}
+}
+
+func TestSharedPortHTTPListenerProtocols(t *testing.T) {
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+
+	sharedMux := mux.NewMux(listener)
+	httpListener := sharedMux.ListenHTTP(1)
+	muxServeErr := make(chan error, 1)
+	go func() {
+		muxServeErr <- sharedMux.Serve()
+	}()
+
+	newProtocols := func(http1, unencryptedHTTP2 bool) *http.Protocols {
+		protocols := new(http.Protocols)
+		protocols.SetHTTP1(http1)
+		protocols.SetUnencryptedHTTP2(unencryptedHTTP2)
+		return protocols
+	}
+
+	const handlerProtocolHeader = "X-Test-Handler-Protocol"
+	httpServer := &http.Server{
+		Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			w.Header().Set(handlerProtocolHeader, r.Proto)
+			w.WriteHeader(http.StatusNoContent)
+		}),
+		ReadHeaderTimeout: time.Second,
+		Protocols:         newProtocols(true, true),
+	}
+	httpServeErr := make(chan error, 1)
+	go func() {
+		httpServeErr <- httpServer.Serve(httpListener)
+	}()
+	t.Cleanup(func() {
+		require.NoError(t, httpServer.Close())
+		require.ErrorIs(t, waitForResult(t, httpServeErr, "shared HTTP server to stop"), http.ErrServerClosed)
+		require.NoError(t, sharedMux.Close())
+		require.ErrorIs(t, waitForResult(t, muxServeErr, "shared mux to stop"), net.ErrClosed)
+	})
+
+	for _, tc := range []struct {
+		name             string
+		http1            bool
+		unencryptedHTTP2 bool
+		expectedProtocol string
+	}{
+		{name: "HTTP/1.1", http1: true, expectedProtocol: "HTTP/1.1"},
+		{name: "HTTP/2 prior knowledge", unencryptedHTTP2: true, expectedProtocol: "HTTP/2.0"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			transport := &http.Transport{
+				Protocols: newProtocols(tc.http1, tc.unencryptedHTTP2),
+			}
+			defer transport.CloseIdleConnections()
+			client := &http.Client{Transport: transport, Timeout: 3 * time.Second}
+			request, err := http.NewRequestWithContext(t.Context(), http.MethodGet, "http://"+listener.Addr().String()+"/", nil)
+			require.NoError(t, err)
+			response, err := client.Do(request)
+			require.NoError(t, err)
+			require.Equal(t, http.StatusNoContent, response.StatusCode)
+			require.Equal(t, tc.expectedProtocol, response.Proto)
+			require.Equal(t, tc.expectedProtocol, response.Header.Get(handlerProtocolHeader))
+			require.NoError(t, response.Body.Close())
+		})
+	}
+}
+
+func TestServiceControlHandoffSkipsStalePendingGeneration(t *testing.T) {
+	svr := newControlTestService(t)
+	metrics := newCountingServerMetrics()
+	metrics.closeEnter = make(chan struct{})
+	metrics.closeResume = make(chan struct{})
+
+	ctlA, connA, err := registerLifecycleTestControl(svr)
+	require.NoError(t, err)
+	ctlA.serverMetrics = metrics
+	require.NoError(t, svr.completeControlLogin(ctlA, func() error { return nil }))
+	waitForSignal(t, connA.readStarted, "A reader to start")
+
+	require.NoError(t, ctlA.Close())
+	waitForSignal(t, metrics.closeEnter, "A finalization barrier")
+
+	type registerResult struct {
+		ctl  *Control
+		conn *deadlineReadConn
+		err  error
+	}
+	resultB := make(chan registerResult, 1)
+	go func() {
+		ctl, conn, registerErr := registerLifecycleTestControl(svr)
+		resultB <- registerResult{ctl: ctl, conn: conn, err: registerErr}
+	}()
+	ctlB := waitForDifferentCurrentControl(t, svr.ctlManager, "shared-run", ctlA)
+	ctlB.serverMetrics = metrics
+
+	resultC := make(chan registerResult, 1)
+	go func() {
+		ctl, conn, registerErr := registerLifecycleTestControl(svr)
+		resultC <- registerResult{ctl: ctl, conn: conn, err: registerErr}
+	}()
+	ctlC := waitForDifferentCurrentControl(t, svr.ctlManager, "shared-run", ctlB)
+	ctlC.serverMetrics = metrics
+	waitForControlDone(t, ctlB)
+
+	select {
+	case result := <-resultB:
+		t.Fatalf("B returned before A finalized: %v", result.err)
+	default:
+	}
+	select {
+	case result := <-resultC:
+		t.Fatalf("C returned before A finalized: %v", result.err)
+	default:
+	}
+
+	close(metrics.closeResume)
+	waitForControlDone(t, ctlA)
+
