Release 2019.3.0

When using sysv init scripts, `cloudflared` fails to start due to the
missing shebang interpreter line.

This patch adds the missing shebang.

.gitignore

@@ -8,3 +8,4 @@ guide/public
 .vscode
 \#*\#
 cscope.*
+cloudflared

RELEASE_NOTES

@@ -1,3 +1,29 @@
+2019.3.0
+- 2018-12-28 make http transport aware of proxy from envvar
+- 2019-02-28 TUN-1559: fix nil dereference in TunnelConfig.CloseConnOnce
+- 2019-03-04 TUN-1451: Make non-interactive, non-service execution possible on Windows
+- 2019-03-04 TUN-1562: Refactor connectedSignal to be safe to close multiple times
+- 2019-02-27 TUN-1550: Add validation timeout for non-responsive origins
+- 2019-03-06 AUTH-1531: Named flags for ssh service tokens
+- 2019-02-14 Support unix sockets.
+- 2019-03-08 TUN-1389: Non-scalar flags in a cloudflared config.yml don't get logged
+- 2019-03-07 TUN-1522: If we can't get SRV from default resolver, get them from 1.1.1.1 DoT
+
+2019.2.1
+- 2019-02-14 TUN-1381:  should tell you if you're on the latest version rather than just exiting silently
+- 2019-02-15 TUN-1467: build with Go 1.11
+- 2019-02-15 AUTH-1519: Added logging
+- 2019-02-19 TUN-1525: cloudflared metrics for registration success/fail
+- 2019-02-19 TUN-1510: Wrap the close() in sync.Once.Do
+
+2019.2.0
+- 2019-01-24 AUTH-1462: better curl arg parsing
+- 2019-02-01 TUN-1456: Only make one UUID
+- 2019-01-30 cloudflared/linux_service: Add missing /etc/init.d shebang
+- 2019-02-07 AUTH-1511: Add custom headers for ssh command
+- 2019-02-01 AUTH-1503: Added RDP support
+- 2019-02-01 AUTH-1403: Print the paths in the ssh-config instructions
+
 2019.1.0
 - 2018-12-10 TUN-1231: Horizontal overflow wrapping on the Hello page
 - 2018-12-17 TUN-1140: Show usage if invoked with no args or config

carrier/carrier.go

@@ -34,18 +34,19 @@ func (c *StdinoutStream) Write(p []byte) (int, error) {
 
 // StartClient will copy the data from stdin/stdout over a WebSocket connection
 // to the edge (originURL)
-func StartClient(logger *logrus.Logger, originURL string, stream io.ReadWriter) error {
-	return serveStream(logger, originURL, stream)
+func StartClient(logger *logrus.Logger, originURL string, stream io.ReadWriter, headers http.Header) error {
+	return serveStream(logger, originURL, stream, headers)
 }
 
 // StartServer will setup a server on a specified port and copy data over a WebSocket connection
 // to the edge (originURL)
-func StartServer(logger *logrus.Logger, address, originURL string, shutdownC <-chan struct{}) error {
+func StartServer(logger *logrus.Logger, address, originURL string, shutdownC <-chan struct{}, headers http.Header) error {
 	listener, err := net.Listen("tcp", address)
 	if err != nil {
 		logger.WithError(err).Error("failed to start forwarding server")
 		return err
 	}
+	logger.Info("Started listening on ", address)
 	defer listener.Close()
 	for {
 		select {
@@ -56,20 +57,20 @@ func StartServer(logger *logrus.Logger, address, originURL string, shutdownC <-c
 			if err != nil {
 				return err
 			}
-			go serveConnection(logger, conn, originURL)
+			go serveConnection(logger, conn, originURL, headers)
 		}
 	}
 }
 
 // serveConnection handles connections for the StartServer call
-func serveConnection(logger *logrus.Logger, c net.Conn, originURL string) {
+func serveConnection(logger *logrus.Logger, c net.Conn, originURL string, headers http.Header) {
 	defer c.Close()
-	serveStream(logger, originURL, c)
+	serveStream(logger, originURL, c, headers)
 }
 
 // serveStream will serve the data over the WebSocket stream
-func serveStream(logger *logrus.Logger, originURL string, conn io.ReadWriter) error {
-	wsConn, err := createWebsocketStream(originURL)
+func serveStream(logger *logrus.Logger, originURL string, conn io.ReadWriter, headers http.Header) error {
+	wsConn, err := createWebsocketStream(originURL, headers)
 	if err != nil {
 		logger.WithError(err).Errorf("failed to connect to %s\n", originURL)
 		return err
@@ -84,11 +85,12 @@ func serveStream(logger *logrus.Logger, originURL string, conn io.ReadWriter) er
 // createWebsocketStream will create a WebSocket connection to stream data over
 // It also handles redirects from Access and will present that flow if
 // the token is not present on the request
-func createWebsocketStream(originURL string) (*websocket.Conn, error) {
+func createWebsocketStream(originURL string, headers http.Header) (*websocket.Conn, error) {
 	req, err := http.NewRequest(http.MethodGet, originURL, nil)
 	if err != nil {
 		return nil, err
 	}
+	req.Header = headers
 
 	wsConn, resp, err := websocket.ClientConnect(req, nil)
 	if err != nil && resp != nil && resp.StatusCode > 300 {

carrier/carrier_test.go

@@ -48,7 +48,7 @@ func TestStartClient(t *testing.T) {
 	defer ts.Close()
 
 	buf := newTestStream()
-	err := StartClient(logger, "http://"+ts.Listener.Addr().String(), buf)
+	err := StartClient(logger, "http://"+ts.Listener.Addr().String(), buf, nil)
 	assert.NoError(t, err)
 	buf.Write([]byte(message))
 
@@ -66,7 +66,7 @@ func TestStartServer(t *testing.T) {
 	defer ts.Close()
 
 	go func() {
-		err := StartServer(logger, listenerAddress, "http://"+ts.Listener.Addr().String(), shutdownC)
+		err := StartServer(logger, listenerAddress, "http://"+ts.Listener.Addr().String(), shutdownC, nil)
 		if err != nil {
 			t.Fatalf("Error starting server: %v", err)
 		}

cfsetup.yaml

@@ -1,4 +1,4 @@
-pinned_go: &pinned_go go=1.9.3-1
+pinned_go: &pinned_go go=1.11.5-1
 build_dir: &build_dir /cfsetup_build/src/github.com/cloudflare/cloudflared/
 stretch: &stretch
   build:
@@ -88,4 +88,4 @@ stretch: &stretch
       - export GOARCH=amd64
       - make test
 
-jessie: *stretch
+jessie: *stretch

cmd/cloudflared/access/carrier.go

@@ -1,7 +1,9 @@
 package access
 
 import (
+	"net/http"
 	"net/url"
+	"strings"
 
 	"github.com/cloudflare/cloudflared/carrier"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
@@ -19,6 +21,13 @@ func ssh(c *cli.Context) error {
 	if err != nil || c.String("hostname") == "" {
 		return cli.ShowCommandHelp(c, "ssh")
 	}
+	headers := buildRequestHeaders(c.StringSlice("header"))
+	if c.IsSet("service-token-id") {
+		headers.Add("CF-Access-Client-Id", c.String("service-token-id"))
+	}
+	if c.IsSet("service-token-secret") {
+		headers.Add("CF-Access-Client-Secret", c.String("service-token-secret"))
+	}
 
 	if c.NArg() > 0 || c.IsSet("url") {
 		localForwarder, err := config.ValidateUrl(c)
@@ -31,8 +40,19 @@ func ssh(c *cli.Context) error {
 			logger.WithError(err).Error("Error validating origin URL")
 			return errors.Wrap(err, "error validating origin URL")
 		}
-		return carrier.StartServer(logger, forwarder.Host, "https://"+hostname, shutdownC)
+		return carrier.StartServer(logger, forwarder.Host, "https://"+hostname, shutdownC, headers)
 	}
 
