Release 2021.12.0

Creates an abstraction over UDP Conn for origin "connection" which can
be useful for future support of complex protocols that may require
changing ports during protocol negotiation (eg. SIP, TFTP)
In addition, it removes a dependency from ingress on connection package.

CHANGES.md

@@ -1,5 +1,28 @@
 **Experimental**: This is a new format for release notes. The format and availability is subject to change.
 
+## 2021.12.0
+### New Features
+- Cloudflared binary released for amd64 linux is now FIPS compliant.
+
+### Improvements
+- Logging about connectivity to Cloudflare edge now only yields `ERR` level logging if there are no connections to
+Cloudflare edge that are active. Otherwise it logs `WARN` level.
+ 
+### Bug Fixes
+- Fixes Github issue #501.
+
+## 2021.11.0
+### Improvements
+- Fallback from `protocol:quic` to `protocol:http2` immediately if UDP connectivity isn't available. This could be because of a firewall or 
+egress rule.
+
+## 2021.10.4
+### Improvements
+- Collect quic transport metrics on RTT, packets and bytes transferred.
+
+### Bug Fixes
+- Fix race condition that was writing to the connection after the http2 handler returns.
+
 ## 2021.9.2
 
 ### New features

Makefile

@@ -1,16 +1,8 @@
-VERSION       := $(shell git describe --tags --always --dirty="-dev" --match "[0-9][0-9][0-9][0-9].*.*")
+VERSION       := $(shell git describe --tags --always --match "[0-9][0-9][0-9][0-9].*.*")
 MSI_VERSION   := $(shell git tag -l --sort=v:refname | grep "w" | tail -1 | cut -c2-)
 #MSI_VERSION expects the format of the tag to be: (wX.X.X). Starts with the w character to not break cfsetup.
 #e.g. w3.0.1 or w4.2.10. It trims off the w character when creating the MSI.
 
-ifeq ($(FIPS), true)
-	GO_BUILD_TAGS := $(GO_BUILD_TAGS) fips
-endif
-
-ifneq ($(GO_BUILD_TAGS),)
-	GO_BUILD_TAGS := -tags $(GO_BUILD_TAGS)
-endif
-
 ifeq ($(NIGHTLY), true)
 	DEB_PACKAGE_NAME := cloudflared-nightly
 	NIGHTLY_FLAGS := --conflicts cloudflared --replaces cloudflared
@@ -19,7 +11,19 @@ else
 endif
 
 DATE          := $(shell date -u '+%Y-%m-%d-%H%M UTC')
-VERSION_FLAGS := -ldflags='-X "main.Version=$(VERSION)" -X "main.BuildTime=$(DATE)"'
+VERSION_FLAGS := -X "main.Version=$(VERSION)" -X "main.BuildTime=$(DATE)"
+
+LINK_FLAGS :=
+ifeq ($(FIPS), true)
+	LINK_FLAGS := -linkmode=external -extldflags=-static $(LINK_FLAGS)
+	# Prevent linking with libc regardless of CGO enabled or not.
+	GO_BUILD_TAGS := $(GO_BUILD_TAGS) osusergo netgo fips
+endif
+
+LDFLAGS := -ldflags='$(VERSION_FLAGS) $(LINK_FLAGS)'
+ifneq ($(GO_BUILD_TAGS),)
+	GO_BUILD_TAGS := -tags "$(GO_BUILD_TAGS)"
+endif
 
 IMPORT_PATH   := github.com/cloudflare/cloudflared
 PACKAGE_DIR   := $(CURDIR)/packaging
@@ -80,17 +84,15 @@ clean:
 	go clean
 
 .PHONY: cloudflared
-cloudflared: 
+cloudflared:
 ifeq ($(FIPS), true)
 	$(info Building cloudflared with go-fips)
-	-test -f fips/fips.go && mv fips/fips.go fips/fips.go.linux-amd64
-	mv fips/fips.go.linux-amd64 fips/fips.go
+	cp -f fips/fips.go.linux-amd64 cmd/cloudflared/fips.go
 endif
-
-	GOOS=$(TARGET_OS) GOARCH=$(TARGET_ARCH) go build -v -mod=vendor $(GO_BUILD_TAGS) $(VERSION_FLAGS) $(IMPORT_PATH)/cmd/cloudflared
-
+	GOOS=$(TARGET_OS) GOARCH=$(TARGET_ARCH) go build -v -mod=vendor $(GO_BUILD_TAGS) $(LDFLAGS) $(IMPORT_PATH)/cmd/cloudflared
 ifeq ($(FIPS), true)
-	mv fips/fips.go fips/fips.go.linux-amd64
+	rm -f cmd/cloudflared/fips.go
+	./check-fips.sh cloudflared
 endif
 
 .PHONY: container
@@ -100,10 +102,10 @@ container:
 .PHONY: test
 test: vet
 ifndef CI
-	go test -v -mod=vendor -race $(VERSION_FLAGS) ./...
+	go test -v -mod=vendor -race $(LDFLAGS) ./...
 else
 	@mkdir -p .cover
-	go test -v -mod=vendor -race $(VERSION_FLAGS) -coverprofile=".cover/c.out" ./...
+	go test -v -mod=vendor -race $(LDFLAGS) -coverprofile=".cover/c.out" ./...
 	go tool cover -html ".cover/c.out" -o .cover/all.html
 endif
 
@@ -114,7 +116,7 @@ test-ssh-server:
 define publish_package
 	chmod 664 cloudflared*.$(1); \
 	for HOST in $(CF_PKG_HOSTS); do \
-		ssh-keyscan -t rsa $$HOST >> ~/.ssh/known_hosts; \
+		ssh-keyscan -t ecdsa $$HOST >> ~/.ssh/known_hosts; \
 		scp -p -4 cloudflared*.$(1) cfsync@$$HOST:/state/cf-pkg/staging/$(2)/$(TARGET_PUBLIC_REPO)/cloudflared/; \
 	done
 endef
@@ -247,8 +249,8 @@ tunnelrpc-deps:
 	capnp compile -ogo tunnelrpc/tunnelrpc.capnp
 
 .PHONY: quic-deps
-quic-deps: 
-	which capnp 
+quic-deps:
+	which capnp
 	which capnpc-go
 	capnp compile -ogo quic/schema/quic_metadata_protocol.capnp
 
@@ -258,9 +260,9 @@ vet:
 	# go get github.com/sudarshan-reddy/go-sumtype (don't do this in build directory or this will cause vendor issues)
 	# Note: If you have github.com/BurntSushi/go-sumtype then you might have to use the repo above instead
 	# for now because it uses an older version of golang.org/x/tools.
-	which go-sumtype  
+	which go-sumtype
 	go-sumtype $$(go list -mod=vendor ./...)
 
 .PHONY: goimports
 goimports:
-	for d in $$(go list -mod=readonly -f '{{.Dir}}' -a ./... | fgrep -v tunnelrpc) ; do goimports -format-only -local github.com/cloudflare/cloudflared -w $$d ; done
+	for d in $$(go list -mod=readonly -f '{{.Dir}}' -a ./... | fgrep -v tunnelrpc) ; do goimports -format-only -local github.com/cloudflare/cloudflared -w $$d ; done

RELEASE_NOTES

@@ -1,3 +1,48 @@
+2021.12.0
+- 2021-12-13 TUN-5530: Get current time from ticker
+- 2021-12-15 TUN-5544: Update CHANGES.md for next release
+- 2021-12-07 TUN-5519: Adjust URL for virtual_networks endpoint to match what we will publish
+- 2021-12-02 TUN-5488: Close session after it's idle for a period defined by registerUdpSession RPC
+- 2021-12-09 TUN-5504: Fix upload of packages to public repo
+- 2021-11-30 TUN-5481: Create abstraction for Origin UDP Connection
+- 2021-11-30 TUN-5422: Define RPC to unregister session
+- 2021-11-26 TUN-5361: Commands for managing virtual networks
+- 2021-11-29 TUN-5362: Adjust route ip commands to be aware of virtual networks
+- 2021-11-23 TUN-5301: Separate datagram multiplex and session management logic from quic connection logic
+- 2021-11-10 TUN-5405: Update net package to v0.0.0-20211109214657-ef0fda0de508
+- 2021-11-10 TUN-5408: Update quic package to v0.24.0
+- 2021-11-12 Fix typos
+- 2021-11-13 Fix for Issue #501: Unexpected User-agent insertion when tunneling http request
+- 2021-11-16 TUN-5129: Remove `-dev` suffix when computing version and Git has uncommitted changes
+- 2021-11-18 TUN-5441: Fix message about available protocols
+- 2021-11-12 TUN-5300: Define RPC to register UDP sessions
+- 2021-11-14 TUN-5299: Send/receive QUIC datagram from edge and proxy to origin as UDP
+- 2021-11-04 TUN-5387: Updated CHANGES.md for 2021.11.0
+- 2021-11-08 TUN-5368: Log connection issues with LogLevel that depends on tunnel state
+- 2021-11-09 TUN-5397: Log cloudflared output when it fails to connect tunnel
+- 2021-11-09 TUN-5277: Ensure cloudflared binary is FIPS compliant on linux amd64
+- 2021-11-08 TUN-5393: Content-length is no longer a control header for non-h2mux transports
+
+2021.11.0
+- 2021-11-03 TUN-5285: Fallback to HTTP2 immediately if connection times out with no network activity
+- 2021-09-29 Add flag to 'tunnel create' subcommand to specify a base64-encoded secret
+
+2021.10.5
+- 2021-10-25 Update change log for release 2021.10.4
+- 2021-10-25 Revert "TUN-5184: Make sure outstanding websocket write is finished, and no more writes after shutdown"
+
+2021.10.4
+- 2021-10-21 TUN-5287: Fix misuse of wait group in TestQUICServer that caused the test to exit immediately
+- 2021-10-21 TUN-5286: Upgrade crypto/ssh package to fix CVE-2020-29652
+- 2021-10-18 TUN-5262: Allow to configure max fetch size for listing queries
+- 2021-10-19 TUN-5262: Improvements to `max-fetch-size` that allow to deal with large number of tunnels in account
+- 2021-10-15 TUN-5261: Collect QUIC metrics about RTT, packets and bytes transfered and log events at tracing level
+- 2021-10-19 TUN-5184: Make sure outstanding websocket write is finished, and no more writes after shutdown
+
+2021.10.3
+- 2021-10-14 TUN-5255: Fix potential panic if Cloudflare API fails to respond to GetTunnel(id) during delete command
+- 2021-10-14 TUN-5257: Fix more cfsetup targets that were broken by recent package changes
+
 2021.10.2
 - 2021-10-11 TUN-5138: Switch to QUIC on auto protocol based on threshold
 - 2021-10-14 TUN-5250: Add missing packages for cfsetup to succeed in github release pkgs target

build-packages.sh

@@ -1,12 +1,15 @@
 VERSION=$(git describe --tags --always --dirty="-dev" --match "[0-9][0-9][0-9][0-9].*.*")
 echo $VERSION
+
+# Avoid depending on C code since we don't need it.
 export CGO_ENABLED=0
+
 # This controls the directory the built artifacts go into
 export ARTIFACT_DIR=built_artifacts/
 mkdir -p $ARTIFACT_DIR
 windowsArchs=("amd64" "386")
 export TARGET_OS=windows
-for arch in ${windowsArchs[@]}; do 
+for arch in ${windowsArchs[@]}; do
     export TARGET_ARCH=$arch
     make cloudflared-msi
     mv ./cloudflared.exe $ARTIFACT_DIR/cloudflared-windows-$arch.exe
@@ -14,15 +17,20 @@ for arch in ${windowsArchs[@]}; do
 done
 
 
-export FIPS=true
-linuxArchs=("amd64" "386" "arm" "arm64")
+# amd64 is last because we override settings for it
+linuxArchs=("386" "arm" "arm64" "amd64")
 export TARGET_OS=linux
-for arch in ${linuxArchs[@]}; do 
+for arch in ${linuxArchs[@]}; do
+    if [ "${arch}" = "amd64" ]; then
+        export FIPS=true
+        # For BoringCrypto to link, we need CGO enabled. Otherwise compilation fails.
+        export CGO_ENABLED=1
+    fi
     export TARGET_ARCH=$arch
     make cloudflared-deb
     mv cloudflared\_$VERSION\_$arch.deb $ARTIFACT_DIR/cloudflared-linux-$arch.deb
 
-    # rpm packages invert the - and _ and use x86_64 instead of amd64. 
+    # rpm packages invert the - and _ and use x86_64 instead of amd64.
     RPMVERSION=$(echo $VERSION|sed -r 's/-/_/g')
     RPMARCH=$arch
     if [ $arch == "amd64" ];then
@@ -37,4 +45,3 @@ for arch in ${linuxArchs[@]}; do
     # finally move the linux binary as well.
     mv ./cloudflared $ARTIFACT_DIR/cloudflared-linux-$arch
 done
-

carrier/carrier.go

@@ -54,7 +54,7 @@ func (c *StdinoutStream) Write(p []byte) (int, error) {
 	return os.Stdout.Write(p)
 }
 
-// Helper to allow defering the response close with a check that the resp is not nil
+// Helper to allow deferring the response close with a check that the resp is not nil
 func closeRespBody(resp *http.Response) {
 	if resp != nil {
 		_ = resp.Body.Close()

certutil/certutil.go

@@ -66,7 +66,7 @@ func DecodeOriginCert(blocks []byte) (*OriginCert, error) {
 				originCert.ServiceKey = ntt.ServiceKey
 				originCert.AccountID = ntt.AccountID
 			} else {
-				// Try the older format, where the zoneID and service key are seperated by
+				// Try the older format, where the zoneID and service key are separated by
 				// a new line character
 				token := string(block.Bytes)
 				s := strings.Split(token, "\n")

cfsetup.yaml

@@ -1,5 +1,5 @@
 pinned_go: &pinned_go go=1.17-1
-pinned_go_fips: &pinned_go_fips go-boring=1.16.6-6
+pinned_go_fips: &pinned_go_fips go-boring=1.16.6-7
 
 build_dir: &build_dir /cfsetup_build
 default-flavor: buster
@@ -41,7 +41,6 @@ stretch: &stretch
       - wget https://github.com/sudarshan-reddy/msitools/releases/download/v0.101b/wixl -P /usr/local/bin
       - chmod a+x /usr/local/bin/wixl
     post-cache:
-      - export FIPS=true
       - ./build-packages.sh
   github-release-pkgs:
     build_dir: *build_dir
@@ -113,6 +112,9 @@ stretch: &stretch
     build_dir: *build_dir
     builddeps:
       - *pinned_go
+      - build-essential
+      - python3-dev
+      - libffi-dev
       - python3-setuptools
       - python3-pip
     pre-cache: &install_pygithub
@@ -152,7 +154,7 @@ stretch: &stretch
     post-cache:
       # Creates and routes a Named Tunnel for this build. Also constructs config file from env vars.
       - python3 component-tests/setup.py --type create
-      - pytest component-tests
+      - pytest component-tests -o log_cli=true --log-cli-level=INFO
       # The Named Tunnel is deleted and its route unprovisioned here.
       - python3 component-tests/setup.py --type cleanup
   update-homebrew:
@@ -165,6 +167,9 @@ stretch: &stretch
     build_dir: *build_dir
     builddeps:
       - *pinned_go
+      - build-essential
+      - python3-dev
+      - libffi-dev
       - python3-setuptools
       - python3-pip
     pre-cache: *install_pygithub

check-fips.sh

@@ -0,0 +1,15 @@
+# Pass the path to the executable to check for FIPS compliance
+exe=$1
+
+if [ "$(go tool nm "${exe}" | grep -c '_Cfunc__goboringcrypto_')" -eq 0 ]; then
+    # Asserts that executable is using FIPS-compliant boringcrypto
+    echo "${exe}: missing goboring symbols" >&2
+    exit 1
+fi
+if [ "$(go tool nm "${exe}" | grep -c 'crypto/internal/boring/sig.FIPSOnly')" -eq 0 ]; then
+    # Asserts that executable is using FIPS-only schemes
+    echo "${exe}: missing fipsonly symbols" >&2
+    exit 1
+fi
+
+echo "${exe} is FIPS-compliant"

cmd/cloudflared/access/cmd.go

@@ -240,7 +240,7 @@ func login(c *cli.Context) error {
 	return nil
 }
 
-// ensureURLScheme prepends a URL with https:// if it doesnt have a scheme. http:// URLs will not be converted.
+// ensureURLScheme prepends a URL with https:// if it doesn't have a scheme. http:// URLs will not be converted.
 func ensureURLScheme(url string) string {
 	url = strings.Replace(strings.ToLower(url), "http://", "https://", 1)
 	if !strings.HasPrefix(url, "https://") {

cmd/cloudflared/tunnel/cmd.go

@@ -102,6 +102,8 @@ func Commands() []*cli.Command {
 		buildLoginSubcommand(false),
 		buildCreateCommand(),
 		buildRouteCommand(),
+		// TODO TUN-5477 this should not be hidden
+		buildVirtualNetworkSubcommand(true),
 		buildRunCommand(),
 		buildListCommand(),
 		buildInfoCommand(),
@@ -181,7 +183,8 @@ func Init(ver string, gracefulShutdown chan struct{}) {
 func runAdhocNamedTunnel(sc *subcommandContext, name, credentialsOutputPath string) error {
 	tunnel, ok, err := sc.tunnelActive(name)
 	if err != nil || !ok {
-		tunnel, err = sc.create(name, credentialsOutputPath)
+		// pass empty string as secret to generate one
+		tunnel, err = sc.create(name, credentialsOutputPath, "")
 		if err != nil {
 			return errors.Wrap(err, "failed to create tunnel")
 		}
@@ -646,6 +649,12 @@ func tunnelFlags(shouldHide bool) []cli.Flag {
 			Value:  "https://api.trycloudflare.com",
 			Hidden: true,
 		}),
+		altsrc.NewIntFlag(&cli.IntFlag{
+			Name:    "max-fetch-size",
+			Usage:   `The maximum number of results that cloudflared can fetch from Cloudflare API for any listing operations needed`,
+			EnvVars: []string{"TUNNEL_MAX_FETCH_SIZE"},
+			Hidden:  true,
+		}),
 		selectProtocolFlag,
 		overwriteDNSFlag,
 	}...)

cmd/cloudflared/tunnel/subcommand_context.go

@@ -1,6 +1,7 @@
 package tunnel
 
 import (
+	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"os"
@@ -148,15 +149,27 @@ func (sc *subcommandContext) readTunnelCredentials(credFinder CredFinder) (conne
 	return credentials, nil
 }
 
-func (sc *subcommandContext) create(name string, credentialsFilePath string) (*tunnelstore.Tunnel, error) {
+func (sc *subcommandContext) create(name string, credentialsFilePath string, secret string) (*tunnelstore.Tunnel, error) {
 	client, err := sc.client()
 	if err != nil {
 		return nil, errors.Wrap(err, "couldn't create client to talk to Cloudflare Tunnel backend")
 	}
 
-	tunnelSecret, err := generateTunnelSecret()
-	if err != nil {
-		return nil, errors.Wrap(err, "couldn't generate the secret for your new tunnel")
+	var tunnelSecret []byte
+	if secret == "" {
+		tunnelSecret, err = generateTunnelSecret()
+		if err != nil {
+			return nil, errors.Wrap(err, "couldn't generate the secret for your new tunnel")
+		}
+	} else {
+		decodedSecret, err := base64.StdEncoding.DecodeString(secret)
+		if err != nil {
+			return nil, errors.Wrap(err, "Couldn't decode tunnel secret from base64")
+		}
+		tunnelSecret = []byte(decodedSecret)
+		if len(tunnelSecret) < 32 {
+			return nil, errors.New("Decoded tunnel secret must be at least 32 bytes long")
+		}
 	}
 
 	tunnel, err := client.CreateTunnel(name, tunnelSecret)
@@ -230,7 +243,7 @@ func (sc *subcommandContext) delete(tunnelIDs []uuid.UUID) error {
 	for _, id := range tunnelIDs {
 		tunnel, err := client.GetTunnel(id)
 		if err != nil {
-			return errors.Wrapf(err, "Can't get tunnel information. Please check tunnel id: %s", tunnel.ID)
+			return errors.Wrapf(err, "Can't get tunnel information. Please check tunnel id: %s", id)
 		}
 
 		// Check if tunnel DeletedAt field has already been set
@@ -373,52 +386,42 @@ func (sc *subcommandContext) findID(input string) (uuid.UUID, error) {
 }
 
 // findIDs is just like mapping `findID` over a slice, but it only uses
-// one Tunnelstore API call.
+// one Tunnelstore API call per non-UUID input provided.
 func (sc *subcommandContext) findIDs(inputs []string) ([]uuid.UUID, error) {
+	uuids, names := splitUuids(inputs)
 
-	// Shortcut without Tunnelstore call if we find that all inputs are already UUIDs.
-	uuids, err := convertNamesToUuids(inputs, make(map[string]uuid.UUID))
-	if err == nil {
-		return uuids, nil
+	for _, name := range names {
+		filter := tunnelstore.NewFilter()
+		filter.NoDeleted()
+		filter.ByName(name)
+
+		tunnels, err := sc.list(filter)
+		if err != nil {
+			return nil, err
+		}
+
+		if len(tunnels) != 1 {
+			return nil, fmt.Errorf("there should only be 1 non-deleted Tunnel named %s", name)
+		}
+
+		uuids = append(uuids, tunnels[0].ID)
 	}
 
-	// First, look up all tunnels the user has
-	filter := tunnelstore.NewFilter()
-	filter.NoDeleted()
-	tunnels, err := sc.list(filter)
-	if err != nil {
-		return nil, err
-	}
-	// Do the pure list-processing in its own function, so that it can be
-	// unit tested easily.
-	return findIDs(tunnels, inputs)
+	return uuids, nil
 }
 
-func findIDs(tunnels []*tunnelstore.Tunnel, inputs []string) ([]uuid.UUID, error) {
-	// Put them into a dictionary for faster lookups
-	nameToID := make(map[string]uuid.UUID, len(tunnels))
-	for _, tunnel := range tunnels {
-		nameToID[tunnel.Name] = tunnel.ID
-	}
+func splitUuids(inputs []string) ([]uuid.UUID, []string) {
+	uuids := make([]uuid.UUID, 0)
+	names := make([]string, 0)
 
-	return convertNamesToUuids(inputs, nameToID)
-}
-
-func convertNamesToUuids(inputs []string, nameToID map[string]uuid.UUID) ([]uuid.UUID, error) {
-	tunnelIDs := make([]uuid.UUID, len(inputs))
-	var badInputs []string
-	for i, input := range inputs {
-		if id, err := uuid.Parse(input); err == nil {
-			tunnelIDs[i] = id
-		} else if id, ok := nameToID[input]; ok {
-			tunnelIDs[i] = id
+	for _, input := range inputs {
+		id, err := uuid.Parse(input)
+		if err != nil {
+			names = append(names, input)
 		} else {
-			badInputs = append(badInputs, input)
+			uuids = append(uuids, id)
 		}
 	}
-	if len(badInputs) > 0 {
-		msg := "Please specify either the ID or name of a tunnel. The following inputs were neither: %s"
-		return nil, fmt.Errorf(msg, strings.Join(badInputs, ", "))
-	}
-	return tunnelIDs, nil
+
+	return uuids, names
 }

cmd/cloudflared/tunnel/subcommand_context_teamnet.go

@@ -1,8 +1,6 @@
 package tunnel
 
 import (
-	"net"
-
 	"github.com/pkg/errors"
 
 	"github.com/cloudflare/cloudflared/teamnet"
@@ -26,18 +24,18 @@ func (sc *subcommandContext) addRoute(newRoute teamnet.NewRoute) (teamnet.Route,
 	return client.AddRoute(newRoute)
 }
 
-func (sc *subcommandContext) deleteRoute(network net.IPNet) error {
+func (sc *subcommandContext) deleteRoute(params teamnet.DeleteRouteParams) error {
 	client, err := sc.client()
 	if err != nil {
 		return errors.Wrap(err, noClientMsg)
 	}
-	return client.DeleteRoute(network)
+	return client.DeleteRoute(params)
 }
 
-func (sc *subcommandContext) getRouteByIP(ip net.IP) (teamnet.DetailedRoute, error) {
+func (sc *subcommandContext) getRouteByIP(params teamnet.GetRouteByIpParams) (teamnet.DetailedRoute, error) {
 	client, err := sc.client()
 	if err != nil {
 		return teamnet.DetailedRoute{}, errors.Wrap(err, noClientMsg)
 	}
-	return client.GetByIP(ip)
+	return client.GetByIP(params)
 }

cmd/cloudflared/tunnel/subcommand_context_test.go

@@ -17,79 +17,6 @@ import (
 	"github.com/cloudflare/cloudflared/tunnelstore"
 )
 
-func Test_findIDs(t *testing.T) {
-	type args struct {
-		tunnels []*tunnelstore.Tunnel
-		inputs  []string
-	}
-	tests := []struct {
-		name    string
-		args    args
-		want    []uuid.UUID
-		wantErr bool
-	}{
-		{
-			name: "input not found",
-			args: args{
-				inputs: []string{"asdf"},
-			},
-			wantErr: true,
-		},
-		{
-			name: "only UUID",
-			args: args{
-				inputs: []string{"a8398a0b-876d-48ed-b609-3fcfd67a4950"},
-			},
-			want: []uuid.UUID{uuid.MustParse("a8398a0b-876d-48ed-b609-3fcfd67a4950")},
-		},
-		{
-			name: "only name",
-			args: args{
-				tunnels: []*tunnelstore.Tunnel{
-					{
-						ID:   uuid.MustParse("a8398a0b-876d-48ed-b609-3fcfd67a4950"),
-						Name: "tunnel1",
-					},
-				},
-				inputs: []string{"tunnel1"},
-			},
-			want: []uuid.UUID{uuid.MustParse("a8398a0b-876d-48ed-b609-3fcfd67a4950")},
-		},
-		{
-			name: "both UUID and name",
-			args: args{
-				tunnels: []*tunnelstore.Tunnel{
-					{
-						ID:   uuid.MustParse("a8398a0b-876d-48ed-b609-3fcfd67a4950"),
-						Name: "tunnel1",
-					},
-					{
-						ID:   uuid.MustParse("bf028b68-744f-466e-97f8-c46161d80aa5"),
-						Name: "tunnel2",
-					},
-				},
-				inputs: []string{"tunnel1", "bf028b68-744f-466e-97f8-c46161d80aa5"},
-			},
-			want: []uuid.UUID{
-				uuid.MustParse("a8398a0b-876d-48ed-b609-3fcfd67a4950"),
-				uuid.MustParse("bf028b68-744f-466e-97f8-c46161d80aa5"),
-			},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got, err := findIDs(tt.args.tunnels, tt.args.inputs)
-			if (err != nil) != tt.wantErr {
-				t.Errorf("findIDs() error = %v, wantErr %v", err, tt.wantErr)
-				return
-			}
-			if !reflect.DeepEqual(got, tt.want) {
-				t.Errorf("findIDs() = %v, want %v", got, tt.want)
-			}
-		})
-	}
-}
-
 type mockFileSystem struct {
 	rf  func(string) ([]byte, error)
 	vfp func(string) bool

cmd/cloudflared/tunnel/subcommand_context_vnets.go

@@ -0,0 +1,40 @@
+package tunnel
+
+import (
+	"github.com/google/uuid"
+	"github.com/pkg/errors"
+
+	"github.com/cloudflare/cloudflared/vnet"
+)
+
+func (sc *subcommandContext) addVirtualNetwork(newVnet vnet.NewVirtualNetwork) (vnet.VirtualNetwork, error) {
+	client, err := sc.client()
+	if err != nil {
+		return vnet.VirtualNetwork{}, errors.Wrap(err, noClientMsg)
+	}
+	return client.CreateVirtualNetwork(newVnet)
+}
+
+func (sc *subcommandContext) listVirtualNetworks(filter *vnet.Filter) ([]*vnet.VirtualNetwork, error) {
+	client, err := sc.client()
+	if err != nil {
+		return nil, errors.Wrap(err, noClientMsg)
+	}
+	return client.ListVirtualNetworks(filter)
+}
+
+func (sc *subcommandContext) deleteVirtualNetwork(vnetId uuid.UUID) error {
+	client, err := sc.client()
+	if err != nil {
+		return errors.Wrap(err, noClientMsg)
+	}
+	return client.DeleteVirtualNetwork(vnetId)
+}
+
+func (sc *subcommandContext) updateVirtualNetwork(vnetId uuid.UUID, updates vnet.UpdateVirtualNetwork) error {
+	client, err := sc.client()
+	if err != nil {
+		return errors.Wrap(err, noClientMsg)
+	}
+	return client.UpdateVirtualNetwork(vnetId, updates)
+}

cmd/cloudflared/tunnel/subcommands.go

@@ -156,6 +156,12 @@ var (
 		Usage:   `Overwrites existing DNS records with this hostname`,
 		EnvVars: []string{"TUNNEL_FORCE_PROVISIONING_DNS"},
 	}
+	createSecretFlag = &cli.StringFlag{
+		Name:    "secret",
+		Aliases: []string{"s"},
+		Usage:   "Base64 encoded secret to set for the tunnel. The decoded secret must be at least 32 bytes long. If not specified, a random 32-byte secret will be generated.",
+		EnvVars: []string{"TUNNEL_CREATE_SECRET"},
+	}
 )
 
 func buildCreateCommand() *cli.Command {
@@ -170,7 +176,7 @@ func buildCreateCommand() *cli.Command {
   For example, to create a tunnel named 'my-tunnel' run:
 
   $ cloudflared tunnel create my-tunnel`,
-		Flags:              []cli.Flag{outputFormatFlag, credentialsFileFlagCLIOnly},
+		Flags:              []cli.Flag{outputFormatFlag, credentialsFileFlagCLIOnly, createSecretFlag},
 		CustomHelpTemplate: commandHelpTemplate(),
 	}
 }
@@ -196,7 +202,7 @@ func createCommand(c *cli.Context) error {
 	warningChecker := updater.StartWarningCheck(c)
 	defer warningChecker.LogWarningIfAny(sc.log)
 
-	_, err = sc.create(name, c.String(CredFileFlag))
+	_, err = sc.create(name, c.String(CredFileFlag), c.String(createSecretFlag.Name))
 	return errors.Wrap(err, "failed to create tunnel")
 }
 
@@ -277,6 +283,9 @@ func listCommand(c *cli.Context) error {
 		}
 		filter.ByTunnelID(tunnelID)
 	}
+	if maxFetch := c.Int("max-fetch-size"); maxFetch > 0 {
+		filter.MaxFetchSize(uint(maxFetch))
+	}
 
 	tunnels, err := sc.list(filter)
 	if err != nil {
@@ -320,7 +329,7 @@ func listCommand(c *cli.Context) error {
 	if len(tunnels) > 0 {
 		formatAndPrintTunnelList(tunnels, c.Bool("show-recently-disconnected"))
 	} else {
-		fmt.Println("You have no tunnels, use 'cloudflared tunnel create' to define a new tunnel")
+		fmt.Println("No tunnels were found for the given filter flags. You can use 'cloudflared tunnel create' to create a tunnel.")
 	}
 
 	return nil

cmd/cloudflared/tunnel/teamnet_subcommands.go

@@ -6,6 +6,7 @@ import (
 	"os"
 	"text/tabwriter"
 
+	"github.com/google/uuid"
 	"github.com/pkg/errors"
 
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/cliutil"
@@ -15,26 +16,45 @@ import (
 	"github.com/urfave/cli/v2"
 )
 
+var (
+	vnetFlag = &cli.StringFlag{
+		Name:    "virtual-network",
+		Aliases: []string{"vn"},
+		Usage:   "The ID or name of the virtual network to which the route is associated to.",
+	}
+)
+
 func buildRouteIPSubcommand() *cli.Command {
 	return &cli.Command{
 		Name:      "ip",
-		Usage:     "Configure and query Cloudflare WARP routing to services or private networks available through this tunnel.",
+		Usage:     "Configure and query Cloudflare WARP routing to private IP networks made available through Cloudflare Tunnels.",
 		UsageText: "cloudflared tunnel [--config FILEPATH] route COMMAND [arguments...]",
-		Description: `cloudflared can provision private routes from any IP space to origins in your corporate network.
-Users enrolled in your Cloudflare for Teams organization can reach those routes through the
-Cloudflare WARP client. You can also build rules to determine who can reach certain routes.`,
+		Description: `cloudflared can provision routes for any IP space in your corporate network. Users enrolled in
+your Cloudflare for Teams organization can reach those IPs through the Cloudflare WARP
+client. You can then configure L7/L4 filtering on https://dash.teams.cloudflare.com to
+determine who can reach certain routes.
+By default IP routes all exist within a single virtual network. If you use the same IP
+space(s) in different physical private networks, all meant to be reachable via IP routes,
+then you have to manage the ambiguous IP routes by associating them to virtual networks.
+See "cloudflared tunnel network --help" for more information.`,
 		Subcommands: []*cli.Command{
 			{
 				Name:      "add",
 				Action:    cliutil.ConfiguredAction(addRouteCommand),
-				Usage:     "Add any new network to the routing table reachable via the tunnel",
-				UsageText: "cloudflared tunnel [--config FILEPATH] route ip add [CIDR] [TUNNEL] [COMMENT?]",
-				Description: `Adds any network route space (represented as a CIDR) to your routing table.
-That network space becomes reachable for requests egressing from a user's machine
+				Usage:     "Add a new network to the routing table reachable via a Tunnel",
+				UsageText: "cloudflared tunnel [--config FILEPATH] route ip add [flags] [CIDR] [TUNNEL] [COMMENT?]",
+				Description: `Adds a network IP route space (represented as a CIDR) to your routing table.
+That network IP space becomes reachable for requests egressing from a user's machine
 as long as it is using Cloudflare WARP client and is enrolled in the same account
-that is running the tunnel chosen here. Further, those requests will be proxied to
-the specified tunnel, and reach an IP in the given CIDR, as long as that IP is
-reachable from the tunnel.`,
+that is running the Tunnel chosen here. Further, those requests will be proxied to
+the specified Tunnel, and reach an IP in the given CIDR, as long as that IP is
+reachable from cloudflared.
+If the CIDR exists in more than one private network, to be connected with Cloudflare
+Tunnels, then you have to manage those IP routes with virtual networks (see
+"cloudflared tunnel network --help)". In those cases, you then have to tell
+which virtual network's routing table you want to add the route to with:
+"cloudflared tunnel route ip add --virtual-network [ID/name] [CIDR] [TUNNEL]".`,
+				Flags: []cli.Flag{vnetFlag},
 			},
 			{
 				Name:        "show",
@@ -49,17 +69,22 @@ reachable from the tunnel.`,
 				Name:      "delete",
 				Action:    cliutil.ConfiguredAction(deleteRouteCommand),
 				Usage:     "Delete a row from your organization's private routing table",
-				UsageText: "cloudflared tunnel [--config FILEPATH] route ip delete [CIDR]",
-				Description: `Deletes the row for a given CIDR from your routing table. That portion
-of your network will no longer be reachable by the WARP clients.`,
+				UsageText: "cloudflared tunnel [--config FILEPATH] route ip delete [flags] [CIDR]",
+				Description: `Deletes the row for a given CIDR from your routing table. That portion of your network
+will no longer be reachable by the WARP clients. Note that if you use virtual
+networks, then you have to tell which virtual network whose routing table you
+have a row deleted from.`,
+				Flags: []cli.Flag{vnetFlag},
 			},
 			{
 				Name:      "get",
 				Action:    cliutil.ConfiguredAction(getRouteByIPCommand),
 				Usage:     "Check which row of the routing table matches a given IP.",
-				UsageText: "cloudflared tunnel [--config FILEPATH] route ip get [IP]",
-				Description: `Checks which row of the routing table will be used to proxy a given IP.
-				This helps check and validate your config.`,
+				UsageText: "cloudflared tunnel [--config FILEPATH] route ip get [flags] [IP]",
+				Description: `Checks which row of the routing table will be used to proxy a given IP. This helps check
+and validate your config. Note that if you use virtual networks, then you have
+to tell which virtual network whose routing table you want to use.`,
+				Flags: []cli.Flag{vnetFlag},
 			},
 		},
 	}
@@ -98,7 +123,7 @@ func showRoutesCommand(c *cli.Context) error {
 	if len(routes) > 0 {
 		formatAndPrintRouteList(routes)
 	} else {
-		fmt.Println("You have no routes, use 'cloudflared tunnel route ip add' to add a route")
+		fmt.Println("No routes were found for the given filter flags. You can use 'cloudflared tunnel route ip add' to add a route.")
 	}
 
 	return nil
@@ -112,7 +137,9 @@ func addRouteCommand(c *cli.Context) error {
 	if c.NArg() < 2 {
 		return errors.New("You must supply at least 2 arguments, first the network you wish to route (in CIDR form e.g. 1.2.3.4/32) and then the tunnel ID to proxy with")
 	}
+
 	args := c.Args()
+
 	_, network, err := net.ParseCIDR(args.Get(0))
 	if err != nil {
 		return errors.Wrap(err, "Invalid network CIDR")
@@ -120,19 +147,32 @@ func addRouteCommand(c *cli.Context) error {
 	if network == nil {
 		return errors.New("Invalid network CIDR")
 	}
+
 	tunnelRef := args.Get(1)
 	tunnelID, err := sc.findID(tunnelRef)
 	if err != nil {
 		return errors.Wrap(err, "Invalid tunnel")
 	}
+
 	comment := ""
 	if c.NArg() >= 3 {
 		comment = args.Get(2)
 	}
+
+	var vnetId *uuid.UUID
+	if c.IsSet(vnetFlag.Name) {
+		id, err := getVnetId(sc, c.String(vnetFlag.Name))
+		if err != nil {
+			return err
+		}
+		vnetId = &id
+	}
+
 	_, err = sc.addRoute(teamnet.NewRoute{
 		Comment:  comment,
 		Network:  *network,
 		TunnelID: tunnelID,
+		VNetID:   vnetId,
 	})
 	if err != nil {
 		return errors.Wrap(err, "API error")
@@ -146,9 +186,11 @@ func deleteRouteCommand(c *cli.Context) error {
 	if err != nil {
 		return err
 	}
+
 	if c.NArg() != 1 {
 		return errors.New("You must supply exactly one argument, the network whose route you want to delete (in CIDR form e.g. 1.2.3.4/32)")
 	}
+
 	_, network, err := net.ParseCIDR(c.Args().First())
 	if err != nil {
 		return errors.Wrap(err, "Invalid network CIDR")
@@ -156,7 +198,20 @@ func deleteRouteCommand(c *cli.Context) error {
 	if network == nil {
 		return errors.New("Invalid network CIDR")
 	}
-	if err := sc.deleteRoute(*network); err != nil {
+
+	params := teamnet.DeleteRouteParams{
+		Network: *network,
+	}
+
+	if c.IsSet(vnetFlag.Name) {
+		vnetId, err := getVnetId(sc, c.String(vnetFlag.Name))
+		if err != nil {
+			return err
+		}
+		params.VNetID = &vnetId
+	}
+
+	if err := sc.deleteRoute(params); err != nil {
 		return errors.Wrap(err, "API error")
 	}
 	fmt.Printf("Successfully deleted route for %s\n", network)
@@ -177,7 +232,20 @@ func getRouteByIPCommand(c *cli.Context) error {
 	if ip == nil {
 		return fmt.Errorf("Invalid IP %s", ipInput)
 	}
-	route, err := sc.getRouteByIP(ip)
+
+	params := teamnet.GetRouteByIpParams{
+		Ip: ip,
+	}
+
+	if c.IsSet(vnetFlag.Name) {
+		vnetId, err := getVnetId(sc, c.String(vnetFlag.Name))
+		if err != nil {
+			return err
+		}
+		params.VNetID = &vnetId
+	}
+
+	route, err := sc.getRouteByIP(params)
 	if err != nil {
 		return errors.Wrap(err, "API error")
 	}
@@ -202,7 +270,7 @@ func formatAndPrintRouteList(routes []*teamnet.DetailedRoute) {
 	defer writer.Flush()
 
 	// Print column headers with tabbed columns
-	_, _ = fmt.Fprintln(writer, "NETWORK\tCOMMENT\tTUNNEL ID\tTUNNEL NAME\tCREATED\tDELETED\t")
+	_, _ = fmt.Fprintln(writer, "NETWORK\tVIRTUAL NET ID\tCOMMENT\tTUNNEL ID\tTUNNEL NAME\tCREATED\tDELETED\t")
 
 	// Loop through routes, create formatted string for each, and print using tabwriter
 	for _, route := range routes {

cmd/cloudflared/tunnel/vnets_subcommands.go

@@ -0,0 +1,285 @@
+package tunnel
+
+import (
+	"fmt"
+	"os"
+	"text/tabwriter"
+
+	"github.com/google/uuid"
+	"github.com/pkg/errors"
+	"github.com/urfave/cli/v2"
+
+	"github.com/cloudflare/cloudflared/cmd/cloudflared/cliutil"
+	"github.com/cloudflare/cloudflared/cmd/cloudflared/updater"
+	"github.com/cloudflare/cloudflared/vnet"
+)
+
+var (
+	makeDefaultFlag = &cli.BoolFlag{
+		Name:    "default",
+		Aliases: []string{"d"},
+		Usage: "The virtual network becomes the default one for the account. This means that all operations that " +
+			"omit a virtual network will now implicitly be using this virtual network (i.e., the default one) such " +
+			"as new IP routes that are created. When this flag is not set, the virtual network will not become the " +
+			"default one in the account.",
+	}
+	newNameFlag = &cli.StringFlag{
+		Name:    "name",
+		Aliases: []string{"n"},
+		Usage:   "The new name for the virtual network.",
+	}
+	newCommentFlag = &cli.StringFlag{
+		Name:    "comment",
+		Aliases: []string{"c"},
+		Usage:   "A new comment describing the purpose of the virtual network.",
+	}
+)
+
+func buildVirtualNetworkSubcommand(hidden bool) *cli.Command {
+	return &cli.Command{
+		Name:      "network",
+		Usage:     "Configure and query virtual networks to manage private IP routes with overlapping IPs.",
+		UsageText: "cloudflared tunnel [--config FILEPATH] network COMMAND [arguments...]",
+		Description: `cloudflared allows to manage IP routes that expose origins in your private network space via their IP directly
+to clients outside (e.g. using WARP client) --- those are configurable via "cloudflared tunnel route ip" commands.
+By default, all those IP routes live in the same virtual network. Managing virtual networks (e.g. by creating a
+new one) becomes relevant when you have different private networks that have overlapping IPs. E.g.: if you have
+a private network A running Tunnel 1, and private network B running Tunnel 2, it is possible that both Tunnels
+expose the same IP space (say 10.0.0.0/8); to handle that, you have to add each IP Route (one that points to
+Tunnel 1 and another that points to Tunnel 2) in different Virtual Networks. That way, if your clients are on
+Virtual Network X, they will see Tunnel 1 (via Route A) and not see Tunnel 2 (since its Route B is associated
+to another Virtual Network Y).`,
+		Hidden: hidden,
+		Subcommands: []*cli.Command{
+			{
+				Name:      "add",
+				Action:    cliutil.ConfiguredAction(addVirtualNetworkCommand),
+				Usage:     "Add a new virtual network to which IP routes can be attached",
+				UsageText: "cloudflared tunnel [--config FILEPATH] network add [flags] NAME [\"comment\"]",
+				Description: `Adds a new virtual network. You can then attach IP routes to this virtual network with "cloudflared tunnel route ip"
+commands. By doing so, such route(s) become segregated from route(s) in another virtual networks. Note that all
+routes exist within some virtual network. If you do not specify any, then the system pre-creates a default virtual
+network to which all routes belong. That is fine if you do not have overlapping IPs within different physical
+private networks in your infrastructure exposed via Cloudflare Tunnel. Note: if a virtual network is added as
+the new default, then the previous existing default virtual network will be automatically modified to no longer
+be the current default.`,
+				Flags:  []cli.Flag{makeDefaultFlag},
+				Hidden: hidden,
+			},
+			{
+				Name:        "list",
+				Action:      cliutil.ConfiguredAction(listVirtualNetworksCommand),
+				Usage:       "Lists the virtual networks",
+				UsageText:   "cloudflared tunnel [--config FILEPATH] network list [flags]",
+				Description: "Lists the virtual networks based on the given filter flags.",
+				Flags:       listVirtualNetworksFlags(),
+				Hidden:      hidden,
+			},
+			{
+				Name:      "delete",
+				Action:    cliutil.ConfiguredAction(deleteVirtualNetworkCommand),
+				Usage:     "Delete a virtual network",
+				UsageText: "cloudflared tunnel [--config FILEPATH] network delete VIRTUAL_NETWORK",
+				Description: `Deletes the virtual network (given its ID or name). This is only possible if that virtual network is unused. 
+A virtual network may be used by IP routes or by WARP devices.`,
+				Hidden: hidden,
+			},
+			{
+				Name:      "update",
+				Action:    cliutil.ConfiguredAction(updateVirtualNetworkCommand),
+				Usage:     "Update a virtual network",
+				UsageText: "cloudflared tunnel [--config FILEPATH] network update [flags] VIRTUAL_NETWORK",
+				Description: `Updates the virtual network (given its ID or name). If this virtual network is updated to become the new
+default, then the previously existing default virtual network will also be modified to no longer be the default.
+You cannot update a virtual network to not be the default anymore directly. Instead, you should create a new
+default or update an existing one to become the default.`,
+				Flags:  []cli.Flag{newNameFlag, newCommentFlag, makeDefaultFlag},
+				Hidden: hidden,
+			},
+		},
+	}
+}
+
+func listVirtualNetworksFlags() []cli.Flag {
+	flags := make([]cli.Flag, 0)
+	flags = append(flags, vnet.FilterFlags...)
+	flags = append(flags, outputFormatFlag)
+	return flags
+}
+
+func addVirtualNetworkCommand(c *cli.Context) error {
+	sc, err := newSubcommandContext(c)
+	if err != nil {
+		return err
+	}
+	if c.NArg() < 1 {
+		return errors.New("You must supply at least 1 argument, the name of the virtual network you wish to add.")
+	}
+
+	warningChecker := updater.StartWarningCheck(c)
+	defer warningChecker.LogWarningIfAny(sc.log)
+
+	args := c.Args()
+
+	name := args.Get(0)
+
+	comment := ""
+	if c.NArg() >= 2 {
+		comment = args.Get(1)
+	}
+
+	newVnet := vnet.NewVirtualNetwork{
+		Name:      name,
+		Comment:   comment,
+		IsDefault: c.Bool(makeDefaultFlag.Name),
+	}
+	createdVnet, err := sc.addVirtualNetwork(newVnet)
+
+	if err != nil {
+		return errors.Wrap(err, "Could not add virtual network")
+	}
+
+	extraMsg := ""
+	if createdVnet.IsDefault {
+		extraMsg = " (as the new default for this account) "
+	}
+	fmt.Printf(
+		"Successfully added virtual 'network' %s with ID: %s%s\n"+
+			"You can now add IP routes attached to this virtual network. See `cloudflared tunnel route ip add -help`\n",
+		name, createdVnet.ID, extraMsg,
+	)
+	return nil
+}
+
+func listVirtualNetworksCommand(c *cli.Context) error {
+	sc, err := newSubcommandContext(c)
+	if err != nil {
+		return err
+	}
+
+	warningChecker := updater.StartWarningCheck(c)
+	defer warningChecker.LogWarningIfAny(sc.log)
+
+	filter, err := vnet.NewFromCLI(c)
+	if err != nil {
+		return errors.Wrap(err, "invalid flags for filtering virtual networks")
+	}
+
+	vnets, err := sc.listVirtualNetworks(filter)
+	if err != nil {
+		return err
+	}
+
+	if outputFormat := c.String(outputFormatFlag.Name); outputFormat != "" {
+		return renderOutput(outputFormat, vnets)
+	}
+
+	if len(vnets) > 0 {
+		formatAndPrintVnetsList(vnets)
+	} else {
+		fmt.Println("No virtual networks were found for the given filter flags. You can use 'cloudflared tunnel network add' to add a virtual network.")
+	}
+
+	return nil
+}
+
+func deleteVirtualNetworkCommand(c *cli.Context) error {
+	sc, err := newSubcommandContext(c)
+	if err != nil {
+		return err
+	}
+	if c.NArg() != 1 {
+		return errors.New("You must supply exactly one argument, either the ID or name of the virtual network to delete")
+	}
+
+	input := c.Args().Get(0)
+	vnetId, err := getVnetId(sc, input)
+	if err != nil {
+		return err
+	}
+
+	if err := sc.deleteVirtualNetwork(vnetId); err != nil {
+		return errors.Wrap(err, "API error")
+	}
+	fmt.Printf("Successfully deleted virtual network '%s'\n", input)
+	return nil
+}
+
+func updateVirtualNetworkCommand(c *cli.Context) error {
+	sc, err := newSubcommandContext(c)
+	if err != nil {
+		return err
+	}
+	if c.NArg() != 1 {
+		return errors.New(" You must supply exactly one argument, either the ID or (current) name of the virtual network to update")
+	}
+
+	input := c.Args().Get(0)
+	vnetId, err := getVnetId(sc, input)
+	if err != nil {
+		return err
+	}
+
+	updates := vnet.UpdateVirtualNetwork{}
+
+	if c.IsSet(newNameFlag.Name) {
+		newName := c.String(newNameFlag.Name)
+		updates.Name = &newName
+	}
+	if c.IsSet(newCommentFlag.Name) {
+		newComment := c.String(newCommentFlag.Name)
+		updates.Comment = &newComment
+	}
+	if c.IsSet(makeDefaultFlag.Name) {
+		isDefault := c.Bool(makeDefaultFlag.Name)
+		updates.IsDefault = &isDefault
+	}
+
+	if err := sc.updateVirtualNetwork(vnetId, updates); err != nil {
+		return errors.Wrap(err, "API error")
+	}
+	fmt.Printf("Successfully updated virtual network '%s'\n", input)
+	return nil
+}
+
+func getVnetId(sc *subcommandContext, input string) (uuid.UUID, error) {
+	val, err := uuid.Parse(input)
+	if err == nil {
+		return val, nil
+	}
+
+	filter := vnet.NewFilter()
+	filter.WithDeleted(false)
+	filter.ByName(input)
+
+	vnets, err := sc.listVirtualNetworks(filter)
+	if err != nil {
+		return uuid.Nil, err
+	}
+
+	if len(vnets) != 1 {
+		return uuid.Nil, fmt.Errorf("there should only be 1 non-deleted virtual network named %s", input)
+	}
+
+	return vnets[0].ID, nil
+}
+
+func formatAndPrintVnetsList(vnets []*vnet.VirtualNetwork) {
+	const (
+		minWidth = 0
+		tabWidth = 8
+		padding  = 1
+		padChar  = ' '
+		flags    = 0
+	)
+
+	writer := tabwriter.NewWriter(os.Stdout, minWidth, tabWidth, padding, padChar, flags)
+	defer writer.Flush()
+
+	_, _ = fmt.Fprintln(writer, "ID\tNAME\tIS DEFAULT\tCOMMENT\tCREATED\tDELETED\t")
+
+	for _, virtualNetwork := range vnets {
+		formattedStr := virtualNetwork.TableString()
+		_, _ = fmt.Fprintln(writer, formattedStr)
+	}
+}

cmd/cloudflared/updater/workers_update.go

@@ -47,7 +47,7 @@ type batchData struct {
 }
 
 // WorkersVersion implements the Version interface.
-// It contains everything needed to preform a version upgrade
+// It contains everything needed to perform a version upgrade
 type WorkersVersion struct {
 	downloadURL  string
 	checksum     string

component-tests/test_logging.py

@@ -75,7 +75,7 @@ class TestLogging:
         }
         config = component_tests_config(extra_config)
         with start_cloudflared(tmp_path, config, new_process=True, capture_output=False):
-            wait_tunnel_ready(tunnel_url=config.get_url())
+            wait_tunnel_ready(tunnel_url=config.get_url(), cfd_logs=str(log_file))
             assert_log_in_file(log_file)
             assert_json_log(log_file)
 
@@ -88,5 +88,5 @@ class TestLogging:
         }
         config = component_tests_config(extra_config)
         with start_cloudflared(tmp_path, config, new_process=True, capture_output=False):
-            wait_tunnel_ready(tunnel_url=config.get_url())
+            wait_tunnel_ready(tunnel_url=config.get_url(), cfd_logs=str(log_dir))
             assert_log_to_dir(config, log_dir)

component-tests/util.py

@@ -1,12 +1,13 @@
-from contextlib import contextmanager
 import logging
-import requests
-from retrying import retry
+import os
 import subprocess
-import yaml
-
+from contextlib import contextmanager
 from time import sleep
 
+import requests
+import yaml
+from retrying import retry
+
 from constants import METRICS_PORT, MAX_RETRIES, BACKOFF_SECS
 
 LOGGER = logging.getLogger(__name__)
@@ -19,7 +20,8 @@ def write_config(directory, config):
     return config_path
 
 
-def start_cloudflared(directory, config, cfd_args=["run"], cfd_pre_args=["tunnel"], new_process=False, allow_input=False, capture_output=True, root=False):
+def start_cloudflared(directory, config, cfd_args=["run"], cfd_pre_args=["tunnel"], new_process=False,
+                      allow_input=False, capture_output=True, root=False):
     config_path = write_config(directory, config.full_config)
     cmd = cloudflared_cmd(config, config_path, cfd_args, cfd_pre_args, root)
     if new_process:
@@ -53,18 +55,42 @@ def run_cloudflared_background(cmd, allow_input, capture_output):
             LOGGER.info(f"cloudflared log: {cfd.stderr.read()}")
 
 
+def wait_tunnel_ready(tunnel_url=None, require_min_connections=1, cfd_logs=None):
+    try:
+        inner_wait_tunnel_ready(tunnel_url, require_min_connections)
+    except Exception as e:
+        if cfd_logs is not None:
+            _log_cloudflared_logs(cfd_logs)
+        raise e
+
+
 @retry(stop_max_attempt_number=MAX_RETRIES, wait_fixed=BACKOFF_SECS * 1000)
-def wait_tunnel_ready(tunnel_url=None, require_min_connections=1):
+def inner_wait_tunnel_ready(tunnel_url=None, require_min_connections=1):
     metrics_url = f'http://localhost:{METRICS_PORT}/ready'
 
     with requests.Session() as s:
         resp = send_request(s, metrics_url, True)
-        assert resp.json()[
-            "readyConnections"] >= require_min_connections, f"Ready endpoint returned {resp.json()} but we expect at least {require_min_connections} connections"
+
+        assert resp.json()["readyConnections"] >= require_min_connections, \
+            f"Ready endpoint returned {resp.json()} but we expect at least {require_min_connections} connections"
+
         if tunnel_url is not None:
             send_request(s, tunnel_url, True)
 