+	b := <-resultB
+	require.Same(t, ctlB, b.ctl)
+	require.ErrorIs(t, b.err, errControlReplaced)
+	require.False(t, svr.ctlManager.Remove(ctlB))
+	require.NoError(t, ctlB.Close())
+
+	c := <-resultC
+	require.NoError(t, c.err)
+	require.Same(t, ctlC, c.ctl)
+	_, ok := svr.ctlManager.GetByID("shared-run")
+	require.False(t, ok)
+	require.Same(t, ctlC, currentControlForTest(svr.ctlManager, "shared-run"))
+
+	info, ok := svr.clientRegistry.GetByKey("client")
+	require.True(t, ok)
+	require.True(t, info.Online)
+	require.Equal(t, uint64(ctlC.ID()), info.ControlID)
+
+	var staleWrites atomic.Int64
+	err = svr.completeControlLogin(ctlB, func() error {
+		staleWrites.Add(1)
+		return nil
+	})
+	require.ErrorIs(t, err, errControlReplaced)
+	require.Equal(t, int64(0), staleWrites.Load())
+
+	require.NoError(t, svr.completeControlLogin(ctlC, func() error { return nil }))
+	waitForSignal(t, c.conn.readStarted, "C reader to start")
+	current, ok := svr.ctlManager.GetByID("shared-run")
+	require.True(t, ok)
+	require.Same(t, ctlC, current)
+	require.Equal(t, int64(2), metrics.newClients())
+	require.Equal(t, int64(1), metrics.closedClients())
+
+	require.NoError(t, ctlC.Close())
+	waitForControlDone(t, ctlC)
+	require.Equal(t, int64(2), metrics.newClients())
+	require.Equal(t, int64(2), metrics.closedClients())
+	_, ok = svr.ctlManager.GetByID("shared-run")
+	require.False(t, ok)
+}
+
+func TestServiceLoginResponseSynchronizationIsScopedToRun(t *testing.T) {
+	svr := newControlTestService(t)
+	metrics := newCountingServerMetrics()
+	ctlA, connA, err := registerLifecycleTestControl(svr)
+	require.NoError(t, err)
+	ctlA.serverMetrics = metrics
+
+	writeEntered := make(chan struct{})
+	resumeWrite := make(chan struct{})
+	var resumeWriteOnce sync.Once
+	resume := func() {
+		resumeWriteOnce.Do(func() { close(resumeWrite) })
+	}
+	t.Cleanup(resume)
+	writeCount := atomic.Int64{}
+	loginDone := make(chan error, 1)
+	go func() {
+		loginDone <- svr.completeControlLogin(ctlA, func() error {
+			close(writeEntered)
+			<-resumeWrite
+			writeCount.Add(1)
+			return nil
+		})
+	}()
+	waitForSignal(t, writeEntered, "A LoginResp write")
+
+	runMu := currentRunGateForTest(svr.ctlManager, "shared-run")
+	require.NotNil(t, runMu)
+	if !svr.ctlManager.mu.TryLock() {
+		t.Fatal("ControlManager mutex was held while LoginResp write was in progress")
+	}
+	svr.ctlManager.mu.Unlock()
+
+	ctlB, connB := newLifecycleTestControl(t, "shared-run", "client", metrics)
+	gateAvailable := make(chan bool)
+	addDone := make(chan error, 1)
+	go func() {
+		if runMu.TryLock() {
+			runMu.Unlock()
+			gateAvailable <- true
+		} else {
+			gateAvailable <- false
+		}
+		addErr := svr.ctlManager.Add(ctlB)
+		addDone <- addErr
+	}()
+	available := waitForResult(t, gateAvailable, "same-run replacement gate probe")
+	require.False(t, available, "same-run gate was available to replacement during LoginResp write")
+	select {
+	case addErr := <-addDone:
+		t.Fatalf("same-run replacement completed during LoginResp write: %v", addErr)
+	case <-time.After(20 * time.Millisecond):
+	}
+	require.Same(t, ctlA, currentControlForTest(svr.ctlManager, "shared-run"))
+
+	otherMetrics := newCountingServerMetrics()
+	otherCtl, otherConn := newLifecycleTestControl(t, "other-run", "other-client", otherMetrics)
+	type unrelatedResult struct {
+		addErr      error
+		active      bool
+		activateErr error
+		loginErr    error
+		current     *Control
+		found       bool
+	}
+	unrelatedDone := make(chan unrelatedResult, 1)
+	go func() {
+		result := unrelatedResult{}
+		result.addErr = svr.ctlManager.Add(otherCtl)
+		if result.addErr == nil {
+			result.active, result.activateErr = svr.ctlManager.Activate(otherCtl)
+		}
+		if result.activateErr == nil && result.active {
+			result.loginErr = svr.completeControlLogin(otherCtl, func() error { return nil })
+		}
+		result.current, result.found = svr.ctlManager.GetByID("other-run")