-	return carrier.StartClient(logger, "https://"+hostname, &carrier.StdinoutStream{})
+	return carrier.StartClient(logger, "https://"+hostname, &carrier.StdinoutStream{}, headers)
+}
+
+func buildRequestHeaders(values []string) http.Header {
+	headers := make(http.Header)
+	for _, valuePair := range values {
+		split := strings.Split(valuePair, ":")
+		if len(split) > 1 {
+			headers.Add(strings.TrimSpace(split[0]), strings.TrimSpace(split[1]))
+		}
+	}
+	return headers
 }

cmd/cloudflared/access/carrier_test.go

@@ -0,0 +1,18 @@
+package access
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestBuildRequestHeaders(t *testing.T) {
+	headers := make(http.Header)
+	headers.Add("client", "value")
+	headers.Add("secret", "safe-value")
+
+	values := buildRequestHeaders([]string{"client: value", "secret: safe-value", "trash"})
+	assert.Equal(t, headers.Get("client"), values.Get("client"))
+	assert.Equal(t, headers.Get("secret"), values.Get("secret"))
+}

cmd/cloudflared/access/cmd.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"net/url"
 	"os"
+	"strings"
 
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/shell"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/token"
@@ -65,7 +66,7 @@ func Commands() []*cli.Command {
 				{
 					Name:   "curl",
 					Action: curl,
-					Usage:  "curl <args>",
+					Usage:  "curl [--allow-request, -ar] <url> [<curl args>...]",
 					Description: `The curl subcommand wraps curl and automatically injects the JWT into a cf-access-token
 					header when using curl to reach an application behind Access.`,
 					ArgsUsage:       "allow-request will allow the curl request to continue even if the jwt is not present.",
@@ -86,15 +87,33 @@ func Commands() []*cli.Command {
 				{
 					Name:        "ssh",
 					Action:      ssh,
+					Aliases:     []string{"rdp"},
 					Usage:       "",
 					ArgsUsage:   "",
 					Description: `The ssh subcommand sends data over a proxy to the Cloudflare edge.`,
 					Flags: []cli.Flag{
 						&cli.StringFlag{
-							Name: "hostname",
+							Name:  "hostname",
+							Usage: "specifics the hostname of your application.",
 						},
 						&cli.StringFlag{
-							Name: "url",
+							Name:  "url",
+							Usage: "specifics the host:port to forward data to Cloudflare edge.",
+						},
+						&cli.StringSliceFlag{
+							Name:    "header",
+							Aliases: []string{"H"},
+							Usage:   "specific additional headers you wish to send.",
+						},
+						&cli.StringSliceFlag{
+							Name:    "service-token-id",
+							Aliases: []string{"id"},
+							Usage:   "specific an Access service token ID you wish to use.",
+						},
+						&cli.StringSliceFlag{
+							Name:    "service-token-secret",
+							Aliases: []string{"secret"},
+							Usage:   "specific an Access service token secret you wish to use.",
 						},
 					},
 				},
@@ -139,7 +158,8 @@ func curl(c *cli.Context) error {
 		return errors.New("incorrect args")
 	}
 
-	cmdArgs, appURL, allowRequest, err := buildCurlCmdArgs(args.Slice())
+	cmdArgs, allowRequest := parseAllowRequest(args.Slice())
+	appURL, err := getAppURL(cmdArgs)
 	if err != nil {
 		return err
 	}
@@ -185,10 +205,37 @@ func generateToken(c *cli.Context) error {
 
 // sshConfig prints an example SSH config to stdout
 func sshConfig(c *cli.Context) error {
-	_, err := os.Stdout.Write([]byte(`Add this configuration block to your $HOME/.ssh/config
-		Host <your hostname>
-		    ProxyCommand cloudflared access ssh --hostname %h` + "\n"))
-	return err
+	outputMessage := "Add this configuration block to your %s/.ssh/config:\n\nHost [your hostname]\n\tProxyCommand %s access ssh --hostname %%h\n"
+	logger.Printf(outputMessage, os.Getenv("HOME"), cloudflaredPath())
+	return nil
+}
+
+// getAppURL will pull the appURL needed for fetching a user's Access token
+func getAppURL(cmdArgs []string) (*url.URL, error) {
+	if len(cmdArgs) < 1 {
+		logger.Error("Please provide a valid URL as the first argument to curl.")
+		return nil, errors.New("not a valid url")
+	}
+
+	u, err := processURL(cmdArgs[0])
+	if err != nil {
+		logger.Error("Please provide a valid URL as the first argument to curl.")
+		return nil, err
+	}
+
+	return u, err
+}
+
+// parseAllowRequest will parse cmdArgs and return a copy of the args and result
+// of the allow request was present
+func parseAllowRequest(cmdArgs []string) ([]string, bool) {
+	if len(cmdArgs) > 1 {
+		if cmdArgs[0] == "--allow-request" || cmdArgs[0] == "-ar" {
+			return cmdArgs[1:], true
+		}
+	}
+
+	return cmdArgs, false
 }
 
 // processURL will preprocess the string (parse to a url, convert to punycode, etc).
@@ -197,6 +244,11 @@ func processURL(s string) (*url.URL, error) {
 	if err != nil {
 		return nil, err
 	}
+
+	if u.Host == "" {
+		return nil, errors.New("not a valid host")
+	}
+
 	host, err := idna.ToASCII(u.Hostname())
 	if err != nil { // we fail to convert to punycode, just return the url we parsed.
 		return u, nil
@@ -210,33 +262,22 @@ func processURL(s string) (*url.URL, error) {
 	return u, nil
 }
 
-// buildCurlCmdArgs will build the curl cmd args
-func buildCurlCmdArgs(cmdArgs []string) ([]string, *url.URL, bool, error) {
-	allowRequest, iAllowRequest := false, 0
-	var appURL *url.URL
-	for i, arg := range cmdArgs {
-		if arg == "-allow-request" || arg == "-ar" {
-			iAllowRequest = i
-			allowRequest = true
-		}
-
-		u, err := processURL(arg)
-		if err == nil {
-			appURL = u
-			cmdArgs[i] = appURL.String()
+// cloudflaredPath pulls the full path of cloudflared on disk
+func cloudflaredPath() string {
+	for _, p := range strings.Split(os.Getenv("PATH"), ":") {
+		path := fmt.Sprintf("%s/%s", p, "cloudflared")
+		if isFileThere(path) {
+			return path
 		}
 	}
-
-	if appURL == nil {
-		logger.Error("Please provide a valid URL.")
-		return cmdArgs, appURL, allowRequest, errors.New("invalid url")
-	}
-
-	if allowRequest {
-		// remove from cmdArgs
-		cmdArgs[iAllowRequest] = cmdArgs[len(cmdArgs)-1]
-		cmdArgs = cmdArgs[:len(cmdArgs)-1]
-	}
-
-	return cmdArgs, appURL, allowRequest, nil
+	return "cloudflared"
+}
+
+// isFileThere will check for the presence of candidate path
+func isFileThere(candidate string) bool {
+	fi, err := os.Stat(candidate)
+	if err != nil || fi.IsDir() || !fi.Mode().IsRegular() {
+		return false
+	}
+	return true
 }