 
+def _log_cloudflared_logs(cfd_logs):
+    log_file = cfd_logs
+    if os.path.isdir(cfd_logs):
+        files = os.listdir(cfd_logs)
+        if len(files) == 0:
+            return
+        log_file = os.path.join(cfd_logs, files[0])
+    with open(log_file, "r") as f:
+        LOGGER.warning("Cloudflared Tunnel was not ready:")
+        for line in f.readlines():
+            LOGGER.warning(line)
+
+
 @retry(stop_max_attempt_number=MAX_RETRIES * BACKOFF_SECS, wait_fixed=1000)
 def check_tunnel_not_connected():
     url = f'http://localhost:{METRICS_PORT}/ready'

connection/h2mux_header.go

@@ -0,0 +1,128 @@
+package connection
+
+import (
+	"fmt"
+	"net/http"
+	"net/url"
+	"strconv"
+	"strings"
+
+	"github.com/pkg/errors"
+
+	"github.com/cloudflare/cloudflared/h2mux"
+)
+
+// H2RequestHeadersToH1Request converts the HTTP/2 headers coming from origintunneld
+// to an HTTP/1 Request object destined for the local origin web service.
+// This operation includes conversion of the pseudo-headers into their closest
+// HTTP/1 equivalents. See https://tools.ietf.org/html/rfc7540#section-8.1.2.3
+func H2RequestHeadersToH1Request(h2 []h2mux.Header, h1 *http.Request) error {
+	for _, header := range h2 {
+		name := strings.ToLower(header.Name)
+		if !IsH2muxControlRequestHeader(name) {
+			continue
+		}
+
+		switch name {
+		case ":method":
+			h1.Method = header.Value
+		case ":scheme":
+			// noop - use the preexisting scheme from h1.URL
+		case ":authority":
+			// Otherwise the host header will be based on the origin URL
+			h1.Host = header.Value
+		case ":path":
+			// We don't want to be an "opinionated" proxy, so ideally we would use :path as-is.
+			// However, this HTTP/1 Request object belongs to the Go standard library,
+			// whose URL package makes some opinionated decisions about the encoding of
+			// URL characters: see the docs of https://godoc.org/net/url#URL,
+			// in particular the EscapedPath method https://godoc.org/net/url#URL.EscapedPath,
+			// which is always used when computing url.URL.String(), whether we'd like it or not.
+			//
+			// Well, not *always*. We could circumvent this by using url.URL.Opaque. But
+			// that would present unusual difficulties when using an HTTP proxy: url.URL.Opaque
+			// is treated differently when HTTP_PROXY is set!
+			// See https://github.com/golang/go/issues/5684#issuecomment-66080888
+			//
+			// This means we are subject to the behavior of net/url's function `shouldEscape`
+			// (as invoked with mode=encodePath): https://github.com/golang/go/blob/go1.12.7/src/net/url/url.go#L101
+
+			if header.Value == "*" {
+				h1.URL.Path = "*"
+				continue
+			}
+			// Due to the behavior of validation.ValidateUrl, h1.URL may
+			// already have a partial value, with or without a trailing slash.
+			base := h1.URL.String()
+			base = strings.TrimRight(base, "/")
+			// But we know :path begins with '/', because we handled '*' above - see RFC7540
+			requestURL, err := url.Parse(base + header.Value)
+			if err != nil {
+				return errors.Wrap(err, fmt.Sprintf("invalid path '%v'", header.Value))
+			}
+			h1.URL = requestURL
+		case "content-length":
+			contentLength, err := strconv.ParseInt(header.Value, 10, 64)
+			if err != nil {
+				return fmt.Errorf("unparseable content length")
+			}
+			h1.ContentLength = contentLength
+		case RequestUserHeaders:
+			// Do not forward the serialized headers to the origin -- deserialize them, and ditch the serialized version
+			// Find and parse user headers serialized into a single one
+			userHeaders, err := DeserializeHeaders(header.Value)
+			if err != nil {
+				return errors.Wrap(err, "Unable to parse user headers")
+			}
+			for _, userHeader := range userHeaders {
+				h1.Header.Add(userHeader.Name, userHeader.Value)
+			}
+		default:
+			// All other control headers shall just be proxied transparently
+			h1.Header.Add(header.Name, header.Value)
+		}
+	}
+
+	return nil
+}
+
+func H1ResponseToH2ResponseHeaders(status int, h1 http.Header) (h2 []h2mux.Header) {
+	h2 = []h2mux.Header{
+		{Name: ":status", Value: strconv.Itoa(status)},
+	}
+	userHeaders := make(http.Header, len(h1))
+	for header, values := range h1 {
+		h2name := strings.ToLower(header)
+		if h2name == "content-length" {
+			// This header has meaning in HTTP/2 and will be used by the edge,
+			// so it should be sent as an HTTP/2 response header.
+
+			// Since these are http2 headers, they're required to be lowercase
+			h2 = append(h2, h2mux.Header{Name: "content-length", Value: values[0]})
+		} else if !IsH2muxControlResponseHeader(h2name) || IsWebsocketClientHeader(h2name) {
+			// User headers, on the other hand, must all be serialized so that
+			// HTTP/2 header validation won't be applied to HTTP/1 header values
+			userHeaders[header] = values
+		}
+	}
+
+	// Perform user header serialization and set them in the single header
+	h2 = append(h2, h2mux.Header{Name: ResponseUserHeaders, Value: SerializeHeaders(userHeaders)})
+	return h2
+}
+
+// IsH2muxControlRequestHeader is called in the direction of eyeball -> origin.
+func IsH2muxControlRequestHeader(headerName string) bool {
+	return headerName == "content-length" ||
+		headerName == "connection" || headerName == "upgrade" || // Websocket request headers
+		strings.HasPrefix(headerName, ":") ||
+		strings.HasPrefix(headerName, "cf-")
+}
+
+// IsH2muxControlResponseHeader is called in the direction of eyeball <- origin.
+func IsH2muxControlResponseHeader(headerName string) bool {
+	return headerName == "content-length" ||
+		strings.HasPrefix(headerName, ":") ||
+		strings.HasPrefix(headerName, "cf-int-") ||
+		strings.HasPrefix(headerName, "cf-cloudflared-")
+}

connection/h2mux_header_test.go

@@ -0,0 +1,642 @@
+package connection
+
+import (
+	"fmt"
+	"math/rand"
+	"net/http"
+	"net/url"
+	"reflect"
+	"regexp"
+	"strings"
+	"testing"
+	"testing/quick"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/cloudflare/cloudflared/h2mux"
+)
+
+type ByName []h2mux.Header
+
+func (a ByName) Len() int      { return len(a) }
+func (a ByName) Swap(i, j int) { a[i], a[j] = a[j], a[i] }
+func (a ByName) Less(i, j int) bool {
+	if a[i].Name == a[j].Name {
+		return a[i].Value < a[j].Value
+	}
+
+	return a[i].Name < a[j].Name
+}
+
+func TestH2RequestHeadersToH1Request_RegularHeaders(t *testing.T) {
+	request, err := http.NewRequest(http.MethodGet, "http://example.com", nil)
+	assert.NoError(t, err)
+
+	mockHeaders := http.Header{
+		"Mock header 1": {"Mock value 1"},
+		"Mock header 2": {"Mock value 2"},
+	}
+
+	headersConversionErr := H2RequestHeadersToH1Request(createSerializedHeaders(RequestUserHeaders, mockHeaders), request)
+
+	assert.True(t, reflect.DeepEqual(mockHeaders, request.Header))
+	assert.NoError(t, headersConversionErr)
+}
+
+func createSerializedHeaders(headersField string, headers http.Header) []h2mux.Header {
+	return []h2mux.Header{{
+		Name:  headersField,
+		Value: SerializeHeaders(headers),
+	}}
+}
+
+func TestH2RequestHeadersToH1Request_NoHeaders(t *testing.T) {
+	request, err := http.NewRequest(http.MethodGet, "http://example.com", nil)
+	assert.NoError(t, err)
+
+	emptyHeaders := make(http.Header)
+	headersConversionErr := H2RequestHeadersToH1Request(
+		[]h2mux.Header{{
+			Name:  RequestUserHeaders,
+			Value: SerializeHeaders(emptyHeaders),
+		}},
+		request,
+	)
+
+	assert.True(t, reflect.DeepEqual(emptyHeaders, request.Header))
+	assert.NoError(t, headersConversionErr)
+}
+
+func TestH2RequestHeadersToH1Request_InvalidHostPath(t *testing.T) {
+	request, err := http.NewRequest(http.MethodGet, "http://example.com", nil)
+	assert.NoError(t, err)
+
+	mockRequestHeaders := []h2mux.Header{
+		{Name: ":path", Value: "//bad_path/"},
+		{Name: RequestUserHeaders, Value: SerializeHeaders(http.Header{"Mock header": {"Mock value"}})},
+	}
+
+	headersConversionErr := H2RequestHeadersToH1Request(mockRequestHeaders, request)
+
+	assert.Equal(t, http.Header{
+		"Mock header": []string{"Mock value"},
+	}, request.Header)
+
+	assert.Equal(t, "http://example.com//bad_path/", request.URL.String())
+
+	assert.NoError(t, headersConversionErr)
+}
+
+func TestH2RequestHeadersToH1Request_HostPathWithQuery(t *testing.T) {
+	request, err := http.NewRequest(http.MethodGet, "http://example.com/", nil)
+	assert.NoError(t, err)
+
+	mockRequestHeaders := []h2mux.Header{
+		{Name: ":path", Value: "/?query=mock%20value"},
+		{Name: RequestUserHeaders, Value: SerializeHeaders(http.Header{"Mock header": {"Mock value"}})},
+	}
+
+	headersConversionErr := H2RequestHeadersToH1Request(mockRequestHeaders, request)
+
+	assert.Equal(t, http.Header{
+		"Mock header": []string{"Mock value"},
+	}, request.Header)
+
+	assert.Equal(t, "http://example.com/?query=mock%20value", request.URL.String())
+
+	assert.NoError(t, headersConversionErr)
+}
+
+func TestH2RequestHeadersToH1Request_HostPathWithURLEncoding(t *testing.T) {
+	request, err := http.NewRequest(http.MethodGet, "http://example.com/", nil)
+	assert.NoError(t, err)
+
+	mockRequestHeaders := []h2mux.Header{
+		{Name: ":path", Value: "/mock%20path"},
+		{Name: RequestUserHeaders, Value: SerializeHeaders(http.Header{"Mock header": {"Mock value"}})},
+	}
+
+	headersConversionErr := H2RequestHeadersToH1Request(mockRequestHeaders, request)
+
+	assert.Equal(t, http.Header{
+		"Mock header": []string{"Mock value"},
+	}, request.Header)
+
+	assert.Equal(t, "http://example.com/mock%20path", request.URL.String())
+
+	assert.NoError(t, headersConversionErr)
+}
+
+func TestH2RequestHeadersToH1Request_WeirdURLs(t *testing.T) {
+	type testCase struct {
+		path string
+		want string
+	}
+	testCases := []testCase{
+		{
+			path: "",
+			want: "",
+		},
+		{
+			path: "/",
+			want: "/",
+		},
+		{
+			path: "//",
+			want: "//",
+		},
+		{
+			path: "/test",
+			want: "/test",
+		},
+		{
+			path: "//test",
+			want: "//test",
+		},
+		{
+			// https://github.com/cloudflare/cloudflared/issues/81
+			path: "//test/",
+			want: "//test/",
+		},
+		{
+			path: "/%2Ftest",
+			want: "/%2Ftest",
+		},
+		{
+			path: "//%20test",
+			want: "//%20test",
+		},
+		{
+			// https://github.com/cloudflare/cloudflared/issues/124
+			path: "/test?get=somthing%20a",
+			want: "/test?get=somthing%20a",
+		},
+		{
+			path: "/%20",
+			want: "/%20",
+		},
+		{
+			// stdlib's EscapedPath() will always percent-encode ' '
+			path: "/ ",
+			want: "/%20",
+		},
+		{
+			path: "/ a ",
+			want: "/%20a%20",
+		},
+		{
+			path: "/a%20b",
+			want: "/a%20b",
+		},
+		{
+			path: "/foo/bar;param?query#frag",
+			want: "/foo/bar;param?query#frag",
+		},
+		{
+			// stdlib's EscapedPath() will always percent-encode non-ASCII chars
+			path: "/a␠b",
+			want: "/a%E2%90%A0b",
+		},
+		{
+			path: "/a-umlaut-ä",
+			want: "/a-umlaut-%C3%A4",
+		},
+		{
+			path: "/a-umlaut-%C3%A4",
+			want: "/a-umlaut-%C3%A4",
+		},
+		{
+			path: "/a-umlaut-%c3%a4",
+			want: "/a-umlaut-%c3%a4",
+		},
+		{
+			// here the second '#' is treated as part of the fragment
+			path: "/a#b#c",
+			want: "/a#b%23c",
+		},
+		{
+			path: "/a#b␠c",
+			want: "/a#b%E2%90%A0c",
+		},
+		{
+			path: "/a#b%20c",
+			want: "/a#b%20c",
+		},
+		{
+			path: "/a#b c",
+			want: "/a#b%20c",
+		},
+		{
+			// stdlib's EscapedPath() will always percent-encode '\'
+			path: "/\\",
+			want: "/%5C",
+		},
+		{
+			path: "/a\\",
+			want: "/a%5C",
+		},
+		{
+			path: "/a,b.c.",
+			want: "/a,b.c.",
+		},
+		{
+			path: "/.",
+			want: "/.",
+		},
+		{
+			// stdlib's EscapedPath() will always percent-encode '`'
+			path: "/a`",
+			want: "/a%60",
+		},
+		{
+			path: "/a[0]",
+			want: "/a[0]",
+		},
+		{
+			path: "/?a[0]=5 &b[]=",
+			want: "/?a[0]=5 &b[]=",
+		},
+		{
+			path: "/?a=%22b%20%22",
+			want: "/?a=%22b%20%22",
+		},
+	}
+
+	for index, testCase := range testCases {
+		requestURL := "https://example.com"
+
+		request, err := http.NewRequest(http.MethodGet, requestURL, nil)
+		assert.NoError(t, err)
+
+		mockRequestHeaders := []h2mux.Header{
+			{Name: ":path", Value: testCase.path},
+			{Name: RequestUserHeaders, Value: SerializeHeaders(http.Header{"Mock header": {"Mock value"}})},
+		}
+
+		headersConversionErr := H2RequestHeadersToH1Request(mockRequestHeaders, request)
+		assert.NoError(t, headersConversionErr)
+
+		assert.Equal(t,
+			http.Header{
+				"Mock header": []string{"Mock value"},
+			},
+			request.Header)
+
+		assert.Equal(t,
+			"https://example.com"+testCase.want,
+			request.URL.String(),
+			"Failed URL index: %v %#v", index, testCase)
+	}
+}
+
+func TestH2RequestHeadersToH1Request_QuickCheck(t *testing.T) {
+	config := &quick.Config{
+		Values: func(args []reflect.Value, rand *rand.Rand) {
+			args[0] = reflect.ValueOf(randomHTTP2Path(t, rand))
+		},
+	}
+
+	type testOrigin struct {
+		url string
+
+		expectedScheme   string
+		expectedBasePath string
+	}
+	testOrigins := []testOrigin{
+		{
+			url:              "http://origin.hostname.example.com:8080",
+			expectedScheme:   "http",
+			expectedBasePath: "http://origin.hostname.example.com:8080",
+		},
+		{
+			url:              "http://origin.hostname.example.com:8080/",
+			expectedScheme:   "http",
+			expectedBasePath: "http://origin.hostname.example.com:8080",
+		},
+		{
+			url:              "http://origin.hostname.example.com:8080/api",
+			expectedScheme:   "http",
+			expectedBasePath: "http://origin.hostname.example.com:8080/api",
+		},
+		{
+			url:              "http://origin.hostname.example.com:8080/api/",
+			expectedScheme:   "http",
+			expectedBasePath: "http://origin.hostname.example.com:8080/api",
+		},
+		{
+			url:              "https://origin.hostname.example.com:8080/api",
+			expectedScheme:   "https",
+			expectedBasePath: "https://origin.hostname.example.com:8080/api",
+		},
+	}
+
+	// use multiple schemes to demonstrate that the URL is based on the
+	// origin's scheme, not the :scheme header
+	for _, testScheme := range []string{"http", "https"} {
+		for _, testOrigin := range testOrigins {
+			assertion := func(testPath string) bool {
+				const expectedMethod = "POST"
+				const expectedHostname = "request.hostname.example.com"
+
+				h2 := []h2mux.Header{
+					{Name: ":method", Value: expectedMethod},
+					{Name: ":scheme", Value: testScheme},
+					{Name: ":authority", Value: expectedHostname},
+					{Name: ":path", Value: testPath},
+					{Name: RequestUserHeaders, Value: ""},
+				}
+				h1, err := http.NewRequest("GET", testOrigin.url, nil)
+				require.NoError(t, err)
+
+				err = H2RequestHeadersToH1Request(h2, h1)
+				return assert.NoError(t, err) &&
+					assert.Equal(t, expectedMethod, h1.Method) &&
+					assert.Equal(t, expectedHostname, h1.Host) &&
+					assert.Equal(t, testOrigin.expectedScheme, h1.URL.Scheme) &&
+					assert.Equal(t, testOrigin.expectedBasePath+testPath, h1.URL.String())
+			}
+			err := quick.Check(assertion, config)
+			assert.NoError(t, err)
+		}
+	}
+}
+
+func randomASCIIPrintableChar(rand *rand.Rand) int {
+	// smallest printable ASCII char is 32, largest is 126
+	const startPrintable = 32
+	const endPrintable = 127
+	return startPrintable + rand.Intn(endPrintable-startPrintable)
+}
+
+// randomASCIIText generates an ASCII string, some of whose characters may be
+// percent-encoded. Its "logical length" (ignoring percent-encoding) is
+// between 1 and `maxLength`.
+func randomASCIIText(rand *rand.Rand, minLength int, maxLength int) string {
+	length := minLength + rand.Intn(maxLength)
+	var result strings.Builder
+	for i := 0; i < length; i++ {
+		c := randomASCIIPrintableChar(rand)
+
+		// 1/4 chance of using percent encoding when not necessary
+		if c == '%' || rand.Intn(4) == 0 {
+			result.WriteString(fmt.Sprintf("%%%02X", c))
+		} else {
+			result.WriteByte(byte(c))
+		}
+	}
+	return result.String()
+}
+
+// Calls `randomASCIIText` and ensures the result is a valid URL path,
+// i.e. one that can pass unchanged through url.URL.String()
+func randomHTTP1Path(t *testing.T, rand *rand.Rand, minLength int, maxLength int) string {
+	text := randomASCIIText(rand, minLength, maxLength)
+	re, err := regexp.Compile("[^/;,]*")
+	require.NoError(t, err)
+	return "/" + re.ReplaceAllStringFunc(text, url.PathEscape)
+}
+
+// Calls `randomASCIIText` and ensures the result is a valid URL query,
+// i.e. one that can pass unchanged through url.URL.String()
+func randomHTTP1Query(rand *rand.Rand, minLength int, maxLength int) string {
+	text := randomASCIIText(rand, minLength, maxLength)
+	return "?" + strings.ReplaceAll(text, "#", "%23")
+}
+
+// Calls `randomASCIIText` and ensures the result is a valid URL fragment,
+// i.e. one that can pass unchanged through url.URL.String()
+func randomHTTP1Fragment(t *testing.T, rand *rand.Rand, minLength int, maxLength int) string {
+	text := randomASCIIText(rand, minLength, maxLength)
+	u, err := url.Parse("#" + text)
+	require.NoError(t, err)
+	return u.String()
+}
+
+// Assemble a random :path pseudoheader that is legal by Go stdlib standards
+// (i.e. all characters will satisfy "net/url".shouldEscape for their respective locations)
+func randomHTTP2Path(t *testing.T, rand *rand.Rand) string {
+	result := randomHTTP1Path(t, rand, 1, 64)
+	if rand.Intn(2) == 1 {
+		result += randomHTTP1Query(rand, 1, 32)
+	}
+	if rand.Intn(2) == 1 {
+		result += randomHTTP1Fragment(t, rand, 1, 16)
+	}
+	return result
+}
+
+func stdlibHeaderToH2muxHeader(headers http.Header) (h2muxHeaders []h2mux.Header) {
+	for name, values := range headers {
+		for _, value := range values {
+			h2muxHeaders = append(h2muxHeaders, h2mux.Header{Name: name, Value: value})
+		}
+	}
+
+	return h2muxHeaders
+}
+
+func TestParseRequestHeaders(t *testing.T) {
+	mockUserHeadersToSerialize := http.Header{
+		"Mock-Header-One":   {"1", "1.5"},
+		"Mock-Header-Two":   {"2"},
+		"Mock-Header-Three": {"3"},
+	}
+
+	mockHeaders := []h2mux.Header{
+		{Name: "One", Value: "1"}, // will be dropped
+		{Name: "Cf-Two", Value: "cf-value-1"},
+		{Name: "Cf-Two", Value: "cf-value-2"},
+		{Name: RequestUserHeaders, Value: SerializeHeaders(mockUserHeadersToSerialize)},
+	}
+
+	expectedHeaders := []h2mux.Header{
+		{Name: "Cf-Two", Value: "cf-value-1"},
+		{Name: "Cf-Two", Value: "cf-value-2"},
+		{Name: "Mock-Header-One", Value: "1"},
+		{Name: "Mock-Header-One", Value: "1.5"},
+		{Name: "Mock-Header-Two", Value: "2"},
+		{Name: "Mock-Header-Three", Value: "3"},
+	}
+	h1 := &http.Request{
+		Header: make(http.Header),
+	}
+	err := H2RequestHeadersToH1Request(mockHeaders, h1)
+	assert.NoError(t, err)
+	assert.ElementsMatch(t, expectedHeaders, stdlibHeaderToH2muxHeader(h1.Header))
+}
+
+func TestIsH2muxControlRequestHeader(t *testing.T) {
+	controlRequestHeaders := []string{
+		// Anything that begins with cf-
+		"cf-sample-header",
+
+		// Any http2 pseudoheader
+		":sample-pseudo-header",
+
+		// content-length is a special case, it has to be there
+		// for some requests to work (per the HTTP2 spec)
+		"content-length",
+
+		// Websocket request headers
+		"connection",
+		"upgrade",
+	}
+
+	for _, header := range controlRequestHeaders {
+		assert.True(t, IsH2muxControlRequestHeader(header))
+	}
+}
+
+func TestIsH2muxControlResponseHeader(t *testing.T) {
+	controlResponseHeaders := []string{
+		// Anything that begins with cf-int- or cf-cloudflared-
+		"cf-int-sample-header",
+		"cf-cloudflared-sample-header",
+
+		// Any http2 pseudoheader
+		":sample-pseudo-header",
+
+		// content-length is a special case, it has to be there
+		// for some requests to work (per the HTTP2 spec)
+		"content-length",
+	}
+
+	for _, header := range controlResponseHeaders {
+		assert.True(t, IsH2muxControlResponseHeader(header))
+	}
+}
+
+func TestIsNotH2muxControlRequestHeader(t *testing.T) {
+	notControlRequestHeaders := []string{
+		"mock-header",
+		"another-sample-header",
+	}
+
+	for _, header := range notControlRequestHeaders {
+		assert.False(t, IsH2muxControlRequestHeader(header))
+	}
+}
+
+func TestIsNotH2muxControlResponseHeader(t *testing.T) {
+	notControlResponseHeaders := []string{
+		"mock-header",
+		"another-sample-header",
+		"upgrade",
+		"connection",
+		"cf-whatever", // On the response path, we only want to filter cf-int- and cf-cloudflared-
+	}
+
+	for _, header := range notControlResponseHeaders {
+		assert.False(t, IsH2muxControlResponseHeader(header))
+	}
+}
+
+func TestH1ResponseToH2ResponseHeaders(t *testing.T) {
+	mockHeaders := http.Header{
+		"User-header-one":       {""},
+		"User-header-two":       {"1", "2"},
+		"cf-header":             {"cf-value"},
+		"cf-int-header":         {"cf-int-value"},
+		"cf-cloudflared-header": {"cf-cloudflared-value"},
+		"Content-Length":        {"123"},
+	}
+	mockResponse := http.Response{
+		StatusCode: 200,
+		Header:     mockHeaders,
+	}
+
+	headers := H1ResponseToH2ResponseHeaders(mockResponse.StatusCode, mockResponse.Header)
+
+	serializedHeadersIndex := -1
+	for i, header := range headers {
+		if header.Name == ResponseUserHeaders {
+			serializedHeadersIndex = i
+			break
+		}
+	}
+	assert.NotEqual(t, -1, serializedHeadersIndex)
+	actualControlHeaders := append(
+		headers[:serializedHeadersIndex],
+		headers[serializedHeadersIndex+1:]...,
+	)
+	expectedControlHeaders := []h2mux.Header{
+		{Name: ":status", Value: "200"},
+		{Name: "content-length", Value: "123"},
+	}
+
+	assert.ElementsMatch(t, expectedControlHeaders, actualControlHeaders)
+
+	actualUserHeaders, err := DeserializeHeaders(headers[serializedHeadersIndex].Value)
+	expectedUserHeaders := []h2mux.Header{
+		{Name: "User-header-one", Value: ""},
+		{Name: "User-header-two", Value: "1"},
+		{Name: "User-header-two", Value: "2"},
+		{Name: "cf-header", Value: "cf-value"},
+	}
+	assert.NoError(t, err)
+	assert.ElementsMatch(t, expectedUserHeaders, actualUserHeaders)
+}
+
+// The purpose of this test is to check that our code and the http.Header
+// implementation don't throw validation errors about header size
+func TestHeaderSize(t *testing.T) {
+	largeValue := randSeq(5 * 1024 * 1024) // 5Mb
+	largeHeaders := http.Header{
+		"User-header": {largeValue},
+	}
+	mockResponse := http.Response{
+		StatusCode: 200,
+		Header:     largeHeaders,
+	}
+
+	serializedHeaders := H1ResponseToH2ResponseHeaders(mockResponse.StatusCode, mockResponse.Header)
+	request, err := http.NewRequest(http.MethodGet, "https://example.com/", nil)
+	assert.NoError(t, err)
+	for _, header := range serializedHeaders {
+		request.Header.Set(header.Name, header.Value)
+	}
+
+	for _, header := range serializedHeaders {
+		if header.Name != ResponseUserHeaders {
+			continue
+		}
+
+		deserializedHeaders, err := DeserializeHeaders(header.Value)
+		assert.NoError(t, err)
+		assert.Equal(t, largeValue, deserializedHeaders[0].Value)
+	}
+}
+
+func randSeq(n int) string {
+	randomizer := rand.New(rand.NewSource(17))
+	var letters = []rune(":;,+/=abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ")
+	b := make([]rune, n)
+	for i := range b {
+		b[i] = letters[randomizer.Intn(len(letters))]
+	}
+	return string(b)
+}
+
+func BenchmarkH1ResponseToH2ResponseHeaders(b *testing.B) {
+	ser := "eC1mb3J3YXJkZWQtcHJvdG8:aHR0cHM;dXBncmFkZS1pbnNlY3VyZS1yZXF1ZXN0cw:MQ;YWNjZXB0LWxhbmd1YWdl:ZW4tVVMsZW47cT0wLjkscnU7cT0wLjg;YWNjZXB0LWVuY29kaW5n:Z3ppcA;eC1mb3J3YXJkZWQtZm9y:MTczLjI0NS42MC42;dXNlci1hZ2VudA:TW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfMTRfNikgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzg0LjAuNDE0Ny44OSBTYWZhcmkvNTM3LjM2;c2VjLWZldGNoLW1vZGU:bmF2aWdhdGU;Y2RuLWxvb3A:Y2xvdWRmbGFyZQ;c2VjLWZldGNoLWRlc3Q:ZG9jdW1lbnQ;c2VjLWZldGNoLXVzZXI:PzE;c2VjLWZldGNoLXNpdGU:bm9uZQ;Y29va2ll:X19jZmR1aWQ9ZGNkOWZjOGNjNWMxMzE0NTMyYTFkMjhlZDEyOWRhOTYwMTU2OTk1MTYzNDsgX19jZl9ibT1mYzY2MzMzYzAzZmM0MWFiZTZmOWEyYzI2ZDUwOTA0YzIxYzZhMTQ2LTE1OTU2MjIzNDEtMTgwMC1BZTVzS2pIU2NiWGVFM05mMUhrTlNQMG1tMHBLc2pQWkloVnM1Z2g1SkNHQkFhS1UxVDB2b003alBGN3FjMHVSR2NjZGcrWHdhL1EzbTJhQzdDVU4xZ2M9;YWNjZXB0:dGV4dC9odG1sLGFwcGxpY2F0aW9uL3hodG1sK3htbCxhcHBsaWNhdGlvbi94bWw7cT0wLjksaW1hZ2Uvd2VicCxpbWFnZS9hcG5nLCovKjtxPTAuOCxhcHBsaWNhdGlvbi9zaWduZWQtZXhjaGFuZ2U7dj1iMztxPTAuOQ"
+	h2, _ := DeserializeHeaders(ser)
+	h1 := make(http.Header)
+	for _, header := range h2 {
+		h1.Add(header.Name, header.Value)
+	}
+	h1.Add("Content-Length", "200")
+	h1.Add("Cf-Something", "Else")
+	h1.Add("Upgrade", "websocket")
+
+	h1resp := &http.Response{
+		StatusCode: 200,
+		Header:     h1,
+	}
+
+	b.ReportAllocs()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		_ = H1ResponseToH2ResponseHeaders(h1resp.StatusCode, h1resp.Header)
+	}
+}

connection/header.go

@@ -4,8 +4,6 @@ import (
 	"encoding/base64"
 	"fmt"
 	"net/http"
-	"net/url"
-	"strconv"
 	"strings"
 
 	"github.com/pkg/errors"
@@ -44,93 +42,9 @@ func mustInitRespMetaHeader(src string) string {
 
 var headerEncoding = base64.RawStdEncoding
 
-// note: all h2mux headers should be lower-case (http/2 style)
-const ()
-
-// H2RequestHeadersToH1Request converts the HTTP/2 headers coming from origintunneld
-// to an HTTP/1 Request object destined for the local origin web service.
-// This operation includes conversion of the pseudo-headers into their closest
-// HTTP/1 equivalents. See https://tools.ietf.org/html/rfc7540#section-8.1.2.3
-func H2RequestHeadersToH1Request(h2 []h2mux.Header, h1 *http.Request) error {
-	for _, header := range h2 {
-		name := strings.ToLower(header.Name)
-		if !IsControlRequestHeader(name) {
-			continue
-		}
-
-		switch name {
-		case ":method":
-			h1.Method = header.Value
-		case ":scheme":
-			// noop - use the preexisting scheme from h1.URL
-		case ":authority":
-			// Otherwise the host header will be based on the origin URL
-			h1.Host = header.Value
-		case ":path":
-			// We don't want to be an "opinionated" proxy, so ideally we would use :path as-is.
-			// However, this HTTP/1 Request object belongs to the Go standard library,
-			// whose URL package makes some opinionated decisions about the encoding of
-			// URL characters: see the docs of https://godoc.org/net/url#URL,
-			// in particular the EscapedPath method https://godoc.org/net/url#URL.EscapedPath,
-			// which is always used when computing url.URL.String(), whether we'd like it or not.
-			//
-			// Well, not *always*. We could circumvent this by using url.URL.Opaque. But
-			// that would present unusual difficulties when using an HTTP proxy: url.URL.Opaque
-			// is treated differently when HTTP_PROXY is set!
-			// See https://github.com/golang/go/issues/5684#issuecomment-66080888
-			//
-			// This means we are subject to the behavior of net/url's function `shouldEscape`
-			// (as invoked with mode=encodePath): https://github.com/golang/go/blob/go1.12.7/src/net/url/url.go#L101
-
-			if header.Value == "*" {
-				h1.URL.Path = "*"
-				continue
-			}
-			// Due to the behavior of validation.ValidateUrl, h1.URL may
-			// already have a partial value, with or without a trailing slash.
-			base := h1.URL.String()
-			base = strings.TrimRight(base, "/")
-			// But we know :path begins with '/', because we handled '*' above - see RFC7540
-			requestURL, err := url.Parse(base + header.Value)
-			if err != nil {
-				return errors.Wrap(err, fmt.Sprintf("invalid path '%v'", header.Value))
-			}
-			h1.URL = requestURL
-		case "content-length":
-			contentLength, err := strconv.ParseInt(header.Value, 10, 64)
-			if err != nil {
-				return fmt.Errorf("unparseable content length")
-			}
-			h1.ContentLength = contentLength
-		case RequestUserHeaders:
-			// Do not forward the serialized headers to the origin -- deserialize them, and ditch the serialized version
-			// Find and parse user headers serialized into a single one
-			userHeaders, err := DeserializeHeaders(header.Value)
-			if err != nil {
-				return errors.Wrap(err, "Unable to parse user headers")
-			}
-			for _, userHeader := range userHeaders {
-				h1.Header.Add(userHeader.Name, userHeader.Value)
-			}
-		default:
-			// All other control headers shall just be proxied transparently
-			h1.Header.Add(header.Name, header.Value)
-		}
-	}
-
-	return nil
-}
-
-func IsControlRequestHeader(headerName string) bool {
-	return headerName == "content-length" ||
-		headerName == "connection" || headerName == "upgrade" || // Websocket request headers
-		strings.HasPrefix(headerName, ":") ||
-		strings.HasPrefix(headerName, "cf-")
-}
-
+// IsControlResponseHeader is called in the direction of eyeball <- origin.
 func IsControlResponseHeader(headerName string) bool {
-	return headerName == "content-length" ||
-		strings.HasPrefix(headerName, ":") ||
+	return strings.HasPrefix(headerName, ":") ||
 		strings.HasPrefix(headerName, "cf-int-") ||
 		strings.HasPrefix(headerName, "cf-cloudflared-")
 }
@@ -142,31 +56,6 @@ func IsWebsocketClientHeader(headerName string) bool {
 		headerName == "upgrade"
 }
 
-func H1ResponseToH2ResponseHeaders(status int, h1 http.Header) (h2 []h2mux.Header) {
-	h2 = []h2mux.Header{
-		{Name: ":status", Value: strconv.Itoa(status)},
-	}
-	userHeaders := make(http.Header, len(h1))
-	for header, values := range h1 {
-		h2name := strings.ToLower(header)
-		if h2name == "content-length" {
-			// This header has meaning in HTTP/2 and will be used by the edge,
-			// so it should be sent as an HTTP/2 response header.
-
-			// Since these are http2 headers, they're required to be lowercase
-			h2 = append(h2, h2mux.Header{Name: "content-length", Value: values[0]})
-		} else if !IsControlResponseHeader(h2name) || IsWebsocketClientHeader(h2name) {
-			// User headers, on the other hand, must all be serialized so that
-			// HTTP/2 header validation won't be applied to HTTP/1 header values
-			userHeaders[header] = values
-		}
-	}
-
-	// Perform user header serialization and set them in the single header
-	h2 = append(h2, h2mux.Header{Name: ResponseUserHeaders, Value: SerializeHeaders(userHeaders)})
-	return h2
-}
-
 // Serialize HTTP1.x headers by base64-encoding each header name and value,
 // and then joining them in the format of [key:value;]
 func SerializeHeaders(h1Headers http.Header) string {

connection/header_test.go

@@ -2,441 +2,14 @@ package connection
 
 import (
 	"fmt"
-	"math/rand"
 	"net/http"
-	"net/url"
 	"reflect"
-	"regexp"
 	"sort"
-	"strings"
 	"testing"
-	"testing/quick"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/cloudflare/cloudflared/h2mux"
 )
 
-type ByName []h2mux.Header
-
-func (a ByName) Len() int      { return len(a) }
-func (a ByName) Swap(i, j int) { a[i], a[j] = a[j], a[i] }
-func (a ByName) Less(i, j int) bool {
-	if a[i].Name == a[j].Name {
-		return a[i].Value < a[j].Value
-	}
-
-	return a[i].Name < a[j].Name
-}
-
-func TestH2RequestHeadersToH1Request_RegularHeaders(t *testing.T) {
-	request, err := http.NewRequest(http.MethodGet, "http://example.com", nil)
-	assert.NoError(t, err)
-
-	mockHeaders := http.Header{
-		"Mock header 1": {"Mock value 1"},
-		"Mock header 2": {"Mock value 2"},
-	}
-
-	headersConversionErr := H2RequestHeadersToH1Request(createSerializedHeaders(RequestUserHeaders, mockHeaders), request)
-
-	assert.True(t, reflect.DeepEqual(mockHeaders, request.Header))
-	assert.NoError(t, headersConversionErr)
-}
-
-func createSerializedHeaders(headersField string, headers http.Header) []h2mux.Header {
-	return []h2mux.Header{{
-		Name:  headersField,
-		Value: SerializeHeaders(headers),
-	}}
-}
-
-func TestH2RequestHeadersToH1Request_NoHeaders(t *testing.T) {
-	request, err := http.NewRequest(http.MethodGet, "http://example.com", nil)
-	assert.NoError(t, err)
-
-	emptyHeaders := make(http.Header)
-	headersConversionErr := H2RequestHeadersToH1Request(
-		[]h2mux.Header{{
-			Name:  RequestUserHeaders,
-			Value: SerializeHeaders(emptyHeaders),
-		}},
-		request,
-	)
-
-	assert.True(t, reflect.DeepEqual(emptyHeaders, request.Header))
-	assert.NoError(t, headersConversionErr)
-}
-
-func TestH2RequestHeadersToH1Request_InvalidHostPath(t *testing.T) {
-	request, err := http.NewRequest(http.MethodGet, "http://example.com", nil)
-	assert.NoError(t, err)
-
-	mockRequestHeaders := []h2mux.Header{
-		{Name: ":path", Value: "//bad_path/"},
-		{Name: RequestUserHeaders, Value: SerializeHeaders(http.Header{"Mock header": {"Mock value"}})},
-	}
-
-	headersConversionErr := H2RequestHeadersToH1Request(mockRequestHeaders, request)
-
-	assert.Equal(t, http.Header{
-		"Mock header": []string{"Mock value"},
-	}, request.Header)
-
-	assert.Equal(t, "http://example.com//bad_path/", request.URL.String())
-
-	assert.NoError(t, headersConversionErr)
-}
-
-func TestH2RequestHeadersToH1Request_HostPathWithQuery(t *testing.T) {
-	request, err := http.NewRequest(http.MethodGet, "http://example.com/", nil)
-	assert.NoError(t, err)
-
-	mockRequestHeaders := []h2mux.Header{
-		{Name: ":path", Value: "/?query=mock%20value"},
-		{Name: RequestUserHeaders, Value: SerializeHeaders(http.Header{"Mock header": {"Mock value"}})},
-	}
-
-	headersConversionErr := H2RequestHeadersToH1Request(mockRequestHeaders, request)
-
-	assert.Equal(t, http.Header{
-		"Mock header": []string{"Mock value"},
-	}, request.Header)
-
-	assert.Equal(t, "http://example.com/?query=mock%20value", request.URL.String())
-
-	assert.NoError(t, headersConversionErr)
-}
-
-func TestH2RequestHeadersToH1Request_HostPathWithURLEncoding(t *testing.T) {
-	request, err := http.NewRequest(http.MethodGet, "http://example.com/", nil)
-	assert.NoError(t, err)
-
-	mockRequestHeaders := []h2mux.Header{
-		{Name: ":path", Value: "/mock%20path"},
-		{Name: RequestUserHeaders, Value: SerializeHeaders(http.Header{"Mock header": {"Mock value"}})},
-	}
-
-	headersConversionErr := H2RequestHeadersToH1Request(mockRequestHeaders, request)
-
-	assert.Equal(t, http.Header{
-		"Mock header": []string{"Mock value"},
-	}, request.Header)
-
-	assert.Equal(t, "http://example.com/mock%20path", request.URL.String())
-
-	assert.NoError(t, headersConversionErr)
-}
-
-func TestH2RequestHeadersToH1Request_WeirdURLs(t *testing.T) {
-	type testCase struct {
-		path string
-		want string
-	}
-	testCases := []testCase{
-		{
-			path: "",
-			want: "",
-		},
-		{
-			path: "/",
-			want: "/",
-		},
-		{
-			path: "//",
-			want: "//",
-		},
-		{
-			path: "/test",
-			want: "/test",
-		},
-		{
-			path: "//test",
-			want: "//test",
-		},
-		{
-			// https://github.com/cloudflare/cloudflared/issues/81
-			path: "//test/",
-			want: "//test/",
-		},
-		{
-			path: "/%2Ftest",
-			want: "/%2Ftest",
-		},
-		{
-			path: "//%20test",
-			want: "//%20test",
-		},
-		{
-			// https://github.com/cloudflare/cloudflared/issues/124
-			path: "/test?get=somthing%20a",
-			want: "/test?get=somthing%20a",
-		},
-		{
-			path: "/%20",
-			want: "/%20",
-		},
-		{
-			// stdlib's EscapedPath() will always percent-encode ' '
-			path: "/ ",
-			want: "/%20",
-		},
-		{
-			path: "/ a ",
-			want: "/%20a%20",
-		},
-		{
-			path: "/a%20b",
-			want: "/a%20b",
-		},
-		{
-			path: "/foo/bar;param?query#frag",
-			want: "/foo/bar;param?query#frag",
-		},
-		{
-			// stdlib's EscapedPath() will always percent-encode non-ASCII chars
-			path: "/a␠b",
-			want: "/a%E2%90%A0b",
-		},
-		{
-			path: "/a-umlaut-ä",
-			want: "/a-umlaut-%C3%A4",
-		},
-		{
-			path: "/a-umlaut-%C3%A4",
-			want: "/a-umlaut-%C3%A4",
-		},
-		{
-			path: "/a-umlaut-%c3%a4",
-			want: "/a-umlaut-%c3%a4",
-		},
-		{
-			// here the second '#' is treated as part of the fragment
-			path: "/a#b#c",
-			want: "/a#b%23c",
-		},
-		{
-			path: "/a#b␠c",
-			want: "/a#b%E2%90%A0c",
-		},
-		{
-			path: "/a#b%20c",
-			want: "/a#b%20c",
-		},
-		{
-			path: "/a#b c",
-			want: "/a#b%20c",
-		},
-		{
-			// stdlib's EscapedPath() will always percent-encode '\'
-			path: "/\\",
-			want: "/%5C",
-		},
-		{
-			path: "/a\\",
-			want: "/a%5C",
-		},
-		{
-			path: "/a,b.c.",
-			want: "/a,b.c.",
-		},
-		{
-			path: "/.",
-			want: "/.",
-		},
-		{
-			// stdlib's EscapedPath() will always percent-encode '`'
-			path: "/a`",
-			want: "/a%60",
-		},
-		{
-			path: "/a[0]",
-			want: "/a[0]",
-		},
-		{
-			path: "/?a[0]=5 &b[]=",
-			want: "/?a[0]=5 &b[]=",
-		},
-		{
-			path: "/?a=%22b%20%22",
-			want: "/?a=%22b%20%22",
-		},
-	}
-
-	for index, testCase := range testCases {
-		requestURL := "https://example.com"
-
-		request, err := http.NewRequest(http.MethodGet, requestURL, nil)
-		assert.NoError(t, err)
-
-		mockRequestHeaders := []h2mux.Header{
-			{Name: ":path", Value: testCase.path},
-			{Name: RequestUserHeaders, Value: SerializeHeaders(http.Header{"Mock header": {"Mock value"}})},
-		}
-
-		headersConversionErr := H2RequestHeadersToH1Request(mockRequestHeaders, request)
-		assert.NoError(t, headersConversionErr)
-
-		assert.Equal(t,
-			http.Header{
-				"Mock header": []string{"Mock value"},
-			},
-			request.Header)
-
-		assert.Equal(t,
-			"https://example.com"+testCase.want,
-			request.URL.String(),
-			"Failed URL index: %v %#v", index, testCase)
-	}
-}
-
-func TestH2RequestHeadersToH1Request_QuickCheck(t *testing.T) {
-	config := &quick.Config{
-		Values: func(args []reflect.Value, rand *rand.Rand) {
-			args[0] = reflect.ValueOf(randomHTTP2Path(t, rand))
-		},
-	}
-
-	type testOrigin struct {
-		url string
-
-		expectedScheme   string
-		expectedBasePath string
-	}
-	testOrigins := []testOrigin{
-		{
-			url:              "http://origin.hostname.example.com:8080",
-			expectedScheme:   "http",
-			expectedBasePath: "http://origin.hostname.example.com:8080",
-		},
-		{
-			url:              "http://origin.hostname.example.com:8080/",
-			expectedScheme:   "http",
-			expectedBasePath: "http://origin.hostname.example.com:8080",
-		},
-		{
-			url:              "http://origin.hostname.example.com:8080/api",
-			expectedScheme:   "http",
-			expectedBasePath: "http://origin.hostname.example.com:8080/api",
-		},
-		{
-			url:              "http://origin.hostname.example.com:8080/api/",
-			expectedScheme:   "http",
-			expectedBasePath: "http://origin.hostname.example.com:8080/api",
-		},
-		{
-			url:              "https://origin.hostname.example.com:8080/api",
-			expectedScheme:   "https",
-			expectedBasePath: "https://origin.hostname.example.com:8080/api",
-		},
-	}
-
-	// use multiple schemes to demonstrate that the URL is based on the
-	// origin's scheme, not the :scheme header
-	for _, testScheme := range []string{"http", "https"} {
-		for _, testOrigin := range testOrigins {
-			assertion := func(testPath string) bool {
-				const expectedMethod = "POST"
-				const expectedHostname = "request.hostname.example.com"
-
-				h2 := []h2mux.Header{
-					{Name: ":method", Value: expectedMethod},
-					{Name: ":scheme", Value: testScheme},
-					{Name: ":authority", Value: expectedHostname},
-					{Name: ":path", Value: testPath},
-					{Name: RequestUserHeaders, Value: ""},
-				}
-				h1, err := http.NewRequest("GET", testOrigin.url, nil)
-				require.NoError(t, err)
-
-				err = H2RequestHeadersToH1Request(h2, h1)
-				return assert.NoError(t, err) &&
-					assert.Equal(t, expectedMethod, h1.Method) &&
-					assert.Equal(t, expectedHostname, h1.Host) &&
-					assert.Equal(t, testOrigin.expectedScheme, h1.URL.Scheme) &&
-					assert.Equal(t, testOrigin.expectedBasePath+testPath, h1.URL.String())
-			}
-			err := quick.Check(assertion, config)
-			assert.NoError(t, err)
-		}
-	}
-}
-
-func randomASCIIPrintableChar(rand *rand.Rand) int {
-	// smallest printable ASCII char is 32, largest is 126
-	const startPrintable = 32
-	const endPrintable = 127
-	return startPrintable + rand.Intn(endPrintable-startPrintable)
-}
-
-// randomASCIIText generates an ASCII string, some of whose characters may be
-// percent-encoded. Its "logical length" (ignoring percent-encoding) is
-// between 1 and `maxLength`.
-func randomASCIIText(rand *rand.Rand, minLength int, maxLength int) string {
-	length := minLength + rand.Intn(maxLength)
-	var result strings.Builder
-	for i := 0; i < length; i++ {
-		c := randomASCIIPrintableChar(rand)
-
-		// 1/4 chance of using percent encoding when not necessary
-		if c == '%' || rand.Intn(4) == 0 {
-			result.WriteString(fmt.Sprintf("%%%02X", c))
-		} else {
-			result.WriteByte(byte(c))
-		}
-	}
-	return result.String()
-}
-
-// Calls `randomASCIIText` and ensures the result is a valid URL path,
-// i.e. one that can pass unchanged through url.URL.String()
-func randomHTTP1Path(t *testing.T, rand *rand.Rand, minLength int, maxLength int) string {
-	text := randomASCIIText(rand, minLength, maxLength)
-	re, err := regexp.Compile("[^/;,]*")
-	require.NoError(t, err)
-	return "/" + re.ReplaceAllStringFunc(text, url.PathEscape)
-}
-
-// Calls `randomASCIIText` and ensures the result is a valid URL query,
-// i.e. one that can pass unchanged through url.URL.String()
-func randomHTTP1Query(rand *rand.Rand, minLength int, maxLength int) string {
-	text := randomASCIIText(rand, minLength, maxLength)
-	return "?" + strings.ReplaceAll(text, "#", "%23")
-}
-
-// Calls `randomASCIIText` and ensures the result is a valid URL fragment,
-// i.e. one that can pass unchanged through url.URL.String()
-func randomHTTP1Fragment(t *testing.T, rand *rand.Rand, minLength int, maxLength int) string {
-	text := randomASCIIText(rand, minLength, maxLength)
-	u, err := url.Parse("#" + text)
-	require.NoError(t, err)
-	return u.String()
-}
-
-// Assemble a random :path pseudoheader that is legal by Go stdlib standards
-// (i.e. all characters will satisfy "net/url".shouldEscape for their respective locations)
-func randomHTTP2Path(t *testing.T, rand *rand.Rand) string {
-	result := randomHTTP1Path(t, rand, 1, 64)
-	if rand.Intn(2) == 1 {
-		result += randomHTTP1Query(rand, 1, 32)
-	}
-	if rand.Intn(2) == 1 {
-		result += randomHTTP1Fragment(t, rand, 1, 16)
-	}
-	return result
-}
-
-func stdlibHeaderToH2muxHeader(headers http.Header) (h2muxHeaders []h2mux.Header) {
-	for name, values := range headers {
-		for _, value := range values {
-			h2muxHeaders = append(h2muxHeaders, h2mux.Header{Name: name, Value: value})
-		}
-	}
-
-	return h2muxHeaders
-}
-
 func TestSerializeHeaders(t *testing.T) {
 	request, err := http.NewRequest(http.MethodGet, "http://example.com", nil)
 	assert.NoError(t, err)
@@ -511,70 +84,13 @@ func TestDeserializeMalformed(t *testing.T) {
 	}
 }
 
-func TestParseRequestHeaders(t *testing.T) {
-	mockUserHeadersToSerialize := http.Header{
-		"Mock-Header-One":   {"1", "1.5"},
-		"Mock-Header-Two":   {"2"},
-		"Mock-Header-Three": {"3"},
-	}
-
-	mockHeaders := []h2mux.Header{
-		{Name: "One", Value: "1"}, // will be dropped
-		{Name: "Cf-Two", Value: "cf-value-1"},
-		{Name: "Cf-Two", Value: "cf-value-2"},
-		{Name: RequestUserHeaders, Value: SerializeHeaders(mockUserHeadersToSerialize)},
-	}
-
-	expectedHeaders := []h2mux.Header{
-		{Name: "Cf-Two", Value: "cf-value-1"},
-		{Name: "Cf-Two", Value: "cf-value-2"},
-		{Name: "Mock-Header-One", Value: "1"},
-		{Name: "Mock-Header-One", Value: "1.5"},
-		{Name: "Mock-Header-Two", Value: "2"},
-		{Name: "Mock-Header-Three", Value: "3"},
-	}
-	h1 := &http.Request{
-		Header: make(http.Header),
-	}
-	err := H2RequestHeadersToH1Request(mockHeaders, h1)
-	assert.NoError(t, err)
-	assert.ElementsMatch(t, expectedHeaders, stdlibHeaderToH2muxHeader(h1.Header))
-}
-
-func TestIsControlRequestHeader(t *testing.T) {
-	controlRequestHeaders := []string{
-		// Anything that begins with cf-
-		"cf-sample-header",
-
-		// Any http2 pseudoheader
-		":sample-pseudo-header",
-
-		// content-length is a special case, it has to be there
-		// for some requests to work (per the HTTP2 spec)
-		"content-length",
-
-		// Websocket request headers
-		"connection",
-		"upgrade",
-	}
-
-	for _, header := range controlRequestHeaders {
-		assert.True(t, IsControlRequestHeader(header))
-	}
-}
-
 func TestIsControlResponseHeader(t *testing.T) {
 	controlResponseHeaders := []string{
 		// Anything that begins with cf-int- or cf-cloudflared-
 		"cf-int-sample-header",
 		"cf-cloudflared-sample-header",
-
 		// Any http2 pseudoheader
 		":sample-pseudo-header",
-
-		// content-length is a special case, it has to be there
-		// for some requests to work (per the HTTP2 spec)
-		"content-length",
 	}
 
 	for _, header := range controlResponseHeaders {
@@ -582,17 +98,6 @@ func TestIsControlResponseHeader(t *testing.T) {
 	}
 }
 
-func TestIsNotControlRequestHeader(t *testing.T) {
-	notControlRequestHeaders := []string{
-		"mock-header",
-		"another-sample-header",
-	}
-
-	for _, header := range notControlRequestHeaders {
-		assert.False(t, IsControlRequestHeader(header))
-	}
-}
-
 func TestIsNotControlResponseHeader(t *testing.T) {
 	notControlResponseHeaders := []string{
 		"mock-header",
@@ -606,112 +111,3 @@ func TestIsNotControlResponseHeader(t *testing.T) {
 		assert.False(t, IsControlResponseHeader(header))
 	}
 }
-
-func TestH1ResponseToH2ResponseHeaders(t *testing.T) {
-	mockHeaders := http.Header{
-		"User-header-one":       {""},
-		"User-header-two":       {"1", "2"},
-		"cf-header":             {"cf-value"},
-		"cf-int-header":         {"cf-int-value"},
-		"cf-cloudflared-header": {"cf-cloudflared-value"},
-		"Content-Length":        {"123"},
-	}
-	mockResponse := http.Response{
-		StatusCode: 200,
-		Header:     mockHeaders,
-	}
-
-	headers := H1ResponseToH2ResponseHeaders(mockResponse.StatusCode, mockResponse.Header)
-
-	serializedHeadersIndex := -1
-	for i, header := range headers {
-		if header.Name == ResponseUserHeaders {
-			serializedHeadersIndex = i
-			break
-		}
-	}
-	assert.NotEqual(t, -1, serializedHeadersIndex)
-	actualControlHeaders := append(
-		headers[:serializedHeadersIndex],
-		headers[serializedHeadersIndex+1:]...,
-	)
-	expectedControlHeaders := []h2mux.Header{
-		{Name: ":status", Value: "200"},
-		{Name: "content-length", Value: "123"},
-	}
-
-	assert.ElementsMatch(t, expectedControlHeaders, actualControlHeaders)
-
-	actualUserHeaders, err := DeserializeHeaders(headers[serializedHeadersIndex].Value)
-	expectedUserHeaders := []h2mux.Header{
-		{Name: "User-header-one", Value: ""},
-		{Name: "User-header-two", Value: "1"},
-		{Name: "User-header-two", Value: "2"},
-		{Name: "cf-header", Value: "cf-value"},
-	}
-	assert.NoError(t, err)
-	assert.ElementsMatch(t, expectedUserHeaders, actualUserHeaders)
-}
-
-// The purpose of this test is to check that our code and the http.Header
-// implementation don't throw validation errors about header size
-func TestHeaderSize(t *testing.T) {
-	largeValue := randSeq(5 * 1024 * 1024) // 5Mb
-	largeHeaders := http.Header{
-		"User-header": {largeValue},
-	}
-	mockResponse := http.Response{
-		StatusCode: 200,
-		Header:     largeHeaders,
-	}
-
-	serializedHeaders := H1ResponseToH2ResponseHeaders(mockResponse.StatusCode, mockResponse.Header)
-	request, err := http.NewRequest(http.MethodGet, "https://example.com/", nil)
-	assert.NoError(t, err)
-	for _, header := range serializedHeaders {
-		request.Header.Set(header.Name, header.Value)
-	}
-
-	for _, header := range serializedHeaders {
-		if header.Name != ResponseUserHeaders {
-			continue
-		}
-
-		deserializedHeaders, err := DeserializeHeaders(header.Value)
-		assert.NoError(t, err)
-		assert.Equal(t, largeValue, deserializedHeaders[0].Value)
-	}
-}
-
-func randSeq(n int) string {
-	randomizer := rand.New(rand.NewSource(17))
-	var letters = []rune(":;,+/=abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ")
-	b := make([]rune, n)
-	for i := range b {
-		b[i] = letters[randomizer.Intn(len(letters))]
-	}
-	return string(b)
-}
-
-func BenchmarkH1ResponseToH2ResponseHeaders(b *testing.B) {
-	ser := "eC1mb3J3YXJkZWQtcHJvdG8:aHR0cHM;dXBncmFkZS1pbnNlY3VyZS1yZXF1ZXN0cw:MQ;YWNjZXB0LWxhbmd1YWdl:ZW4tVVMsZW47cT0wLjkscnU7cT0wLjg;YWNjZXB0LWVuY29kaW5n:Z3ppcA;eC1mb3J3YXJkZWQtZm9y:MTczLjI0NS42MC42;dXNlci1hZ2VudA:TW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfMTRfNikgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzg0LjAuNDE0Ny44OSBTYWZhcmkvNTM3LjM2;c2VjLWZldGNoLW1vZGU:bmF2aWdhdGU;Y2RuLWxvb3A:Y2xvdWRmbGFyZQ;c2VjLWZldGNoLWRlc3Q:ZG9jdW1lbnQ;c2VjLWZldGNoLXVzZXI:PzE;c2VjLWZldGNoLXNpdGU:bm9uZQ;Y29va2ll:X19jZmR1aWQ9ZGNkOWZjOGNjNWMxMzE0NTMyYTFkMjhlZDEyOWRhOTYwMTU2OTk1MTYzNDsgX19jZl9ibT1mYzY2MzMzYzAzZmM0MWFiZTZmOWEyYzI2ZDUwOTA0YzIxYzZhMTQ2LTE1OTU2MjIzNDEtMTgwMC1BZTVzS2pIU2NiWGVFM05mMUhrTlNQMG1tMHBLc2pQWkloVnM1Z2g1SkNHQkFhS1UxVDB2b003alBGN3FjMHVSR2NjZGcrWHdhL1EzbTJhQzdDVU4xZ2M9;YWNjZXB0:dGV4dC9odG1sLGFwcGxpY2F0aW9uL3hodG1sK3htbCxhcHBsaWNhdGlvbi94bWw7cT0wLjksaW1hZ2Uvd2VicCxpbWFnZS9hcG5nLCovKjtxPTAuOCxhcHBsaWNhdGlvbi9zaWduZWQtZXhjaGFuZ2U7dj1iMztxPTAuOQ"
-	h2, _ := DeserializeHeaders(ser)
-	h1 := make(http.Header)
-	for _, header := range h2 {
-		h1.Add(header.Name, header.Value)
-	}
-	h1.Add("Content-Length", "200")
-	h1.Add("Cf-Something", "Else")
-	h1.Add("Upgrade", "websocket")
-
-	h1resp := &http.Response{
-		StatusCode: 200,
-		Header:     h1,
-	}
-
-	b.ReportAllocs()
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		_ = H1ResponseToH2ResponseHeaders(h1resp.StatusCode, h1resp.Header)
-	}
-}

connection/http2.go

@@ -125,7 +125,7 @@ func (c *HTTP2Connection) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	case TypeTCP:
 		host, err := getRequestHost(r)
 		if err != nil {
-			err := fmt.Errorf(`cloudflared recieved a warp-routing request with an empty host value: %w`, err)
+			err := fmt.Errorf(`cloudflared received a warp-routing request with an empty host value: %w`, err)
 			c.log.Error().Err(err)
 			respWriter.WriteErrorResponse()
 		}
@@ -184,12 +184,14 @@ func (rp *http2RespWriter) WriteRespHeaders(status int, header http.Header) erro
 	for name, values := range header {
 		// Since these are http2 headers, they're required to be lowercase
 		h2name := strings.ToLower(name)
+
 		if h2name == "content-length" {
 			// This header has meaning in HTTP/2 and will be used by the edge,
-			// so it should be sent as an HTTP/2 response header.
+			// so it should be sent *also* as an HTTP/2 response header.
 			dest[name] = values
-			// Since these are http2 headers, they're required to be lowercase
-		} else if !IsControlResponseHeader(h2name) || IsWebsocketClientHeader(h2name) {
+		}
+
+		if !IsControlResponseHeader(h2name) || IsWebsocketClientHeader(h2name) {
 			// User headers, on the other hand, must all be serialized so that
 			// HTTP/2 header validation won't be applied to HTTP/1 header values
 			userHeaders[name] = values

connection/protocol.go

@@ -12,7 +12,7 @@ import (
 )
 
 const (
-	AvailableProtocolFlagMessage = "Available protocols: http2 - Go's implementation, h2mux - Cloudflare's implementation of HTTP/2, and auto - automatically select between http2 and h2mux"
+	AvailableProtocolFlagMessage = "Available protocols: 'auto' - automatically chooses the best protocol over time (the default; and also the recommended one); 'quic' - based on QUIC, relying on UDP egress to Cloudflare edge; 'http2' - using Go's HTTP2 library, relying on TCP egress to Cloudflare edge; 'h2mux' - Cloudflare's implementation of HTTP/2, deprecated"
 	// edgeH2muxTLSServerName is the server name to establish h2mux connection with edge
 	edgeH2muxTLSServerName = "cftunnel.com"
 	// edgeH2TLSServerName is the server name to establish http2 connection with edge
@@ -42,7 +42,7 @@ const (
 	// H2mux on HTTP2 failure to connect.
 	HTTP2Warp
 	//QUICWarp is used only with named tunnels. It's useful for warp-routing where we want to fallback to HTTP2 but
-	// dont' want HTTP2 to fallback to H2mux
+	// don't want HTTP2 to fallback to H2mux
 	QUICWarp
 )
 

connection/protocol_test.go

@@ -26,7 +26,7 @@ var (
 func mockFetcher(getError bool, protocolPercent ...edgediscovery.ProtocolPercent) PercentageFetcher {
 	return func() (edgediscovery.ProtocolPercents, error) {
 		if getError {
-			return nil, fmt.Errorf("failed to fetch precentage")
+			return nil, fmt.Errorf("failed to fetch percentage")
 		}
 		return protocolPercent, nil
 	}

connection/quic.go

@@ -9,11 +9,16 @@ import (
 	"net/http"
 	"strconv"
 	"strings"
+	"time"
 
+	"github.com/google/uuid"
 	"github.com/lucas-clemente/quic-go"
 	"github.com/pkg/errors"
 	"github.com/rs/zerolog"
+	"golang.org/x/sync/errgroup"
 
+	"github.com/cloudflare/cloudflared/datagramsession"
+	"github.com/cloudflare/cloudflared/ingress"
 	quicpogs "github.com/cloudflare/cloudflared/quic"
 	tunnelpogs "github.com/cloudflare/cloudflared/tunnelrpc/pogs"
 )
@@ -24,16 +29,16 @@ const (
 	// HTTPMethodKey is used to get or set http method in QUIC ALPN if the underlying proxy connection type is HTTP.
 	HTTPMethodKey = "HttpMethod"
 	// HTTPHostKey is used to get or set http Method in QUIC ALPN if the underlying proxy connection type is HTTP.
-	HTTPHostKey = "HttpHost"
+	HTTPHostKey          = "HttpHost"
+	MaxDatagramFrameSize = 1220
 )
 
 // QUICConnection represents the type that facilitates Proxying via QUIC streams.
 type QUICConnection struct {
-	session           quic.Session
-	logger            *zerolog.Logger
-	httpProxy         OriginProxy
-	gracefulShutdownC <-chan struct{}
-	stoppedGracefully bool
+	session        quic.Session
+	logger         *zerolog.Logger
+	httpProxy      OriginProxy
+	sessionManager datagramsession.Manager
 }
 
 // NewQUICConnection returns a new instance of QUICConnection.
@@ -49,12 +54,12 @@ func NewQUICConnection(
 ) (*QUICConnection, error) {
 	session, err := quic.DialAddr(edgeAddr.String(), tlsConfig, quicConfig)
 	if err != nil {
-		return nil, errors.Wrap(err, "failed to dial to edge")
+		return nil, fmt.Errorf("failed to dial to edge: %w", err)
 	}
 
 	registrationStream, err := session.OpenStream()
 	if err != nil {
-		return nil, errors.Wrap(err, "failed to open a registration stream")
+		return nil, fmt.Errorf("failed to open a registration stream: %w", err)
 	}
 
 	err = controlStreamHandler.ServeControlStream(ctx, registrationStream, connOptions, false)
@@ -63,18 +68,34 @@ func NewQUICConnection(
 		return nil, err
 	}
 
+	datagramMuxer, err := quicpogs.NewDatagramMuxer(session)
+	if err != nil {
+		return nil, err
+	}
+
+	sessionManager := datagramsession.NewManager(datagramMuxer, observer.log)
+
 	return &QUICConnection{
-		session:   session,
-		httpProxy: httpProxy,
-		logger:    observer.log,
+		session:        session,
+		httpProxy:      httpProxy,
+		logger:         observer.log,
+		sessionManager: sessionManager,
 	}, nil
 }
 
 // Serve starts a QUIC session that begins accepting streams.
 func (q *QUICConnection) Serve(ctx context.Context) error {
-	ctx, cancel := context.WithCancel(ctx)
-	defer cancel()
+	errGroup, ctx := errgroup.WithContext(ctx)
+	errGroup.Go(func() error {
+		return q.acceptStream(ctx)
+	})
+	errGroup.Go(func() error {
+		return q.sessionManager.Serve(ctx)
+	})
+	return errGroup.Wait()
+}
 
+func (q *QUICConnection) acceptStream(ctx context.Context) error {
 	for {
 		stream, err := q.session.AcceptStream(ctx)
 		if err != nil {
@@ -82,7 +103,7 @@ func (q *QUICConnection) Serve(ctx context.Context) error {
 			if errors.Is(err, context.Canceled) {
 				return nil
 			}
-			return errors.Wrap(err, "failed to accept QUIC stream")
+			return fmt.Errorf("failed to accept QUIC stream: %w", err)
 		}
 		go func() {
 			defer stream.Close()
@@ -99,7 +120,30 @@ func (q *QUICConnection) Close() {
 }
 
 func (q *QUICConnection) handleStream(stream quic.Stream) error {
-	connectRequest, err := quicpogs.ReadConnectRequestData(stream)
+	signature, err := quicpogs.DetermineProtocol(stream)
+	if err != nil {
+		return err
+	}
+	switch signature {
+	case quicpogs.DataStreamProtocolSignature:
+		reqServerStream, err := quicpogs.NewRequestServerStream(stream, signature)
+		if err != nil {
+			return nil
+		}
+		return q.handleDataStream(reqServerStream)
+	case quicpogs.RPCStreamProtocolSignature:
+		rpcStream, err := quicpogs.NewRPCServerStream(stream, signature)
+		if err != nil {
+			return err
+		}
+		return q.handleRPCStream(rpcStream)
+	default:
+		return fmt.Errorf("unknown protocol %v", signature)
+	}
+}
+
+func (q *QUICConnection) handleDataStream(stream *quicpogs.RequestServerStream) error {
+	connectRequest, err := stream.ReadConnectRequestData()
 	if err != nil {
 		return err
 	}
@@ -114,32 +158,62 @@ func (q *QUICConnection) handleStream(stream quic.Stream) error {
 		w := newHTTPResponseAdapter(stream)
 		return q.httpProxy.ProxyHTTP(w, req, connectRequest.Type == quicpogs.ConnectionTypeWebsocket)
 	case quicpogs.ConnectionTypeTCP:
-		rwa := &streamReadWriteAcker{
-			ReadWriter: stream,
-		}
+		rwa := &streamReadWriteAcker{stream}
 		return q.httpProxy.ProxyTCP(context.Background(), rwa, &TCPRequest{Dest: connectRequest.Dest})
 	}
 	return nil
 }
 
+func (q *QUICConnection) handleRPCStream(rpcStream *quicpogs.RPCServerStream) error {
+	return rpcStream.Serve(q, q.logger)
+}
+
+func (q *QUICConnection) RegisterUdpSession(ctx context.Context, sessionID uuid.UUID, dstIP net.IP, dstPort uint16, closeAfterIdleHint time.Duration) error {
+	// Each session is a series of datagram from an eyeball to a dstIP:dstPort.
+	// (src port, dst IP, dst port) uniquely identifies a session, so it needs a dedicated connected socket.
+	originProxy, err := ingress.DialUDP(dstIP, dstPort)
+	if err != nil {
+		q.logger.Err(err).Msgf("Failed to create udp proxy to %s:%d", dstIP, dstPort)
+		return err
+	}
+	session, err := q.sessionManager.RegisterSession(ctx, sessionID, originProxy)
+	if err != nil {
+		q.logger.Err(err).Msgf("Failed to register udp session %s", sessionID)
+		return err
+	}
+	go func() {
+		defer q.sessionManager.UnregisterSession(q.session.Context(), sessionID)
+		if err := session.Serve(q.session.Context(), closeAfterIdleHint); err != nil {
+			q.logger.Debug().Err(err).Str("sessionID", sessionID.String()).Msg("session terminated")
+		}
+	}()
+	q.logger.Debug().Msgf("Registered session %v, %v, %v", sessionID, dstIP, dstPort)
+	return nil
+}
+
+func (q *QUICConnection) UnregisterUdpSession(ctx context.Context, sessionID uuid.UUID) error {
+	q.sessionManager.UnregisterSession(ctx, sessionID)
+	return nil
+}
+
 // streamReadWriteAcker is a light wrapper over QUIC streams with a callback to send response back to
 // the client.
 type streamReadWriteAcker struct {
-	io.ReadWriter
+	*quicpogs.RequestServerStream
 }
 