+		unrelatedDone <- result
+	}()
+	result := waitForResult(t, unrelatedDone, "unrelated run lifecycle")
+	require.NoError(t, result.addErr)
+	require.NoError(t, result.activateErr)
+	require.True(t, result.active)
+	require.NoError(t, result.loginErr)
+	require.True(t, result.found)
+	require.Same(t, otherCtl, result.current)
+	waitForSignal(t, otherConn.readStarted, "unrelated control reader to start")
+	require.Equal(t, int64(1), otherMetrics.newClients())
+
+	resume()
+	require.NoError(t, waitForResult(t, loginDone, "LoginResp completion"))
+	require.NoError(t, waitForResult(t, addDone, "replacement"))
+	waitForControlDone(t, ctlA)
+	require.Same(t, ctlB, currentControlForTest(svr.ctlManager, "shared-run"))
+	require.Equal(t, int64(1), writeCount.Load())
+	require.Equal(t, int64(1), metrics.newClients())
+	require.Equal(t, int64(1), metrics.closedClients())
+	require.Equal(t, []string{"deadline", "close"}, connA.eventsSnapshot())
+
+	require.False(t, svr.ctlManager.Remove(ctlA))
+	require.NoError(t, ctlA.Close())
+	require.True(t, svr.ctlManager.Remove(ctlB))
+	require.NoError(t, ctlB.Close())
+	require.Equal(t, []string{"deadline", "close"}, connB.eventsSnapshot())
+
+	require.NoError(t, otherCtl.Close())
+	waitForControlDone(t, otherCtl)
+	require.Equal(t, int64(1), otherMetrics.newClients())
+	require.Equal(t, int64(1), otherMetrics.closedClients())
+}
+
+func TestServiceVisitorAdmissionSerializesReplacement(t *testing.T) {
+	svr := newControlTestService(t)
+	ctlA, controlConn, err := registerLifecycleTestControl(svr)
+	require.NoError(t, err)
+	ctlA.sessionCtx.LoginMsg.User = "old-user"
+	require.NoError(t, svr.completeControlLogin(ctlA, func() error { return nil }))
+	waitForSignal(t, controlConn.readStarted, "A reader to start")
+
+	admissionEntered := make(chan struct{})
+	resumeAdmission := make(chan struct{})
+	var resumeOnce sync.Once
+	resume := func() {
+		resumeOnce.Do(func() { close(resumeAdmission) })
+	}
+	t.Cleanup(resume)
+	type admissionResult struct {
+		admitted bool
+		user     string
+		err      error
+	}
+	admissionDone := make(chan admissionResult, 1)
+	go func() {
+		var admittedUser string
+		admitted, admitErr := svr.ctlManager.admitVisitorByRunID("shared-run", func(user string) error {
+			admittedUser = user
+			close(admissionEntered)
+			<-resumeAdmission
+			return nil
+		})
+		admissionDone <- admissionResult{admitted: admitted, user: admittedUser, err: admitErr}
+	}()
+	waitForSignal(t, admissionEntered, "visitor admission callback")
+	runMu := currentRunGateForTest(svr.ctlManager, "shared-run")
+	require.NotNil(t, runMu)
+
+	type registerResult struct {
+		ctl *Control
+		err error
+	}
+	gateAvailable := make(chan bool)
+	replacementDone := make(chan registerResult, 1)
+	go func() {
+		if runMu.TryLock() {
+			runMu.Unlock()
+			gateAvailable <- true
+		} else {
+			gateAvailable <- false
+		}
+		ctl, _, registerErr := registerLifecycleTestControl(svr)
+		replacementDone <- registerResult{ctl: ctl, err: registerErr}
+	}()
+	available := waitForResult(t, gateAvailable, "visitor replacement gate probe")
+	require.False(t, available, "same-run gate was available during visitor admission")
+	select {
+	case result := <-replacementDone:
+		t.Fatalf("replacement completed during visitor admission: %v", result.err)
+	case <-time.After(20 * time.Millisecond):
+	}
+	require.Same(t, ctlA, currentControlForTest(svr.ctlManager, "shared-run"))
+
+	resume()
+	admission := waitForResult(t, admissionDone, "visitor admission")
+	require.NoError(t, admission.err)
+	require.True(t, admission.admitted)
+	require.Equal(t, "old-user", admission.user)
+	replacement := waitForResult(t, replacementDone, "replacement")
+	require.NoError(t, replacement.err)
+	ctlB := replacement.ctl
+	require.Same(t, ctlB, currentControlForTest(svr.ctlManager, "shared-run"))
+	waitForControlDone(t, ctlA)
+	require.True(t, svr.ctlManager.Remove(ctlB))
+	require.NoError(t, ctlB.Close())