cmd/cloudflared/config/configuration.go

@@ -63,7 +63,17 @@ func FindDefaultConfigPath() string {
 	return ""
 }
 
+// ValidateUnixSocket ensures --unix-socket param is used exclusively
+// i.e. it fails if a user specifies both --url and --unix-socket
+func ValidateUnixSocket(c *cli.Context) (string, error) {
+	if c.IsSet("unix-socket") && (c.IsSet("url") || c.NArg() > 0) {
+		return "", errors.New("--unix-socket must be used exclusivly.")
+	}
+	return c.String("unix-socket"), nil
+}
+
 // ValidateUrl will validate url flag correctness. It can be either from --url or argument
+// Notice ValidateUnixSocket, it will enforce --unix-socket is not used with --url or argument
 func ValidateUrl(c *cli.Context) (string, error) {
 	var url = c.String("url")
 	if c.NArg() > 0 {

cmd/cloudflared/linux_service.go

@@ -84,7 +84,8 @@ WantedBy=timers.target
 var sysvTemplate = ServiceTemplate{
 	Path:     "/etc/init.d/cloudflared",
 	FileMode: 0755,
-	Content: `# For RedHat and cousins:
+	Content: `#!/bin/sh
+# For RedHat and cousins:
 # chkconfig: 2345 99 01
 # description: Argo Tunnel agent
 # processname: {{.Path}}

cmd/cloudflared/tunnel/cmd.go

@@ -20,6 +20,7 @@ import (
 	"github.com/cloudflare/cloudflared/hello"
 	"github.com/cloudflare/cloudflared/metrics"
 	"github.com/cloudflare/cloudflared/origin"
+	"github.com/cloudflare/cloudflared/signal"
 	"github.com/cloudflare/cloudflared/tunneldns"
 	"github.com/cloudflare/cloudflared/websocket"
 	"github.com/coreos/go-systemd/daemon"
@@ -180,7 +181,7 @@ func StartServer(c *cli.Context, version string, shutdownC, graceShutdownC chan
 	var wg sync.WaitGroup
 	listeners := gracenet.Net{}
 	errC := make(chan error)
-	connectedSignal := make(chan struct{})
+	connectedSignal := signal.New(make(chan struct{}))
 	dnsReadySignal := make(chan struct{})
 
 	if c.String("config") == "" {
@@ -280,7 +281,7 @@ func StartServer(c *cli.Context, version string, shutdownC, graceShutdownC chan
 
 	// Serve DNS proxy stand-alone if no hostname or tag or app is going to run
 	if dnsProxyStandAlone(c) {
-		close(connectedSignal)
+		connectedSignal.Notify()
 		// no grace period, handle SIGINT/SIGTERM immediately
 		return waitToShutdown(&wg, errC, shutdownC, graceShutdownC, 0)
 	}
@@ -300,11 +301,7 @@ func StartServer(c *cli.Context, version string, shutdownC, graceShutdownC chan
 		c.Set("url", "https://"+helloListener.Addr().String())
 	}
 
-	if uri, err := url.Parse(c.String("url")); err == nil && uri.Scheme == "ssh" {
-		host := uri.Host
-		if uri.Port() == "" { // default to 22
-			host = uri.Hostname() + ":22"
-		}
+	if host := hostnameFromURI(c.String("url")); host != "" {
 		listener, err := net.Listen("tcp", "127.0.0.1:")
 		if err != nil {
 			logger.WithError(err).Error("Cannot start Websocket Proxy Server")
@@ -378,13 +375,13 @@ func waitToShutdown(wg *sync.WaitGroup,
 	return err
 }
 
-func notifySystemd(waitForSignal chan struct{}) {
-	<-waitForSignal
+func notifySystemd(waitForSignal *signal.Signal) {
+	<-waitForSignal.Wait()
 	daemon.SdNotify(false, "READY=1")
 }
 
-func writePidFile(waitForSignal chan struct{}, pidFile string) {
-	<-waitForSignal
+func writePidFile(waitForSignal *signal.Signal, pidFile string) {
+	<-waitForSignal.Wait()
 	file, err := os.Create(pidFile)
 	if err != nil {
 		logger.WithError(err).Errorf("Unable to write pid to %s", pidFile)
@@ -393,6 +390,27 @@ func writePidFile(waitForSignal chan struct{}, pidFile string) {
 	fmt.Fprintf(file, "%d", os.Getpid())
 }
 
+func hostnameFromURI(uri string) string {
+	u, err := url.Parse(uri)
+	if err != nil {
+		return ""
+	}
+	switch u.Scheme {
+	case "ssh":
+		return addPortIfMissing(u, 22)
+	case "rdp":
+		return addPortIfMissing(u, 3389)
+	}
+	return ""
+}
+
+func addPortIfMissing(uri *url.URL, port int) string {
+	if uri.Port() != "" {
+		return uri.Host
+	}
+	return fmt.Sprintf("%s:%d", uri.Hostname(), port)
+}
+
 func tunnelFlags(shouldHide bool) []cli.Flag {
 	return []cli.Flag{
 		&cli.StringFlag{
@@ -457,6 +475,12 @@ func tunnelFlags(shouldHide bool) []cli.Flag {
 			EnvVars: []string{"TUNNEL_URL"},
 			Hidden:  shouldHide,
 		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name:    "unix-socket",
+			Usage:   "Path to unix socket to use instead of --url",
+			EnvVars: []string{"TUNNEL_UNIX_SOCKET"},
+			Hidden:  shouldHide,
+		}),
 		altsrc.NewStringFlag(&cli.StringFlag{
 			Name:    "hostname",
 			Usage:   "Set a hostname on a Cloudflare zone to route traffic through this tunnel.",

cmd/cloudflared/tunnel/cmd_test.go

@@ -0,0 +1,15 @@
+package tunnel
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TesthostnameFromURI(t *testing.T) {
+	assert.Equal(t, "ssh://awesome.warptunnels.horse:22", hostnameFromURI("ssh://awesome.warptunnels.horse:22"))
+	assert.Equal(t, "ssh://awesome.warptunnels.horse:22", hostnameFromURI("ssh://awesome.warptunnels.horse"))
+	assert.Equal(t, "rdp://localhost:3389", hostnameFromURI("rdp://localhost"))
+	assert.Equal(t, "", hostnameFromURI("trash"))
+	assert.Equal(t, "", hostnameFromURI("https://awesomesauce.com"))
+}

cmd/cloudflared/tunnel/configuration.go

@@ -1,6 +1,7 @@
 package tunnel
 
 import (
+	"context"
 	"crypto/tls"
 	"crypto/x509"
 	"encoding/hex"
@@ -69,8 +70,16 @@ func logClientOptions(c *cli.Context) {
 	for _, flag := range c.LocalFlagNames() {
 		flags[flag] = c.Generic(flag)
 	}
+
+	sliceFlags := []string{"header", "tag", "proxy-dns-upstream", "upstream", "edge"}
+	for _, sliceFlag := range sliceFlags {
+		if len(c.StringSlice(sliceFlag)) > 0 {
+			flags[sliceFlag] = strings.Join(c.StringSlice(sliceFlag), ", ")
+		}
+	}
+
 	if len(flags) > 0 {
-		logger.Infof("Flags %v", flags)
+		logger.WithFields(flags).Info("Flags")
 	}
 
 	envs := make(map[string]string)
@@ -136,7 +145,12 @@ If you don't have a certificate signed by Cloudflare, run the command:
 	return originCert, nil
 }
 
