CodeVetter · Repo Unpack · Feature catalog

fatedier/frp

Scanned commit d20a232996 dated 2026-09-10 — last upstream commit. Generated by codevetter codevetter 1.12.0 on 2026-09-22. Deep analysis by swe-2 via the devin CLI on 2026-09-22 (runtime not recorded).

frp exposes eight proxy types (tcp, udp, http, https, tcpmux, stcp, sudp, xtcp) plus three visitor types (stcp, sudp, xtcp) for private/P2P access. Features include token and OIDC auth, per-proxy encryption/compression/bandwidth limits, load-balancer groups, health checks, PROXY protocol and host-header rewriting, HTTP server plugins, client plugins (static_file, unix_domain_socket, http(s) converters, socks5, tls2raw, virtual_net), NAT hole punching via STUN, an SSH tunnel gateway, a WireGuard-based VirtualNet, Prometheus metrics, dashboards for both daemons, and a rich frpc CLI with per-type subcommands, verify, nathole discover and admin commands.

Eight proxy types are defined by proxyConfigTypeMap in pkg/config/v1/proxy.go (TCP, UDP, HTTP, HTTPS, TCPMUX, STCP, XTCP, SUDP); NewProxyConfigurerByType instantiates typed configurers via reflection.
pkg/config/v1/proxy.go#L242-261
frpc auto-generates a cobra subcommand per proxy type (tcp, udp, tcpmux, http, https, stcp, sudp, xtcp) plus visitor subcommands for stcp/sudp/xtcp, wiring flags via config.RegisterClientCommonConfigFlags/RegisterProxyFlags.
cmd/frpc/sub/proxy.go#L45-87
Auth supports token and OIDC methods: NewAuthSetter picks NewTokenAuth or Oidc setters/verifiers, and TokenSource can dynamically resolve tokens (file/exec) via Resolve.
pkg/auth/auth.go#L64-81 pkg/auth/auth.go#L118-127 pkg/auth/oidc.go pkg/auth/token.go
Client-side plugins registered via init() include static_file, unix_domain_socket, http2http, http2https, https2http, https2https, socks5, tls2raw, virtual_net, and http_proxy; each registers a CreatorFn into pkg/plugin/client's creators map.
pkg/plugin/client/plugin.go#L33-49 pkg/plugin/client/static_file.go pkg/plugin/client/unix_domain_socket.go pkg/plugin/client/socks5.go
Server manage plugins are HTTP webhooks configured via HTTPPlugins; plugin.Manager supports six ops (Login, NewProxy, CloseProxy, Ping, NewWorkConn, NewUserConn) that can reject or mutate request content.
server/service.go#L207-211 pkg/plugin/server/manager.go#L27-44 pkg/plugin/server/manager.go#L108-170 pkg/plugin/server/http.go
xtcp P2P mode uses NAT hole punching: client/visitor exchange NatHoleVisitor/NatHoleClient messages through frps' nathole.Controller, with STUN discovery defaulting to stun.easyvoip.com:3478 (natHoleStunServer).
pkg/nathole/controller.go pkg/nathole/nathole.go#L118-120 pkg/config/v1/client.go#L50-89 server/control.go#L730-732
stcp/sudp 'secret' proxies require a shared secretKey; visitors bind a local port and connect through frps visitor-manager admission (admitVisitorByRunID / visitor.Manager).
server/control.go#L289-303 server/visitor client/visitor
Load balancing groups exist for TCP (TCPGroupCtl), HTTP (HTTPGroupCtl), HTTPS and TCPMux, letting multiple proxies share a group key and remote port.
server/service.go#L214-220 server/service.go#L348 server/proxy/tcp.go#L51-65 server/group
SSH tunnel gateway (SSHTunnelGateway.BindPort) accepts native ssh connections and forwards them into frps via an InternalListener handled like regular frp connections.
server/service.go#L101 server/service.go#L280-287 server/service.go#L381 pkg/ssh/gateway.go
VirtualNet creates a TUN device (water + wireguard-go) so visitors get an IP on a virtual network; enabled via featureGates.VirtualNet and virtualNet.address, and cannot be enabled by hot reload alone.
client/service.go#L220-222 client/service.go#L515-520 pkg/vnet/controller.go pkg/vnet/tun_linux.go
frps dashboard API exposes /healthz, /api/serverinfo, /api/proxy/{type}[/{name}], /api/traffic/{name}, /api/clients, DELETE /api/proxies, plus a parallel /api/v2 surface (users, system/info, system/prune, clients, proxies) and /metrics when EnablePrometheus.
server/api_router.go#L27-60 server/http
frpc admin API exposes /api/reload, /api/stop, /api/status, GET/PUT /api/config, per-proxy/visitor config reads, and CRUD under /api/store/proxies|visitors when the store source is enabled.
client/api_router.go#L36-55
frpc CLI extras: 'verify' subcommand validates auth against a server, 'nathole discover' probes NAT behavior, and admin subcommands call the admin API.
cmd/frpc/sub/verify.go#L27-30 cmd/frpc/sub/nathole.go#L34-47 cmd/frpc/sub/admin.go#L48-54
Per-proxy transport features include useEncryption/useCompression (golib io wrappers), bandwidthLimit with client/server mode (rate.Limiter), and proxyProtocolVersion headers built by BuildProxyProtocolHeaderStruct.
client/proxy/proxy.go#L66-70 client/proxy/proxy.go#L134-154 client/proxy/proxy.go#L210-215
Health checking of local services lives in client/health, and event hooks in client/event let proxies react to lifecycle events.
client/health/health.go client/event/event.go