+}
+
+func TestServiceWorkConnRoutingRequiresCurrentRunningControl(t *testing.T) {
+	svr := newControlTestService(t)
+	ctl, controlConn, err := registerLifecycleTestControl(svr)
+	require.NoError(t, err)
+
+	pendingConn := newCountingCloseConn()
+	pendingMsgConn := msg.NewConn(pendingConn, msg.NewV1ReadWriter(pendingConn))
+	err = registerWorkConnAsCaller(svr, pendingMsgConn, &msg.NewWorkConn{RunID: "shared-run"})
+	require.Error(t, err)
+	require.Equal(t, int64(1), pendingConn.closeCount.Load())
+	require.Len(t, ctl.workConnCh, 0)
+
+	require.NoError(t, svr.completeControlLogin(ctl, func() error { return nil }))
+	waitForSignal(t, controlConn.readStarted, "control reader to start")
+	current, ok := svr.ctlManager.GetByID("shared-run")
+	require.True(t, ok)
+	require.Same(t, ctl, current)
+	require.Len(t, ctl.workConnCh, 0)
+
+	runningConn := newCountingCloseConn()
+	runningMsgConn := msg.NewConn(runningConn, msg.NewV1ReadWriter(runningConn))
+	require.NoError(t, svr.RegisterWorkConn(runningMsgConn, &msg.NewWorkConn{RunID: "shared-run"}))
+	require.Len(t, ctl.workConnCh, 1)
+
+	require.NoError(t, ctl.Close())
+	waitForControlDone(t, ctl)
+	require.Equal(t, int64(1), runningConn.closeCount.Load())
+}
+
+func TestServiceWorkConnRoutingRejectsLostGeneration(t *testing.T) {
+	for _, action := range []string{"replace", "close"} {
+		t.Run(action, func(t *testing.T) {
+			svr := newControlTestService(t)
+			ctl, controlConn, err := registerLifecycleTestControl(svr)
+			require.NoError(t, err)
+			require.NoError(t, svr.completeControlLogin(ctl, func() error { return nil }))
+			waitForSignal(t, controlConn.readStarted, "control reader to start")
+
+			barrier := newWorkConnBarrierPlugin()
+			svr.pluginManager.Register(barrier)
+			workConn := newCountingCloseConn()
+			workMsgConn := msg.NewConn(workConn, msg.NewV1ReadWriter(workConn))
+			routeDone := make(chan error, 1)
+			go func() {
+				routeDone <- registerWorkConnAsCaller(svr, workMsgConn, &msg.NewWorkConn{RunID: "shared-run"})
+			}()
+			waitForSignal(t, barrier.entered, "work connection plugin barrier")
+
+			var replacement *Control
+			switch action {
+			case "replace":
+				replacement, _, err = registerLifecycleTestControl(svr)
+				require.NoError(t, err)
+			case "close":
+				require.NoError(t, ctl.Close())
+				waitForControlDone(t, ctl)
+			}
+
+			close(barrier.resume)
+			require.Error(t, waitForResult(t, routeDone, "work connection route to finish"))
+			require.Equal(t, int64(1), workConn.closeCount.Load())
+			require.Len(t, ctl.workConnCh, 0)
+
+			if replacement != nil {
+				require.Len(t, replacement.workConnCh, 0)
+				require.True(t, svr.ctlManager.Remove(replacement))
+				require.NoError(t, replacement.Close())
+				waitForControlDone(t, replacement)
+			}
+		})
+	}
+}
+
+func TestServiceVisitorRoutingExcludesPendingUser(t *testing.T) {
+	svr := newControlTestService(t)
+	listener, err := svr.rc.VisitorManager.Listen("visitor", "secret", []string{"pending-user"})
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = listener.Close() })
+
+	controlConn := newDeadlineReadConn()
+	controlMsgConn := msg.NewConn(controlConn, msg.NewV1ReadWriter(controlConn))
+	ctl, err := svr.RegisterControl(controlMsgConn, &msg.Login{
+		RunID:    "visitor-run",
+		User:     "pending-user",
+		ClientID: "visitor-client",
+		ClientSpec: msg.ClientSpec{
+			AlwaysAuthPass: true,
+		},
+	}, true, wire.ProtocolV1)
+	require.NoError(t, err)
+
+	timestamp := time.Now().Unix()
+	visitorMsg := &msg.NewVisitorConn{
+		RunID:     "visitor-run",
+		ProxyName: "visitor",
+		Timestamp: timestamp,
+		SignKey:   util.GetAuthKey("secret", timestamp),
+	}
+	pendingConn := newCountingCloseConn()
+	err = svr.RegisterVisitorConn(pendingConn, visitorMsg, wire.ProtocolV1)
+	require.ErrorContains(t, err, "no client control found")
+	require.NoError(t, pendingConn.Close())
+	require.Equal(t, int64(1), pendingConn.closeCount.Load())