-func prepareTunnelConfig(c *cli.Context, buildInfo *origin.BuildInfo, version string, logger, transportLogger *logrus.Logger) (*origin.TunnelConfig, error) {
+func prepareTunnelConfig(
+	c *cli.Context,
+	buildInfo *origin.BuildInfo,
+	version string, logger,
+	transportLogger *logrus.Logger,
+) (*origin.TunnelConfig, error) {
 	hostname, err := validation.ValidateHostname(c.String("hostname"))
 	if err != nil {
 		logger.WithError(err).Error("Invalid hostname")
@@ -160,7 +174,6 @@ func prepareTunnelConfig(c *cli.Context, buildInfo *origin.BuildInfo, version st
 		logger.WithError(err).Error("Error validating origin URL")
 		return nil, errors.Wrap(err, "Error validating origin URL")
 	}
-	logger.Infof("Proxying tunnel requests to %s", originURL)
 
 	originCert, err := getOriginCert(c)
 	if err != nil {
@@ -175,12 +188,7 @@ func prepareTunnelConfig(c *cli.Context, buildInfo *origin.BuildInfo, version st
 
 	tunnelMetrics := origin.NewTunnelMetrics()
 	httpTransport := &http.Transport{
-		Proxy: http.ProxyFromEnvironment,
-		DialContext: (&net.Dialer{
-			Timeout:   c.Duration("proxy-connect-timeout"),
-			KeepAlive: c.Duration("proxy-tcp-keepalive"),
-			DualStack: !c.Bool("proxy-no-happy-eyeballs"),
-		}).DialContext,
+		Proxy:                 http.ProxyFromEnvironment,
 		MaxIdleConns:          c.Int("proxy-keepalive-connections"),
 		IdleConnTimeout:       c.Duration("proxy-keepalive-timeout"),
 		TLSHandshakeTimeout:   c.Duration("proxy-tls-timeout"),
@@ -188,6 +196,29 @@ func prepareTunnelConfig(c *cli.Context, buildInfo *origin.BuildInfo, version st
 		TLSClientConfig:       &tls.Config{RootCAs: originCertPool, InsecureSkipVerify: c.IsSet("no-tls-verify")},
 	}
 
+	dialContext := (&net.Dialer{
+		Timeout:   c.Duration("proxy-connect-timeout"),
+		KeepAlive: c.Duration("proxy-tcp-keepalive"),
+		DualStack: !c.Bool("proxy-no-happy-eyeballs"),
+	}).DialContext
+
+	if c.IsSet("unix-socket") {
+		unixSocket, err := config.ValidateUnixSocket(c)
+		if err != nil {
+			logger.WithError(err).Error("Error validating --unix-socket")
+			return nil, errors.Wrap(err, "Error validating --unix-socket")
+		}
+
+		logger.Infof("Proxying tunnel requests to unix:%s", unixSocket)
+		httpTransport.DialContext = func(ctx context.Context, _, _ string) (net.Conn, error) {
+			// if --unix-socket specified, enforce network type "unix"
+			return dialContext(ctx, "unix", unixSocket)
+		}
+	} else {
+		logger.Infof("Proxying tunnel requests to %s", originURL)
+		httpTransport.DialContext = dialContext
+	}
+
 	if !c.IsSet("hello-world") && c.IsSet("origin-server-name") {
 		httpTransport.TLSClientConfig.ServerName = c.String("origin-server-name")
 	}

cmd/cloudflared/updater/update.go

@@ -30,45 +30,56 @@ EKx0BZogHSor9Wy5VztdFaAaVbsJiCbO
 	logger = log.CreateLogger()
 )
 
-type ReleaseInfo struct {
+type UpdateOutcome struct {
 	Updated bool
 	Version string
 	Error   error
 }
 
-func checkForUpdates() ReleaseInfo {
+func (uo *UpdateOutcome) noUpdate() bool {
+	return uo.Error != nil && uo.Updated == false
+}
+
+func checkForUpdateAndApply() UpdateOutcome {
 	var opts equinox.Options
 	if err := opts.SetPublicKeyPEM(publicKey); err != nil {
-		return ReleaseInfo{Error: err}
+		return UpdateOutcome{Error: err}
 	}
 
 	resp, err := equinox.Check(appID, opts)
 	switch {
 	case err == equinox.NotAvailableErr:
-		return ReleaseInfo{}
+		return UpdateOutcome{}
 	case err != nil:
-		return ReleaseInfo{Error: err}
+		return UpdateOutcome{Error: err}
 	}
 
 	err = resp.Apply()
 	if err != nil {
-		return ReleaseInfo{Error: err}
+		return UpdateOutcome{Error: err}
 	}
 
-	return ReleaseInfo{Updated: true, Version: resp.ReleaseVersion}
+	return UpdateOutcome{Updated: true, Version: resp.ReleaseVersion}
 }
 
 func Update(_ *cli.Context) error {
-	if updateApplied() {
-		os.Exit(64)
+	updateOutcome := loggedUpdate()
+	if updateOutcome.Error != nil {
+		os.Exit(10)
 	}
-	return nil
+
+	if updateOutcome.noUpdate() {
+		logger.Infof("cloudflared is up to date (%s)", updateOutcome.Version)
+	}
+
+	return updateOutcome.Error
 }
 
 func Autoupdate(freq time.Duration, listeners *gracenet.Net, shutdownC chan struct{}) error {
 	tickC := time.Tick(freq)
 	for {
-		if updateApplied() {
+		updateOutcome := loggedUpdate()
+		if updateOutcome.Updated {
 			os.Args = append(os.Args, "--is-autoupdated=true")
 			pid, err := listeners.StartProcess()
 			if err != nil {
@@ -88,16 +99,17 @@ func Autoupdate(freq time.Duration, listeners *gracenet.Net, shutdownC chan stru
 	}
 }
 
-func updateApplied() bool {
-	releaseInfo := checkForUpdates()
-	if releaseInfo.Updated {
-		logger.Infof("Updated to version %s", releaseInfo.Version)
-		return true
+// Checks for an update and applies it if one is available
+func loggedUpdate() UpdateOutcome {
+	updateOutcome := checkForUpdateAndApply()
+	if updateOutcome.Updated {
+		logger.Infof("cloudflared has been updated to version %s", updateOutcome.Version)
 	}
-	if releaseInfo.Error != nil {
-		logger.WithError(releaseInfo.Error).Error("Update check failed")
+	if updateOutcome.Error != nil {
+		logger.WithError(updateOutcome.Error).Error("update check failed")
 	}
-	return false
+
+	return updateOutcome
 }
 
 func IsAutoupdateEnabled(c *cli.Context) bool {

cmd/cloudflared/windows_service.go

@@ -8,6 +8,7 @@ package main
 import (
 	"fmt"
 	"os"
+	"syscall"
 	"time"
 	"unsafe"
 
@@ -30,6 +31,10 @@ const (
 	// not defined in golang.org/x/sys/windows package
 	// https://msdn.microsoft.com/en-us/library/windows/desktop/ms681988(v=vs.85).aspx
 	serviceConfigFailureActionsFlag = 4
+
+	// ERROR_FAILED_SERVICE_CONTROLLER_CONNECT
+	// https://docs.microsoft.com/en-us/windows/desktop/debug/system-error-codes--1000-1299-
+	serviceControllerConnectionFailure = 1063
 )
 
 func runApp(app *cli.App, shutdownC, graceShutdownC chan struct{}) {
@@ -50,16 +55,48 @@ func runApp(app *cli.App, shutdownC, graceShutdownC chan struct{}) {
 		},
 	})
 