 // AckConnection acks response back to the proxy.
 func (s *streamReadWriteAcker) AckConnection() error {
-	return quicpogs.WriteConnectResponseData(s, nil)
+	return s.WriteConnectResponseData(nil)
 }
 
 // httpResponseAdapter translates responses written by the HTTP Proxy into ones that can be used in QUIC.
 type httpResponseAdapter struct {
-	io.Writer
+	*quicpogs.RequestServerStream
 }
 
-func newHTTPResponseAdapter(w io.Writer) httpResponseAdapter {
-	return httpResponseAdapter{w}
+func newHTTPResponseAdapter(s *quicpogs.RequestServerStream) httpResponseAdapter {
+	return httpResponseAdapter{s}
 }
 
 func (hrw httpResponseAdapter) WriteRespHeaders(status int, header http.Header) error {
@@ -151,11 +225,11 @@ func (hrw httpResponseAdapter) WriteRespHeaders(status int, header http.Header)
 			metadata = append(metadata, quicpogs.Metadata{Key: httpHeaderKey, Val: v})
 		}
 	}
-	return quicpogs.WriteConnectResponseData(hrw, nil, metadata...)
+	return hrw.WriteConnectResponseData(nil, metadata...)
 }
 
 func (hrw httpResponseAdapter) WriteErrorResponse(err error) {
-	quicpogs.WriteConnectResponseData(hrw, err, quicpogs.Metadata{Key: "HttpStatus", Val: strconv.Itoa(http.StatusBadGateway)})
+	hrw.WriteConnectResponseData(err, quicpogs.Metadata{Key: "HttpStatus", Val: strconv.Itoa(http.StatusBadGateway)})
 }
 
 func buildHTTPRequest(connectRequest *quicpogs.ConnectRequest, body io.ReadCloser) (*http.Request, error) {
@@ -176,7 +250,7 @@ func buildHTTPRequest(connectRequest *quicpogs.ConnectRequest, body io.ReadClose
 			// metadata.Key is off the format httpHeaderKey:<HTTPHeader>
 			httpHeaderKey := strings.Split(metadata.Key, ":")
 			if len(httpHeaderKey) != 2 {
-				return nil, fmt.Errorf("Header Key: %s malformed", metadata.Key)
+				return nil, fmt.Errorf("header Key: %s malformed", metadata.Key)
 			}
 			req.Header.Add(httpHeaderKey[1], metadata.Val)
 		}

connection/quic_test.go

@@ -26,7 +26,6 @@ import (
 	"github.com/stretchr/testify/require"
 
 	quicpogs "github.com/cloudflare/cloudflared/quic"
-	"github.com/cloudflare/cloudflared/tunnelrpc/pogs"
 	tunnelpogs "github.com/cloudflare/cloudflared/tunnelrpc/pogs"
 )
 
@@ -34,7 +33,8 @@ import (
 // It also serves as a demonstration for communication with the QUIC connection started by a cloudflared.
 func TestQUICServer(t *testing.T) {
 	quicConfig := &quic.Config{
-		KeepAlive: true,
+		KeepAlive:       true,
+		EnableDatagrams: true,
 	}
 
 	// Setup test.
@@ -76,15 +76,15 @@ func TestQUICServer(t *testing.T) {
 			dest:           "/ok",
 			connectionType: quicpogs.ConnectionTypeHTTP,
 			metadata: []quicpogs.Metadata{
-				quicpogs.Metadata{
+				{
 					Key: "HttpHeader:Cf-Ray",
 					Val: "123123123",
 				},
-				quicpogs.Metadata{
+				{
 					Key: "HttpHost",
 					Val: "cf.host",
 				},
-				quicpogs.Metadata{
+				{
 					Key: "HttpMethod",
 					Val: "GET",
 				},
@@ -96,19 +96,19 @@ func TestQUICServer(t *testing.T) {
 			dest:           "/echo_body",
 			connectionType: quicpogs.ConnectionTypeHTTP,
 			metadata: []quicpogs.Metadata{
-				quicpogs.Metadata{
+				{
 					Key: "HttpHeader:Cf-Ray",
 					Val: "123123123",
 				},
-				quicpogs.Metadata{
+				{
 					Key: "HttpHost",
 					Val: "cf.host",
 				},
-				quicpogs.Metadata{
+				{
 					Key: "HttpMethod",
 					Val: "POST",
 				},
-				quicpogs.Metadata{
+				{
 					Key: "HttpHeader:Content-Length",
 					Val: "24",
 				},
@@ -121,19 +121,19 @@ func TestQUICServer(t *testing.T) {
 			dest:           "/ok",
 			connectionType: quicpogs.ConnectionTypeWebsocket,
 			metadata: []quicpogs.Metadata{
-				quicpogs.Metadata{
+				{
 					Key: "HttpHeader:Cf-Cloudflared-Proxy-Connection-Upgrade",
 					Val: "Websocket",
 				},
-				quicpogs.Metadata{
+				{
 					Key: "HttpHeader:Another-Header",
 					Val: "Misc",
 				},
-				quicpogs.Metadata{
+				{
 					Key: "HttpHost",
 					Val: "cf.host",
 				},
-				quicpogs.Metadata{
+				{
 					Key: "HttpMethod",
 					Val: "get",
 				},
@@ -154,8 +154,8 @@ func TestQUICServer(t *testing.T) {
 		t.Run(test.desc, func(t *testing.T) {
 			ctx, cancel := context.WithCancel(context.Background())
 			var wg sync.WaitGroup
+			wg.Add(1)
 			go func() {
-				wg.Add(1)
 				defer wg.Done()
 				quicServer(
 					t, udpListener, tlsConfig, quicConfig,
@@ -171,7 +171,7 @@ func TestQUICServer(t *testing.T) {
 				udpListener.LocalAddr(),
 				tlsClientConfig,
 				originProxy,
-				&pogs.ConnectionOptions{},
+				&tunnelpogs.ConnectionOptions{},
 				controlStream,
 				NewObserver(&log, &log, false),
 			)
@@ -218,10 +218,11 @@ func quicServer(
 	stream, err := session.OpenStreamSync(context.Background())
 	require.NoError(t, err)
 
-	err = quicpogs.WriteConnectRequestData(stream, dest, connectionType, metadata...)
+	reqClientStream := quicpogs.RequestClientStream{ReadWriteCloser: stream}
+	err = reqClientStream.WriteConnectRequestData(dest, connectionType, metadata...)
 	require.NoError(t, err)
 
-	_, err = quicpogs.ReadConnectResponseData(stream)
+	_, err = reqClientStream.ReadConnectResponseData()
 	require.NoError(t, err)
 
 	if message != nil {
@@ -309,23 +310,23 @@ func TestBuildHTTPRequest(t *testing.T) {
 			connectRequest: &quicpogs.ConnectRequest{
 				Dest: "http://test.com",
 				Metadata: []quicpogs.Metadata{
-					quicpogs.Metadata{
+					{
 						Key: "HttpHeader:Cf-Cloudflared-Proxy-Connection-Upgrade",
 						Val: "Websocket",
 					},
-					quicpogs.Metadata{
+					{
 						Key: "HttpHeader:Content-Length",
 						Val: "514",
 					},
-					quicpogs.Metadata{
+					{
 						Key: "HttpHeader:Another-Header",
 						Val: "Misc",
 					},
-					quicpogs.Metadata{
+					{
 						Key: "HttpHost",
 						Val: "cf.host",
 					},
-					quicpogs.Metadata{
+					{
 						Key: "HttpMethod",
 						Val: "get",
 					},
@@ -355,19 +356,19 @@ func TestBuildHTTPRequest(t *testing.T) {
 			connectRequest: &quicpogs.ConnectRequest{
 				Dest: "http://test.com",
 				Metadata: []quicpogs.Metadata{
-					quicpogs.Metadata{
+					{
 						Key: "HttpHeader:Cf-Cloudflared-Proxy-Connection-Upgrade",
 						Val: "Websocket",
 					},
-					quicpogs.Metadata{
+					{
 						Key: "HttpHeader:Another-Header",
 						Val: "Misc",
 					},
-					quicpogs.Metadata{
+					{
 						Key: "HttpHost",
 						Val: "cf.host",
 					},
-					quicpogs.Metadata{
+					{
 						Key: "HttpMethod",
 						Val: "get",
 					},
@@ -396,19 +397,19 @@ func TestBuildHTTPRequest(t *testing.T) {
 			connectRequest: &quicpogs.ConnectRequest{
 				Dest: "http://test.com",
 				Metadata: []quicpogs.Metadata{
-					quicpogs.Metadata{
+					{
 						Key: "HttpHeader:Another-Header",
 						Val: "Misc",
 					},
-					quicpogs.Metadata{
+					{
 						Key: "HttpHeader:Transfer-Encoding",
 						Val: "chunked",
 					},
-					quicpogs.Metadata{
+					{
 						Key: "HttpHost",
 						Val: "cf.host",
 					},
-					quicpogs.Metadata{
+					{
 						Key: "HttpMethod",
 						Val: "get",
 					},
@@ -438,19 +439,19 @@ func TestBuildHTTPRequest(t *testing.T) {
 			connectRequest: &quicpogs.ConnectRequest{
 				Dest: "http://test.com",
 				Metadata: []quicpogs.Metadata{
-					quicpogs.Metadata{
+					{
 						Key: "HttpHeader:Another-Header",
 						Val: "Misc",
 					},
-					quicpogs.Metadata{
+					{
 						Key: "HttpHeader:Transfer-Encoding",
 						Val: "gzip,chunked",
 					},
-					quicpogs.Metadata{
+					{
 						Key: "HttpHost",
 						Val: "cf.host",
 					},
-					quicpogs.Metadata{
+					{
 						Key: "HttpMethod",
 						Val: "get",
 					},
@@ -481,15 +482,15 @@ func TestBuildHTTPRequest(t *testing.T) {
 				Type: quicpogs.ConnectionTypeWebsocket,
 				Dest: "http://test.com",
 				Metadata: []quicpogs.Metadata{
-					quicpogs.Metadata{
+					{
 						Key: "HttpHeader:Another-Header",
 						Val: "Misc",
 					},
-					quicpogs.Metadata{
+					{
 						Key: "HttpHost",
 						Val: "cf.host",
 					},
-					quicpogs.Metadata{
+					{
 						Key: "HttpMethod",
 						Val: "get",
 					},

datagramsession/event.go

@@ -0,0 +1,33 @@
+package datagramsession
+
+import (
+	"io"
+
+	"github.com/google/uuid"
+)
+
+// registerSessionEvent is an event to start tracking a new session
+type registerSessionEvent struct {
+	sessionID   uuid.UUID
+	originProxy io.ReadWriteCloser
+	resultChan  chan *Session
+}
+
+func newRegisterSessionEvent(sessionID uuid.UUID, originProxy io.ReadWriteCloser) *registerSessionEvent {
+	return &registerSessionEvent{
+		sessionID:   sessionID,
+		originProxy: originProxy,
+		resultChan:  make(chan *Session, 1),
+	}
+}
+
+// unregisterSessionEvent is an event to stop tracking and terminate the session.
+type unregisterSessionEvent struct {
+	sessionID uuid.UUID
+}
+
+// newDatagram is an event when transport receives new datagram
+type newDatagram struct {
+	sessionID uuid.UUID
+	payload   []byte
+}

datagramsession/manager.go

@@ -0,0 +1,134 @@
+package datagramsession
+
+import (
+	"context"
+	"io"
+
+	"github.com/google/uuid"
+	"github.com/rs/zerolog"
+	"golang.org/x/sync/errgroup"
+)
+
+const (
+	requestChanCapacity = 16
+)
+
+// Manager defines the APIs to manage sessions from the same transport.
+type Manager interface {
+	// Serve starts the event loop
+	Serve(ctx context.Context) error
+	// RegisterSession starts tracking a session. Caller is responsible for starting the session
+	RegisterSession(ctx context.Context, sessionID uuid.UUID, dstConn io.ReadWriteCloser) (*Session, error)
+	// UnregisterSession stops tracking the session and terminates it
+	UnregisterSession(ctx context.Context, sessionID uuid.UUID) error
+}
+
+type manager struct {
+	registrationChan   chan *registerSessionEvent
+	unregistrationChan chan *unregisterSessionEvent
+	datagramChan       chan *newDatagram
+	transport          transport
+	sessions           map[uuid.UUID]*Session
+	log                *zerolog.Logger
+}
+
+func NewManager(transport transport, log *zerolog.Logger) Manager {
+	return &manager{
+		registrationChan:   make(chan *registerSessionEvent),
+		unregistrationChan: make(chan *unregisterSessionEvent),
+		// datagramChan is buffered, so it can read more datagrams from transport while the event loop is processing other events
+		datagramChan: make(chan *newDatagram, requestChanCapacity),
+		transport:    transport,
+		sessions:     make(map[uuid.UUID]*Session),
+		log:          log,
+	}
+}
+
+func (m *manager) Serve(ctx context.Context) error {
+	errGroup, ctx := errgroup.WithContext(ctx)
+	errGroup.Go(func() error {
+		for {
+			sessionID, payload, err := m.transport.ReceiveFrom()
+			if err != nil {
+				m.log.Err(err).Msg("Failed to receive datagram from transport, closing session manager")
+				return err
+			}
+			datagram := &newDatagram{
+				sessionID: sessionID,
+				payload:   payload,
+			}
+			select {
+			case <-ctx.Done():
+				return ctx.Err()
+			// Only the event loop routine can update/lookup the sessions map to avoid concurrent access
+			// Send the datagram to the event loop. It will find the session to send to
+			case m.datagramChan <- datagram:
+			}
+		}
+	})
+	errGroup.Go(func() error {
+		for {
+			select {
+			case <-ctx.Done():
+				return ctx.Err()
+			case datagram := <-m.datagramChan:
+				m.sendToSession(datagram)
+			case registration := <-m.registrationChan:
+				m.registerSession(ctx, registration)
+			// TODO: TUN-5422: Unregister inactive session upon timeout
+			case unregistration := <-m.unregistrationChan:
+				m.unregisterSession(unregistration)
+			}
+		}
+	})
+	return errGroup.Wait()
+}
+
+func (m *manager) RegisterSession(ctx context.Context, sessionID uuid.UUID, originProxy io.ReadWriteCloser) (*Session, error) {
+	event := newRegisterSessionEvent(sessionID, originProxy)
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	case m.registrationChan <- event:
+		session := <-event.resultChan
+		return session, nil
+	}
+}
+
+func (m *manager) registerSession(ctx context.Context, registration *registerSessionEvent) {
+	session := newSession(registration.sessionID, m.transport, registration.originProxy)
+	m.sessions[registration.sessionID] = session
+	registration.resultChan <- session
+}
+
+func (m *manager) UnregisterSession(ctx context.Context, sessionID uuid.UUID) error {
+	event := &unregisterSessionEvent{sessionID: sessionID}
+	select {
+	case <-ctx.Done():
+		return ctx.Err()
+	case m.unregistrationChan <- event:
+		return nil
+	}
+}
+
+func (m *manager) unregisterSession(unregistration *unregisterSessionEvent) {
+	session, ok := m.sessions[unregistration.sessionID]
+	if ok {
+		delete(m.sessions, unregistration.sessionID)
+		session.close()
+	}
+}
+
+func (m *manager) sendToSession(datagram *newDatagram) {
+	session, ok := m.sessions[datagram.sessionID]
+	if !ok {
+		m.log.Error().Str("sessionID", datagram.sessionID.String()).Msg("session not found")
+		return
+	}
+	// session writes to destination over a connected UDP socket, which should not be blocking, so this call doesn't
+	// need to run in another go routine
+	_, err := session.transportToDst(datagram.payload)
+	if err != nil {
+		m.log.Err(err).Str("sessionID", datagram.sessionID.String()).Msg("Failed to write payload to session")
+	}
+}

datagramsession/manager_test.go

@@ -0,0 +1,215 @@
+package datagramsession
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/rs/zerolog"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/sync/errgroup"
+)
+
+func TestManagerServe(t *testing.T) {
+	const (
+		sessions = 20
+		msgs     = 50
+	)
+	log := zerolog.Nop()
+	transport := &mockQUICTransport{
+		reqChan:  newDatagramChannel(1),
+		respChan: newDatagramChannel(1),
+	}
+	mg := NewManager(transport, &log)
+
+	eyeballTracker := make(map[uuid.UUID]*datagramChannel)
+	for i := 0; i < sessions; i++ {
+		sessionID := uuid.New()
+		eyeballTracker[sessionID] = newDatagramChannel(1)
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	serveDone := make(chan struct{})
+	go func(ctx context.Context) {
+		mg.Serve(ctx)
+		close(serveDone)
+	}(ctx)
+
+	go func(ctx context.Context) {
+		for {
+			sessionID, payload, err := transport.respChan.Receive(ctx)
+			if err != nil {
+				require.Equal(t, context.Canceled, err)
+				return
+			}
+			respChan := eyeballTracker[sessionID]
+			require.NoError(t, respChan.Send(ctx, sessionID, payload))
+		}
+	}(ctx)
+
+	errGroup, ctx := errgroup.WithContext(ctx)
+	for sID, receiver := range eyeballTracker {
+		// Assign loop variables to local variables
+		sessionID := sID
+		eyeballRespReceiver := receiver
+		errGroup.Go(func() error {
+			payload := testPayload(sessionID)
+			expectResp := testResponse(payload)
+
+			cfdConn, originConn := net.Pipe()
+
+			origin := mockOrigin{
+				expectMsgCount: msgs,
+				expectedMsg:    payload,
+				expectedResp:   expectResp,
+				conn:           originConn,
+			}
+			eyeball := mockEyeball{
+				expectMsgCount:  msgs,
+				expectedMsg:     expectResp,
+				expectSessionID: sessionID,
+				respReceiver:    eyeballRespReceiver,
+			}
+
+			reqErrGroup, reqCtx := errgroup.WithContext(ctx)
+			reqErrGroup.Go(func() error {
+				return origin.serve()
+			})
+			reqErrGroup.Go(func() error {
+				return eyeball.serve(reqCtx)
+			})
+
+			session, err := mg.RegisterSession(ctx, sessionID, cfdConn)
+			require.NoError(t, err)
+
+			sessionDone := make(chan struct{})
+			go func() {
+				session.Serve(ctx, time.Minute*2)
+				close(sessionDone)
+			}()
+
+			for i := 0; i < msgs; i++ {
+				require.NoError(t, transport.newRequest(ctx, sessionID, testPayload(sessionID)))
+			}
+
+			// Make sure eyeball and origin have received all messages before unregistering the session
+			require.NoError(t, reqErrGroup.Wait())
+
+			require.NoError(t, mg.UnregisterSession(ctx, sessionID))
+			<-sessionDone
+
+			return nil
+		})
+	}
+
+	require.NoError(t, errGroup.Wait())
+	cancel()
+	transport.close()
+	<-serveDone
+}
+
+type mockOrigin struct {
+	expectMsgCount int
+	expectedMsg    []byte
+	expectedResp   []byte
+	conn           io.ReadWriteCloser
+}
+
+func (mo *mockOrigin) serve() error {
+	expectedMsgLen := len(mo.expectedMsg)
+	readBuffer := make([]byte, expectedMsgLen+1)
+	for i := 0; i < mo.expectMsgCount; i++ {
+		n, err := mo.conn.Read(readBuffer)
+		if err != nil {
+			return err
+		}
+		if n != expectedMsgLen {
+			return fmt.Errorf("Expect to read %d bytes, read %d", expectedMsgLen, n)
+		}
+		if !bytes.Equal(readBuffer[:n], mo.expectedMsg) {
+			return fmt.Errorf("Expect %v, read %v", mo.expectedMsg, readBuffer[:n])
+		}
+
+		_, err = mo.conn.Write(mo.expectedResp)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func testPayload(sessionID uuid.UUID) []byte {
+	return []byte(fmt.Sprintf("Message from %s", sessionID))
+}
+
+func testResponse(msg []byte) []byte {
+	return []byte(fmt.Sprintf("Response to %v", msg))
+}
+
+type mockEyeball struct {
+	expectMsgCount  int
+	expectedMsg     []byte
+	expectSessionID uuid.UUID
+	respReceiver    *datagramChannel
+}
+
+func (me *mockEyeball) serve(ctx context.Context) error {
+	for i := 0; i < me.expectMsgCount; i++ {
+		sessionID, msg, err := me.respReceiver.Receive(ctx)
+		if err != nil {
+			return err
+		}
+		if sessionID != me.expectSessionID {
+			return fmt.Errorf("Expect session %s, got %s", me.expectSessionID, sessionID)
+		}
+		if !bytes.Equal(msg, me.expectedMsg) {
+			return fmt.Errorf("Expect %v, read %v", me.expectedMsg, msg)
+		}
+	}
+	return nil
+}
+
+// datagramChannel is a channel for Datagram with wrapper to send/receive with context
+type datagramChannel struct {
+	datagramChan chan *newDatagram
+	closedChan   chan struct{}
+}
+
+func newDatagramChannel(capacity uint) *datagramChannel {
+	return &datagramChannel{
+		datagramChan: make(chan *newDatagram, capacity),
+		closedChan:   make(chan struct{}),
+	}
+}
+
+func (rc *datagramChannel) Send(ctx context.Context, sessionID uuid.UUID, payload []byte) error {
+	select {
+	case <-ctx.Done():
+		return ctx.Err()
+	case <-rc.closedChan:
+		return fmt.Errorf("datagram channel closed")
+	case rc.datagramChan <- &newDatagram{sessionID: sessionID, payload: payload}:
+		return nil
+	}
+}
+
+func (rc *datagramChannel) Receive(ctx context.Context) (uuid.UUID, []byte, error) {
+	select {
+	case <-ctx.Done():
+		return uuid.Nil, nil, ctx.Err()
+	case <-rc.closedChan:
+		return uuid.Nil, nil, fmt.Errorf("datagram channel closed")
+	case msg := <-rc.datagramChan:
+		return msg.sessionID, msg.payload, nil
+	}
+}
+
+func (rc *datagramChannel) Close() {
+	// No need to close msgChan, it will be garbage collect once there is no reference to it
+	close(rc.closedChan)
+}

datagramsession/session.go

@@ -0,0 +1,118 @@
+package datagramsession
+
+import (
+	"context"
+	"io"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+const (
+	defaultCloseIdleAfter = time.Second * 210
+)
+
+// Each Session is a bidirectional pipe of datagrams between transport and dstConn
+// Currently the only implementation of transport is quic DatagramMuxer
+// Destination can be a connection with origin or with eyeball
+// When the destination is origin:
+// - Datagrams from edge are read by Manager from the transport. Manager finds the corresponding Session and calls the
+//   write method of the Session to send to origin
+// - Datagrams from origin are read from conn and SentTo transport. Transport will return them to eyeball
+// When the destination is eyeball:
+// - Datagrams from eyeball are read from conn and SentTo transport. Transport will send them to cloudflared
+// - Datagrams from cloudflared are read by Manager from the transport. Manager finds the corresponding Session and calls the
+//   write method of the Session to send to eyeball
+type Session struct {
+	id        uuid.UUID
+	transport transport
+	dstConn   io.ReadWriteCloser
+	// activeAtChan is used to communicate the last read/write time
+	activeAtChan chan time.Time
+	doneChan     chan struct{}
+}
+
+func newSession(id uuid.UUID, transport transport, dstConn io.ReadWriteCloser) *Session {
+	return &Session{
+		id:        id,
+		transport: transport,
+		dstConn:   dstConn,
+		// activeAtChan has low capacity. It can be full when there are many concurrent read/write. markActive() will
+		// drop instead of blocking because last active time only needs to be an approximation
+		activeAtChan: make(chan time.Time, 2),
+		doneChan:     make(chan struct{}),
+	}
+}
+
+func (s *Session) Serve(ctx context.Context, closeAfterIdle time.Duration) error {
+	serveCtx, cancel := context.WithCancel(ctx)
+	defer cancel()
+	go s.waitForCloseCondition(serveCtx, closeAfterIdle)
+	// QUIC implementation copies data to another buffer before returning https://github.com/lucas-clemente/quic-go/blob/v0.24.0/session.go#L1967-L1975
+	// This makes it safe to share readBuffer between iterations
+	readBuffer := make([]byte, s.transport.MTU())
+	for {
+		if err := s.dstToTransport(readBuffer); err != nil {
+			return err
+		}
+	}
+}
+
+func (s *Session) waitForCloseCondition(ctx context.Context, closeAfterIdle time.Duration) {
+	if closeAfterIdle == 0 {
+		// provide deafult is caller doesn't specify one
+		closeAfterIdle = defaultCloseIdleAfter
+	}
+	// Closing dstConn cancels read so Serve function can return
+	defer s.dstConn.Close()
+
+	checkIdleFreq := closeAfterIdle / 8
+	checkIdleTicker := time.NewTicker(checkIdleFreq)
+	defer checkIdleTicker.Stop()
+
+	activeAt := time.Now()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-s.doneChan:
+			return
+		// TODO: TUN-5423 evaluate if using atomic is more efficient
+		case now := <-checkIdleTicker.C:
+			// The session is considered inactive if current time is after (last active time + allowed idle time)
+			if now.After(activeAt.Add(closeAfterIdle)) {
+				return
+			}
+		case activeAt = <-s.activeAtChan: // Update last active time
+		}
+	}
+}
+
+func (s *Session) dstToTransport(buffer []byte) error {
+	n, err := s.dstConn.Read(buffer)
+	s.markActive()
+	if n > 0 {
+		if err := s.transport.SendTo(s.id, buffer[:n]); err != nil {
+			return err
+		}
+	}
+	return err
+}
+
+func (s *Session) transportToDst(payload []byte) (int, error) {
+	s.markActive()
+	return s.dstConn.Write(payload)
+}
+
+// Sends the last active time to the idle checker loop without blocking. activeAtChan will only be full when there
+// are many concurrent read/write. It is fine to lose some precision
+func (s *Session) markActive() {
+	select {
+	case s.activeAtChan <- time.Now():
+	default:
+	}
+}
+
+func (s *Session) close() {
+	close(s.doneChan)
+}

datagramsession/session_test.go

@@ -0,0 +1,177 @@
+package datagramsession
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"net"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/sync/errgroup"
+)
+
+// TestCloseSession makes sure a session will stop after context is done
+func TestSessionCtxDone(t *testing.T) {
+	testSessionReturns(t, closeByContext, time.Minute*2)
+}
+
+// TestCloseSession makes sure a session will stop after close method is called
+func TestCloseSession(t *testing.T) {
+	testSessionReturns(t, closeByCallingClose, time.Minute*2)
+}
+
+// TestCloseIdle makess sure a session will stop after there is no read/write for a period defined by closeAfterIdle
+func TestCloseIdle(t *testing.T) {
+	testSessionReturns(t, closeByTimeout, time.Millisecond*100)
+}
+
+func testSessionReturns(t *testing.T, closeBy closeMethod, closeAfterIdle time.Duration) {
+	sessionID := uuid.New()
+	cfdConn, originConn := net.Pipe()
+	payload := testPayload(sessionID)
+	transport := &mockQUICTransport{
+		reqChan:  newDatagramChannel(1),
+		respChan: newDatagramChannel(1),
+	}
+	session := newSession(sessionID, transport, cfdConn)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	sessionDone := make(chan struct{})
+	go func() {
+		session.Serve(ctx, closeAfterIdle)
+		close(sessionDone)
+	}()
+
+	go func() {
+		n, err := session.transportToDst(payload)
+		require.NoError(t, err)
+		require.Equal(t, len(payload), n)
+	}()
+
+	readBuffer := make([]byte, len(payload)+1)
+	n, err := originConn.Read(readBuffer)
+	require.NoError(t, err)
+	require.Equal(t, len(payload), n)
+
+	lastRead := time.Now()
+
+	switch closeBy {
+	case closeByContext:
+		cancel()
+	case closeByCallingClose:
+		session.close()
+	}
+
+	<-sessionDone
+	if closeBy == closeByTimeout {
+		require.True(t, time.Now().After(lastRead.Add(closeAfterIdle)))
+	}
+	// call cancelled again otherwise the linter will warn about possible context leak
+	cancel()
+}
+
+type closeMethod int
+
+const (
+	closeByContext closeMethod = iota
+	closeByCallingClose
+	closeByTimeout
+)
+
+func TestWriteToDstSessionPreventClosed(t *testing.T) {
+	testActiveSessionNotClosed(t, false, true)
+}
+
+func TestReadFromDstSessionPreventClosed(t *testing.T) {
+	testActiveSessionNotClosed(t, true, false)
+}
+
+func testActiveSessionNotClosed(t *testing.T, readFromDst bool, writeToDst bool) {
+	const closeAfterIdle = time.Millisecond * 100
+	const activeTime = time.Millisecond * 500
+
+	sessionID := uuid.New()
+	cfdConn, originConn := net.Pipe()
+	payload := testPayload(sessionID)
+	transport := &mockQUICTransport{
+		reqChan:  newDatagramChannel(100),
+		respChan: newDatagramChannel(100),
+	}
+	session := newSession(sessionID, transport, cfdConn)
+
+	startTime := time.Now()
+	activeUntil := startTime.Add(activeTime)
+	ctx, cancel := context.WithCancel(context.Background())
+	errGroup, ctx := errgroup.WithContext(ctx)
+	errGroup.Go(func() error {
+		session.Serve(ctx, closeAfterIdle)
+		if time.Now().Before(startTime.Add(activeTime)) {
+			return fmt.Errorf("session closed while it's still active")
+		}
+		return nil
+	})
+
+	if readFromDst {
+		errGroup.Go(func() error {
+			for {
+				if time.Now().After(activeUntil) {
+					return nil
+				}
+				if _, err := originConn.Write(payload); err != nil {
+					return err
+				}
+				time.Sleep(closeAfterIdle / 2)
+			}
+		})
+	}
+	if writeToDst {
+		errGroup.Go(func() error {
+			readBuffer := make([]byte, len(payload))
+			for {
+				n, err := originConn.Read(readBuffer)
+				if err != nil {
+					if err == io.EOF || err == io.ErrClosedPipe {
+						return nil
+					}
+					return err
+				}
+				if !bytes.Equal(payload, readBuffer[:n]) {
+					return fmt.Errorf("payload %v is not equal to %v", readBuffer[:n], payload)
+				}
+			}
+		})
+		errGroup.Go(func() error {
+			for {
+				if time.Now().After(activeUntil) {
+					return nil
+				}
+				if _, err := session.transportToDst(payload); err != nil {
+					return err
+				}
+				time.Sleep(closeAfterIdle / 2)
+			}
+		})
+	}
+
+	require.NoError(t, errGroup.Wait())
+	cancel()
+}
+
+func TestMarkActiveNotBlocking(t *testing.T) {
+	const concurrentCalls = 50
+	session := newSession(uuid.New(), nil, nil)
+	var wg sync.WaitGroup
+	wg.Add(concurrentCalls)
+	for i := 0; i < concurrentCalls; i++ {
+		go func() {
+			session.markActive()
+			wg.Done()
+		}()
+	}
+	wg.Wait()
+}

datagramsession/transport.go

@@ -0,0 +1,13 @@
+package datagramsession
+
+import "github.com/google/uuid"
+
+// Transport is a connection between cloudflared and edge that can multiplex datagrams from multiple sessions
+type transport interface {
+	// SendTo writes payload for a session to the transport
+	SendTo(sessionID uuid.UUID, payload []byte) error
+	// ReceiveFrom reads the next datagram from the transport
+	ReceiveFrom() (uuid.UUID, []byte, error)
+	// Max transmission unit of the transport
+	MTU() uint
+}

datagramsession/transport_test.go

@@ -0,0 +1,36 @@
+package datagramsession
+
+import (
+	"context"
+
+	"github.com/google/uuid"
+)
+
+type mockQUICTransport struct {
+	reqChan  *datagramChannel
+	respChan *datagramChannel
+}
+
+func (mt *mockQUICTransport) SendTo(sessionID uuid.UUID, payload []byte) error {
+	buf := make([]byte, len(payload))
+	// The QUIC implementation copies data to another buffer before returning https://github.com/lucas-clemente/quic-go/blob/v0.24.0/session.go#L1967-L1975
+	copy(buf, payload)
+	return mt.respChan.Send(context.Background(), sessionID, buf)
+}
+
+func (mt *mockQUICTransport) ReceiveFrom() (uuid.UUID, []byte, error) {
+	return mt.reqChan.Receive(context.Background())
+}
+
+func (mt *mockQUICTransport) MTU() uint {
+	return 1220
+}
+
+func (mt *mockQUICTransport) newRequest(ctx context.Context, sessionID uuid.UUID, payload []byte) error {
+	return mt.reqChan.Send(ctx, sessionID, payload)
+}
+
+func (mt *mockQUICTransport) close() {
+	mt.reqChan.Close()
+	mt.respChan.Close()
+}

github_release.py

@@ -72,7 +72,7 @@ def get_or_create_release(repo, version, dry_run=False):
     except UnknownObjectException:
         logging.info("Release %s not found", version)
 
-    # We dont want to create a new release tag if one doesnt already exist
+    # We don't want to create a new release tag if one doesn't already exist
     assert_tag_exists(repo, version)
 
     if dry_run:
@@ -198,7 +198,7 @@ def upload_asset(release, filepath, filename, release_version, kv_account_id, na
         pass # the macOS release copy fails with being the same file (already in the artifacts directory)
 
 def main():
-    """ Attempts to upload Asset to Github Release. Creates Release if it doesnt exist """
+    """ Attempts to upload Asset to Github Release. Creates Release if it doesn't exist """
     try:
         args = parse_args()
         client = Github(args.api_key)

go.mod

@@ -28,7 +28,7 @@ require (
 	github.com/json-iterator/go v1.1.10
 	github.com/kr/text v0.2.0 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
-	github.com/lucas-clemente/quic-go v0.23.0
+	github.com/lucas-clemente/quic-go v0.24.0
 	github.com/mattn/go-colorable v0.1.8
 	github.com/miekg/dns v1.1.31
 	github.com/mitchellh/go-homedir v1.1.0
@@ -45,11 +45,11 @@ require (
 	github.com/stretchr/testify v1.6.0
 	github.com/urfave/cli/v2 v2.2.0
 	go.uber.org/automaxprocs v1.4.0
-	golang.org/x/crypto v0.0.0-20200820211705-5c72a883971a
-	golang.org/x/net v0.0.0-20210428140749-89ef3d95e781
+	golang.org/x/crypto v0.0.0-20210921155107-089bfa567519
+	golang.org/x/net v0.0.0-20211109214657-ef0fda0de508
 	golang.org/x/oauth2 v0.0.0-20200902213428-5d25da1a8d43 // indirect
 	golang.org/x/sync v0.0.0-20210220032951-036812b2e83c
-	golang.org/x/sys v0.0.0-20210510120138-977fb7262007
+	golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1
 	golang.org/x/term v0.0.0-20201210144234-2321bbc49cbf
 	google.golang.org/genproto v0.0.0-20200904004341-0bd0a958aa1d // indirect
 	google.golang.org/grpc v1.32.0 // indirect
@@ -70,6 +70,7 @@ require (
 	github.com/cheekybits/genny v1.0.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568 // indirect
+	github.com/francoispqt/gojay v1.2.13 // indirect
 	github.com/gdamore/encoding v1.0.0 // indirect
 	github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 // indirect
 	github.com/golang/protobuf v1.5.2 // indirect

go.sum

@@ -197,6 +197,7 @@ github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5Kwzbycv
 github.com/fatih/structs v1.1.0/go.mod h1:9NiDSp5zOcgEDl+j00MP/WkGVPOlPRLejGD8Ga6PJ7M=
 github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568 h1:BHsljHzVlRcyQhjrss6TZTdY2VfCqZPbv5k3iBFa2ZQ=
 github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc=
+github.com/francoispqt/gojay v1.2.13 h1:d2m3sFjloqoIUQU3TsHBgj6qg/BVGlTBeHDUmyJnXKk=
 github.com/francoispqt/gojay v1.2.13/go.mod h1:ehT5mTG4ua4581f1++1WLG0vPdaA9HaiDsoyrBGkyDY=
 github.com/franela/goblin v0.0.0-20200105215937-c9ffbefa60db/go.mod h1:7dvUGVsVBjqR7JHJk0brhHOZYGmfBYOrK0ZhYMEtBr4=
 github.com/franela/goreq v0.0.0-20171204163338-bcd34c9993f8/go.mod h1:ZhphrRTfi2rbfLwlschooIH4+wKKDR4Pdxhh+TRoA20=
@@ -421,6 +422,8 @@ github.com/liquidweb/liquidweb-go v1.6.0/go.mod h1:UDcVnAMDkZxpw4Y7NOHkqoeiGacVL
 github.com/lucas-clemente/quic-go v0.13.1/go.mod h1:Vn3/Fb0/77b02SGhQk36KzOUmXgVpFfizUfW5WMaqyU=
 github.com/lucas-clemente/quic-go v0.23.0 h1:5vFnKtZ6nHDFsc/F3uuiF4T3y/AXaQdxjUqiVw26GZE=
 github.com/lucas-clemente/quic-go v0.23.0/go.mod h1:paZuzjXCE5mj6sikVLMvqXk8lJV2AsqtJ6bDhjEfxx0=
+github.com/lucas-clemente/quic-go v0.24.0 h1:ToR7SIIEdrgOhgVTHvPgdVRJfgVy+N0wQAagH7L4d5g=
+github.com/lucas-clemente/quic-go v0.24.0/go.mod h1:paZuzjXCE5mj6sikVLMvqXk8lJV2AsqtJ6bDhjEfxx0=
 github.com/lucasb-eyer/go-colorful v1.0.2/go.mod h1:0MS4r+7BZKSJ5mw4/S5MPN+qHFF1fYclkSPilDOKW0s=
 github.com/lucasb-eyer/go-colorful v1.0.3 h1:QIbQXiugsb+q10B+MI+7DI1oQLdmnep86tWFlaaUAac=
 github.com/lucasb-eyer/go-colorful v1.0.3/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
@@ -732,6 +735,8 @@ golang.org/x/crypto v0.0.0-20200323165209-0ec3e9974c59/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200820211705-5c72a883971a h1:vclmkQCjlDX5OydZ9wv8rBCcS0QyQY66Mpf/7BZbInM=
 golang.org/x/crypto v0.0.0-20200820211705-5c72a883971a/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519 h1:7I4JAnoQBe7ZtJcBaYHi5UtiO8tQHbUSXxL+pnGRANg=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -815,6 +820,8 @@ golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwY
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
 golang.org/x/net v0.0.0-20210428140749-89ef3d95e781 h1:DzZ89McO9/gWPsQXS/FVKAlG02ZjaQ6AlZRBimEYOd0=
 golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
+golang.org/x/net v0.0.0-20211109214657-ef0fda0de508 h1:v3NKo+t/Kc3EASxaKZ82lwK6mCf4ZeObQBduYFZHo7c=
+golang.org/x/net v0.0.0-20211109214657-ef0fda0de508/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181017192945-9dcd33a902f4/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181203162652-d668ce993890/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
@@ -899,6 +906,8 @@ golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007 h1:gG67DSER+11cZvqIMb8S8bt0vZtiN6xWYARwirrOSfE=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1 h1:SrN+KX8Art/Sf4HNj6Zcz06G7VEz+7w9tdXTPOZ7+l4=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20201210144234-2321bbc49cbf h1:MZ2shdL+ZM/XzY3ZGOnh4Nlpnxz5GSOhOmtHo3iPU6M=
 golang.org/x/term v0.0.0-20201210144234-2321bbc49cbf/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=

h2mux/activestreammap.go

@@ -93,7 +93,7 @@ func (m *activeStreamMap) Set(newStream *MuxedStream) bool {
 	return true
 }
 
-// Delete stops tracking the stream. It should be called only after it is closed and resetted.
+// Delete stops tracking the stream. It should be called only after it is closed and reset.
 func (m *activeStreamMap) Delete(streamID uint32) {
 	m.Lock()
 	defer m.Unlock()

h2mux/h2_dictionaries.go

@@ -12,7 +12,7 @@ import (
 /* This is an implementation of https://github.com/vkrasnov/h2-compression-dictionaries
 but modified for tunnels in a few key ways:
 Since tunnels is a server-to-server service, some aspects of the spec would cause
-unnessasary head-of-line blocking on the CPU and on the network, hence this implementation
+unnecessary head-of-line blocking on the CPU and on the network, hence this implementation
 allows for parallel compression on the "client", and buffering on the "server" to solve
 this problem. */
 
@@ -67,7 +67,7 @@ var compressionPresets = map[CompressionSetting]CompressionPreset{
 }
 
 func compressionSettingVal(version, fmt, sz, nd uint8) uint32 {
-	// Currently the compression settings are inlcude:
+	// Currently the compression settings are include:
 	// * version: only 1 is supported
 	// * fmt: only 2 for brotli is supported
 	// * sz: log2 of the maximal allowed dictionary size
@@ -438,7 +438,7 @@ func assignDictToStream(s *MuxedStream, p []byte) bool {
 	h2d.dictLock.Lock()
 
 	if w.comp != nil {
-		// Check again with lock, in therory the inteface allows for unordered writes
+		// Check again with lock, in therory the interface allows for unordered writes
 		h2d.dictLock.Unlock()
 		return false
 	}
@@ -468,7 +468,7 @@ func assignDictToStream(s *MuxedStream, p []byte) bool {
 		}
 	} else {
 		// Use the overflow dictionary as last resort
-		// If slots are availabe generate new dictioanries for path and content-type
+		// If slots are available generate new dictionaries for path and content-type
 		useID, _ = h2d.getGenericDictID()
 		pathID, pathFound = h2d.getNextDictID()
 		if pathFound {

h2mux/h2mux.go

@@ -174,7 +174,7 @@ func Handshake(
 	pingTimestamp := NewPingTimestamp()
 	connActive := NewSignal()
 	idleDuration := config.HeartbeatInterval
-	// Sanity check to enusre idelDuration is sane
+	// Sanity check to ensure idelDuration is sane
 	if idleDuration == 0 || idleDuration < defaultTimeout {
 		idleDuration = defaultTimeout
 		config.Log.Info().Msgf("muxer: Minimum idle time has been adjusted to %d", defaultTimeout)
@@ -274,7 +274,7 @@ func (m *Muxer) readPeerSettings(magic uint32) error {
 		m.compressionQuality = compressionPresets[CompressionNone]
 		return nil
 	}
-	// Values used for compression are the mimimum between the two peers
+	// Values used for compression are the minimum between the two peers
 	if sz < m.compressionQuality.dictSize {
 		m.compressionQuality.dictSize = sz
 	}

h2mux/muxmetrics_test.go

@@ -130,7 +130,7 @@ func TestMuxMetricsUpdater(t *testing.T) {
 			m.updateReceiveWindow(uint32(j))
 			m.updateSendWindow(uint32(j))
 
-			// should always be disgarded since the send time is before readerSend
+			// should always be discarded since the send time is before readerSend
 			rm := &roundTripMeasurement{receiveTime: readerStart, sendTime: readerStart.Add(-time.Duration(j*dataPoints) * time.Millisecond)}
 			m.updateRTT(rm)
 

ingress/origin_connection_test.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"fmt"
+	"io"
 	"io/ioutil"
 	"net"
 	"net/http"
@@ -19,7 +20,6 @@ import (
 	"golang.org/x/net/proxy"
 	"golang.org/x/sync/errgroup"
 
-	"github.com/cloudflare/cloudflared/connection"
 	"github.com/cloudflare/cloudflared/logger"
 	"github.com/cloudflare/cloudflared/socks"
 	"github.com/cloudflare/cloudflared/websocket"
@@ -97,7 +97,7 @@ func TestDefaultStreamWSOverTCPConnection(t *testing.T) {
 }
 
 // TestSocksStreamWSOverTCPConnection simulates proxying in socks mode.
-// Eyeball side runs cloudflared accesss tcp with --url flag to start a websocket forwarder which
+// Eyeball side runs cloudflared access tcp with --url flag to start a websocket forwarder which
 // wraps SOCKS5 traffic in websocket
 // Origin side runs a tcpOverWSConnection with socks.StreamHandler
 func TestSocksStreamWSOverTCPConnection(t *testing.T) {
@@ -192,8 +192,10 @@ func TestSocksStreamWSOverTCPConnection(t *testing.T) {
 
 func TestWsConnReturnsBeforeStreamReturns(t *testing.T) {
 	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		eyeballConn, err := connection.NewHTTP2RespWriter(r, w, connection.TypeWebsocket)
-		assert.NoError(t, err)
+		eyeballConn := &readWriter{
+			w: w,
+			r: r.Body,
+		}
 
 		cfdConn, originConn := net.Pipe()
 		tcpOverWSConn := tcpOverWSConnection{
@@ -319,3 +321,16 @@ func echoTCPOrigin(t *testing.T, conn net.Conn) {
 	_, err = conn.Write(testResponse)
 	assert.NoError(t, err)
 }
+
+type readWriter struct {
+	w io.Writer
+	r io.Reader
+}
+
+func (r *readWriter) Read(p []byte) (n int, err error) {
+	return r.r.Read(p)
+}
+
+func (r *readWriter) Write(p []byte) (n int, err error) {
+	return r.w.Write(p)
+}

ingress/origin_udp_proxy.go

@@ -0,0 +1,27 @@
+package ingress
+
+import (
+	"fmt"
+	"io"
+	"net"
+)
+
+type UDPProxy struct {
+	io.ReadWriteCloser
+}
+
+func DialUDP(dstIP net.IP, dstPort uint16) (*UDPProxy, error) {
+	dstAddr := &net.UDPAddr{
+		IP:   dstIP,
+		Port: int(dstPort),
+	}
+
+	// We use nil as local addr to force runtime to find the best suitable local address IP given the destination
+	// address as context.
+	udpConn, err := net.DialUDP("udp", nil, dstAddr)
+	if err != nil {
+		return nil, fmt.Errorf("unable to create UDP proxy to origin (%v:%v): %w", dstIP, dstPort, err)
+	}
+
+	return &UDPProxy{udpConn}, nil
+}

metrics/readiness.go

@@ -4,46 +4,32 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
-	"sync"
 
 	conn "github.com/cloudflare/cloudflared/connection"
+	"github.com/cloudflare/cloudflared/tunnelstate"
 
 	"github.com/rs/zerolog"
 )
 
 // ReadyServer serves HTTP 200 if the tunnel can serve traffic. Intended for k8s readiness checks.
 type ReadyServer struct {
-	sync.RWMutex
-	isConnected map[int]bool
-	log         *zerolog.Logger
+	tracker *tunnelstate.ConnTracker
 }
 
 // NewReadyServer initializes a ReadyServer and starts listening for dis/connection events.
 func NewReadyServer(log *zerolog.Logger) *ReadyServer {
 	return &ReadyServer{
-		isConnected: make(map[int]bool, 0),
-		log:         log,
+		tracker: tunnelstate.NewConnTracker(log),
 	}
 }
 
 func (rs *ReadyServer) OnTunnelEvent(c conn.Event) {
-	switch c.EventType {
-	case conn.Connected:
-		rs.Lock()
-		rs.isConnected[int(c.Index)] = true
-		rs.Unlock()
-	case conn.Disconnected, conn.Reconnecting, conn.RegisteringTunnel, conn.Unregistering:
-		rs.Lock()
-		rs.isConnected[int(c.Index)] = false
-		rs.Unlock()
-	default:
-		rs.log.Error().Msgf("Unknown connection event case %v", c)
-	}
+	rs.tracker.OnTunnelEvent(c)
 }
 
 type body struct {
-	Status           int `json:"status"`
-	ReadyConnections int `json:"readyConnections"`
+	Status           int  `json:"status"`
+	ReadyConnections uint `json:"readyConnections"`
 }
 
 // ServeHTTP responds with HTTP 200 if the tunnel is connected to the edge.
@@ -63,15 +49,11 @@ func (rs *ReadyServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 
 // This is the bulk of the logic for ServeHTTP, broken into its own pure function
 // to make unit testing easy.
-func (rs *ReadyServer) makeResponse() (statusCode, readyConnections int) {
-	statusCode = http.StatusServiceUnavailable
-	rs.RLock()
-	defer rs.RUnlock()
-	for _, connected := range rs.isConnected {
-		if connected {
-			statusCode = http.StatusOK
-			readyConnections++
-		}
+func (rs *ReadyServer) makeResponse() (statusCode int, readyConnections uint) {
+	readyConnections = rs.tracker.CountActiveConns()
+	if readyConnections > 0 {
+		return http.StatusOK, readyConnections
+	} else {
+		return http.StatusServiceUnavailable, readyConnections
 	}
-	return statusCode, readyConnections
 }

metrics/readiness_test.go

@@ -7,6 +7,8 @@ import (
 	"github.com/rs/zerolog"
 	"github.com/stretchr/testify/assert"
 
+	"github.com/cloudflare/cloudflared/tunnelstate"
+
 	"github.com/cloudflare/cloudflared/connection"
 )
 
@@ -18,7 +20,7 @@ func TestReadyServer_makeResponse(t *testing.T) {
 		name                 string
 		fields               fields
 		wantOK               bool
-		wantReadyConnections int
+		wantReadyConnections uint
 	}{
 		{
 			name: "One connection online => HTTP 200",
@@ -49,7 +51,7 @@ func TestReadyServer_makeResponse(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			rs := &ReadyServer{
-				isConnected: tt.fields.isConnected,
+				tracker: tunnelstate.MockedConnTracker(tt.fields.isConnected),
 			}
 			gotStatusCode, gotReadyConnections := rs.makeResponse()
 			if tt.wantOK && gotStatusCode != http.StatusOK {

origin/conn_aware_logger.go

@@ -0,0 +1,42 @@
+package origin
+
+import (
+	"github.com/rs/zerolog"
+
+	"github.com/cloudflare/cloudflared/connection"
+	"github.com/cloudflare/cloudflared/tunnelstate"
+)
+
+type ConnAwareLogger struct {
+	tracker *tunnelstate.ConnTracker
+	logger  *zerolog.Logger
+}
+
+func NewConnAwareLogger(logger *zerolog.Logger, observer *connection.Observer) *ConnAwareLogger {
+	connAwareLogger := &ConnAwareLogger{
+		tracker: tunnelstate.NewConnTracker(logger),
+		logger:  logger,
+	}
+
+	observer.RegisterSink(connAwareLogger.tracker)
+
+	return connAwareLogger
+}
+
+func (c *ConnAwareLogger) ReplaceLogger(logger *zerolog.Logger) *ConnAwareLogger {
+	return &ConnAwareLogger{
+		tracker: c.tracker,
+		logger:  logger,
+	}
+}
+
+func (c *ConnAwareLogger) ConnAwareLogger() *zerolog.Event {
+	if c.tracker.CountActiveConns() == 0 {
+		return c.logger.Error()
+	}
+	return c.logger.Warn()
+}
+
+func (c *ConnAwareLogger) Logger() *zerolog.Logger {
+	return c.logger
+}

origin/proxy.go

@@ -177,6 +177,11 @@ func (p *Proxy) proxyHTTPRequest(
 		roundTripReq.Header.Set("Connection", "keep-alive")
 	}
 
+	// Set the User-Agent as an empty string if not provided to avoid inserting golang default UA
+	if roundTripReq.Header.Get("User-Agent") == "" {
+		roundTripReq.Header.Set("User-Agent", "")
+	}
+
 	resp, err := httpService.RoundTrip(roundTripReq)
 	if err != nil {
 		return errors.Wrap(err, "Unable to reach the origin service. The service may be down or it may not be responding to traffic from cloudflared")

origin/proxy_test.go

@@ -767,7 +767,7 @@ func newWSRespWriter(w io.Writer) *wsRespWriter {
 func (w *wsRespWriter) Write(p []byte) (int, error) {
 	returnedMsg, err := wsutil.ReadServerBinary(bytes.NewBuffer(p))
 	if err != nil {
-		// The data was not returned by a websocket connecton.
+		// The data was not returned by a websocket connection.
 		if err != io.ErrUnexpectedEOF {
 			return w.w.Write(p)
 		}

origin/reconnect.go

@@ -91,7 +91,7 @@ func (cm *reconnectCredentialManager) ConnDigest(connID uint8) ([]byte, error) {
 	defer cm.mu.RUnlock()
 	digest, ok := cm.connDigest[connID]
 	if !ok {
-		return nil, fmt.Errorf("no conneciton digest for connection %v", connID)
+		return nil, fmt.Errorf("no connection digest for connection %v", connID)
 	}
 	return digest, nil
 }

origin/supervisor.go

@@ -46,7 +46,7 @@ type Supervisor struct {
 	nextConnectedIndex  int
 	nextConnectedSignal chan struct{}
 
-	log          *zerolog.Logger
+	log          *ConnAwareLogger
 	logTransport *zerolog.Logger
 
 	reconnectCredentialManager *reconnectCredentialManager
@@ -91,7 +91,7 @@ func NewSupervisor(config *TunnelConfig, reconnectCh chan ReconnectSignal, grace
 		edgeIPs:                    edgeIPs,
 		tunnelErrors:               make(chan tunnelError),
 		tunnelsConnecting:          map[int]chan struct{}{},
-		log:                        config.Log,
+		log:                        NewConnAwareLogger(config.Log, config.Observer),
 		logTransport:               config.LogTransport,
 		reconnectCredentialManager: newReconnectCredentialManager(connection.MetricsNamespace, connection.TunnelSubsystem, config.HAConnections),
 		useReconnectToken:          useReconnectToken,
@@ -123,7 +123,7 @@ func (s *Supervisor) Run(
 		if timer, err := s.reconnectCredentialManager.RefreshAuth(ctx, refreshAuthBackoff, s.authenticate); err == nil {
 			refreshAuthBackoffTimer = timer
 		} else {
-			s.log.Err(err).
+			s.log.Logger().Err(err).
 				Dur("refreshAuthRetryDuration", refreshAuthRetryDuration).
 				Msgf("supervisor: initial refreshAuth failed, retrying in %v", refreshAuthRetryDuration)
 			refreshAuthBackoffTimer = time.After(refreshAuthRetryDuration)
@@ -145,7 +145,7 @@ func (s *Supervisor) Run(
 		case tunnelError := <-s.tunnelErrors:
 			tunnelsActive--
 			if tunnelError.err != nil && !shuttingDown {
-				s.log.Err(tunnelError.err).Int(connection.LogFieldConnIndex, tunnelError.index).Msg("Connection terminated")
+				s.log.ConnAwareLogger().Err(tunnelError.err).Int(connection.LogFieldConnIndex, tunnelError.index).Msg("Connection terminated")
 				tunnelsWaiting = append(tunnelsWaiting, tunnelError.index)
 				s.waitForNextTunnel(tunnelError.index)
 
@@ -170,7 +170,7 @@ func (s *Supervisor) Run(
 		case <-refreshAuthBackoffTimer:
 			newTimer, err := s.reconnectCredentialManager.RefreshAuth(ctx, refreshAuthBackoff, s.authenticate)
 			if err != nil {
-				s.log.Err(err).Msg("supervisor: Authentication failed")
+				s.log.Logger().Err(err).Msg("supervisor: Authentication failed")
 				// Permanent failure. Leave the `select` without setting the
 				// channel to be non-null, so we'll never hit this case of the `select` again.
 				continue
@@ -195,7 +195,7 @@ func (s *Supervisor) initialize(
 ) error {
 	availableAddrs := s.edgeIPs.AvailableAddrs()
 	if s.config.HAConnections > availableAddrs {
-		s.log.Info().Msgf("You requested %d HA connections but I can give you at most %d.", s.config.HAConnections, availableAddrs)
+		s.log.Logger().Info().Msgf("You requested %d HA connections but I can give you at most %d.", s.config.HAConnections, availableAddrs)
 		s.config.HAConnections = availableAddrs
 	}
 
@@ -244,6 +244,7 @@ func (s *Supervisor) startFirstTunnel(
 		s.reconnectCredentialManager,
 		s.config,
 		addr,
+		s.log,
 		firstConnIndex,
 		connectedSignal,
 		s.cloudflaredUUID,
@@ -277,6 +278,7 @@ func (s *Supervisor) startFirstTunnel(
 			s.reconnectCredentialManager,
 			s.config,
 			addr,
+			s.log,
 			firstConnIndex,
 			connectedSignal,
 			s.cloudflaredUUID,
@@ -310,6 +312,7 @@ func (s *Supervisor) startTunnel(
 		s.reconnectCredentialManager,
 		s.config,
 		addr,
+		s.log,
 		uint8(index),
 		connectedSignal,
 		s.cloudflaredUUID,
@@ -373,7 +376,7 @@ func (s *Supervisor) authenticate(ctx context.Context, numPreviousAttempts int)
 	if err != nil {
 		return nil, err
 	}
-	rpcClient := connection.NewTunnelServerClient(ctx, stream, s.log)
+	rpcClient := connection.NewTunnelServerClient(ctx, stream, s.log.Logger())
 	defer rpcClient.Close()
 
 	const arbitraryConnectionID = uint8(0)

origin/tunnel.go

@@ -20,6 +20,7 @@ import (
 	"github.com/cloudflare/cloudflared/edgediscovery"
 	"github.com/cloudflare/cloudflared/edgediscovery/allregions"
 	"github.com/cloudflare/cloudflared/h2mux"
+	quicpogs "github.com/cloudflare/cloudflared/quic"
 	"github.com/cloudflare/cloudflared/retry"
 	"github.com/cloudflare/cloudflared/signal"
 	"github.com/cloudflare/cloudflared/tunnelrpc"
@@ -130,6 +131,7 @@ func ServeTunnelLoop(
 	credentialManager *reconnectCredentialManager,
 	config *TunnelConfig,
 	addr *allregions.EdgeAddr,
+	connAwareLogger *ConnAwareLogger,
 	connIndex uint8,
 	connectedSignal *signal.Signal,
 	cloudflaredUUID uuid.UUID,
@@ -139,7 +141,8 @@ func ServeTunnelLoop(
 	haConnections.Inc()
 	defer haConnections.Dec()
 
-	connLog := config.Log.With().Uint8(connection.LogFieldConnIndex, connIndex).Logger()
+	logger := config.Log.With().Uint8(connection.LogFieldConnIndex, connIndex).Logger()
+	connLog := connAwareLogger.ReplaceLogger(&logger)
 
 	protocolFallback := &protocolFallback{
 		retry.BackoffHandler{MaxRetries: config.Retries},
@@ -159,7 +162,7 @@ func ServeTunnelLoop(
 	for {
 		err, recoverable := ServeTunnel(
 			ctx,
-			&connLog,
+			connLog,
 			credentialManager,
 			config,
 			addr,
@@ -181,7 +184,7 @@ func ServeTunnelLoop(
 		if !ok {
 			return err
 		}
-		connLog.Info().Msgf("Retrying connection in up to %s seconds", duration)
+		connLog.Logger().Info().Msgf("Retrying connection in up to %s seconds", duration)
 
 		select {
 		case <-ctx.Done():
@@ -189,7 +192,13 @@ func ServeTunnelLoop(
 		case <-gracefulShutdownC:
 			return nil
 		case <-protocolFallback.BackoffTimer():
-			if !selectNextProtocol(&connLog, protocolFallback, config.ProtocolSelector) {
+			var idleTimeoutError *quic.IdleTimeoutError
+			if !selectNextProtocol(
+				connLog.Logger(),
+				protocolFallback,
+				config.ProtocolSelector,
+				errors.As(err, &idleTimeoutError),
+			) {
 				return err
 			}
 		}
@@ -221,8 +230,9 @@ func selectNextProtocol(
 	connLog *zerolog.Logger,
 	protocolBackoff *protocolFallback,
 	selector connection.ProtocolSelector,
+	isNetworkActivityTimeout bool,
 ) bool {
-	if protocolBackoff.ReachedMaxRetries() {
+	if protocolBackoff.ReachedMaxRetries() || isNetworkActivityTimeout {
 		fallback, hasFallback := selector.Fallback()
 		if !hasFallback {
 			return false
@@ -247,7 +257,7 @@ func selectNextProtocol(
 // on error returns a flag indicating if error can be retried
 func ServeTunnel(
 	ctx context.Context,
-	connLog *zerolog.Logger,
+	connLog *ConnAwareLogger,
 	credentialManager *reconnectCredentialManager,
 	config *TunnelConfig,
 	addr *allregions.EdgeAddr,
@@ -291,29 +301,29 @@ func ServeTunnel(
 	if err != nil {
 		switch err := err.(type) {
 		case connection.DupConnRegisterTunnelError:
-			connLog.Err(err).Msg("Unable to establish connection.")
+			connLog.ConnAwareLogger().Err(err).Msg("Unable to establish connection.")
 			// don't retry this connection anymore, let supervisor pick a new address
 			return err, false
 		case connection.ServerRegisterTunnelError:
-			connLog.Err(err).Msg("Register tunnel error from server side")
+			connLog.ConnAwareLogger().Err(err).Msg("Register tunnel error from server side")
 			// Don't send registration error return from server to Sentry. They are
 			// logged on server side
 			if incidents := config.IncidentLookup.ActiveIncidents(); len(incidents) > 0 {
-				connLog.Error().Msg(activeIncidentsMsg(incidents))
+				connLog.ConnAwareLogger().Msg(activeIncidentsMsg(incidents))
 			}
 			return err.Cause, !err.Permanent
 		case ReconnectSignal:
-			connLog.Info().
+			connLog.Logger().Info().
 				Uint8(connection.LogFieldConnIndex, connIndex).
 				Msgf("Restarting connection due to reconnect signal in %s", err.Delay)
 			err.DelayBeforeReconnect()
 			return err, true
 		default:
 			if err == context.Canceled {
-				connLog.Debug().Err(err).Msgf("Serve tunnel error")
+				connLog.Logger().Debug().Err(err).Msgf("Serve tunnel error")
 				return err, false
 			}
-			connLog.Err(err).Msgf("Serve tunnel error")
+			connLog.ConnAwareLogger().Err(err).Msgf("Serve tunnel error")
 			_, permanent := err.(unrecoverableError)
 			return err, !permanent
 		}
@@ -323,7 +333,7 @@ func ServeTunnel(
 
 func serveTunnel(
 	ctx context.Context,
-	connLog *zerolog.Logger,
+	connLog *ConnAwareLogger,
 	credentialManager *reconnectCredentialManager,
 	config *TunnelConfig,
 	addr *allregions.EdgeAddr,
@@ -356,15 +366,17 @@ func serveTunnel(
 		return ServeQUIC(ctx,
 			addr.UDP,
 			config,
+			connLog,
 			connOptions,
 			controlStream,
+			connIndex,
 			reconnectCh,
 			gracefulShutdownC)
 
 	case connection.HTTP2, connection.HTTP2Warp:
 		edgeConn, err := edgediscovery.DialEdge(ctx, dialTimeout, config.EdgeTLSConfigs[protocol], addr.TCP)
 		if err != nil {
-			connLog.Err(err).Msg("Unable to establish connection with Cloudflare edge")
+			connLog.ConnAwareLogger().Err(err).Msg("Unable to establish connection with Cloudflare edge")
 			return err, true
 		}
 
@@ -386,7 +398,7 @@ func serveTunnel(
 	default:
 		edgeConn, err := edgediscovery.DialEdge(ctx, dialTimeout, config.EdgeTLSConfigs[protocol], addr.TCP)
 		if err != nil {
-			connLog.Err(err).Msg("Unable to establish connection with Cloudflare edge")
+			connLog.ConnAwareLogger().Err(err).Msg("Unable to establish connection with Cloudflare edge")
 			return err, true
 		}
 
@@ -418,7 +430,7 @@ func (r unrecoverableError) Error() string {
 
 func ServeH2mux(
 	ctx context.Context,
-	connLog *zerolog.Logger,
+	connLog *ConnAwareLogger,
 	credentialManager *reconnectCredentialManager,
 	config *TunnelConfig,
 	edgeConn net.Conn,
@@ -428,7 +440,7 @@ func ServeH2mux(
 	reconnectCh chan ReconnectSignal,
 	gracefulShutdownC <-chan struct{},
 ) error {
-	connLog.Debug().Msgf("Connecting via h2mux")
+	connLog.Logger().Debug().Msgf("Connecting via h2mux")
 	// Returns error from parsing the origin URL or handshake errors
 	handler, err, recoverable := connection.NewH2muxConnection(
 		config.ConnectionConfig,
@@ -465,7 +477,7 @@ func ServeH2mux(
 
 func ServeHTTP2(
 	ctx context.Context,
-	connLog *zerolog.Logger,
+	connLog *ConnAwareLogger,
 	config *TunnelConfig,
 	tlsServerConn net.Conn,
 	connOptions *tunnelpogs.ConnectionOptions,
@@ -474,7 +486,7 @@ func ServeHTTP2(
 	gracefulShutdownC <-chan struct{},
 	reconnectCh chan ReconnectSignal,
 ) error {
-	connLog.Debug().Msgf("Connecting via http2")
+	connLog.Logger().Debug().Msgf("Connecting via http2")
 	h2conn := connection.NewHTTP2Connection(
 		tlsServerConn,
 		config.ConnectionConfig,
@@ -506,8 +518,10 @@ func ServeQUIC(
 	ctx context.Context,
 	edgeAddr *net.UDPAddr,
 	config *TunnelConfig,
+	connLogger *ConnAwareLogger,
 	connOptions *tunnelpogs.ConnectionOptions,
 	controlStreamHandler connection.ControlStreamHandler,
+	connIndex uint8,
 	reconnectCh chan ReconnectSignal,
 	gracefulShutdownC <-chan struct{},
 ) (err error, recoverable bool) {
@@ -518,6 +532,8 @@ func ServeQUIC(
 		MaxIncomingStreams:    connection.MaxConcurrentStreams,
 		MaxIncomingUniStreams: connection.MaxConcurrentStreams,
 		KeepAlive:             true,
+		EnableDatagrams:       true,
+		Tracer:                quicpogs.NewClientTracer(connLogger.Logger(), connIndex),
 	}
 	for {
 		select {
@@ -534,7 +550,7 @@ func ServeQUIC(
 				controlStreamHandler,
 				config.Observer)
 			if err != nil {
-				config.Log.Error().Msgf("Failed to create new quic connection, err: %v", err)
+				connLogger.ConnAwareLogger().Err(err).Msgf("Failed to create new quic connection")
 				return err, true
 			}
 
@@ -542,7 +558,7 @@ func ServeQUIC(
 			errGroup.Go(func() error {
 				err := quicConn.Serve(ctx)
 				if err != nil {
-					config.Log.Error().Msgf("Failed to serve quic connection, err: %v", err)
+					connLogger.ConnAwareLogger().Err(err).Msg("Failed to serve quic connection")
 				}
 				return fmt.Errorf("Connection with edge closed")
 			})
@@ -559,19 +575,6 @@ func ServeQUIC(
 	}
 }
 
-type quicLogger struct {
-	*zerolog.Logger
-}
-
-func (ql *quicLogger) Write(p []byte) (n int, err error) {
-	ql.Debug().Msgf("quic log: %v", string(p))
-	return len(p), nil
-}
-
-func (ql *quicLogger) Close() error {
-	return nil
-}
-
 func listenReconnect(ctx context.Context, reconnectCh <-chan ReconnectSignal, gracefulShutdownCh <-chan struct{}) error {
 	select {
 	case reconnect := <-reconnectCh:

origin/tunnel_test.go

@@ -62,7 +62,7 @@ func TestWaitForBackoffFallback(t *testing.T) {
 	// Retry #0 and #1. At retry #2, we switch protocol, so the fallback loop has one more retry than this
 	for i := 0; i < int(maxRetries-1); i++ {
 		protocolFallback.BackoffTimer() // simulate retry
-		ok := selectNextProtocol(&log, protocolFallback, protocolSelector)
+		ok := selectNextProtocol(&log, protocolFallback, protocolSelector, false)
 		assert.True(t, ok)
 		assert.Equal(t, initProtocol, protocolFallback.protocol)
 	}
@@ -70,7 +70,7 @@ func TestWaitForBackoffFallback(t *testing.T) {
 	// Retry fallback protocol
 	for i := 0; i < int(maxRetries); i++ {
 		protocolFallback.BackoffTimer() // simulate retry
-		ok := selectNextProtocol(&log, protocolFallback, protocolSelector)
+		ok := selectNextProtocol(&log, protocolFallback, protocolSelector, false)
 		assert.True(t, ok)
 		fallback, ok := protocolSelector.Fallback()
 		assert.True(t, ok)
@@ -82,12 +82,19 @@ func TestWaitForBackoffFallback(t *testing.T) {
 
 	// No protocol to fallback, return error
 	protocolFallback.BackoffTimer() // simulate retry
-	ok := selectNextProtocol(&log, protocolFallback, protocolSelector)
+	ok := selectNextProtocol(&log, protocolFallback, protocolSelector, false)
 	assert.False(t, ok)
 
 	protocolFallback.reset()
 	protocolFallback.BackoffTimer() // simulate retry
-	ok = selectNextProtocol(&log, protocolFallback, protocolSelector)
+	ok = selectNextProtocol(&log, protocolFallback, protocolSelector, false)
 	assert.True(t, ok)
 	assert.Equal(t, initProtocol, protocolFallback.protocol)
+
+	protocolFallback.reset()
+	protocolFallback.BackoffTimer() // simulate retry
+	ok = selectNextProtocol(&log, protocolFallback, protocolSelector, true)
+	// Check that we get a true after the first try itself when this flag is true. This allows us to immediately
+	// switch protocols.
+	assert.True(t, ok)
 }

quic/conversion.go

@@ -0,0 +1,99 @@
+package quic
+
+import (
+	"strconv"
+	"time"
+
+	"github.com/lucas-clemente/quic-go/logging"
+)
+
+func perspectiveString(p logging.Perspective) string {
+	switch p {
+	case logging.PerspectiveClient:
+		return "client"
+	case logging.PerspectiveServer:
+		return "server"
+	default:
+		return ""
+	}
+}
+
+// Helper to convert logging.ByteCount(alias for int64) to float64 used in prometheus
+func byteCountToPromCount(count logging.ByteCount) float64 {
+	return float64(count)
+}
+
+// Helper to convert Duration to float64 used in prometheus
+func durationToPromGauge(duration time.Duration) float64 {
+	return float64(duration.Milliseconds())
+}
+
+// Helper to convert https://pkg.go.dev/github.com/lucas-clemente/quic-go@v0.23.0/logging#PacketType into string
+func packetTypeString(pt logging.PacketType) string {
+	switch pt {
+	case logging.PacketTypeInitial:
+		return "initial"
+	case logging.PacketTypeHandshake:
+		return "handshake"
+	case logging.PacketTypeRetry:
+		return "retry"
+	case logging.PacketType0RTT:
+		return "0_rtt"
+	case logging.PacketTypeVersionNegotiation:
+		return "version_negotiation"
+	case logging.PacketType1RTT:
+		return "1_rtt"
+	case logging.PacketTypeStatelessReset:
+		return "stateless_reset"
+	case logging.PacketTypeNotDetermined:
+		return "undetermined"
+	default:
+		return "unknown_packet_type"
+	}
+}
+
+// Helper to convert https://pkg.go.dev/github.com/lucas-clemente/quic-go@v0.23.0/logging#PacketDropReason into string
+func packetDropReasonString(reason logging.PacketDropReason) string {
+	switch reason {
+	case logging.PacketDropKeyUnavailable:
+		return "key_unavailable"
+	case logging.PacketDropUnknownConnectionID:
+		return "unknown_conn_id"
+	case logging.PacketDropHeaderParseError:
+		return "header_parse_err"
+	case logging.PacketDropPayloadDecryptError:
+		return "payload_decrypt_err"
+	case logging.PacketDropProtocolViolation:
+		return "protocol_violation"
+	case logging.PacketDropDOSPrevention:
+		return "dos_prevention"
+	case logging.PacketDropUnsupportedVersion:
+		return "unsupported_version"
+	case logging.PacketDropUnexpectedPacket:
+		return "unexpected_packet"
+	case logging.PacketDropUnexpectedSourceConnectionID:
+		return "unexpected_src_conn_id"
+	case logging.PacketDropUnexpectedVersion:
+		return "unexpected_version"
+	case logging.PacketDropDuplicate:
+		return "duplicate"
+	default:
+		return "unknown_reason"
+	}
+}
+
+// Helper to convert https://pkg.go.dev/github.com/lucas-clemente/quic-go@v0.23.0/logging#PacketLossReason into string
+func packetLossReasonString(reason logging.PacketLossReason) string {
+	switch reason {
+	case logging.PacketLossReorderingThreshold:
+		return "reordering"
+	case logging.PacketLossTimeThreshold:
+		return "timeout"
+	default:
+		return "unknown_loss_reason"
+	}
+}
+
+func uint8ToString(input uint8) string {
+	return strconv.FormatUint(uint64(input), 10)
+}

quic/datagram.go

@@ -0,0 +1,88 @@
+package quic
+
+import (
+	"fmt"
+
+	"github.com/google/uuid"
+	"github.com/lucas-clemente/quic-go"
+	"github.com/pkg/errors"
+)
+
+const (
+	MaxDatagramFrameSize = 1220
+	sessionIDLen         = len(uuid.UUID{})
+)
+
+type DatagramMuxer struct {
+	ID      uuid.UUID
+	session quic.Session
+}
+
+func NewDatagramMuxer(quicSession quic.Session) (*DatagramMuxer, error) {
+	muxerID, err := uuid.NewRandom()
+	if err != nil {
+		return nil, err
+	}
+	return &DatagramMuxer{
+		ID:      muxerID,
+		session: quicSession,
+	}, nil
+}
+
+// SendTo suffix the session ID to the payload so the other end of the QUIC session can demultiplex
+// the payload from multiple datagram sessions
+func (dm *DatagramMuxer) SendTo(sessionID uuid.UUID, payload []byte) error {
+	if len(payload) > MaxDatagramFrameSize-sessionIDLen {
+		// TODO: TUN-5302 return ICMP packet too big message
+		return fmt.Errorf("origin UDP payload has %d bytes, which exceeds transport MTU %d", len(payload), MaxDatagramFrameSize-sessionIDLen)
+	}
+	msgWithID, err := SuffixSessionID(sessionID, payload)
+	if err != nil {
+		return errors.Wrap(err, "Failed to suffix session ID to datagram, it will be dropped")
+	}
+	if err := dm.session.SendMessage(msgWithID); err != nil {
+		return errors.Wrap(err, "Failed to send datagram back to edge")
+	}
+	return nil
+}
+
+// ReceiveFrom extracts datagram session ID, then sends the session ID and payload to session manager
+// which determines how to proxy to the origin. It assumes the datagram session has already been
+// registered with session manager through other side channel
+func (dm *DatagramMuxer) ReceiveFrom() (uuid.UUID, []byte, error) {
+	msg, err := dm.session.ReceiveMessage()
+	if err != nil {
+		return uuid.Nil, nil, err
+	}
+	return ExtractSessionID(msg)
+}
+
+func (dm *DatagramMuxer) MTU() uint {
+	return MaxDatagramFrameSize
+}
+
+// Each QUIC datagram should be suffixed with session ID.
+// ExtractSessionID extracts the session ID and a slice with only the payload
+func ExtractSessionID(b []byte) (uuid.UUID, []byte, error) {
+	msgLen := len(b)
+	if msgLen < sessionIDLen {
+		return uuid.Nil, nil, fmt.Errorf("session ID has %d bytes, but data only has %d", sessionIDLen, len(b))
+	}
+	// Parse last 16 bytess as UUID and remove it from slice
+	sessionID, err := uuid.FromBytes(b[len(b)-sessionIDLen:])
+	if err != nil {
+		return uuid.Nil, nil, err
+	}
+	b = b[:len(b)-sessionIDLen]
+	return sessionID, b, nil
+}
+
+// SuffixSessionID appends the session ID at the end of the payload. Suffix is more performant than prefix because
+// the payload slice might already have enough capacity to append the session ID at the end
+func SuffixSessionID(sessionID uuid.UUID, b []byte) ([]byte, error) {
+	if len(b)+len(sessionID) > MaxDatagramFrameSize {
+		return nil, fmt.Errorf("datagram size exceed %d", MaxDatagramFrameSize)
+	}
+	b = append(b, sessionID[:]...)
+	return b, nil
+}

quic/datagram_test.go

@@ -0,0 +1,41 @@
+package quic
+
+import (
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+)
+
+var (
+	testSessionID = uuid.New()
+)
+
+func TestSuffixThenRemoveSessionID(t *testing.T) {
+	msg := []byte(t.Name())
+	msgWithID, err := SuffixSessionID(testSessionID, msg)
+	require.NoError(t, err)
+	require.Len(t, msgWithID, len(msg)+sessionIDLen)
+
+	sessionID, msgWithoutID, err := ExtractSessionID(msgWithID)
+	require.NoError(t, err)
+	require.Equal(t, msg, msgWithoutID)
+	require.Equal(t, testSessionID, sessionID)
+}
+
+func TestRemoveSessionIDError(t *testing.T) {
+	// message is too short to contain session ID
+	msg := []byte("test")
+	_, _, err := ExtractSessionID(msg)
+	require.Error(t, err)
+}
+
+func TestSuffixSessionIDError(t *testing.T) {
+	msg := make([]byte, MaxDatagramFrameSize-sessionIDLen)
+	_, err := SuffixSessionID(testSessionID, msg)
+	require.NoError(t, err)
+
+	msg = make([]byte, MaxDatagramFrameSize-sessionIDLen+1)
+	_, err = SuffixSessionID(testSessionID, msg)
+	require.Error(t, err)
+}

quic/metrics.go

@@ -0,0 +1,373 @@
+package quic
+
+import (
+	"sync"
+
+	"github.com/lucas-clemente/quic-go/logging"
+	"github.com/prometheus/client_golang/prometheus"
+)
+
+const (
+	namespace = "quic"
+)
+
+var (
+	clientConnLabels = []string{"conn_index"}
+	clientMetrics    = struct {
+		totalConnections  prometheus.Counter
+		closedConnections *prometheus.CounterVec
+		sentPackets       *prometheus.CounterVec
+		sentBytes         *prometheus.CounterVec
+		receivePackets    *prometheus.CounterVec
+		receiveBytes      *prometheus.CounterVec
+		bufferedPackets   *prometheus.CounterVec
+		droppedPackets    *prometheus.CounterVec
+		lostPackets       *prometheus.CounterVec
+		minRTT            *prometheus.GaugeVec
+		latestRTT         *prometheus.GaugeVec
+		smoothedRTT       *prometheus.GaugeVec
+	}{
+		totalConnections: prometheus.NewCounter(
+			totalConnectionsOpts(logging.PerspectiveClient),
+		),
+		closedConnections: prometheus.NewCounterVec(
+			closedConnectionsOpts(logging.PerspectiveClient),
+			[]string{"error"},
+		),
+		sentPackets: prometheus.NewCounterVec(
+			sentPacketsOpts(logging.PerspectiveClient),
+			clientConnLabels,
+		),
+		sentBytes: prometheus.NewCounterVec(
+			sentBytesOpts(logging.PerspectiveClient),
+			clientConnLabels,
+		),
+		receivePackets: prometheus.NewCounterVec(
+			receivePacketsOpts(logging.PerspectiveClient),
+			clientConnLabels,
+		),
+		receiveBytes: prometheus.NewCounterVec(
+			receiveBytesOpts(logging.PerspectiveClient),
+			clientConnLabels,
+		),
+		bufferedPackets: prometheus.NewCounterVec(
+			bufferedPacketsOpts(logging.PerspectiveClient),
+			append(clientConnLabels, "packet_type"),
+		),
+		droppedPackets: prometheus.NewCounterVec(
+			droppedPacketsOpts(logging.PerspectiveClient),
+			append(clientConnLabels, "packet_type", "reason"),
+		),
+		lostPackets: prometheus.NewCounterVec(
+			lostPacketsOpts(logging.PerspectiveClient),
+			append(clientConnLabels, "reason"),
+		),
+		minRTT: prometheus.NewGaugeVec(
+			prometheus.GaugeOpts{
+				Namespace: namespace,
+				Subsystem: perspectiveString(logging.PerspectiveClient),
+				Name:      "min_rtt",
+				Help:      "Lowest RTT measured on a connection in millisec",
+			},
+			clientConnLabels,
+		),
+		latestRTT: prometheus.NewGaugeVec(
+			prometheus.GaugeOpts{
+				Namespace: namespace,
+				Subsystem: perspectiveString(logging.PerspectiveClient),
+				Name:      "latest_rtt",
+				Help:      "Latest RTT measured on a connection",
+			},
+			clientConnLabels,
+		),
+		smoothedRTT: prometheus.NewGaugeVec(
+			prometheus.GaugeOpts{
+				Namespace: namespace,
+				Subsystem: perspectiveString(logging.PerspectiveClient),
+				Name:      "smoothed_rtt",
+				Help:      "Calculated smoothed RTT measured on a connection in millisec",
+			},
+			clientConnLabels,
+		),
+	}
+	// The server has many QUIC connections. Adding per connection label incurs high memory cost
+	serverMetrics = struct {
+		totalConnections  prometheus.Counter
+		closedConnections prometheus.Counter
+		sentPackets       prometheus.Counter
+		sentBytes         prometheus.Counter
+		receivePackets    prometheus.Counter
+		receiveBytes      prometheus.Counter
+		bufferedPackets   *prometheus.CounterVec
+		droppedPackets    *prometheus.CounterVec
+		lostPackets       *prometheus.CounterVec
+		rtt               prometheus.Histogram
+	}{
+		totalConnections: prometheus.NewCounter(
+			totalConnectionsOpts(logging.PerspectiveServer),
+		),
+		closedConnections: prometheus.NewCounter(
+			closedConnectionsOpts(logging.PerspectiveServer),
+		),
+		sentPackets: prometheus.NewCounter(
+			sentPacketsOpts(logging.PerspectiveServer),
+		),
+		sentBytes: prometheus.NewCounter(
+			sentBytesOpts(logging.PerspectiveServer),
+		),
+		receivePackets: prometheus.NewCounter(
+			receivePacketsOpts(logging.PerspectiveServer),
+		),
+		receiveBytes: prometheus.NewCounter(
+			receiveBytesOpts(logging.PerspectiveServer),
+		),
+		bufferedPackets: prometheus.NewCounterVec(
+			bufferedPacketsOpts(logging.PerspectiveServer),
+			[]string{"packet_type"},
+		),
+		droppedPackets: prometheus.NewCounterVec(
+			droppedPacketsOpts(logging.PerspectiveServer),
+			[]string{"packet_type", "reason"},
+		),
+		lostPackets: prometheus.NewCounterVec(
+			lostPacketsOpts(logging.PerspectiveServer),
+			[]string{"reason"},
+		),
+		rtt: prometheus.NewHistogram(
+			prometheus.HistogramOpts{
+				Namespace: namespace,
+				Subsystem: perspectiveString(logging.PerspectiveServer),
+				Name:      "rtt",
+				Buckets:   []float64{5, 10, 20, 30, 40, 50, 75, 100},
+			},
+		),
+	}
+	registerClient = sync.Once{}
+	registerServer = sync.Once{}
+)
+
+// MetricsCollector abstracts the difference between client and server metrics from connTracer
+type MetricsCollector interface {
+	startedConnection()
+	closedConnection(err error)
+	sentPackets(logging.ByteCount)
+	receivedPackets(logging.ByteCount)
+	bufferedPackets(logging.PacketType)
+	droppedPackets(logging.PacketType, logging.ByteCount, logging.PacketDropReason)
+	lostPackets(logging.PacketLossReason)
+	updatedRTT(*logging.RTTStats)
+}
+
+func totalConnectionsOpts(p logging.Perspective) prometheus.CounterOpts {
+	var help string
+	if p == logging.PerspectiveClient {
+		help = "Number of connections initiated. For all quic metrics, client means the side initiating the connection"
+	} else {
+		help = "Number of connections accepted. For all quic metrics, server means the side accepting connections"
+	}
+	return prometheus.CounterOpts{
+		Namespace: namespace,
+		Subsystem: perspectiveString(p),
+		Name:      "total_connections",
+		Help:      help,
+	}
+}
+
+func closedConnectionsOpts(p logging.Perspective) prometheus.CounterOpts {
+	return prometheus.CounterOpts{
+		Namespace: namespace,
+		Subsystem: perspectiveString(p),
+		Name:      "closed_connections",
+		Help:      "Number of connections that has been closed",
+	}
+}
+
+func sentPacketsOpts(p logging.Perspective) prometheus.CounterOpts {
+	return prometheus.CounterOpts{
+		Namespace: namespace,
+		Subsystem: perspectiveString(p),
+		Name:      "sent_packets",
+		Help:      "Number of packets that have been sent through a connection",
+	}
+}
+
+func sentBytesOpts(p logging.Perspective) prometheus.CounterOpts {
+	return prometheus.CounterOpts{
+		Namespace: namespace,
+		Subsystem: perspectiveString(p),
+		Name:      "sent_bytes",
+		Help:      "Number of bytes that have been sent through a connection",
+	}
+}
+
+func receivePacketsOpts(p logging.Perspective) prometheus.CounterOpts {
+	return prometheus.CounterOpts{
+		Namespace: namespace,
+		Subsystem: perspectiveString(p),
+		Name:      "receive_packets",
+		Help:      "Number of packets that have been received through a connection",
+	}
+}
+
+func receiveBytesOpts(p logging.Perspective) prometheus.CounterOpts {
+	return prometheus.CounterOpts{
+		Namespace: namespace,
+		Subsystem: perspectiveString(p),
+		Name:      "receive_bytes",
+		Help:      "Number of bytes that have been received through a connection",
+	}
+}
+
+func bufferedPacketsOpts(p logging.Perspective) prometheus.CounterOpts {
+	return prometheus.CounterOpts{
+		Namespace: namespace,
+		Subsystem: perspectiveString(p),
+		Name:      "buffered_packets",
+		Help:      "Number of bytes that have been buffered on a connection",
+	}
+}
+
+func droppedPacketsOpts(p logging.Perspective) prometheus.CounterOpts {
+	return prometheus.CounterOpts{
+		Namespace: namespace,
+		Subsystem: perspectiveString(p),
+		Name:      "dropped_packets",
+		Help:      "Number of bytes that have been dropped on a connection",
+	}
+}
+
+func lostPacketsOpts(p logging.Perspective) prometheus.CounterOpts {
+	return prometheus.CounterOpts{
+		Namespace: namespace,
+		Subsystem: perspectiveString(p),
+		Name:      "lost_packets",
+		Help:      "Number of packets that have been lost from a connection",
+	}
+}
+
+type clientCollector struct {
+	index string
+}
+
+func newClientCollector(index uint8) MetricsCollector {
+	registerClient.Do(func() {
+		prometheus.MustRegister(
+			clientMetrics.totalConnections,
+			clientMetrics.closedConnections,
+			clientMetrics.sentPackets,
+			clientMetrics.sentBytes,
+			clientMetrics.receivePackets,
+			clientMetrics.receiveBytes,
+			clientMetrics.bufferedPackets,
+			clientMetrics.droppedPackets,
+			clientMetrics.lostPackets,
+			clientMetrics.minRTT,
+			clientMetrics.latestRTT,
+			clientMetrics.smoothedRTT,
+		)
+	})
+	return &clientCollector{
+		index: uint8ToString(index),
+	}
+}
+
+func (cc *clientCollector) startedConnection() {
+	clientMetrics.totalConnections.Inc()
+}
+
+func (cc *clientCollector) closedConnection(err error) {
+	clientMetrics.closedConnections.WithLabelValues(err.Error()).Inc()
+}
+
+func (cc *clientCollector) sentPackets(size logging.ByteCount) {
+	clientMetrics.sentPackets.WithLabelValues(cc.index).Inc()
+	clientMetrics.sentBytes.WithLabelValues(cc.index).Add(byteCountToPromCount(size))
+}
+
+func (cc *clientCollector) receivedPackets(size logging.ByteCount) {
+	clientMetrics.receivePackets.WithLabelValues(cc.index).Inc()
+	clientMetrics.receiveBytes.WithLabelValues(cc.index).Add(byteCountToPromCount(size))
+}
+
+func (cc *clientCollector) bufferedPackets(packetType logging.PacketType) {
+	clientMetrics.bufferedPackets.WithLabelValues(cc.index, packetTypeString(packetType)).Inc()
+}
+
+func (cc *clientCollector) droppedPackets(packetType logging.PacketType, size logging.ByteCount, reason logging.PacketDropReason) {
+	clientMetrics.droppedPackets.WithLabelValues(
+		cc.index,
+		packetTypeString(packetType),
+		packetDropReasonString(reason),
+	).Add(byteCountToPromCount(size))
+}
+
+func (cc *clientCollector) lostPackets(reason logging.PacketLossReason) {
+	clientMetrics.lostPackets.WithLabelValues(cc.index, packetLossReasonString(reason)).Inc()
+}
+
+func (cc *clientCollector) updatedRTT(rtt *logging.RTTStats) {
+	clientMetrics.minRTT.WithLabelValues(cc.index).Set(durationToPromGauge(rtt.MinRTT()))
+	clientMetrics.latestRTT.WithLabelValues(cc.index).Set(durationToPromGauge(rtt.LatestRTT()))
+	clientMetrics.smoothedRTT.WithLabelValues(cc.index).Set(durationToPromGauge(rtt.SmoothedRTT()))
+}
+
+type serverCollector struct{}
+
+func newServiceCollector() MetricsCollector {
+	registerServer.Do(func() {
+		prometheus.MustRegister(
+			serverMetrics.totalConnections,
+			serverMetrics.closedConnections,
+			serverMetrics.sentPackets,
+			serverMetrics.sentBytes,
+			serverMetrics.receivePackets,
+			serverMetrics.receiveBytes,
+			serverMetrics.bufferedPackets,
+			serverMetrics.droppedPackets,
+			serverMetrics.lostPackets,
+			serverMetrics.rtt,
+		)
+	})
+	return &serverCollector{}
+}
+
+func (sc *serverCollector) startedConnection() {
+	serverMetrics.totalConnections.Inc()
+}
+
+func (sc *serverCollector) closedConnection(err error) {
+	serverMetrics.closedConnections.Inc()
+}
+
+func (sc *serverCollector) sentPackets(size logging.ByteCount) {
+	serverMetrics.sentPackets.Inc()
+	serverMetrics.sentBytes.Add(byteCountToPromCount(size))
+}
+
+func (sc *serverCollector) receivedPackets(size logging.ByteCount) {
+	serverMetrics.receivePackets.Inc()
+	serverMetrics.receiveBytes.Add(byteCountToPromCount(size))
+}
+
+func (sc *serverCollector) bufferedPackets(packetType logging.PacketType) {
+	serverMetrics.bufferedPackets.WithLabelValues(packetTypeString(packetType)).Inc()
+}
+
+func (sc *serverCollector) droppedPackets(packetType logging.PacketType, size logging.ByteCount, reason logging.PacketDropReason) {
+	serverMetrics.droppedPackets.WithLabelValues(
+		packetTypeString(packetType),
+		packetDropReasonString(reason),
+	).Add(byteCountToPromCount(size))
+}
+
+func (sc *serverCollector) lostPackets(reason logging.PacketLossReason) {
+	serverMetrics.lostPackets.WithLabelValues(packetLossReasonString(reason)).Inc()
+}
+
+func (sc *serverCollector) updatedRTT(rtt *logging.RTTStats) {
+	latestRTT := rtt.LatestRTT()
+	// May return 0 if no valid updates have occurred
+	if latestRTT > 0 {
+		serverMetrics.rtt.Observe(durationToPromGauge(latestRTT))
+	}
+}

quic/quic_protocol.go

@@ -1,16 +1,33 @@
 package quic
 
 import (
-	"bytes"
+	"context"
 	"fmt"
 	"io"
+	"net"
+	"time"
 
 	capnp "zombiezen.com/go/capnproto2"
+	"zombiezen.com/go/capnproto2/rpc"
+
+	"github.com/google/uuid"
+	"github.com/rs/zerolog"
+
+	"github.com/cloudflare/cloudflared/tunnelrpc"
+	tunnelpogs "github.com/cloudflare/cloudflared/tunnelrpc/pogs"
 )
 
-// protocolSignature is a custom protocol signature to ensure that whoever performs a handshake does not write data
-// before writing the metadata.
-var protocolSignature = []byte{0x0A, 0x36, 0xCD, 0x12, 0xA1, 0x3E}
+// The first 6 bytes of the stream is used to distinguish the type of stream. It ensures whoever performs a handshake does
+// not write data before writing the metadata.
+type ProtocolSignature [6]byte
+
+var (
+	// DataStreamProtocolSignature is a custom protocol signature for data stream
+	DataStreamProtocolSignature = ProtocolSignature{0x0A, 0x36, 0xCD, 0x12, 0xA1, 0x3E}
+
+	// RPCStreamProtocolSignature is a custom protocol signature for RPC stream
+	RPCStreamProtocolSignature = ProtocolSignature{0x52, 0xBB, 0x82, 0x5C, 0xDB, 0x65}
+)
 
 const protocolVersionLength = 2
 
@@ -20,18 +37,26 @@ const (
 	protocolV1 protocolVersion = "01"
 )
 
+// RequestServerStream is a stream to serve requests
+type RequestServerStream struct {
+	io.ReadWriteCloser
+}
+
+func NewRequestServerStream(stream io.ReadWriteCloser, signature ProtocolSignature) (*RequestServerStream, error) {
+	if signature != DataStreamProtocolSignature {
+		return nil, fmt.Errorf("RequestClientStream can only be created from data stream")
+	}
+	return &RequestServerStream{stream}, nil
+}
+
 // ReadConnectRequestData reads the handshake data from a QUIC stream.
-func ReadConnectRequestData(stream io.Reader) (*ConnectRequest, error) {
-	if err := verifySignature(stream); err != nil {
-		return nil, err
-	}
-
+func (rss *RequestServerStream) ReadConnectRequestData() (*ConnectRequest, error) {
 	// This is a NO-OP for now. We could cause a branching if we wanted to use multiple versions.
-	if _, err := readVersion(stream); err != nil {
+	if _, err := readVersion(rss); err != nil {
 		return nil, err
 	}
 
-	msg, err := capnp.NewDecoder(stream).Decode()
+	msg, err := capnp.NewDecoder(rss).Decode()
 	if err != nil {
 		return nil, err
 	}
@@ -43,50 +68,8 @@ func ReadConnectRequestData(stream io.Reader) (*ConnectRequest, error) {
 	return r, nil
 }
 
-// WriteConnectRequestData writes requestMeta to a stream.
-func WriteConnectRequestData(stream io.Writer, dest string, connectionType ConnectionType, metadata ...Metadata) error {
-	connectRequest := &ConnectRequest{
-		Dest:     dest,
-		Type:     connectionType,
-		Metadata: metadata,
-	}
-
-	msg, err := connectRequest.toPogs()
-	if err != nil {
-		return err
-	}
-
-	if err := writePreamble(stream); err != nil {
-		return err
-	}
-	return capnp.NewEncoder(stream).Encode(msg)
-}
-
-// ReadConnectResponseData reads the response to a RequestMeta in a stream.
-func ReadConnectResponseData(stream io.Reader) (*ConnectResponse, error) {
-	if err := verifySignature(stream); err != nil {
-		return nil, err
-	}
-
-	// This is a NO-OP for now. We could cause a branching if we wanted to use multiple versions.
-	if _, err := readVersion(stream); err != nil {
-		return nil, err
-	}
-
-	msg, err := capnp.NewDecoder(stream).Decode()
-	if err != nil {
-		return nil, err
-	}
-
-	r := &ConnectResponse{}
-	if err := r.fromPogs(msg); err != nil {
-		return nil, err
-	}
-	return r, nil
-}
-
 // WriteConnectResponseData writes response to a QUIC stream.
-func WriteConnectResponseData(stream io.Writer, respErr error, metadata ...Metadata) error {
+func (rss *RequestServerStream) WriteConnectResponseData(respErr error, metadata ...Metadata) error {
 	var connectResponse *ConnectResponse
 	if respErr != nil {
 		connectResponse = &ConnectResponse{
@@ -103,14 +86,105 @@ func WriteConnectResponseData(stream io.Writer, respErr error, metadata ...Metad
 		return err
 	}
 
-	if err := writePreamble(stream); err != nil {
+	if err := writeDataStreamPreamble(rss); err != nil {
 		return err
 	}
-	return capnp.NewEncoder(stream).Encode(msg)
+	return capnp.NewEncoder(rss).Encode(msg)
 }
 
-func writePreamble(stream io.Writer) error {
-	if err := writeSignature(stream); err != nil {
+type RequestClientStream struct {
+	io.ReadWriteCloser
+}
+
+// WriteConnectRequestData writes requestMeta to a stream.
+func (rcs *RequestClientStream) WriteConnectRequestData(dest string, connectionType ConnectionType, metadata ...Metadata) error {
+	connectRequest := &ConnectRequest{
+		Dest:     dest,
+		Type:     connectionType,
+		Metadata: metadata,
+	}
+
+	msg, err := connectRequest.toPogs()
+	if err != nil {
+		return err
+	}
+
+	if err := writeDataStreamPreamble(rcs); err != nil {
+		return err
+	}
+	return capnp.NewEncoder(rcs).Encode(msg)
+}
+
+// ReadConnectResponseData reads the response to a RequestMeta in a stream.
+func (rcs *RequestClientStream) ReadConnectResponseData() (*ConnectResponse, error) {
+	signature, err := DetermineProtocol(rcs)
+	if err != nil {
+		return nil, err
+	}
+	if signature != DataStreamProtocolSignature {
+		return nil, fmt.Errorf("Wrong protocol signature %v", signature)
+	}
+
+	// This is a NO-OP for now. We could cause a branching if we wanted to use multiple versions.
+	if _, err := readVersion(rcs); err != nil {
+		return nil, err
+	}
+
+	msg, err := capnp.NewDecoder(rcs).Decode()
+	if err != nil {
+		return nil, err
+	}
+
+	r := &ConnectResponse{}
+	if err := r.fromPogs(msg); err != nil {
+		return nil, err
+	}
+	return r, nil
+}
+
+// RPCServerStream is a stream to serve RPCs. It is closed when the RPC client is done
+type RPCServerStream struct {
+	io.ReadWriteCloser
+}
+
+func NewRPCServerStream(stream io.ReadWriteCloser, protocol ProtocolSignature) (*RPCServerStream, error) {
+	if protocol != RPCStreamProtocolSignature {
+		return nil, fmt.Errorf("RPCStream can only be created from rpc stream")
+	}
+	return &RPCServerStream{stream}, nil
+}
+
+func (s *RPCServerStream) Serve(sessionManager tunnelpogs.SessionManager, logger *zerolog.Logger) error {
+	rpcTransport := tunnelrpc.NewTransportLogger(logger, rpc.StreamTransport(s))
+	defer rpcTransport.Close()
+
+	main := tunnelpogs.SessionManager_ServerToClient(sessionManager)
+	rpcConn := rpc.NewConn(
+		rpcTransport,
+		rpc.MainInterface(main.Client),
+	)
+	defer rpcConn.Close()
+
+	return rpcConn.Wait()
+}
+
+func DetermineProtocol(stream io.Reader) (ProtocolSignature, error) {
+	signature, err := readSignature(stream)
+	if err != nil {
+		return ProtocolSignature{}, err
+	}
+	switch signature {
+	case DataStreamProtocolSignature:
+		return DataStreamProtocolSignature, nil
+	case RPCStreamProtocolSignature:
+		return RPCStreamProtocolSignature, nil
+	default:
+		return ProtocolSignature{}, fmt.Errorf("Unknown signature %v", signature)
+	}
+}
+
+func writeDataStreamPreamble(stream io.Writer) error {
+	if err := writeSignature(stream, DataStreamProtocolSignature); err != nil {
 		return err
 	}
 
@@ -128,20 +202,57 @@ func readVersion(stream io.Reader) (string, error) {
 	return string(version), err
 }
 
-func writeSignature(stream io.Writer) error {
-	_, err := stream.Write(protocolSignature)
+func readSignature(stream io.Reader) (ProtocolSignature, error) {
+	var signature ProtocolSignature
+	if _, err := io.ReadFull(stream, signature[:]); err != nil {
+		return ProtocolSignature{}, err
+	}
+	return signature, nil
+}
+
+func writeSignature(stream io.Writer, signature ProtocolSignature) error {
+	_, err := stream.Write(signature[:])
 	return err
 }
 
-func verifySignature(stream io.Reader) error {
-	signature := make([]byte, len(protocolSignature))
-	if _, err := io.ReadFull(stream, signature); err != nil {
+// RPCClientStream is a stream to call methods of SessionManager
+type RPCClientStream struct {
+	client    tunnelpogs.SessionManager_PogsClient
+	transport rpc.Transport
+}
+
+func NewRPCClientStream(ctx context.Context, stream io.ReadWriteCloser, logger *zerolog.Logger) (*RPCClientStream, error) {
+	n, err := stream.Write(RPCStreamProtocolSignature[:])
+	if err != nil {
+		return nil, err
+	}
+	if n != len(RPCStreamProtocolSignature) {
+		return nil, fmt.Errorf("expect to write %d bytes for RPC stream protocol signature, wrote %d", len(RPCStreamProtocolSignature), n)
+	}
+	transport := tunnelrpc.NewTransportLogger(logger, rpc.StreamTransport(stream))
+	conn := rpc.NewConn(
+		transport,
+		tunnelrpc.ConnLog(logger),
+	)
+	return &RPCClientStream{
+		client:    tunnelpogs.SessionManager_PogsClient{Client: conn.Bootstrap(ctx), Conn: conn},
+		transport: transport,
+	}, nil
+}
+
+func (rcs *RPCClientStream) RegisterUdpSession(ctx context.Context, sessionID uuid.UUID, dstIP net.IP, dstPort uint16, closeIdleAfterHint time.Duration) error {
+	resp, err := rcs.client.RegisterUdpSession(ctx, sessionID, dstIP, dstPort, closeIdleAfterHint)
+	if err != nil {
 		return err
 	}
-
-	if !bytes.Equal(signature[0:], protocolSignature) {
-		return fmt.Errorf("Wrong signature: %v", signature)
-	}
-
-	return nil
+	return resp.Err
+}
+
+func (rcs *RPCClientStream) UnregisterUdpSession(ctx context.Context, sessionID uuid.UUID) error {
+	return rcs.client.UnregisterUdpSession(ctx, sessionID)
+}
+
+func (rcs *RPCClientStream) Close() {
+	_ = rcs.client.Close()
+	_ = rcs.transport.Close()
 }

quic/quic_protocol_test.go

@@ -2,13 +2,24 @@ package quic
 
 import (
 	"bytes"
+	"context"
 	"errors"
+	"fmt"
+	"io"
+	"net"
 	"testing"
+	"time"
 
+	"github.com/google/uuid"
+	"github.com/rs/zerolog"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
+const (
+	testCloseIdleAfterHint = time.Minute * 2
+)
+
 func TestConnectRequestData(t *testing.T) {
 	var tests = []struct {
 		name           string
@@ -21,7 +32,7 @@ func TestConnectRequestData(t *testing.T) {
 			hostname:       "tunnel.com",
 			connectionType: ConnectionTypeHTTP,
 			metadata: []Metadata{
-				Metadata{
+				{
 					Key: "key",
 					Val: "1234",
 				},
@@ -31,9 +42,15 @@ func TestConnectRequestData(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			b := &bytes.Buffer{}
-			err := WriteConnectRequestData(b, test.hostname, test.connectionType, test.metadata...)
+			reqClientStream := RequestClientStream{noopCloser{b}}
+			err := reqClientStream.WriteConnectRequestData(test.hostname, test.connectionType, test.metadata...)
 			require.NoError(t, err)
-			reqMeta, err := ReadConnectRequestData(b)
+			protocol, err := DetermineProtocol(b)
+			require.NoError(t, err)
+			reqServerStream, err := NewRequestServerStream(noopCloser{b}, protocol)
+			require.NoError(t, err)
+
+			reqMeta, err := reqServerStream.ReadConnectRequestData()
 			require.NoError(t, err)
 
 			assert.Equal(t, test.metadata, reqMeta.Metadata)
@@ -52,7 +69,7 @@ func TestConnectResponseMeta(t *testing.T) {
 		{
 			name: "Signature verified and response metadata is unmarshaled and read correctly",
 			metadata: []Metadata{
-				Metadata{
+				{
 					Key: "key",
 					Val: "1234",
 				},
@@ -62,7 +79,7 @@ func TestConnectResponseMeta(t *testing.T) {
 			name: "If error is not empty, other fields should be blank",
 			err:  errors.New("something happened"),
 			metadata: []Metadata{
-				Metadata{
+				{
 					Key: "key",
 					Val: "1234",
 				},
@@ -73,9 +90,12 @@ func TestConnectResponseMeta(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			b := &bytes.Buffer{}
-			err := WriteConnectResponseData(b, test.err, test.metadata...)
+			reqServerStream := RequestServerStream{noopCloser{b}}
+			err := reqServerStream.WriteConnectResponseData(test.err, test.metadata...)
 			require.NoError(t, err)
-			respMeta, err := ReadConnectResponseData(b)
+
+			reqClientStream := RequestClientStream{noopCloser{b}}
+			respMeta, err := reqClientStream.ReadConnectResponseData()
 			require.NoError(t, err)
 
 			if respMeta.Error == "" {
@@ -86,3 +106,96 @@ func TestConnectResponseMeta(t *testing.T) {
 		})
 	}
 }
+
+func TestRegisterUdpSession(t *testing.T) {
+	clientReader, serverWriter := io.Pipe()
+	serverReader, clientWriter := io.Pipe()
+
+	clientStream := mockRPCStream{clientReader, clientWriter}
+	serverStream := mockRPCStream{serverReader, serverWriter}
+
+	rpcServer := mockRPCServer{
+		sessionID:      uuid.New(),
+		dstIP:          net.IP{172, 16, 0, 1},
+		dstPort:        8000,
+		closeIdleAfter: testCloseIdleAfterHint,
+	}
+	logger := zerolog.Nop()
+	sessionRegisteredChan := make(chan struct{})
+	go func() {
+		protocol, err := DetermineProtocol(serverStream)
+		assert.NoError(t, err)
+		rpcServerStream, err := NewRPCServerStream(serverStream, protocol)
+		assert.NoError(t, err)
+		err = rpcServerStream.Serve(rpcServer, &logger)
+		assert.NoError(t, err)
+
+		serverStream.Close()
+		close(sessionRegisteredChan)
+	}()
+
+	rpcClientStream, err := NewRPCClientStream(context.Background(), clientStream, &logger)
+	assert.NoError(t, err)
+
+	assert.NoError(t, rpcClientStream.RegisterUdpSession(context.Background(), rpcServer.sessionID, rpcServer.dstIP, rpcServer.dstPort, testCloseIdleAfterHint))
+
+	// Different sessionID, the RPC server should reject the registraion
+	assert.Error(t, rpcClientStream.RegisterUdpSession(context.Background(), uuid.New(), rpcServer.dstIP, rpcServer.dstPort, testCloseIdleAfterHint))
+
+	assert.NoError(t, rpcClientStream.UnregisterUdpSession(context.Background(), rpcServer.sessionID))
+
+	// Different sessionID, the RPC server should reject the unregistraion
+	assert.Error(t, rpcClientStream.UnregisterUdpSession(context.Background(), uuid.New()))
+
+	rpcClientStream.Close()
+	<-sessionRegisteredChan
+}
+
+type mockRPCServer struct {
+	sessionID      uuid.UUID
+	dstIP          net.IP
+	dstPort        uint16
+	closeIdleAfter time.Duration
+}
+
+func (s mockRPCServer) RegisterUdpSession(ctx context.Context, sessionID uuid.UUID, dstIP net.IP, dstPort uint16, closeIdleAfter time.Duration) error {
+	if s.sessionID != sessionID {
+		return fmt.Errorf("expect session ID %s, got %s", s.sessionID, sessionID)
+	}
+	if !s.dstIP.Equal(dstIP) {
+		return fmt.Errorf("expect destination IP %s, got %s", s.dstIP, dstIP)
+	}
+	if s.dstPort != dstPort {
+		return fmt.Errorf("expect destination port %d, got %d", s.dstPort, dstPort)
+	}
+	if s.closeIdleAfter != closeIdleAfter {
+		return fmt.Errorf("expect closeIdleAfter %d, got %d", s.closeIdleAfter, closeIdleAfter)
+	}
+	return nil
+}
+
+func (s mockRPCServer) UnregisterUdpSession(ctx context.Context, sessionID uuid.UUID) error {
+	if s.sessionID != sessionID {
+		return fmt.Errorf("expect session ID %s, got %s", s.sessionID, sessionID)
+	}
+	return nil
+}
+
+type mockRPCStream struct {
+	io.ReadCloser
+	io.WriteCloser
+}
+
+func (s mockRPCStream) Close() error {
+	_ = s.ReadCloser.Close()
+	_ = s.WriteCloser.Close()
+	return nil
+}
+
+type noopCloser struct {
+	io.ReadWriter
+}
+
+func (noopCloser) Close() error {
+	return nil
+}

quic/tracing.go

@@ -0,0 +1,126 @@
+package quic
+
+import (
+	"context"
+	"net"
+
+	"github.com/lucas-clemente/quic-go/logging"
+	"github.com/lucas-clemente/quic-go/qlog"
+	"github.com/rs/zerolog"
+)
+
+// QUICTracer is a wrapper to create new quicConnTracer
+type tracer struct {
+	logger *zerolog.Logger
+	config *tracerConfig
+}
+
+type tracerConfig struct {
+	isClient bool
+	// Only client has an index
+	index uint8
+}
+
+func NewClientTracer(logger *zerolog.Logger, index uint8) logging.Tracer {
+	return &tracer{
+		logger: logger,
+		config: &tracerConfig{
+			isClient: true,
+			index:    index,
+		},
+	}
+}
+
+func NewServerTracer(logger *zerolog.Logger) logging.Tracer {
+	return &tracer{
+		logger: logger,
+		config: &tracerConfig{
+			isClient: false,
+		},
+	}
+}
+
+func (t *tracer) TracerForConnection(_ context.Context, p logging.Perspective, odcid logging.ConnectionID) logging.ConnectionTracer {
+	connID := logging.ConnectionID(odcid).String()
+	ql := &quicLogger{
+		logger:       t.logger,
+		connectionID: connID,
+	}
+	if t.config.isClient {
+		return newConnTracer(ql, p, odcid, newClientCollector(t.config.index))
+	}
+	return newConnTracer(ql, p, odcid, newServiceCollector())
+}
+
+func (*tracer) SentPacket(net.Addr, *logging.Header, logging.ByteCount, []logging.Frame) {}
+func (*tracer) DroppedPacket(net.Addr, logging.PacketType, logging.ByteCount, logging.PacketDropReason) {
+}
+
+// connTracer is a wrapper around https://pkg.go.dev/github.com/lucas-clemente/quic-go@v0.23.0/qlog#NewConnectionTracer to collect metrics
+type connTracer struct {
+	logging.ConnectionTracer
+	metricsCollector MetricsCollector
+	connectionID     string
+}
+
+func newConnTracer(ql *quicLogger, p logging.Perspective, odcid logging.ConnectionID, metricsCollector MetricsCollector) logging.ConnectionTracer {
+	return &connTracer{
+		qlog.NewConnectionTracer(ql, p, odcid),
+		metricsCollector,
+		logging.ConnectionID(odcid).String(),
+	}
+}
+
+func (ct *connTracer) StartedConnection(local, remote net.Addr, srcConnID, destConnID logging.ConnectionID) {
+	ct.metricsCollector.startedConnection()
+	ct.ConnectionTracer.StartedConnection(local, remote, srcConnID, destConnID)
+}
+
+func (ct *connTracer) ClosedConnection(err error) {
+	ct.metricsCollector.closedConnection(err)
+	ct.ConnectionTracer.ClosedConnection(err)
+}
+
+func (ct *connTracer) SentPacket(hdr *logging.ExtendedHeader, packetSize logging.ByteCount, ack *logging.AckFrame, frames []logging.Frame) {
+	ct.metricsCollector.sentPackets(packetSize)
+	ct.ConnectionTracer.SentPacket(hdr, packetSize, ack, frames)
+}
+
+func (ct *connTracer) ReceivedPacket(hdr *logging.ExtendedHeader, size logging.ByteCount, frames []logging.Frame) {
+	ct.metricsCollector.receivedPackets(size)
+	ct.ConnectionTracer.ReceivedPacket(hdr, size, frames)
+}
+
+func (ct *connTracer) BufferedPacket(pt logging.PacketType) {
+	ct.metricsCollector.bufferedPackets(pt)
+	ct.ConnectionTracer.BufferedPacket(pt)
+}
+
+func (ct *connTracer) DroppedPacket(pt logging.PacketType, size logging.ByteCount, reason logging.PacketDropReason) {
+	ct.metricsCollector.droppedPackets(pt, size, reason)
+	ct.ConnectionTracer.DroppedPacket(pt, size, reason)
+}
+
+func (ct *connTracer) LostPacket(level logging.EncryptionLevel, number logging.PacketNumber, reason logging.PacketLossReason) {
+	ct.metricsCollector.lostPackets(reason)
+	ct.ConnectionTracer.LostPacket(level, number, reason)
+}
+
+func (ct *connTracer) UpdatedMetrics(rttStats *logging.RTTStats, cwnd, bytesInFlight logging.ByteCount, packetsInFlight int) {
+	ct.metricsCollector.updatedRTT(rttStats)
+	ct.ConnectionTracer.UpdatedMetrics(rttStats, cwnd, bytesInFlight, packetsInFlight)
+}
+
+type quicLogger struct {
+	logger       *zerolog.Logger
+	connectionID string
+}
+
+func (qt *quicLogger) Write(p []byte) (n int, err error) {
+	qt.logger.Trace().Str("quicConnection", qt.connectionID).RawJSON("event", p).Msg("Quic event")
+	return len(p), nil
+}
+
+func (*quicLogger) Close() error {
+	return nil
+}

socks/auth_handler.go

@@ -18,7 +18,7 @@ const (
 	authFailure     = uint8(1)
 )
 
-// AuthHandler handles socks authenication requests
+// AuthHandler handles socks authentication requests
 type AuthHandler interface {
 	Handle(io.Reader, io.Writer) error
 	Register(uint8, Authenticator)
@@ -43,7 +43,7 @@ func (h *StandardAuthHandler) Register(method uint8, a Authenticator) {
 	h.authenticators[method] = a
 }
 
-// Handle gets the methods from the SOCKS5 client and authenicates with the first supported method
+// Handle gets the methods from the SOCKS5 client and authenticates with the first supported method
 func (h *StandardAuthHandler) Handle(bufConn io.Reader, conn io.Writer) error {
 	methods, err := readMethods(bufConn)
 	if err != nil {

socks/request_handler.go

@@ -55,7 +55,7 @@ func (h *StandardRequestHandler) handleConnect(conn io.ReadWriter, req *Request)
 			addr, err := net.ResolveIPAddr("ip", req.DestAddr.FQDN)
 			if err != nil {
 				_ = sendReply(conn, ruleFailure, req.DestAddr)
-				return fmt.Errorf("unable to resolve host to confirm acceess")
+				return fmt.Errorf("unable to resolve host to confirm access")
 			}
 
 			req.DestAddr.IP = addr.IP

ssh_server_tests/tests.py

@@ -178,7 +178,7 @@ class TestSSHShell(TestSSHBase):
             self.assertIn(username, pwd)
 
             # Ensure shell launched with correct user's permissions and privs.
-            # Cant read root owned 0700 files.
+            # Can't read root owned 0700 files.
             output = self.get_command_output(
                 session, f"cat {self.ROOT_ONLY_TEST_FILE_PATH}"
             )

teamnet/api.go

@@ -16,11 +16,13 @@ import (
 // network, and says that eyeballs can reach that route using the corresponding
 // tunnel.
 type Route struct {
-	Network   CIDR      `json:"network"`
-	TunnelID  uuid.UUID `json:"tunnel_id"`
-	Comment   string    `json:"comment"`
-	CreatedAt time.Time `json:"created_at"`
-	DeletedAt time.Time `json:"deleted_at"`
+	Network  CIDR      `json:"network"`
+	TunnelID uuid.UUID `json:"tunnel_id"`
+	// Optional field. When unset, it means the Route belongs to the default virtual network.
+	VNetID    *uuid.UUID `json:"virtual_network_id,omitempty"`
+	Comment   string     `json:"comment"`
+	CreatedAt time.Time  `json:"created_at"`
+	DeletedAt time.Time  `json:"deleted_at"`
 }
 
 // CIDR is just a newtype wrapper around net.IPNet. It adds JSON unmarshalling.
@@ -62,27 +64,33 @@ type NewRoute struct {
 	Network  net.IPNet
 	TunnelID uuid.UUID
 	Comment  string
+	// Optional field. If unset, backend will assume the default vnet for the account.
+	VNetID *uuid.UUID
 }
 
 // MarshalJSON handles fields with non-JSON types (e.g. net.IPNet).
 func (r NewRoute) MarshalJSON() ([]byte, error) {
 	return json.Marshal(&struct {
-		TunnelID uuid.UUID `json:"tunnel_id"`
-		Comment  string    `json:"comment"`
+		TunnelID uuid.UUID  `json:"tunnel_id"`
+		Comment  string     `json:"comment"`
+		VNetID   *uuid.UUID `json:"virtual_network_id,omitempty"`
 	}{
 		TunnelID: r.TunnelID,
 		Comment:  r.Comment,
+		VNetID:   r.VNetID,
 	})
 }
 
 // DetailedRoute is just a Route with some extra fields, e.g. TunnelName.
 type DetailedRoute struct {
-	Network    CIDR      `json:"network"`
-	TunnelID   uuid.UUID `json:"tunnel_id"`
-	Comment    string    `json:"comment"`
-	CreatedAt  time.Time `json:"created_at"`
-	DeletedAt  time.Time `json:"deleted_at"`
-	TunnelName string    `json:"tunnel_name"`
+	Network  CIDR      `json:"network"`
+	TunnelID uuid.UUID `json:"tunnel_id"`
+	// Optional field. When unset, it means the DetailedRoute belongs to the default virtual network.
+	VNetID     *uuid.UUID `json:"virtual_network_id,omitempty"`
+	Comment    string     `json:"comment"`
+	CreatedAt  time.Time  `json:"created_at"`
+	DeletedAt  time.Time  `json:"deleted_at"`
+	TunnelName string     `json:"tunnel_name"`
 }
 
 // IsZero checks if DetailedRoute is the zero value.
@@ -97,9 +105,15 @@ func (r DetailedRoute) TableString() string {
 	if !r.DeletedAt.IsZero() {
 		deletedColumn = r.DeletedAt.Format(time.RFC3339)
 	}
+	vnetColumn := "default"
+	if r.VNetID != nil {
+		vnetColumn = r.VNetID.String()
+	}
+
 	return fmt.Sprintf(
-		"%s\t%s\t%s\t%s\t%s\t%s\t",
+		"%s\t%s\t%s\t%s\t%s\t%s\t%s\t",
 		r.Network.String(),
+		vnetColumn,
 		r.Comment,
 		r.TunnelID,
 		r.TunnelName,
@@ -107,3 +121,15 @@ func (r DetailedRoute) TableString() string {
 		deletedColumn,
 	)
 }
+
+type DeleteRouteParams struct {
+	Network net.IPNet
+	// Optional field. If unset, backend will assume the default vnet for the account.
+	VNetID *uuid.UUID
+}
+
+type GetRouteByIpParams struct {
+	Ip net.IP
+	// Optional field. If unset, backend will assume the default vnet for the account.
+	VNetID *uuid.UUID
+}

teamnet/api_test.go

@@ -12,77 +12,154 @@ import (
 )
 
 func TestUnmarshalRoute(t *testing.T) {
-	// Response from the teamnet route backend
-	data := `{
-		"network":"10.1.2.40/29",
-		"tunnel_id":"fba6ffea-807f-4e7a-a740-4184ee1b82c8",
-		"comment":"test",
-		"created_at":"2020-12-22T02:00:15.587008Z",
-		"deleted_at":null
-	}`
-	var r Route
-	err := json.Unmarshal([]byte(data), &r)
+	testCases := []struct {
+		Json    string
+		HasVnet bool
+	}{
+		{
+			`{
+				"network":"10.1.2.40/29",
+				"tunnel_id":"fba6ffea-807f-4e7a-a740-4184ee1b82c8",
+				"comment":"test",
+				"created_at":"2020-12-22T02:00:15.587008Z",
+				"deleted_at":null
+			}`,
+			false,
+		},
+		{
+			`{
+				"network":"10.1.2.40/29",
+				"tunnel_id":"fba6ffea-807f-4e7a-a740-4184ee1b82c8",
+				"comment":"test",
+				"created_at":"2020-12-22T02:00:15.587008Z",
+				"deleted_at":null,
+				"virtual_network_id":"38c95083-8191-4110-8339-3f438d44fdb9"
+			}`,
+			true,
+		},
+	}
 
-	// Check everything worked
-	require.NoError(t, err)
-	require.Equal(t, uuid.MustParse("fba6ffea-807f-4e7a-a740-4184ee1b82c8"), r.TunnelID)
-	require.Equal(t, "test", r.Comment)
-	_, cidr, err := net.ParseCIDR("10.1.2.40/29")
-	require.NoError(t, err)
-	require.Equal(t, CIDR(*cidr), r.Network)
-	require.Equal(t, "test", r.Comment)
+	for _, testCase := range testCases {
+		data := testCase.Json
+
+		var r Route
+		err := json.Unmarshal([]byte(data), &r)
+
+		// Check everything worked
+		require.NoError(t, err)
+		require.Equal(t, uuid.MustParse("fba6ffea-807f-4e7a-a740-4184ee1b82c8"), r.TunnelID)
+		require.Equal(t, "test", r.Comment)
+		_, cidr, err := net.ParseCIDR("10.1.2.40/29")
+		require.NoError(t, err)
+		require.Equal(t, CIDR(*cidr), r.Network)
+		require.Equal(t, "test", r.Comment)
+
+		if testCase.HasVnet {
+			require.Equal(t, uuid.MustParse("38c95083-8191-4110-8339-3f438d44fdb9"), *r.VNetID)
+		} else {
+			require.Nil(t, r.VNetID)
+		}
+	}
 }
 
 func TestDetailedRouteJsonRoundtrip(t *testing.T) {
-	// Response from the teamnet route backend
-	data := `{
-		"network":"10.1.2.40/29",
-		"tunnel_id":"fba6ffea-807f-4e7a-a740-4184ee1b82c8",
-		"comment":"test",
-		"created_at":"2020-12-22T02:00:15.587008Z",
-		"deleted_at":"2021-01-14T05:01:42.183002Z",
-		"tunnel_name":"Mr. Tun"
-	}`
-	var r DetailedRoute
-	err := json.Unmarshal([]byte(data), &r)
+	testCases := []struct {
+		Json    string
+		HasVnet bool
+	}{
+		{
+			`{
+				"network":"10.1.2.40/29",
+				"tunnel_id":"fba6ffea-807f-4e7a-a740-4184ee1b82c8",
+				"comment":"test",
+				"created_at":"2020-12-22T02:00:15.587008Z",
+				"deleted_at":"2021-01-14T05:01:42.183002Z",
+				"tunnel_name":"Mr. Tun"
+			}`,
+			false,
+		},
+		{
+			`{
+				"network":"10.1.2.40/29",
+				"tunnel_id":"fba6ffea-807f-4e7a-a740-4184ee1b82c8",
+				"virtual_network_id":"38c95083-8191-4110-8339-3f438d44fdb9",
+				"comment":"test",
+				"created_at":"2020-12-22T02:00:15.587008Z",
+				"deleted_at":"2021-01-14T05:01:42.183002Z",
+				"tunnel_name":"Mr. Tun"
+			}`,
+			true,
+		},
+	}
 
-	// Check everything worked
-	require.NoError(t, err)
-	require.Equal(t, uuid.MustParse("fba6ffea-807f-4e7a-a740-4184ee1b82c8"), r.TunnelID)
-	require.Equal(t, "test", r.Comment)
-	_, cidr, err := net.ParseCIDR("10.1.2.40/29")
-	require.NoError(t, err)
-	require.Equal(t, CIDR(*cidr), r.Network)
-	require.Equal(t, "test", r.Comment)
-	require.Equal(t, "Mr. Tun", r.TunnelName)
+	for _, testCase := range testCases {
+		data := testCase.Json
 
-	bytes, err := json.Marshal(r)
-	require.NoError(t, err)
-	obtainedJson := string(bytes)
-	data = strings.Replace(data, "\t", "", -1)
-	data = strings.Replace(data, "\n", "", -1)
-	require.Equal(t, data, obtainedJson)
+		var r DetailedRoute
+		err := json.Unmarshal([]byte(data), &r)
+
+		// Check everything worked
+		require.NoError(t, err)
+		require.Equal(t, uuid.MustParse("fba6ffea-807f-4e7a-a740-4184ee1b82c8"), r.TunnelID)
+		require.Equal(t, "test", r.Comment)
+		_, cidr, err := net.ParseCIDR("10.1.2.40/29")
+		require.NoError(t, err)
+		require.Equal(t, CIDR(*cidr), r.Network)
+		require.Equal(t, "test", r.Comment)
+		require.Equal(t, "Mr. Tun", r.TunnelName)
+
+		if testCase.HasVnet {
+			require.Equal(t, uuid.MustParse("38c95083-8191-4110-8339-3f438d44fdb9"), *r.VNetID)
+		} else {
+			require.Nil(t, r.VNetID)
+		}
+
+		bytes, err := json.Marshal(r)
+		require.NoError(t, err)
+		obtainedJson := string(bytes)
+		data = strings.Replace(data, "\t", "", -1)
+		data = strings.Replace(data, "\n", "", -1)
+		require.Equal(t, data, obtainedJson)
+	}
 }
 
 func TestMarshalNewRoute(t *testing.T) {
 	_, network, err := net.ParseCIDR("1.2.3.4/32")
 	require.NoError(t, err)
 	require.NotNil(t, network)
-	newRoute := NewRoute{
-		Network:  *network,
-		TunnelID: uuid.New(),
-		Comment:  "hi",
+	vnetId := uuid.New()
+
+	newRoutes := []NewRoute{
+		{
+			Network:  *network,
+			TunnelID: uuid.New(),
+			Comment:  "hi",
+		},
+		{
+			Network:  *network,
+			TunnelID: uuid.New(),
+			Comment:  "hi",
+			VNetID:   &vnetId,
+		},
 	}
 
-	// Test where receiver is struct
-	serialized, err := json.Marshal(newRoute)
-	require.NoError(t, err)
-	require.True(t, strings.Contains(string(serialized), "tunnel_id"))
+	for _, newRoute := range newRoutes {
+		// Test where receiver is struct
+		serialized, err := json.Marshal(newRoute)
+		require.NoError(t, err)
+		require.True(t, strings.Contains(string(serialized), "tunnel_id"))
 
-	// Test where receiver is pointer to struct
-	serialized, err = json.Marshal(&newRoute)
-	require.NoError(t, err)
-	require.True(t, strings.Contains(string(serialized), "tunnel_id"))
+		// Test where receiver is pointer to struct
+		serialized, err = json.Marshal(&newRoute)
+		require.NoError(t, err)
+		require.True(t, strings.Contains(string(serialized), "tunnel_id"))
+
+		if newRoute.VNetID == nil {
+			require.False(t, strings.Contains(string(serialized), "virtual_network_id"))
+		} else {
+			require.True(t, strings.Contains(string(serialized), "virtual_network_id"))
+		}
+	}
 }
 
 func TestRouteTableString(t *testing.T) {

teamnet/filter.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"net"
 	"net/url"
+	"strconv"
 	"time"
 
 	"github.com/google/uuid"
@@ -34,6 +35,11 @@ var (
 		Name:  "filter-comment-is",
 		Usage: "Show only routes with this comment.",
 	}
+	filterVnet = cli.StringFlag{
+		Name:  "filter-virtual-network-id",
+		Usage: "Show only routes that are attached to the given virtual network ID.",
+	}
+
 	// Flags contains all filter flags.
 	FilterFlags = []cli.Flag{
 		&filterDeleted,
@@ -41,6 +47,7 @@ var (
 		&filterSubset,
 		&filterSuperset,
 		&filterComment,
+		&filterVnet,
 	}
 )
 
@@ -81,11 +88,23 @@ func NewFromCLI(c *cli.Context) (*Filter, error) {
 	if tunnelID := c.String(filterTunnelID.Name); tunnelID != "" {
 		u, err := uuid.Parse(tunnelID)
 		if err != nil {
-			return nil, errors.Wrap(err, "Couldn't parse UUID from --filter-tunnel-id")
+			return nil, errors.Wrapf(err, "Couldn't parse UUID from %s", filterTunnelID.Name)
 		}
 		f.tunnelID(u)
 	}
 
+	if vnetId := c.String(filterVnet.Name); vnetId != "" {
+		u, err := uuid.Parse(vnetId)
+		if err != nil {
+			return nil, errors.Wrapf(err, "Couldn't parse UUID from %s", filterVnet.Name)
+		}
+		f.vnetID(u)
+	}
+
+	if maxFetch := c.Int("max-fetch-size"); maxFetch > 0 {
+		f.MaxFetchSize(uint(maxFetch))
+	}
+
 	return f, nil
 }
 
@@ -133,6 +152,14 @@ func (f *Filter) tunnelID(id uuid.UUID) {
 	f.queryParams.Set("tunnel_id", id.String())
 }
 
+func (f *Filter) vnetID(id uuid.UUID) {
+	f.queryParams.Set("virtual_network_id", id.String())
+}
+
+func (f *Filter) MaxFetchSize(max uint) {
+	f.queryParams.Set("per_page", strconv.Itoa(int(max)))
+}
+
 func (f Filter) Encode() string {
 	return f.queryParams.Encode()
 }

token/token.go

@@ -178,7 +178,7 @@ func getToken(appURL *url.URL, appInfo *AppInfo, useHostOnly bool, log *zerolog.
 		return token, nil
 	}
 
-	// If an app token couldnt be found on disk, check for an org token and attempt to exchange it for an app token.
+	// If an app token couldn't be found on disk, check for an org token and attempt to exchange it for an app token.
 	var orgTokenPath string
 	orgToken, err := GetOrgTokenIfExists(appInfo.AuthDomain)
 	if err != nil {
@@ -213,7 +213,7 @@ func getToken(appURL *url.URL, appInfo *AppInfo, useHostOnly bool, log *zerolog.
 // getTokensFromEdge will attempt to use the transfer service to retrieve an app and org token, save them to disk,
 // and return the app token.
 func getTokensFromEdge(appURL *url.URL, appTokenPath, orgTokenPath string, useHostOnly bool, log *zerolog.Logger) (string, error) {
-	// If no org token exists or if it couldnt be exchanged for an app token, then run the transfer service flow.
+	// If no org token exists or if it couldn't be exchanged for an app token, then run the transfer service flow.
 
 	// this weird parameter is the resource name (token) and the key/value
 	// we want to send to the transfer service. the key is token and the value

tunneldns/https_upstream.go

@@ -49,12 +49,12 @@ func (u *UpstreamHTTPS) Exchange(ctx context.Context, query *dns.Msg) (*dns.Msg,
 		for _, bootstrap := range u.bootstraps {
 			endpoint, client, err := configureBootstrap(bootstrap)
 			if err != nil {
-				u.log.Err(err).Msgf("failed to configure boostrap upstream %s", bootstrap)
+				u.log.Err(err).Msgf("failed to configure bootstrap upstream %s", bootstrap)
 				continue
 			}
 			msg, err := exchange(queryBuf, query.Id, endpoint, client, u.log)
 			if err != nil {
-				u.log.Err(err).Msgf("failed to connect to a boostrap upstream %s", bootstrap)
+				u.log.Err(err).Msgf("failed to connect to a bootstrap upstream %s", bootstrap)
 				continue
 			}
 			return msg, nil

tunnelrpc/pogs/sessionrpc.go

@@ -0,0 +1,150 @@
+package pogs
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"time"
+
+	"github.com/cloudflare/cloudflared/tunnelrpc"
+	"github.com/google/uuid"
+	capnp "zombiezen.com/go/capnproto2"
+	"zombiezen.com/go/capnproto2/rpc"
+	"zombiezen.com/go/capnproto2/server"
+)
+
+type SessionManager interface {
+	RegisterUdpSession(ctx context.Context, sessionID uuid.UUID, dstIP net.IP, dstPort uint16, closeAfterIdleHint time.Duration) error
+	UnregisterUdpSession(ctx context.Context, sessionID uuid.UUID) error
+}
+
+type SessionManager_PogsImpl struct {
+	impl SessionManager
+}
+
+func SessionManager_ServerToClient(s SessionManager) tunnelrpc.SessionManager {
+	return tunnelrpc.SessionManager_ServerToClient(SessionManager_PogsImpl{s})
+}
+
+func (i SessionManager_PogsImpl) RegisterUdpSession(p tunnelrpc.SessionManager_registerUdpSession) error {
+	server.Ack(p.Options)
+
+	sessionIDRaw, err := p.Params.SessionId()
+	if err != nil {
+		return err
+	}
+	sessionID, err := uuid.FromBytes(sessionIDRaw)
+	if err != nil {
+		return err
+	}
+
+	dstIPRaw, err := p.Params.DstIp()
+	if err != nil {
+		return err
+	}
+	dstIP := net.IP(dstIPRaw)
+	if dstIP == nil {
+		return fmt.Errorf("%v is not valid IP", dstIPRaw)
+	}
+	dstPort := p.Params.DstPort()
+
+	closeIdleAfterHint := time.Duration(p.Params.CloseAfterIdleHint())
+
+	resp := RegisterUdpSessionResponse{}
+	registrationErr := i.impl.RegisterUdpSession(p.Ctx, sessionID, dstIP, dstPort, closeIdleAfterHint)
+	if registrationErr != nil {
+		resp.Err = registrationErr
+	}
+
+	result, err := p.Results.NewResult()
+	if err != nil {
+		return err
+	}
+
+	return resp.Marshal(result)
+}
+
+func (i SessionManager_PogsImpl) UnregisterUdpSession(p tunnelrpc.SessionManager_unregisterUdpSession) error {
+	server.Ack(p.Options)
+
+	sessionIDRaw, err := p.Params.SessionId()
+	if err != nil {
+		return err
+	}
+	sessionID, err := uuid.FromBytes(sessionIDRaw)
+	if err != nil {
+		return err
+	}
+
+	return i.impl.UnregisterUdpSession(p.Ctx, sessionID)
+}
+
+type RegisterUdpSessionResponse struct {
+	Err error
+}
+
+func (p *RegisterUdpSessionResponse) Marshal(s tunnelrpc.RegisterUdpSessionResponse) error {
+	if p.Err != nil {
+		return s.SetErr(p.Err.Error())
+	}
+	return nil
+}
+
+func (p *RegisterUdpSessionResponse) Unmarshal(s tunnelrpc.RegisterUdpSessionResponse) error {
+	respErr, err := s.Err()
+	if err != nil {
+		return err
+	}
+	if respErr != "" {
+		p.Err = fmt.Errorf(respErr)
+	}
+	return nil
+}
+
+type SessionManager_PogsClient struct {
+	Client capnp.Client
+	Conn   *rpc.Conn
+}
+
+func (c SessionManager_PogsClient) Close() error {
+	c.Client.Close()
+	return c.Conn.Close()
+}
+
+func (c SessionManager_PogsClient) RegisterUdpSession(ctx context.Context, sessionID uuid.UUID, dstIP net.IP, dstPort uint16, closeAfterIdleHint time.Duration) (*RegisterUdpSessionResponse, error) {
+	client := tunnelrpc.SessionManager{Client: c.Client}
+	promise := client.RegisterUdpSession(ctx, func(p tunnelrpc.SessionManager_registerUdpSession_Params) error {
+		if err := p.SetSessionId(sessionID[:]); err != nil {
+			return err
+		}
+		if err := p.SetDstIp(dstIP); err != nil {
+			return err
+		}
+		p.SetDstPort(dstPort)
+		p.SetCloseAfterIdleHint(int64(closeAfterIdleHint))
+		return nil
+	})
+	result, err := promise.Result().Struct()
+	if err != nil {
+		return nil, wrapRPCError(err)
+	}
+	response := new(RegisterUdpSessionResponse)
+
+	err = response.Unmarshal(result)
+	if err != nil {
+		return nil, err
+	}
+	return response, nil
+}
+
+func (c SessionManager_PogsClient) UnregisterUdpSession(ctx context.Context, sessionID uuid.UUID) error {
+	client := tunnelrpc.SessionManager{Client: c.Client}
+	promise := client.UnregisterUdpSession(ctx, func(p tunnelrpc.SessionManager_unregisterUdpSession_Params) error {
+		if err := p.SetSessionId(sessionID[:]); err != nil {
+			return err
+		}
+		return nil
+	})
+	_, err := promise.Struct()
+	return err
+}

tunnelrpc/tunnelrpc.capnp

@@ -142,3 +142,13 @@ interface TunnelServer extends (RegistrationServer) {
     authenticate @4 (originCert :Data, hostname :Text, options :RegistrationOptions) -> (result :AuthenticateResponse);
     reconnectTunnel @5 (jwt :Data, eventDigest :Data, connDigest :Data, hostname :Text, options :RegistrationOptions) -> (result :TunnelRegistration);
 }
+
+struct RegisterUdpSessionResponse {
+    err @0 :Text;
+}
+
+interface SessionManager {
+    # Let the edge decide closeAfterIdle to make sure cloudflared doesn't close session before the edge closes its side
+    registerUdpSession @0 (sessionId :Data, dstIp :Data, dstPort: UInt16, closeAfterIdleHint: Int64) -> (result :RegisterUdpSessionResponse);
+    unregisterUdpSession @1 (sessionId :Data) -> ();
+}

tunnelrpc/tunnelrpc.capnp.go

@@ -3371,195 +3371,711 @@ func (p TunnelServer_reconnectTunnel_Results_Promise) Result() TunnelRegistratio
 	return TunnelRegistration_Promise{Pipeline: p.Pipeline.GetPipeline(0)}
 }
 
-const schema_db8274f9144abc7e = "x\xda\xccY{l\x1c\xd5\xd5?g\xee\xaeg\xed\xd8" +
-	"\xac\x87\xd9\xc4\x89\x05\x9f\xbf/\x0a\xe2\xc3`\xc0q\xa9" +
-	"\xd2\x94\xd6v\xb0Sl\xf2\xf0x\x93\x96G\x82\x18\xef" +
-	"\xde\xd8\xe3\xee\xce,3\xb3\xc6N\x13\x92\x98\xa4\x10\xc4" +
-	"+!\xe1\x91\x926\x04\xd1\xaa\x14ZR@m*\xaa" +
-	"B_\x80x\xa3P%\x10\xd4\x96\x90>\xa2PJ\xa0" +
-	"BT\x94\xa9\xce\xcc\xce\xc3kc;\xd0?\xfa\xdf\xea" +
-	"\xcc\xb9\xf7\x9es~\xe7\x9e\xf3\xbbg\xcf\xff\x9a\xd8&" +
-	"4\xc7\xc5\x19\x00\xca\xc6x\x85\xc3\x1b_Y\xbb\xe7\x8c" +
-	"_\x8d\x82R\x8f\xe8\\\xfbxw\xeaC{\xf4u\x88" +
-	"3\x11\xa0E\x8b\xafEy}\\\x04\x90G\xe2\x7f\x06" +
-	"t.\x91\xce\xbb\"\xf5\xd2\x0b\xd7\x81T\x1fU\x8e\x91" +
-	"\xf2\xea\x8aF\x94\xf3\x15\xa4\xacU\x90\xf2\x85\xf9\x17\xf7" +
-	"~~\xe7\xb3\x9bA\xaa\x17Be\xc0\x96\x95\xe2Z\x94" +
-	"5\x914\xb9\xb8\x1c\xd0yo\xc7\xec\x1f\xdc\xfb\xc2\xd3" +
-	"[@:\x13\xa1t\xf6z\xf15\x04\x94\xb7\x89?\x02" +
-	"tZ\x17?\xbf\xbf\xbe\xe5\x8e\x1de\xe7\x0a\xa4\xd8\x9c" +
-	"hD\xb9=A\xbb})q\x0d\xa03w\xe8\x8c\xab" +
-	"~\xf9\x9bG\xee\x04\xa5\x09\xd19\xdcw\xf6\xabl\xf7" +
-	"\x03\xaf\xc3J\x14Q\x00h\xb97\xb1\x976\xde\xe7\xea" +
-	"\xbex\xce\xe3?\xbb\xed\x91\xeb\xbf\x05\xca\x99\x88\x00\xae" +
-	"#3+\xffI\x0agU\xb6\x02:;\x0e\xfe|Y" +
-	"~\xdb\xae\xbd\x9ei\xeew\xa5R\x10 \xe6l\xee\xfa" +
-	" \xbf\xf2\xbe\xf4}%\xa3)J-\x9d\x95'\x10\xb0" +
-	"\xe5\xb2\xca\x06\x04t.x\xed\xe8\xf2\xa5?^\xf3\xbd" +
-	"\xc8\xdab\xd5ZZ\xfb\xd0\xff\\R9|t\xf1\xc3" +
-	" 5\xf9_\xae\xae\xea\xa5/\xb1\xd5\xecc\xf5\xae_" +
-	"<Z\x8e\x87\xebj\xbe\xaa\x0f\xe5MUnx\xaa\xdc" +
-	"#n|r\xd7\xd9\x89\xef\xbc\xf7\xd8D\x81\xb9\x7fF" +
-	"\x1f\xca\xfbgP`\x1e\x9bA\xce\xce\xec\xc2\xc3O4" +
-	"\xc7~\x12\x0d\xf3\xcc\xeac\xae\xb3\xd5\x14\xe6\xd3\xdf^" +
-	"T\xa3\xbf3\xfaD\xd9n\xae\xe23\xd5\xdd(\xbfQ" +
-	"M\xbb\x1dr\x95\xbb\xaf\xb8}{\xfc\xe8\xedO\x91\xa5" +
-	"\x11|\xe3\x09\xd7\xcf\x1a\x13\xe5\xad5\xf4sKM\x1d" +
-	"\x03t\xea\x1f\xfe\xe2\x0f\x17e\x0f=;\x81\xa5r\\" +
-	":!K\x12\xfd\xaa\x91\xc8\xd0#M\xfb\xbe\xf1\xd7\x9b" +
-	"_>P2\x14\xdd\\\x94\\T\xd6K\x84J\x00j" +
-	"Y\x94\\\xcd\xdd\xd2 \xca\xfb\xdc\xed\x1er\xb5\x85\xa3" +
-	"\xea\x9c\x8d\xbf\xfb\xf2\xe1\x08\x0e\xfb\xa47\x11b\xce\xb2" +
-	"\xaf^1X\xb9\xfe\xc8\x91\xe8A\xf7KnD\xf6\xbb" +
-	"K\xff\xf6\xddc\xb7\x1e\xcfg\xff\xe4\xe6\x92\x1f\xb3C" +
-	"\xd2B\x01P~W\xa2,\xafk\xa8\xe9\x9c{\xb0\xe7" +
-	"\x98\x07\xa5\xb7\xc5\xf3\xa7.\"\x85\xa3\xa7\xd2\x16\x17\\" +
-	"\xd5\xceW-\xb8\xf4\x18H\xf5l\xcc5\x88\xcb\x0bQ" +
-	"\x9e)\xd3\x02I\xbe\x1e\xe5\xb3Ru\x00\xce-\xd7v" +
-	",\xff\xc2\xdc'ODM\x9a\x93\xa2\xb4\x92\x9bR\xb4" +
-	"\xdf\x9a\x05\xc7\xbfr\xc6-\xbf=Q\x16HWqi" +
-	"\xaa\x11\xe5\xd5)r\xfd2R~g\xf1\xb7\x0f\xd4'" +
-	"\xeb\xdf/\x0bS\x85\x9bA\xa9A\x94\xb7\x91n\xcb\xcd" +
-	"\xa9\xa7(\x99\xbe\xf9\xfa\x95\xc3\xaf\\\xf7\xde?\xca\x11" +
-	"u\xb7\xde4\xab\x17\xe5\x9d\xb3h\xebm\xb3\x08\xff;" +
-	"W\xfce\xc3\xf1\x9d\xb3>\x18\xe7Ws\xdd \xca\x9d" +
-	"u\xa4\xd9^w\xbd|/\xfdr^\x12\xefk\xee\xd8" +
-	"\xf0\xec\x87\x91\x8c\xdfZ\xd7M\x19\x7f\x87x\xcf\x91\x8d" +
-	"\xbf\xbf\xf2\xa3\xa8\xc3[\xea\xde$\x87\xef\xae#\x87\xd7" +
-	"\xbds\xf7\xc5\xb7\xaez\xf0\xe3\x08|\xfb\xebFi\xa9" +
-	"]\xd4u\x9e3\x0b\xb1\xccy\xfe\xcf\xcc\xb9\x19\xb5\xa0" +
-	"\x17\x16\xb6\x17\xed\x01\xae\xdbZF\xb5y/o\xb5\x0a" +
-	"\x86n\xf1\x1eD\xa5\x96\xc5\x00b\x08 \xa9\x83\x00\xca" +
-	"U\x0c\x95\x9c\x80\x12b\x8a\x00\x964\x12\x0e0Tl" +
-	"\x01%AHQ\xc9\x90\xae\x9e\x0b\xa0\xe4\x18*\xc3\x02" +
-	"\"K!\x03\x90\x8a\xdb\x01\x94a\x86\xcaf\x01\x9d\x02" +
-	"7\xf3\xaa\xceuH\xda\x9d\xa6\x89\xd5 `5\xa0c" +
-	"r\xdb\x1cQ\xfbr\x90\xe4\x11\xb18x\x8d\x8d5 " +
-	"`\x0d\xa03`\x14Mk\xa5n\xa3\x96\xeb\xe5kL" +
-	"n\xe1\x00V\x80\x80\x15\x80\x81{l\xbc{\x17\xe54" +
-	"\xae\xdb\xc9.}\x8dQ\xe6T\xf7DNu\x97\x9c\xda" +
-	"\x1cqj\xd3\"\x00e\x1dC\xe5\x06\x01%V\xf2j" +
-	"K#\xf5\x05\x86\xcaM\x02:\x19\xf7\x90\xae,\x00\x04" +
-	"\xf6\xae\xe1\xaa]4\xb9E\xb2S\x00{\x18\xban\x9d" +
-	"\x02\xb8a\x88\x9b\x96f\xe8\xbe\x9bI\xd5\xcc\x0c\x04\xa1" +
-	"\x98\x04\xaa\xcea\xcd\xb25\xbd\x7f\x85+o\xed1r" +
-	"Zf\x84\xbc\xaav\xed<}!\x00\xa24\xf3r\x00" +
-	"\x14$i\x11@\xab\xd6\xaf\x1b&w\xb2\x9a\x951t" +
-	"\x9d\x03\xcb\xd8\x1b\xfa\xd4\x9c\xaagxpP\xc5\xf8\x83" +
-	"\xbc\x03\xd2\xdc\x1c\xe2\xe6\xb9j$A\xe6\xf5\xa8\xa6\xca" +
-	"\xf2\x96R\x1d\xc4\xb1\xf3r\x00\xa5\x83\xa1\xd2\x13\x89\xe3" +
-	"R\x8a\xe3\x12\x86\xca\xa5\x918\xae\xa48\xf60TV" +
-	"\x09\xe8\x18\xa6\xd6\xaf\xe9\x17q`f\x14c\xcb\xd6\xd5" +
-	"<\xa7\x98\x95\xe2\xb1\xc1(\xd8\x9a\xa1[X\x1b\xd6Q" +
-	"@\xac\x9d\x1cu\xcf\x81$\xe56\xc5'\x11X{\x16" +
-	"Y\xfb\xff\x0c\x95\xcfE\xacm\xa6T>\x9f\xa1r\xa1" +
-	"\x80\x8e\x9a\xc9\x18E\xdd^\x01L\xed/\x03%\xcd!" +
-	"\x991yh\xaf\x7fl|\x82\xbc\xa3xg\xc8\xf4^" +
-	"\xee\xdd\xa9sMn\x89\xc5\x9cM\xd6T;\x8eg\xce" +
-	"|\x00e\x1eC\xe5|\x01k\xf0c\xc7\xb3\xa7i{" +
-	"hO\x037M\xc3\xc4\xda\xb0\xe6\x94\xbc\xcf\x94\x0e@" +
-	"C\xef\xe0\xb6\xaa\xe5\x90b\x14\xb4\xb9\xb2\x18M\x05r" +
-	"Q7y\xbff\xd9\xdc\xf4\xc4\xf3Z\x09\xe9\xbc\xa5\xc4" +
-	"\x82\xd0\xd5\xec\x02Pj\x19*\xa7\x09\xe8\xf4\x9bj\x86" +
-	"\xf7p\x135#\xbbL\xd5\x8d4\xe3\x19\x8c\x83\x80\xf1" +
-	"\xc8\xa1\xa7\x9c\xec\xa1\xbd\xdc*\xe6l\x0b\x82U\x93\xaf" +
-	"7y)\x08\xa5\xe5=\x0d\x9e\xcd\xa9\xc0\xe6\xf5s\xc3" +
-	"\xda\x13\xc0\xbd\xa9/\xbc\xbaArn\xa5\xc4\xb8\x81\xa1" +
-	"\xb2#r\xc9\xb7Q\x1a\xdf\xc6P\xb9G@)\x16K" +
-	"a\x0c@\xba\x9b\xd2x\x07Ce\x8f0\xb6B\xf1!" +
-	"\xae\xdb\x1dZ?\x88\xdc\x0a\xa5db\x87\xd6\xcf\x81Y" +
-	"\x9f5\xd1\x13S\xc4\xc3\xe8\xb3\x8c\x1c\xb7y\x07\xcf\xe4" +
-	"TS\xb5\xb5!\xee}/%\xa3\x0f\xead\x1b\xf6\xba" +
-	"\x88\xd0bC\x1f\x07S\x98\xd4%\xa8\xd0\x9a\xac^\x85" +
-	"\xea\xcb\x0b\xb6&\x1a\xbaE\x971\x82\xce\xc2\x89\xd01" +
-	"Ct\xd0\x07g4\x0a\x0e\x96\xc0\xd9\x15\xe2 \xc5\x04" +
-	"\x0f\x9c\xdd{\x01\x94=\x0c\x95\x07\x05l\xf5\xca2\xd6" +
-	"\x86l\xbc\x14P\xaf\xf8,1\xa0!\xa3\xe6\xba\x0a\x01" +
-	",&/\xe4\xd4\x0c\xef\xc4R\xa1\x05D\x10\x10]\x14" +
-	"\xf3\x05\x93[\x16j\x86\xae\x14\xd5\x9c\xc6\xec\x91\xa0\xfd" +
-	"\xe8\xc5|\x8f\xc9\x8744\x8aV\xbbm\xf3\xbcX\xb0" +
-	"\xadq\xcdi\xd2\x00\xd1\x15\x16\xb5\x9cUV\xad\x1a\xc3" +
-	"\xf2\x10\x04\xa8\x89\xaa\xd59\x0c\x95\x05\x02&\x8bE-" +
-	"\x1b\x98\x9f32.n\x90\\\xa6\xe6\xf9\xb8\x8eR1" +
-	"\xe5u\x1as\x19{\xd4\xa4{\x9b\xfe\x9bJ\xfd\xe4\xfc" +
-	"\x85\\\x07\xb7\x1f\x86&S\x01hc\xa8,\x89\x98\xdc" +
-	"5?\xe2\x87o\xf2\xd2\xbe\xd0\x0f\xf1\xeb|\xc4\xb7\xaa" +
-	"\x81\xe7\xa9\xb8\xfa\xc1,9\xd3\x0e\xe2%\xa1\xced\xf6" +
-	"E/\xd4\xf2B\x83\xeb!\xd9\xb8\xc0\xb7Q\x1e\xc1n" +
-	"\x80\xf402Lo\xc6\xd0Ly\x13.\x02H\xaf#" +
-	"\xf9\x0d\x18Z*o\xc1z\x80\xf4F\x92\xdf\x84\x01\xcf" +
-	"\x92\xb7\xe2\x03\x00\xe9\x9bH|\x17\xa9\xc7\x98{%\xe4" +
-	"\x9d\xee\xf6;H\xbe\x87\xe4\xf1X\x0a\xe3\x00\xf2nl" +
-	"\x04H\xdfE\xf2GI^!\xa4\xb0\x02@\xde\x87\x83" +
-	"\x00\xe9\x87I\xfe8\xc9\xc5x\x8a\xa8\xa6\xbc\x1fM\x80" +
-	"\xf4OI\xfek\x92'f\xa70\x01 ?\xe9\xca\x9f" +
-	" \xf9s$\xaf\x9c\x93\xc2J\x00\xf9\x19\x1c\x05H?" +
-	"M\xf2\x03$\xaf\xc2\x14V\x01\xc8/\xe3.\x80\xf4\x01" +
-	"\x92\xff\x81\xe43*R8\x03@~\xc3\xb5\xe7 \xc9" +
-	"\xdf\"yu,\x85\xd5\x00\xf2\x1fq/@\xfa-\x92" +
-	"\xff\x9d\xe45b\x0ak\x00\xe4\xb7]\xbf\x8e\x93<!" +
-	"\x94\x910?\xa3\xca\x98\x163\xac\x002^\xba\xe3\xe8" +
-	"\xa5{\x8f\x91$6\x85\xc9\xf05\x0e\x88I@\xa7`" +
-	"\x18\xb9ec35i\xab\xfd\x96\xcf\xeaj\xc3\x17\x1b" +
-	" \x09\x83\xd6\x0cIC\xef\xca\x06\x85\xa0\xbc\xea\xf8\x96" +
-	"hV{\xd16\x8a\x05h\xc8\xaa6\xcf\x065\xc7," +
-	"\xea\x8bM#\xbf\x02\xb9\x99\xd7t57E5\xaa\x04" +
-	"\x01+\xa1T\x12\xfc\xbd'/M\x9f\xccQ\x83\x8c\x16" +
-	"\xca3\xba\xa1\xb0p\x85\xda?\x9d:5?\xa4ZI" +
-	"=R\x90\x1a\x86\xd4\\\xf1\xd3\x94\xa7\xb1\xdd\xbe\xb7\xd5" +
-	"c\x0bQ\x8aB\x0d%\xc1PI\x09\xd8jz\x1d\xaa" +
-	"\xd6\x7f\xdaM]J\xc6r\xb6\xa4\xff\x10r\xf7\xc7\xc8" +
-	"\xb8\x84\xce\x11J\xfbO\xdb\xfc~n{\xbf\xe8)B" +
-	"<Z\x8cv\xe2\x93[\xdd\xcb\xad\xe4t\\\x0f\x9f\xc0" +
-	"e\xce\x8b\xd3j\xfc\x13\xb4}\x9f\x16F\xdeQ\x84\xfd" +
-	"*\x86\xca@\x04{NM!\xcbP)\x84M<\xdf" +
-	"\x1b\xbe\x0d%&\x94\x1e\x87\xd4(\x0a\x0c\x95u\x02&" +
-	"\xe9\xa5\x81\xb5\xe1\x0ck\x8c\xd1c_W\x94\x0a]z" +
-	"\x96\x03\x0e\xfb\xd9\x1ci\x1f\xc1lhj\x025=\xb7" +
-	"}b:e\xc0\x83y\xcbt\xdf(\xad\xde\xa1\x94g" +
-	"\xb3Y\x1c \x98=\xa1?\xdf\x90\xf6\xad\x05A\xfa\xbe" +
-	"\x88\xe1|\x06\xfdq\x8c\xb4\xdb\x04A\xda)\xa2\x10\x0c" +
-	"\xe8\xd0\x1f\xc4I[o\x04A\xda\"\"\x0b\xe6k\xe8" +
-	"O\x08\x9aG\xaa\x10\x04i\xbd\x88\xb1`\xa6\x88\xfe|" +
-	"A\xbaz\x10\x04I\x131\x1e\x8c\xee\xd0\x1f4I\xab" +
-	"GA\x90V\x8a\x8e\x1f$h\xf5\xfchC\xc7\xcfQ" +
-	"hp\xb3\xb4\x0d\x1d\x9f9\xa2O*\x00\xda\xd0\xf1i" +
-	"*\xfb$\x9e\xeaj\xf9\xcfNH\xd2\xc3\xb3\x8d\xc8\x99" +
-	"w\xff\xb1T\x00\xa0\x0d\x95\x18F\xc6+\x00\x9f\x96\xea" +
-	"\xf4\xf2\x86\xcfRJ&\x00\xd7;'\x18;D\xf6%" +
-	"\xf6V\xcdP\x99-LI\xd8b\x9f\xe4\x85\x9f\xb4I" +
-	"ZL\xfb\xffo\xb0\xff\xcbDx\x9ec\xa8\x1c\x8c\\" +
-	"\xc7WI\xf8\x12C\xe5p\x84\xf0\x1c\xa2;z\x90\xa1" +
-	"\xf2~8\xaby\xf7F\x00\xe5}\x86\xbd\x11\x02!\xfd" +
-	"\x8b\x14?\xa26\xeb\xd2\x07\xf4\xe8C\x1c\xb7\x03\xa4\x13" +
-	"\xd4~S.}\x88y\xf4A\xc2>\x80t-\xc9O" +
-	"\x8b\xd2\x879x9@z6\xc9\xe7\xa1\x80\"\x8f\xcc" +
-	"y\x8afH\xb0rF\xff\x12M\x9f\xb0'\xf9\xc3#" +
-	"\xb4\x17\xabZ\xaehr\x08[b\xa9HtD\xba\xb4" +
-	"7Uj_C\xe9\x97\xa6\xe4\xc9\xa2\x85\"\x08(\x9e" +
-	"\xdccmZ\x1d\xa3\xd34\x0d4\xcb\xc8\xe7\xfc\x90|" +
-	"\x06\xdc\x938\xf4\xc5\x0c\x95\x15\x04E\x9b\x07\x85\xd2\x17" +
-	"\xd2\xe5\x86\x8cZ\xb4\xf88\x1f\x80q3x`[\x03" +
-	"F1\x97\xed\xe5 \xda\xe6HY\x08\xa6$\xa1i\x9e" +
-	"\xf4+N\xc2\xad8\xfe\xe8\x16\xfd\x09\xad\xd4\xbc\x0b\x04" +
-	"\xa9\x89*\x8e?\x8dD\x7f\x10/\xfd\xdf\x03 H\xa7" +
-	"\x87\x05\x00\xfd\x180C\x1f{\xe5\xbd\x0fn\x8e\xb6a" +
-	"\x0f\xe2\x7f\xe2\xd9\xe9\xb5\x9f\x93\xb8\xe9c\xa6WT\xc6" +
-	"\xc5\xe9\xf4\xcd\xe0\xcf\x9e\xb2\x9b^\xf9Y_\xe0~#" +
-	"\xf9w\x00\x00\x00\xff\xffH\xa22\xa3"
+type RegisterUdpSessionResponse struct{ capnp.Struct }
+
+// RegisterUdpSessionResponse_TypeID is the unique identifier for the type RegisterUdpSessionResponse.
+const RegisterUdpSessionResponse_TypeID = 0xab6d5210c1f26687
+
+func NewRegisterUdpSessionResponse(s *capnp.Segment) (RegisterUdpSessionResponse, error) {
+	st, err := capnp.NewStruct(s, capnp.ObjectSize{DataSize: 0, PointerCount: 1})
+	return RegisterUdpSessionResponse{st}, err
+}
+
+func NewRootRegisterUdpSessionResponse(s *capnp.Segment) (RegisterUdpSessionResponse, error) {
+	st, err := capnp.NewRootStruct(s, capnp.ObjectSize{DataSize: 0, PointerCount: 1})
+	return RegisterUdpSessionResponse{st}, err
+}
+
+func ReadRootRegisterUdpSessionResponse(msg *capnp.Message) (RegisterUdpSessionResponse, error) {
+	root, err := msg.RootPtr()
+	return RegisterUdpSessionResponse{root.Struct()}, err
+}
+
+func (s RegisterUdpSessionResponse) String() string {
+	str, _ := text.Marshal(0xab6d5210c1f26687, s.Struct)
+	return str
+}
+
+func (s RegisterUdpSessionResponse) Err() (string, error) {
+	p, err := s.Struct.Ptr(0)
+	return p.Text(), err
+}
+
+func (s RegisterUdpSessionResponse) HasErr() bool {
+	p, err := s.Struct.Ptr(0)
+	return p.IsValid() || err != nil
+}
+
+func (s RegisterUdpSessionResponse) ErrBytes() ([]byte, error) {
+	p, err := s.Struct.Ptr(0)
+	return p.TextBytes(), err
+}
+
+func (s RegisterUdpSessionResponse) SetErr(v string) error {
+	return s.Struct.SetText(0, v)
+}
+
+// RegisterUdpSessionResponse_List is a list of RegisterUdpSessionResponse.
+type RegisterUdpSessionResponse_List struct{ capnp.List }
+
+// NewRegisterUdpSessionResponse creates a new list of RegisterUdpSessionResponse.
+func NewRegisterUdpSessionResponse_List(s *capnp.Segment, sz int32) (RegisterUdpSessionResponse_List, error) {
+	l, err := capnp.NewCompositeList(s, capnp.ObjectSize{DataSize: 0, PointerCount: 1}, sz)
+	return RegisterUdpSessionResponse_List{l}, err
+}
+
+func (s RegisterUdpSessionResponse_List) At(i int) RegisterUdpSessionResponse {
+	return RegisterUdpSessionResponse{s.List.Struct(i)}
+}
+
+func (s RegisterUdpSessionResponse_List) Set(i int, v RegisterUdpSessionResponse) error {
+	return s.List.SetStruct(i, v.Struct)
+}
+
+func (s RegisterUdpSessionResponse_List) String() string {
+	str, _ := text.MarshalList(0xab6d5210c1f26687, s.List)
+	return str
+}
+
+// RegisterUdpSessionResponse_Promise is a wrapper for a RegisterUdpSessionResponse promised by a client call.
+type RegisterUdpSessionResponse_Promise struct{ *capnp.Pipeline }
+
+func (p RegisterUdpSessionResponse_Promise) Struct() (RegisterUdpSessionResponse, error) {
+	s, err := p.Pipeline.Struct()
+	return RegisterUdpSessionResponse{s}, err
+}
+
+type SessionManager struct{ Client capnp.Client }
+
+// SessionManager_TypeID is the unique identifier for the type SessionManager.
+const SessionManager_TypeID = 0x839445a59fb01686
+
+func (c SessionManager) RegisterUdpSession(ctx context.Context, params func(SessionManager_registerUdpSession_Params) error, opts ...capnp.CallOption) SessionManager_registerUdpSession_Results_Promise {
+	if c.Client == nil {
+		return SessionManager_registerUdpSession_Results_Promise{Pipeline: capnp.NewPipeline(capnp.ErrorAnswer(capnp.ErrNullClient))}
+	}
+	call := &capnp.Call{
+		Ctx: ctx,
+		Method: capnp.Method{
+			InterfaceID:   0x839445a59fb01686,
+			MethodID:      0,
+			InterfaceName: "tunnelrpc/tunnelrpc.capnp:SessionManager",
+			MethodName:    "registerUdpSession",
+		},
+		Options: capnp.NewCallOptions(opts),
+	}
+	if params != nil {
+		call.ParamsSize = capnp.ObjectSize{DataSize: 16, PointerCount: 2}
+		call.ParamsFunc = func(s capnp.Struct) error { return params(SessionManager_registerUdpSession_Params{Struct: s}) }
+	}
+	return SessionManager_registerUdpSession_Results_Promise{Pipeline: capnp.NewPipeline(c.Client.Call(call))}
+}
+func (c SessionManager) UnregisterUdpSession(ctx context.Context, params func(SessionManager_unregisterUdpSession_Params) error, opts ...capnp.CallOption) SessionManager_unregisterUdpSession_Results_Promise {
+	if c.Client == nil {
+		return SessionManager_unregisterUdpSession_Results_Promise{Pipeline: capnp.NewPipeline(capnp.ErrorAnswer(capnp.ErrNullClient))}
+	}
+	call := &capnp.Call{
+		Ctx: ctx,
+		Method: capnp.Method{
+			InterfaceID:   0x839445a59fb01686,
+			MethodID:      1,
+			InterfaceName: "tunnelrpc/tunnelrpc.capnp:SessionManager",
+			MethodName:    "unregisterUdpSession",
+		},
+		Options: capnp.NewCallOptions(opts),
+	}
+	if params != nil {
+		call.ParamsSize = capnp.ObjectSize{DataSize: 0, PointerCount: 1}
+		call.ParamsFunc = func(s capnp.Struct) error { return params(SessionManager_unregisterUdpSession_Params{Struct: s}) }
+	}
+	return SessionManager_unregisterUdpSession_Results_Promise{Pipeline: capnp.NewPipeline(c.Client.Call(call))}
+}
+
+type SessionManager_Server interface {
+	RegisterUdpSession(SessionManager_registerUdpSession) error
+
+	UnregisterUdpSession(SessionManager_unregisterUdpSession) error
+}
+
+func SessionManager_ServerToClient(s SessionManager_Server) SessionManager {
+	c, _ := s.(server.Closer)
+	return SessionManager{Client: server.New(SessionManager_Methods(nil, s), c)}
+}
+
+func SessionManager_Methods(methods []server.Method, s SessionManager_Server) []server.Method {
+	if cap(methods) == 0 {
+		methods = make([]server.Method, 0, 2)
+	}
+
+	methods = append(methods, server.Method{
+		Method: capnp.Method{
+			InterfaceID:   0x839445a59fb01686,
+			MethodID:      0,
+			InterfaceName: "tunnelrpc/tunnelrpc.capnp:SessionManager",
+			MethodName:    "registerUdpSession",
+		},
+		Impl: func(c context.Context, opts capnp.CallOptions, p, r capnp.Struct) error {
+			call := SessionManager_registerUdpSession{c, opts, SessionManager_registerUdpSession_Params{Struct: p}, SessionManager_registerUdpSession_Results{Struct: r}}
+			return s.RegisterUdpSession(call)
+		},
+		ResultsSize: capnp.ObjectSize{DataSize: 0, PointerCount: 1},
+	})
+
+	methods = append(methods, server.Method{
+		Method: capnp.Method{
+			InterfaceID:   0x839445a59fb01686,
+			MethodID:      1,
+			InterfaceName: "tunnelrpc/tunnelrpc.capnp:SessionManager",
+			MethodName:    "unregisterUdpSession",
+		},
+		Impl: func(c context.Context, opts capnp.CallOptions, p, r capnp.Struct) error {
+			call := SessionManager_unregisterUdpSession{c, opts, SessionManager_unregisterUdpSession_Params{Struct: p}, SessionManager_unregisterUdpSession_Results{Struct: r}}
+			return s.UnregisterUdpSession(call)
+		},
+		ResultsSize: capnp.ObjectSize{DataSize: 0, PointerCount: 0},
+	})
+
+	return methods
+}
+
+// SessionManager_registerUdpSession holds the arguments for a server call to SessionManager.registerUdpSession.
+type SessionManager_registerUdpSession struct {
+	Ctx     context.Context
+	Options capnp.CallOptions
+	Params  SessionManager_registerUdpSession_Params
+	Results SessionManager_registerUdpSession_Results
+}
+
+// SessionManager_unregisterUdpSession holds the arguments for a server call to SessionManager.unregisterUdpSession.
+type SessionManager_unregisterUdpSession struct {
+	Ctx     context.Context
+	Options capnp.CallOptions
+	Params  SessionManager_unregisterUdpSession_Params
+	Results SessionManager_unregisterUdpSession_Results
+}
+
+type SessionManager_registerUdpSession_Params struct{ capnp.Struct }
+
+// SessionManager_registerUdpSession_Params_TypeID is the unique identifier for the type SessionManager_registerUdpSession_Params.
+const SessionManager_registerUdpSession_Params_TypeID = 0x904e297b87fbecea
+
+func NewSessionManager_registerUdpSession_Params(s *capnp.Segment) (SessionManager_registerUdpSession_Params, error) {
+	st, err := capnp.NewStruct(s, capnp.ObjectSize{DataSize: 16, PointerCount: 2})
+	return SessionManager_registerUdpSession_Params{st}, err
+}
+
+func NewRootSessionManager_registerUdpSession_Params(s *capnp.Segment) (SessionManager_registerUdpSession_Params, error) {
+	st, err := capnp.NewRootStruct(s, capnp.ObjectSize{DataSize: 16, PointerCount: 2})
+	return SessionManager_registerUdpSession_Params{st}, err
+}
+
+func ReadRootSessionManager_registerUdpSession_Params(msg *capnp.Message) (SessionManager_registerUdpSession_Params, error) {
+	root, err := msg.RootPtr()
+	return SessionManager_registerUdpSession_Params{root.Struct()}, err
+}
+
+func (s SessionManager_registerUdpSession_Params) String() string {
+	str, _ := text.Marshal(0x904e297b87fbecea, s.Struct)
+	return str
+}
+
+func (s SessionManager_registerUdpSession_Params) SessionId() ([]byte, error) {
+	p, err := s.Struct.Ptr(0)
+	return []byte(p.Data()), err
+}
+
+func (s SessionManager_registerUdpSession_Params) HasSessionId() bool {
+	p, err := s.Struct.Ptr(0)
+	return p.IsValid() || err != nil
+}
+
+func (s SessionManager_registerUdpSession_Params) SetSessionId(v []byte) error {
+	return s.Struct.SetData(0, v)
+}
+
+func (s SessionManager_registerUdpSession_Params) DstIp() ([]byte, error) {
+	p, err := s.Struct.Ptr(1)
+	return []byte(p.Data()), err
+}
+
+func (s SessionManager_registerUdpSession_Params) HasDstIp() bool {
+	p, err := s.Struct.Ptr(1)
+	return p.IsValid() || err != nil
+}
+
+func (s SessionManager_registerUdpSession_Params) SetDstIp(v []byte) error {
+	return s.Struct.SetData(1, v)
+}
+
+func (s SessionManager_registerUdpSession_Params) DstPort() uint16 {
+	return s.Struct.Uint16(0)
+}
+
+func (s SessionManager_registerUdpSession_Params) SetDstPort(v uint16) {
+	s.Struct.SetUint16(0, v)
+}
+
+func (s SessionManager_registerUdpSession_Params) CloseAfterIdleHint() int64 {
+	return int64(s.Struct.Uint64(8))
+}
+
+func (s SessionManager_registerUdpSession_Params) SetCloseAfterIdleHint(v int64) {
+	s.Struct.SetUint64(8, uint64(v))
+}
+
+// SessionManager_registerUdpSession_Params_List is a list of SessionManager_registerUdpSession_Params.
+type SessionManager_registerUdpSession_Params_List struct{ capnp.List }
+
+// NewSessionManager_registerUdpSession_Params creates a new list of SessionManager_registerUdpSession_Params.
+func NewSessionManager_registerUdpSession_Params_List(s *capnp.Segment, sz int32) (SessionManager_registerUdpSession_Params_List, error) {
+	l, err := capnp.NewCompositeList(s, capnp.ObjectSize{DataSize: 16, PointerCount: 2}, sz)
+	return SessionManager_registerUdpSession_Params_List{l}, err
+}
+
+func (s SessionManager_registerUdpSession_Params_List) At(i int) SessionManager_registerUdpSession_Params {
+	return SessionManager_registerUdpSession_Params{s.List.Struct(i)}
+}
+
+func (s SessionManager_registerUdpSession_Params_List) Set(i int, v SessionManager_registerUdpSession_Params) error {
+	return s.List.SetStruct(i, v.Struct)
+}
+
+func (s SessionManager_registerUdpSession_Params_List) String() string {
+	str, _ := text.MarshalList(0x904e297b87fbecea, s.List)
+	return str
+}
+
+// SessionManager_registerUdpSession_Params_Promise is a wrapper for a SessionManager_registerUdpSession_Params promised by a client call.
+type SessionManager_registerUdpSession_Params_Promise struct{ *capnp.Pipeline }
+
+func (p SessionManager_registerUdpSession_Params_Promise) Struct() (SessionManager_registerUdpSession_Params, error) {
+	s, err := p.Pipeline.Struct()
+	return SessionManager_registerUdpSession_Params{s}, err
+}
+
+type SessionManager_registerUdpSession_Results struct{ capnp.Struct }
+
+// SessionManager_registerUdpSession_Results_TypeID is the unique identifier for the type SessionManager_registerUdpSession_Results.
+const SessionManager_registerUdpSession_Results_TypeID = 0x8635c6b4f45bf5cd
+
+func NewSessionManager_registerUdpSession_Results(s *capnp.Segment) (SessionManager_registerUdpSession_Results, error) {
+	st, err := capnp.NewStruct(s, capnp.ObjectSize{DataSize: 0, PointerCount: 1})
+	return SessionManager_registerUdpSession_Results{st}, err
+}
+
+func NewRootSessionManager_registerUdpSession_Results(s *capnp.Segment) (SessionManager_registerUdpSession_Results, error) {
+	st, err := capnp.NewRootStruct(s, capnp.ObjectSize{DataSize: 0, PointerCount: 1})
+	return SessionManager_registerUdpSession_Results{st}, err
+}
+
+func ReadRootSessionManager_registerUdpSession_Results(msg *capnp.Message) (SessionManager_registerUdpSession_Results, error) {
+	root, err := msg.RootPtr()
+	return SessionManager_registerUdpSession_Results{root.Struct()}, err
+}
+
+func (s SessionManager_registerUdpSession_Results) String() string {
+	str, _ := text.Marshal(0x8635c6b4f45bf5cd, s.Struct)
+	return str
+}
+
+func (s SessionManager_registerUdpSession_Results) Result() (RegisterUdpSessionResponse, error) {
+	p, err := s.Struct.Ptr(0)
+	return RegisterUdpSessionResponse{Struct: p.Struct()}, err
+}
+
+func (s SessionManager_registerUdpSession_Results) HasResult() bool {
+	p, err := s.Struct.Ptr(0)
+	return p.IsValid() || err != nil
+}
+
+func (s SessionManager_registerUdpSession_Results) SetResult(v RegisterUdpSessionResponse) error {
+	return s.Struct.SetPtr(0, v.Struct.ToPtr())
+}
+
+// NewResult sets the result field to a newly
+// allocated RegisterUdpSessionResponse struct, preferring placement in s's segment.
+func (s SessionManager_registerUdpSession_Results) NewResult() (RegisterUdpSessionResponse, error) {
+	ss, err := NewRegisterUdpSessionResponse(s.Struct.Segment())
+	if err != nil {
+		return RegisterUdpSessionResponse{}, err
+	}
+	err = s.Struct.SetPtr(0, ss.Struct.ToPtr())
+	return ss, err
+}
+
+// SessionManager_registerUdpSession_Results_List is a list of SessionManager_registerUdpSession_Results.
+type SessionManager_registerUdpSession_Results_List struct{ capnp.List }
+
+// NewSessionManager_registerUdpSession_Results creates a new list of SessionManager_registerUdpSession_Results.
+func NewSessionManager_registerUdpSession_Results_List(s *capnp.Segment, sz int32) (SessionManager_registerUdpSession_Results_List, error) {
+	l, err := capnp.NewCompositeList(s, capnp.ObjectSize{DataSize: 0, PointerCount: 1}, sz)
+	return SessionManager_registerUdpSession_Results_List{l}, err
+}
+
+func (s SessionManager_registerUdpSession_Results_List) At(i int) SessionManager_registerUdpSession_Results {
+	return SessionManager_registerUdpSession_Results{s.List.Struct(i)}
+}
+
+func (s SessionManager_registerUdpSession_Results_List) Set(i int, v SessionManager_registerUdpSession_Results) error {
+	return s.List.SetStruct(i, v.Struct)
+}
+
+func (s SessionManager_registerUdpSession_Results_List) String() string {
+	str, _ := text.MarshalList(0x8635c6b4f45bf5cd, s.List)
+	return str
+}
+
+// SessionManager_registerUdpSession_Results_Promise is a wrapper for a SessionManager_registerUdpSession_Results promised by a client call.
+type SessionManager_registerUdpSession_Results_Promise struct{ *capnp.Pipeline }
+
+func (p SessionManager_registerUdpSession_Results_Promise) Struct() (SessionManager_registerUdpSession_Results, error) {
+	s, err := p.Pipeline.Struct()
+	return SessionManager_registerUdpSession_Results{s}, err
+}
+
+func (p SessionManager_registerUdpSession_Results_Promise) Result() RegisterUdpSessionResponse_Promise {
+	return RegisterUdpSessionResponse_Promise{Pipeline: p.Pipeline.GetPipeline(0)}
+}
+
+type SessionManager_unregisterUdpSession_Params struct{ capnp.Struct }
+
+// SessionManager_unregisterUdpSession_Params_TypeID is the unique identifier for the type SessionManager_unregisterUdpSession_Params.
+const SessionManager_unregisterUdpSession_Params_TypeID = 0x96b74375ce9b0ef6
+
+func NewSessionManager_unregisterUdpSession_Params(s *capnp.Segment) (SessionManager_unregisterUdpSession_Params, error) {
+	st, err := capnp.NewStruct(s, capnp.ObjectSize{DataSize: 0, PointerCount: 1})
+	return SessionManager_unregisterUdpSession_Params{st}, err
+}
+
+func NewRootSessionManager_unregisterUdpSession_Params(s *capnp.Segment) (SessionManager_unregisterUdpSession_Params, error) {
+	st, err := capnp.NewRootStruct(s, capnp.ObjectSize{DataSize: 0, PointerCount: 1})
+	return SessionManager_unregisterUdpSession_Params{st}, err
+}
+
+func ReadRootSessionManager_unregisterUdpSession_Params(msg *capnp.Message) (SessionManager_unregisterUdpSession_Params, error) {
+	root, err := msg.RootPtr()
+	return SessionManager_unregisterUdpSession_Params{root.Struct()}, err
+}
+
+func (s SessionManager_unregisterUdpSession_Params) String() string {
+	str, _ := text.Marshal(0x96b74375ce9b0ef6, s.Struct)
+	return str
+}
+
+func (s SessionManager_unregisterUdpSession_Params) SessionId() ([]byte, error) {
+	p, err := s.Struct.Ptr(0)
+	return []byte(p.Data()), err
+}
+
+func (s SessionManager_unregisterUdpSession_Params) HasSessionId() bool {
+	p, err := s.Struct.Ptr(0)
+	return p.IsValid() || err != nil
+}
+
+func (s SessionManager_unregisterUdpSession_Params) SetSessionId(v []byte) error {
+	return s.Struct.SetData(0, v)
+}
+
+// SessionManager_unregisterUdpSession_Params_List is a list of SessionManager_unregisterUdpSession_Params.
+type SessionManager_unregisterUdpSession_Params_List struct{ capnp.List }
+
+// NewSessionManager_unregisterUdpSession_Params creates a new list of SessionManager_unregisterUdpSession_Params.
+func NewSessionManager_unregisterUdpSession_Params_List(s *capnp.Segment, sz int32) (SessionManager_unregisterUdpSession_Params_List, error) {
+	l, err := capnp.NewCompositeList(s, capnp.ObjectSize{DataSize: 0, PointerCount: 1}, sz)
+	return SessionManager_unregisterUdpSession_Params_List{l}, err
+}
+
+func (s SessionManager_unregisterUdpSession_Params_List) At(i int) SessionManager_unregisterUdpSession_Params {
+	return SessionManager_unregisterUdpSession_Params{s.List.Struct(i)}
+}
+
+func (s SessionManager_unregisterUdpSession_Params_List) Set(i int, v SessionManager_unregisterUdpSession_Params) error {
+	return s.List.SetStruct(i, v.Struct)
+}
+
+func (s SessionManager_unregisterUdpSession_Params_List) String() string {
+	str, _ := text.MarshalList(0x96b74375ce9b0ef6, s.List)
+	return str
+}
+
+// SessionManager_unregisterUdpSession_Params_Promise is a wrapper for a SessionManager_unregisterUdpSession_Params promised by a client call.
+type SessionManager_unregisterUdpSession_Params_Promise struct{ *capnp.Pipeline }
+
+func (p SessionManager_unregisterUdpSession_Params_Promise) Struct() (SessionManager_unregisterUdpSession_Params, error) {
+	s, err := p.Pipeline.Struct()
+	return SessionManager_unregisterUdpSession_Params{s}, err
+}
+
+type SessionManager_unregisterUdpSession_Results struct{ capnp.Struct }
+
+// SessionManager_unregisterUdpSession_Results_TypeID is the unique identifier for the type SessionManager_unregisterUdpSession_Results.
+const SessionManager_unregisterUdpSession_Results_TypeID = 0xf24ec4ab5891b676
+
+func NewSessionManager_unregisterUdpSession_Results(s *capnp.Segment) (SessionManager_unregisterUdpSession_Results, error) {
+	st, err := capnp.NewStruct(s, capnp.ObjectSize{DataSize: 0, PointerCount: 0})
+	return SessionManager_unregisterUdpSession_Results{st}, err
+}
+
+func NewRootSessionManager_unregisterUdpSession_Results(s *capnp.Segment) (SessionManager_unregisterUdpSession_Results, error) {
+	st, err := capnp.NewRootStruct(s, capnp.ObjectSize{DataSize: 0, PointerCount: 0})
+	return SessionManager_unregisterUdpSession_Results{st}, err
+}
+
+func ReadRootSessionManager_unregisterUdpSession_Results(msg *capnp.Message) (SessionManager_unregisterUdpSession_Results, error) {
+	root, err := msg.RootPtr()
+	return SessionManager_unregisterUdpSession_Results{root.Struct()}, err
+}
+
+func (s SessionManager_unregisterUdpSession_Results) String() string {
+	str, _ := text.Marshal(0xf24ec4ab5891b676, s.Struct)
+	return str
+}
+
+// SessionManager_unregisterUdpSession_Results_List is a list of SessionManager_unregisterUdpSession_Results.
+type SessionManager_unregisterUdpSession_Results_List struct{ capnp.List }
+
+// NewSessionManager_unregisterUdpSession_Results creates a new list of SessionManager_unregisterUdpSession_Results.
+func NewSessionManager_unregisterUdpSession_Results_List(s *capnp.Segment, sz int32) (SessionManager_unregisterUdpSession_Results_List, error) {
+	l, err := capnp.NewCompositeList(s, capnp.ObjectSize{DataSize: 0, PointerCount: 0}, sz)
+	return SessionManager_unregisterUdpSession_Results_List{l}, err
+}
+
+func (s SessionManager_unregisterUdpSession_Results_List) At(i int) SessionManager_unregisterUdpSession_Results {
+	return SessionManager_unregisterUdpSession_Results{s.List.Struct(i)}
+}
+
+func (s SessionManager_unregisterUdpSession_Results_List) Set(i int, v SessionManager_unregisterUdpSession_Results) error {
+	return s.List.SetStruct(i, v.Struct)
+}
+
+func (s SessionManager_unregisterUdpSession_Results_List) String() string {
+	str, _ := text.MarshalList(0xf24ec4ab5891b676, s.List)
+	return str
+}
+
+// SessionManager_unregisterUdpSession_Results_Promise is a wrapper for a SessionManager_unregisterUdpSession_Results promised by a client call.
+type SessionManager_unregisterUdpSession_Results_Promise struct{ *capnp.Pipeline }
+
+func (p SessionManager_unregisterUdpSession_Results_Promise) Struct() (SessionManager_unregisterUdpSession_Results, error) {
+	s, err := p.Pipeline.Struct()
+	return SessionManager_unregisterUdpSession_Results{s}, err
+}
+
+const schema_db8274f9144abc7e = "x\xda\xccY{p\x14e\xb6?\xa7{&\x9d@\x86" +
+	"IW\x0f\x04\xa6\xe4\xe6^\x0a\xcaK\x14\x14\xb8\xdeB" +
+	"\xae\xde\x04L\xb8&\xf2H\xcf\x90\xbb\x96\xa0eg\xe6" +
+	"#tv\xa6{\xe8\xee\x89\x04A\x1e\x82\x88\xe5\x0b\x04" +
+	"E\x94\x95\xc5r\xb7D\xdd\x85U\xd7eKke\xd7" +
+	"\x17\xa5\xa8X\xb8\x05\x8a\xb5\xab\xc8>(\\W\xc4\xb5" +
+	"\xdcu\xed\xad\xd3=\xfd\xc8$$A\xf6\x8f\xfdor" +
+	"\xfa\xfb\xcew\xce\xef\xfc\xbes\xcewr\xe9w*\x1b" +
+	"\xb9)\xd1\xda\x18\x80\xbc-Za\xb3\xfaw\x96\xef\x9c" +
+	"\xf0\xab\xb5 '\x11\xed[\x9eoM|e\xad}\x1f" +
+	"\xa2\xbc\x000mi\xc5r\x94\xd6W\x08\x00\xd2\x9a\x8a" +
+	"\xdf\x03\xda\xb7\x8d\xda\xf3\xc8c\xcd[n\x051\xc9\x07" +
+	"\x8b\x01\xa71\xa1\x15\xa5\x1e\x81V\x16\x85\x0d\xd2\xbb\xf4" +
+	"\xcb\xbeF\xbcda\xe2\xed7iuXu\x84T\xbf" +
+	" \xd4\xa3t\xd0\xd9p@ \xd5W\xe4\xdf\xda\xf5\xdf" +
+	"[__\x07b\x92\xeb\xa5\xfa\xd9\xca\xe5(\x1d\xa8\xa4" +
+	"\x95/W\xce\x07\xb4?\xdf2\xfa\x89\xef\xbf\xf9\xdaz" +
+	"\x10/D(Y\xfaA\xe5{\x08(}V\xf9c@" +
+	"\xfb\xe0\x17\x0b\xcf<\xf3\xcae\xb7\x818\x91\x16 -" +
+	"\xd8T5\x8e\x03\x94\x1e\xafj\x00\xb4O\x9e\xfa\xdb\x86" +
+	"\x9b'\xce\xbb\x17\xe4\x89\xc8\x01D9Zq\xa0*I" +
+	"+>\xac\"k\x1af\x1f\xdc\x97\x9cv\xff\x962\xd3" +
+	"\x9d\x85\xfb\x87\xd5\xa3th\x18\x19tp\xd8M\x80\xf6" +
+	"_F<\xf4f\xf1\xaa\xe7\xee\x0f\x9f7ex=i" +
+	"k\x19N\xe7\x8d\xeb\x9ep\xe3/_~\xfa\x01\x90'" +
+	"!\xda\xc7:.z\x97\xdf\xb1\xfb}hG\x81\x8e\x9f" +
+	"\x96\x1f\xbe\x8b\x8c_9\x9c\x94\xbdu\xf1\xf3?\xbf\xf7" +
+	"\xe9\x0d\x0f\x81|!\"\x80\x03\xd6\x87\xc3\xffJ\x0b\xbe" +
+	"p\x94m9\xf2\xc2\xbc\xfc\xa6\xed\xbb\\\xf7\x9d\xefc" +
+	"\xab9\x0e\"\xf6\xba\x96/\xf3\xed\x8f\xa6\x1f-\x01\x13" +
+	"\xa5Ob\xf5i\x04\x9c6\xa1\xba\x0e\x01\xed\xcb\xde;" +
+	"1\x7f\xeeO\x16\xff0\xb4wfl9\xed\xdd\xb0\xf8" +
+	"\xf4\xfe\x9aT\xfe\x892\x87\x1d_\xae\x8c\xedF\xa9=" +
+	"F\x0e\xcb12\xe1\xa9\x7f\xbb\xa6j\xd9\x89\xd9{@" +
+	"\x9c\xe4\xa9Y\x1aK\x91\x9a\xc8\xf5\xfc7\xca\xb6_<" +
+	"SN'\x07\xb8|\xac\x03\xa55\xa4g\xda\xca\x98c" +
+	"\xcf\x1d\xfb\xb7_T\xf9\xc8\xe7\xcf\xf6\x07\xf3c#:" +
+	"P\xda7\x82N}v\x04!3\xb2\x05\x8f\xbd8%" +
+	"\xf2\\8\xee#\xe3'\x09\x99\x89q\x8a\xfb\xd8Of" +
+	"\xc5\xb4O\xd7\xbeX\xa6\xcdYx \xde\x8a\xd2\x07q" +
+	"\xd2v\xd4Y\xdc\xba\xf0\xbe\xcd\xd1\x13\xf7\xbdJ\x96\x86" +
+	"\x08\x17%\xa2M+\xd6\x18(m\xac\xa1\x9f\xebkj" +
+	"y@;\xb9\xe7\x7f~4+{\xf4\xf5~,\x95\xa2" +
+	"\x89\xd3\x92\x98\xa0_\xb1\x04\x19z|\xd2\xde\x9b\xffx" +
+	"\xd7\xa1\xc3%C\x1d\x0c\xd5\x84\x13\xc2\x95\x09\xc2\xcfg" +
+	"@\x19J\xce\xca\x1d\x89.\x94\xf6:\xea\x9erVs" +
+	"'\x941\xab\x7f\xfd\xbf\xc7BA\xdb\x9b\xf8\x08!b" +
+	"\xcf\xfb\xff\x85]U+\x8f\x1f\x0f\x1f\xf4X\xc2Ad" +
+	"\x9f\xb3\xf5O?8y\xcf\xa9|\xf6w\x0e\xf1<\xcc" +
+	"\x8e&f\x105?K\x10\xd1k\xebb\xcd\xe3\x8e\xb4" +
+	"\x9dtC\xe9\xaa88r\x16-81\x92T\\v" +
+	"\xe3L\xb6h\xfa\xb5'\xfb\\\xf9\xe8\xa8\x19(\x8d\x1c" +
+	"\xe5\x90l\xd4\x06\x94&\xd6\xd6\x02\xd8\xdd?\xddt\xed" +
+	"\x13/\xcd;\xed\xde\x05\xc7\xd81\xb5S\x89\x1aw\xdf" +
+	"\xd24\xff\xf2q\xfbO\x87\x8d\x15k\x89\x9d\xd2\x84Z" +
+	":i\xf1\xf4S\xff7\xe1\xeeWN\xf7G\xc1\xe6\xda" +
+	"z\x94\xdak\x1d\x0a\xd2\xe2Og\x7f\xefp2\x9e<" +
+	"S\x06`\x85\x13\xbc\xda.\x946\xd6:\xc1\xab}\x95" +
+	"hv\xdb\xfb7,{\xe7\xd6\xcf\xbf(\x8f\xb5\xa3\xba" +
+	"gL\x0a\xa5\xbb\xc6\x90\xea\x8dc\x88\x19\x0f,\xf8\xc3" +
+	"\xaaS[G}\xd9\xc7\xe3\x89\xc9.\x94\xaeL\xd2\xca" +
+	"\xcb\x93\x1b\xa4\x07\xe9\x97\xfd\xb6\xf0\xe8\x94\xa6U\xaf\x7f" +
+	"\x15\xba\x0bk\x92\xad\xe4\xf0\xfd\xc2\xc3\xc7W\xff\xe6\x86" +
+	"\xaf\xc3\x0e\xafL~D\x0eoJ\x92\xc3+>}\xf0" +
+	"\xea{\x16=\xf9M8\xb0\xc9\xb5\xb4\xd5*j\x1a\xcb" +
+	"\x19\x85H\xe6\x12\xefgfrF)h\x85\x193\x8b" +
+	"\xd6\x12\xa6YjF\xb1X\x8a5\x98\x05]3Y\x1b" +
+	"\xa2\\\xc3G\x00\"\x08 *]\x00\xf2\x8d<\xca9" +
+	"\x0eE\xc4\x04\x85^TI\xb8\x84G\xd9\xe2P\xe4\xb8" +
+	"\x04e\x1eq\xe98\x009\xc7\xa3\xbc\x8cC\xe4\x13\xc8" +
+	"\x03\x88\xc5\xcd\x00\xf22\x1e\xe5u\x1c\xda\x05f\xe4\x15" +
+	"\x8di\x10\xb7\x9a\x0d\x03\xab\x81\xc3j@\xdb`\x96\xd1" +
+	"\xa3t\xe4 \xceBb\xa1\xeb&\x0bc\xc0a\x0c\xd0" +
+	"^\xa2\x17\x0d\xb3]\xb3P\xcd\xa5\xd8b\x83\x99\xb8\x04" +
+	"+\x80\xc3\x0a\xc0\x81\xdcK3\xd3Tum\xae\xa2)" +
+	"\x9d\xcc\x00 \xcf*\xf9(\x80\x9f\xb4\xd1K\xef\xe2\x94" +
+	"\xed\xc0\x89\x93\x04\x0c20z\xf4\x13\xffc7p\xe2" +
+	"X\xc16X\xa7jZ\xcc\xc0\xf6l\xc1\xd1\xcd\xebZ" +
+	"#\xdaE\xcd\xfd\x80\xccp?\xc4\xe9\xd4Fl\xc3\xc0" +
+	":\xbe\xafuW\xe5T\xa6Y\xf1\x16m\xb1^\x06y" +
+	"k\x7f\x90\xb7\x96 _\x17\x82|\xcd,\x00y\x05\x8f" +
+	"\xf2\xed\x1c\x8a|\x09\xf3\xf5\xf5\x00\xf2j\x1e\xe5;9" +
+	"\xb43\xce!-Y\x00\xf0\xd1\\\xcc\x14\xabh0\x93" +
+	"d#\x00\xdbxt@\x1f\x01\xb8\xaa\x9b\x19d\xbb\x17" +
+	"\x84\xb8bd\x96\xf8\x81\x1a\x00\xe9\xe6e\xaai\xa9Z" +
+	"\xe7\x02G\xde\xd0\xa6\xe7\xd4L\x0fyU\xed\xd89v" +
+	"\x06\x00\xa28\xf2:\x00\xe4Dq\x16@\x83\xda\xa9\xe9" +
+	"\x06\xb3\xb3\xaa\x99\xd15\x8d\x01\x9f\xb1Vu(9E" +
+	"\xcb0\xff\xa0\x8a\xbe\x07\xb9\x07\xa4\x99\xd1\xcd\x8c\xc9J" +
+	"\x88\xbe\xe3\xdb\x14C\xe1\xf3\xa6\\\xed\xe3\xd8|\x1d\x80" +
+	"\xdc\xc4\xa3\xdc\x16\xc2q.\xe18\x87G\xf9\xda\x10\x8e" +
+	"\xed\x84c\x1b\x8f\xf2\"\x0em\xddP;U\xed*\x06" +
+	"\xbc\x11f\xa0iiJ\x9e\x11f%<V\xe9\x05K" +
+	"\xd55\x13k\x82\xfc\x0f\x885!\xa4\x84\xc189\xd9" +
+	"\xa3\x94\xc7(]\x1b\x9fbfQ\xc8Y\xa6\x1c\xf1=" +
+	"\x89\xcd\x00\x90+y\x94\x13\x1c6\x18\xcc,\xe6,\xac" +
+	"\x09\xca\xec?\xe3T\x0f\xbe\x10\x0dS\xfd\xd1p*\x80" +
+	"\x9c\xe5Q.p\x88%\xf4\xf2\xb3B\xd9\x80G\x97\x85" +
+	"K\xb7\x03\xc8\x16\x8f\xf2j\x0em\xd3=\xa4\x050\xeb" +
+	"!Z\x975\xad\x96\x82\xf7\xd7\xaa\xaci\xb5\xe9\x86\x85" +
+	"\x02p(\x00\xf1V7\xd9\xcc\xc5t\xa7Z\xb29v" +
+	"\xb5\xcak\x16F\x81\xc3(\x0cx\xa9\\~\xc4)\xb1" +
+	"\xb9\xb7\xdd\xf3f\"\x91\xe1?y\x94\xff+\xe4\xcd\x14" +
+	"\xcac\x97\xf2(_\xc1\xa1\xadd2zQ\xb3\x16\x00" +
+	"\xaft\x96q>\xcd \x9e1X@\x87\xa1C\xed%" +
+	"\x872\xb0\xe3\x86\x92\xef\x15a\x02\xbb\x9aGyt\xff" +
+	"p\xf9'F\xfbI$t\x812\xc4\xc5\x14sS\xf8" +
+	"d\x83\x99B1g\x91\xff\xd5\xb6\xed\x02@\x91\x1b\xcf" +
+	"\xa3|)\x871\xfc\xc6v\x11\x98\xb49@\xa0\x8e\x19" +
+	"\x86n`MP\xe2J\xc4\xca\x94\x0e@]kb\x96" +
+	"\xa2\xe6\x90H\xef\xf7[e\xf4\x1b\xec\xd6\x06\x88\xb8\xe2" +
+	"\xf1\x0d\xc4\xbd\xdeh\x10yjx\x94/\xe0\xd0\xee4" +
+	"\x94\x0ckc\x06\xaazv\x9e\xa2\xe9i\x9ee\xfaP" +
+	"a\xc4\xb9\x1e\x9arn\x91\x09\xfe\xae\x81\xf7\x1b\xac\x04" +
+	"Bi{[\x9dks\xc2\xb7y\xe5\xb8\xa0\xd4\xf9\x04" +
+	"[\xd3\x11\xe4b?\xdbl$*\xde\xce\xa3\xbc%\x94" +
+	"\xb57Q^\xba\x97G\xf9a\x0e\xc5H$\x81\x11\x00" +
+	"\xf1A\xbaY[x\x94wr\xbd\x0b\"\xebf\x9a\xd5" +
+	"\xa4v\x82\xc0\xcc@J&6\xa9\x9d\x0cx\xf3|3" +
+	"W\xe5 x\xe8\x1d\xa6\x9ec\x16kb\x99\x9cb(" +
+	"\x96\xda\xcd\xdc\xef%2zA\x1d\x88\xb7\xa9>\x17\x83" +
+	"\xf8\x1b\xf7z\x90\x10\x1d\xc6\x05\xe9O`\xa1\xd6a\x00" +
+	"k]\xe5d\x99\xae\xf5\xe1@pcJ<@s\xa0" +
+	"\xea\x16,\x9f_\xb0TA\xd7L\xb2/\x14\xfa\x19\xfd" +
+	"\x85\xde\x08B\xefe\xca\x8dk\xc3\x91/e\xcaM\xdb" +
+	"\x83 \x8b\x11\xce\x8d\xfc\x8e]\x00\xf2N\x1e\xe5'9" +
+	"lp\x8b8\xd6\x04\x8f\xe0R\xb4\xdcR5G\x87\xba" +
+	"\x8c\x92\x0b\xb2\xa9m\xb0BN\xc9\xb0f,\x95e@" +
+	"\x04\x0e\xd1\xa1H\xbe`0\xd3DU\xd7\xe4\xa2\x92S" +
+	"y\xab\xc7o\xa5\xb4b\xbe\xcd`\xdd*\xeaEs\xa6" +
+	"e\xb1\xbcP\xb0\xcc\xa14Z\x01@\x94\x1f\x045g" +
+	"\x96%\xdf\xfa \xf7\xf8\x00M\xa2\xe4{1\x8f\xf2t" +
+	"\x0e\xe3\xc5\xa2\x1a\xe4\xba\x9c\x9eq\xe2\x06\xf1yJ\x9e" +
+	"\xf5\x89v\xc5\xa0w\xb5\xd7M\xf7\x92\xed\xbfRc0" +
+	"p/N\xae;\xcdj\xc8d\xba\x02\x8d<\xcasB" +
+	"&\xb7L\x0d\xf9\xe1\x99<\xb7#\xf0C\xf8.\xeb\xf1" +
+	"\xac\xaacy\xca\xdc\x1e\x98%gf\x82pM\xb0f" +
+	" \xfb\xc2\x17j~\xa1\xce\xf1\x90l\x9c\xee\xd9(\xf5" +
+	"`+@z\x19\xf2\x98^\x87\x81\x99\xd2\x1a\x9c\x05\x90" +
+	"^A\xf2\xdb1\xb0TZ\x8fI\x80\xf4j\x92\xdf\x89" +
+	"\xfe\x9bA\xda\x88\xbb\x01\xd2w\x92x\x1b-\x8f\xf0\xce" +
+	"\x95\x90\xb6:\xea\xb7\x90|'\xc9\xa3\x91\x04F\x01\xa4" +
+	"\x1dX\x0f\x90\xdeF\xf2gH^\xc1%\xb0\x02@\xda" +
+	"\x8b]\x00\xe9=$\x7f\x9e\xe4B4A\xcf&i\x1f" +
+	"\x1a\x00\xe9\x9f\x91\xfc%\x92W\x8eN`%\x80\xb4\xdf" +
+	"\x91\xbfH\xf27H^5&\x81U\x00\xd2\x01\\\x0b" +
+	"\x90~\x8d\xe4\x87I>\x0c\x138\x0c@:\x84\xdb\x01" +
+	"\xd2\x87I\xfe[\x92\x0f\xafH\xe0p\x00\xe9\x03\xc7\x9e" +
+	"#$\xff\x98\xe4\xd5\x91\x04V\x03H\x1f\xe2.\x80\xf4" +
+	"\xc7$\xff3\xc9cB\x02c\x00\xd2'\x8e_\xa7H" +
+	"^\xc9\x95\xb5\xec\x1e\xa3\xca\xfar^7\xfd\x90\xb1\xd2" +
+	"\x1dG\x97\xeemz\x9czo\x8c\x07C0@\x8c\x03" +
+	"\xda\x05]\xcf\xcd\xeb\xcd\xd4\xb8\xa5t\x9a\xde\x1b\xa0&" +
+	"\x98K\x00\x92\xd0\xaf\xfb\x10\xd7\xb5\x96\xac\x9f\x08\xca\xb3" +
+	"\x8eg\x89j\xce,Zz\xb1\x00uY\xc5bY?" +
+	"\xe7\x18Em\xb6\xa1\xe7\x17 3\xf2\xaa\xa6\xe4\x06\xc9" +
+	"FU\xc0a\x15\x94R\x82\xa7{\xe0\xd4t\xf6\x17\x8d" +
+	"\xcfh\xae\x9c\xd1u\x85\x19\x0b\x94\xce\xa1\xe4\xa9\xa9A" +
+	"\xe7\x18\xd7B\x09\xa9\xae[\xc9\x15\xbfMz\xea\xddJ" +
+	"\xa4\x1a\xdcVd\xb0~\xdf\x1bS\x0c\x9eJz7\x84" +
+	"\xbd\x0b*\x86&\x88t\x0eW\xd2?d\xf3;\x99\xe5" +
+	"\xfe\xa2\x87+=\x1b\x84p\x99?\xb7\xdd)f\xc6\x87" +
+	"\xe2z0\xce\x19\xfc\xa9\xd3O\xe1\xef\xa7\xec{=g" +
+	"\xe8\xb9C\xb1_\xc4\xa3\xbc$\x14{\xd6\xda\xcfs'" +
+	"\x15\xcc9D\x9e+\x0d:\xa8P\x14x\x94Wp\x18" +
+	"\xa7w)\xd6\x04s\xdf^F\xf7~\x8b\x13\x15Z\xb4" +
+	",\x03\\\xe6\xb19T>\xfc\x09\xe8\xe0\xdd\xd9\xd0\xdc" +
+	"\xf6\xba\xdeA\x01\xf7\xa7\x8ae'\x9f\xf5\xc9\xd5\xe0\x1e" +
+	"J<\x1b\xed\x8cX\xbc\x09+z\xb3:q\xefr\xe0" +
+	"\xc4\xc7\x05\x0c\xa6\x90\xe8\x0d\x1d\xc5\x1d\x06p\xe2V\x01" +
+	"9\x7ff\x8d\xdelZ\xdcx\x07p\xe2z\x01y\x7f" +
+	"\xe4\x8c\xde\xb4kJ\xcf0\x04N\\)`\xc4\x1f\xe5" +
+	"\xa37+\x13\x97v\x01'\xaa\x02F\xfdi6z\xe3" +
+	"T\xf1\xfa\xb5\xc0\x89\xed\xc1L\x07\x1a\\?\x1a\xd1\xf6" +
+	"8\x0au\x0eK{Ox\xdcU\x00\x8dh{=0" +
+	"\x7f\xb6&\xd8Y\xe5\x0d) \x9eQ,\xd6H\xcd\x99" +
+	"{\xff\xb1\x94\x00\xa0\x11\xe5\x08\x86F\x85\x00\xe7\xfb\xbe" +
+	"L\xb1:'\xce\xdf\xb6e\xf2\xf6\x7f\xcb\x94\xc4\xf7g" +
+	"5\x9d\xe3\x0f\xbbBz\xbbB\x0f\xdfA\x1a\xbf\xc8\xd9" +
+	"\xbc\xf0\xc8\x1f\xa7\xcd\xa4\xff\xdf}\xfd\x87\xa8qz\x83" +
+	"G\xf9H\xe8Z\xbfK\xc2\xb7y\x94\x8f\x85\x1a\xa7\xa3" +
+	"t\xd7\x8f\xf0(\x9f\x09\xe6\x97\x9f\xdd\x01 \x9f\xe11" +
+	"\x15jD\xc4\xbf\xd3\xc2\xaf\xa9\\;m\x08\xbamH" +
+	"\x147\x03\xa4+\xa9\x8c'\x9c6$\xe2\xb6!\"v" +
+	"\x00\xa4kH~A\xb8\x0d\x19\x83\xd7\x01\xa4G\x93|" +
+	"<\xf6~\xd7\x08E#h\xd4rz\xe7\x1cU\xeb\xb7" +
+	"\xb6y\x03U\xb4f+j\xaeh0\x08Jk)\xd9" +
+	"4\x85\xaa\xbd;iu\x87*i\"a\x16M\x7f\xe0" +
+	"r\x0e/\xca!U\x9ef\xc3\xd0\xd1(kb\xa7\x06" +
+	"M\xac\xdf\xc3R/~5\x8f\xf2\x02\x0aE\xa3\x1b\x0a" +
+	"\xb9#h\xbb\xeb2J\xd1d}|\x00\x9e\x19\xfe\x14" +
+	"\xc0\\\xa2\x17s\xd9\x14\x03\xc12z\xca \x18\xb4\x99" +
+	"M\xb3\xb8\x97\xb9\xdc\xe1\xb0\xf7\x8f\x0e\xf4\xfe\x9f\x11\x1a" +
+	"\x0e{\x13z\xf4\xfem\xd5w8\xeca\xd0g8\xec" +
+	"~p8\xda{8|\x1e\xcfW\xb7\x8c\x852\xc69" +
+	"\xcdL\x87<j\xf4\xff\xb3[v\xd3\xab\xcewL\xe0" +
+	"\x15\xa4\x7f\x04\x00\x00\xff\xff\xa5\x0ed\xc9"
 
 func init() {
 	schemas.Register(schema_db8274f9144abc7e,
 		0x82c325a07ad22a65,
+		0x839445a59fb01686,
 		0x83ced0145b2f114b,
 		0x84cb9536a2cf6d3c,
 		0x85c8cea1ab1894f3,
+		0x8635c6b4f45bf5cd,
+		0x904e297b87fbecea,
 		0x9496331ab9cd463f,
+		0x96b74375ce9b0ef6,
 		0x97b3c5c260257622,
 		0x9b87b390babc2ccf,
 		0xa29a916d4ebdd894,
 		0xa353a3556df74984,
 		0xa766b24d4fe5da35,
+		0xab6d5210c1f26687,
 		0xb046e578094b1ead,
 		0xb4bf9861fe035d04,
 		0xb5f39f082b9ac18a,
@@ -3574,6 +4090,7 @@ func init() {
 		0xe6646dec8feaa6ee,
 		0xea50d822450d1f17,
 		0xea58385c65416035,
+		0xf24ec4ab5891b676,
 		0xf2c122394f447e8e,
 		0xf2c68e2547ec3866,
 		0xf41a0f001ad49e46,

tunnelstate/conntracker.go

@@ -0,0 +1,55 @@
+package tunnelstate
+
+import (
+	"sync"
+
+	"github.com/rs/zerolog"
+
+	"github.com/cloudflare/cloudflared/connection"
+)
+
+type ConnTracker struct {
+	sync.RWMutex
+	isConnected map[int]bool
+	log         *zerolog.Logger
+}
+
+func NewConnTracker(log *zerolog.Logger) *ConnTracker {
+	return &ConnTracker{
+		isConnected: make(map[int]bool, 0),
+		log:         log,
+	}
+}
+
+func MockedConnTracker(mocked map[int]bool) *ConnTracker {
+	return &ConnTracker{
+		isConnected: mocked,
+	}
+}
+
+func (ct *ConnTracker) OnTunnelEvent(c connection.Event) {
+	switch c.EventType {
+	case connection.Connected:
+		ct.Lock()
+		ct.isConnected[int(c.Index)] = true
+		ct.Unlock()
+	case connection.Disconnected, connection.Reconnecting, connection.RegisteringTunnel, connection.Unregistering:
+		ct.Lock()
+		ct.isConnected[int(c.Index)] = false
+		ct.Unlock()
+	default:
+		ct.log.Error().Msgf("Unknown connection event case %v", c)
+	}
+}
+
+func (ct *ConnTracker) CountActiveConns() uint {
+	ct.RLock()
+	defer ct.RUnlock()
+	active := uint(0)
+	for _, connected := range ct.isConnected {
+		if connected {
+			active++
+		}
+	}
+	return active
+}

tunnelstore/client.go

@@ -15,10 +15,10 @@ import (
 	"github.com/google/uuid"
 	"github.com/pkg/errors"
 	"github.com/rs/zerolog"
-
 	"golang.org/x/net/http2"
 
 	"github.com/cloudflare/cloudflared/teamnet"
+	"github.com/cloudflare/cloudflared/vnet"
 )
 
 const (
@@ -236,8 +236,14 @@ type Client interface {
 	// Teamnet endpoints
 	ListRoutes(filter *teamnet.Filter) ([]*teamnet.DetailedRoute, error)
 	AddRoute(newRoute teamnet.NewRoute) (teamnet.Route, error)
-	DeleteRoute(network net.IPNet) error
-	GetByIP(ip net.IP) (teamnet.DetailedRoute, error)
+	DeleteRoute(params teamnet.DeleteRouteParams) error
+	GetByIP(params teamnet.GetRouteByIpParams) (teamnet.DetailedRoute, error)
+
+	// Virtual Networks endpoints
+	CreateVirtualNetwork(newVnet vnet.NewVirtualNetwork) (vnet.VirtualNetwork, error)
+	ListVirtualNetworks(filter *vnet.Filter) ([]*vnet.VirtualNetwork, error)
+	DeleteVirtualNetwork(id uuid.UUID) error
+	UpdateVirtualNetwork(id uuid.UUID, updates vnet.UpdateVirtualNetwork) error
 }
 
 type RESTClient struct {
@@ -252,6 +258,7 @@ type baseEndpoints struct {
 	accountLevel  url.URL
 	zoneLevel     url.URL
 	accountRoutes url.URL
+	accountVnets  url.URL
 }
 
 var _ Client = (*RESTClient)(nil)
@@ -268,6 +275,10 @@ func NewRESTClient(baseURL, accountTag, zoneTag, authToken, userAgent string, lo
 	if err != nil {
 		return nil, errors.Wrap(err, "failed to create route account-level endpoint")
 	}
+	accountVnetsEndpoint, err := url.Parse(fmt.Sprintf("%s/accounts/%s/teamnet/virtual_networks", baseURL, accountTag))
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to create virtual network account-level endpoint")
+	}
 	zoneLevelEndpoint, err := url.Parse(fmt.Sprintf("%s/zones/%s/tunnels", baseURL, zoneTag))
 	if err != nil {
 		return nil, errors.Wrap(err, "failed to create account level endpoint")
@@ -282,6 +293,7 @@ func NewRESTClient(baseURL, accountTag, zoneTag, authToken, userAgent string, lo
 			accountLevel:  *accountLevelEndpoint,
 			zoneLevel:     *zoneLevelEndpoint,
 			accountRoutes: *accountRoutesEndpoint,
+			accountVnets:  *accountVnetsEndpoint,
 		},
 		authToken: authToken,
 		userAgent: userAgent,

tunnelstore/client_teamnet.go

@@ -2,11 +2,11 @@ package tunnelstore
 
 import (
 	"io"
-	"net"
 	"net/http"
 	"net/url"
 	"path"
 
+	"github.com/google/uuid"
 	"github.com/pkg/errors"
 
 	"github.com/cloudflare/cloudflared/teamnet"
@@ -47,9 +47,11 @@ func (r *RESTClient) AddRoute(newRoute teamnet.NewRoute) (teamnet.Route, error)
 }
 
 // DeleteRoute calls the Tunnelstore DELETE endpoint for a given route.
-func (r *RESTClient) DeleteRoute(network net.IPNet) error {
+func (r *RESTClient) DeleteRoute(params teamnet.DeleteRouteParams) error {
 	endpoint := r.baseEndpoints.accountRoutes
-	endpoint.Path = path.Join(endpoint.Path, "network", url.PathEscape(network.String()))
+	endpoint.Path = path.Join(endpoint.Path, "network", url.PathEscape(params.Network.String()))
+	setVnetParam(&endpoint, params.VNetID)
+
 	resp, err := r.sendRequest("DELETE", endpoint, nil)
 	if err != nil {
 		return errors.Wrap(err, "REST request failed")
@@ -65,9 +67,11 @@ func (r *RESTClient) DeleteRoute(network net.IPNet) error {
 }
 
 // GetByIP checks which route will proxy a given IP.
-func (r *RESTClient) GetByIP(ip net.IP) (teamnet.DetailedRoute, error) {
+func (r *RESTClient) GetByIP(params teamnet.GetRouteByIpParams) (teamnet.DetailedRoute, error) {
 	endpoint := r.baseEndpoints.accountRoutes
-	endpoint.Path = path.Join(endpoint.Path, "ip", url.PathEscape(ip.String()))
+	endpoint.Path = path.Join(endpoint.Path, "ip", url.PathEscape(params.Ip.String()))
+	setVnetParam(&endpoint, params.VNetID)
+
 	resp, err := r.sendRequest("GET", endpoint, nil)
 	if err != nil {
 		return teamnet.DetailedRoute{}, errors.Wrap(err, "REST request failed")
@@ -81,12 +85,6 @@ func (r *RESTClient) GetByIP(ip net.IP) (teamnet.DetailedRoute, error) {
 	return teamnet.DetailedRoute{}, r.statusCodeToError("get route by IP", resp)
 }
 
-func parseListRoutes(body io.ReadCloser) ([]*teamnet.Route, error) {
-	var routes []*teamnet.Route
-	err := parseResponse(body, &routes)
-	return routes, err
-}
-
 func parseListDetailedRoutes(body io.ReadCloser) ([]*teamnet.DetailedRoute, error) {
 	var routes []*teamnet.DetailedRoute
 	err := parseResponse(body, &routes)
@@ -104,3 +102,13 @@ func parseDetailedRoute(body io.ReadCloser) (teamnet.DetailedRoute, error) {
 	err := parseResponse(body, &route)
 	return route, err
 }
+
+// setVnetParam overwrites the URL's query parameters with a query param to scope the Route action to a certain
+// virtual network (if one is provided).
+func setVnetParam(endpoint *url.URL, vnetID *uuid.UUID) {
+	queryParams := url.Values{}
+	if vnetID != nil {
+		queryParams.Set("virtual_network_id", vnetID.String())
+	}
+	endpoint.RawQuery = queryParams.Encode()
+}

tunnelstore/client_vnets.go

@@ -0,0 +1,89 @@
+package tunnelstore
+
+import (
+	"io"
+	"net/http"
+	"net/url"
+	"path"
+
+	"github.com/google/uuid"
+	"github.com/pkg/errors"
+
+	"github.com/cloudflare/cloudflared/vnet"
+)
+
+func (r *RESTClient) CreateVirtualNetwork(newVnet vnet.NewVirtualNetwork) (vnet.VirtualNetwork, error) {
+	resp, err := r.sendRequest("POST", r.baseEndpoints.accountVnets, newVnet)
+	if err != nil {
+		return vnet.VirtualNetwork{}, errors.Wrap(err, "REST request failed")
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode == http.StatusOK {
+		return parseVnet(resp.Body)
+	}
+
+	return vnet.VirtualNetwork{}, r.statusCodeToError("add virtual network", resp)
+}
+
+func (r *RESTClient) ListVirtualNetworks(filter *vnet.Filter) ([]*vnet.VirtualNetwork, error) {
+	endpoint := r.baseEndpoints.accountVnets
+	endpoint.RawQuery = filter.Encode()
+	resp, err := r.sendRequest("GET", endpoint, nil)
+	if err != nil {
+		return nil, errors.Wrap(err, "REST request failed")
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode == http.StatusOK {
+		return parseListVnets(resp.Body)
+	}
+
+	return nil, r.statusCodeToError("list virtual networks", resp)
+}
+
+func (r *RESTClient) DeleteVirtualNetwork(id uuid.UUID) error {
+	endpoint := r.baseEndpoints.accountVnets
+	endpoint.Path = path.Join(endpoint.Path, url.PathEscape(id.String()))
+	resp, err := r.sendRequest("DELETE", endpoint, nil)
+	if err != nil {
+		return errors.Wrap(err, "REST request failed")
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode == http.StatusOK {
+		_, err := parseVnet(resp.Body)
+		return err
+	}
+
+	return r.statusCodeToError("delete virtual network", resp)
+}
+
+func (r *RESTClient) UpdateVirtualNetwork(id uuid.UUID, updates vnet.UpdateVirtualNetwork) error {
+	endpoint := r.baseEndpoints.accountVnets
+	endpoint.Path = path.Join(endpoint.Path, url.PathEscape(id.String()))
+	resp, err := r.sendRequest("PATCH", endpoint, updates)
+	if err != nil {
+		return errors.Wrap(err, "REST request failed")
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode == http.StatusOK {
+		_, err := parseVnet(resp.Body)
+		return err
+	}
+
+	return r.statusCodeToError("update virtual network", resp)
+}
+
+func parseListVnets(body io.ReadCloser) ([]*vnet.VirtualNetwork, error) {
+	var vnets []*vnet.VirtualNetwork
+	err := parseResponse(body, &vnets)
+	return vnets, err
+}
+
+func parseVnet(body io.ReadCloser) (vnet.VirtualNetwork, error) {
+	var vnet vnet.VirtualNetwork
+	err := parseResponse(body, &vnet)
+	return vnet, err
+}

tunnelstore/filter.go

@@ -2,6 +2,7 @@ package tunnelstore
 
 import (
 	"net/url"
+	"strconv"
 	"time"
 
 	"github.com/google/uuid"
@@ -45,6 +46,10 @@ func (f *Filter) ByTunnelID(tunnelID uuid.UUID) {
 	f.queryParams.Set("uuid", tunnelID.String())
 }
 
+func (f *Filter) MaxFetchSize(max uint) {
+	f.queryParams.Set("per_page", strconv.Itoa(int(max)))
+}
+
 func (f Filter) encode() string {
 	return f.queryParams.Encode()
 }

vendor/github.com/francoispqt/gojay/.gitignore

@@ -0,0 +1,5 @@
+vendor
+*.out
+*.log
+*.test
+.vscode

vendor/github.com/francoispqt/gojay/.travis.yml

@@ -0,0 +1,15 @@
+language: go
+
+go:
+  - "1.10.x"
+  - "1.11.x"
+  - "1.12.x"
+
+script:
+  - go get github.com/golang/dep/cmd/dep github.com/stretchr/testify
+  - dep ensure -v -vendor-only
+  - go test ./gojay/codegen/test/... -race
+  - go test -race -coverprofile=coverage.txt -covermode=atomic
+
+after_success:
+  - bash <(curl -s https://codecov.io/bash)

vendor/github.com/francoispqt/gojay/Gopkg.lock

@@ -0,0 +1,163 @@
+# This file is autogenerated, do not edit; changes may be undone by the next 'dep ensure'.
+
+
+[[projects]]
+  digest = "1:1a37f9f2ae10d161d9688fb6008ffa14e1631e5068cc3e9698008b9e8d40d575"
+  name = "cloud.google.com/go"
+  packages = ["compute/metadata"]
+  pruneopts = ""
+  revision = "457ea5c15ccf3b87db582c450e80101989da35f7"
+  version = "v0.40.0"
+
+[[projects]]
+  digest = "1:968d8903d598e3fae738325d3410f33f07ea6a2b9ee5591e9c262ee37df6845a"
+  name = "github.com/go-errors/errors"
+  packages = ["."]
+  pruneopts = ""
+  revision = "a6af135bd4e28680facf08a3d206b454abc877a4"
+  version = "v1.0.1"
+
+[[projects]]
+  digest = "1:529d738b7976c3848cae5cf3a8036440166835e389c1f617af701eeb12a0518d"
+  name = "github.com/golang/protobuf"
+  packages = ["proto"]
+  pruneopts = ""
+  revision = "b5d812f8a3706043e23a9cd5babf2e5423744d30"
+  version = "v1.3.1"
+
+[[projects]]
+  branch = "master"
+  digest = "1:cae59d7b8243c671c9f544965522ba35c0fec48ee80adb9f1400cd2f33abbbec"
+  name = "github.com/mailru/easyjson"
+  packages = [
+    ".",
+    "buffer",
+    "jlexer",
+    "jwriter",
+  ]
+  pruneopts = ""
+  revision = "1ea4449da9834f4d333f1cc461c374aea217d249"
+
+[[projects]]
+  digest = "1:1d7e1867c49a6dd9856598ef7c3123604ea3daabf5b83f303ff457bcbc410b1d"
+  name = "github.com/pkg/errors"
+  packages = ["."]
+  pruneopts = ""
+  revision = "ba968bfe8b2f7e042a574c888954fccecfa385b4"
+  version = "v0.8.1"
+
+[[projects]]
+  digest = "1:8d4bbd8ab012efc77ab6b97286f2aff262bcdeac9803bb57d75cf7d0a5e6a877"
+  name = "github.com/viant/assertly"
+  packages = ["."]
+  pruneopts = ""
+  revision = "04f45e0aeb6f3455884877b047a97bcc95dc9493"
+  version = "v0.4.8"
+
+[[projects]]
+  digest = "1:5913451bc2d274673c0716efe226a137625740cd9380641f4d8300ff4f2d82a0"
+  name = "github.com/viant/toolbox"
+  packages = [
+    ".",
+    "cred",
+    "data",
+    "storage",
+    "url",
+  ]
+  pruneopts = ""
+  revision = "1be8e4d172138324f40d55ea61a2aeab0c5ce864"
+  version = "v0.24.0"
+
+[[projects]]
+  branch = "master"
+  digest = "1:9d150270ca2c3356f2224a0878daa1652e4d0b25b345f18b4f6e156cc4b8ec5e"
+  name = "golang.org/x/crypto"
+  packages = [
+    "blowfish",
+    "curve25519",
+    "ed25519",
+    "ed25519/internal/edwards25519",
+    "internal/chacha20",
+    "internal/subtle",
+    "poly1305",
+    "ssh",
+  ]
+  pruneopts = ""
+  revision = "f99c8df09eb5bff426315721bfa5f16a99cad32c"
+
+[[projects]]
+  branch = "master"
+  digest = "1:5a56f211e7c12a65c5585c629457a2fb91d8719844ee8fab92727ea8adb5721c"
+  name = "golang.org/x/net"
+  packages = [
+    "context",
+    "context/ctxhttp",
+    "websocket",
+  ]
+  pruneopts = ""
+  revision = "461777fb6f67e8cb9d70cda16573678d085a74cf"
+
+[[projects]]
+  branch = "master"
+  digest = "1:01bdbbc604dcd5afb6f66a717f69ad45e9643c72d5bc11678d44ffa5c50f9e42"
+  name = "golang.org/x/oauth2"
+  packages = [
+    ".",
+    "google",
+    "internal",
+    "jws",
+    "jwt",
+  ]
+  pruneopts = ""
+  revision = "0f29369cfe4552d0e4bcddc57cc75f4d7e672a33"
+
+[[projects]]
+  branch = "master"
+  digest = "1:8ddb956f67d4c176abbbc42b7514aaeaf9ea30daa24e27d2cf30ad82f9334a2c"
+  name = "golang.org/x/sys"
+  packages = ["cpu"]
+  pruneopts = ""
+  revision = "1e42afee0f762ed3d76e6dd942e4181855fd1849"
+
+[[projects]]
+  digest = "1:47f391ee443f578f01168347818cb234ed819521e49e4d2c8dd2fb80d48ee41a"
+  name = "google.golang.org/appengine"
+  packages = [
+    ".",
+    "internal",
+    "internal/app_identity",
+    "internal/base",
+    "internal/datastore",
+    "internal/log",
+    "internal/modules",
+    "internal/remote_api",
+    "internal/urlfetch",
+    "urlfetch",
+  ]
+  pruneopts = ""
+  revision = "b2f4a3cf3c67576a2ee09e1fe62656a5086ce880"
+  version = "v1.6.1"
+
+[[projects]]
+  digest = "1:cedccf16b71e86db87a24f8d4c70b0a855872eb967cb906a66b95de56aefbd0d"
+  name = "gopkg.in/yaml.v2"
+  packages = ["."]
+  pruneopts = ""
+  revision = "51d6538a90f86fe93ac480b35f37b2be17fef232"
+  version = "v2.2.2"
+
+[solve-meta]
+  analyzer-name = "dep"
+  analyzer-version = 1
+  input-imports = [
+    "github.com/go-errors/errors",
+    "github.com/mailru/easyjson",
+    "github.com/mailru/easyjson/jlexer",
+    "github.com/mailru/easyjson/jwriter",
+    "github.com/viant/assertly",
+    "github.com/viant/toolbox",
+    "github.com/viant/toolbox/url",
+    "golang.org/x/net/websocket",
+  ]
+  solver-name = "gps-cdcl"
+  solver-version = 1

vendor/github.com/francoispqt/gojay/Gopkg.toml

@@ -0,0 +1,23 @@
+# Gopkg.toml example
+#
+# Refer to https://github.com/golang/dep/blob/master/docs/Gopkg.toml.md
+# for detailed Gopkg.toml documentation.
+#
+# required = ["github.com/user/thing/cmd/thing"]
+# ignored = ["github.com/user/project/pkgX", "bitbucket.org/user/project/pkgA/pkgY"]
+#
+# [[constraint]]
+#   name = "github.com/user/project"
+#   version = "1.0.0"
+#
+# [[constraint]]
+#   name = "github.com/user/project2"
+#   branch = "dev"
+#   source = "github.com/myfork/project2"
+#
+# [[override]]
+#  name = "github.com/x/y"
+#  version = "2.4.0"
+
+
+ignored = ["github.com/francoispqt/benchmarks*","github.com/stretchr/testify*","github.com/stretchr/testify","github.com/json-iterator/go","github.com/buger/jsonparser"]

vendor/github.com/francoispqt/gojay/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2016 gojay
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

vendor/github.com/francoispqt/gojay/Makefile

@@ -0,0 +1,11 @@
+.PHONY: test
+test:
+	go test -race -run=^Test -v
+
+.PHONY: cover
+cover: 
+	go test -coverprofile=coverage.out -covermode=atomic
+
+.PHONY: coverhtml
+coverhtml: 
+	go tool cover -html=coverage.out

vendor/github.com/francoispqt/gojay/README.md

@@ -0,0 +1,855 @@
+[![Build Status](https://travis-ci.org/francoispqt/gojay.svg?branch=master)](https://travis-ci.org/francoispqt/gojay)
+[![codecov](https://codecov.io/gh/francoispqt/gojay/branch/master/graph/badge.svg)](https://codecov.io/gh/francoispqt/gojay)
+[![Go Report Card](https://goreportcard.com/badge/github.com/francoispqt/gojay)](https://goreportcard.com/report/github.com/francoispqt/gojay)
+[![Go doc](http://img.shields.io/badge/go-documentation-blue.svg?style=flat-square
+)](https://godoc.org/github.com/francoispqt/gojay)
+![MIT License](https://img.shields.io/badge/license-mit-blue.svg?style=flat-square)
+[![Sourcegraph](https://sourcegraph.com/github.com/francoispqt/gojay/-/badge.svg)](https://sourcegraph.com/github.com/francoispqt/gojay)
+![stability-stable](https://img.shields.io/badge/stability-stable-green.svg)
+
+# GoJay
+
+<img src="https://github.com/francoispqt/gojay/raw/master/gojay.png" width="200px">
+
+GoJay is a performant JSON encoder/decoder for Golang (currently the most performant, [see benchmarks](#benchmark-results)).
+
+It has a simple API and doesn't use reflection. It relies on small interfaces to decode/encode structures and slices.
+
+Gojay also comes with powerful stream decoding features and an even faster [Unsafe](#unsafe-api) API.
+
+There is also a [code generation tool](https://github.com/francoispqt/gojay/tree/master/gojay) to make usage easier and faster.
+
+# Why another JSON parser?
+
+I looked at other fast decoder/encoder and realised it was mostly hardly readable static code generation or a lot of reflection, poor streaming features, and not so fast in the end.
+
+Also, I wanted to build a decoder that could consume an io.Reader of line or comma delimited JSON, in a JIT way. To consume a flow of JSON objects from a TCP connection for example or from a standard output. Same way I wanted to build an encoder that could encode a flow of data to a io.Writer.
+
+This is how GoJay aims to be a very fast, JIT stream parser with 0 reflection, low allocation with a friendly API.
+
+# Get started
+
+```bash
+go get github.com/francoispqt/gojay
+```
+
+* [Encoder](#encoding)
+* [Decoder](#decoding)
+* [Stream API](#stream-api)
+* [Code Generation](https://github.com/francoispqt/gojay/tree/master/gojay)
+
+## Decoding
+
+Decoding is done through two different API similar to standard `encoding/json`:
+* [Unmarshal](#unmarshal-api)
+* [Decode](#decode-api)
+
+
+Example of basic stucture decoding with Unmarshal:
+```go
+import "github.com/francoispqt/gojay"
+
+type user struct {
+    id int
+    name string
+    email string
+}
+// implement gojay.UnmarshalerJSONObject
+func (u *user) UnmarshalJSONObject(dec *gojay.Decoder, key string) error {
+    switch key {
+    case "id":
+        return dec.Int(&u.id)
+    case "name":
+        return dec.String(&u.name)
+    case "email":
+        return dec.String(&u.email)
+    }
+    return nil
+}
+func (u *user) NKeys() int {
+    return 3
+}
+
+func main() {
+    u := &user{}
+    d := []byte(`{"id":1,"name":"gojay","email":"gojay@email.com"}`)
+    err := gojay.UnmarshalJSONObject(d, u)
+    if err != nil {
+        log.Fatal(err)
+    }
+}
+```
+
+with Decode:
+```go
+func main() {
+    u := &user{}
+    dec := gojay.NewDecoder(bytes.NewReader([]byte(`{"id":1,"name":"gojay","email":"gojay@email.com"}`)))
+    err := dec.DecodeObject(d, u)
+    if err != nil {
+        log.Fatal(err)
+    }
+}
+```
+
+### Unmarshal API
+
+Unmarshal API decodes a `[]byte` to a given pointer with a single function.
+
+Behind the doors, Unmarshal API borrows a `*gojay.Decoder` resets its settings and decodes the data to the given pointer and releases the `*gojay.Decoder` to the pool when it finishes, whether it encounters an error or not.
+
+If it cannot find the right Decoding strategy for the type of the given pointer, it returns an `InvalidUnmarshalError`. You can test the error returned by doing `if ok := err.(InvalidUnmarshalError); ok {}`.
+
+Unmarshal API comes with three functions:
+* Unmarshal
+```go
+func Unmarshal(data []byte, v interface{}) error
+```
+
+* UnmarshalJSONObject
+```go
+func UnmarshalJSONObject(data []byte, v gojay.UnmarshalerJSONObject) error
+```
+
+* UnmarshalJSONArray
+```go
+func UnmarshalJSONArray(data []byte, v gojay.UnmarshalerJSONArray) error
+```
+
+
+### Decode API
+
+Decode API decodes a `[]byte` to a given pointer by creating or borrowing a `*gojay.Decoder` with an `io.Reader` and calling `Decode` methods.
+
+__Getting a *gojay.Decoder or Borrowing__
+
+You can either get a fresh `*gojay.Decoder` calling `dec := gojay.NewDecoder(io.Reader)` or borrow one from the pool by calling `dec := gojay.BorrowDecoder(io.Reader)`.
+
+After using a decoder, you can release it by calling `dec.Release()`. Beware, if you reuse the decoder after releasing it, it will panic with an error of type `InvalidUsagePooledDecoderError`. If you want to fully benefit from the pooling, you must release your decoders after using.
+
+Example getting a fresh an releasing:
+```go
+str := ""
+dec := gojay.NewDecoder(strings.NewReader(`"test"`))
+defer dec.Release()
+if err := dec.Decode(&str); err != nil {
+    log.Fatal(err)
+}
+```
+Example borrowing a decoder and releasing:
+```go
+str := ""
+dec := gojay.BorrowDecoder(strings.NewReader(`"test"`))
+defer dec.Release()
+if err := dec.Decode(&str); err != nil {
+    log.Fatal(err)
+}
+```
+
+`*gojay.Decoder` has multiple methods to decode to specific types:
+* Decode
+```go
+func (dec *gojay.Decoder) Decode(v interface{}) error
+```
+* DecodeObject
+```go
+func (dec *gojay.Decoder) DecodeObject(v gojay.UnmarshalerJSONObject) error
+```
+* DecodeArray
+```go
+func (dec *gojay.Decoder) DecodeArray(v gojay.UnmarshalerJSONArray) error
+```
+* DecodeInt
+```go
+func (dec *gojay.Decoder) DecodeInt(v *int) error
+```
+* DecodeBool
+```go
+func (dec *gojay.Decoder) DecodeBool(v *bool) error
+```
+* DecodeString
+```go
+func (dec *gojay.Decoder) DecodeString(v *string) error
+```
+
+All DecodeXxx methods are used to decode top level JSON values. If you are decoding keys or items of a JSON object or array, don't use the Decode methods.
+
+Example:
+```go
+reader := strings.NewReader(`"John Doe"`)
+dec := NewDecoder(reader)
+
+var str string
+err := dec.DecodeString(&str)
+if err != nil {
+    log.Fatal(err)
+}
+
+fmt.Println(str) // John Doe
+```
+
+### Structs and Maps
+#### UnmarshalerJSONObject Interface
+
+To unmarshal a JSON object to a structure, the structure must implement the `UnmarshalerJSONObject` interface:
+```go
+type UnmarshalerJSONObject interface {
+	UnmarshalJSONObject(*gojay.Decoder, string) error
+	NKeys() int
+}
+```
+`UnmarshalJSONObject` method takes two arguments, the first one is a pointer to the Decoder (*gojay.Decoder) and the second one is the string value of the current key being parsed. If the JSON data is not an object, the UnmarshalJSONObject method will never be called.
+
+`NKeys` method must return the number of keys to Unmarshal in the JSON object or 0. If zero is returned, all keys will be parsed.
+
+Example of implementation for a struct:
+```go
+type user struct {
+    id int
+    name string
+    email string
+}
+// implement UnmarshalerJSONObject
+func (u *user) UnmarshalJSONObject(dec *gojay.Decoder, key string) error {
+    switch key {
+    case "id":
+        return dec.Int(&u.id)
+    case "name":
+        return dec.String(&u.name)
+    case "email":
+        return dec.String(&u.email)
+    }
+    return nil
+}
+func (u *user) NKeys() int {
+    return 3
+}
+```
+
+Example of implementation for a `map[string]string`:
+```go
+// define our custom map type implementing UnmarshalerJSONObject
+type message map[string]string
+
+// Implementing Unmarshaler
+func (m message) UnmarshalJSONObject(dec *gojay.Decoder, k string) error {
+	str := ""
+	err := dec.String(&str)
+	if err != nil {
+		return err
+	}
+	m[k] = str
+	return nil
+}
+
+// we return 0, it tells the Decoder to decode all keys
+func (m message) NKeys() int {
+	return 0
+}
+```
+
+### Arrays, Slices and Channels
+
+To unmarshal a JSON object to a slice an array or a channel, it must implement the UnmarshalerJSONArray interface:
+```go
+type UnmarshalerJSONArray interface {
+	UnmarshalJSONArray(*gojay.Decoder) error
+}
+```
+UnmarshalJSONArray method takes one argument, a pointer to the Decoder (*gojay.Decoder). If the JSON data is not an array, the Unmarshal method will never be called.
+
+Example of implementation with a slice:
+```go
+type testSlice []string
+// implement UnmarshalerJSONArray
+func (t *testSlice) UnmarshalJSONArray(dec *gojay.Decoder) error {
+	str := ""
+	if err := dec.String(&str); err != nil {
+		return err
+	}
+	*t = append(*t, str)
+	return nil
+}
+
+func main() {
+	dec := gojay.BorrowDecoder(strings.NewReader(`["Tom", "Jim"]`))
+	var slice testSlice
+	err := dec.DecodeArray(&slice)
+	if err != nil {
+		log.Fatal(err)
+	}
+	fmt.Println(slice) // [Tom Jim]
+	dec.Release()
+}
+```
+
+Example of implementation with a channel:
+```go
+type testChannel chan string
+// implement UnmarshalerJSONArray
+func (c testChannel) UnmarshalJSONArray(dec *gojay.Decoder) error {
+	str := ""
+	if err := dec.String(&str); err != nil {
+		return err
+	}
+	c <- str
+	return nil
+}
+
+func main() {
+	dec := gojay.BorrowDecoder(strings.NewReader(`["Tom", "Jim"]`))
+	c := make(testChannel, 2)
+	err := dec.DecodeArray(c)
+	if err != nil {
+		log.Fatal(err)
+	}
+	for i := 0; i < 2; i++ {
+		fmt.Println(<-c)
+	}
+	close(c)
+	dec.Release()
+}
+```
+
+Example of implementation with an array:
+```go
+type testArray [3]string
+// implement UnmarshalerJSONArray
+func (a *testArray) UnmarshalJSONArray(dec *Decoder) error {
+	var str string
+	if err := dec.String(&str); err != nil {
+		return err
+	}
+	a[dec.Index()] = str
+	return nil
+}
+
+func main() {
+	dec := gojay.BorrowDecoder(strings.NewReader(`["Tom", "Jim", "Bob"]`))
+	var a testArray
+	err := dec.DecodeArray(&a)
+	fmt.Println(a) // [Tom Jim Bob]
+	dec.Release()
+}
+```
+
+### Other types
+To decode other types (string, int, int32, int64, uint32, uint64, float, booleans), you don't need to implement any interface.
+
+Example of encoding strings:
+```go
+func main() {
+    json := []byte(`"Jay"`)
+    var v string
+    err := gojay.Unmarshal(json, &v)
+    if err != nil {
+        log.Fatal(err)
+    }
+    fmt.Println(v) // Jay
+}
+```
+
+### Decode values methods
+When decoding a JSON object of a JSON array using `UnmarshalerJSONObject` or `UnmarshalerJSONArray` interface, the `gojay.Decoder` provides dozens of methods to Decode multiple types.
+
+Non exhaustive list of methods available (to see all methods, check the godoc):
+```go
+dec.Int
+dec.Int8
+dec.Int16
+dec.Int32
+dec.Int64
+dec.Uint8
+dec.Uint16
+dec.Uint32
+dec.Uint64
+dec.String
+dec.Time
+dec.Bool
+dec.SQLNullString
+dec.SQLNullInt64
+```
+
+
+## Encoding
+
+Encoding is done through two different API similar to standard `encoding/json`:
+* [Marshal](#marshal-api)
+* [Encode](#encode-api)
+
+Example of basic structure encoding with Marshal:
+```go
+import "github.com/francoispqt/gojay"
+
+type user struct {
+	id    int
+	name  string
+	email string
+}
+
+// implement MarshalerJSONObject
+func (u *user) MarshalJSONObject(enc *gojay.Encoder) {
+	enc.IntKey("id", u.id)
+	enc.StringKey("name", u.name)
+	enc.StringKey("email", u.email)
+}
+func (u *user) IsNil() bool {
+	return u == nil
+}
+
+func main() {
+	u := &user{1, "gojay", "gojay@email.com"}
+	b, err := gojay.MarshalJSONObject(u)
+	if err != nil {
+		log.Fatal(err)
+	}
+	fmt.Println(string(b)) // {"id":1,"name":"gojay","email":"gojay@email.com"}
+}
+```
+
+with Encode:
+```go
+func main() {
+	u := &user{1, "gojay", "gojay@email.com"}
+	b := strings.Builder{}
+	enc := gojay.NewEncoder(&b)
+	if err := enc.Encode(u); err != nil {
+		log.Fatal(err)
+	}
+	fmt.Println(b.String()) // {"id":1,"name":"gojay","email":"gojay@email.com"}
+}
+```
+
+### Marshal API
+
+Marshal API encodes a value to a JSON `[]byte` with a single function.
+
+Behind the doors, Marshal API borrows a `*gojay.Encoder` resets its settings and encodes the data to an internal byte buffer and releases the `*gojay.Encoder` to the pool when it finishes, whether it encounters an error or not.
+
+If it cannot find the right Encoding strategy for the type of the given value, it returns an `InvalidMarshalError`. You can test the error returned by doing `if ok := err.(InvalidMarshalError); ok {}`.
+
+Marshal API comes with three functions:
+* Marshal
+```go
+func Marshal(v interface{}) ([]byte, error)
+```
+
+* MarshalJSONObject
+```go
+func MarshalJSONObject(v gojay.MarshalerJSONObject) ([]byte, error)
+```
+
+* MarshalJSONArray
+```go
+func MarshalJSONArray(v gojay.MarshalerJSONArray) ([]byte, error)
+```
+
+### Encode API
+
+Encode API decodes a value to JSON by creating or borrowing a `*gojay.Encoder` sending it to an `io.Writer` and calling `Encode` methods.
+
+__Getting a *gojay.Encoder or Borrowing__
+
+You can either get a fresh `*gojay.Encoder` calling `enc := gojay.NewEncoder(io.Writer)` or borrow one from the pool by calling `enc := gojay.BorrowEncoder(io.Writer)`.
+
+After using an encoder, you can release it by calling `enc.Release()`. Beware, if you reuse the encoder after releasing it, it will panic with an error of type `InvalidUsagePooledEncoderError`. If you want to fully benefit from the pooling, you must release your encoders after using.
+
+Example getting a fresh encoder an releasing:
+```go
+str := "test"
+b := strings.Builder{}
+enc := gojay.NewEncoder(&b)
+defer enc.Release()
+if err := enc.Encode(str); err != nil {
+    log.Fatal(err)
+}
+```
+Example borrowing an encoder and releasing:
+```go
+str := "test"
+b := strings.Builder{}
+enc := gojay.BorrowEncoder(b)
+defer enc.Release()
+if err := enc.Encode(str); err != nil {
+    log.Fatal(err)
+}
+```
+
+`*gojay.Encoder` has multiple methods to encoder specific types to JSON:
+* Encode
+```go
+func (enc *gojay.Encoder) Encode(v interface{}) error
+```
+* EncodeObject
+```go
+func (enc *gojay.Encoder) EncodeObject(v gojay.MarshalerJSONObject) error
+```
+* EncodeArray
+```go
+func (enc *gojay.Encoder) EncodeArray(v gojay.MarshalerJSONArray) error
+```
+* EncodeInt
+```go
+func (enc *gojay.Encoder) EncodeInt(n int) error
+```
+* EncodeInt64
+```go
+func (enc *gojay.Encoder) EncodeInt64(n int64) error
+```
+* EncodeFloat
+```go
+func (enc *gojay.Encoder) EncodeFloat(n float64) error
+```
+* EncodeBool
+```go
+func (enc *gojay.Encoder) EncodeBool(v bool) error
+```
+* EncodeString
+```go
+func (enc *gojay.Encoder) EncodeString(s string) error
+```
+
+### Structs and Maps
+
+To encode a structure, the structure must implement the MarshalerJSONObject interface:
+```go
+type MarshalerJSONObject interface {
+	MarshalJSONObject(enc *gojay.Encoder)
+	IsNil() bool
+}
+```
+`MarshalJSONObject` method takes one argument, a pointer to the Encoder (*gojay.Encoder). The method must add all the keys in the JSON Object by calling Decoder's methods.
+
+IsNil method returns a boolean indicating if the interface underlying value is nil or not. It is used to safely ensure that the underlying value is not nil without using Reflection.
+
+Example of implementation for a struct:
+```go
+type user struct {
+	id    int
+	name  string
+	email string
+}
+
+// implement MarshalerJSONObject
+func (u *user) MarshalJSONObject(enc *gojay.Encoder) {
+	enc.IntKey("id", u.id)
+	enc.StringKey("name", u.name)
+	enc.StringKey("email", u.email)
+}
+func (u *user) IsNil() bool {
+	return u == nil
+}
+```
+
+Example of implementation for a `map[string]string`:
+```go
+// define our custom map type implementing MarshalerJSONObject
+type message map[string]string
+
+// Implementing Marshaler
+func (m message) MarshalJSONObject(enc *gojay.Encoder) {
+	for k, v := range m {
+		enc.StringKey(k, v)
+	}
+}
+
+func (m message) IsNil() bool {
+	return m == nil
+}
+```
+
+### Arrays and Slices
+To encode an array or a slice, the slice/array must implement the MarshalerJSONArray interface:
+```go
+type MarshalerJSONArray interface {
+	MarshalJSONArray(enc *gojay.Encoder)
+	IsNil() bool
+}
+```
+`MarshalJSONArray` method takes one argument, a pointer to the Encoder (*gojay.Encoder). The method must add all element in the JSON Array by calling Decoder's methods.
+
+`IsNil` method returns a boolean indicating if the interface underlying value is nil(empty) or not. It is used to safely ensure that the underlying value is not nil without using Reflection and also to in `OmitEmpty` feature.
+
+Example of implementation:
+```go
+type users []*user
+// implement MarshalerJSONArray
+func (u *users) MarshalJSONArray(enc *gojay.Encoder) {
+	for _, e := range u {
+		enc.Object(e)
+	}
+}
+func (u *users) IsNil() bool {
+	return len(u) == 0
+}
+```
+
+### Other types
+To encode other types (string, int, float, booleans), you don't need to implement any interface.
+
+Example of encoding strings:
+```go
+func main() {
+	name := "Jay"
+	b, err := gojay.Marshal(name)
+	if err != nil {
+		log.Fatal(err)
+	}
+	fmt.Println(string(b)) // "Jay"
+}
+```
+
+# Stream API
+
+### Stream Decoding
+GoJay ships with a powerful stream decoder.
+
+It allows to read continuously from an io.Reader stream and do JIT decoding writing unmarshalled JSON to a channel to allow async consuming.
+
+When using the Stream API, the Decoder implements context.Context to provide graceful cancellation.
+
+To decode a stream of JSON, you must call `gojay.Stream.DecodeStream` and pass it a `UnmarshalerStream` implementation.
+
+```go
+type UnmarshalerStream interface {
+	UnmarshalStream(*StreamDecoder) error
+}
+```
+
+Example of implementation of stream reading from a WebSocket connection:
+```go
+// implement UnmarshalerStream
+type ChannelStream chan *user
+
+func (c ChannelStream) UnmarshalStream(dec *gojay.StreamDecoder) error {
+	u := &user{}
+	if err := dec.Object(u); err != nil {
+		return err
+	}
+	c <- u
+	return nil
+}
+
+func main() {
+	// get our websocket connection
+	origin := "http://localhost/"
+	url := "ws://localhost:12345/ws"
+	ws, err := websocket.Dial(url, "", origin)
+	if err != nil {
+		log.Fatal(err)
+	}
+	// create our channel which will receive our objects
+	streamChan := ChannelStream(make(chan *user))
+	// borrow a decoder
+	dec := gojay.Stream.BorrowDecoder(ws)
+	// start decoding, it will block until a JSON message is decoded from the WebSocket
+	// or until Done channel is closed
+	go dec.DecodeStream(streamChan)
+	for {
+		select {
+		case v := <-streamChan:
+			// Got something from my websocket!
+			log.Println(v)
+		case <-dec.Done():
+			log.Println("finished reading from WebSocket")
+			os.Exit(0)
+		}
+	}
+}
+```
+
+### Stream Encoding
+GoJay ships with a powerful stream encoder part of the Stream API.
+
+It allows to write continuously to an io.Writer and do JIT encoding of data fed to a channel to allow async consuming. You can set multiple consumers on the channel to be as performant as possible. Consumers are non blocking and are scheduled individually in their own go routine.
+
+When using the Stream API, the Encoder implements context.Context to provide graceful cancellation.
+
+To encode a stream of data, you must call `EncodeStream` and pass it a `MarshalerStream` implementation.
+
+```go
+type MarshalerStream interface {
+	MarshalStream(enc *gojay.StreamEncoder)
+}
+```
+
+Example of implementation of stream writing to a WebSocket:
+```go
+// Our structure which will be pushed to our stream
+type user struct {
+	id    int
+	name  string
+	email string
+}
+
+func (u *user) MarshalJSONObject(enc *gojay.Encoder) {
+	enc.IntKey("id", u.id)
+	enc.StringKey("name", u.name)
+	enc.StringKey("email", u.email)
+}
+func (u *user) IsNil() bool {
+	return u == nil
+}
+
+// Our MarshalerStream implementation
+type StreamChan chan *user
+
+func (s StreamChan) MarshalStream(enc *gojay.StreamEncoder) {
+	select {
+	case <-enc.Done():
+		return
+	case o := <-s:
+		enc.Object(o)
+	}
+}
+
+// Our main function
+func main() {
+	// get our websocket connection
+	origin := "http://localhost/"
+	url := "ws://localhost:12345/ws"
+	ws, err := websocket.Dial(url, "", origin)
+	if err != nil {
+		log.Fatal(err)
+	}
+	// we borrow an encoder set stdout as the writer,
+	// set the number of consumer to 10
+	// and tell the encoder to separate each encoded element
+	// added to the channel by a new line character
+	enc := gojay.Stream.BorrowEncoder(ws).NConsumer(10).LineDelimited()
+	// instantiate our MarshalerStream
+	s := StreamChan(make(chan *user))
+	// start the stream encoder
+	// will block its goroutine until enc.Cancel(error) is called
+	// or until something is written to the channel
+	go enc.EncodeStream(s)
+	// write to our MarshalerStream
+	for i := 0; i < 1000; i++ {
+		s <- &user{i, "username", "user@email.com"}
+	}
+	// Wait
+	<-enc.Done()
+}
+```
+
+# Unsafe API
+
+Unsafe API has the same functions than the regular API, it only has `Unmarshal API` for now. It is unsafe because it makes assumptions on the quality of the given JSON.
+
+If you are not sure if your JSON is valid, don't use the Unsafe API.
+
+Also, the `Unsafe` API does not copy the buffer when using Unmarshal API, which, in case of string decoding, can lead to data corruption if a byte buffer is reused. Using the `Decode` API makes `Unsafe` API safer as the io.Reader relies on `copy` builtin method and `Decoder` will have its own internal buffer :)
+
+Access the `Unsafe` API this way:
+```go
+gojay.Unsafe.Unmarshal(b, v)
+```
+
+
+# Benchmarks
+
+Benchmarks encode and decode three different data based on size (small, medium, large).
+
+To run benchmark for decoder:
+```bash
+cd $GOPATH/src/github.com/francoispqt/gojay/benchmarks/decoder && make bench
+```
+
+To run benchmark for encoder:
+```bash
+cd $GOPATH/src/github.com/francoispqt/gojay/benchmarks/encoder && make bench
+```
+
+# Benchmark Results
+## Decode
+
+<img src="https://images2.imgbox.com/78/01/49OExcPh_o.png" width="500px">
+
+### Small Payload
+[benchmark code is here](https://github.com/francoispqt/gojay/blob/master/benchmarks/decoder/decoder_bench_small_test.go)
+
+[benchmark data is here](https://github.com/francoispqt/gojay/blob/master/benchmarks/benchmarks_small.go)
+
+|                 | ns/op     | bytes/op     | allocs/op |
+|-----------------|-----------|--------------|-----------|
+| Std Library     | 2547      | 496          | 4         |
+| JsonIter        | 2046      | 312          | 12        |
+| JsonParser      | 1408      | 0            | 0         |
+| EasyJson        | 929       | 240          | 2         |
+| **GoJay**       | **807**   | **256**      | **2**     |
+| **GoJay-unsafe**| **712**   | **112**      | **1**     |
+
+### Medium Payload
+[benchmark code is here](https://github.com/francoispqt/gojay/blob/master/benchmarks/decoder/decoder_bench_medium_test.go)
+
+[benchmark data is here](https://github.com/francoispqt/gojay/blob/master/benchmarks/benchmarks_medium.go)
+
+|                 | ns/op     | bytes/op | allocs/op |
+|-----------------|-----------|----------|-----------|
+| Std Library     | 30148     | 2152     | 496       |
+| JsonIter        | 16309     | 2976     | 80        |
+| JsonParser      | 7793      | 0        | 0         |
+| EasyJson        | 7957      | 232      | 6         |
+| **GoJay**       | **4984**  | **2448** | **8**     |
+| **GoJay-unsafe**| **4809**  | **144**  | **7**     |
+
+### Large Payload
+[benchmark code is here](https://github.com/francoispqt/gojay/blob/master/benchmarks/decoder/decoder_bench_large_test.go)
+
+[benchmark data is here](https://github.com/francoispqt/gojay/blob/master/benchmarks/benchmarks_large.go)
+
+|                 | ns/op     | bytes/op    | allocs/op |
+|-----------------|-----------|-------------|-----------|
+| JsonIter        | 210078    | 41712       | 1136      |
+| EasyJson        | 106626    | 160         | 2         |
+| JsonParser      | 66813     | 0           | 0         |
+| **GoJay**       | **52153** | **31241**   | **77**    |
+| **GoJay-unsafe**| **48277** | **2561**    | **76**    |
+
+## Encode
+
+<img src="https://images2.imgbox.com/e9/cc/pnM8c7Gf_o.png" width="500px">
+
+### Small Struct
+[benchmark code is here](https://github.com/francoispqt/gojay/blob/master/benchmarks/encoder/encoder_bench_small_test.go)
+
+[benchmark data is here](https://github.com/francoispqt/gojay/blob/master/benchmarks/benchmarks_small.go)
+
+|                | ns/op    | bytes/op     | allocs/op |
+|----------------|----------|--------------|-----------|
+| Std Library    | 1280     | 464          | 3         |
+| EasyJson       | 871      | 944          | 6         |
+| JsonIter       | 866      | 272          | 3         |
+| **GoJay**      | **543**  | **112**      | **1**     |
+| **GoJay-func** | **347**  | **0**        | **0**     |
+
+### Medium Struct
+[benchmark code is here](https://github.com/francoispqt/gojay/blob/master/benchmarks/encoder/encoder_bench_medium_test.go)
+
+[benchmark data is here](https://github.com/francoispqt/gojay/blob/master/benchmarks/benchmarks_medium.go)
+
+|             | ns/op    | bytes/op     | allocs/op |
+|-------------|----------|--------------|-----------|
+| Std Library | 5006     | 1496         | 25        |
+| JsonIter    | 2232     | 1544         | 20        |
+| EasyJson    | 1997     | 1544         | 19        |
+| **GoJay**   | **1522** | **312**      | **14**    |
+
+### Large Struct
+[benchmark code is here](https://github.com/francoispqt/gojay/blob/master/benchmarks/encoder/encoder_bench_large_test.go)
+
+[benchmark data is here](https://github.com/francoispqt/gojay/blob/master/benchmarks/benchmarks_large.go)
+
+|             | ns/op     | bytes/op     | allocs/op |
+|-------------|-----------|--------------|-----------|
+| Std Library | 66441     | 20576        | 332       |
+| JsonIter    | 35247     | 20255        | 328       |
+| EasyJson    | 32053     | 15474        | 327       |
+| **GoJay**   | **27847** | **9802**     | **318**   |
+
+# Contributing
+
+Contributions are welcome :)
+
+If you encounter issues please report it in Github and/or send an email at [francois@parquet.ninja](mailto:francois@parquet.ninja)
+

vendor/github.com/francoispqt/gojay/decode.go

@@ -0,0 +1,386 @@
+package gojay
+
+import (
+	"fmt"
+	"io"
+)
+
+// UnmarshalJSONArray parses the JSON-encoded data and stores the result in the value pointed to by v.
+//
+// v must implement UnmarshalerJSONArray.
+//
+// If a JSON value is not appropriate for a given target type, or if a JSON number
+// overflows the target type, UnmarshalJSONArray skips that field and completes the unmarshaling as best it can.
+func UnmarshalJSONArray(data []byte, v UnmarshalerJSONArray) error {
+	dec := borrowDecoder(nil, 0)
+	defer dec.Release()
+	dec.data = make([]byte, len(data))
+	copy(dec.data, data)
+	dec.length = len(data)
+	_, err := dec.decodeArray(v)
+	if err != nil {
+		return err
+	}
+	if dec.err != nil {
+		return dec.err
+	}
+	return nil
+}
+
+// UnmarshalJSONObject parses the JSON-encoded data and stores the result in the value pointed to by v.
+//
+// v must implement UnmarshalerJSONObject.
+//
+// If a JSON value is not appropriate for a given target type, or if a JSON number
+// overflows the target type, UnmarshalJSONObject skips that field and completes the unmarshaling as best it can.
+func UnmarshalJSONObject(data []byte, v UnmarshalerJSONObject) error {
+	dec := borrowDecoder(nil, 0)
+	defer dec.Release()
+	dec.data = make([]byte, len(data))
+	copy(dec.data, data)
+	dec.length = len(data)
+	_, err := dec.decodeObject(v)
+	if err != nil {
+		return err
+	}
+	if dec.err != nil {
+		return dec.err
+	}
+	return nil
+}
+
+// Unmarshal parses the JSON-encoded data and stores the result in the value pointed to by v.
+// If v is nil, not an implementation of UnmarshalerJSONObject or UnmarshalerJSONArray or not one of the following types:
+// 	*string, **string, *int, **int, *int8, **int8, *int16, **int16, *int32, **int32, *int64, **int64, *uint8, **uint8, *uint16, **uint16,
+// 	*uint32, **uint32, *uint64, **uint64, *float64, **float64, *float32, **float32, *bool, **bool
+// Unmarshal returns an InvalidUnmarshalError.
+//
+//
+// If a JSON value is not appropriate for a given target type, or if a JSON number
+// overflows the target type, Unmarshal skips that field and completes the unmarshaling as best it can.
+// If no more serious errors are encountered, Unmarshal returns an UnmarshalTypeError describing the earliest such error.
+// In any case, it's not guaranteed that all the remaining fields following the problematic one will be unmarshaled into the target object.
+func Unmarshal(data []byte, v interface{}) error {
+	var err error
+	var dec *Decoder
+	switch vt := v.(type) {
+	case *string:
+		dec = borrowDecoder(nil, 0)
+		dec.length = len(data)
+		dec.data = data
+		err = dec.decodeString(vt)
+	case **string:
+		dec = borrowDecoder(nil, 0)
+		dec.length = len(data)
+		dec.data = data
+		err = dec.decodeStringNull(vt)
+	case *int:
+		dec = borrowDecoder(nil, 0)
+		dec.length = len(data)
+		dec.data = data
+		err = dec.decodeInt(vt)
+	case **int:
+		dec = borrowDecoder(nil, 0)
+		dec.length = len(data)
+		dec.data = data
+		err = dec.decodeIntNull(vt)
+	case *int8:
+		dec = borrowDecoder(nil, 0)
+		dec.length = len(data)
+		dec.data = data
+		err = dec.decodeInt8(vt)
+	case **int8:
+		dec = borrowDecoder(nil, 0)
+		dec.length = len(data)
+		dec.data = data
+		err = dec.decodeInt8Null(vt)
+	case *int16:
+		dec = borrowDecoder(nil, 0)
+		dec.length = len(data)
+		dec.data = data
+		err = dec.decodeInt16(vt)
+	case **int16:
+		dec = borrowDecoder(nil, 0)
+		dec.length = len(data)
+		dec.data = data
+		err = dec.decodeInt16Null(vt)
+	case *int32:
+		dec = borrowDecoder(nil, 0)
+		dec.length = len(data)
+		dec.data = data
+		err = dec.decodeInt32(vt)
+	case **int32:
+		dec = borrowDecoder(nil, 0)
+		dec.length = len(data)
+		dec.data = data
+		err = dec.decodeInt32Null(vt)
+	case *int64:
+		dec = borrowDecoder(nil, 0)
+		dec.length = len(data)
+		dec.data = data
+		err = dec.decodeInt64(vt)
+	case **int64:
+		dec = borrowDecoder(nil, 0)
+		dec.length = len(data)
+		dec.data = data
+		err = dec.decodeInt64Null(vt)
+	case *uint8:
+		dec = borrowDecoder(nil, 0)
+		dec.length = len(data)
+		dec.data = data
+		err = dec.decodeUint8(vt)
+	case **uint8:
+		dec = borrowDecoder(nil, 0)
+		dec.length = len(data)
+		dec.data = data
+		err = dec.decodeUint8Null(vt)
+	case *uint16:
+		dec = borrowDecoder(nil, 0)
+		dec.length = len(data)
+		dec.data = data
+		err = dec.decodeUint16(vt)
+	case **uint16:
+		dec = borrowDecoder(nil, 0)
+		dec.length = len(data)
+		dec.data = data
+		err = dec.decodeUint16Null(vt)
+	case *uint32:
+		dec = borrowDecoder(nil, 0)
+		dec.length = len(data)
+		dec.data = data
+		err = dec.decodeUint32(vt)
+	case **uint32:
+		dec = borrowDecoder(nil, 0)
+		dec.length = len(data)
+		dec.data = data
+		err = dec.decodeUint32Null(vt)
+	case *uint64:
+		dec = borrowDecoder(nil, 0)
+		dec.length = len(data)
+		dec.data = data
+		err = dec.decodeUint64(vt)
+	case **uint64:
+		dec = borrowDecoder(nil, 0)
+		dec.length = len(data)
+		dec.data = data
+		err = dec.decodeUint64Null(vt)
+	case *float64:
+		dec = borrowDecoder(nil, 0)
+		dec.length = len(data)
+		dec.data = data
+		err = dec.decodeFloat64(vt)
+	case **float64:
+		dec = borrowDecoder(nil, 0)
+		dec.length = len(data)
+		dec.data = data
+		err = dec.decodeFloat64Null(vt)
+	case *float32:
+		dec = borrowDecoder(nil, 0)
+		dec.length = len(data)
+		dec.data = data
+		err = dec.decodeFloat32(vt)
+	case **float32:
+		dec = borrowDecoder(nil, 0)
+		dec.length = len(data)
+		dec.data = data
+		err = dec.decodeFloat32Null(vt)
+	case *bool:
+		dec = borrowDecoder(nil, 0)
+		dec.length = len(data)
+		dec.data = data
+		err = dec.decodeBool(vt)
+	case **bool:
+		dec = borrowDecoder(nil, 0)
+		dec.length = len(data)
+		dec.data = data
+		err = dec.decodeBoolNull(vt)
+	case UnmarshalerJSONObject:
+		dec = borrowDecoder(nil, 0)
+		dec.length = len(data)
+		dec.data = make([]byte, len(data))
+		copy(dec.data, data)
+		_, err = dec.decodeObject(vt)
+	case UnmarshalerJSONArray:
+		dec = borrowDecoder(nil, 0)
+		dec.length = len(data)
+		dec.data = make([]byte, len(data))
+		copy(dec.data, data)
+		_, err = dec.decodeArray(vt)
+	case *interface{}:
+		dec = borrowDecoder(nil, 0)
+		dec.length = len(data)
+		dec.data = make([]byte, len(data))
+		copy(dec.data, data)
+		err = dec.decodeInterface(vt)
+	default:
+		return InvalidUnmarshalError(fmt.Sprintf(invalidUnmarshalErrorMsg, vt))
+	}
+	defer dec.Release()
+	if err != nil {
+		return err
+	}
+	return dec.err
+}
+
+// UnmarshalerJSONObject is the interface to implement to decode a JSON Object.
+type UnmarshalerJSONObject interface {
+	UnmarshalJSONObject(*Decoder, string) error
+	NKeys() int
+}
+
+// UnmarshalerJSONArray is the interface to implement to decode a JSON Array.
+type UnmarshalerJSONArray interface {
+	UnmarshalJSONArray(*Decoder) error
+}
+
+// A Decoder reads and decodes JSON values from an input stream.
+type Decoder struct {
+	r          io.Reader
+	data       []byte
+	err        error
+	isPooled   byte
+	called     byte
+	child      byte
+	cursor     int
+	length     int
+	keysDone   int
+	arrayIndex int
+}
+
+// Decode reads the next JSON-encoded value from the decoder's input (io.Reader) and stores it in the value pointed to by v.
+//
+// See the documentation for Unmarshal for details about the conversion of JSON into a Go value.
+// The differences between Decode and Unmarshal are:
+// 	- Decode reads from an io.Reader in the Decoder, whereas Unmarshal reads from a []byte
+// 	- Decode leaves to the user the option of borrowing and releasing a Decoder, whereas Unmarshal internally always borrows a Decoder and releases it when the unmarshaling is completed
+func (dec *Decoder) Decode(v interface{}) error {
+	if dec.isPooled == 1 {
+		panic(InvalidUsagePooledDecoderError("Invalid usage of pooled decoder"))
+	}
+	var err error
+	switch vt := v.(type) {
+	case *string:
+		err = dec.decodeString(vt)
+	case **string:
+		err = dec.decodeStringNull(vt)
+	case *int:
+		err = dec.decodeInt(vt)
+	case **int:
+		err = dec.decodeIntNull(vt)
+	case *int8:
+		err = dec.decodeInt8(vt)
+	case **int8:
+		err = dec.decodeInt8Null(vt)
+	case *int16:
+		err = dec.decodeInt16(vt)
+	case **int16:
+		err = dec.decodeInt16Null(vt)
+	case *int32:
+		err = dec.decodeInt32(vt)
+	case **int32:
+		err = dec.decodeInt32Null(vt)
+	case *int64:
+		err = dec.decodeInt64(vt)
+	case **int64:
+		err = dec.decodeInt64Null(vt)
+	case *uint8:
+		err = dec.decodeUint8(vt)
+	case **uint8:
+		err = dec.decodeUint8Null(vt)
+	case *uint16:
+		err = dec.decodeUint16(vt)
+	case **uint16:
+		err = dec.decodeUint16Null(vt)
+	case *uint32:
+		err = dec.decodeUint32(vt)
+	case **uint32:
+		err = dec.decodeUint32Null(vt)
+	case *uint64:
+		err = dec.decodeUint64(vt)
+	case **uint64:
+		err = dec.decodeUint64Null(vt)
+	case *float64:
+		err = dec.decodeFloat64(vt)
+	case **float64:
+		err = dec.decodeFloat64Null(vt)
+	case *float32:
+		err = dec.decodeFloat32(vt)
+	case **float32:
+		err = dec.decodeFloat32Null(vt)
+	case *bool:
+		err = dec.decodeBool(vt)
+	case **bool:
+		err = dec.decodeBoolNull(vt)
+	case UnmarshalerJSONObject:
+		_, err = dec.decodeObject(vt)
+	case UnmarshalerJSONArray:
+		_, err = dec.decodeArray(vt)
+	case *EmbeddedJSON:
+		err = dec.decodeEmbeddedJSON(vt)
+	case *interface{}:
+		err = dec.decodeInterface(vt)
+	default:
+		return InvalidUnmarshalError(fmt.Sprintf(invalidUnmarshalErrorMsg, vt))
+	}
+	if err != nil {
+		return err
+	}
+	return dec.err
+}
+
+// Non exported
+
+func isDigit(b byte) bool {
+	switch b {
+	case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+		return true
+	default:
+		return false
+	}
+}
+
+func (dec *Decoder) read() bool {
+	if dec.r != nil {
+		// if we reach the end, double the buffer to ensure there's always more space
+		if len(dec.data) == dec.length {
+			nLen := dec.length * 2
+			if nLen == 0 {
+				nLen = 512
+			}
+			Buf := make([]byte, nLen, nLen)
+			copy(Buf, dec.data)
+			dec.data = Buf
+		}
+		var n int
+		var err error
+		for n == 0 {
+			n, err = dec.r.Read(dec.data[dec.length:])
+			if err != nil {
+				if err != io.EOF {
+					dec.err = err
+					return false
+				}
+				if n == 0 {
+					return false
+				}
+				dec.length = dec.length + n
+				return true
+			}
+		}
+		dec.length = dec.length + n
+		return true
+	}
+	return false
+}
+
+func (dec *Decoder) nextChar() byte {
+	for ; dec.cursor < dec.length || dec.read(); dec.cursor++ {
+		switch dec.data[dec.cursor] {
+		case ' ', '\n', '\t', '\r', ',':
+			continue
+		}
+		d := dec.data[dec.cursor]
+		return d
+	}
+	return 0
+}

vendor/github.com/francoispqt/gojay/decode_array.go

@@ -0,0 +1,247 @@
+package gojay
+
+import "reflect"
+
+// DecodeArray reads the next JSON-encoded value from the decoder's input (io.Reader)
+// and stores it in the value pointed to by v.
+//
+// v must implement UnmarshalerJSONArray.
+//
+// See the documentation for Unmarshal for details about the conversion of JSON into a Go value.
+func (dec *Decoder) DecodeArray(v UnmarshalerJSONArray) error {
+	if dec.isPooled == 1 {
+		panic(InvalidUsagePooledDecoderError("Invalid usage of pooled decoder"))
+	}
+	_, err := dec.decodeArray(v)
+	return err
+}
+func (dec *Decoder) decodeArray(arr UnmarshalerJSONArray) (int, error) {
+	// remember last array index in case of nested arrays
+	lastArrayIndex := dec.arrayIndex
+	dec.arrayIndex = 0
+	defer func() {
+		dec.arrayIndex = lastArrayIndex
+	}()
+	for ; dec.cursor < dec.length || dec.read(); dec.cursor++ {
+		switch dec.data[dec.cursor] {
+		case ' ', '\n', '\t', '\r', ',':
+			continue
+		case '[':
+			dec.cursor = dec.cursor + 1
+			// array is open, char is not space start readings
+			for dec.nextChar() != 0 {
+				// closing array
+				if dec.data[dec.cursor] == ']' {
+					dec.cursor = dec.cursor + 1
+					return dec.cursor, nil
+				}
+				// calling unmarshall function for each element of the slice
+				err := arr.UnmarshalJSONArray(dec)
+				if err != nil {
+					return 0, err
+				}
+				dec.arrayIndex++
+			}
+			return 0, dec.raiseInvalidJSONErr(dec.cursor)
+		case 'n':
+			// is null
+			dec.cursor++
+			err := dec.assertNull()
+			if err != nil {
+				return 0, err
+			}
+			return dec.cursor, nil
+		case '{', '"', 'f', 't', '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+			// can't unmarshall to struct
+			// we skip array and set Error
+			dec.err = dec.makeInvalidUnmarshalErr(arr)
+			err := dec.skipData()
+			if err != nil {
+				return 0, err
+			}
+			return dec.cursor, nil
+		default:
+			return 0, dec.raiseInvalidJSONErr(dec.cursor)
+		}
+	}
+	return 0, dec.raiseInvalidJSONErr(dec.cursor)
+}
+func (dec *Decoder) decodeArrayNull(v interface{}) (int, error) {
+	// remember last array index in case of nested arrays
+	lastArrayIndex := dec.arrayIndex
+	dec.arrayIndex = 0
+	defer func() {
+		dec.arrayIndex = lastArrayIndex
+	}()
+	vv := reflect.ValueOf(v)
+	vvt := vv.Type()
+	if vvt.Kind() != reflect.Ptr || vvt.Elem().Kind() != reflect.Ptr {
+		dec.err = ErrUnmarshalPtrExpected
+		return 0, dec.err
+	}
+	// not an array not an error, but do not know what to do
+	// do not check syntax
+	for ; dec.cursor < dec.length || dec.read(); dec.cursor++ {
+		switch dec.data[dec.cursor] {
+		case ' ', '\n', '\t', '\r', ',':
+			continue
+		case '[':
+			dec.cursor = dec.cursor + 1
+			// create our new type
+			elt := vv.Elem()
+			n := reflect.New(elt.Type().Elem())
+			var arr UnmarshalerJSONArray
+			var ok bool
+			if arr, ok = n.Interface().(UnmarshalerJSONArray); !ok {
+				dec.err = dec.makeInvalidUnmarshalErr((UnmarshalerJSONArray)(nil))
+				return 0, dec.err
+			}
+			// array is open, char is not space start readings
+			for dec.nextChar() != 0 {
+				// closing array
+				if dec.data[dec.cursor] == ']' {
+					elt.Set(n)
+					dec.cursor = dec.cursor + 1
+					return dec.cursor, nil
+				}
+				// calling unmarshall function for each element of the slice
+				err := arr.UnmarshalJSONArray(dec)
+				if err != nil {
+					return 0, err
+				}
+				dec.arrayIndex++
+			}
+			return 0, dec.raiseInvalidJSONErr(dec.cursor)
+		case 'n':
+			// is null
+			dec.cursor++
+			err := dec.assertNull()
+			if err != nil {
+				return 0, err
+			}
+			return dec.cursor, nil
+		case '{', '"', 'f', 't', '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+			// can't unmarshall to struct
+			// we skip array and set Error
+			dec.err = dec.makeInvalidUnmarshalErr((UnmarshalerJSONArray)(nil))
+			err := dec.skipData()
+			if err != nil {
+				return 0, err
+			}
+			return dec.cursor, nil
+		default:
+			return 0, dec.raiseInvalidJSONErr(dec.cursor)
+		}
+	}
+	return 0, dec.raiseInvalidJSONErr(dec.cursor)
+}
+
+func (dec *Decoder) skipArray() (int, error) {
+	var arraysOpen = 1
+	var arraysClosed = 0
+	// var stringOpen byte = 0
+	for j := dec.cursor; j < dec.length || dec.read(); j++ {
+		switch dec.data[j] {
+		case ']':
+			arraysClosed++
+			// everything is closed return
+			if arraysOpen == arraysClosed {
+				// add char to object data
+				return j + 1, nil
+			}
+		case '[':
+			arraysOpen++
+		case '"':
+			j++
+			var isInEscapeSeq bool
+			var isFirstQuote = true
+			for ; j < dec.length || dec.read(); j++ {
+				if dec.data[j] != '"' {
+					continue
+				}
+				if dec.data[j-1] != '\\' || (!isInEscapeSeq && !isFirstQuote) {
+					break
+				} else {
+					isInEscapeSeq = false
+				}
+				if isFirstQuote {
+					isFirstQuote = false
+				}
+				// loop backward and count how many anti slash found
+				// to see if string is effectively escaped
+				ct := 0
+				for i := j - 1; i > 0; i-- {
+					if dec.data[i] != '\\' {
+						break
+					}
+					ct++
+				}
+				// is pair number of slashes, quote is not escaped
+				if ct&1 == 0 {
+					break
+				}
+				isInEscapeSeq = true
+			}
+		default:
+			continue
+		}
+	}
+	return 0, dec.raiseInvalidJSONErr(dec.cursor)
+}
+
+// DecodeArrayFunc is a func type implementing UnmarshalerJSONArray.
+// Use it to cast a `func(*Decoder) error` to Unmarshal an array on the fly.
+
+type DecodeArrayFunc func(*Decoder) error
+
+// UnmarshalJSONArray implements UnmarshalerJSONArray.
+func (f DecodeArrayFunc) UnmarshalJSONArray(dec *Decoder) error {
+	return f(dec)
+}
+
+// IsNil implements UnmarshalerJSONArray.
+func (f DecodeArrayFunc) IsNil() bool {
+	return f == nil
+}
+
+// Add Values functions
+
+// AddArray decodes the JSON value within an object or an array to a UnmarshalerJSONArray.
+func (dec *Decoder) AddArray(v UnmarshalerJSONArray) error {
+	return dec.Array(v)
+}
+
+// AddArrayNull decodes the JSON value within an object or an array to a UnmarshalerJSONArray.
+func (dec *Decoder) AddArrayNull(v interface{}) error {
+	return dec.ArrayNull(v)
+}
+
+// Array decodes the JSON value within an object or an array to a UnmarshalerJSONArray.
+func (dec *Decoder) Array(v UnmarshalerJSONArray) error {
+	newCursor, err := dec.decodeArray(v)
+	if err != nil {
+		return err
+	}
+	dec.cursor = newCursor
+	dec.called |= 1
+	return nil
+}
+
+// ArrayNull decodes the JSON value within an object or an array to a UnmarshalerJSONArray.
+// v should be a pointer to an UnmarshalerJSONArray,
+// if `null` value is encountered in JSON, it will leave the value v untouched,
+// else it will create a new instance of the UnmarshalerJSONArray behind v.
+func (dec *Decoder) ArrayNull(v interface{}) error {
+	newCursor, err := dec.decodeArrayNull(v)
+	if err != nil {
+		return err
+	}
+	dec.cursor = newCursor
+	dec.called |= 1
+	return nil
+}
+
+// Index returns the index of an array being decoded.
+func (dec *Decoder) Index() int {
+	return dec.arrayIndex
+}

vendor/github.com/francoispqt/gojay/decode_bool.go

@@ -0,0 +1,241 @@
+package gojay
+
+// DecodeBool reads the next JSON-encoded value from the decoder's input (io.Reader)
+// and stores it in the boolean pointed to by v.
+//
+// See the documentation for Unmarshal for details about the conversion of JSON into a Go value.
+func (dec *Decoder) DecodeBool(v *bool) error {
+	if dec.isPooled == 1 {
+		panic(InvalidUsagePooledDecoderError("Invalid usage of pooled decoder"))
+	}
+	return dec.decodeBool(v)
+}
+func (dec *Decoder) decodeBool(v *bool) error {
+	for ; dec.cursor < dec.length || dec.read(); dec.cursor++ {
+		switch dec.data[dec.cursor] {
+		case ' ', '\n', '\t', '\r', ',':
+			continue
+		case 't':
+			dec.cursor++
+			err := dec.assertTrue()
+			if err != nil {
+				return err
+			}
+			*v = true
+			return nil
+		case 'f':
+			dec.cursor++
+			err := dec.assertFalse()
+			if err != nil {
+				return err
+			}
+			*v = false
+			return nil
+		case 'n':
+			dec.cursor++
+			err := dec.assertNull()
+			if err != nil {
+				return err
+			}
+			*v = false
+			return nil
+		default:
+			dec.err = dec.makeInvalidUnmarshalErr(v)
+			err := dec.skipData()
+			if err != nil {
+				return err
+			}
+			return nil
+		}
+	}
+	return nil
+}
+func (dec *Decoder) decodeBoolNull(v **bool) error {
+	for ; dec.cursor < dec.length || dec.read(); dec.cursor++ {
+		switch dec.data[dec.cursor] {
+		case ' ', '\n', '\t', '\r', ',':
+			continue
+		case 't':
+			dec.cursor++
+			err := dec.assertTrue()
+			if err != nil {
+				return err
+			}
+			if *v == nil {
+				*v = new(bool)
+			}
+			**v = true
+			return nil
+		case 'f':
+			dec.cursor++
+			err := dec.assertFalse()
+			if err != nil {
+				return err
+			}
+			if *v == nil {
+				*v = new(bool)
+			}
+			**v = false
+			return nil
+		case 'n':
+			dec.cursor++
+			err := dec.assertNull()
+			if err != nil {
+				return err
+			}
+			return nil
+		default:
+			dec.err = dec.makeInvalidUnmarshalErr(v)
+			err := dec.skipData()
+			if err != nil {
+				return err
+			}
+			return nil
+		}
+	}
+	return nil
+}
+
+func (dec *Decoder) assertTrue() error {
+	i := 0
+	for ; dec.cursor < dec.length || dec.read(); dec.cursor++ {
+		switch i {
+		case 0:
+			if dec.data[dec.cursor] != 'r' {
+				return dec.raiseInvalidJSONErr(dec.cursor)
+			}
+		case 1:
+			if dec.data[dec.cursor] != 'u' {
+				return dec.raiseInvalidJSONErr(dec.cursor)
+			}
+		case 2:
+			if dec.data[dec.cursor] != 'e' {
+				return dec.raiseInvalidJSONErr(dec.cursor)
+			}
+		case 3:
+			switch dec.data[dec.cursor] {
+			case ' ', '\b', '\t', '\n', ',', ']', '}':
+				// dec.cursor--
+				return nil
+			default:
+				return dec.raiseInvalidJSONErr(dec.cursor)
+			}
+		}
+		i++
+	}
+	if i == 3 {
+		return nil
+	}
+	return dec.raiseInvalidJSONErr(dec.cursor)
+}
+
+func (dec *Decoder) assertNull() error {
+	i := 0
+	for ; dec.cursor < dec.length || dec.read(); dec.cursor++ {
+		switch i {
+		case 0:
+			if dec.data[dec.cursor] != 'u' {
+				return dec.raiseInvalidJSONErr(dec.cursor)
+			}
+		case 1:
+			if dec.data[dec.cursor] != 'l' {
+				return dec.raiseInvalidJSONErr(dec.cursor)
+			}
+		case 2:
+			if dec.data[dec.cursor] != 'l' {
+				return dec.raiseInvalidJSONErr(dec.cursor)
+			}
+		case 3:
+			switch dec.data[dec.cursor] {
+			case ' ', '\t', '\n', ',', ']', '}':
+				// dec.cursor--
+				return nil
+			default:
+				return dec.raiseInvalidJSONErr(dec.cursor)
+			}
+		}
+		i++
+	}
+	if i == 3 {
+		return nil
+	}
+	return dec.raiseInvalidJSONErr(dec.cursor)
+}
+
+func (dec *Decoder) assertFalse() error {
+	i := 0
+	for ; dec.cursor < dec.length || dec.read(); dec.cursor++ {
+		switch i {
+		case 0:
+			if dec.data[dec.cursor] != 'a' {
+				return dec.raiseInvalidJSONErr(dec.cursor)
+			}
+		case 1:
+			if dec.data[dec.cursor] != 'l' {
+				return dec.raiseInvalidJSONErr(dec.cursor)
+			}
+		case 2:
+			if dec.data[dec.cursor] != 's' {
+				return dec.raiseInvalidJSONErr(dec.cursor)
+			}
+		case 3:
+			if dec.data[dec.cursor] != 'e' {
+				return dec.raiseInvalidJSONErr(dec.cursor)
+			}
+		case 4:
+			switch dec.data[dec.cursor] {
+			case ' ', '\t', '\n', ',', ']', '}':
+				// dec.cursor--
+				return nil
+			default:
+				return dec.raiseInvalidJSONErr(dec.cursor)
+			}
+		}
+		i++
+	}
+	if i == 4 {
+		return nil
+	}
+	return dec.raiseInvalidJSONErr(dec.cursor)
+}
+
+// Add Values functions
+
+// AddBool decodes the JSON value within an object or an array to a *bool.
+// If next key is neither null nor a JSON boolean, an InvalidUnmarshalError will be returned.
+// If next key is null, bool will be false.
+func (dec *Decoder) AddBool(v *bool) error {
+	return dec.Bool(v)
+}
+
+// AddBoolNull decodes the JSON value within an object or an array to a *bool.
+// If next key is neither null nor a JSON boolean, an InvalidUnmarshalError will be returned.
+// If next key is null, bool will be false.
+// If a `null` is encountered, gojay does not change the value of the pointer.
+func (dec *Decoder) AddBoolNull(v **bool) error {
+	return dec.BoolNull(v)
+}
+
+// Bool decodes the JSON value within an object or an array to a *bool.
+// If next key is neither null nor a JSON boolean, an InvalidUnmarshalError will be returned.
+// If next key is null, bool will be false.
+func (dec *Decoder) Bool(v *bool) error {
+	err := dec.decodeBool(v)
+	if err != nil {
+		return err
+	}
+	dec.called |= 1
+	return nil
+}
+
+// BoolNull decodes the JSON value within an object or an array to a *bool.
+// If next key is neither null nor a JSON boolean, an InvalidUnmarshalError will be returned.
+// If next key is null, bool will be false.
+func (dec *Decoder) BoolNull(v **bool) error {
+	err := dec.decodeBoolNull(v)
+	if err != nil {
+		return err
+	}
+	dec.called |= 1
+	return nil
+}

vendor/github.com/francoispqt/gojay/decode_embedded_json.go

@@ -0,0 +1,85 @@
+package gojay
+
+// EmbeddedJSON is a raw encoded JSON value.
+// It can be used to delay JSON decoding or precompute a JSON encoding.
+type EmbeddedJSON []byte
+
+func (dec *Decoder) decodeEmbeddedJSON(ej *EmbeddedJSON) error {
+	var err error
+	if ej == nil {
+		return InvalidUnmarshalError("Invalid nil pointer given")
+	}
+	var beginOfEmbeddedJSON int
+	for ; dec.cursor < dec.length || dec.read(); dec.cursor++ {
+		switch dec.data[dec.cursor] {
+		case ' ', '\n', '\t', '\r', ',':
+			continue
+		// is null
+		case 'n':
+			beginOfEmbeddedJSON = dec.cursor
+			dec.cursor++
+			err := dec.assertNull()
+			if err != nil {
+				return err
+			}
+		case 't':
+			beginOfEmbeddedJSON = dec.cursor
+			dec.cursor++
+			err := dec.assertTrue()
+			if err != nil {
+				return err
+			}
+		// is false
+		case 'f':
+			beginOfEmbeddedJSON = dec.cursor
+			dec.cursor++
+			err := dec.assertFalse()
+			if err != nil {
+				return err
+			}
+		// is an object
+		case '{':
+			beginOfEmbeddedJSON = dec.cursor
+			dec.cursor = dec.cursor + 1
+			dec.cursor, err = dec.skipObject()
+		// is string
+		case '"':
+			beginOfEmbeddedJSON = dec.cursor
+			dec.cursor = dec.cursor + 1
+			err = dec.skipString() // why no new dec.cursor in result?
+		// is array
+		case '[':
+			beginOfEmbeddedJSON = dec.cursor
+			dec.cursor = dec.cursor + 1
+			dec.cursor, err = dec.skipArray()
+		case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '-':
+			beginOfEmbeddedJSON = dec.cursor
+			dec.cursor, err = dec.skipNumber()
+		}
+		break
+	}
+	if err == nil {
+		if dec.cursor-1 >= beginOfEmbeddedJSON {
+			*ej = append(*ej, dec.data[beginOfEmbeddedJSON:dec.cursor]...)
+		}
+		dec.called |= 1
+	}
+	return err
+}
+
+// AddEmbeddedJSON adds an EmbeddedsJSON to the value pointed by v.
+// It can be used to delay JSON decoding or precompute a JSON encoding.
+func (dec *Decoder) AddEmbeddedJSON(v *EmbeddedJSON) error {
+	return dec.EmbeddedJSON(v)
+}
+
+// EmbeddedJSON adds an EmbeddedsJSON to the value pointed by v.
+// It can be used to delay JSON decoding or precompute a JSON encoding.
+func (dec *Decoder) EmbeddedJSON(v *EmbeddedJSON) error {
+	err := dec.decodeEmbeddedJSON(v)
+	if err != nil {
+		return err
+	}
+	dec.called |= 1
+	return nil
+}

vendor/github.com/francoispqt/gojay/decode_interface.go

@@ -0,0 +1,130 @@
+package gojay
+
+// TODO @afiune for now we are using the standard json unmarshaling but in
+// the future it would be great to implement one here inside this repo
+import "encoding/json"
+
+// DecodeInterface reads the next JSON-encoded value from the decoder's input (io.Reader) and stores it in the value pointed to by i.
+//
+// i must be an interface poiter
+func (dec *Decoder) DecodeInterface(i *interface{}) error {
+	if dec.isPooled == 1 {
+		panic(InvalidUsagePooledDecoderError("Invalid usage of pooled decoder"))
+	}
+	err := dec.decodeInterface(i)
+	return err
+}
+
+func (dec *Decoder) decodeInterface(i *interface{}) error {
+	start, end, err := dec.getObject()
+	if err != nil {
+		dec.cursor = start
+		return err
+	}
+
+	// if start & end are equal the object is a null, don't unmarshal
+	if start == end {
+		return nil
+	}
+
+	object := dec.data[start:end]
+	if err = json.Unmarshal(object, i); err != nil {
+		return err
+	}
+
+	dec.cursor = end
+	return nil
+}
+
+// @afiune Maybe return the type as well?
+func (dec *Decoder) getObject() (start int, end int, err error) {
+	// start cursor
+	for ; dec.cursor < dec.length || dec.read(); dec.cursor++ {
+		switch dec.data[dec.cursor] {
+		case ' ', '\n', '\t', '\r', ',':
+			continue
+		// is null
+		case 'n':
+			dec.cursor++
+			err = dec.assertNull()
+			if err != nil {
+				return
+			}
+			// Set start & end to the same cursor to indicate the object
+			// is a null and should not be unmarshal
+			start = dec.cursor
+			end = dec.cursor
+			return
+		case 't':
+			start = dec.cursor
+			dec.cursor++
+			err = dec.assertTrue()
+			if err != nil {
+				return
+			}
+			end = dec.cursor
+			dec.cursor++
+			return
+		// is false
+		case 'f':
+			start = dec.cursor
+			dec.cursor++
+			err = dec.assertFalse()
+			if err != nil {
+				return
+			}
+			end = dec.cursor
+			dec.cursor++
+			return
+		// is an object
+		case '{':
+			start = dec.cursor
+			dec.cursor++
+			end, err = dec.skipObject()
+			dec.cursor = end
+			return
+		// is string
+		case '"':
+			start = dec.cursor
+			dec.cursor++
+			start, end, err = dec.getString()
+			start--
+			dec.cursor = end
+			return
+		// is array
+		case '[':
+			start = dec.cursor
+			dec.cursor++
+			end, err = dec.skipArray()
+			dec.cursor = end
+			return
+		case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '-':
+			start = dec.cursor
+			end, err = dec.skipNumber()
+			dec.cursor = end
+			return
+		default:
+			err = dec.raiseInvalidJSONErr(dec.cursor)
+			return
+		}
+	}
+	err = dec.raiseInvalidJSONErr(dec.cursor)
+	return
+}
+
+// Add Values functions
+
+// AddInterface decodes the JSON value within an object or an array to a interface{}.
+func (dec *Decoder) AddInterface(v *interface{}) error {
+	return dec.Interface(v)
+}
+
+// Interface decodes the JSON value within an object or an array to an interface{}.
+func (dec *Decoder) Interface(value *interface{}) error {
+	err := dec.decodeInterface(value)
+	if err != nil {
+		return err
+	}
+	dec.called |= 1
+	return nil
+}

vendor/github.com/francoispqt/gojay/decode_number.go

@@ -0,0 +1,118 @@
+package gojay
+
+import (
+	"math"
+)
+
+var digits []int8
+
+const maxInt64toMultiply = math.MaxInt64 / 10
+const maxInt32toMultiply = math.MaxInt32 / 10
+const maxInt16toMultiply = math.MaxInt16 / 10
+const maxInt8toMultiply = math.MaxInt8 / 10
+const maxUint8toMultiply = math.MaxUint8 / 10
+const maxUint16toMultiply = math.MaxUint16 / 10
+const maxUint32toMultiply = math.MaxUint32 / 10
+const maxUint64toMultiply = math.MaxUint64 / 10
+const maxUint32Length = 10
+const maxUint64Length = 20
+const maxUint16Length = 5
+const maxUint8Length = 3
+const maxInt32Length = 10
+const maxInt64Length = 19
+const maxInt16Length = 5
+const maxInt8Length = 3
+const invalidNumber = int8(-1)
+
+var pow10uint64 = [21]uint64{
+	0,
+	1,
+	10,
+	100,
+	1000,
+	10000,
+	100000,
+	1000000,
+	10000000,
+	100000000,
+	1000000000,
+	10000000000,
+	100000000000,
+	1000000000000,
+	10000000000000,
+	100000000000000,
+	1000000000000000,
+	10000000000000000,
+	100000000000000000,
+	1000000000000000000,
+	10000000000000000000,
+}
+
+var skipNumberEndCursorIncrement [256]int
+
+func init() {
+	digits = make([]int8, 256)
+	for i := 0; i < len(digits); i++ {
+		digits[i] = invalidNumber
+	}
+	for i := int8('0'); i <= int8('9'); i++ {
+		digits[i] = i - int8('0')
+	}
+
+	for i := 0; i < 256; i++ {
+		switch i {
+		case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '.', 'e', 'E', '+', '-':
+			skipNumberEndCursorIncrement[i] = 1
+		}
+	}
+}
+
+func (dec *Decoder) skipNumber() (int, error) {
+	end := dec.cursor + 1
+	// look for following numbers
+	for j := dec.cursor + 1; j < dec.length || dec.read(); j++ {
+		end += skipNumberEndCursorIncrement[dec.data[j]]
+
+		switch dec.data[j] {
+		case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '.', 'e', 'E', '+', '-', ' ', '\n', '\t', '\r':
+			continue
+		case ',', '}', ']':
+			return end, nil
+		default:
+			// invalid json we expect numbers, dot (single one), comma, or spaces
+			return end, dec.raiseInvalidJSONErr(dec.cursor)
+		}
+	}
+
+	return end, nil
+}
+
+func (dec *Decoder) getExponent() (int64, error) {
+	start := dec.cursor
+	end := dec.cursor
+	for ; dec.cursor < dec.length || dec.read(); dec.cursor++ {
+		switch dec.data[dec.cursor] { // is positive
+		case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+			end = dec.cursor + 1
+		case '-':
+			dec.cursor++
+			exp, err := dec.getExponent()
+			return -exp, err
+		case '+':
+			dec.cursor++
+			return dec.getExponent()
+		default:
+			// if nothing return 0
+			// could raise error
+			if start == end {
+				return 0, dec.raiseInvalidJSONErr(dec.cursor)
+			}
+			return dec.atoi64(start, end-1), nil
+		}
+	}
+	if start == end {
+
+		return 0, dec.raiseInvalidJSONErr(dec.cursor)
+	}
+	return dec.atoi64(start, end-1), nil
+}

vendor/github.com/francoispqt/gojay/decode_number_float.go

@@ -0,0 +1,516 @@
+package gojay
+
+// DecodeFloat64 reads the next JSON-encoded value from the decoder's input (io.Reader) and stores it in the float64 pointed to by v.
+//
+// See the documentation for Unmarshal for details about the conversion of JSON into a Go value.
+func (dec *Decoder) DecodeFloat64(v *float64) error {
+	if dec.isPooled == 1 {
+		panic(InvalidUsagePooledDecoderError("Invalid usage of pooled decoder"))
+	}
+	return dec.decodeFloat64(v)
+}
+func (dec *Decoder) decodeFloat64(v *float64) error {
+	for ; dec.cursor < dec.length || dec.read(); dec.cursor++ {
+		switch c := dec.data[dec.cursor]; c {
+		case ' ', '\n', '\t', '\r', ',':
+			continue
+		case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+			val, err := dec.getFloat()
+			if err != nil {
+				return err
+			}
+			*v = val
+			return nil
+		case '-':
+			dec.cursor = dec.cursor + 1
+			val, err := dec.getFloatNegative()
+			if err != nil {
+				return err
+			}
+			*v = -val
+			return nil
+		case 'n':
+			dec.cursor++
+			err := dec.assertNull()
+			if err != nil {
+				return err
+			}
+			return nil
+		default:
+			dec.err = dec.makeInvalidUnmarshalErr(v)
+			err := dec.skipData()
+			if err != nil {
+				return err
+			}
+			return nil
+		}
+	}
+	return dec.raiseInvalidJSONErr(dec.cursor)
+}
+func (dec *Decoder) decodeFloat64Null(v **float64) error {
+	for ; dec.cursor < dec.length || dec.read(); dec.cursor++ {
+		switch c := dec.data[dec.cursor]; c {
+		case ' ', '\n', '\t', '\r', ',':
+			continue
+		case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+			val, err := dec.getFloat()
+			if err != nil {
+				return err
+			}
+			if *v == nil {
+				*v = new(float64)
+			}
+			**v = val
+			return nil
+		case '-':
+			dec.cursor = dec.cursor + 1
+			val, err := dec.getFloatNegative()
+			if err != nil {
+				return err
+			}
+			if *v == nil {
+				*v = new(float64)
+			}
+			**v = -val
+			return nil
+		case 'n':
+			dec.cursor++
+			err := dec.assertNull()
+			if err != nil {
+				return err
+			}
+			return nil
+		default:
+			dec.err = dec.makeInvalidUnmarshalErr(v)
+			err := dec.skipData()
+			if err != nil {
+				return err
+			}
+			return nil
+		}
+	}
+	return dec.raiseInvalidJSONErr(dec.cursor)
+}
+
+func (dec *Decoder) getFloatNegative() (float64, error) {
+	// look for following numbers
+	for ; dec.cursor < dec.length || dec.read(); dec.cursor++ {
+		switch dec.data[dec.cursor] {
+		case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+			return dec.getFloat()
+		default:
+			return 0, dec.raiseInvalidJSONErr(dec.cursor)
+		}
+	}
+	return 0, dec.raiseInvalidJSONErr(dec.cursor)
+}
+
+func (dec *Decoder) getFloat() (float64, error) {
+	var end = dec.cursor
+	var start = dec.cursor
+	// look for following numbers
+	for j := dec.cursor + 1; j < dec.length || dec.read(); j++ {
+		switch dec.data[j] {
+		case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+			end = j
+			continue
+		case '.':
+			// we get part before decimal as integer
+			beforeDecimal := dec.atoi64(start, end)
+			// then we get part after decimal as integer
+			start = j + 1
+			// get number after the decimal point
+			for i := j + 1; i < dec.length || dec.read(); i++ {
+				c := dec.data[i]
+				if isDigit(c) {
+					end = i
+					// multiply the before decimal point portion by 10 using bitwise
+					// make sure it doesn't overflow
+					if end-start < 18 {
+						beforeDecimal = (beforeDecimal << 3) + (beforeDecimal << 1)
+					}
+					continue
+				} else if (c == 'e' || c == 'E') && j < i-1 {
+					// we have an exponent, convert first the value we got before the exponent
+					var afterDecimal int64
+					expI := end - start + 2
+					// if exp is too long, it means number is too long, just truncate the number
+					if expI >= len(pow10uint64) || expI < 0 {
+						expI = len(pow10uint64) - 2
+						afterDecimal = dec.atoi64(start, start+expI-2)
+					} else {
+						// then we add both integers
+						// then we divide the number by the power found
+						afterDecimal = dec.atoi64(start, end)
+					}
+					dec.cursor = i + 1
+					pow := pow10uint64[expI]
+					floatVal := float64(beforeDecimal+afterDecimal) / float64(pow)
+					exp, err := dec.getExponent()
+					if err != nil {
+						return 0, err
+					}
+					pExp := (exp + (exp >> 31)) ^ (exp >> 31) + 1 // absolute exponent
+					if pExp >= int64(len(pow10uint64)) || pExp < 0 {
+						return 0, dec.raiseInvalidJSONErr(dec.cursor)
+					}
+					// if exponent is negative
+					if exp < 0 {
+						return float64(floatVal) * (1 / float64(pow10uint64[pExp])), nil
+					}
+					return float64(floatVal) * float64(pow10uint64[pExp]), nil
+				}
+				dec.cursor = i
+				break
+			}
+			if end >= dec.length || end < start {
+				return 0, dec.raiseInvalidJSONErr(dec.cursor)
+			}
+			var afterDecimal int64
+			expI := end - start + 2
+			// if exp is too long, it means number is too long, just truncate the number
+			if expI >= len(pow10uint64) || expI < 0 {
+				expI = 19
+				afterDecimal = dec.atoi64(start, start+expI-2)
+			} else {
+				afterDecimal = dec.atoi64(start, end)
+			}
+
+			pow := pow10uint64[expI]
+			// then we add both integers
+			// then we divide the number by the power found
+			return float64(beforeDecimal+afterDecimal) / float64(pow), nil
+		case 'e', 'E':
+			dec.cursor = j + 1
+			// we get part before decimal as integer
+			beforeDecimal := uint64(dec.atoi64(start, end))
+			// get exponent
+			exp, err := dec.getExponent()
+			if err != nil {
+				return 0, err
+			}
+			pExp := (exp + (exp >> 31)) ^ (exp >> 31) + 1 // abs
+			if pExp >= int64(len(pow10uint64)) || pExp < 0 {
+				return 0, dec.raiseInvalidJSONErr(dec.cursor)
+			}
+			// if exponent is negative
+			if exp < 0 {
+				return float64(beforeDecimal) * (1 / float64(pow10uint64[pExp])), nil
+			}
+			return float64(beforeDecimal) * float64(pow10uint64[pExp]), nil
+		case ' ', '\n', '\t', '\r', ',', '}', ']': // does not have decimal
+			dec.cursor = j
+			return float64(dec.atoi64(start, end)), nil
+		}
+		// invalid json we expect numbers, dot (single one), comma, or spaces
+		return 0, dec.raiseInvalidJSONErr(dec.cursor)
+	}
+	return float64(dec.atoi64(start, end)), nil
+}
+
+// DecodeFloat32 reads the next JSON-encoded value from the decoder's input (io.Reader) and stores it in the float32 pointed to by v.
+//
+// See the documentation for Unmarshal for details about the conversion of JSON into a Go value.
+func (dec *Decoder) DecodeFloat32(v *float32) error {
+	if dec.isPooled == 1 {
+		panic(InvalidUsagePooledDecoderError("Invalid usage of pooled decoder"))
+	}
+	return dec.decodeFloat32(v)
+}
+func (dec *Decoder) decodeFloat32(v *float32) error {
+	for ; dec.cursor < dec.length || dec.read(); dec.cursor++ {
+		switch c := dec.data[dec.cursor]; c {
+		case ' ', '\n', '\t', '\r', ',':
+			continue
+		case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+			val, err := dec.getFloat32()
+			if err != nil {
+				return err
+			}
+			*v = val
+			return nil
+		case '-':
+			dec.cursor = dec.cursor + 1
+			val, err := dec.getFloat32Negative()
+			if err != nil {
+				return err
+			}
+			*v = -val
+			return nil
+		case 'n':
+			dec.cursor++
+			err := dec.assertNull()
+			if err != nil {
+				return err
+			}
+			return nil
+		default:
+			dec.err = dec.makeInvalidUnmarshalErr(v)
+			err := dec.skipData()
+			if err != nil {
+				return err
+			}
+			return nil
+		}
+	}
+	return dec.raiseInvalidJSONErr(dec.cursor)
+}
+func (dec *Decoder) decodeFloat32Null(v **float32) error {
+	for ; dec.cursor < dec.length || dec.read(); dec.cursor++ {
+		switch c := dec.data[dec.cursor]; c {
+		case ' ', '\n', '\t', '\r', ',':
+			continue
+		case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+			val, err := dec.getFloat32()
+			if err != nil {
+				return err
+			}
+			if *v == nil {
+				*v = new(float32)
+			}
+			**v = val
+			return nil
+		case '-':
+			dec.cursor = dec.cursor + 1
+			val, err := dec.getFloat32Negative()
+			if err != nil {
+				return err
+			}
+			if *v == nil {
+				*v = new(float32)
+			}
+			**v = -val
+			return nil
+		case 'n':
+			dec.cursor++
+			err := dec.assertNull()
+			if err != nil {
+				return err
+			}
+			return nil
+		default:
+			dec.err = dec.makeInvalidUnmarshalErr(v)
+			err := dec.skipData()
+			if err != nil {
+				return err
+			}
+			return nil
+		}
+	}
+	return dec.raiseInvalidJSONErr(dec.cursor)
+}
+
+func (dec *Decoder) getFloat32Negative() (float32, error) {
+	// look for following numbers
+	for ; dec.cursor < dec.length || dec.read(); dec.cursor++ {
+		switch dec.data[dec.cursor] {
+		case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+			return dec.getFloat32()
+		default:
+			return 0, dec.raiseInvalidJSONErr(dec.cursor)
+		}
+	}
+	return 0, dec.raiseInvalidJSONErr(dec.cursor)
+}
+
+func (dec *Decoder) getFloat32() (float32, error) {
+	var end = dec.cursor
+	var start = dec.cursor
+	// look for following numbers
+	for j := dec.cursor + 1; j < dec.length || dec.read(); j++ {
+		switch dec.data[j] {
+		case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+			end = j
+			continue
+		case '.':
+			// we get part before decimal as integer
+			beforeDecimal := dec.atoi64(start, end)
+			// then we get part after decimal as integer
+			start = j + 1
+			// get number after the decimal point
+			// multiple the before decimal point portion by 10 using bitwise
+			for i := j + 1; i < dec.length || dec.read(); i++ {
+				c := dec.data[i]
+				if isDigit(c) {
+					end = i
+					// multiply the before decimal point portion by 10 using bitwise
+					// make sure it desn't overflow
+					if end-start < 9 {
+						beforeDecimal = (beforeDecimal << 3) + (beforeDecimal << 1)
+					}
+					continue
+				} else if (c == 'e' || c == 'E') && j < i-1 {
+					// we get the number before decimal
+					var afterDecimal int64
+					expI := end - start + 2
+					// if exp is too long, it means number is too long, just truncate the number
+					if expI >= 12 || expI < 0 {
+						expI = 10
+						afterDecimal = dec.atoi64(start, start+expI-2)
+					} else {
+						afterDecimal = dec.atoi64(start, end)
+					}
+					dec.cursor = i + 1
+					pow := pow10uint64[expI]
+					// then we add both integers
+					// then we divide the number by the power found
+					floatVal := float32(beforeDecimal+afterDecimal) / float32(pow)
+					exp, err := dec.getExponent()
+					if err != nil {
+						return 0, err
+					}
+					pExp := (exp + (exp >> 31)) ^ (exp >> 31) + 1 // abs
+					if pExp >= int64(len(pow10uint64)) || pExp < 0 {
+						return 0, dec.raiseInvalidJSONErr(dec.cursor)
+					}
+					// if exponent is negative
+					if exp < 0 {
+						return float32(floatVal) * (1 / float32(pow10uint64[pExp])), nil
+					}
+					return float32(floatVal) * float32(pow10uint64[pExp]), nil
+				}
+				dec.cursor = i
+				break
+			}
+			if end >= dec.length || end < start {
+				return 0, dec.raiseInvalidJSONErr(dec.cursor)
+			}
+			// then we add both integers
+			// then we divide the number by the power found
+			var afterDecimal int64
+			expI := end - start + 2
+			// if exp is too long, it means number is too long, just truncate the number
+			if expI >= 12 || expI < 0 {
+				expI = 10
+				afterDecimal = dec.atoi64(start, start+expI-2)
+			} else {
+				// then we add both integers
+				// then we divide the number by the power found
+				afterDecimal = dec.atoi64(start, end)
+			}
+			pow := pow10uint64[expI]
+			return float32(beforeDecimal+afterDecimal) / float32(pow), nil
+		case 'e', 'E':
+			dec.cursor = j + 1
+			// we get part before decimal as integer
+			beforeDecimal := dec.atoi64(start, end)
+			// get exponent
+			exp, err := dec.getExponent()
+			if err != nil {
+				return 0, err
+			}
+			pExp := (exp + (exp >> 31)) ^ (exp >> 31) + 1
+			if pExp >= int64(len(pow10uint64)) || pExp < 0 {
+				return 0, dec.raiseInvalidJSONErr(dec.cursor)
+			}
+			// if exponent is negative
+			if exp < 0 {
+				return float32(beforeDecimal) * (1 / float32(pow10uint64[pExp])), nil
+			}
+			return float32(beforeDecimal) * float32(pow10uint64[pExp]), nil
+		case ' ', '\n', '\t', '\r', ',', '}', ']': // does not have decimal
+			dec.cursor = j
+			return float32(dec.atoi64(start, end)), nil
+		}
+		// invalid json we expect numbers, dot (single one), comma, or spaces
+		return 0, dec.raiseInvalidJSONErr(dec.cursor)
+	}
+	return float32(dec.atoi64(start, end)), nil
+}
+
+// Add Values functions
+
+// AddFloat decodes the JSON value within an object or an array to a *float64.
+// If next key value overflows float64, an InvalidUnmarshalError error will be returned.
+func (dec *Decoder) AddFloat(v *float64) error {
+	return dec.Float64(v)
+}
+
+// AddFloatNull decodes the JSON value within an object or an array to a *float64.
+// If next key value overflows float64, an InvalidUnmarshalError error will be returned.
+// If a `null` is encountered, gojay does not change the value of the pointer.
+func (dec *Decoder) AddFloatNull(v **float64) error {
+	return dec.Float64Null(v)
+}
+
+// AddFloat64 decodes the JSON value within an object or an array to a *float64.
+// If next key value overflows float64, an InvalidUnmarshalError error will be returned.
+func (dec *Decoder) AddFloat64(v *float64) error {
+	return dec.Float64(v)
+}
+
+// AddFloat64Null decodes the JSON value within an object or an array to a *float64.
+// If next key value overflows float64, an InvalidUnmarshalError error will be returned.
+// If a `null` is encountered, gojay does not change the value of the pointer.
+func (dec *Decoder) AddFloat64Null(v **float64) error {
+	return dec.Float64Null(v)
+}
+
+// AddFloat32 decodes the JSON value within an object or an array to a *float64.
+// If next key value overflows float64, an InvalidUnmarshalError error will be returned.
+func (dec *Decoder) AddFloat32(v *float32) error {
+	return dec.Float32(v)
+}
+
+// AddFloat32Null decodes the JSON value within an object or an array to a *float64.
+// If next key value overflows float64, an InvalidUnmarshalError error will be returned.
+// If a `null` is encountered, gojay does not change the value of the pointer.
+func (dec *Decoder) AddFloat32Null(v **float32) error {
+	return dec.Float32Null(v)
+}
+
+// Float decodes the JSON value within an object or an array to a *float64.
+// If next key value overflows float64, an InvalidUnmarshalError error will be returned.
+func (dec *Decoder) Float(v *float64) error {
+	return dec.Float64(v)
+}
+
+// FloatNull decodes the JSON value within an object or an array to a *float64.
+// If next key value overflows float64, an InvalidUnmarshalError error will be returned.
+func (dec *Decoder) FloatNull(v **float64) error {
+	return dec.Float64Null(v)
+}
+
+// Float64 decodes the JSON value within an object or an array to a *float64.
+// If next key value overflows float64, an InvalidUnmarshalError error will be returned.
+func (dec *Decoder) Float64(v *float64) error {
+	err := dec.decodeFloat64(v)
+	if err != nil {
+		return err
+	}
+	dec.called |= 1
+	return nil
+}
+
+// Float64Null decodes the JSON value within an object or an array to a *float64.
+// If next key value overflows float64, an InvalidUnmarshalError error will be returned.
+func (dec *Decoder) Float64Null(v **float64) error {
+	err := dec.decodeFloat64Null(v)
+	if err != nil {
+		return err
+	}
+	dec.called |= 1
+	return nil
+}
+
+// Float32 decodes the JSON value within an object or an array to a *float64.
+// If next key value overflows float64, an InvalidUnmarshalError error will be returned.
+func (dec *Decoder) Float32(v *float32) error {
+	err := dec.decodeFloat32(v)
+	if err != nil {
+		return err
+	}
+	dec.called |= 1
+	return nil
+}
+
+// Float32Null decodes the JSON value within an object or an array to a *float64.
+// If next key value overflows float64, an InvalidUnmarshalError error will be returned.
+func (dec *Decoder) Float32Null(v **float32) error {
+	err := dec.decodeFloat32Null(v)
+	if err != nil {
+		return err
+	}
+	dec.called |= 1
+	return nil
+}

vendor/github.com/francoispqt/gojay/decode_number_uint.go

@@ -0,0 +1,715 @@
+package gojay
+
+import (
+	"math"
+)
+
+// DecodeUint8 reads the next JSON-encoded value from the decoder's input (io.Reader) and stores it in the uint8 pointed to by v.
+//
+// See the documentation for Unmarshal for details about the conversion of JSON into a Go value.
+func (dec *Decoder) DecodeUint8(v *uint8) error {
+	if dec.isPooled == 1 {
+		panic(InvalidUsagePooledDecoderError("Invalid usage of pooled decoder"))
+	}
+	return dec.decodeUint8(v)
+}
+
+func (dec *Decoder) decodeUint8(v *uint8) error {
+	for ; dec.cursor < dec.length || dec.read(); dec.cursor++ {
+		switch c := dec.data[dec.cursor]; c {
+		case ' ', '\n', '\t', '\r', ',':
+			continue
+		case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+			val, err := dec.getUint8()
+			if err != nil {
+				return err
+			}
+			*v = val
+			return nil
+		case '-': // if negative, we just set it to 0 and set error
+			dec.err = dec.makeInvalidUnmarshalErr(v)
+			err := dec.skipData()
+			if err != nil {
+				return err
+			}
+			return nil
+		case 'n':
+			dec.cursor++
+			err := dec.assertNull()
+			if err != nil {
+				return err
+			}
+			return nil
+		default:
+			dec.err = dec.makeInvalidUnmarshalErr(v)
+			err := dec.skipData()
+			if err != nil {
+				return err
+			}
+			return nil
+		}
+	}
+	return dec.raiseInvalidJSONErr(dec.cursor)
+}
+func (dec *Decoder) decodeUint8Null(v **uint8) error {
+	for ; dec.cursor < dec.length || dec.read(); dec.cursor++ {
+		switch c := dec.data[dec.cursor]; c {
+		case ' ', '\n', '\t', '\r', ',':
+			continue
+		case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+			val, err := dec.getUint8()
+			if err != nil {
+				return err
+			}
+			if *v == nil {
+				*v = new(uint8)
+			}
+			**v = val
+			return nil
+		case '-': // if negative, we just set it to 0 and set error
+			dec.err = dec.makeInvalidUnmarshalErr(v)
+			err := dec.skipData()
+			if err != nil {
+				return err
+			}
+			if *v == nil {
+				*v = new(uint8)
+			}
+			return nil
+		case 'n':
+			dec.cursor++
+			err := dec.assertNull()
+			if err != nil {
+				return err
+			}
+			return nil
+		default:
+			dec.err = dec.makeInvalidUnmarshalErr(v)
+			err := dec.skipData()
+			if err != nil {
+				return err
+			}
+			return nil
+		}
+	}
+	return dec.raiseInvalidJSONErr(dec.cursor)
+}
+
+func (dec *Decoder) getUint8() (uint8, error) {
+	var end = dec.cursor
+	var start = dec.cursor
+	// look for following numbers
+	for j := dec.cursor + 1; j < dec.length || dec.read(); j++ {
+		switch dec.data[j] {
+		case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+			end = j
+			continue
+		case ' ', '\n', '\t', '\r':
+			continue
+		case '.', ',', '}', ']':
+			dec.cursor = j
+			return dec.atoui8(start, end), nil
+		}
+		// invalid json we expect numbers, dot (single one), comma, or spaces
+		return 0, dec.raiseInvalidJSONErr(dec.cursor)
+	}
+	return dec.atoui8(start, end), nil
+}
+
+// DecodeUint16 reads the next JSON-encoded value from the decoder's input (io.Reader) and stores it in the uint16 pointed to by v.
+//
+// See the documentation for Unmarshal for details about the conversion of JSON into a Go value.
+func (dec *Decoder) DecodeUint16(v *uint16) error {
+	if dec.isPooled == 1 {
+		panic(InvalidUsagePooledDecoderError("Invalid usage of pooled decoder"))
+	}
+	return dec.decodeUint16(v)
+}
+
+func (dec *Decoder) decodeUint16(v *uint16) error {
+	for ; dec.cursor < dec.length || dec.read(); dec.cursor++ {
+		switch c := dec.data[dec.cursor]; c {
+		case ' ', '\n', '\t', '\r', ',':
+			continue
+		case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+			val, err := dec.getUint16()
+			if err != nil {
+				return err
+			}
+			*v = val
+			return nil
+		case '-':
+			dec.err = dec.makeInvalidUnmarshalErr(v)
+			err := dec.skipData()
+			if err != nil {
+				return err
+			}
+			return nil
+		case 'n':
+			dec.cursor++
+			err := dec.assertNull()
+			if err != nil {
+				return err
+			}
+			return nil
+		default:
+			dec.err = dec.makeInvalidUnmarshalErr(v)
+			err := dec.skipData()
+			if err != nil {
+				return err
+			}
+			return nil
+		}
+	}
+	return dec.raiseInvalidJSONErr(dec.cursor)
+}
+func (dec *Decoder) decodeUint16Null(v **uint16) error {
+	for ; dec.cursor < dec.length || dec.read(); dec.cursor++ {
+		switch c := dec.data[dec.cursor]; c {
+		case ' ', '\n', '\t', '\r', ',':
+			continue
+		case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+			val, err := dec.getUint16()
+			if err != nil {
+				return err
+			}
+			if *v == nil {
+				*v = new(uint16)
+			}
+			**v = val
+			return nil
+		case '-':
+			dec.err = dec.makeInvalidUnmarshalErr(v)
+			err := dec.skipData()
+			if err != nil {
+				return err
+			}
+			if *v == nil {
+				*v = new(uint16)
+			}
+			return nil
+		case 'n':
+			dec.cursor++
+			err := dec.assertNull()
+			if err != nil {
+				return err
+			}
+			return nil
+		default:
+			dec.err = dec.makeInvalidUnmarshalErr(v)
+			err := dec.skipData()
+			if err != nil {
+				return err
+			}
+			return nil
+		}
+	}
+	return dec.raiseInvalidJSONErr(dec.cursor)
+}
+
+func (dec *Decoder) getUint16() (uint16, error) {
+	var end = dec.cursor
+	var start = dec.cursor
+	// look for following numbers
+	for j := dec.cursor + 1; j < dec.length || dec.read(); j++ {
+		switch dec.data[j] {
+		case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+			end = j
+			continue
+		case ' ', '\n', '\t', '\r':
+			continue
+		case '.', ',', '}', ']':
+			dec.cursor = j
+			return dec.atoui16(start, end), nil
+		}
+		// invalid json we expect numbers, dot (single one), comma, or spaces
+		return 0, dec.raiseInvalidJSONErr(dec.cursor)
+	}
+	return dec.atoui16(start, end), nil
+}
+
+// DecodeUint32 reads the next JSON-encoded value from the decoder's input (io.Reader) and stores it in the uint32 pointed to by v.
+//
+// See the documentation for Unmarshal for details about the conversion of JSON into a Go value.
+func (dec *Decoder) DecodeUint32(v *uint32) error {
+	if dec.isPooled == 1 {
+		panic(InvalidUsagePooledDecoderError("Invalid usage of pooled decoder"))
+	}
+	return dec.decodeUint32(v)
+}
+
+func (dec *Decoder) decodeUint32(v *uint32) error {
+	for ; dec.cursor < dec.length || dec.read(); dec.cursor++ {
+		switch c := dec.data[dec.cursor]; c {
+		case ' ', '\n', '\t', '\r', ',':
+			continue
+		case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+			val, err := dec.getUint32()
+			if err != nil {
+				return err
+			}
+			*v = val
+			return nil
+		case '-':
+			dec.err = dec.makeInvalidUnmarshalErr(v)
+			err := dec.skipData()
+			if err != nil {
+				return err
+			}
+			return nil
+		case 'n':
+			dec.cursor++
+			err := dec.assertNull()
+			if err != nil {
+				return err
+			}
+			return nil
+		default:
+			dec.err = dec.makeInvalidUnmarshalErr(v)
+			err := dec.skipData()
+			if err != nil {
+				return err
+			}
+			return nil
+		}
+	}
+	return dec.raiseInvalidJSONErr(dec.cursor)
+}
+func (dec *Decoder) decodeUint32Null(v **uint32) error {
+	for ; dec.cursor < dec.length || dec.read(); dec.cursor++ {
+		switch c := dec.data[dec.cursor]; c {
+		case ' ', '\n', '\t', '\r', ',':
+			continue
+		case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+			val, err := dec.getUint32()
+			if err != nil {
+				return err
+			}
+			if *v == nil {
+				*v = new(uint32)
+			}
+			**v = val
+			return nil
+		case '-':
+			dec.err = dec.makeInvalidUnmarshalErr(v)
+			err := dec.skipData()
+			if err != nil {
+				return err
+			}
+			if *v == nil {
+				*v = new(uint32)
+			}
+			return nil
+		case 'n':
+			dec.cursor++
+			err := dec.assertNull()
+			if err != nil {
+				return err
+			}
+			return nil
+		default:
+			dec.err = dec.makeInvalidUnmarshalErr(v)
+			err := dec.skipData()
+			if err != nil {
+				return err
+			}
+			return nil
+		}
+	}
+	return dec.raiseInvalidJSONErr(dec.cursor)
+}
+
+func (dec *Decoder) getUint32() (uint32, error) {
+	var end = dec.cursor
+	var start = dec.cursor
+	// look for following numbers
+	for j := dec.cursor + 1; j < dec.length || dec.read(); j++ {
+		switch dec.data[j] {
+		case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+			end = j
+			continue
+		case ' ', '\n', '\t', '\r':
+			continue
+		case '.', ',', '}', ']':
+			dec.cursor = j
+			return dec.atoui32(start, end), nil
+		}
+		// invalid json we expect numbers, dot (single one), comma, or spaces
+		return 0, dec.raiseInvalidJSONErr(dec.cursor)
+	}
+	return dec.atoui32(start, end), nil
+}
+
+// DecodeUint64 reads the next JSON-encoded value from the decoder's input (io.Reader) and stores it in the uint64 pointed to by v.
+//
+// See the documentation for Unmarshal for details about the conversion of JSON into a Go value.
+func (dec *Decoder) DecodeUint64(v *uint64) error {
+	if dec.isPooled == 1 {
+		panic(InvalidUsagePooledDecoderError("Invalid usage of pooled decoder"))
+	}
+	return dec.decodeUint64(v)
+}
+func (dec *Decoder) decodeUint64(v *uint64) error {
+	for ; dec.cursor < dec.length || dec.read(); dec.cursor++ {
+		switch c := dec.data[dec.cursor]; c {
+		case ' ', '\n', '\t', '\r', ',':
+			continue
+		case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+			val, err := dec.getUint64()
+			if err != nil {
+				return err
+			}
+			*v = val
+			return nil
+		case '-':
+			dec.err = dec.makeInvalidUnmarshalErr(v)
+			err := dec.skipData()
+			if err != nil {
+				return err
+			}
+			return nil
+		case 'n':
+			dec.cursor++
+			err := dec.assertNull()
+			if err != nil {
+				return err
+			}
+			return nil
+		default:
+			dec.err = dec.makeInvalidUnmarshalErr(v)
+			err := dec.skipData()
+			if err != nil {
+				return err
+			}
+			return nil
+		}
+	}
+	return dec.raiseInvalidJSONErr(dec.cursor)
+}
+func (dec *Decoder) decodeUint64Null(v **uint64) error {
+	for ; dec.cursor < dec.length || dec.read(); dec.cursor++ {
+		switch c := dec.data[dec.cursor]; c {
+		case ' ', '\n', '\t', '\r', ',':
+			continue
+		case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+			val, err := dec.getUint64()
+			if err != nil {
+				return err
+			}
+			if *v == nil {
+				*v = new(uint64)
+			}
+			**v = val
+			return nil
+		case '-':
+			dec.err = dec.makeInvalidUnmarshalErr(v)
+			err := dec.skipData()
+			if err != nil {
+				return err
+			}
+			if *v == nil {
+				*v = new(uint64)
+			}
+			return nil
+		case 'n':
+			dec.cursor++
+			err := dec.assertNull()
+			if err != nil {
+				return err
+			}
+			return nil
+		default:
+			dec.err = dec.makeInvalidUnmarshalErr(v)
+			err := dec.skipData()
+			if err != nil {
+				return err
+			}
+			return nil
+		}
+	}
+	return dec.raiseInvalidJSONErr(dec.cursor)
+}
+
+func (dec *Decoder) getUint64() (uint64, error) {
+	var end = dec.cursor
+	var start = dec.cursor
+	// look for following numbers
+	for j := dec.cursor + 1; j < dec.length || dec.read(); j++ {
+		switch dec.data[j] {
+		case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+			end = j
+			continue
+		case ' ', '\n', '\t', '\r', '.', ',', '}', ']':
+			dec.cursor = j
+			return dec.atoui64(start, end), nil
+		}
+		// invalid json we expect numbers, dot (single one), comma, or spaces
+		return 0, dec.raiseInvalidJSONErr(dec.cursor)
+	}
+	return dec.atoui64(start, end), nil
+}
+
+func (dec *Decoder) atoui64(start, end int) uint64 {
+	var ll = end + 1 - start
+	var val = uint64(digits[dec.data[start]])
+	end = end + 1
+	if ll < maxUint64Length {
+		for i := start + 1; i < end; i++ {
+			uintv := uint64(digits[dec.data[i]])
+			val = (val << 3) + (val << 1) + uintv
+		}
+	} else if ll == maxUint64Length {
+		for i := start + 1; i < end; i++ {
+			uintv := uint64(digits[dec.data[i]])
+			if val > maxUint64toMultiply {
+				dec.err = dec.makeInvalidUnmarshalErr(val)
+				return 0
+			}
+			val = (val << 3) + (val << 1)
+			if math.MaxUint64-val < uintv {
+				dec.err = dec.makeInvalidUnmarshalErr(val)
+				return 0
+			}
+			val += uintv
+		}
+	} else {
+		dec.err = dec.makeInvalidUnmarshalErr(val)
+		return 0
+	}
+	return val
+}
+
+func (dec *Decoder) atoui32(start, end int) uint32 {
+	var ll = end + 1 - start
+	var val uint32
+	val = uint32(digits[dec.data[start]])
+	end = end + 1
+	if ll < maxUint32Length {
+		for i := start + 1; i < end; i++ {
+			uintv := uint32(digits[dec.data[i]])
+			val = (val << 3) + (val << 1) + uintv
+		}
+	} else if ll == maxUint32Length {
+		for i := start + 1; i < end; i++ {
+			uintv := uint32(digits[dec.data[i]])
+			if val > maxUint32toMultiply {
+				dec.err = dec.makeInvalidUnmarshalErr(val)
+				return 0
+			}
+			val = (val << 3) + (val << 1)
+			if math.MaxUint32-val < uintv {
+				dec.err = dec.makeInvalidUnmarshalErr(val)
+				return 0
+			}
+			val += uintv
+		}
+	} else if ll > maxUint32Length {
+		dec.err = dec.makeInvalidUnmarshalErr(val)
+		val = 0
+	}
+	return val
+}
+
+func (dec *Decoder) atoui16(start, end int) uint16 {
+	var ll = end + 1 - start
+	var val uint16
+	val = uint16(digits[dec.data[start]])
+	end = end + 1
+	if ll < maxUint16Length {
+		for i := start + 1; i < end; i++ {
+			uintv := uint16(digits[dec.data[i]])
+			val = (val << 3) + (val << 1) + uintv
+		}
+	} else if ll == maxUint16Length {
+		for i := start + 1; i < end; i++ {
+			uintv := uint16(digits[dec.data[i]])
+			if val > maxUint16toMultiply {
+				dec.err = dec.makeInvalidUnmarshalErr(val)
+				return 0
+			}
+			val = (val << 3) + (val << 1)
+			if math.MaxUint16-val < uintv {
+				dec.err = dec.makeInvalidUnmarshalErr(val)
+				return 0
+			}
+			val += uintv
+		}
+	} else if ll > maxUint16Length {
+		dec.err = dec.makeInvalidUnmarshalErr(val)
+		val = 0
+	}
+	return val
+}
+
+func (dec *Decoder) atoui8(start, end int) uint8 {
+	var ll = end + 1 - start
+	var val uint8
+	val = uint8(digits[dec.data[start]])
+	end = end + 1
+	if ll < maxUint8Length {
+		for i := start + 1; i < end; i++ {
+			uintv := uint8(digits[dec.data[i]])
+			val = (val << 3) + (val << 1) + uintv
+		}
+	} else if ll == maxUint8Length {
+		for i := start + 1; i < end; i++ {
+			uintv := uint8(digits[dec.data[i]])
+			if val > maxUint8toMultiply {
+				dec.err = dec.makeInvalidUnmarshalErr(val)
+				return 0
+			}
+			val = (val << 3) + (val << 1)
+			if math.MaxUint8-val < uintv {
+				dec.err = dec.makeInvalidUnmarshalErr(val)
+				return 0
+			}
+			val += uintv
+		}
+	} else if ll > maxUint8Length {
+		dec.err = dec.makeInvalidUnmarshalErr(val)
+		val = 0
+	}
+	return val
+}
+
+// Add Values functions
+
+// AddUint8 decodes the JSON value within an object or an array to an *int.
+// If next key value overflows uint8, an InvalidUnmarshalError error will be returned.
+func (dec *Decoder) AddUint8(v *uint8) error {
+	return dec.Uint8(v)
+}
+
+// AddUint8Null decodes the JSON value within an object or an array to an *int.
+// If next key value overflows uint8, an InvalidUnmarshalError error will be returned.
+// If a `null` is encountered, gojay does not change the value of the pointer.
+func (dec *Decoder) AddUint8Null(v **uint8) error {
+	return dec.Uint8Null(v)
+}
+
+// AddUint16 decodes the JSON value within an object or an array to an *int.
+// If next key value overflows uint16, an InvalidUnmarshalError error will be returned.
+func (dec *Decoder) AddUint16(v *uint16) error {
+	return dec.Uint16(v)
+}
+
+// AddUint16Null decodes the JSON value within an object or an array to an *int.
+// If next key value overflows uint16, an InvalidUnmarshalError error will be returned.
+// If a `null` is encountered, gojay does not change the value of the pointer.
+func (dec *Decoder) AddUint16Null(v **uint16) error {
+	return dec.Uint16Null(v)
+}
+
+// AddUint32 decodes the JSON value within an object or an array to an *int.
+// If next key value overflows uint32, an InvalidUnmarshalError error will be returned.
+func (dec *Decoder) AddUint32(v *uint32) error {
+	return dec.Uint32(v)
+}
+
+// AddUint32Null decodes the JSON value within an object or an array to an *int.
+// If next key value overflows uint32, an InvalidUnmarshalError error will be returned.
+// If a `null` is encountered, gojay does not change the value of the pointer.
+func (dec *Decoder) AddUint32Null(v **uint32) error {
+	return dec.Uint32Null(v)
+}
+
+// AddUint64 decodes the JSON value within an object or an array to an *int.
+// If next key value overflows uint64, an InvalidUnmarshalError error will be returned.
+func (dec *Decoder) AddUint64(v *uint64) error {
+	return dec.Uint64(v)
+}
+
+// AddUint64Null decodes the JSON value within an object or an array to an *int.
+// If next key value overflows uint64, an InvalidUnmarshalError error will be returned.
+// If a `null` is encountered, gojay does not change the value of the pointer.
+func (dec *Decoder) AddUint64Null(v **uint64) error {
+	return dec.Uint64Null(v)
+}
+
+// Uint8 decodes the JSON value within an object or an array to an *int.
+// If next key value overflows uint8, an InvalidUnmarshalError error will be returned.
+func (dec *Decoder) Uint8(v *uint8) error {
+	err := dec.decodeUint8(v)
+	if err != nil {
+		return err
+	}
+	dec.called |= 1
+	return nil
+}
+
+// Uint8Null decodes the JSON value within an object or an array to an *int.
+// If next key value overflows uint8, an InvalidUnmarshalError error will be returned.
+func (dec *Decoder) Uint8Null(v **uint8) error {
+	err := dec.decodeUint8Null(v)
+	if err != nil {
+		return err
+	}
+	dec.called |= 1
+	return nil
+}
+
+// Uint16 decodes the JSON value within an object or an array to an *int.
+// If next key value overflows uint16, an InvalidUnmarshalError error will be returned.
+func (dec *Decoder) Uint16(v *uint16) error {
+	err := dec.decodeUint16(v)
+	if err != nil {
+		return err
+	}
+	dec.called |= 1
+	return nil
+}
+
+// Uint16Null decodes the JSON value within an object or an array to an *int.
+// If next key value overflows uint16, an InvalidUnmarshalError error will be returned.
+func (dec *Decoder) Uint16Null(v **uint16) error {
+	err := dec.decodeUint16Null(v)
+	if err != nil {
+		return err
+	}
+	dec.called |= 1
+	return nil
+}
+
+// Uint32 decodes the JSON value within an object or an array to an *int.
+// If next key value overflows uint32, an InvalidUnmarshalError error will be returned.
+func (dec *Decoder) Uint32(v *uint32) error {
+	err := dec.decodeUint32(v)
+	if err != nil {
+		return err
+	}
+	dec.called |= 1
+	return nil
+}
+
+// Uint32Null decodes the JSON value within an object or an array to an *int.
+// If next key value overflows uint32, an InvalidUnmarshalError error will be returned.
+func (dec *Decoder) Uint32Null(v **uint32) error {
+	err := dec.decodeUint32Null(v)
+	if err != nil {
+		return err
+	}
+	dec.called |= 1
+	return nil
+}
+
+// Uint64 decodes the JSON value within an object or an array to an *int.
+// If next key value overflows uint64, an InvalidUnmarshalError error will be returned.
+func (dec *Decoder) Uint64(v *uint64) error {
+	err := dec.decodeUint64(v)
+	if err != nil {
+		return err
+	}
+	dec.called |= 1
+	return nil
+}
+
+// Uint64Null decodes the JSON value within an object or an array to an *int.
+// If next key value overflows uint64, an InvalidUnmarshalError error will be returned.
+func (dec *Decoder) Uint64Null(v **uint64) error {
+	err := dec.decodeUint64Null(v)
+	if err != nil {
+		return err
+	}
+	dec.called |= 1
+	return nil
+}

vendor/github.com/francoispqt/gojay/decode_object.go

@@ -0,0 +1,407 @@
+package gojay
+
+import (
+	"reflect"
+	"unsafe"
+)
+
+// DecodeObject reads the next JSON-encoded value from the decoder's input (io.Reader) and stores it in the value pointed to by v.
+//
+// v must implement UnmarshalerJSONObject.
+//
+// See the documentation for Unmarshal for details about the conversion of JSON into a Go value.
+func (dec *Decoder) DecodeObject(j UnmarshalerJSONObject) error {
+	if dec.isPooled == 1 {
+		panic(InvalidUsagePooledDecoderError("Invalid usage of pooled decoder"))
+	}
+	_, err := dec.decodeObject(j)
+	return err
+}
+func (dec *Decoder) decodeObject(j UnmarshalerJSONObject) (int, error) {
+	keys := j.NKeys()
+	for ; dec.cursor < dec.length || dec.read(); dec.cursor++ {
+		switch dec.data[dec.cursor] {
+		case ' ', '\n', '\t', '\r', ',':
+		case '{':
+			dec.cursor = dec.cursor + 1
+			// if keys is zero we will parse all keys
+			// we run two loops for micro optimization
+			if keys == 0 {
+				for dec.cursor < dec.length || dec.read() {
+					k, done, err := dec.nextKey()
+					if err != nil {
+						return 0, err
+					} else if done {
+						return dec.cursor, nil
+					}
+					err = j.UnmarshalJSONObject(dec, k)
+					if err != nil {
+						dec.err = err
+						return 0, err
+					} else if dec.called&1 == 0 {
+						err := dec.skipData()
+						if err != nil {
+							return 0, err
+						}
+					} else {
+						dec.keysDone++
+					}
+					dec.called &= 0
+				}
+			} else {
+				for (dec.cursor < dec.length || dec.read()) && dec.keysDone < keys {
+					k, done, err := dec.nextKey()
+					if err != nil {
+						return 0, err
+					} else if done {
+						return dec.cursor, nil
+					}
+					err = j.UnmarshalJSONObject(dec, k)
+					if err != nil {
+						dec.err = err
+						return 0, err
+					} else if dec.called&1 == 0 {
+						err := dec.skipData()
+						if err != nil {
+							return 0, err
+						}
+					} else {
+						dec.keysDone++
+					}
+					dec.called &= 0
+				}
+			}
+			// will get to that point when keysDone is not lower than keys anymore
+			// in that case, we make sure cursor goes to the end of object, but we skip
+			// unmarshalling
+			if dec.child&1 != 0 {
+				end, err := dec.skipObject()
+				dec.cursor = end
+				return dec.cursor, err
+			}
+			return dec.cursor, nil
+		case 'n':
+			dec.cursor++
+			err := dec.assertNull()
+			if err != nil {
+				return 0, err
+			}
+			return dec.cursor, nil
+		default:
+			// can't unmarshal to struct
+			dec.err = dec.makeInvalidUnmarshalErr(j)
+			err := dec.skipData()
+			if err != nil {
+				return 0, err
+			}
+			return dec.cursor, nil
+		}
+	}
+	return 0, dec.raiseInvalidJSONErr(dec.cursor)
+}
+
+func (dec *Decoder) decodeObjectNull(v interface{}) (int, error) {
+	// make sure the value is a pointer
+	vv := reflect.ValueOf(v)
+	vvt := vv.Type()
+	if vvt.Kind() != reflect.Ptr || vvt.Elem().Kind() != reflect.Ptr {
+		dec.err = ErrUnmarshalPtrExpected
+		return 0, dec.err
+	}
+	for ; dec.cursor < dec.length || dec.read(); dec.cursor++ {
+		switch dec.data[dec.cursor] {
+		case ' ', '\n', '\t', '\r', ',':
+		case '{':
+			elt := vv.Elem()
+			n := reflect.New(elt.Type().Elem())
+			elt.Set(n)
+			var j UnmarshalerJSONObject
+			var ok bool
+			if j, ok = n.Interface().(UnmarshalerJSONObject); !ok {
+				dec.err = dec.makeInvalidUnmarshalErr((UnmarshalerJSONObject)(nil))
+				return 0, dec.err
+			}
+			keys := j.NKeys()
+			dec.cursor = dec.cursor + 1
+			// if keys is zero we will parse all keys
+			// we run two loops for micro optimization
+			if keys == 0 {
+				for dec.cursor < dec.length || dec.read() {
+					k, done, err := dec.nextKey()
+					if err != nil {
+						return 0, err
+					} else if done {
+						return dec.cursor, nil
+					}
+					err = j.UnmarshalJSONObject(dec, k)
+					if err != nil {
+						dec.err = err
+						return 0, err
+					} else if dec.called&1 == 0 {
+						err := dec.skipData()
+						if err != nil {
+							return 0, err
+						}
+					} else {
+						dec.keysDone++
+					}
+					dec.called &= 0
+				}
+			} else {
+				for (dec.cursor < dec.length || dec.read()) && dec.keysDone < keys {
+					k, done, err := dec.nextKey()
+					if err != nil {
+						return 0, err
+					} else if done {
+						return dec.cursor, nil
+					}
+					err = j.UnmarshalJSONObject(dec, k)
+					if err != nil {
+						dec.err = err
+						return 0, err
+					} else if dec.called&1 == 0 {
+						err := dec.skipData()
+						if err != nil {
+							return 0, err
+						}
+					} else {
+						dec.keysDone++
+					}
+					dec.called &= 0
+				}
+			}
+			// will get to that point when keysDone is not lower than keys anymore
+			// in that case, we make sure cursor goes to the end of object, but we skip
+			// unmarshalling
+			if dec.child&1 != 0 {
+				end, err := dec.skipObject()
+				dec.cursor = end
+				return dec.cursor, err
+			}
+			return dec.cursor, nil
+		case 'n':
+			dec.cursor++
+			err := dec.assertNull()
+			if err != nil {
+				return 0, err
+			}
+			return dec.cursor, nil
+		default:
+			// can't unmarshal to struct
+			dec.err = dec.makeInvalidUnmarshalErr((UnmarshalerJSONObject)(nil))
+			err := dec.skipData()
+			if err != nil {
+				return 0, err
+			}
+			return dec.cursor, nil
+		}
+	}
+	return 0, dec.raiseInvalidJSONErr(dec.cursor)
+}
+
+func (dec *Decoder) skipObject() (int, error) {
+	var objectsOpen = 1
+	var objectsClosed = 0
+	for j := dec.cursor; j < dec.length || dec.read(); j++ {
+		switch dec.data[j] {
+		case '}':
+			objectsClosed++
+			// everything is closed return
+			if objectsOpen == objectsClosed {
+				// add char to object data
+				return j + 1, nil
+			}
+		case '{':
+			objectsOpen++
+		case '"':
+			j++
+			var isInEscapeSeq bool
+			var isFirstQuote = true
+			for ; j < dec.length || dec.read(); j++ {
+				if dec.data[j] != '"' {
+					continue
+				}
+				if dec.data[j-1] != '\\' || (!isInEscapeSeq && !isFirstQuote) {
+					break
+				} else {
+					isInEscapeSeq = false
+				}
+				if isFirstQuote {
+					isFirstQuote = false
+				}
+				// loop backward and count how many anti slash found
+				// to see if string is effectively escaped
+				ct := 0
+				for i := j - 1; i > 0; i-- {
+					if dec.data[i] != '\\' {
+						break
+					}
+					ct++
+				}
+				// is pair number of slashes, quote is not escaped
+				if ct&1 == 0 {
+					break
+				}
+				isInEscapeSeq = true
+			}
+		default:
+			continue
+		}
+	}
+	return 0, dec.raiseInvalidJSONErr(dec.cursor)
+}
+
+func (dec *Decoder) nextKey() (string, bool, error) {
+	for ; dec.cursor < dec.length || dec.read(); dec.cursor++ {
+		switch dec.data[dec.cursor] {
+		case ' ', '\n', '\t', '\r', ',':
+			continue
+		case '"':
+			dec.cursor = dec.cursor + 1
+			start, end, err := dec.getString()
+			if err != nil {
+				return "", false, err
+			}
+			var found byte
+			for ; dec.cursor < dec.length || dec.read(); dec.cursor++ {
+				if dec.data[dec.cursor] == ':' {
+					found |= 1
+					break
+				}
+			}
+			if found&1 != 0 {
+				dec.cursor++
+				d := dec.data[start : end-1]
+				return *(*string)(unsafe.Pointer(&d)), false, nil
+			}
+			return "", false, dec.raiseInvalidJSONErr(dec.cursor)
+		case '}':
+			dec.cursor = dec.cursor + 1
+			return "", true, nil
+		default:
+			// can't unmarshall to struct
+			return "", false, dec.raiseInvalidJSONErr(dec.cursor)
+		}
+	}
+	return "", false, dec.raiseInvalidJSONErr(dec.cursor)
+}
+
+func (dec *Decoder) skipData() error {
+	for ; dec.cursor < dec.length || dec.read(); dec.cursor++ {
+		switch dec.data[dec.cursor] {
+		case ' ', '\n', '\t', '\r', ',':
+			continue
+		// is null
+		case 'n':
+			dec.cursor++
+			err := dec.assertNull()
+			if err != nil {
+				return err
+			}
+			return nil
+		case 't':
+			dec.cursor++
+			err := dec.assertTrue()
+			if err != nil {
+				return err
+			}
+			return nil
+		// is false
+		case 'f':
+			dec.cursor++
+			err := dec.assertFalse()
+			if err != nil {
+				return err
+			}
+			return nil
+		// is an object
+		case '{':
+			dec.cursor = dec.cursor + 1
+			end, err := dec.skipObject()
+			dec.cursor = end
+			return err
+		// is string
+		case '"':
+			dec.cursor = dec.cursor + 1
+			err := dec.skipString()
+			return err
+		// is array
+		case '[':
+			dec.cursor = dec.cursor + 1
+			end, err := dec.skipArray()
+			dec.cursor = end
+			return err
+		case '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '-':
+			end, err := dec.skipNumber()
+			dec.cursor = end
+			return err
+		}
+		return dec.raiseInvalidJSONErr(dec.cursor)
+	}
+	return dec.raiseInvalidJSONErr(dec.cursor)
+}
+
+// DecodeObjectFunc is a func type implementing UnmarshalerJSONObject.
+// Use it to cast a `func(*Decoder, k string) error` to Unmarshal an object on the fly.
+type DecodeObjectFunc func(*Decoder, string) error
+
+// UnmarshalJSONObject implements UnmarshalerJSONObject.
+func (f DecodeObjectFunc) UnmarshalJSONObject(dec *Decoder, k string) error {
+	return f(dec, k)
+}
+
+// NKeys implements UnmarshalerJSONObject.
+func (f DecodeObjectFunc) NKeys() int {
+	return 0
+}
+
+// Add Values functions
+
+// AddObject decodes the JSON value within an object or an array to a UnmarshalerJSONObject.
+func (dec *Decoder) AddObject(v UnmarshalerJSONObject) error {
+	return dec.Object(v)
+}
+
+// AddObjectNull decodes the JSON value within an object or an array to a UnmarshalerJSONObject.
+func (dec *Decoder) AddObjectNull(v interface{}) error {
+	return dec.ObjectNull(v)
+}
+
+// Object decodes the JSON value within an object or an array to a UnmarshalerJSONObject.
+func (dec *Decoder) Object(value UnmarshalerJSONObject) error {
+	initialKeysDone := dec.keysDone
+	initialChild := dec.child
+	dec.keysDone = 0
+	dec.called = 0
+	dec.child |= 1
+	newCursor, err := dec.decodeObject(value)
+	if err != nil {
+		return err
+	}
+	dec.cursor = newCursor
+	dec.keysDone = initialKeysDone
+	dec.child = initialChild
+	dec.called |= 1
+	return nil
+}
+
+// ObjectNull decodes the JSON value within an object or an array to a UnmarshalerJSONObject.
+// v should be a pointer to an UnmarshalerJSONObject,
+// if `null` value is encountered in JSON, it will leave the value v untouched,
+// else it will create a new instance of the UnmarshalerJSONObject behind v.
+func (dec *Decoder) ObjectNull(v interface{}) error {
+	initialKeysDone := dec.keysDone
+	initialChild := dec.child
+	dec.keysDone = 0
+	dec.called = 0
+	dec.child |= 1
+	newCursor, err := dec.decodeObjectNull(v)
+	if err != nil {
+		return err
+	}
+	dec.cursor = newCursor
+	dec.keysDone = initialKeysDone
+	dec.child = initialChild
+	dec.called |= 1
+	return nil
+}

vendor/github.com/francoispqt/gojay/decode_pool.go

@@ -0,0 +1,64 @@
+package gojay
+
+import (
+	"io"
+	"sync"
+)
+
+var decPool = sync.Pool{
+	New: newDecoderPool,
+}
+
+func init() {
+	for i := 0; i < 32; i++ {
+		decPool.Put(NewDecoder(nil))
+	}
+}
+
+// NewDecoder returns a new decoder.
+// It takes an io.Reader implementation as data input.
+func NewDecoder(r io.Reader) *Decoder {
+	return &Decoder{
+		called:   0,
+		cursor:   0,
+		keysDone: 0,
+		err:      nil,
+		r:        r,
+		data:     make([]byte, 512),
+		length:   0,
+		isPooled: 0,
+	}
+}
+func newDecoderPool() interface{} {
+	return NewDecoder(nil)
+}
+
+// BorrowDecoder borrows a Decoder from the pool.
+// It takes an io.Reader implementation as data input.
+//
+// In order to benefit from the pool, a borrowed decoder must be released after usage.
+func BorrowDecoder(r io.Reader) *Decoder {
+	return borrowDecoder(r, 512)
+}
+func borrowDecoder(r io.Reader, bufSize int) *Decoder {
+	dec := decPool.Get().(*Decoder)
+	dec.called = 0
+	dec.keysDone = 0
+	dec.cursor = 0
+	dec.err = nil
+	dec.r = r
+	dec.length = 0
+	dec.isPooled = 0
+	if bufSize > 0 {
+		dec.data = make([]byte, bufSize)
+	}
+	return dec
+}
+
+// Release sends back a Decoder to the pool.
+// If a decoder is used after calling Release
+// a panic will be raised with an InvalidUsagePooledDecoderError error.
+func (dec *Decoder) Release() {
+	dec.isPooled = 1
+	decPool.Put(dec)
+}

vendor/github.com/francoispqt/gojay/decode_slice.go

@@ -0,0 +1,89 @@
+package gojay
+
+// AddSliceString unmarshals the next JSON array of strings to the given *[]string s
+func (dec *Decoder) AddSliceString(s *[]string) error {
+	return dec.SliceString(s)
+}
+
+// SliceString unmarshals the next JSON array of strings to the given *[]string s
+func (dec *Decoder) SliceString(s *[]string) error {
+	err := dec.Array(DecodeArrayFunc(func(dec *Decoder) error {
+		var str string
+		if err := dec.String(&str); err != nil {
+			return err
+		}
+		*s = append(*s, str)
+		return nil
+	}))
+
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// AddSliceInt unmarshals the next JSON array of integers to the given *[]int s
+func (dec *Decoder) AddSliceInt(s *[]int) error {
+	return dec.SliceInt(s)
+}
+
+// SliceInt unmarshals the next JSON array of integers to the given *[]int s
+func (dec *Decoder) SliceInt(s *[]int) error {
+	err := dec.Array(DecodeArrayFunc(func(dec *Decoder) error {
+		var i int
+		if err := dec.Int(&i); err != nil {
+			return err
+		}
+		*s = append(*s, i)
+		return nil
+	}))
+
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// AddFloat64 unmarshals the next JSON array of floats to the given *[]float64 s
+func (dec *Decoder) AddSliceFloat64(s *[]float64) error {
+	return dec.SliceFloat64(s)
+}
+
+// SliceFloat64 unmarshals the next JSON array of floats to the given *[]float64 s
+func (dec *Decoder) SliceFloat64(s *[]float64) error {
+	err := dec.Array(DecodeArrayFunc(func(dec *Decoder) error {
+		var i float64
+		if err := dec.Float64(&i); err != nil {
+			return err
+		}
+		*s = append(*s, i)
+		return nil
+	}))
+
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// AddBool unmarshals the next JSON array of boolegers to the given *[]bool s
+func (dec *Decoder) AddSliceBool(s *[]bool) error {
+	return dec.SliceBool(s)
+}
+
+// SliceBool unmarshals the next JSON array of boolegers to the given *[]bool s
+func (dec *Decoder) SliceBool(s *[]bool) error {
+	err := dec.Array(DecodeArrayFunc(func(dec *Decoder) error {
+		var b bool
+		if err := dec.Bool(&b); err != nil {
+			return err
+		}
+		*s = append(*s, b)
+		return nil
+	}))
+
+	if err != nil {
+		return err
+	}
+	return nil
+}

vendor/github.com/francoispqt/gojay/decode_sqlnull.go

@@ -0,0 +1,157 @@
+package gojay
+
+import "database/sql"
+
+// DecodeSQLNullString decodes a sql.NullString
+func (dec *Decoder) DecodeSQLNullString(v *sql.NullString) error {
+	if dec.isPooled == 1 {
+		panic(InvalidUsagePooledDecoderError("Invalid usage of pooled decoder"))
+	}
+	return dec.decodeSQLNullString(v)
+}
+
+func (dec *Decoder) decodeSQLNullString(v *sql.NullString) error {
+	var str string
+	if err := dec.decodeString(&str); err != nil {
+		return err
+	}
+	v.String = str
+	v.Valid = true
+	return nil
+}
+
+// DecodeSQLNullInt64 decodes a sql.NullInt64
+func (dec *Decoder) DecodeSQLNullInt64(v *sql.NullInt64) error {
+	if dec.isPooled == 1 {
+		panic(InvalidUsagePooledDecoderError("Invalid usage of pooled decoder"))
+	}
+	return dec.decodeSQLNullInt64(v)
+}
+
+func (dec *Decoder) decodeSQLNullInt64(v *sql.NullInt64) error {
+	var i int64
+	if err := dec.decodeInt64(&i); err != nil {
+		return err
+	}
+	v.Int64 = i
+	v.Valid = true
+	return nil
+}
+
+// DecodeSQLNullFloat64 decodes a sql.NullString with the given format
+func (dec *Decoder) DecodeSQLNullFloat64(v *sql.NullFloat64) error {
+	if dec.isPooled == 1 {
+		panic(InvalidUsagePooledDecoderError("Invalid usage of pooled decoder"))
+	}
+	return dec.decodeSQLNullFloat64(v)
+}
+
+func (dec *Decoder) decodeSQLNullFloat64(v *sql.NullFloat64) error {
+	var i float64
+	if err := dec.decodeFloat64(&i); err != nil {
+		return err
+	}
+	v.Float64 = i
+	v.Valid = true
+	return nil
+}
+
+// DecodeSQLNullBool decodes a sql.NullString with the given format
+func (dec *Decoder) DecodeSQLNullBool(v *sql.NullBool) error {
+	if dec.isPooled == 1 {
+		panic(InvalidUsagePooledDecoderError("Invalid usage of pooled decoder"))
+	}
+	return dec.decodeSQLNullBool(v)
+}
+
+func (dec *Decoder) decodeSQLNullBool(v *sql.NullBool) error {
+	var b bool
+	if err := dec.decodeBool(&b); err != nil {
+		return err
+	}
+	v.Bool = b
+	v.Valid = true
+	return nil
+}
+
+// Add Values functions
+
+// AddSQLNullString decodes the JSON value within an object or an array to qn *sql.NullString
+func (dec *Decoder) AddSQLNullString(v *sql.NullString) error {
+	return dec.SQLNullString(v)
+}
+
+// SQLNullString decodes the JSON value within an object or an array to an *sql.NullString
+func (dec *Decoder) SQLNullString(v *sql.NullString) error {
+	var b *string
+	if err := dec.StringNull(&b); err != nil {
+		return err
+	}
+	if b == nil {
+		v.Valid = false
+	} else {
+		v.String = *b
+		v.Valid = true
+	}
+	return nil
+}
+
+// AddSQLNullInt64 decodes the JSON value within an object or an array to qn *sql.NullInt64
+func (dec *Decoder) AddSQLNullInt64(v *sql.NullInt64) error {
+	return dec.SQLNullInt64(v)
+}
+
+// SQLNullInt64 decodes the JSON value within an object or an array to an *sql.NullInt64
+func (dec *Decoder) SQLNullInt64(v *sql.NullInt64) error {
+	var b *int64
+	if err := dec.Int64Null(&b); err != nil {
+		return err
+	}
+	if b == nil {
+		v.Valid = false
+	} else {
+		v.Int64 = *b
+		v.Valid = true
+	}
+	return nil
+}
+
+// AddSQLNullFloat64 decodes the JSON value within an object or an array to qn *sql.NullFloat64
+func (dec *Decoder) AddSQLNullFloat64(v *sql.NullFloat64) error {
+	return dec.SQLNullFloat64(v)
+}
+
+// SQLNullFloat64 decodes the JSON value within an object or an array to an *sql.NullFloat64
+func (dec *Decoder) SQLNullFloat64(v *sql.NullFloat64) error {
+	var b *float64
+	if err := dec.Float64Null(&b); err != nil {
+		return err
+	}
+	if b == nil {
+		v.Valid = false
+	} else {
+		v.Float64 = *b
+		v.Valid = true
+	}
+	return nil
+}
+
+// AddSQLNullBool decodes the JSON value within an object or an array to an *sql.NullBool
+func (dec *Decoder) AddSQLNullBool(v *sql.NullBool) error {
+	return dec.SQLNullBool(v)
+}
+
+// SQLNullBool decodes the JSON value within an object or an array to an *sql.NullBool
+func (dec *Decoder) SQLNullBool(v *sql.NullBool) error {
+	var b *bool
+	if err := dec.BoolNull(&b); err != nil {
+		return err
+	}
+	if b == nil {
+		v.Valid = false
+	} else {
+		v.Bool = *b
+		v.Valid = true
+	}
+	return nil
+}

vendor/github.com/francoispqt/gojay/decode_stream.go

@@ -0,0 +1,115 @@
+package gojay
+
+import (
+	"sync"
+	"time"
+)
+
+// UnmarshalerStream is the interface to implement for a slice, an array or a slice
+// to decode a line delimited JSON to.
+type UnmarshalerStream interface {
+	UnmarshalStream(*StreamDecoder) error
+}
+
+// Stream is a struct holding the Stream api
+var Stream = stream{}
+
+type stream struct{}
+
+// A StreamDecoder reads and decodes JSON values from an input stream.
+//
+// It implements conext.Context and provide a channel to notify interruption.
+type StreamDecoder struct {
+	mux sync.RWMutex
+	*Decoder
+	done     chan struct{}
+	deadline *time.Time
+}
+
+// DecodeStream reads the next line delimited JSON-encoded value from the decoder's input (io.Reader) and stores it in the value pointed to by c.
+//
+// c must implement UnmarshalerStream. Ideally c is a channel. See example for implementation.
+//
+// See the documentation for Unmarshal for details about the conversion of JSON into a Go value.
+func (dec *StreamDecoder) DecodeStream(c UnmarshalerStream) error {
+	if dec.isPooled == 1 {
+		panic(InvalidUsagePooledDecoderError("Invalid usage of pooled decoder"))
+	}
+	if dec.r == nil {
+		dec.err = NoReaderError("No reader given to decode stream")
+		close(dec.done)
+		return dec.err
+	}
+	for ; dec.cursor < dec.length || dec.read(); dec.cursor++ {
+		switch dec.data[dec.cursor] {
+		case ' ', '\n', '\t', '\r', ',':
+			continue
+		default:
+			// char is not space start reading
+			for dec.nextChar() != 0 {
+				// calling unmarshal stream
+				err := c.UnmarshalStream(dec)
+				if err != nil {
+					dec.err = err
+					close(dec.done)
+					return err
+				}
+				// garbage collects buffer
+				// we don't want the buffer to grow extensively
+				dec.data = dec.data[dec.cursor:]
+				dec.length = dec.length - dec.cursor
+				dec.cursor = 0
+			}
+			// close the done channel to signal the end of the job
+			close(dec.done)
+			return nil
+		}
+	}
+	close(dec.done)
+	dec.mux.Lock()
+	err := dec.raiseInvalidJSONErr(dec.cursor)
+	dec.mux.Unlock()
+	return err
+}
+
+// context.Context implementation
+
+// Done returns a channel that's closed when work is done.
+// It implements context.Context
+func (dec *StreamDecoder) Done() <-chan struct{} {
+	return dec.done
+}
+
+// Deadline returns the time when work done on behalf of this context
+// should be canceled. Deadline returns ok==false when no deadline is
+// set. Successive calls to Deadline return the same results.
+func (dec *StreamDecoder) Deadline() (time.Time, bool) {
+	if dec.deadline != nil {
+		return *dec.deadline, true
+	}
+	return time.Time{}, false
+}
+
+// SetDeadline sets the deadline
+func (dec *StreamDecoder) SetDeadline(t time.Time) {
+	dec.deadline = &t
+}
+
+// Err returns nil if Done is not yet closed.
+// If Done is closed, Err returns a non-nil error explaining why.
+// It implements context.Context
+func (dec *StreamDecoder) Err() error {
+	select {
+	case <-dec.done:
+		dec.mux.RLock()
+		defer dec.mux.RUnlock()
+		return dec.err
+	default:
+		return nil
+	}
+}
+
+// Value implements context.Context
+func (dec *StreamDecoder) Value(key interface{}) interface{} {
+	return nil
+}

vendor/github.com/francoispqt/gojay/decode_stream_pool.go

@@ -0,0 +1,59 @@
+package gojay
+
+import (
+	"io"
+	"sync"
+)
+
+var streamDecPool = sync.Pool{
+	New: newStreamDecoderPool,
+}
+
+// NewDecoder returns a new StreamDecoder.
+// It takes an io.Reader implementation as data input.
+// It initiates the done channel returned by Done().
+func (s stream) NewDecoder(r io.Reader) *StreamDecoder {
+	dec := NewDecoder(r)
+	streamDec := &StreamDecoder{
+		Decoder: dec,
+		done:    make(chan struct{}, 1),
+		mux:     sync.RWMutex{},
+	}
+	return streamDec
+}
+func newStreamDecoderPool() interface{} {
+	return Stream.NewDecoder(nil)
+}
+
+// BorrowDecoder borrows a StreamDecoder from the pool.
+// It takes an io.Reader implementation as data input.
+// It initiates the done channel returned by Done().
+//
+// If no StreamEncoder is available in the pool, it returns a fresh one
+func (s stream) BorrowDecoder(r io.Reader) *StreamDecoder {
+	return s.borrowDecoder(r, 512)
+}
+
+func (s stream) borrowDecoder(r io.Reader, bufSize int) *StreamDecoder {
+	streamDec := streamDecPool.Get().(*StreamDecoder)
+	streamDec.called = 0
+	streamDec.keysDone = 0
+	streamDec.cursor = 0
+	streamDec.err = nil
+	streamDec.r = r
+	streamDec.length = 0
+	streamDec.isPooled = 0
+	streamDec.done = make(chan struct{}, 1)
+	if bufSize > 0 {
+		streamDec.data = make([]byte, bufSize)
+	}
+	return streamDec
+}
+
+// Release sends back a Decoder to the pool.
+// If a decoder is used after calling Release
+// a panic will be raised with an InvalidUsagePooledDecoderError error.
+func (dec *StreamDecoder) Release() {
+	dec.isPooled = 1
+	streamDecPool.Put(dec)
+}

vendor/github.com/francoispqt/gojay/decode_string.go

@@ -0,0 +1,260 @@
+package gojay
+
+import (
+	"unsafe"
+)
+
+// DecodeString reads the next JSON-encoded value from the decoder's input (io.Reader) and stores it in the string pointed to by v.
+//
+// See the documentation for Unmarshal for details about the conversion of JSON into a Go value.
+func (dec *Decoder) DecodeString(v *string) error {
+	if dec.isPooled == 1 {
+		panic(InvalidUsagePooledDecoderError("Invalid usage of pooled decoder"))
+	}
+	return dec.decodeString(v)
+}
+func (dec *Decoder) decodeString(v *string) error {
+	for ; dec.cursor < dec.length || dec.read(); dec.cursor++ {
+		switch dec.data[dec.cursor] {
+		case ' ', '\n', '\t', '\r', ',':
+			// is string
+			continue
+		case '"':
+			dec.cursor++
+			start, end, err := dec.getString()
+			if err != nil {
+				return err
+			}
+			// we do minus one to remove the last quote
+			d := dec.data[start : end-1]
+			*v = *(*string)(unsafe.Pointer(&d))
+			dec.cursor = end
+			return nil
+		// is nil
+		case 'n':
+			dec.cursor++
+			err := dec.assertNull()
+			if err != nil {
+				return err
+			}
+			return nil
+		default:
+			dec.err = dec.makeInvalidUnmarshalErr(v)
+			err := dec.skipData()
+			if err != nil {
+				return err
+			}
+			return nil
+		}
+	}
+	return nil
+}
+
+func (dec *Decoder) decodeStringNull(v **string) error {
+	for ; dec.cursor < dec.length || dec.read(); dec.cursor++ {
+		switch dec.data[dec.cursor] {
+		case ' ', '\n', '\t', '\r', ',':
+			// is string
+			continue
+		case '"':
+			dec.cursor++
+			start, end, err := dec.getString()
+
+			if err != nil {
+				return err
+			}
+			if *v == nil {
+				*v = new(string)
+			}
+			// we do minus one to remove the last quote
+			d := dec.data[start : end-1]
+			**v = *(*string)(unsafe.Pointer(&d))
+			dec.cursor = end
+			return nil
+		// is nil
+		case 'n':
+			dec.cursor++
+			err := dec.assertNull()
+			if err != nil {
+				return err
+			}
+			return nil
+		default:
+			dec.err = dec.makeInvalidUnmarshalErr(v)
+			err := dec.skipData()
+			if err != nil {
+				return err
+			}
+			return nil
+		}
+	}
+	return nil
+}
+
+func (dec *Decoder) parseEscapedString() error {
+	if dec.cursor >= dec.length && !dec.read() {
+		return dec.raiseInvalidJSONErr(dec.cursor)
+	}
+	switch dec.data[dec.cursor] {
+	case '"':
+		dec.data[dec.cursor] = '"'
+	case '\\':
+		dec.data[dec.cursor] = '\\'
+	case '/':
+		dec.data[dec.cursor] = '/'
+	case 'b':
+		dec.data[dec.cursor] = '\b'
+	case 'f':
+		dec.data[dec.cursor] = '\f'
+	case 'n':
+		dec.data[dec.cursor] = '\n'
+	case 'r':
+		dec.data[dec.cursor] = '\r'
+	case 't':
+		dec.data[dec.cursor] = '\t'
+	case 'u':
+		start := dec.cursor
+		dec.cursor++
+		str, err := dec.parseUnicode()
+		if err != nil {
+			return err
+		}
+		diff := dec.cursor - start
+		dec.data = append(append(dec.data[:start-1], str...), dec.data[dec.cursor:]...)
+		dec.length = len(dec.data)
+		dec.cursor += len(str) - diff - 1
+
+		return nil
+	default:
+		return dec.raiseInvalidJSONErr(dec.cursor)
+	}
+
+	dec.data = append(dec.data[:dec.cursor-1], dec.data[dec.cursor:]...)
+	dec.length--
+
+	// Since we've lost a character, our dec.cursor offset is now
+	// 1 past the escaped character which is precisely where we
+	// want it.
+
+	return nil
+}
+
+func (dec *Decoder) getString() (int, int, error) {
+	// extract key
+	var keyStart = dec.cursor
+	// var str *Builder
+	for dec.cursor < dec.length || dec.read() {
+		switch dec.data[dec.cursor] {
+		// string found
+		case '"':
+			dec.cursor = dec.cursor + 1
+			return keyStart, dec.cursor, nil
+		// slash found
+		case '\\':
+			dec.cursor = dec.cursor + 1
+			err := dec.parseEscapedString()
+			if err != nil {
+				return 0, 0, err
+			}
+		default:
+			dec.cursor = dec.cursor + 1
+			continue
+		}
+	}
+	return 0, 0, dec.raiseInvalidJSONErr(dec.cursor)
+}
+
+func (dec *Decoder) skipEscapedString() error {
+	start := dec.cursor
+	for ; dec.cursor < dec.length || dec.read(); dec.cursor++ {
+		if dec.data[dec.cursor] != '\\' {
+			d := dec.data[dec.cursor]
+			dec.cursor = dec.cursor + 1
+			nSlash := dec.cursor - start
+			switch d {
+			case '"':
+				// nSlash must be odd
+				if nSlash&1 != 1 {
+					return dec.raiseInvalidJSONErr(dec.cursor)
+				}
+				return nil
+			case 'u': // is unicode, we skip the following characters and place the cursor one one byte backward to avoid it breaking when returning to skipString
+				if err := dec.skipString(); err != nil {
+					return err
+				}
+				dec.cursor--
+				return nil
+			case 'n', 'r', 't', '/', 'f', 'b':
+				return nil
+			default:
+				// nSlash must be even
+				if nSlash&1 == 1 {
+					return dec.raiseInvalidJSONErr(dec.cursor)
+				}
+				return nil
+			}
+		}
+	}
+	return dec.raiseInvalidJSONErr(dec.cursor)
+}
+
+func (dec *Decoder) skipString() error {
+	for dec.cursor < dec.length || dec.read() {
+		switch dec.data[dec.cursor] {
+		// found the closing quote
+		// let's return
+		case '"':
+			dec.cursor = dec.cursor + 1
+			return nil
+		// solidus found start parsing an escaped string
+		case '\\':
+			dec.cursor = dec.cursor + 1
+			err := dec.skipEscapedString()
+			if err != nil {
+				return err
+			}
+		default:
+			dec.cursor = dec.cursor + 1
+			continue
+		}
+	}
+	return dec.raiseInvalidJSONErr(len(dec.data) - 1)
+}
+
+// Add Values functions
+
+// AddString decodes the JSON value within an object or an array to a *string.
+// If next key is not a JSON string nor null, InvalidUnmarshalError will be returned.
+func (dec *Decoder) AddString(v *string) error {
+	return dec.String(v)
+}
+
+// AddStringNull decodes the JSON value within an object or an array to a *string.
+// If next key is not a JSON string nor null, InvalidUnmarshalError will be returned.
+// If a `null` is encountered, gojay does not change the value of the pointer.
+func (dec *Decoder) AddStringNull(v **string) error {
+	return dec.StringNull(v)
+}
+
+// String decodes the JSON value within an object or an array to a *string.
+// If next key is not a JSON string nor null, InvalidUnmarshalError will be returned.
+func (dec *Decoder) String(v *string) error {
+	err := dec.decodeString(v)
+	if err != nil {
+		return err
+	}
+	dec.called |= 1
+	return nil
+}
+
+// StringNull decodes the JSON value within an object or an array to a **string.
+// If next key is not a JSON string nor null, InvalidUnmarshalError will be returned.
+// If a `null` is encountered, gojay does not change the value of the pointer.
+func (dec *Decoder) StringNull(v **string) error {
+	err := dec.decodeStringNull(v)
+	if err != nil {
+		return err
+	}
+	dec.called |= 1
+	return nil
+}