+
+	require.NoError(t, svr.completeControlLogin(ctl, func() error { return nil }))
+	waitForSignal(t, controlConn.readStarted, "control reader to start")
+	runningConn := newCountingCloseConn()
+	require.NoError(t, svr.RegisterVisitorConn(runningConn, visitorMsg, wire.ProtocolV1))
+	accepted, err := listener.Accept()
+	require.NoError(t, err)
+	require.NoError(t, accepted.Close())
+	require.Equal(t, int64(1), runningConn.closeCount.Load())
+
+	require.NoError(t, ctl.Close())
+	waitForControlDone(t, ctl)
+}
+
+func newControlTestService(t *testing.T) *Service {
+	t.Helper()
+	cfg := &v1.ServerConfig{}
+	cfg.Auth.Method = v1.AuthMethodToken
+	authRuntime, err := auth.BuildServerAuth(&cfg.Auth)
+	require.NoError(t, err)
+	clientRegistry := registry.NewClientRegistry()
+	return &Service{
+		ctlManager:     NewControlManager(clientRegistry),
+		clientRegistry: clientRegistry,
+		pxyManager:     proxy.NewManager(),
+		pluginManager:  plugin.NewManager(),
+		rc: &controller.ResourceController{
+			VisitorManager: visitor.NewManager(),
+		},
+		auth: authRuntime,
+		cfg:  cfg,
+	}
+}
+
+func registerLifecycleTestControl(svr *Service) (*Control, *deadlineReadConn, error) {
+	conn := newDeadlineReadConn()
+	msgConn := msg.NewConn(conn, msg.NewReadWriter(conn, wire.ProtocolV1))
+	ctl, err := svr.RegisterControl(msgConn, &msg.Login{
+		RunID:    "shared-run",
+		ClientID: "client",
+		ClientSpec: msg.ClientSpec{
+			AlwaysAuthPass: true,
+		},
+	}, true, wire.ProtocolV1)
+	return ctl, conn, err
+}
+
+func waitForDifferentCurrentControl(t *testing.T, manager *ControlManager, runID string, old *Control) *Control {
+	t.Helper()
+	deadline := time.Now().Add(3 * time.Second)
+	for time.Now().Before(deadline) {
+		if ctl := currentControlForTest(manager, runID); ctl != nil && ctl != old {
+			return ctl
+		}
+		runtime.Gosched()
+	}
+	t.Fatalf("timed out waiting for a new current control after ID %d", old.ID())
+	return nil
+}
+
+func registerWorkConnAsCaller(svr *Service, workConn *msg.Conn, newMsg *msg.NewWorkConn) error {
+	err := svr.RegisterWorkConn(workConn, newMsg)
+	if err != nil {
+		_ = workConn.Close()
+	}
+	return err
+}
+
+func waitForResult[T any](t *testing.T, ch <-chan T, description string) T {
+	t.Helper()
+	select {
+	case result := <-ch:
+		return result
+	case <-time.After(3 * time.Second):
+		t.Fatalf("timed out waiting for %s", description)
+		var zero T
+		return zero
+	}
+}
+
+type workConnBarrierPlugin struct {
+	entered chan struct{}
+	resume  chan struct{}
+}
+
+func newWorkConnBarrierPlugin() *workConnBarrierPlugin {
+	return &workConnBarrierPlugin{
+		entered: make(chan struct{}),
+		resume:  make(chan struct{}),
+	}
+}
+
+func (*workConnBarrierPlugin) Name() string { return "work-conn-barrier" }
+
+func (*workConnBarrierPlugin) IsSupport(op string) bool { return op == plugin.OpNewWorkConn }
+
+func (p *workConnBarrierPlugin) Handle(
+	context.Context,
+	string,
+	any,
+) (*plugin.Response, any, error) {
+	close(p.entered)
+	<-p.resume
+	return &plugin.Response{Unchange: true}, nil, nil
+}
+
+type countingCloseConn struct {
+	closeCount atomic.Int64
+}
+
+func newCountingCloseConn() *countingCloseConn { return &countingCloseConn{} }
+
+func (*countingCloseConn) Read([]byte) (int, error)         { return 0, net.ErrClosed }
+func (*countingCloseConn) Write(p []byte) (int, error)      { return len(p), nil }
+func (c *countingCloseConn) Close() error                   { c.closeCount.Add(1); return nil }
+func (*countingCloseConn) LocalAddr() net.Addr              { return lifecycleTestAddr("local") }
+func (*countingCloseConn) RemoteAddr() net.Addr             { return lifecycleTestAddr("remote") }
+func (*countingCloseConn) SetDeadline(time.Time) error      { return nil }
+func (*countingCloseConn) SetReadDeadline(time.Time) error  { return nil }
+func (*countingCloseConn) SetWriteDeadline(time.Time) error { return nil }