+	// `IsAnInteractiveSession()` isn't exactly equivalent to "should the
+	// process run as a normal EXE?" There are legitimate non-service cases,
+	// like running cloudflared in a GCP startup script, for which
+	// `IsAnInteractiveSession()` returns false. For more context, see:
+	//     https://github.com/judwhite/go-svc/issues/6
+	// It seems that the "correct way" to check "is this a normal EXE?" is:
+	//     1. attempt to connect to the Service Control Manager
+	//     2. get ERROR_FAILED_SERVICE_CONTROLLER_CONNECT
+	// This involves actually trying to start the service.
+
 	isIntSess, err := svc.IsAnInteractiveSession()
 	if err != nil {
 		logger.Fatalf("failed to determine if we are running in an interactive session: %v", err)
 	}
-
 	if isIntSess {
 		app.Run(os.Args)
 		return
 	}
 
+	// Run executes service name by calling windowsService which is a Handler
+	// interface that implements Execute method.
+	// It will set service status to stop after Execute returns
+	err = svc.Run(windowsServiceName, &windowsService{app: app, shutdownC: shutdownC, graceShutdownC: graceShutdownC})
+	if err != nil {
+		if errno, ok := err.(syscall.Errno); ok && int(errno) == serviceControllerConnectionFailure {
+			// Hack: assume this is a false negative from the IsAnInteractiveSession() check above.
+			// Run the app in "interactive" mode anyway.
+			app.Run(os.Args)
+			return
+		}
+		logger.Fatalf("%s service failed: %v", windowsServiceName, err)
+	}
+}
+
+type windowsService struct {
+	app            *cli.App
+	shutdownC      chan struct{}
+	graceShutdownC chan struct{}
+}
+
+// called by the package code at the start of the service
+func (s *windowsService) Execute(serviceArgs []string, r <-chan svc.ChangeRequest, statusChan chan<- svc.Status) (ssec bool, errno uint32) {
 	elog, err := eventlog.Open(windowsServiceName)
 	if err != nil {
 		logger.WithError(err).Errorf("Cannot open event log for %s", windowsServiceName)
@@ -68,26 +105,10 @@ func runApp(app *cli.App, shutdownC, graceShutdownC chan struct{}) {
 	defer elog.Close()
 
 	elog.Info(1, fmt.Sprintf("%s service starting", windowsServiceName))
-	// Run executes service name by calling windowsService which is a Handler
-	// interface that implements Execute method.
-	// It will set service status to stop after Execute returns
-	err = svc.Run(windowsServiceName, &windowsService{app: app, elog: elog, shutdownC: shutdownC, graceShutdownC: graceShutdownC})
-	if err != nil {
-		elog.Error(1, fmt.Sprintf("%s service failed: %v", windowsServiceName, err))
-		return
-	}
-	elog.Info(1, fmt.Sprintf("%s service stopped", windowsServiceName))
-}
+	defer func() {
+		elog.Info(1, fmt.Sprintf("%s service stopped", windowsServiceName))
+	}()
 
-type windowsService struct {
-	app            *cli.App
-	elog           *eventlog.Log
-	shutdownC      chan struct{}
-	graceShutdownC chan struct{}
-}
-
-// called by the package code at the start of the service
-func (s *windowsService) Execute(serviceArgs []string, r <-chan svc.ChangeRequest, statusChan chan<- svc.Status) (ssec bool, errno uint32) {
 	// the arguments passed here are only meaningful if they were manually
 	// specified by the user, e.g. using the Services console or `sc start`.
 	// https://docs.microsoft.com/en-us/windows/desktop/services/service-entry-point
@@ -99,7 +120,7 @@ func (s *windowsService) Execute(serviceArgs []string, r <-chan svc.ChangeReques
 		// fall back to the arguments from ImagePath (or, as sc calls it, binPath)
 		args = os.Args
 	}
-	s.elog.Info(1, fmt.Sprintf("%s service arguments: %v", windowsServiceName, args))
+	elog.Info(1, fmt.Sprintf("%s service arguments: %v", windowsServiceName, args))
 
 	const cmdsAccepted = svc.AcceptStop | svc.AcceptShutdown
 	statusChan <- svc.Status{State: svc.StartPending}
@@ -114,26 +135,26 @@ func (s *windowsService) Execute(serviceArgs []string, r <-chan svc.ChangeReques
 		case c := <-r:
 			switch c.Cmd {
 			case svc.Interrogate:
-				s.elog.Info(1, fmt.Sprintf("control request 1 #%d", c))
+				elog.Info(1, fmt.Sprintf("control request 1 #%d", c))
 				statusChan <- c.CurrentStatus
 			case svc.Stop:
-				s.elog.Info(1, "received stop control request")
+				elog.Info(1, "received stop control request")
 				close(s.graceShutdownC)
 				statusChan <- svc.Status{State: svc.StopPending}
 			case svc.Shutdown:
-				s.elog.Info(1, "received shutdown control request")
+				elog.Info(1, "received shutdown control request")
 				close(s.shutdownC)
 				statusChan <- svc.Status{State: svc.StopPending}
 			default:
-				s.elog.Error(1, fmt.Sprintf("unexpected control request #%d", c))
+				elog.Error(1, fmt.Sprintf("unexpected control request #%d", c))
 			}
 		case err := <-errC:
 			ssec = true
 			if err != nil {
-				s.elog.Error(1, fmt.Sprintf("cloudflared terminated with error %v", err))
+				elog.Error(1, fmt.Sprintf("cloudflared terminated with error %v", err))
 				errno = 1
 			} else {
-				s.elog.Info(1, "cloudflared terminated without error")
+				elog.Info(1, "cloudflared terminated without error")
 				errno = 0
 			}
 			return

origin/discovery.go

@@ -1,8 +1,14 @@
 package origin
 
 import (
+	"context"
+	"crypto/tls"
 	"fmt"
 	"net"
+	"time"
+
+	"github.com/pkg/errors"
+	log "github.com/sirupsen/logrus"
 )
 
 const (
@@ -10,9 +16,25 @@ const (
 	srvService = "warp"
 	srvProto   = "tcp"
 	srvName    = "cloudflarewarp.com"
+
+	// Used to fallback to DoT when we can't use the default resolver to
+	// discover HA Warp servers (GitHub issue #75).
+	dotServerName = "cloudflare-dns.com"
+	dotServerAddr = "1.1.1.1:853"
+	dotTimeout    = time.Duration(15 * time.Second)
 )
 
