mirror of
https://github.com/fatedier/frp.git
synced 2026-10-19 17:03:26 +08:00
fatedierandGitHub
399bf2ce4c
A constructor that binds a port before its fallible preparation leaks the listener when a later step returns an error, and no one can close it because the returned service is nil. pkg/util/http: load the TLS keypair and build the auth middleware before net.Listen, so binding is the last step that can run and a failure leaves no bound port behind. server: create the web server after auth, the tcpmux, main, kcp, quic, ssh gateway and vhost listeners, and the nat hole controller, following what frpc already does. If the web server itself fails, close the resources created so far before returning. The port managers start their cleanup workers on creation, so they are created after every fallible step too, and the metrics collectors keep being enabled only when the web server is configured. Add regression tests for all three failure paths.
56 lines
1.6 KiB
Go
56 lines
1.6 KiB
Go
// Copyright 2026 The frp Authors
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
package http
|
|
|
|
import (
|
|
"net"
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
|
|
v1 "github.com/fatedier/frp/pkg/config/v1"
|
|
)
|
|
|
|
func TestNewServerDoesNotLeakListenerOnTLSFailure(t *testing.T) {
|
|
dir := t.TempDir()
|
|
certFile := filepath.Join(dir, "cert.pem")
|
|
keyFile := filepath.Join(dir, "key.pem")
|
|
require.NoError(t, os.WriteFile(certFile, []byte("invalid certificate"), 0o600))
|
|
require.NoError(t, os.WriteFile(keyFile, []byte("invalid key"), 0o600))
|
|
|
|
ln, err := net.Listen("tcp", "127.0.0.1:0")
|
|
require.NoError(t, err)
|
|
address := ln.Addr().String()
|
|
port := ln.Addr().(*net.TCPAddr).Port
|
|
require.NoError(t, ln.Close())
|
|
|
|
svr, err := NewServer(v1.WebServerConfig{
|
|
Addr: "127.0.0.1",
|
|
Port: port,
|
|
TLS: &v1.TLSConfig{CertFile: certFile, KeyFile: keyFile},
|
|
})
|
|
if svr != nil {
|
|
defer svr.Close()
|
|
}
|
|
require.ErrorContains(t, err, "failed to find any PEM data in certificate input")
|
|
require.Nil(t, svr)
|
|
|
|
ln, err = net.Listen("tcp", address)
|
|
require.NoError(t, err, "web server port was not released")
|
|
require.NoError(t, ln.Close())
|
|
}
|