server/visitor/visitor.go

@@ -65,6 +65,7 @@ func (vm *Manager) Listen(name string, sk string, allowUsers []string) (*netpkg.
 
 func (vm *Manager) NewConn(name string, conn net.Conn, timestamp int64, signKey string,
 	useEncryption bool, useCompression bool, visitorUser string,
+	wireProtocol string,
 ) (err error) {
 	vm.mu.RLock()
 	defer vm.mu.RUnlock()
@@ -90,7 +91,11 @@ func (vm *Manager) NewConn(name string, conn net.Conn, timestamp int64, signKey
 		if useCompression {
 			rwc = libio.WithCompression(rwc)
 		}
-		err = l.l.PutConn(netpkg.WrapReadWriteCloserToConn(rwc, conn))
+		visitorConn := netpkg.WrapReadWriteCloserToConn(rwc, conn)
+		err = l.l.PutConn(&wireProtocolConn{
+			Conn:         visitorConn,
+			wireProtocol: wireProtocol,
+		})
 	} else {
 		err = fmt.Errorf("custom listener for [%s] doesn't exist", name)
 		return
@@ -98,6 +103,15 @@ func (vm *Manager) NewConn(name string, conn net.Conn, timestamp int64, signKey
 	return
 }
 
+type wireProtocolConn struct {
+	net.Conn
+	wireProtocol string
+}
+
+func (c *wireProtocolConn) WireProtocol() string {
+	return c.wireProtocol
+}
+
 func (vm *Manager) CloseListener(name string) {
 	vm.mu.Lock()
 	defer vm.mu.Unlock()

server/visitor/visitor_test.go

@@ -0,0 +1,61 @@
+// Copyright 2026 The frp Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package visitor
+
+import (
+	"net"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/fatedier/frp/pkg/proto/wire"
+	"github.com/fatedier/frp/pkg/util/util"
+)
+
+func TestManagerNewConnCarriesWireProtocol(t *testing.T) {
+	vm := NewManager()
+	listener, err := vm.Listen("sudp", "secret", []string{"*"})
+	require.NoError(t, err)
+	defer listener.Close()
+
+	client, server := net.Pipe()
+	defer client.Close()
+	defer server.Close()
+
+	now := time.Now().Unix()
+	errCh := make(chan error, 1)
+	go func() {
+		errCh <- vm.NewConn(
+			"sudp",
+			server,
+			now,
+			util.GetAuthKey("secret", now),
+			false,
+			false,
+			"user",
+			wire.ProtocolV2,
+		)
+	}()
+
+	acceptedConn, err := listener.Accept()
+	require.NoError(t, err)
+	defer acceptedConn.Close()
+
+	getter, ok := acceptedConn.(interface{ WireProtocol() string })
+	require.True(t, ok)
+	require.Equal(t, wire.ProtocolV2, getter.WireProtocol())
+	require.NoError(t, <-errCh)
+}

test/e2e/compatibility/compatibility_test.go

@@ -7,6 +7,8 @@ import (
 	"io"
 	"net/http"
 	"os"
+	"strconv"
+	"strings"
 	"testing"
 	"time"
 
@@ -158,7 +160,7 @@ webServer.port = %d
 		framework.NewRequestExpect(f).PortName(portName).Ensure()
 	})
 
-	ginkgo.It("baseline frps rejects current frpc forced to v2", func() {
+	ginkgo.It("baseline frps handles current frpc forced to v2 according to baseline support", func() {
 		portName := port.GenName("CompatBaselineFRPSForcedV2")
 		clientConf := tcpClientConfig("tcp", portName, `
 transport.wireProtocol = "v2"
@@ -170,6 +172,21 @@ transport.wireProtocol = "v2"
 			consts.DefaultServerConfig,
 			[]string{clientConf},
 		)
+
+		// frp v0.69.0 added control connection wireProtocol v2 support, so
+		// baseline frps v0.69.0 and newer should accept a current frpc forced
+		// to v2. Older known baselines still must reject the unsupported protocol.
+		// For custom baselines, the version is unknown and the binary may be either
+		// side of the support boundary, so this versioned expectation is skipped.
+		supportsV2, knownVersion := baselineSupportsControlWireProtocolV2(compatCtx.BaselineVersion)
+		if !knownVersion {
+			ginkgo.Skip(fmt.Sprintf("baseline version %q is not semver; skip versioned forced-v2 expectation", compatCtx.BaselineVersion))
+		}
+		if supportsV2 {
+			framework.NewRequestExpect(f).PortName(portName).Ensure()
+			return
+		}
+
 		expectProcessExit(clientProcesses[0], 5*time.Second)
 		framework.NewRequestExpect(f).PortName(portName).ExpectError(true).Ensure()
 	})
@@ -199,6 +216,39 @@ func expectProcessExit(p *process.Process, timeout time.Duration) {
 	}
 }
 
+func baselineSupportsControlWireProtocolV2(version string) (supports bool, known bool) {
+	version = strings.TrimPrefix(version, "v")
+	parts := strings.Split(version, ".")
+	if len(parts) != 3 {
+		return false, false
+	}
+
+	major, err := strconv.Atoi(parts[0])
+	if err != nil {
+		return false, false
+	}
+	minor, err := strconv.Atoi(parts[1])
+	if err != nil {
+		return false, false
+	}
+	patch, err := strconv.Atoi(parts[2])
+	if err != nil {
+		return false, false
+	}
+
+	return compareSemanticVersion(major, minor, patch, 0, 69, 0) >= 0, true
+}
+
+func compareSemanticVersion(major, minor, patch int, baseMajor, baseMinor, basePatch int) int {
+	if major != baseMajor {
+		return major - baseMajor
+	}
+	if minor != baseMinor {
+		return minor - baseMinor
+	}
+	return patch - basePatch
+}
+
 type wireClientInfo struct {
 	ClientID     string `json:"clientID"`
 	WireProtocol string `json:"wireProtocol"`

test/e2e/framework/cleanup.go

@@ -1,62 +0,0 @@
-package framework
-
-import (
-	"sync"
-)
-
-// CleanupActionHandle is an integer pointer type for handling cleanup action
-type CleanupActionHandle *int
-
-type cleanupFuncHandle struct {
-	actionHandle CleanupActionHandle
-	actionHook   func()
-}
-
-var (
-	cleanupActionsLock sync.Mutex
-	cleanupHookList    = []cleanupFuncHandle{}
-)
-
-// AddCleanupAction installs a function that will be called in the event of the
-// whole test being terminated.  This allows arbitrary pieces of the overall
-// test to hook into SynchronizedAfterSuite().
-// The hooks are called in last-in-first-out order.
-func AddCleanupAction(fn func()) CleanupActionHandle {
-	p := CleanupActionHandle(new(int))
-	cleanupActionsLock.Lock()
-	defer cleanupActionsLock.Unlock()
-	c := cleanupFuncHandle{actionHandle: p, actionHook: fn}
-	cleanupHookList = append([]cleanupFuncHandle{c}, cleanupHookList...)
-	return p
-}
-
-// RemoveCleanupAction removes a function that was installed by
-// AddCleanupAction.
-func RemoveCleanupAction(p CleanupActionHandle) {
-	cleanupActionsLock.Lock()
-	defer cleanupActionsLock.Unlock()
-	for i, item := range cleanupHookList {
-		if item.actionHandle == p {
-			cleanupHookList = append(cleanupHookList[:i], cleanupHookList[i+1:]...)
-			break
-		}
-	}
-}
-
-// RunCleanupActions runs all functions installed by AddCleanupAction.  It does
-// not remove them (see RemoveCleanupAction) but it does run unlocked, so they
-// may remove themselves.
-func RunCleanupActions() {
-	list := []func(){}
-	func() {
-		cleanupActionsLock.Lock()
-		defer cleanupActionsLock.Unlock()
-		for _, p := range cleanupHookList {
-			list = append(list, p.actionHook)
-		}
-	}()
-	// Run unlocked.
-	for _, fn := range list {
-		fn()
-	}
-}

test/e2e/framework/expect.go

@@ -23,11 +23,6 @@ func ExpectNotEqual(actual any, extra any, explain ...any) {
 	gomega.ExpectWithOffset(1, actual).NotTo(gomega.Equal(extra), explain...)
 }
 