-func ResolveEdgeIPs(addresses []string) ([]*net.TCPAddr, error) {
+var friendlyDNSErrorLines = []string{
+	`Please try the following things to diagnose this issue:`,
+	`  1. ensure that cloudflarewarp.com is returning "warp" service records.`,
+	`     Run your system's equivalent of: dig srv _warp._tcp.cloudflarewarp.com`,
+	`  2. ensure that your DNS resolver is not returning compressed SRV records.`,
+	`     See GitHub issue https://github.com/golang/go/issues/27546`,
+	`     For example, you could use Cloudflare's 1.1.1.1 as your resolver:`,
+	`     https://developers.cloudflare.com/1.1.1.1/setting-up-1.1.1.1/`,
+}
+
+func ResolveEdgeIPs(logger *log.Logger, addresses []string) ([]*net.TCPAddr, error) {
 	if len(addresses) > 0 {
 		var tcpAddrs []*net.TCPAddr
 		for _, address := range addresses {
@@ -28,7 +50,30 @@ func ResolveEdgeIPs(addresses []string) ([]*net.TCPAddr, error) {
 	// HA service discovery lookup
 	_, addrs, err := net.LookupSRV(srvService, srvProto, srvName)
 	if err != nil {
-		return nil, err
+		// Try to fall back to DoT from Cloudflare directly.
+		//
+		// Note: Instead of DoT, we could also have used DoH. Either of these:
+		//     - directly via the JSON API (https://1.1.1.1/dns-query?ct=application/dns-json&name=_warp._tcp.cloudflarewarp.com&type=srv)
+		//     - indirectly via `tunneldns.NewUpstreamHTTPS()`
+		// But both of these cases miss out on a key feature from the stdlib:
+		//     "The returned records are sorted by priority and randomized by weight within a priority."
+		//     (https://golang.org/pkg/net/#Resolver.LookupSRV)
+		// Does this matter? I don't know. It may someday. Let's use DoT so we don't need to worry about it.
+		// See also: Go feature request for stdlib-supported DoH: https://github.com/golang/go/issues/27552
+		r := fallbackResolver(dotServerName, dotServerAddr)
+		ctx, cancel := context.WithTimeout(context.Background(), dotTimeout)
+		defer cancel()
+		_, fallbackAddrs, fallbackErr := r.LookupSRV(ctx, srvService, srvProto, srvName)
+		if fallbackErr != nil || len(fallbackAddrs) == 0 {
+			// use the original DNS error `err` in messages, not `fallbackErr`
+			logger.Errorln("Error looking up Cloudflare edge IPs: the DNS query failed:", err)
+			for _, s := range friendlyDNSErrorLines {
+				logger.Errorln(s)
+			}
+			return nil, errors.Wrap(err, "Could not lookup srv records on _warp._tcp.cloudflarewarp.com")
+		}
+		// Accept the fallback results and keep going
+		addrs = fallbackAddrs
 	}
 	var resolvedIPsPerCNAME [][]*net.TCPAddr
 	var lookupErr error
@@ -80,3 +125,19 @@ func FlattenServiceIPs(ipsByService [][]*net.TCPAddr) []*net.TCPAddr {
 	}
 	return result
 }
+
+// Inspiration: https://github.com/artyom/dot/blob/master/dot.go
+func fallbackResolver(serverName, serverAddress string) *net.Resolver {
+	return &net.Resolver{
+		PreferGo: true,
+		Dial: func(ctx context.Context, _ string, _ string) (net.Conn, error) {
+			var dialer net.Dialer
+			conn, err := dialer.DialContext(ctx, "tcp", serverAddress)
+			if err != nil {
+				return nil, err
+			}
+			tlsConfig := &tls.Config{ServerName: serverName}
+			return tls.Client(conn, tlsConfig), nil
+		},
+	}
+}

origin/metrics.go

@@ -51,6 +51,9 @@ type TunnelMetrics struct {
 	// oldServerLocations stores the last server the tunnel was connected to
 	oldServerLocations map[string]string
 
+	regSuccess prometheus.Counter
+	regFail    *prometheus.CounterVec
+
 	muxerMetrics *muxerMetrics
 	tunnelsHA    tunnelsForHA
 }
@@ -342,6 +345,22 @@ func NewTunnelMetrics() *TunnelMetrics {
 	)
 	prometheus.MustRegister(serverLocations)
 
+	registerFail := prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Name: "tunnel_register_fail",
+			Help: "Count of tunnel registration errors by type",
+		},
+		[]string{"error"},
+	)
+	prometheus.MustRegister(registerFail)
+
+	registerSuccess := prometheus.NewCounter(
+		prometheus.CounterOpts{
+			Name: "tunnel_register_success",
+			Help: "Count of successful tunnel registrations",
+		})
+	prometheus.MustRegister(registerSuccess)
+
 	return &TunnelMetrics{
 		haConnections:                  haConnections,
 		totalRequests:                  totalRequests,
@@ -357,6 +376,8 @@ func NewTunnelMetrics() *TunnelMetrics {
 		oldServerLocations:             make(map[string]string),
 		muxerMetrics:                   newMuxerMetrics(),
 		tunnelsHA:                      NewTunnelsForHA(),
+		regSuccess:                     registerSuccess,
+		regFail:                        registerFail,
 	}
 }
 

origin/supervisor.go

@@ -5,6 +5,10 @@ import (
 	"fmt"
 	"net"
 	"time"
+
+	"github.com/cloudflare/cloudflared/signal"
+
+	"github.com/google/uuid"
 )
 
 const (
@@ -49,9 +53,9 @@ func NewSupervisor(config *TunnelConfig) *Supervisor {
 	}
 }
 
-func (s *Supervisor) Run(ctx context.Context, connectedSignal chan struct{}) error {
+func (s *Supervisor) Run(ctx context.Context, connectedSignal *signal.Signal, u uuid.UUID) error {
 	logger := s.config.Logger
-	if err := s.initialize(ctx, connectedSignal); err != nil {
+	if err := s.initialize(ctx, connectedSignal, u); err != nil {
 		return err
 	}
 	var tunnelsWaiting []int
@@ -94,7 +98,7 @@ func (s *Supervisor) Run(ctx context.Context, connectedSignal chan struct{}) err
 		case <-backoffTimer:
 			backoffTimer = nil
 			for _, index := range tunnelsWaiting {
-				go s.startTunnel(ctx, index, s.newConnectedTunnelSignal(index))
+				go s.startTunnel(ctx, index, s.newConnectedTunnelSignal(index), u)
 			}
 			tunnelsActive += len(tunnelsWaiting)
 			tunnelsWaiting = nil
@@ -118,9 +122,9 @@ func (s *Supervisor) Run(ctx context.Context, connectedSignal chan struct{}) err
 	}
 }
 
-func (s *Supervisor) initialize(ctx context.Context, connectedSignal chan struct{}) error {
+func (s *Supervisor) initialize(ctx context.Context, connectedSignal *signal.Signal, u uuid.UUID) error {
 	logger := s.config.Logger
-	edgeIPs, err := ResolveEdgeIPs(s.config.EdgeAddrs)
+	edgeIPs, err := ResolveEdgeIPs(logger, s.config.EdgeAddrs)
 	if err != nil {
 		logger.Infof("ResolveEdgeIPs err")
 		return err
@@ -133,7 +137,7 @@ func (s *Supervisor) initialize(ctx context.Context, connectedSignal chan struct
 	s.lastResolve = time.Now()
 	// check entitlement and version too old error before attempting to register more tunnels
 	s.nextUnusedEdgeIP = s.config.HAConnections
-	go s.startFirstTunnel(ctx, connectedSignal)
+	go s.startFirstTunnel(ctx, connectedSignal, u)
 	select {
 	case <-ctx.Done():
 		<-s.tunnelErrors
@@ -141,11 +145,12 @@ func (s *Supervisor) initialize(ctx context.Context, connectedSignal chan struct
 		return fmt.Errorf("context was canceled")
 	case tunnelError := <-s.tunnelErrors:
 		return tunnelError.err
-	case <-connectedSignal:
+	case <-connectedSignal.Wait():
 	}
 	// At least one successful connection, so start the rest
 	for i := 1; i < s.config.HAConnections; i++ {
-		go s.startTunnel(ctx, i, make(chan struct{}))
+		ch := signal.New(make(chan struct{}))
+		go s.startTunnel(ctx, i, ch, u)
 		time.Sleep(registrationInterval)
 	}
 	return nil
@@ -153,8 +158,8 @@ func (s *Supervisor) initialize(ctx context.Context, connectedSignal chan struct
 
 // startTunnel starts the first tunnel connection. The resulting error will be sent on
 // s.tunnelErrors. It will send a signal via connectedSignal if registration succeed
-func (s *Supervisor) startFirstTunnel(ctx context.Context, connectedSignal chan struct{}) {
-	err := ServeTunnelLoop(ctx, s.config, s.getEdgeIP(0), 0, connectedSignal)
+func (s *Supervisor) startFirstTunnel(ctx context.Context, connectedSignal *signal.Signal, u uuid.UUID) {
+	err := ServeTunnelLoop(ctx, s.config, s.getEdgeIP(0), 0, connectedSignal, u)
 	defer func() {
 		s.tunnelErrors <- tunnelError{index: 0, err: err}
 	}()
@@ -175,23 +180,23 @@ func (s *Supervisor) startFirstTunnel(ctx context.Context, connectedSignal chan
 		default:
 			return
 		}
-		err = ServeTunnelLoop(ctx, s.config, s.getEdgeIP(0), 0, connectedSignal)
+		err = ServeTunnelLoop(ctx, s.config, s.getEdgeIP(0), 0, connectedSignal, u)
 	}
 }
 
 // startTunnel starts a new tunnel connection. The resulting error will be sent on
 // s.tunnelErrors.
-func (s *Supervisor) startTunnel(ctx context.Context, index int, connectedSignal chan struct{}) {
-	err := ServeTunnelLoop(ctx, s.config, s.getEdgeIP(index), uint8(index), connectedSignal)
+func (s *Supervisor) startTunnel(ctx context.Context, index int, connectedSignal *signal.Signal, u uuid.UUID) {
+	err := ServeTunnelLoop(ctx, s.config, s.getEdgeIP(index), uint8(index), connectedSignal, u)
 	s.tunnelErrors <- tunnelError{index: index, err: err}
 }
 
-func (s *Supervisor) newConnectedTunnelSignal(index int) chan struct{} {
-	signal := make(chan struct{})
-	s.tunnelsConnecting[index] = signal
-	s.nextConnectedSignal = signal
+func (s *Supervisor) newConnectedTunnelSignal(index int) *signal.Signal {
+	sig := make(chan struct{})
+	s.tunnelsConnecting[index] = sig
+	s.nextConnectedSignal = sig
 	s.nextConnectedIndex = index
-	return signal
+	return signal.New(sig)
 }
 
 func (s *Supervisor) waitForNextTunnel(index int) bool {
@@ -218,7 +223,7 @@ func (s *Supervisor) refreshEdgeIPs() {
 	}
 	s.resolverC = make(chan resolveResult)
 	go func() {
-		edgeIPs, err := ResolveEdgeIPs(s.config.EdgeAddrs)
+		edgeIPs, err := ResolveEdgeIPs(s.config.Logger, s.config.EdgeAddrs)
 		s.resolverC <- resolveResult{edgeIPs: edgeIPs, err: err}
 	}()
 }

origin/tunnel.go

@@ -11,11 +11,11 @@ import (
 	"net/url"
 	"strconv"
 	"strings"
+	"sync"
 	"time"
 
-	"golang.org/x/sync/errgroup"
-
 	"github.com/cloudflare/cloudflared/h2mux"
+	"github.com/cloudflare/cloudflared/signal"
 	"github.com/cloudflare/cloudflared/tunnelrpc"
 	tunnelpogs "github.com/cloudflare/cloudflared/tunnelrpc/pogs"
 	"github.com/cloudflare/cloudflared/validation"
@@ -26,6 +26,7 @@ import (
 	"github.com/pkg/errors"
 	_ "github.com/prometheus/client_golang/prometheus"
 	log "github.com/sirupsen/logrus"
+	"golang.org/x/sync/errgroup"
 	rpc "zombiezen.com/go/capnproto2/rpc"
 )
 
@@ -37,8 +38,10 @@ const (
 )
 
 type TunnelConfig struct {
+	// OriginUrl may not be used if a user specifies a unix socket.
+	OriginUrl string
+
 	EdgeAddrs          []string
-	OriginUrl          string
 	Hostname           string
 	OriginCert         []byte
 	TlsConfig          *tls.Config
@@ -64,6 +67,7 @@ type TunnelConfig struct {
 	WSGI               bool
 	CompressionQuality uint64
 	IncidentLookup     IncidentLookup
+	CloseConnOnce      *sync.Once // Used to close connectedSignal no more than once
 }
 
 type dialError struct {
@@ -126,21 +130,27 @@ func (c *TunnelConfig) RegistrationOptions(connectionID uint8, OriginLocalIP str
 	}
 }
 
-func StartTunnelDaemon(config *TunnelConfig, shutdownC <-chan struct{}, connectedSignal chan struct{}) error {
+func StartTunnelDaemon(config *TunnelConfig, shutdownC <-chan struct{}, connectedSignal *signal.Signal) error {
 	ctx, cancel := context.WithCancel(context.Background())
 	go func() {
 		<-shutdownC
 		cancel()
 	}()
+
+	u, err := uuid.NewRandom()
+	if err != nil {
+		return err
+	}
+
 	// If a user specified negative HAConnections, we will treat it as requesting 1 connection
 	if config.HAConnections > 1 {
-		return NewSupervisor(config).Run(ctx, connectedSignal)
+		return NewSupervisor(config).Run(ctx, connectedSignal, u)
 	} else {
-		addrs, err := ResolveEdgeIPs(config.EdgeAddrs)
+		addrs, err := ResolveEdgeIPs(config.Logger, config.EdgeAddrs)
 		if err != nil {
 			return err
 		}
-		return ServeTunnelLoop(ctx, config, addrs[0], 0, connectedSignal)
+		return ServeTunnelLoop(ctx, config, addrs[0], 0, connectedSignal, u)
 	}
 }
 
@@ -148,23 +158,23 @@ func ServeTunnelLoop(ctx context.Context,
 	config *TunnelConfig,
 	addr *net.TCPAddr,
 	connectionID uint8,
-	connectedSignal chan struct{},
+	connectedSignal *signal.Signal,
+	u uuid.UUID,
 ) error {
 	logger := config.Logger
 	config.Metrics.incrementHaConnections()
 	defer config.Metrics.decrementHaConnections()
 	backoff := BackoffHandler{MaxRetries: config.Retries}
-	// Used to close connectedSignal no more than once
 	connectedFuse := h2mux.NewBooleanFuse()
 	go func() {
 		if connectedFuse.Await() {
-			close(connectedSignal)
+			connectedSignal.Notify()
 		}
 	}()
 	// Ensure the above goroutine will terminate if we return without connecting
 	defer connectedFuse.Fuse(false)
 	for {
-		err, recoverable := ServeTunnel(ctx, config, addr, connectionID, connectedFuse, &backoff)
+		err, recoverable := ServeTunnel(ctx, config, addr, connectionID, connectedFuse, &backoff, u)
 		if recoverable {
 			if duration, ok := backoff.GetBackoffDuration(ctx); ok {
 				logger.Infof("Retrying in %s seconds", duration)
@@ -183,6 +193,7 @@ func ServeTunnel(
 	connectionID uint8,
 	connectedFuse *h2mux.BooleanFuse,
 	backoff *BackoffHandler,
+	u uuid.UUID,
 ) (err error, recoverable bool) {
 	// Treat panics as recoverable errors
 	defer func() {
@@ -222,7 +233,7 @@ func ServeTunnel(
 	errGroup, serveCtx := errgroup.WithContext(ctx)
 