-// ExpectError expects an error happens, otherwise an exception raises
-func ExpectError(err error, explain ...any) {
-	gomega.ExpectWithOffset(1, err).To(gomega.HaveOccurred(), explain...)
-}
-
 func ExpectErrorWithOffset(offset int, err error, explain ...any) {
 	gomega.ExpectWithOffset(1+offset, err).To(gomega.HaveOccurred(), explain...)
 }
@@ -47,11 +42,6 @@ func ExpectContainSubstring(actual, substr string, explain ...any) {
 	gomega.ExpectWithOffset(1, actual).To(gomega.ContainSubstring(substr), explain...)
 }
 
-// ExpectConsistOf expects actual contains precisely the extra elements.  The ordering of the elements does not matter.
-func ExpectConsistOf(actual any, extra any, explain ...any) {
-	gomega.ExpectWithOffset(1, actual).To(gomega.ConsistOf(extra), explain...)
-}
-
 func ExpectContainElements(actual any, extra any, explain ...any) {
 	gomega.ExpectWithOffset(1, actual).To(gomega.ContainElements(extra), explain...)
 }
@@ -60,16 +50,6 @@ func ExpectNotContainElements(actual any, extra any, explain ...any) {
 	gomega.ExpectWithOffset(1, actual).NotTo(gomega.ContainElements(extra), explain...)
 }
 
-// ExpectHaveKey expects the actual map has the key in the keyset
-func ExpectHaveKey(actual any, key any, explain ...any) {
-	gomega.ExpectWithOffset(1, actual).To(gomega.HaveKey(key), explain...)
-}
-
-// ExpectEmpty expects actual is empty
-func ExpectEmpty(actual any, explain ...any) {
-	gomega.ExpectWithOffset(1, actual).To(gomega.BeEmpty(), explain...)
-}
-
 func ExpectTrue(actual any, explain ...any) {
 	gomega.ExpectWithOffset(1, actual).Should(gomega.BeTrue(), explain...)
 }

test/e2e/framework/framework.go

@@ -38,11 +38,6 @@ type Framework struct {
 	// Multiple default mock servers used for e2e testing.
 	mockServers *MockServers
 
-	// To make sure that this framework cleans up after itself, no matter what,
-	// we install a Cleanup action before each test and clear it after.  If we
-	// should abort, the AfterSuite hook should run all Cleanup actions.
-	cleanupHandle CleanupActionHandle
-
 	// beforeEachStarted indicates that BeforeEach has started
 	beforeEachStarted bool
 
@@ -87,8 +82,6 @@ func NewFramework(opt Options) *Framework {
 func (f *Framework) BeforeEach() {
 	f.beforeEachStarted = true
 
-	f.cleanupHandle = AddCleanupAction(f.AfterEach)
-
 	dir, err := os.MkdirTemp(os.TempDir(), "frp-e2e-test-*")
 	ExpectNoError(err)
 	f.TempDirectory = dir
@@ -113,8 +106,6 @@ func (f *Framework) AfterEach() {
 		return
 	}
 
-	RemoveCleanupAction(f.cleanupHandle)
-
 	// stop processor
 	for _, p := range f.serverProcesses {
 		_ = p.Stop()
@@ -266,10 +257,6 @@ func (f *Framework) AllocPortExcludingRanges(ranges ...[2]int) int {
 	return 0
 }
 
-func (f *Framework) ReleasePort(port int) {
-	f.portAllocator.Release(port)
-}
-
 func (f *Framework) RunServer(portName string, s server.Server) {
 	f.servers = append(f.servers, s)
 	if s.BindPort() > 0 && portName != "" {

test/e2e/framework/mockservers.go

@@ -75,11 +75,3 @@ func (m *MockServers) GetTemplateParams() map[string]any {
 	ret[HTTPSimpleServerPort] = m.httpSimpleServer.BindPort()
 	return ret
 }
-
-func (m *MockServers) GetParam(key string) any {
-	params := m.GetTemplateParams()
-	if v, ok := params[key]; ok {
-		return v
-	}
-	return nil
-}