 	errGroup.Go(func() error {
-		err := RegisterTunnel(serveCtx, handler.muxer, config, connectionID, originLocalIP)
+		err := RegisterTunnel(serveCtx, handler.muxer, config, connectionID, originLocalIP, u)
 		if err == nil {
 			connectedFuse.Fuse(true)
 			backoff.SetGracePeriod()
@@ -302,6 +313,7 @@ func RegisterTunnel(
 	config *TunnelConfig,
 	connectionID uint8,
 	originLocalIP string,
+	uuid uuid.UUID,
 ) error {
 	config.TransportLogger.Debug("initiating RPC stream to register")
 	stream, err := muxer.OpenStream([]h2mux.Header{
@@ -328,10 +340,6 @@ func RegisterTunnel(
 	serverInfoPromise := tsClient.GetServerInfo(ctx, func(tunnelrpc.TunnelServer_getServerInfo_Params) error {
 		return nil
 	})
-	uuid, err := uuid.NewRandom()
-	if err != nil {
-		return clientRegisterTunnelError{cause: err}
-	}
 	registration, err := ts.RegisterTunnel(
 		ctx,
 		config.OriginCert,
@@ -346,13 +354,9 @@ func RegisterTunnel(
 	for _, logLine := range registration.LogLines {
 		config.Logger.Info(logLine)
 	}
-	if registration.Err == DuplicateConnectionError {
-		return dupConnRegisterTunnelError{}
-	} else if registration.Err != "" {
-		return serverRegisterTunnelError{
-			cause:     fmt.Errorf("Server error: %s", registration.Err),
-			permanent: registration.PermanentFailure,
-		}
+
+	if regErr := processRegisterTunnelError(registration.Err, registration.PermanentFailure, config.Metrics); regErr != nil {
+		return regErr
 	}
 
 	if registration.TunnelID != "" {
@@ -376,6 +380,22 @@ func RegisterTunnel(
 	return nil
 }
 
+func processRegisterTunnelError(err string, permanentFailure bool, metrics *TunnelMetrics) error {
+	if err == "" {
+		metrics.regSuccess.Inc()
+		return nil
+	}
+
+	metrics.regFail.WithLabelValues(err).Inc()
+	if err == DuplicateConnectionError {
+		return dupConnRegisterTunnelError{}
+	}
+	return serverRegisterTunnelError{
+		cause:     fmt.Errorf("Server error: %s", err),
+		permanent: permanentFailure,
+	}
+}
+
 func UnregisterTunnel(muxer *h2mux.Muxer, gracePeriod time.Duration, logger *log.Logger) error {
 	logger.Debug("initiating RPC stream to unregister")
 	stream, err := muxer.OpenStream([]h2mux.Header{

signal/safe_signal.go

@@ -0,0 +1,33 @@
+package signal
+
+import (
+	"sync"
+)
+
+// Signal lets goroutines signal that some event has occurred. Other goroutines can wait for the signal.
+type Signal struct {
+	ch   chan struct{}
+	once sync.Once
+}
+
+// New wraps a channel and turns it into a signal for a one-time event.
+func New(ch chan struct{}) *Signal {
+	return &Signal{
+		ch:   ch,
+		once: sync.Once{},
+	}
+}
+
+// Notify alerts any goroutines waiting on this signal that the event has occurred.
+// After the first call to Notify(), future calls are no-op.
+func (s *Signal) Notify() {
+	s.once.Do(func() {
+		close(s.ch)
+	})
+}
+
+// Wait returns a channel which will be written to when Notify() is called for the first time.
+// This channel will never be written to a second time.
+func (s *Signal) Wait() <-chan struct{} {
+	return s.ch
+}

signal/safe_signal_test.go

@@ -0,0 +1,25 @@
+package signal
+
+import (
+	"testing"
+)
+
+func TestMultiNotifyDoesntCrash(t *testing.T) {
+	sig := New(make(chan struct{}))
+	sig.Notify()
+	sig.Notify()
+	// If code has reached here without crashing, the test has passed.
+}
+
+func TestWait(t *testing.T) {
+	sig := New(make(chan struct{}))
+	sig.Notify()
+	select {
+	case <-sig.Wait():
+		// Test succeeds
+		return
+	default:
+		// sig.Wait() should have been read from, because sig.Notify() wrote to it.
+		t.Fail()
+	}
+}

tunneldns/https_upstream.go

@@ -39,6 +39,7 @@ func NewUpstreamHTTPS(endpoint string) (Upstream, error) {
 		TLSClientConfig:    tls,
 		DisableCompression: true,
 		MaxIdleConns:       1,
+		Proxy:              http.ProxyFromEnvironment,
 	}
 	http2.ConfigureTransport(transport)
 

validation/validation.go

@@ -5,6 +5,7 @@ import (
 	"net"
 	"net/url"
 	"strings"
+	"time"
 
 	"net/http"
 
@@ -14,7 +15,10 @@ import (
 
 const defaultScheme = "http"
 
-var supportedProtocol = [2]string{"http", "https"}
+var (
+	supportedProtocol = [2]string{"http", "https"}
+	validationTimeout = time.Duration(30 * time.Second)
+)
 
 func ValidateHostname(hostname string) (string, error) {
 	if hostname == "" {
@@ -149,6 +153,7 @@ func ValidateHTTPService(originURL string, hostname string, transport http.Round
 		CheckRedirect: func(req *http.Request, via []*http.Request) error {
 			return http.ErrUseLastResponse
 		},
+		Timeout: validationTimeout,
 	}
 
 	initialRequest, err := http.NewRequest("GET", parsedURL.String(), nil)

validation/validation_test.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"io/ioutil"
 	"testing"
+	"time"
 
 	"context"
 	"crypto/tls"
@@ -383,6 +384,36 @@ func TestValidateHTTPService_HTTP2HTTPS(t *testing.T) {
 	assert.Error(t, ValidateHTTPService(originURL, hostname, redirectClient.Transport))
 }
 
+// error path 3: origin URL is nonresponsive
+func TestValidateHTTPService_NonResponsiveOrigin(t *testing.T) {
+	originURL := "https://127.0.0.1/"
+	hostname := "example.com"
+	oldValidationTimeout := validationTimeout
+	defer func() {
+		validationTimeout = oldValidationTimeout
+	}()
+	validationTimeout = 500 * time.Millisecond
+
+	server, client, err := createSecureMockServerAndClient(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == "CONNECT" {
+			assert.Equal(t, "127.0.0.1:443", r.Host)
+		} else {
+			assert.Equal(t, hostname, r.Host)
+		}
+		time.Sleep(1 * time.Second)
+		w.WriteHeader(200)
+	}))
+	if !assert.NoError(t, err) {
+		t.FailNow()
+	}
+	defer server.Close()
+
+	err = ValidateHTTPService(originURL, hostname, client.Transport)
+	if err, ok := err.(net.Error); assert.True(t, ok) {
+		assert.True(t, err.Timeout())
+	}
+}
+
 type testRoundTripper func(req *http.Request) (*http.Response, error)
 
 func (f testRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {