Release 2021.2.5

It also fixes the marshelling of CIDR into JSON since otherwise
it would show garbled characters as the mask.

CHANGES.md

@@ -0,0 +1,29 @@
+**Experimental**: This is a new format for release notes. The format and availability is subject to change.
+
+## 2021.2.5
+
+### New Features
+- We introduce [Cloudflare One Routing](https://developers.cloudflare.com/cloudflare-one/tutorials/warp-to-tunnel) in beta mode, where users can create private networks with RFC 1918 IP addresses on Cloudflare's network. Clients running Cloudflare WARP client in the same organization can then connect to services made available by Argo Tunnel. Please share your feedback in the GitHub issue opened.
+
+
+## 2021.2.4
+
+### Bug Fixes
+- Reverts the Improvement released in 2021.2.3 for CLI arguments as it introduced a regression where cloudflared failed to read URLs in configuration files.
+- Cloudflared now logs the reason for failed connections if the error is recoverable.
+
+
+## 2021.2.3
+ 
+### Backward Incompatible Changes
+- Removes db-connect. The Cloudflare Workers product will continue to support db-connect implementations with versions of cloudflared that predate this release and include support for db-connect.
+ 
+### New Features
+- Introduces support for proxy configurations with websockets in arbitrary TCP connections (#318).
+ 
+### Improvements
+- Nested command line arguments (such as `cloudflared tunnel run`) now consider CLI arguments even if they appear earlier in the command. E.g. `cloudflared --config config.yaml tunnel run` will now behave similarly to `cloudflared tunnel --config config.yaml run`
+ 
+### Bug Fixes
+- The maximum number of upstream connections is now limited by default which should fix reported issues of cloudflared exhausting CPU usage when faced with connectivity issues.
+

README.md

@@ -1,6 +1,6 @@
 # Argo Tunnel client
 
-Contains the command-line client for Argo Tunnel, a tunneling daemon that proxies any local webserver through the Cloudflare network. Extensive documentation can be found in the [Argo Tunnel section](https://developers.cloudflare.com/argo-tunnel/) of the Cloudflare Docs.
+Contains the command-line client for Argo Tunnel, a tunneling daemon that proxies any local webserver through the Cloudflare network. Extensive documentation can be found in the [Argo Tunnel section](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps) of the Cloudflare Docs.
 
 ## Before you get started
 
@@ -13,29 +13,29 @@ Before you use Argo Tunnel, you'll need to complete a few steps in the Cloudflar
 
 Downloads are available as standalone binaries, a Docker image, and Debian, RPM, and Homebrew packages. You can also find releases here on the `cloudflared` GitHub repository.
 
-* You can [install on macOS](https://developers.cloudflare.com/argo-tunnel/getting-started/installation#macos) via Homebrew or by downloading the [latest Darwin amd64 release](https://github.com/cloudflare/cloudflared/releases)
-* Binaries, Debian, and RPM packages for Linux [can be found here](https://developers.cloudflare.com/argo-tunnel/getting-started/installation#linux)
+* You can [install on macOS](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation#macos) via Homebrew or by downloading the [latest Darwin amd64 release](https://github.com/cloudflare/cloudflared/releases)
+* Binaries, Debian, and RPM packages for Linux [can be found here](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation#linux)
 * A Docker image of `cloudflared` is [available on DockerHub](https://hub.docker.com/r/cloudflare/cloudflared)
-* You can install on Windows machines with the [steps here](https://developers.cloudflare.com/argo-tunnel/getting-started/installation#windows)
+* You can install on Windows machines with the [steps here](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation#windows)
 
-User documentation for Argo Tunnel can be found at https://developers.cloudflare.com/argo-tunnel/
+User documentation for Argo Tunnel can be found at https://developers.cloudflare.com/cloudflare-one/connections/connect-apps
 
 ## Creating Tunnels and routing traffic
 
 Once installed, you can authenticate `cloudflared` into your Cloudflare account and begin creating Tunnels that serve traffic for hostnames in your account.
 
-* Create a Tunnel with [these instructions](https://developers.cloudflare.com/argo-tunnel/create-tunnel)
-* Route traffic to that Tunnel with [DNS records in Cloudflare](https://developers.cloudflare.com/argo-tunnel/routing-to-tunnel/dns) or with a [Cloudflare Load Balancer](https://developers.cloudflare.com/argo-tunnel/routing-to-tunnel/lb)
+* Create a Tunnel with [these instructions](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/create-tunnel)
+* Route traffic to that Tunnel with [DNS records in Cloudflare](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/routing-to-tunnel/dns) or with a [Cloudflare Load Balancer](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/routing-to-tunnel/lb)
 
 ## TryCloudflare
 
-Want to test Argo Tunnel before adding a website to Cloudflare? You can do so with TryCloudflare using the documentation [available here](https://developers.cloudflare.com/argo-tunnel/learning/trycloudflare).
+Want to test Argo Tunnel before adding a website to Cloudflare? You can do so with TryCloudflare using the documentation [available here](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/trycloudflare).
 
 ## Deprecated versions
 
 Cloudflare currently supports all versions of `cloudflared`. Starting on March 20, 2021, Cloudflare will no longer support versions released prior to 2020.5.1.
 
-All features available in versions released prior to 2020.5.1 are available in current versions. Breaking changes unrelated to feature availability may be introduced that will impact versions released prior to 2020.5.1. You can read more about upgrading `cloudflared` in our [developer documentation](https://developers.cloudflare.com/argo-tunnel/getting-started/installation#updating-cloudflared).
+All features available in versions released prior to 2020.5.1 are available in current versions. Breaking changes unrelated to feature availability may be introduced that will impact versions released prior to 2020.5.1. You can read more about upgrading `cloudflared` in our [developer documentation](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation#updating-cloudflared).
 
 | Version(s) | Deprecation status |
 |---|---|

RELEASE_NOTES

@@ -1,3 +1,38 @@
+2021.2.5
+- 2021-02-23 Publish change notes for 2021.2.5
+- 2021-02-11 TUN-3838: ResponseWriter no longer reads and origin error tests
+- 2021-02-10 TUN-3895: Tests for socks stream handler
+- 2021-02-19 TUN-3939: Add logging that shows that Warp-routing is enabled
+- 2021-02-02 TUN-3817: Adds tests for websocket based streaming regression
+- 2021-02-04 TUN-3799: extended the Stream interface to take a logger and added debug logs for io.Copy errors
+- 2021-02-03 TUN-3855: Add ability to override target of 'access ssh' command to a different host for testing
+- 2021-02-04 TUN-3853: Respond with ws headers from the origin service rather than generating our own
+- 2021-02-08 TUN-3889: Move host header override logic to httpService
+- 2021-02-05 TUN-3868: Refactor singleTCPService and bridgeService to tcpOverWSService and rawTCPService
+- 2021-01-21 TUN-3753: Select http2 protocol when warp routing is enabled
+- 2021-01-26 TUN-3809: Allow routes ip show to output as JSON or YAML
+- 2021-01-11 TUN-3615: added support to  proxy tcp streams
+- 2021-01-17 TUN-3725: Warp-routing is independent of ingress
+- 2021-01-15 TUN-3764: Actively flush data for TCP streams
+- 2020-12-09 TUN-3617: Separate service from client, and implement different client for http vs. tcp origins
+
+2021.2.4
+- 2021-02-22 TUN-3948: Log error when retrying connection
+- 2021-02-23 TUN-3964: Revert "TUN-3922: Repoint urfave/cli/v2 library at patched branch at github.com/ipostelnik/cli/v2@fixed which correctly handles reading flags declared at multiple levels of subcommands."
+- 2021-02-23 Publish release notes for 2021.2.4
+
+2021.2.3
+- 2021-02-23 Publish release notes for 2021.2.3
+- 2021-02-10 TUN-3902: Add jitter to backoffhandler
+- 2021-02-11 TUN-3913: Help gives wrong exit code for autoupdate
+- 2021-02-12 Add max upstream connections dns-proxy option (#290)
+- 2021-02-16 TUN-3924: Removed db-connect command. Added a placeholder handler for this command that informs users that command is no longer supported.
+- 2021-02-12 TUN-3922: Repoint urfave/cli/v2 library at patched branch at github.com/ipostelnik/cli/v2@fixed which correctly handles reading flags declared at multiple levels of subcommands.
+- 2021-02-19 Added support for proxy (#318)
+- 2021-02-19 TUN-3945: Fix runApp signature for generic service
+- 2021-02-09 Update README.md
+- 2021-02-09 Update the TryCloudflare link
+
 2021.2.2
 - 2021-02-04 TUN-3864: Users can choose where credentials file is written after creating a tunnel
 - 2021-02-04 TUN-3869: Improve reliability of graceful shutdown.

carrier/carrier.go

@@ -4,6 +4,7 @@
 package carrier
 
 import (
+	"crypto/tls"
 	"io"
 	"net"
 	"net/http"
@@ -20,8 +21,10 @@ import (
 const LogFieldOriginURL = "originURL"
 
 type StartOptions struct {
-	OriginURL string
-	Headers   http.Header
+	OriginURL       string
+	Headers         http.Header
+	Host            string
+	TLSClientConfig *tls.Config
 }
 
 // Connection wraps up all the needed functions to forward over the tunnel

carrier/carrier_test.go

@@ -44,7 +44,7 @@ func (s *testStreamer) Write(p []byte) (int, error) {
 func TestStartClient(t *testing.T) {
 	message := "Good morning Austin! Time for another sunny day in the great state of Texas."
 	log := zerolog.Nop()
-	wsConn := NewWSConnection(&log, false)
+	wsConn := NewWSConnection(&log)
 	ts := newTestWebSocketServer()
 	defer ts.Close()
 
@@ -70,7 +70,7 @@ func TestStartServer(t *testing.T) {
 	message := "Good morning Austin! Time for another sunny day in the great state of Texas."
 	log := zerolog.Nop()
 	shutdownC := make(chan struct{})
-	wsConn := NewWSConnection(&log, false)
+	wsConn := NewWSConnection(&log)
 	ts := newTestWebSocketServer()
 	defer ts.Close()
 	options := &StartOptions{

carrier/websocket.go

@@ -8,6 +8,7 @@ import (
 	"net/http/httputil"
 
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/token"
+	"github.com/cloudflare/cloudflared/ingress"
 	"github.com/cloudflare/cloudflared/socks"
 	cfwebsocket "github.com/cloudflare/cloudflared/websocket"
 
@@ -23,7 +24,7 @@ type Websocket struct {
 }
 
 type wsdialer struct {
-	conn *cfwebsocket.Conn
+	conn *cfwebsocket.GorillaConn
 }
 
 func (d *wsdialer) Dial(address string) (io.ReadWriteCloser, *socks.AddrSpec, error) {
@@ -37,10 +38,9 @@ func (d *wsdialer) Dial(address string) (io.ReadWriteCloser, *socks.AddrSpec, er
 }
 
 // NewWSConnection returns a new connection object
-func NewWSConnection(log *zerolog.Logger, isSocks bool) Connection {
+func NewWSConnection(log *zerolog.Logger) Connection {
 	return &Websocket{
-		log:     log,
-		isSocks: isSocks,
+		log: log,
 	}
 }
 
@@ -54,38 +54,36 @@ func (ws *Websocket) ServeStream(options *StartOptions, conn io.ReadWriter) erro
 	}
 	defer wsConn.Close()
 
-	if ws.isSocks {
-		dialer := &wsdialer{conn: wsConn}
-		requestHandler := socks.NewRequestHandler(dialer)
-		socksServer := socks.NewConnectionHandler(requestHandler)
-
-		_ = socksServer.Serve(conn)
-	} else {
-		cfwebsocket.Stream(wsConn, conn)
-	}
+	ingress.Stream(wsConn, conn, ws.log)
 	return nil
 }
 
 // StartServer creates a Websocket server to listen for connections.
 // This is used on the origin (tunnel) side to take data from the muxer and send it to the origin
 func (ws *Websocket) StartServer(listener net.Listener, remote string, shutdownC <-chan struct{}) error {
-	return cfwebsocket.StartProxyServer(ws.log, listener, remote, shutdownC, cfwebsocket.DefaultStreamHandler)
+	return cfwebsocket.StartProxyServer(ws.log, listener, remote, shutdownC, ingress.DefaultStreamHandler)
 }
 
 // createWebsocketStream will create a WebSocket connection to stream data over
 // It also handles redirects from Access and will present that flow if
 // the token is not present on the request
-func createWebsocketStream(options *StartOptions, log *zerolog.Logger) (*cfwebsocket.Conn, error) {
+func createWebsocketStream(options *StartOptions, log *zerolog.Logger) (*cfwebsocket.GorillaConn, error) {
 	req, err := http.NewRequest(http.MethodGet, options.OriginURL, nil)
 	if err != nil {
 		return nil, err
 	}
 	req.Header = options.Headers
+	if options.Host != "" {
+		req.Host = options.Host
+	}
 
 	dump, err := httputil.DumpRequest(req, false)
 	log.Debug().Msgf("Websocket request: %s", string(dump))
 
-	wsConn, resp, err := cfwebsocket.ClientConnect(req, nil)
+	dialer := &websocket.Dialer{
+		TLSClientConfig: options.TLSClientConfig,
+	}
+	wsConn, resp, err := cfwebsocket.ClientConnect(req, dialer)
 	defer closeRespBody(resp)
 
 	if err != nil && IsAccessResponse(resp) {
@@ -97,7 +95,7 @@ func createWebsocketStream(options *StartOptions, log *zerolog.Logger) (*cfwebso
 		return nil, err
 	}
 
-	return &cfwebsocket.Conn{Conn: wsConn}, nil
+	return &cfwebsocket.GorillaConn{Conn: wsConn}, nil
 }
 
 // createAccessAuthenticatedStream will try load a token from storage and make

cfsetup.yaml

@@ -194,6 +194,7 @@ stretch: &stretch
     builddeps:
       - *pinned_go_fips
       - build-essential
+      - gotest-to-teamcity
     post-cache:
       - export GOOS=linux
       - export GOARCH=amd64
@@ -201,7 +202,7 @@ stretch: &stretch
       # cd to a non-module directory: https://github.com/golang/go/issues/24250
       - (cd / && go get github.com/BurntSushi/go-sumtype)
       - export PATH="$HOME/go/bin:$PATH"
-      - make test
+      - make test | gotest-to-teamcity
   update-homebrew:
     builddeps:
       - openssh-client
@@ -275,14 +276,3 @@ centos-7:
       - export GOOS=linux
       - export GOARCH=amd64
       - make cloudflared-rpm
-
-# cfsetup compose
-default-stack: test_dbconnect
-test_dbconnect:
-  compose:
-    up-args:
-      - --renew-anon-volumes
-      - --abort-on-container-exit
-      - --exit-code-from=cloudflared
-    files:
-      - dbconnect_tests/dbconnect.yaml

cmd/cloudflared/access/carrier.go

@@ -1,6 +1,8 @@
 package access
 
 import (
+	"crypto/tls"
+	"fmt"
 	"net/http"
 	"strings"
 
@@ -46,7 +48,7 @@ func StartForwarder(forwarder config.Forwarder, shutdown <-chan struct{}, log *z
 	}
 
 	// we could add a cmd line variable for this bool if we want the SOCK5 server to be on the client side
-	wsConn := carrier.NewWSConnection(log, false)
+	wsConn := carrier.NewWSConnection(log)
 
 	log.Info().Str(LogFieldHost, validURL.Host).Msg("Start Websocket listener")
 	return carrier.StartForwarder(wsConn, validURL.Host, shutdown, options)
@@ -84,10 +86,30 @@ func ssh(c *cli.Context) error {
 	options := &carrier.StartOptions{
 		OriginURL: originURL,
 		Headers:   headers,
+		Host:      hostname,
+	}
+
+	if connectTo := c.String(sshConnectTo); connectTo != "" {
+		parts := strings.Split(connectTo, ":")
+		switch len(parts) {
+		case 1:
+			options.OriginURL = fmt.Sprintf("https://%s", parts[0])
+		case 2:
+			options.OriginURL = fmt.Sprintf("https://%s:%s", parts[0], parts[1])
+		case 3:
+			options.OriginURL = fmt.Sprintf("https://%s:%s", parts[2], parts[1])
+			options.TLSClientConfig = &tls.Config{
+				InsecureSkipVerify: true,
+				ServerName:         parts[0],
+			}
+			log.Warn().Msgf("Using insecure SSL connection because SNI overridden to %s", parts[0])
+		default:
+			return fmt.Errorf("invalid connection override: %s", connectTo)
+		}
 	}
 
 	// we could add a cmd line variable for this bool if we want the SOCK5 server to be on the client side
-	wsConn := carrier.NewWSConnection(log, false)
+	wsConn := carrier.NewWSConnection(log)
 
 	if c.NArg() > 0 || c.IsSet(sshURLFlag) {
 		forwarder, err := config.ValidateUrl(c, true)
@@ -95,7 +117,6 @@ func ssh(c *cli.Context) error {
 			log.Err(err).Msg("Error validating origin URL")
 			return errors.Wrap(err, "error validating origin URL")
 		}
-
 		log.Info().Str(LogFieldHost, forwarder.Host).Msg("Start Websocket listener")
 		err = carrier.StartForwarder(wsConn, forwarder.Host, shutdownC, options)
 		if err != nil {

cmd/cloudflared/access/cmd.go

@@ -33,6 +33,7 @@ const (
 	sshTokenIDFlag     = "service-token-id"
 	sshTokenSecretFlag = "service-token-secret"
 	sshGenCertFlag     = "short-lived-cert"
+	sshConnectTo       = "connect-to"
 	sshConfigTemplate  = `
 Add to your {{.Home}}/.ssh/config:
 
@@ -54,7 +55,7 @@ Host cfpipe-{{.Hostname}}
 const sentryDSN = "https://56a9c9fa5c364ab28f34b14f35ea0f1b@sentry.io/189878"
 
 var (
-	shutdownC      chan struct{}
+	shutdownC chan struct{}
 )
 
 // Init will initialize and store vars from the main program
@@ -164,6 +165,11 @@ func Commands() []*cli.Command {
 							Aliases: []string{"loglevel"}, //added to match the tunnel side
 							Usage:   "Application logging level {fatal, error, info, debug}. ",
 						},
+						&cli.StringFlag{
+							Name:  sshConnectTo,
+							Hidden: true,
+							Usage: "Connect to alternate location for testing, value is host, host:port, or sni:port:host",
+						},
 					},
 				},
 				{

cmd/cloudflared/app_resolver_service.go

@@ -11,8 +11,9 @@ const (
 	// ResolverServiceType is used to identify what kind of overwatch service this is
 	ResolverServiceType = "resolver"
 
-	LogFieldResolverAddress = "resolverAddress"
-	LogFieldResolverPort    = "resolverPort"
+	LogFieldResolverAddress          = "resolverAddress"
+	LogFieldResolverPort             = "resolverPort"
+	LogFieldResolverMaxUpstreamConns = "resolverMaxUpstreamConns"
 )
 
 // ResolverService is used to wrap the tunneldns package's DNS over HTTP
@@ -57,7 +58,7 @@ func (s *ResolverService) Shutdown() {
 func (s *ResolverService) Run() error {
 	// create a listener
 	l, err := tunneldns.CreateListener(s.resolver.AddressOrDefault(), s.resolver.PortOrDefault(),
-		s.resolver.UpstreamsOrDefault(), s.resolver.BootstrapsOrDefault(), s.log)
+		s.resolver.UpstreamsOrDefault(), s.resolver.BootstrapsOrDefault(), s.resolver.MaxUpstreamConnectionsOrDefault(), s.log)
 	if err != nil {
 		return err
 	}
@@ -74,6 +75,7 @@ func (s *ResolverService) Run() error {
 	resolverLog := s.log.With().
 		Str(LogFieldResolverAddress, s.resolver.AddressOrDefault()).
 		Uint16(LogFieldResolverPort, s.resolver.PortOrDefault()).
+		Int(LogFieldResolverMaxUpstreamConns, s.resolver.MaxUpstreamConnectionsOrDefault()).
 		Logger()
 
 	resolverLog.Info().Msg("Starting resolver")

cmd/cloudflared/cliutil/deprecated.go

@@ -0,0 +1,21 @@
+package cliutil
+
+import (
+	"fmt"
+
+	"github.com/urfave/cli/v2"
+)
+
+func RemovedCommand(name string) *cli.Command {
+	return &cli.Command{
+		Name: name,
+		Action: ErrorHandler(func(context *cli.Context) error {
+			return cli.Exit(
+				fmt.Sprintf("%s command is no longer supported by cloudflared. Consult Argo Tunnel documentation for possible alternative solutions.", name),
+				-1,
+			)
+		}),
+		Description: fmt.Sprintf("%s is deprecated", name),
+		Hidden: true,
+	}
+}

cmd/cloudflared/config/configuration.go

@@ -226,10 +226,15 @@ type OriginRequestConfig struct {
 type Configuration struct {
 	TunnelID      string `yaml:"tunnel"`
 	Ingress       []UnvalidatedIngressRule
+	WarpRouting   WarpRoutingConfig   `yaml:"warp-routing"`
 	OriginRequest OriginRequestConfig `yaml:"originRequest"`
 	sourceFile    string
 }
 
+type WarpRoutingConfig struct {
+	Enabled bool `yaml:"enabled"`
+}
+
 type configFileSettings struct {
 	Configuration `yaml:",inline"`
 	// older settings will be aggregated into the generic map, should be read via cli.Context

cmd/cloudflared/config/configuration_test.go

@@ -20,6 +20,9 @@ func TestConfigFileSettings(t *testing.T) {
 			Path:     "",
 			Service:  "https://localhost:8001",
 		}
+		warpRouting = WarpRoutingConfig{
+			Enabled: true,
+		}
 	)
 	rawYAML := `
 tunnel: config-file-test
@@ -29,6 +32,8 @@ ingress:
    service: https://localhost:8000
  - hostname: "*"
    service: https://localhost:8001
+warp-routing: 
+  enabled: true
 retries: 5
 grace-period: 30s
 percentage: 3.14
@@ -47,6 +52,7 @@ counters:
 	assert.Equal(t, "config-file-test", config.TunnelID)
 	assert.Equal(t, firstIngress, config.Ingress[0])
 	assert.Equal(t, secondIngress, config.Ingress[1])
+	assert.Equal(t, warpRouting, config.WarpRouting)
 
 	retries, err := config.Int("retries")
 	assert.NoError(t, err)
@@ -73,4 +79,5 @@ counters:
 	assert.NoError(t, err)
 	assert.Equal(t, 123, counters[0])
 	assert.Equal(t, 456, counters[1])
+
 }

cmd/cloudflared/config/model.go

@@ -5,6 +5,8 @@ import (
 	"fmt"
 	"io"
 	"strings"
+
+	"github.com/cloudflare/cloudflared/tunneldns"
 )
 
 // Forwarder represents a client side listener to forward traffic to the edge
@@ -25,11 +27,12 @@ type Tunnel struct {
 
 // DNSResolver represents a client side DNS resolver
 type DNSResolver struct {
-	Enabled    bool     `json:"enabled"`
-	Address    string   `json:"address,omitempty"`
-	Port       uint16   `json:"port,omitempty"`
-	Upstreams  []string `json:"upstreams,omitempty"`
-	Bootstraps []string `json:"bootstraps,omitempty"`
+	Enabled                bool     `json:"enabled"`
+	Address                string   `json:"address,omitempty"`
+	Port                   uint16   `json:"port,omitempty"`
+	Upstreams              []string `json:"upstreams,omitempty"`
+	Bootstraps             []string `json:"bootstraps,omitempty"`
+	MaxUpstreamConnections int      `json:"max_upstream_connections,omitempty"`
 }
 
 // Root is the base options to configure the service
@@ -59,6 +62,7 @@ func (r *DNSResolver) Hash() string {
 	io.WriteString(h, strings.Join(r.Bootstraps, ","))
 	io.WriteString(h, strings.Join(r.Upstreams, ","))
 	io.WriteString(h, fmt.Sprintf("%d", r.Port))
+	io.WriteString(h, fmt.Sprintf("%d", r.MaxUpstreamConnections))
 	io.WriteString(h, fmt.Sprintf("%v", r.Enabled))
 	return fmt.Sprintf("%x", h.Sum(nil))
 }
@@ -99,3 +103,11 @@ func (r *DNSResolver) BootstrapsOrDefault() []string {
 	}
 	return []string{"https://162.159.36.1/dns-query", "https://162.159.46.1/dns-query", "https://[2606:4700:4700::1111]/dns-query", "https://[2606:4700:4700::1001]/dns-query"}
 }
+
+// MaxUpstreamConnectionsOrDefault return the max upstream connections or returns the default if negative
+func (r *DNSResolver) MaxUpstreamConnectionsOrDefault() int {
+	if r.MaxUpstreamConnections >= 0 {
+		return r.MaxUpstreamConnections
+	}
+	return tunneldns.MaxUpstreamConnsDefault
+}

cmd/cloudflared/generic_service.go

@@ -8,6 +8,6 @@ import (
 	cli "github.com/urfave/cli/v2"
 )
 
-func runApp(app *cli.App, shutdownC, graceShutdownC chan struct{}) {
+func runApp(app *cli.App, graceShutdownC chan struct{}) {
 	app.Run(os.Args)
 }

cmd/cloudflared/main.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"fmt"
+	"math/rand"
 	"strings"
 	"time"
 
@@ -43,6 +44,7 @@ var (
 )
 
 func main() {
+	rand.Seed(time.Now().UnixNano())
 	metrics.RegisterBuildInfo(BuildTime, Version)
 	raven.SetRelease(Version)
 
@@ -115,7 +117,7 @@ func commands(version func(c *cli.Context)) []*cli.Command {
 If a new version exists, updates the agent binary and quits.
 Otherwise, does nothing.
 
-To determine if an update happened in a script, check for error code 64.`,
+To determine if an update happened in a script, check for error code 11.`,
 		},
 		{
 			Name: "version",

cmd/cloudflared/tunnel/cmd.go

@@ -19,7 +19,6 @@ import (
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/ui"
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/updater"
 	"github.com/cloudflare/cloudflared/connection"
-	"github.com/cloudflare/cloudflared/dbconnect"
 	"github.com/cloudflare/cloudflared/ingress"
 	"github.com/cloudflare/cloudflared/logger"
 	"github.com/cloudflare/cloudflared/metrics"
@@ -106,14 +105,14 @@ func Commands() []*cli.Command {
 		buildCleanupCommand(),
 		// for compatibility, allow following as tunnel subcommands
 		tunneldns.Command(true),
-		dbConnectCmd(),
+		cliutil.RemovedCommand("db-connect"),
 	}
 
 	return []*cli.Command{
 		buildTunnelCommand(subcommands),
 		// for compatibility, allow following as top-level subcommands
 		buildLoginSubcommand(true),
-		dbConnectCmd(),
+		cliutil.RemovedCommand("db-connect"),
 	}
 }
 
@@ -479,33 +478,6 @@ func addPortIfMissing(uri *url.URL, port int) string {
 	return fmt.Sprintf("%s:%d", uri.Hostname(), port)
 }
 
-func dbConnectCmd() *cli.Command {
-	cmd := dbconnect.Cmd()
-
-	// Append the tunnel commands so users can customize the daemon settings.
-	cmd.Flags = appendFlags(Flags(), cmd.Flags...)
-
-	// Override before to run tunnel validation before dbconnect validation.
-	cmd.Before = func(c *cli.Context) error {
-		err := SetFlagsFromConfigFile(c)
-		if err == nil {
-			err = dbconnect.CmdBefore(c)
-		}
-		return err
-	}
-
-	// Override action to setup the Proxy, then if successful, start the tunnel daemon.
-	cmd.Action = cliutil.ErrorHandler(func(c *cli.Context) error {
-		err := dbconnect.CmdAction(c)
-		if err == nil {
-			err = TunnelCommand(c)
-		}
-		return err
-	})
-
-	return cmd
-}
-
 // appendFlags will append extra flags to a slice of flags.
 //
 // The cli package will panic if two flags exist with the same name,
@@ -1011,6 +983,13 @@ func configureProxyDNSFlags(shouldHide bool) []cli.Flag {
 			EnvVars: []string{"TUNNEL_DNS_UPSTREAM"},
 			Hidden:  shouldHide,
 		}),
+		altsrc.NewIntFlag(&cli.IntFlag{
+			Name:    "proxy-dns-max-upstream-conns",
+			Usage:   "Maximum concurrent connections to upstream. Setting to 0 means unlimited.",
+			Value:   tunneldns.MaxUpstreamConnsDefault,
+			Hidden:  shouldHide,
+			EnvVars: []string{"TUNNEL_DNS_MAX_UPSTREAM_CONNS"},
+		}),
 		altsrc.NewStringSliceFlag(&cli.StringSliceFlag{
 			Name:  "proxy-dns-bootstrap",
 			Usage: "bootstrap endpoint URL, you can specify multiple endpoints for redundancy.",

cmd/cloudflared/tunnel/configuration.go

@@ -195,6 +195,7 @@ func prepareTunnelConfig(
 		ingressRules  ingress.Ingress
 		classicTunnel *connection.ClassicTunnelConfig
 	)
+	cfg := config.GetConfiguration()
 	if isNamedTunnel {
 		clientUUID, err := uuid.NewRandom()
 		if err != nil {
@@ -206,7 +207,7 @@ func prepareTunnelConfig(
 			Version:  version,
 			Arch:     fmt.Sprintf("%s_%s", buildInfo.GoOS, buildInfo.GoArch),
 		}
-		ingressRules, err = ingress.ParseIngress(config.GetConfiguration())
+		ingressRules, err = ingress.ParseIngress(cfg)
 		if err != nil && err != ingress.ErrNoIngressRules {
 			return nil, ingress.Ingress{}, err
 		}
@@ -230,7 +231,14 @@ func prepareTunnelConfig(
 		}
 	}
 
-	protocolSelector, err := connection.NewProtocolSelector(c.String("protocol"), namedTunnel, edgediscovery.HTTP2Percentage, origin.ResolveTTL, log)
+	var warpRoutingService *ingress.WarpRoutingService
+	warpRoutingEnabled := isWarpRoutingEnabled(cfg.WarpRouting, isNamedTunnel)
+	if warpRoutingEnabled {
+		warpRoutingService = ingress.NewWarpRoutingService()
+		log.Info().Msgf("Warp-routing is enabled")
+	}
+
+	protocolSelector, err := connection.NewProtocolSelector(c.String("protocol"), warpRoutingEnabled, namedTunnel, edgediscovery.HTTP2Percentage, origin.ResolveTTL, log)
 	if err != nil {
 		return nil, ingress.Ingress{}, err
 	}
@@ -245,9 +253,9 @@ func prepareTunnelConfig(
 		edgeTLSConfigs[p] = edgeTLSConfig
 	}
 
-	originClient := origin.NewClient(ingressRules, tags, log)
+	originProxy := origin.NewOriginProxy(ingressRules, warpRoutingService, tags, log)
 	connectionConfig := &connection.Config{
-		OriginClient:    originClient,
+		OriginProxy:     originProxy,
 		GracePeriod:     c.Duration("grace-period"),
 		ReplaceExisting: c.Bool("force"),
 	}
@@ -286,6 +294,10 @@ func prepareTunnelConfig(
 	}, ingressRules, nil
 }
 
+func isWarpRoutingEnabled(warpConfig config.WarpRoutingConfig, isNamedTunnel bool) bool {
+	return warpConfig.Enabled && isNamedTunnel
+}
+
 func isRunningFromTerminal() bool {
 	return terminal.IsTerminal(int(os.Stdout.Fd()))
 }

cmd/cloudflared/tunnel/server.go

@@ -1,6 +1,8 @@
 package tunnel
 
 import (
+	"fmt"
+
 	"github.com/cloudflare/cloudflared/tunneldns"
 
 	"github.com/pkg/errors"
@@ -13,7 +15,11 @@ func runDNSProxyServer(c *cli.Context, dnsReadySignal chan struct{}, shutdownC <
 	if port <= 0 || port > 65535 {
 		return errors.New("The 'proxy-dns-port' must be a valid port number in <1, 65535> range.")
 	}
-	listener, err := tunneldns.CreateListener(c.String("proxy-dns-address"), uint16(port), c.StringSlice("proxy-dns-upstream"), c.StringSlice("proxy-dns-bootstrap"), log)
+	maxUpstreamConnections := c.Int("proxy-dns-max-upstream-conns")
+	if maxUpstreamConnections < 0 {
+		return fmt.Errorf("'%s' must be 0 or higher", "proxy-dns-max-upstream-conns")
+	}
+	listener, err := tunneldns.CreateListener(c.String("proxy-dns-address"), uint16(port), c.StringSlice("proxy-dns-upstream"), c.StringSlice("proxy-dns-bootstrap"), maxUpstreamConnections, log)
 	if err != nil {
 		close(dnsReadySignal)
 		listener.Stop()

cmd/cloudflared/tunnel/teamnet_subcommands.go

@@ -41,7 +41,7 @@ func buildRouteIPSubcommand() *cli.Command {
 				Usage:       "Show the routing table",
 				UsageText:   "cloudflared tunnel [--config FILEPATH] route ip show [flags]",
 				Description: `Shows your organization's private route table. You can use flags to filter the results.`,
-				Flags:       teamnet.FilterFlags,
+				Flags:       showRoutesFlags(),
 			},
 			{
 				Name:        "delete",
@@ -62,6 +62,13 @@ func buildRouteIPSubcommand() *cli.Command {
 	}
 }
 
+func showRoutesFlags() []cli.Flag {
+	flags := make([]cli.Flag, 0)
+	flags = append(flags, teamnet.FilterFlags...)
+	flags = append(flags, outputFormatFlag)
+	return flags
+}
+
 func showRoutesCommand(c *cli.Context) error {
 	sc, err := newSubcommandContext(c)
 	if err != nil {

connection/connection.go

@@ -1,6 +1,7 @@
 package connection
 
 import (
+	"fmt"
 	"io"
 	"net/http"
 	"strconv"
@@ -14,7 +15,7 @@ import (
 const LogFieldConnIndex = "connIndex"
 
 type Config struct {
-	OriginClient    OriginClient
+	OriginProxy     OriginProxy
 	GracePeriod     time.Duration
 	ReplaceExisting bool
 }
@@ -50,14 +51,49 @@ func (c *ClassicTunnelConfig) IsTrialZone() bool {
 	return c.Hostname == ""
 }
 
-type OriginClient interface {
-	Proxy(w ResponseWriter, req *http.Request, isWebsocket bool) error
+// Type indicates the connection type of the  connection.
+type Type int
+
+const (
+	TypeWebsocket Type = iota
+	TypeTCP
+	TypeControlStream
+	TypeHTTP
+)
+
+// ShouldFlush returns whether this kind of connection should actively flush data
+func (t Type) shouldFlush() bool {
+	switch t {
+	case TypeWebsocket, TypeTCP, TypeControlStream:
+		return true
+	default:
+		return false
+	}
+}
+
+func (t Type) String() string {
+	switch t {
+	case TypeWebsocket:
+		return "websocket"
+	case TypeTCP:
+		return "tcp"
+	case TypeControlStream:
+		return "control stream"
+	case TypeHTTP:
+		return "http"
+	default:
+		return fmt.Sprintf("Unknown Type %d", t)
+	}
+}
+
+type OriginProxy interface {
+	// If Proxy returns an error, the caller is responsible for writing the error status to ResponseWriter
+	Proxy(w ResponseWriter, req *http.Request, sourceConnectionType Type) error
 }
 
 type ResponseWriter interface {
-	WriteRespHeaders(*http.Response) error
-	WriteErrorResponse()
-	io.ReadWriter
+	WriteRespHeaders(status int, header http.Header) error
+	io.Writer
 }
 
 type ConnectedFuse interface {

connection/connection_test.go

@@ -19,8 +19,8 @@ const (
 
 var (
 	testConfig = &Config{
-		OriginClient: &mockOriginClient{},
-		GracePeriod:  time.Millisecond * 100,
+		OriginProxy: &mockOriginProxy{},
+		GracePeriod: time.Millisecond * 100,
 	}
 	log           = zerolog.Nop()
 	testOriginURL = &url.URL{
@@ -38,11 +38,11 @@ type testRequest struct {
 	isProxyError   bool
 }
 
-type mockOriginClient struct {
+type mockOriginProxy struct {
 }
 
-func (moc *mockOriginClient) Proxy(w ResponseWriter, r *http.Request, isWebsocket bool) error {
-	if isWebsocket {
+func (moc *mockOriginProxy) Proxy(w ResponseWriter, r *http.Request, sourceConnectionType Type) error {
+	if sourceConnectionType == TypeWebsocket {
 		return wsEndpoint(w, r)
 	}
 	switch r.URL.Path {
@@ -74,7 +74,7 @@ func wsEndpoint(w ResponseWriter, r *http.Request) error {
 	resp := &http.Response{
 		StatusCode: http.StatusSwitchingProtocols,
 	}
-	_ = w.WriteRespHeaders(resp)
+	_ = w.WriteRespHeaders(resp.StatusCode, resp.Header)
 	clientReader := nowriter{r.Body}
 	go func() {
 		for {
@@ -95,7 +95,7 @@ func originRespEndpoint(w ResponseWriter, status int, data []byte) {
 	resp := &http.Response{
 		StatusCode: status,
 	}
-	_ = w.WriteRespHeaders(resp)
+	_ = w.WriteRespHeaders(resp.StatusCode, resp.Header)
 	_, _ = w.Write(data)
 }
 

connection/h2mux.go

@@ -216,7 +216,12 @@ func (h *h2muxConnection) ServeStream(stream *h2mux.MuxedStream) error {
 		return reqErr
 	}
 
-	err := h.config.OriginClient.Proxy(respWriter, req, websocket.IsWebSocketUpgrade(req))
+	var sourceConnectionType = TypeHTTP
+	if websocket.IsWebSocketUpgrade(req) {
+		sourceConnectionType = TypeWebsocket
+	}
+
+	err := h.config.OriginProxy.Proxy(respWriter, req, sourceConnectionType)
 	if err != nil {
 		respWriter.WriteErrorResponse()
 		return err
@@ -240,8 +245,8 @@ type h2muxRespWriter struct {
 	*h2mux.MuxedStream
 }
 
-func (rp *h2muxRespWriter) WriteRespHeaders(resp *http.Response) error {
-	headers := h2mux.H1ResponseToH2ResponseHeaders(resp)
+func (rp *h2muxRespWriter) WriteRespHeaders(status int, header http.Header) error {
+	headers := h2mux.H1ResponseToH2ResponseHeaders(status, header)
 	headers = append(headers, h2mux.Header{Name: ResponseMetaHeaderField, Value: responseMetaHeaderOrigin})
 	return rp.WriteHeaders(headers)
 }

connection/http2.go

@@ -19,6 +19,7 @@ import (
 
 const (
 	internalUpgradeHeader = "Cf-Cloudflared-Proxy-Connection-Upgrade"
+	tcpStreamHeader       = "Cf-Cloudflared-Proxy-Src"
 	websocketUpgrade      = "websocket"
 	controlStreamUpgrade  = "control-stream"
 )
@@ -96,31 +97,24 @@ func (c *http2Connection) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	c.activeRequestsWG.Add(1)
 	defer c.activeRequestsWG.Done()
 
-	respWriter := &http2RespWriter{
-		r: r.Body,
-		w: w,
-	}
-	flusher, isFlusher := w.(http.Flusher)
-	if !isFlusher {
-		c.observer.log.Error().Msgf("%T doesn't implement http.Flusher", w)
-		respWriter.WriteErrorResponse()
+	connType := determineHTTP2Type(r)
+	respWriter, err := newHTTP2RespWriter(r, w, connType)
+	if err != nil {
+		c.observer.log.Error().Msg(err.Error())
 		return
 	}
-	respWriter.flusher = flusher
-	var err error
-	if isControlStreamUpgrade(r) {
-		respWriter.shouldFlush = true
-		err = c.serveControlStream(r.Context(), respWriter)
-		c.controlStreamErr = err
-	} else if isWebsocketUpgrade(r) {
-		respWriter.shouldFlush = true
-		stripWebsocketUpgradeHeader(r)
-		err = c.config.OriginClient.Proxy(respWriter, r, true)
-	} else {
-		err = c.config.OriginClient.Proxy(respWriter, r, false)
-	}
 
-	if err != nil {
+	var proxyErr error
+	switch connType {
+	case TypeControlStream:
+		proxyErr = c.serveControlStream(r.Context(), respWriter)
+	case TypeWebsocket:
+		stripWebsocketUpgradeHeader(r)
+		proxyErr = c.config.OriginProxy.Proxy(respWriter, r, TypeWebsocket)
+	default:
+		proxyErr = c.config.OriginProxy.Proxy(respWriter, r, connType)
+	}
+	if proxyErr != nil {
 		respWriter.WriteErrorResponse()
 	}
 }
@@ -161,10 +155,29 @@ type http2RespWriter struct {
 	shouldFlush bool
 }
 
-func (rp *http2RespWriter) WriteRespHeaders(resp *http.Response) error {
+func newHTTP2RespWriter(r *http.Request, w http.ResponseWriter, connType Type) (*http2RespWriter, error) {
+	flusher, isFlusher := w.(http.Flusher)
+	if !isFlusher {
+		respWriter := &http2RespWriter{
+			r: r.Body,
+			w: w,
+		}
+		respWriter.WriteErrorResponse()
+		return nil, fmt.Errorf("%T doesn't implement http.Flusher", w)
+	}
+
+	return &http2RespWriter{
+		r:           r.Body,
+		w:           w,
+		flusher:     flusher,
+		shouldFlush: connType.shouldFlush(),
+	}, nil
+}
+
+func (rp *http2RespWriter) WriteRespHeaders(status int, header http.Header) error {
 	dest := rp.w.Header()
-	userHeaders := make(http.Header, len(resp.Header))
-	for header, values := range resp.Header {
+	userHeaders := make(http.Header, len(header))
+	for header, values := range header {
 		// Since these are http2 headers, they're required to be lowercase
 		h2name := strings.ToLower(header)
 		for _, v := range values {
@@ -184,13 +197,12 @@ func (rp *http2RespWriter) WriteRespHeaders(resp *http.Response) error {
 	// Perform user header serialization and set them in the single header
 	dest.Set(canonicalResponseUserHeadersField, h2mux.SerializeHeaders(userHeaders))
 	rp.setResponseMetaHeader(responseMetaHeaderOrigin)
-	status := resp.StatusCode
 	// HTTP2 removes support for 101 Switching Protocols https://tools.ietf.org/html/rfc7540#section-8.1.1
 	if status == http.StatusSwitchingProtocols {
 		status = http.StatusOK
 	}
 	rp.w.WriteHeader(status)
-	if IsServerSentEvent(resp.Header) {
+	if IsServerSentEvent(header) {
 		rp.shouldFlush = true
 	}
 	if rp.shouldFlush {
@@ -231,12 +243,30 @@ func (rp *http2RespWriter) Close() error {
 	return nil
 }
 
+func determineHTTP2Type(r *http.Request) Type {
+	switch {
+	case isWebsocketUpgrade(r):
+		return TypeWebsocket
+	case IsTCPStream(r):
+		return TypeTCP
+	case isControlStreamUpgrade(r):
+		return TypeControlStream
+	default:
+		return TypeHTTP
+	}
+}
+
 func isControlStreamUpgrade(r *http.Request) bool {
-	return strings.ToLower(r.Header.Get(internalUpgradeHeader)) == controlStreamUpgrade
+	return r.Header.Get(internalUpgradeHeader) == controlStreamUpgrade
 }
 
 func isWebsocketUpgrade(r *http.Request) bool {
-	return strings.ToLower(r.Header.Get(internalUpgradeHeader)) == websocketUpgrade
+	return r.Header.Get(internalUpgradeHeader) == websocketUpgrade
+}
+
+// IsTCPStream discerns if the connection request needs a tcp stream proxy.
+func IsTCPStream(r *http.Request) bool {
+	return r.Header.Get(tcpStreamHeader) != ""
 }
 
 func stripWebsocketUpgradeHeader(r *http.Request) {

connection/protocol.go

@@ -141,16 +141,29 @@ type PercentageFetcher func() (int32, error)
 
 func NewProtocolSelector(
 	protocolFlag string,
+	warpRoutingEnabled bool,
 	namedTunnel *NamedTunnelConfig,
 	fetchFunc PercentageFetcher,
 	ttl time.Duration,
 	log *zerolog.Logger,
 ) (ProtocolSelector, error) {
+	// Classic tunnel is only supported with h2mux
 	if namedTunnel == nil {
 		return &staticProtocolSelector{
 			current: H2mux,
 		}, nil
 	}
+
+	// warp routing can only be served over http2 connections
+	if warpRoutingEnabled {
+		if protocolFlag == H2mux.String() {
+			log.Warn().Msg("Warp routing is only supported by http2 protocol. Upgrading protocol to http2")
+		}
+		return &staticProtocolSelector{
+			current: HTTP2,
+		}, nil
+	}
+
 	if protocolFlag == H2mux.String() {
 		return &staticProtocolSelector{
 			current: H2mux,

connection/protocol_test.go

@@ -9,7 +9,8 @@ import (
 )
 
 const (
-	testNoTTL = 0
+	testNoTTL            = 0
+	noWarpRoutingEnabled = false
 )
 
 var (
@@ -48,14 +49,15 @@ func (dmf *dynamicMockFetcher) fetch() PercentageFetcher {
 
 func TestNewProtocolSelector(t *testing.T) {
 	tests := []struct {
-		name              string
-		protocol          string
-		expectedProtocol  Protocol
-		hasFallback       bool
-		expectedFallback  Protocol
-		namedTunnelConfig *NamedTunnelConfig
-		fetchFunc         PercentageFetcher
-		wantErr           bool
+		name               string
+		protocol           string
+		expectedProtocol   Protocol
+		hasFallback        bool
+		expectedFallback   Protocol
+		warpRoutingEnabled bool
+		namedTunnelConfig  *NamedTunnelConfig
+		fetchFunc          PercentageFetcher
+		wantErr            bool
 	}{
 		{
 			name:              "classic tunnel",
@@ -108,6 +110,36 @@ func TestNewProtocolSelector(t *testing.T) {
 			fetchFunc:         mockFetcher(100),
 			namedTunnelConfig: testNamedTunnelConfig,
 		},
+		{
+			name:               "warp routing requesting h2mux",
+			protocol:           "h2mux",
+			expectedProtocol:   HTTP2,
+			hasFallback:        false,
+			expectedFallback:   H2mux,
+			fetchFunc:          mockFetcher(100),
+			warpRoutingEnabled: true,
+			namedTunnelConfig:  testNamedTunnelConfig,
+		},
+		{
+			name:               "warp routing http2",
+			protocol:           "http2",
+			expectedProtocol:   HTTP2,
+			hasFallback:        false,
+			expectedFallback:   H2mux,
+			fetchFunc:          mockFetcher(100),
+			warpRoutingEnabled: true,
+			namedTunnelConfig:  testNamedTunnelConfig,
+		},
+		{
+			name:               "warp routing auto",
+			protocol:           "auto",
+			expectedProtocol:   HTTP2,
+			hasFallback:        false,
+			expectedFallback:   H2mux,
+			fetchFunc:          mockFetcher(100),
+			warpRoutingEnabled: true,
+			namedTunnelConfig:  testNamedTunnelConfig,
+		},
 		{
 			// None named tunnel can only use h2mux, so specifying an unknown protocol is not an error
 			name:             "classic tunnel unknown protocol",
@@ -131,7 +163,7 @@ func TestNewProtocolSelector(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		selector, err := NewProtocolSelector(test.protocol, test.namedTunnelConfig, test.fetchFunc, testNoTTL, &log)
+		selector, err := NewProtocolSelector(test.protocol, test.warpRoutingEnabled, test.namedTunnelConfig, test.fetchFunc, testNoTTL, &log)
 		if test.wantErr {
 			assert.Error(t, err, fmt.Sprintf("test %s failed", test.name))
 		} else {
@@ -148,7 +180,7 @@ func TestNewProtocolSelector(t *testing.T) {
 
 func TestAutoProtocolSelectorRefresh(t *testing.T) {
 	fetcher := dynamicMockFetcher{}
-	selector, err := NewProtocolSelector("auto", testNamedTunnelConfig, fetcher.fetch(), testNoTTL, &log)
+	selector, err := NewProtocolSelector("auto", noWarpRoutingEnabled, testNamedTunnelConfig, fetcher.fetch(), testNoTTL, &log)
 	assert.NoError(t, err)
 	assert.Equal(t, H2mux, selector.Current())
 
@@ -177,7 +209,7 @@ func TestAutoProtocolSelectorRefresh(t *testing.T) {
 
 func TestHTTP2ProtocolSelectorRefresh(t *testing.T) {
 	fetcher := dynamicMockFetcher{}
-	selector, err := NewProtocolSelector("http2", testNamedTunnelConfig, fetcher.fetch(), testNoTTL, &log)
+	selector, err := NewProtocolSelector("http2", noWarpRoutingEnabled, testNamedTunnelConfig, fetcher.fetch(), testNoTTL, &log)
 	assert.NoError(t, err)
 	assert.Equal(t, HTTP2, selector.Current())
 
@@ -206,7 +238,7 @@ func TestHTTP2ProtocolSelectorRefresh(t *testing.T) {
 
 func TestProtocolSelectorRefreshTTL(t *testing.T) {
 	fetcher := dynamicMockFetcher{percentage: 100}
-	selector, err := NewProtocolSelector("auto", testNamedTunnelConfig, fetcher.fetch(), time.Hour, &log)
+	selector, err := NewProtocolSelector("auto", noWarpRoutingEnabled, testNamedTunnelConfig, fetcher.fetch(), time.Hour, &log)
 	assert.NoError(t, err)
 	assert.Equal(t, HTTP2, selector.Current())
 

dbconnect/client.go

@@ -1,145 +0,0 @@
-package dbconnect
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"net/url"
-	"strings"
-	"time"
-	"unicode"
-	"unicode/utf8"
-)
-
-// Client is an interface to talk to any database.
-//
-// Currently, the only implementation is SQLClient, but its structure
-// should be designed to handle a MongoClient or RedisClient in the future.
-type Client interface {
-	Ping(context.Context) error
-	Submit(context.Context, *Command) (interface{}, error)
-}
-
-// NewClient creates a database client based on its URL scheme.
-func NewClient(ctx context.Context, originURL *url.URL) (Client, error) {
-	return NewSQLClient(ctx, originURL)
-}
-
-// Command is a standard, non-vendor format for submitting database commands.
-//
-// When determining the scope of this struct, refer to the following litmus test:
-// Could this (roughly) conform to SQL, Document-based, and Key-value command formats?
-type Command struct {
-	Statement string        `json:"statement"`
-	Arguments Arguments     `json:"arguments,omitempty"`
-	Mode      string        `json:"mode,omitempty"`
-	Isolation string        `json:"isolation,omitempty"`
-	Timeout   time.Duration `json:"timeout,omitempty"`
-}
-
-// Validate enforces the contract of Command: non empty statement (both in length and logic),
-// lowercase mode and isolation, non-zero timeout, and valid Arguments.
-func (cmd *Command) Validate() error {
-	if cmd.Statement == "" {
-		return fmt.Errorf("cannot provide an empty statement")
-	}
-
-	if strings.Map(func(char rune) rune {
-		if char == ';' || unicode.IsSpace(char) {
-			return -1
-		}
-		return char
-	}, cmd.Statement) == "" {
-		return fmt.Errorf("cannot provide a statement with no logic: '%s'", cmd.Statement)
-	}
-
-	cmd.Mode = strings.ToLower(cmd.Mode)
-	cmd.Isolation = strings.ToLower(cmd.Isolation)
-
-	if cmd.Timeout.Nanoseconds() <= 0 {
-		cmd.Timeout = 24 * time.Hour
-	}
-
-	return cmd.Arguments.Validate()
-}
-
-// UnmarshalJSON converts a byte representation of JSON into a Command, which is also validated.
-func (cmd *Command) UnmarshalJSON(data []byte) error {
-	// Alias is required to avoid infinite recursion from the default UnmarshalJSON.
-	type Alias Command
-	alias := &struct {
-		*Alias
-	}{
-		Alias: (*Alias)(cmd),
-	}
-
-	err := json.Unmarshal(data, &alias)
-	if err == nil {
-		err = cmd.Validate()
-	}
-
-	return err
-}
-
-// Arguments is a wrapper for either map-based or array-based Command arguments.
-//
-// Each field is mutually-exclusive and some Client implementations may not
-// support both fields (eg. MySQL does not accept named arguments).
-type Arguments struct {
-	Named      map[string]interface{}
-	Positional []interface{}
-}
-
-// Validate enforces the contract of Arguments: non nil, mutually exclusive, and no empty or reserved keys.
-func (args *Arguments) Validate() error {
-	if args.Named == nil {
-		args.Named = map[string]interface{}{}
-	}
-	if args.Positional == nil {
-		args.Positional = []interface{}{}
-	}
-
-	if len(args.Named) > 0 && len(args.Positional) > 0 {
-		return fmt.Errorf("both named and positional arguments cannot be specified: %+v and %+v", args.Named, args.Positional)
-	}
-
-	for key := range args.Named {
-		if key == "" {
-			return fmt.Errorf("named arguments cannot contain an empty key: %+v", args.Named)
-		}
-		if !utf8.ValidString(key) {
-			return fmt.Errorf("named argument does not conform to UTF-8 encoding: %s", key)
-		}
-		if strings.HasPrefix(key, "_") {
-			return fmt.Errorf("named argument cannot start with a reserved keyword '_': %s", key)
-		}
-		if unicode.IsNumber([]rune(key)[0]) {
-			return fmt.Errorf("named argument cannot start with a number: %s", key)
-		}
-	}
-
-	return nil
-}
-
-// UnmarshalJSON converts a byte representation of JSON into Arguments, which is also validated.
-func (args *Arguments) UnmarshalJSON(data []byte) error {
-	var obj interface{}
-	err := json.Unmarshal(data, &obj)
-	if err != nil {
-		return err
-	}
-
-	named, ok := obj.(map[string]interface{})
-	if ok {
-		args.Named = named
-	} else {
-		positional, ok := obj.([]interface{})
-		if ok {
-			args.Positional = positional
-		} else {
-			return fmt.Errorf("arguments must either be an object {\"0\":\"val\"} or an array [\"val\"]: %s", string(data))
-		}
-	}
-
-	return args.Validate()
-}

dbconnect/client_test.go

@@ -1,183 +0,0 @@
-package dbconnect
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestCommandValidateEmpty(t *testing.T) {
-	stmts := []string{
-		"",
-		";",
-		" \n\t",
-		";\n;\t;",
-	}
-
-	for _, stmt := range stmts {
-		cmd := Command{Statement: stmt}
-
-		assert.Error(t, cmd.Validate(), stmt)
-	}
-}
-
-func TestCommandValidateMode(t *testing.T) {
-	modes := []string{
-		"",
-		"query",
-		"ExEc",
-		"PREPARE",
-	}
-
-	for _, mode := range modes {
-		cmd := Command{Statement: "Ok", Mode: mode}
-
-		assert.NoError(t, cmd.Validate(), mode)
-		assert.Equal(t, strings.ToLower(mode), cmd.Mode)
-	}
-}
-
-func TestCommandValidateIsolation(t *testing.T) {
-	isos := []string{
-		"",
-		"default",
-		"read_committed",
-		"SNAPshot",
-	}
-
-	for _, iso := range isos {
-		cmd := Command{Statement: "Ok", Isolation: iso}
-
-		assert.NoError(t, cmd.Validate(), iso)
-		assert.Equal(t, strings.ToLower(iso), cmd.Isolation)
-	}
-}
-
-func TestCommandValidateTimeout(t *testing.T) {
-	cmd := Command{Statement: "Ok", Timeout: 0}
-
-	assert.NoError(t, cmd.Validate())
-	assert.NotZero(t, cmd.Timeout)
-
-	cmd = Command{Statement: "Ok", Timeout: 1 * time.Second}
-
-	assert.NoError(t, cmd.Validate())
-	assert.Equal(t, 1*time.Second, cmd.Timeout)
-}
-
-func TestCommandValidateArguments(t *testing.T) {
-	cmd := Command{Statement: "Ok", Arguments: Arguments{
-		Named:      map[string]interface{}{"key": "val"},
-		Positional: []interface{}{"val"},
-	}}
-
-	assert.Error(t, cmd.Validate())
-}
-
-func TestCommandUnmarshalJSON(t *testing.T) {
-	strs := []string{
-		"{\"statement\":\"Ok\"}",
-		"{\"statement\":\"Ok\",\"arguments\":[0, 3.14, \"apple\"],\"mode\":\"query\"}",
-		"{\"statement\":\"Ok\",\"isolation\":\"read_uncommitted\",\"timeout\":1000}",
-	}
-
-	for _, str := range strs {
-		var cmd Command
-		assert.NoError(t, json.Unmarshal([]byte(str), &cmd), str)
-	}
-
-	strs = []string{
-		"",
-		"\"",
-		"{}",
-		"{\"argument\":{\"key\":\"val\"}}",
-		"{\"statement\":[\"Ok\"]}",
-	}
-
-	for _, str := range strs {
-		var cmd Command
-		assert.Error(t, json.Unmarshal([]byte(str), &cmd), str)
-	}
-}
-
-func TestArgumentsValidateNotNil(t *testing.T) {
-	args := Arguments{}
-
-	assert.NoError(t, args.Validate())
-	assert.NotNil(t, args.Named)
-	assert.NotNil(t, args.Positional)
-}
-
-func TestArgumentsValidateMutuallyExclusive(t *testing.T) {
-	args := []Arguments{
-		Arguments{},
-		Arguments{Named: map[string]interface{}{"key": "val"}},
-		Arguments{Positional: []interface{}{"val"}},
-	}
-
-	for _, arg := range args {
-		assert.NoError(t, arg.Validate())
-		assert.False(t, len(arg.Named) > 0 && len(arg.Positional) > 0)
-	}
-
-	args = []Arguments{
-		Arguments{
-			Named:      map[string]interface{}{"key": "val"},
-			Positional: []interface{}{"val"},
-		},
-	}
-
-	for _, arg := range args {
-		assert.Error(t, arg.Validate())
-		assert.True(t, len(arg.Named) > 0 && len(arg.Positional) > 0)
-	}
-}
-
-func TestArgumentsValidateKeys(t *testing.T) {
-	keys := []string{
-		"",
-		"_",
-		"_key",
-		"1",
-		"1key",
-		"\xf0\x28\x8c\xbc", // non-utf8
-	}
-
-	for _, key := range keys {
-		args := Arguments{Named: map[string]interface{}{key: "val"}}
-
-		assert.Error(t, args.Validate(), key)
-	}
-}
-
-func TestArgumentsUnmarshalJSON(t *testing.T) {
-	strs := []string{
-		"{}",
-		"{\"key\":\"val\"}",
-		"{\"key\":[1, 3.14, {\"key\":\"val\"}]}",
-		"[]",
-		"[\"key\",\"val\"]",
-		"[{}]",
-	}
-
-	for _, str := range strs {
-		var args Arguments
-		assert.NoError(t, json.Unmarshal([]byte(str), &args), str)
-	}
-
-	strs = []string{
-		"",
-		"\"",
-		"1",
-		"\"key\"",
-		"{\"key\",\"val\"}",
-	}
-
-	for _, str := range strs {
-		var args Arguments
-		assert.Error(t, json.Unmarshal([]byte(str), &args), str)
-	}
-}

dbconnect/cmd.go

@@ -1,165 +0,0 @@
-package dbconnect
-
-import (
-	"context"
-	"log"
-	"net"
-	"strconv"
-
-	"github.com/urfave/cli/v2"
-	"github.com/urfave/cli/v2/altsrc"
-)
-
-// Cmd is the entrypoint command for dbconnect.
-//
-// The tunnel package is responsible for appending this to tunnel.Commands().
-func Cmd() *cli.Command {
-	return &cli.Command{
-		Category:  "Database Connect (ALPHA) - Deprecated",
-		Name:      "db-connect",
-		Usage:     "deprecated: Access your SQL database from Cloudflare Workers or the browser",
-		ArgsUsage: " ",
-		Description: `
-		This feature has been deprecated. 
-		Please see: 
-
-		cloudflared access tcp --help 
-
-		for setting up database connections to the cloudflare edge.
-		
-
-		Creates a connection between your database and the Cloudflare edge.
-		Now you can execute SQL commands anywhere you can send HTTPS requests.
-
-		Connect your database with any of the following commands, you can also try the "playground" without a database:
-
-			cloudflared db-connect --hostname sql.mysite.com --url postgres://user:pass@localhost?sslmode=disable \
-			                       --auth-domain mysite.cloudflareaccess.com --application-aud my-access-policy-tag
-			cloudflared db-connect --hostname sql-dev.mysite.com --url mysql://localhost --insecure
-			cloudflared db-connect --playground
-		
-		Requests should be authenticated using Cloudflare Access, learn more about how to enable it here:
-
-			https://developers.cloudflare.com/access/service-auth/service-token/
-		`,
-		Flags: []cli.Flag{
-			altsrc.NewStringFlag(&cli.StringFlag{
-				Name:    "url",
-				Usage:   "URL to the database (eg. postgres://user:pass@localhost?sslmode=disable)",
-				EnvVars: []string{"TUNNEL_URL"},
-			}),
-			altsrc.NewStringFlag(&cli.StringFlag{
-				Name:    "hostname",
-				Usage:   "Hostname to accept commands over HTTPS (eg. sql.mysite.com)",
-				EnvVars: []string{"TUNNEL_HOSTNAME"},
-			}),
-			altsrc.NewStringFlag(&cli.StringFlag{
-				Name:    "auth-domain",
-				Usage:   "Cloudflare Access authentication domain for your account (eg. mysite.cloudflareaccess.com)",
-				EnvVars: []string{"TUNNEL_ACCESS_AUTH_DOMAIN"},
-			}),
-			altsrc.NewStringFlag(&cli.StringFlag{
-				Name:    "application-aud",
-				Usage:   "Cloudflare Access application \"AUD\" to verify JWTs from requests",
-				EnvVars: []string{"TUNNEL_ACCESS_APPLICATION_AUD"},
-			}),
-			altsrc.NewBoolFlag(&cli.BoolFlag{
-				Name:    "insecure",
-				Usage:   "Disable authentication, the database will be open to the Internet",
-				Value:   false,
-				EnvVars: []string{"TUNNEL_ACCESS_INSECURE"},
-			}),
-			altsrc.NewBoolFlag(&cli.BoolFlag{
-				Name:    "playground",
-				Usage:   "Run a temporary, in-memory SQLite3 database for testing",
-				Value:   false,
-				EnvVars: []string{"TUNNEL_HELLO_WORLD"},
-			}),
-			altsrc.NewStringFlag(&cli.StringFlag{
-				Name:    "loglevel",
-				Value:   "debug", // Make it more verbose than the tunnel default 'info'.
-				EnvVars: []string{"TUNNEL_LOGLEVEL"},
-				Hidden:  true,
-			}),
-		},
-		Before: CmdBefore,
-		Action: CmdAction,
-		Hidden: true,
-	}
-}
-
-// CmdBefore runs some validation checks before running the command.
-func CmdBefore(c *cli.Context) error {
-	// Show the help text is no flags are specified.
-	if c.NumFlags() == 0 {
-		return cli.ShowSubcommandHelp(c)
-	}
-
-	// Hello-world and playground are synonymous with each other,
-	// unset hello-world to prevent tunnel from initializing the hello package.
-	if c.IsSet("hello-world") {
-		c.Set("playground", "true")
-		c.Set("hello-world", "false")
-	}
-
-	// Unix-socket database urls are supported, but the logic is the same as url.
-	if c.IsSet("unix-socket") {
-		c.Set("url", c.String("unix-socket"))
-		c.Set("unix-socket", "")
-	}
-
-	// When playground mode is enabled, run with an in-memory database.
-	if c.IsSet("playground") {
-		c.Set("url", "sqlite3::memory:?cache=shared")
-		c.Set("insecure", strconv.FormatBool(!c.IsSet("auth-domain") && !c.IsSet("application-aud")))
-	}
-
-	// At this point, insecure configurations are valid.
-	if c.Bool("insecure") {
-		return nil
-	}
-
-	// Ensure that secure configurations specify a hostname, domain, and tag for JWT validation.
-	if !c.IsSet("hostname") || !c.IsSet("auth-domain") || !c.IsSet("application-aud") {
-		log.Fatal("must specify --hostname, --auth-domain, and --application-aud unless you want to run in --insecure mode")
-	}
-
-	return nil
-}
-
-// CmdAction starts the Proxy and sets the url in cli.Context to point to the Proxy address.
-func CmdAction(c *cli.Context) error {
-	// STOR-612: sync with context in tunnel daemon.
-	ctx := context.Background()
-
-	var proxy *Proxy
-	var err error
-	if c.Bool("insecure") {
-		proxy, err = NewInsecureProxy(ctx, c.String("url"))
-	} else {
-		proxy, err = NewSecureProxy(ctx, c.String("url"), c.String("auth-domain"), c.String("application-aud"))
-	}
-
-	if err != nil {
-		log.Fatal(err)
-		return err
-	}
-
-	listenerC := make(chan net.Listener)
-	defer close(listenerC)
-
-	// Since the Proxy should only talk to the tunnel daemon, find the next available
-	// localhost port and start to listen to requests.
-	go func() {
-		err := proxy.Start(ctx, "127.0.0.1:", listenerC)
-		if err != nil {
-			log.Fatal(err)
-		}
-	}()
-
-	// Block until the the Proxy is online, retreive its address, and change the url to point to it.
-	// This is effectively "handing over" control to the tunnel package so it can run the tunnel daemon.
-	c.Set("url", "https://"+(<-listenerC).Addr().String())
-
-	return nil
-}

dbconnect/cmd_test.go

@@ -1,27 +0,0 @@
-package dbconnect
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-
-	"github.com/urfave/cli/v2"
-)
-
-func TestCmd(t *testing.T) {
-	tests := [][]string{
-		{"cloudflared", "db-connect", "--playground"},
-		{"cloudflared", "db-connect", "--playground", "--hostname", "sql.mysite.com"},
-		{"cloudflared", "db-connect", "--url", "sqlite3::memory:?cache=shared", "--insecure"},
-		{"cloudflared", "db-connect", "--url", "sqlite3::memory:?cache=shared", "--hostname", "sql.mysite.com", "--auth-domain", "mysite.cloudflareaccess.com", "--application-aud", "aud"},
-	}
-
-	app := &cli.App{
-		Name:     "cloudflared",
-		Commands: []*cli.Command{Cmd()},
-	}
-
-	for _, test := range tests {
-		assert.NoError(t, app.Run(test))
-	}
-}

dbconnect/proxy.go

@@ -1,279 +0,0 @@
-package dbconnect
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net"
-	"net/http"
-	"net/url"
-	"os"
-	"time"
-
-	"github.com/cloudflare/cloudflared/hello"
-	"github.com/cloudflare/cloudflared/validation"
-	"github.com/gorilla/mux"
-	"github.com/pkg/errors"
-	"github.com/rs/zerolog"
-)
-
-const (
-	LogFieldCFRay = "cfRay"
-)
-
-// Proxy is an HTTP server that proxies requests to a Client.
-type Proxy struct {
-	client          Client
-	accessValidator *validation.Access
-	log             *zerolog.Logger
-}
-
-// NewInsecureProxy creates a Proxy that talks to a Client at an origin.
-//
-// In insecure mode, the Proxy will allow all Command requests.
-func NewInsecureProxy(ctx context.Context, origin string) (*Proxy, error) {
-	originURL, err := url.Parse(origin)
-	if err != nil {
-		return nil, errors.Wrap(err, "must provide a valid database url")
-	}
-
-	client, err := NewClient(ctx, originURL)
-	if err != nil {
-		return nil, err
-	}
-
-	err = client.Ping(ctx)
-	if err != nil {
-		return nil, errors.Wrap(err, "could not connect to the database")
-	}
-
-	log := zerolog.New(os.Stderr).With().Logger() // TODO: Does not obey log configuration
-
-	return &Proxy{client, nil, &log}, nil
-}
-
-// NewSecureProxy creates a Proxy that talks to a Client at an origin.
-//
-// In secure mode, the Proxy will reject any Command requests that are
-// not authenticated by Cloudflare Access with a valid JWT.
-func NewSecureProxy(ctx context.Context, origin, authDomain, applicationAUD string) (*Proxy, error) {
-	proxy, err := NewInsecureProxy(ctx, origin)
-	if err != nil {
-		return nil, err
-	}
-
-	validator, err := validation.NewAccessValidator(ctx, authDomain, authDomain, applicationAUD)
-	if err != nil {
-		return nil, err
-	}
-
-	proxy.accessValidator = validator
-
-	return proxy, err
-}
-
-// IsInsecure gets whether the Proxy will accept a Command from any source.
-func (proxy *Proxy) IsInsecure() bool {
-	return proxy.accessValidator == nil
-}
-
-// IsAllowed checks whether a http.Request is allowed to receive data.
-//
-// By default, requests must pass through Cloudflare Access for authentication.
-// If the proxy is explcitly set to insecure mode, all requests will be allowed.
-func (proxy *Proxy) IsAllowed(r *http.Request, verbose ...bool) bool {
-	if proxy.IsInsecure() {
-		return true
-	}
-
-	// Access and Tunnel should prevent bad JWTs from even reaching the origin,
-	// but validate tokens anyway as an abundance of caution.
-	err := proxy.accessValidator.ValidateRequest(r.Context(), r)
-	if err == nil {
-		return true
-	}
-
-	// Warn administrators that invalid JWTs are being rejected. This is indicative
-	// of either a misconfiguration of the CLI or a massive failure of upstream systems.
-	if len(verbose) > 0 {
-		proxy.log.Err(err).Str(LogFieldCFRay, proxy.getRayHeader(r)).Msg("dbproxy: Failed JWT authentication")
-	}
-
-	return false
-}
-
-// Start the Proxy at a given address and notify the listener channel when the server is online.
-func (proxy *Proxy) Start(ctx context.Context, addr string, listenerC chan<- net.Listener) error {
-	// STOR-611: use a seperate listener and consider web socket support.
-	httpListener, err := hello.CreateTLSListener(addr)
-	if err != nil {
-		return errors.Wrapf(err, "could not create listener at %s", addr)
-	}
-
-	errC := make(chan error)
-	defer close(errC)
-
-	// Starts the HTTP server and begins to serve requests.
-	go func() {
-		errC <- proxy.httpListen(ctx, httpListener)
-	}()
-
-	// Continually ping the server until it comes online or 10 attempts fail.
-	go func() {
-		var err error
-		for i := 0; i < 10; i++ {
-			_, err = http.Get("http://" + httpListener.Addr().String())
-
-			// Once no error was detected, notify the listener channel and return.
-			if err == nil {
-				listenerC <- httpListener
-				return
-			}
-
-			// Backoff between requests to ping the server.
-			<-time.After(1 * time.Second)
-		}
-		errC <- errors.Wrap(err, "took too long for the http server to start")
-	}()
-
-	return <-errC
-}
-
-// httpListen starts the httpServer and blocks until the context closes.
-func (proxy *Proxy) httpListen(ctx context.Context, listener net.Listener) error {
-	httpServer := &http.Server{
-		Addr:         listener.Addr().String(),
-		Handler:      proxy.httpRouter(),
-		ReadTimeout:  10 * time.Second,
-		WriteTimeout: 60 * time.Second,
-		IdleTimeout:  60 * time.Second,
-	}
-
-	go func() {
-		<-ctx.Done()
-		_ = httpServer.Close()
-		_ = listener.Close()
-	}()
-
-	return httpServer.Serve(listener)
-}
-
-// httpRouter creates a mux.Router for the Proxy.
-func (proxy *Proxy) httpRouter() *mux.Router {
-	router := mux.NewRouter()
-
-	router.HandleFunc("/ping", proxy.httpPing()).Methods("GET", "HEAD")
-	router.HandleFunc("/submit", proxy.httpSubmit()).Methods("POST")
-
-	return router
-}
-
-// httpPing tests the connection to the database.
-//
-// By default, this endpoint is unauthenticated to allow for health checks.
-// To enable authentication, Cloudflare Access must be enabled on this route.
-func (proxy *Proxy) httpPing() http.HandlerFunc {
-	return func(w http.ResponseWriter, r *http.Request) {
-		ctx := r.Context()
-		err := proxy.client.Ping(ctx)
-
-		if err == nil {
-			proxy.httpRespond(w, r, http.StatusOK, "")
-		} else {
-			proxy.httpRespondErr(w, r, http.StatusInternalServerError, err)
-		}
-	}
-}
-
-// httpSubmit sends a command to the database and returns its response.
-//
-// By default, this endpoint will reject requests that do not pass through Cloudflare Access.
-// To disable authentication, the --insecure flag must be specified in the command line.
-func (proxy *Proxy) httpSubmit() http.HandlerFunc {
-	return func(w http.ResponseWriter, r *http.Request) {
-		if !proxy.IsAllowed(r, true) {
-			proxy.httpRespondErr(w, r, http.StatusForbidden, fmt.Errorf(""))
-			return
-		}
-
-		var cmd Command
-		err := json.NewDecoder(r.Body).Decode(&cmd)
-		if err != nil {
-			proxy.httpRespondErr(w, r, http.StatusBadRequest, err)
-			return
-		}
-
-		ctx := r.Context()
-		data, err := proxy.client.Submit(ctx, &cmd)
-
-		if err != nil {
-			proxy.httpRespondErr(w, r, http.StatusUnprocessableEntity, err)
-			return
-		}
-
-		w.Header().Set("Content-type", "application/json")
-		err = json.NewEncoder(w).Encode(data)
-		if err != nil {
-			proxy.httpRespondErr(w, r, http.StatusInternalServerError, err)
-		}
-	}
-}
-
-// httpRespond writes a status code and string response to the response writer.
-func (proxy *Proxy) httpRespond(w http.ResponseWriter, r *http.Request, status int, message string) {
-	w.WriteHeader(status)
-
-	// Only expose the message detail of the reponse if the request is not HEAD
-	// and the user is authenticated. For example, this prevents an unauthenticated
-	// failed health check from accidentally leaking sensitive information about the Client.
-	if r.Method != http.MethodHead && proxy.IsAllowed(r) {
-		if message == "" {
-			message = http.StatusText(status)
-		}
-		fmt.Fprint(w, message)
-	}
-}
-
-// httpRespondErr is similar to httpRespond, except it formats errors to be more friendly.
-func (proxy *Proxy) httpRespondErr(w http.ResponseWriter, r *http.Request, defaultStatus int, err error) {
-	status, err := httpError(defaultStatus, err)
-
-	proxy.httpRespond(w, r, status, err.Error())
-	if len(err.Error()) > 0 {
-		cfRay := proxy.getRayHeader(r)
-		proxy.log.Err(err).Str(LogFieldCFRay, cfRay).Msg("dbproxy: Database proxy error")
-	}
-}
-
-// getRayHeader returns the request's Cf-ray header.
-func (proxy *Proxy) getRayHeader(r *http.Request) string {
-	return r.Header.Get("Cf-ray")
-}
-
-// httpError extracts common errors and returns an status code and friendly error.
-func httpError(defaultStatus int, err error) (int, error) {
-	if err == nil {
-		return http.StatusNotImplemented, fmt.Errorf("error expected but found none")
-	}
-
-	if err == io.EOF {
-		return http.StatusBadRequest, fmt.Errorf("request body cannot be empty")
-	}
-
-	if err == context.DeadlineExceeded {
-		return http.StatusRequestTimeout, err
-	}
-
-	_, ok := err.(net.Error)
-	if ok {
-		return http.StatusRequestTimeout, err
-	}
-
-	if err == context.Canceled {
-		// Does not exist in Golang, but would be: http.StatusClientClosedWithoutResponse
-		return 444, err
-	}
-
-	return defaultStatus, err
-}

dbconnect/proxy_test.go

@@ -1,238 +0,0 @@
-package dbconnect
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"io/ioutil"
-	"net"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-
-	"github.com/gorilla/mux"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestNewInsecureProxy(t *testing.T) {
-	origins := []string{
-		"",
-		":/",
-		"http://localhost",
-		"tcp://localhost:9000?debug=true",
-		"mongodb://127.0.0.1",
-	}
-
-	for _, origin := range origins {
-		proxy, err := NewInsecureProxy(context.Background(), origin)
-
-		assert.Error(t, err)
-		assert.Empty(t, proxy)
-	}
-}
-
-func TestProxyIsAllowed(t *testing.T) {
-	proxy := helperNewProxy(t)
-	req := httptest.NewRequest("GET", "https://1.1.1.1/ping", nil)
-	assert.True(t, proxy.IsAllowed(req))
-
-	proxy = helperNewProxy(t, true)
-	req.Header.Set("Cf-access-jwt-assertion", "xxx")
-	assert.False(t, proxy.IsAllowed(req))
-}
-
-func TestProxyStart(t *testing.T) {
-	proxy := helperNewProxy(t)
-	ctx := context.Background()
-	listenerC := make(chan net.Listener)
-
-	err := proxy.Start(ctx, "1.1.1.1:", listenerC)
-	assert.Error(t, err)
-
-	err = proxy.Start(ctx, "127.0.0.1:-1", listenerC)
-	assert.Error(t, err)
-
-	ctx, cancel := context.WithTimeout(ctx, 0)
-	defer cancel()
-
-	err = proxy.Start(ctx, "127.0.0.1:", listenerC)
-	assert.IsType(t, http.ErrServerClosed, err)
-}
-
-func TestProxyHTTPRouter(t *testing.T) {
-	proxy := helperNewProxy(t)
-	router := proxy.httpRouter()
-
-	tests := []struct {
-		path   string
-		method string
-		valid  bool
-	}{
-		{"", "GET", false},
-		{"/", "GET", false},
-		{"/ping", "GET", true},
-		{"/ping", "HEAD", true},
-		{"/ping", "POST", false},
-		{"/submit", "POST", true},
-		{"/submit", "GET", false},
-		{"/submit/extra", "POST", false},
-	}
-
-	for _, test := range tests {
-		match := &mux.RouteMatch{}
-		ok := router.Match(httptest.NewRequest(test.method, "https://1.1.1.1"+test.path, nil), match)
-
-		assert.True(t, ok == test.valid, test.path)
-	}
-}
-
-func TestProxyHTTPPing(t *testing.T) {
-	proxy := helperNewProxy(t)
-
-	server := httptest.NewServer(proxy.httpPing())
-	defer server.Close()
-	client := server.Client()
-
-	res, err := client.Get(server.URL)
-	assert.NoError(t, err)
-	assert.Equal(t, http.StatusOK, res.StatusCode)
-	assert.Equal(t, int64(2), res.ContentLength)
-
-	res, err = client.Head(server.URL)
-	assert.NoError(t, err)
-	assert.Equal(t, http.StatusOK, res.StatusCode)
-	assert.Equal(t, int64(-1), res.ContentLength)
-}
-
-func TestProxyHTTPSubmit(t *testing.T) {
-	proxy := helperNewProxy(t)
-
-	server := httptest.NewServer(proxy.httpSubmit())
-	defer server.Close()
-	client := server.Client()
-
-	tests := []struct {
-		input  string
-		status int
-		output string
-	}{
-		{"", http.StatusBadRequest, "request body cannot be empty"},
-		{"{}", http.StatusBadRequest, "cannot provide an empty statement"},
-		{"{\"statement\":\"Ok\"}", http.StatusUnprocessableEntity, "cannot provide invalid sql mode: ''"},
-		{"{\"statement\":\"Ok\",\"mode\":\"query\"}", http.StatusUnprocessableEntity, "near \"Ok\": syntax error"},
-		{"{\"statement\":\"CREATE TABLE t (a INT);\",\"mode\":\"exec\"}", http.StatusOK, "{\"last_insert_id\":0,\"rows_affected\":0}\n"},
-	}
-
-	for _, test := range tests {
-		res, err := client.Post(server.URL, "application/json", strings.NewReader(test.input))
-
-		assert.NoError(t, err)
-		assert.Equal(t, test.status, res.StatusCode)
-		if res.StatusCode > http.StatusOK {
-			assert.Equal(t, "text/plain; charset=utf-8", res.Header.Get("Content-type"))
-		} else {
-			assert.Equal(t, "application/json", res.Header.Get("Content-type"))
-		}
-
-		data, err := ioutil.ReadAll(res.Body)
-		defer res.Body.Close()
-		str := string(data)
-
-		assert.NoError(t, err)
-		assert.Equal(t, test.output, str)
-	}
-}
-
-func TestProxyHTTPSubmitForbidden(t *testing.T) {
-	proxy := helperNewProxy(t, true)
-
-	server := httptest.NewServer(proxy.httpSubmit())
-	defer server.Close()
-	client := server.Client()
-
-	res, err := client.Get(server.URL)
-
-	assert.NoError(t, err)
-	assert.Equal(t, http.StatusForbidden, res.StatusCode)
-	assert.Zero(t, res.ContentLength)
-}
-
-func TestProxyHTTPRespond(t *testing.T) {
-	proxy := helperNewProxy(t)
-
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		proxy.httpRespond(w, r, http.StatusAccepted, "Hello")
-	}))
-	defer server.Close()
-	client := server.Client()
-
-	res, err := client.Get(server.URL)
-	assert.NoError(t, err)
-	assert.Equal(t, http.StatusAccepted, res.StatusCode)
-	assert.Equal(t, int64(5), res.ContentLength)
-
-	data, err := ioutil.ReadAll(res.Body)
-	defer res.Body.Close()
-	assert.Equal(t, []byte("Hello"), data)
-}
-
-func TestProxyHTTPRespondForbidden(t *testing.T) {
-	proxy := helperNewProxy(t, true)
-
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		proxy.httpRespond(w, r, http.StatusAccepted, "Hello")
-	}))
-	defer server.Close()
-	client := server.Client()
-
-	res, err := client.Get(server.URL)
-
-	assert.NoError(t, err)
-	assert.Equal(t, http.StatusAccepted, res.StatusCode)
-	assert.Equal(t, int64(0), res.ContentLength)
-}
-
-func TestHTTPError(t *testing.T) {
-	_, errTimeout := net.DialTimeout("tcp", "127.0.0.1", 0)
-	assert.Error(t, errTimeout)
-
-	tests := []struct {
-		input  error
-		status int
-		output error
-	}{
-		{nil, http.StatusNotImplemented, fmt.Errorf("error expected but found none")},
-		{io.EOF, http.StatusBadRequest, fmt.Errorf("request body cannot be empty")},
-		{context.DeadlineExceeded, http.StatusRequestTimeout, nil},
-		{context.Canceled, 444, nil},
-		{errTimeout, http.StatusRequestTimeout, nil},
-		{fmt.Errorf(""), http.StatusInternalServerError, nil},
-	}
-
-	for _, test := range tests {
-		status, err := httpError(http.StatusInternalServerError, test.input)
-
-		assert.Error(t, err)
-		assert.Equal(t, test.status, status)
-		if test.output == nil {
-			test.output = test.input
-		}
-		assert.Equal(t, test.output, err)
-	}
-}
-
-func helperNewProxy(t *testing.T, secure ...bool) *Proxy {
-	t.Helper()
-
-	proxy, err := NewSecureProxy(context.Background(), "file::memory:?cache=shared", "test.cloudflareaccess.com", "")
-	assert.NoError(t, err)
-	assert.NotNil(t, proxy)
-
-	if len(secure) == 0 {
-		proxy.accessValidator = nil // Mark as insecure
-	}
-
-	return proxy
-}

dbconnect/sql.go

@@ -1,318 +0,0 @@
-package dbconnect
-
-import (
-	"context"
-	"database/sql"
-	"encoding/json"
-	"fmt"
-	"net/url"
-	"reflect"
-	"strings"
-
-	"github.com/jmoiron/sqlx"
-	"github.com/pkg/errors"
-	"github.com/xo/dburl"
-
-	// SQL drivers self-register with the database/sql package.
-	// https://github.com/golang/go/wiki/SQLDrivers
-	_ "github.com/denisenkom/go-mssqldb"
-	_ "github.com/go-sql-driver/mysql"
-	_ "github.com/mattn/go-sqlite3"
-
-	"github.com/kshvakov/clickhouse"
-	"github.com/lib/pq"
-)
-
-// SQLClient is a Client that talks to a SQL database.
-type SQLClient struct {
-	Dialect string
-	driver  *sqlx.DB
-}
-
-// NewSQLClient creates a SQL client based on its URL scheme.
-func NewSQLClient(ctx context.Context, originURL *url.URL) (Client, error) {
-	res, err := dburl.Parse(originURL.String())
-	if err != nil {
-		helpText := fmt.Sprintf("supported drivers: %+q, see documentation for more details: %s", sql.Drivers(), "https://godoc.org/github.com/xo/dburl")
-		return nil, fmt.Errorf("could not parse sql database url '%s': %s\n%s", originURL, err.Error(), helpText)
-	}
-
-	// Establishes the driver, but does not test the connection.
-	driver, err := sqlx.Open(res.Driver, res.DSN)
-	if err != nil {
-		return nil, fmt.Errorf("could not open sql driver %s: %s\n%s", res.Driver, err.Error(), res.DSN)
-	}
-
-	// Closes the driver, will occur when the context finishes.
-	go func() {
-		<-ctx.Done()
-		_ = driver.Close()
-	}()
-
-	return &SQLClient{driver.DriverName(), driver}, nil
-}
-
-// Ping verifies a connection to the database is still alive.
-func (client *SQLClient) Ping(ctx context.Context) error {
-	return client.driver.PingContext(ctx)
-}
-
-// Submit queries or executes a command to the SQL database.
-func (client *SQLClient) Submit(ctx context.Context, cmd *Command) (interface{}, error) {
-	txx, err := cmd.ValidateSQL(client.Dialect)
-	if err != nil {
-		return nil, err
-	}
-
-	ctx, cancel := context.WithTimeout(ctx, cmd.Timeout)
-	defer cancel()
-
-	var res interface{}
-
-	// Get the next available sql.Conn and submit the Command.
-	err = sqlConn(ctx, client.driver, txx, func(conn *sql.Conn) error {
-		stmt := cmd.Statement
-		args := cmd.Arguments.Positional
-
-		if cmd.Mode == "query" {
-			res, err = sqlQuery(ctx, conn, stmt, args)
-		} else {
-			res, err = sqlExec(ctx, conn, stmt, args)
-		}
-
-		return err
-	})
-
-	return res, err
-}
-
-// ValidateSQL extends the contract of Command for SQL dialects:
-// mode is conformed, arguments are []sql.NamedArg, and isolation is a sql.IsolationLevel.
-//
-// When the command should not be wrapped in a transaction, *sql.TxOptions and error will both be nil.
-func (cmd *Command) ValidateSQL(dialect string) (*sql.TxOptions, error) {
-	err := cmd.Validate()
-	if err != nil {
-		return nil, err
-	}
-
-	mode, err := sqlMode(cmd.Mode)
-	if err != nil {
-		return nil, err
-	}
-
-	// Mutates Arguments to only use positional arguments with the type sql.NamedArg.
-	// This is a required by the sql.Driver before submitting arguments.
-	cmd.Arguments.sql(dialect)
-
-	iso, err := sqlIsolation(cmd.Isolation)
-	if err != nil {
-		return nil, err
-	}
-
-	// When isolation is out-of-range, this is indicative that no
-	// transaction should be executed and sql.TxOptions should be nil.
-	if iso < sql.LevelDefault {
-		return nil, nil
-	}
-
-	// In query mode, execute the transaction in read-only, unless it's Microsoft SQL
-	// which does not support that type of transaction.
-	readOnly := mode == "query" && dialect != "mssql"
-
-	return &sql.TxOptions{Isolation: iso, ReadOnly: readOnly}, nil
-}
-
-// sqlConn gets the next available sql.Conn in the connection pool and runs a function to use it.
-//
-// If the transaction options are nil, run the useIt function outside a transaction.
-// This is potentially an unsafe operation if the command does not clean up its state.
-func sqlConn(ctx context.Context, driver *sqlx.DB, txx *sql.TxOptions, useIt func(*sql.Conn) error) error {
-	conn, err := driver.Conn(ctx)
-	if err != nil {
-		return err
-	}
-	defer conn.Close()
-
-	// If transaction options are specified, begin and defer a rollback to catch errors.
-	var tx *sql.Tx
-	if txx != nil {
-		tx, err = conn.BeginTx(ctx, txx)
-		if err != nil {
-			return err
-		}
-		defer tx.Rollback()
-	}
-
-	err = useIt(conn)
-
-	// Check if useIt was successful and a transaction exists before committing.
-	if err == nil && tx != nil {
-		err = tx.Commit()
-	}
-
-	return err
-}
-
-// sqlQuery queries rows on a sql.Conn and returns an array of result objects.
-func sqlQuery(ctx context.Context, conn *sql.Conn, stmt string, args []interface{}) ([]map[string]interface{}, error) {
-	rows, err := conn.QueryContext(ctx, stmt, args...)
-	if err == nil {
-		return sqlRows(rows)
-	}
-	return nil, err
-}
-
-// sqlExec executes a command on a sql.Conn and returns the result of the operation.
-func sqlExec(ctx context.Context, conn *sql.Conn, stmt string, args []interface{}) (sqlResult, error) {
-	exec, err := conn.ExecContext(ctx, stmt, args...)
-	if err == nil {
-		return sqlResultFrom(exec), nil
-	}
-	return sqlResult{}, err
-}
-
-// sql mutates Arguments to contain a positional []sql.NamedArg.
-//
-// The actual return type is []interface{} due to the native Golang
-// function signatures for sql.Exec and sql.Query being generic.
-func (args *Arguments) sql(dialect string) {
-	result := args.Positional
-
-	for i, val := range result {
-		result[i] = sqlArg("", val, dialect)
-	}
-
-	for key, val := range args.Named {
-		result = append(result, sqlArg(key, val, dialect))
-	}
-
-	args.Positional = result
-	args.Named = map[string]interface{}{}
-}
-
-// sqlArg creates a sql.NamedArg from a key-value pair and an optional dialect.
-//
-// Certain dialects will need to wrap objects, such as arrays, to conform its driver requirements.
-func sqlArg(key, val interface{}, dialect string) sql.NamedArg {
-	switch reflect.ValueOf(val).Kind() {
-
-	// PostgreSQL and Clickhouse require arrays to be wrapped before
-	// being inserted into the driver interface.
-	case reflect.Slice, reflect.Array:
-		switch dialect {
-		case "postgres":
-			val = pq.Array(val)
-		case "clickhouse":
-			val = clickhouse.Array(val)
-		}
-	}
-
-	return sql.Named(fmt.Sprint(key), val)
-}
-
-// sqlIsolation tries to match a string to a sql.IsolationLevel.
-func sqlIsolation(str string) (sql.IsolationLevel, error) {
-	if str == "none" {
-		return sql.IsolationLevel(-1), nil
-	}
-
-	for iso := sql.LevelDefault; ; iso++ {
-		if iso > sql.LevelLinearizable {
-			return -1, fmt.Errorf("cannot provide an invalid sql isolation level: '%s'", str)
-		}
-
-		if str == "" || strings.EqualFold(iso.String(), strings.ReplaceAll(str, "_", " ")) {
-			return iso, nil
-		}
-	}
-}
-
-// sqlMode tries to match a string to a command mode: 'query' or 'exec' for now.
-func sqlMode(str string) (string, error) {
-	switch str {
-	case "query", "exec":
-		return str, nil
-	default:
-		return "", fmt.Errorf("cannot provide invalid sql mode: '%s'", str)
-	}
-}
-
-// sqlRows scans through a SQL result set and returns an array of objects.
-func sqlRows(rows *sql.Rows) ([]map[string]interface{}, error) {
-	columns, err := rows.Columns()
-	if err != nil {
-		return nil, errors.Wrap(err, "could not extract columns from result")
-	}
-	defer rows.Close()
-
-	types, err := rows.ColumnTypes()
-	if err != nil {
-		// Some drivers do not support type extraction, so fail silently and continue.
-		types = make([]*sql.ColumnType, len(columns))
-	}
-
-	values := make([]interface{}, len(columns))
-	pointers := make([]interface{}, len(columns))
-
-	var results []map[string]interface{}
-	for rows.Next() {
-		for i := range columns {
-			pointers[i] = &values[i]
-		}
-		_ = rows.Scan(pointers...)
-
-		// Convert a row, an array of values, into an object where
-		// each key is the name of its respective column.
-		entry := make(map[string]interface{})
-		for i, col := range columns {
-			entry[col] = sqlValue(values[i], types[i])
-		}
-		results = append(results, entry)
-	}
-
-	return results, nil
-}
-
-// sqlValue handles special cases where sql.Rows does not return a "human-readable" object.
-func sqlValue(val interface{}, col *sql.ColumnType) interface{} {
-	bytes, ok := val.([]byte)
-	if ok {
-		// Opportunistically check for embeded JSON and convert it to a first-class object.
-		var embeded interface{}
-		if json.Unmarshal(bytes, &embeded) == nil {
-			return embeded
-		}
-
-		// STOR-604: investigate a way to coerce PostgreSQL arrays '{a, b, ...}' into JSON.
-		// Although easy with strings, it becomes more difficult with special types like INET[].
-
-		return string(bytes)
-	}
-
-	return val
-}
-
-// sqlResult is a thin wrapper around sql.Result.
-type sqlResult struct {
-	LastInsertId int64 `json:"last_insert_id"`
-	RowsAffected int64 `json:"rows_affected"`
-}
-
-// sqlResultFrom converts sql.Result into a JSON-marshable sqlResult.
-func sqlResultFrom(res sql.Result) sqlResult {
-	insertID, errID := res.LastInsertId()
-	rowsAffected, errRows := res.RowsAffected()
-
-	// If an error occurs when extracting the result, it is because the
-	// driver does not support that specific field. Instead of passing this
-	// to the user, omit the field in the response.
-	if errID != nil {
-		insertID = -1
-	}
-	if errRows != nil {
-		rowsAffected = -1
-	}
-
-	return sqlResult{insertID, rowsAffected}
-}

dbconnect/sql_test.go

@@ -1,336 +0,0 @@
-package dbconnect
-
-import (
-	"context"
-	"database/sql"
-	"fmt"
-	"net/url"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/kshvakov/clickhouse"
-	"github.com/lib/pq"
-
-	"github.com/DATA-DOG/go-sqlmock"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestNewSQLClient(t *testing.T) {
-	originURLs := []string{
-		"postgres://localhost",
-		"cockroachdb://localhost:1337",
-		"postgresql://user:pass@127.0.0.1",
-		"mysql://localhost",
-		"clickhouse://127.0.0.1:9000/?debug",
-		"sqlite3::memory:",
-		"file:test.db?cache=shared",
-	}
-
-	for _, originURL := range originURLs {
-		origin, _ := url.Parse(originURL)
-		_, err := NewSQLClient(context.Background(), origin)
-
-		assert.NoError(t, err, originURL)
-	}
-
-	originURLs = []string{
-		"",
-		"/",
-		"http://localhost",
-		"coolthing://user:pass@127.0.0.1",
-	}
-
-	for _, originURL := range originURLs {
-		origin, _ := url.Parse(originURL)
-		_, err := NewSQLClient(context.Background(), origin)
-
-		assert.Error(t, err, originURL)
-	}
-}
-
-func TestArgumentsSQL(t *testing.T) {
-	args := []Arguments{
-		Arguments{
-			Positional: []interface{}{
-				"val", 10, 3.14,
-			},
-		},
-		Arguments{
-			Named: map[string]interface{}{
-				"key": time.Unix(0, 0),
-			},
-		},
-	}
-
-	var nameType sql.NamedArg
-	for _, arg := range args {
-		arg.sql("")
-		for _, named := range arg.Positional {
-			assert.IsType(t, nameType, named)
-		}
-	}
-}
-
-func TestSQLArg(t *testing.T) {
-	tests := []struct {
-		key     interface{}
-		val     interface{}
-		dialect string
-		arg     sql.NamedArg
-	}{
-		{"key", "val", "mssql", sql.Named("key", "val")},
-		{0, 1, "sqlite3", sql.Named("0", 1)},
-		{1, []string{"a", "b", "c"}, "postgres", sql.Named("1", pq.Array([]string{"a", "b", "c"}))},
-		{"in", []uint{0, 1}, "clickhouse", sql.Named("in", clickhouse.Array([]uint{0, 1}))},
-		{"", time.Unix(0, 0), "", sql.Named("", time.Unix(0, 0))},
-	}
-
-	for _, test := range tests {
-		arg := sqlArg(test.key, test.val, test.dialect)
-		assert.Equal(t, test.arg, arg, test.key)
-	}
-}
-
-func TestSQLIsolation(t *testing.T) {
-	tests := []struct {
-		str string
-		iso sql.IsolationLevel
-	}{
-		{"", sql.LevelDefault},
-		{"DEFAULT", sql.LevelDefault},
-		{"read_UNcommitted", sql.LevelReadUncommitted},
-		{"serializable", sql.LevelSerializable},
-		{"none", sql.IsolationLevel(-1)},
-		{"SNAP shot", -2},
-		{"blah", -2},
-	}
-
-	for _, test := range tests {
-		iso, err := sqlIsolation(test.str)
-
-		if test.iso < -1 {
-			assert.Error(t, err, test.str)
-		} else {
-			assert.NoError(t, err)
-			assert.Equal(t, test.iso, iso, test.str)
-		}
-	}
-}
-
-func TestSQLMode(t *testing.T) {
-	modes := []string{
-		"query",
-		"exec",
-	}
-
-	for _, mode := range modes {
-		actual, err := sqlMode(mode)
-
-		assert.NoError(t, err)
-		assert.Equal(t, strings.ToLower(mode), actual, mode)
-	}
-
-	modes = []string{
-		"",
-		"blah",
-	}
-
-	for _, mode := range modes {
-		_, err := sqlMode(mode)
-
-		assert.Error(t, err)
-	}
-}
-
-func helperRows(mockRows *sqlmock.Rows) *sql.Rows {
-	db, mock, _ := sqlmock.New()
-	mock.ExpectQuery("SELECT").WillReturnRows(mockRows)
-	rows, _ := db.Query("SELECT")
-	return rows
-}
-
-func TestSQLRows(t *testing.T) {
-	actual, err := sqlRows(helperRows(sqlmock.NewRows(
-		[]string{"name", "age", "dept"}).
-		AddRow("alice", 19, "prod")))
-	expected := []map[string]interface{}{map[string]interface{}{
-		"name": "alice",
-		"age":  int64(19),
-		"dept": "prod"}}
-
-	assert.NoError(t, err)
-	assert.ElementsMatch(t, expected, actual)
-}
-
-func TestSQLValue(t *testing.T) {
-	tests := []struct {
-		input  interface{}
-		output interface{}
-	}{
-		{"hello", "hello"},
-		{1, 1},
-		{false, false},
-		{[]byte("random"), "random"},
-		{[]byte("{\"json\":true}"), map[string]interface{}{"json": true}},
-		{[]byte("[]"), []interface{}{}},
-	}
-
-	for _, test := range tests {
-		assert.Equal(t, test.output, sqlValue(test.input, nil), test.input)
-	}
-}
-
-func TestSQLResultFrom(t *testing.T) {
-	res := sqlResultFrom(sqlmock.NewResult(1, 2))
-	assert.Equal(t, sqlResult{1, 2}, res)
-
-	res = sqlResultFrom(sqlmock.NewErrorResult(fmt.Errorf("")))
-	assert.Equal(t, sqlResult{-1, -1}, res)
-}
-
-func helperSQLite3(t *testing.T) (context.Context, Client) {
-	t.Helper()
-
-	ctx := context.Background()
-	url, _ := url.Parse("file::memory:?cache=shared")
-
-	sqlite3, err := NewSQLClient(ctx, url)
-	assert.NoError(t, err)
-
-	return ctx, sqlite3
-}
-
-func TestPing(t *testing.T) {
-	ctx, sqlite3 := helperSQLite3(t)
-	err := sqlite3.Ping(ctx)
-
-	assert.NoError(t, err)
-}
-
-func TestSubmit(t *testing.T) {
-	ctx, sqlite3 := helperSQLite3(t)
-
-	res, err := sqlite3.Submit(ctx, &Command{
-		Statement: "CREATE TABLE t (a INTEGER, b FLOAT, c TEXT, d BLOB);",
-		Mode:      "exec",
-	})
-	assert.NoError(t, err)
-	assert.Equal(t, sqlResult{0, 0}, res)
-
-	res, err = sqlite3.Submit(ctx, &Command{
-		Statement: "SELECT * FROM t;",
-		Mode:      "query",
-	})
-	assert.NoError(t, err)
-	assert.Empty(t, res)
-
-	res, err = sqlite3.Submit(ctx, &Command{
-		Statement: "INSERT INTO t VALUES (?, ?, ?, ?);",
-		Mode:      "exec",
-		Arguments: Arguments{
-			Positional: []interface{}{
-				1,
-				3.14,
-				"text",
-				"blob",
-			},
-		},
-	})
-	assert.NoError(t, err)
-	assert.Equal(t, sqlResult{1, 1}, res)
-
-	res, err = sqlite3.Submit(ctx, &Command{
-		Statement: "UPDATE t SET c = NULL;",
-		Mode:      "exec",
-	})
-	assert.NoError(t, err)
-	assert.Equal(t, sqlResult{1, 1}, res)
-
-	res, err = sqlite3.Submit(ctx, &Command{
-		Statement: "SELECT * FROM t WHERE a = ?;",
-		Mode:      "query",
-		Arguments: Arguments{
-			Positional: []interface{}{1},
-		},
-	})
-	assert.NoError(t, err)
-	assert.Len(t, res, 1)
-
-	resf, ok := res.([]map[string]interface{})
-	assert.True(t, ok)
-	assert.EqualValues(t, map[string]interface{}{
-		"a": int64(1),
-		"b": 3.14,
-		"c": nil,
-		"d": "blob",
-	}, resf[0])
-
-	res, err = sqlite3.Submit(ctx, &Command{
-		Statement: "DROP TABLE t;",
-		Mode:      "exec",
-	})
-	assert.NoError(t, err)
-	assert.Equal(t, sqlResult{1, 1}, res)
-}
-
-func TestSubmitTransaction(t *testing.T) {
-	ctx, sqlite3 := helperSQLite3(t)
-
-	res, err := sqlite3.Submit(ctx, &Command{
-		Statement: "BEGIN;",
-		Mode:      "exec",
-	})
-	assert.Error(t, err)
-	assert.Empty(t, res)
-
-	res, err = sqlite3.Submit(ctx, &Command{
-		Statement: "BEGIN; CREATE TABLE tt (a INT); COMMIT;",
-		Mode:      "exec",
-		Isolation: "none",
-	})
-	assert.NoError(t, err)
-	assert.Equal(t, sqlResult{0, 0}, res)
-
-	rows, err := sqlite3.Submit(ctx, &Command{
-		Statement: "SELECT * FROM tt;",
-		Mode:      "query",
-		Isolation: "repeatable_read",
-	})
-	assert.NoError(t, err)
-	assert.Empty(t, rows)
-}
-
-func TestSubmitTimeout(t *testing.T) {
-	ctx, sqlite3 := helperSQLite3(t)
-
-	res, err := sqlite3.Submit(ctx, &Command{
-		Statement: "SELECT * FROM t;",
-		Mode:      "query",
-		Timeout:   1 * time.Nanosecond,
-	})
-	assert.Error(t, err)
-	assert.Empty(t, res)
-}
-
-func TestSubmitMode(t *testing.T) {
-	ctx, sqlite3 := helperSQLite3(t)
-
-	res, err := sqlite3.Submit(ctx, &Command{
-		Statement: "SELECT * FROM t;",
-		Mode:      "notanoption",
-	})
-	assert.Error(t, err)
-	assert.Empty(t, res)
-}
-
-func TestSubmitEmpty(t *testing.T) {
-	ctx, sqlite3 := helperSQLite3(t)
-
-	res, err := sqlite3.Submit(ctx, &Command{
-		Statement: "; ; ; ;",
-		Mode:      "query",
-	})
-	assert.Error(t, err)
-	assert.Empty(t, res)
-}

dbconnect_tests/dbconnect.yaml

@@ -1,78 +0,0 @@
-# docker-compose -f ./dbconnect_tests/dbconnect.yaml up --build --force-recreate --renew-anon-volumes --exit-code-from cloudflared
-
-version: "2.3"
-networks:
-  test-dbconnect-network:
-    driver: bridge
-services:
-  cloudflared:
-    build:
-      context: ../
-      dockerfile: dev.Dockerfile
-    command: go test github.com/cloudflare/cloudflared/dbconnect_tests -v
-    depends_on:
-      postgres:
-        condition: service_healthy
-      mysql:
-        condition: service_healthy
-      mssql:
-        condition: service_healthy
-      clickhouse:
-        condition: service_healthy
-    environment:
-      DBCONNECT_INTEGRATION_TEST: "true"
-      POSTGRESQL_URL: postgres://postgres:secret@postgres/db?sslmode=disable
-      MYSQL_URL: mysql://root:secret@mysql/db?tls=false
-      MSSQL_URL: mssql://sa:secret12345!@mssql
-      CLICKHOUSE_URL: clickhouse://clickhouse:9000/db
-    networks:
-      - test-dbconnect-network
-  postgres:
-    image: postgres:11.4-alpine
-    environment:
-      POSTGRES_DB: db
-      POSTGRES_PASSWORD: secret
-    healthcheck:
-      test: ["CMD", "pg_isready", "-U", "postgres"]
-      start_period: 3s
-      interval: 1s
-      timeout: 3s
-      retries: 10
-    networks:
-      - test-dbconnect-network
-  mysql:
-    image: mysql:8.0
-    environment:
-      MYSQL_DATABASE: db
-      MYSQL_ROOT_PASSWORD: secret
-    healthcheck:
-      test: ["CMD", "mysqladmin", "ping"]
-      start_period: 3s
-      interval: 1s
-      timeout: 3s
-      retries: 10
-    networks:
-      - test-dbconnect-network
-  mssql:
-    image: mcr.microsoft.com/mssql/server:2017-CU8-ubuntu
-    environment:
-      ACCEPT_EULA: "Y"
-      SA_PASSWORD: secret12345!
-    healthcheck:
-      test: ["CMD", "/opt/mssql-tools/bin/sqlcmd", "-S", "localhost", "-U", "sa", "-P", "secret12345!", "-Q", "SELECT 1"]
-      start_period: 3s
-      interval: 1s
-      timeout: 3s
-      retries: 10
-    networks:
-      - test-dbconnect-network
-  clickhouse:
-    image: yandex/clickhouse-server:19.11
-    healthcheck:
-      test: ["CMD", "clickhouse-client", "--query", "SELECT 1"]
-      start_period: 3s
-      interval: 1s
-      timeout: 3s
-      retries: 10
-    networks:
-      - test-dbconnect-network

dbconnect_tests/sql_test.go

@@ -1,265 +0,0 @@
-package dbconnect_tests
-
-import (
-	"context"
-	"log"
-	"net/url"
-	"os"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-
-	"github.com/cloudflare/cloudflared/dbconnect"
-)
-
-func TestIntegrationPostgreSQL(t *testing.T) {
-	ctx, pq := helperNewSQLClient(t, "POSTGRESQL_URL")
-
-	err := pq.Ping(ctx)
-	assert.NoError(t, err)
-
-	_, err = pq.Submit(ctx, &dbconnect.Command{
-		Statement: "CREATE TABLE t (a TEXT, b UUID, c JSON, d INET[], e SERIAL);",
-		Mode:      "exec",
-	})
-	assert.NoError(t, err)
-
-	_, err = pq.Submit(ctx, &dbconnect.Command{
-		Statement: "INSERT INTO t VALUES ($1, $2, $3, $4);",
-		Mode:      "exec",
-		Arguments: dbconnect.Arguments{
-			Positional: []interface{}{
-				"text",
-				"6b8d686d-bd8e-43bc-b09a-cfcbbe702c10",
-				"{\"bool\":true,\"array\":[\"a\", 1, 3.14],\"embed\":{\"num\":21}}",
-				[]string{"1.1.1.1", "1.0.0.1"},
-			},
-		},
-	})
-	assert.NoError(t, err)
-
-	_, err = pq.Submit(ctx, &dbconnect.Command{
-		Statement: "UPDATE t SET b = NULL;",
-		Mode:      "exec",
-	})
-	assert.NoError(t, err)
-
-	res, err := pq.Submit(ctx, &dbconnect.Command{
-		Statement: "SELECT * FROM t;",
-		Mode:      "query",
-	})
-	assert.NoError(t, err)
-	assert.IsType(t, make([]map[string]interface{}, 0), res)
-
-	actual := res.([]map[string]interface{})[0]
-	expected := map[string]interface{}{
-		"a": "text",
-		"b": nil,
-		"c": map[string]interface{}{
-			"bool":  true,
-			"array": []interface{}{"a", float64(1), 3.14},
-			"embed": map[string]interface{}{"num": float64(21)},
-		},
-		"d": "{1.1.1.1,1.0.0.1}",
-		"e": int64(1),
-	}
-	assert.EqualValues(t, expected, actual)
-
-	_, err = pq.Submit(ctx, &dbconnect.Command{
-		Statement: "DROP TABLE t;",
-		Mode:      "exec",
-	})
-	assert.NoError(t, err)
-}
-
-func TestIntegrationMySQL(t *testing.T) {
-	ctx, my := helperNewSQLClient(t, "MYSQL_URL")
-
-	err := my.Ping(ctx)
-	assert.NoError(t, err)
-
-	_, err = my.Submit(ctx, &dbconnect.Command{
-		Statement: "CREATE TABLE t (a CHAR, b TINYINT, c FLOAT, d JSON, e YEAR);",
-		Mode:      "exec",
-	})
-	assert.NoError(t, err)
-
-	_, err = my.Submit(ctx, &dbconnect.Command{
-		Statement: "INSERT INTO t VALUES (?, ?, ?, ?, ?);",
-		Mode:      "exec",
-		Arguments: dbconnect.Arguments{
-			Positional: []interface{}{
-				"a",
-				10,
-				3.14,
-				"{\"bool\":true}",
-				2000,
-			},
-		},
-	})
-	assert.NoError(t, err)
-
-	_, err = my.Submit(ctx, &dbconnect.Command{
-		Statement: "ALTER TABLE t ADD COLUMN f GEOMETRY;",
-		Mode:      "exec",
-	})
-	assert.NoError(t, err)
-
-	res, err := my.Submit(ctx, &dbconnect.Command{
-		Statement: "SELECT * FROM t;",
-		Mode:      "query",
-	})
-	assert.NoError(t, err)
-	assert.IsType(t, make([]map[string]interface{}, 0), res)
-
-	actual := res.([]map[string]interface{})[0]
-	expected := map[string]interface{}{
-		"a": "a",
-		"b": float64(10),
-		"c": 3.14,
-		"d": map[string]interface{}{"bool": true},
-		"e": float64(2000),
-		"f": nil,
-	}
-	assert.EqualValues(t, expected, actual)
-
-	_, err = my.Submit(ctx, &dbconnect.Command{
-		Statement: "DROP TABLE t;",
-		Mode:      "exec",
-	})
-	assert.NoError(t, err)
-}
-
-func TestIntegrationMSSQL(t *testing.T) {
-	ctx, ms := helperNewSQLClient(t, "MSSQL_URL")
-
-	err := ms.Ping(ctx)
-	assert.NoError(t, err)
-
-	_, err = ms.Submit(ctx, &dbconnect.Command{
-		Statement: "CREATE TABLE t (a BIT, b DECIMAL, c MONEY, d TEXT);",
-		Mode:      "exec"})
-	assert.NoError(t, err)
-
-	_, err = ms.Submit(ctx, &dbconnect.Command{
-		Statement: "INSERT INTO t VALUES (?, ?, ?, ?);",
-		Mode:      "exec",
-		Arguments: dbconnect.Arguments{
-			Positional: []interface{}{
-				0,
-				3,
-				"$0.99",
-				"text",
-			},
-		},
-	})
-	assert.NoError(t, err)
-
-	_, err = ms.Submit(ctx, &dbconnect.Command{
-		Statement: "UPDATE t SET d = NULL;",
-		Mode:      "exec",
-	})
-	assert.NoError(t, err)
-
-	res, err := ms.Submit(ctx, &dbconnect.Command{
-		Statement: "SELECT * FROM t;",
-		Mode:      "query",
-	})
-	assert.NoError(t, err)
-	assert.IsType(t, make([]map[string]interface{}, 0), res)
-
-	actual := res.([]map[string]interface{})[0]
-	expected := map[string]interface{}{
-		"a": false,
-		"b": float64(3),
-		"c": float64(0.99),
-		"d": nil,
-	}
-	assert.EqualValues(t, expected, actual)
-
-	_, err = ms.Submit(ctx, &dbconnect.Command{
-		Statement: "DROP TABLE t;",
-		Mode:      "exec",
-	})
-	assert.NoError(t, err)
-}
-
-func TestIntegrationClickhouse(t *testing.T) {
-	ctx, ch := helperNewSQLClient(t, "CLICKHOUSE_URL")
-
-	err := ch.Ping(ctx)
-	assert.NoError(t, err)
-
-	_, err = ch.Submit(ctx, &dbconnect.Command{
-		Statement: "CREATE TABLE t (a UUID, b String, c Float64, d UInt32, e Int16, f Array(Enum8('a'=1, 'b'=2, 'c'=3))) engine=Memory;",
-		Mode:      "exec",
-	})
-	assert.NoError(t, err)
-
-	_, err = ch.Submit(ctx, &dbconnect.Command{
-		Statement: "INSERT INTO t VALUES (?, ?, ?, ?, ?, ?);",
-		Mode:      "exec",
-		Arguments: dbconnect.Arguments{
-			Positional: []interface{}{
-				"ec65f626-6f50-4c86-9628-6314ef1edacd",
-				"",
-				3.14,
-				314,
-				-144,
-				[]string{"a", "b", "c"},
-			},
-		},
-	})
-	assert.NoError(t, err)
-
-	res, err := ch.Submit(ctx, &dbconnect.Command{
-		Statement: "SELECT * FROM t;",
-		Mode:      "query",
-	})
-	assert.NoError(t, err)
-	assert.IsType(t, make([]map[string]interface{}, 0), res)
-
-	actual := res.([]map[string]interface{})[0]
-	expected := map[string]interface{}{
-		"a": "ec65f626-6f50-4c86-9628-6314ef1edacd",
-		"b": "",
-		"c": float64(3.14),
-		"d": uint32(314),
-		"e": int16(-144),
-		"f": []string{"a", "b", "c"},
-	}
-	assert.EqualValues(t, expected, actual)
-
-	_, err = ch.Submit(ctx, &dbconnect.Command{
-		Statement: "DROP TABLE t;",
-		Mode:      "exec",
-	})
-	assert.NoError(t, err)
-}
-
-func helperNewSQLClient(t *testing.T, env string) (context.Context, dbconnect.Client) {
-	_, ok := os.LookupEnv("DBCONNECT_INTEGRATION_TEST")
-	if ok {
-		t.Helper()
-	} else {
-		t.SkipNow()
-	}
-
-	val, ok := os.LookupEnv(env)
-	if !ok {
-		log.Fatalf("must provide database url as environment variable: %s", env)
-	}
-
-	parsed, err := url.Parse(val)
-	if err != nil {
-		log.Fatalf("cannot provide invalid database url: %s=%s", env, val)
-	}
-
-	ctx := context.Background()
-	client, err := dbconnect.NewSQLClient(ctx, parsed)
-	if err != nil {
-		log.Fatalf("could not start test client: %s", err)
-	}
-
-	return ctx, client
-}

go.mod

@@ -3,29 +3,20 @@ module github.com/cloudflare/cloudflared
 go 1.15
 
 require (
-	github.com/DATA-DOG/go-sqlmock v1.3.3
-	github.com/acmacalister/skittles v0.0.0-20160609003031-7423546701e1 // indirect
-	github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d // indirect
-	github.com/anmitsu/go-shlex v0.0.0-20161002113705-648efa622239 // indirect
-	github.com/aws/aws-sdk-go v1.34.19 // indirect
 	github.com/certifi/gocertifi v0.0.0-20200211180108-c7c1fbc02894 // indirect
 	github.com/cloudflare/brotli-go v0.0.0-20191101163834-d34379f7ff93
 	github.com/cloudflare/golibs v0.0.0-20170913112048-333127dbecfc
 	github.com/coredns/coredns v1.7.0
 	github.com/coreos/go-oidc v0.0.0-20171002155002-a93f71fdfe73
 	github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf
-	github.com/denisenkom/go-mssqldb v0.0.0-20191001013358-cfbb681360f0
 	github.com/facebookgo/ensure v0.0.0-20160127193407-b4ab57deab51 // indirect
 	github.com/facebookgo/freeport v0.0.0-20150612182905-d4adf43b75b9 // indirect
 	github.com/facebookgo/grace v0.0.0-20180706040059-75cf19382434
 	github.com/facebookgo/stack v0.0.0-20160209184415-751773369052 // indirect
 	github.com/facebookgo/subset v0.0.0-20150612182917-8dac2c3c4870 // indirect
-	github.com/frankban/quicktest v1.10.0 // indirect
 	github.com/fsnotify/fsnotify v1.4.9
 	github.com/gdamore/tcell v1.3.0
 	github.com/getsentry/raven-go v0.0.0-20180517221441-ed7bcb39ff10
-	github.com/gliderlabs/ssh v0.0.0-20191009160644-63518b5243e0 // indirect
-	github.com/go-sql-driver/mysql v1.5.0
 	github.com/gobwas/httphead v0.0.0-20200921212729-da3d93bc3c58 // indirect
 	github.com/gobwas/pool v0.2.1 // indirect
 	github.com/gobwas/ws v1.0.4
@@ -34,19 +25,14 @@ require (
 	github.com/google/uuid v1.1.2
 	github.com/gorilla/mux v1.7.3
 	github.com/gorilla/websocket v1.4.2
-	github.com/jmoiron/sqlx v1.2.0
 	github.com/json-iterator/go v1.1.10
 	github.com/kr/text v0.2.0 // indirect
-	github.com/kshvakov/clickhouse v1.3.11
 	github.com/kylelemons/godebug v1.1.0 // indirect
-	github.com/lib/pq v1.2.0
 	github.com/mattn/go-colorable v0.1.8
-	github.com/mattn/go-sqlite3 v1.11.0
 	github.com/miekg/dns v1.1.31
 	github.com/mitchellh/go-homedir v1.1.0
 	github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e // indirect
 	github.com/opentracing/opentracing-go v1.2.0 // indirect
-	github.com/pierrec/lz4 v2.5.2+incompatible // indirect
 	github.com/pkg/errors v0.9.1
 	github.com/pquerna/cachecontrol v0.0.0-20180517163645-1555304b9b35 // indirect
 	github.com/prometheus/client_golang v1.7.1
@@ -55,7 +41,6 @@ require (
 	github.com/rs/zerolog v1.20.0
 	github.com/stretchr/testify v1.6.0
 	github.com/urfave/cli/v2 v2.2.0
-	github.com/xo/dburl v0.0.0-20191005012637-293c3298d6c0
 	golang.org/x/crypto v0.0.0-20200820211705-5c72a883971a
 	golang.org/x/net v0.0.0-20200904194848-62affa334b73
 	golang.org/x/oauth2 v0.0.0-20200902213428-5d25da1a8d43 // indirect

go.sum

@@ -75,8 +75,6 @@ github.com/Shopify/sarama v1.19.0/go.mod h1:FVkBWblsNy7DGZRfXLU0O9RCGt5g3g3yEuWX
 github.com/Shopify/sarama v1.21.0/go.mod h1:yuqtN/pe8cXRWG5zPaO7hCfNJp5MwmkoJEoLjkm5tCQ=
 github.com/Shopify/toxiproxy v2.1.4+incompatible/go.mod h1:OXgGpZ6Cli1/URJOF1DMxUHB2q5Ap20/P/eIdh4G0pI=
 github.com/VividCortex/gohistogram v1.0.0/go.mod h1:Pf5mBqqDxYaXu3hDrrU+w6nw50o/4+TcAqDqk/vUH7g=
-github.com/acmacalister/skittles v0.0.0-20160609003031-7423546701e1 h1:RKnVV4C7qoN/sToLX2y1dqH7T6kKLMHcwRJlgwb9Ggk=
-github.com/acmacalister/skittles v0.0.0-20160609003031-7423546701e1/go.mod h1:gI5CyA/CEnS6eqNV22rqs4dG3aGfaSbXgPORIlwr2r0=
 github.com/afex/hystrix-go v0.0.0-20180502004556-fa1af6a1f4f5/go.mod h1:SkGFH1ia65gfNATL8TAiHDNxPzPdmEL5uirI2Uyuz6c=
 github.com/akamai/AkamaiOPEN-edgegrid-golang v0.9.0/go.mod h1:zpDJeKyp9ScW4NNrbdr+Eyxvry3ilGPewKoXw3XGN1k=
 github.com/alangpierce/go-forceexport v0.0.0-20160317203124-8f1d6941cd75/go.mod h1:uAXEEpARkRhCZfEvy/y0Jcc888f9tHCc1W7/UeEtreE=
@@ -88,8 +86,6 @@ github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d h1:UQZhZ2O0vMHr2c
 github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
 github.com/aliyun/alibaba-cloud-sdk-go v0.0.0-20190808125512-07798873deee/go.mod h1:myCDvQSzCW+wB1WAlocEru4wMGJxy+vlxHdhegi1CDQ=
 github.com/aliyun/aliyun-oss-go-sdk v0.0.0-20190307165228-86c17b95fcd5/go.mod h1:T/Aws4fEfogEE9v+HPhhw+CntffsBHJ8nXQCwKr0/g8=
-github.com/anmitsu/go-shlex v0.0.0-20161002113705-648efa622239 h1:kFOfPq6dUM1hTo4JG6LR5AXSUEsOjtdm0kw0FtQtMJA=
-github.com/anmitsu/go-shlex v0.0.0-20161002113705-648efa622239/go.mod h1:2FmKhYUyUczH0OGQWaF5ceTx0UBShxjsH6f8oGKYe2c=
 github.com/apache/thrift v0.12.0/go.mod h1:cp2SuWMxlEZw2r+iP2GNCdIi4C1qmUzdZFSVb+bacwQ=
 github.com/apache/thrift v0.13.0/go.mod h1:cp2SuWMxlEZw2r+iP2GNCdIi4C1qmUzdZFSVb+bacwQ=
 github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
@@ -100,7 +96,6 @@ github.com/aws/aws-lambda-go v1.13.3/go.mod h1:4UKl9IzQMoD+QF79YdCuzCwp8VbmG4VAQ
 github.com/aws/aws-sdk-go v1.23.0/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
 github.com/aws/aws-sdk-go v1.27.0/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
 github.com/aws/aws-sdk-go v1.32.1/go.mod h1:5zCpMtNQVjRREroY7sYe8lOMRSxkhG6MZveU8YkpAk0=
-github.com/aws/aws-sdk-go v1.34.19/go.mod h1:5zCpMtNQVjRREroY7sYe8lOMRSxkhG6MZveU8YkpAk0=
 github.com/aws/aws-sdk-go-v2 v0.18.0/go.mod h1:JWVYvqSMppoMJC0x5wdwiImzgXTI9FuZwxzkQq9wy+g=
 github.com/baiyubin/aliyun-sts-go-sdk v0.0.0-20180326062324-cfa1a18b161f/go.mod h1:AuiFmCCPBSrqvVMvuqFuk0qogytodnVFVSN5CeJB8Gc=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
@@ -108,8 +103,6 @@ github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+Ce
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
-github.com/bkaradzic/go-lz4 v1.0.0 h1:RXc4wYsyz985CkXXeX04y4VnZFGG8Rd43pRaHsOXAKk=
-github.com/bkaradzic/go-lz4 v1.0.0/go.mod h1:0YdlkowM3VswSROI7qDxhRvJ3sLhlFrRRwjwegp5jy4=
 github.com/caddyserver/caddy v1.0.5 h1:5B1Hs0UF2x2tggr2X9jL2qOZtDXbIWQb9YLbmlxHSuM=
 github.com/caddyserver/caddy v1.0.5/go.mod h1:AnFHB+/MrgRC+mJAvuAgQ38ePzw+wKeW0wzENpdQQKY=
 github.com/casbin/casbin/v2 v2.1.2/go.mod h1:YcPU1XXisHhLzuxH9coDNf2FbKpjGlbCg3n9yuLkIJQ=
@@ -133,8 +126,6 @@ github.com/cloudflare/brotli-go v0.0.0-20191101163834-d34379f7ff93/go.mod h1:QiT
 github.com/cloudflare/cloudflare-go v0.10.2/go.mod h1:qhVI5MKwBGhdNU89ZRz2plgYutcJ5PCekLxXn56w6SY=
 github.com/cloudflare/golibs v0.0.0-20170913112048-333127dbecfc h1:Dvk3ySBsOm5EviLx6VCyILnafPcQinXGP5jbTdHUJgE=
 github.com/cloudflare/golibs v0.0.0-20170913112048-333127dbecfc/go.mod h1:HlgKKR8V5a1wroIDDIz3/A+T+9Janfq+7n1P5sEFdi0=
-github.com/cloudflare/golz4 v0.0.0-20150217214814-ef862a3cdc58 h1:F1EaeKL/ta07PY/k9Os/UFtwERei2/XzGemhpGnBKNg=
-github.com/cloudflare/golz4 v0.0.0-20150217214814-ef862a3cdc58/go.mod h1:EOBUe0h4xcZ5GoxqC5SDxFQ8gwyZPKQoEzownBlhI80=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cockroachdb/datadriven v0.0.0-20190809214429-80d97fb3cbaa/go.mod h1:zn76sxSg3SzpJ0PPJaLDCu+Bu0Lg3sKTORVIj19EIF8=
 github.com/codahale/hdrhistogram v0.0.0-20161010025455-3a0bb77429bd/go.mod h1:sE/e/2PUdi/liOCUjSTXgM1o87ZssimdTWN964YiIeI=
@@ -159,8 +150,6 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/decker502/dnspod-go v0.2.0/go.mod h1:qsurYu1FgxcDwfSwXJdLt4kRsBLZeosEb9uq4Sy+08g=
-github.com/denisenkom/go-mssqldb v0.0.0-20191001013358-cfbb681360f0 h1:epsH3lb7KVbXHYk7LYGN5EiE0MxcevHU85CKITJ0wUY=
-github.com/denisenkom/go-mssqldb v0.0.0-20191001013358-cfbb681360f0/go.mod h1:xbL0rPBG9cCiLr28tMa8zpbdarY27NDyej4t/EjAShU=
 github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
 github.com/dimchansky/utfbom v1.1.0/go.mod h1:rO41eb7gLfo8SF1jd9F8HplJm1Fewwi4mQvIirEdv+8=
 github.com/dnaeon/go-vcr v0.0.0-20180814043457-aafff18a5cc2/go.mod h1:aBB1+wY4s93YsC3HHjMBMrwTj2R9FHDzUr9KyGc8n1E=
@@ -199,8 +188,6 @@ github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568 h1:BHsljHzVlRcyQhjr
 github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc=
 github.com/franela/goblin v0.0.0-20200105215937-c9ffbefa60db/go.mod h1:7dvUGVsVBjqR7JHJk0brhHOZYGmfBYOrK0ZhYMEtBr4=
 github.com/franela/goreq v0.0.0-20171204163338-bcd34c9993f8/go.mod h1:ZhphrRTfi2rbfLwlschooIH4+wKKDR4Pdxhh+TRoA20=
-github.com/frankban/quicktest v1.10.0 h1:Gfh+GAJZOAoKZsIZeZbdn2JF10kN1XHNvjsvQK8gVkE=
-github.com/frankban/quicktest v1.10.0/go.mod h1:ui7WezCLWMWxVWr1GETZY3smRy0G4KWq9vcPtJmFl7Y=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
@@ -212,8 +199,6 @@ github.com/getsentry/raven-go v0.0.0-20180517221441-ed7bcb39ff10 h1:YO10pIIBftO/
 github.com/getsentry/raven-go v0.0.0-20180517221441-ed7bcb39ff10/go.mod h1:KungGk8q33+aIAZUIVWZDr2OfAEBsO49PX4NzFV5kcQ=
 github.com/ghodss/yaml v0.0.0-20150909031657-73d445a93680/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
-github.com/gliderlabs/ssh v0.0.0-20191009160644-63518b5243e0 h1:gF8ngtda767ddth2SH0YSAhswhz6qUkvyI9EZFYCWJA=
-github.com/gliderlabs/ssh v0.0.0-20191009160644-63518b5243e0/go.mod h1:U7qILu1NlMHj9FlMhZLlkCdDnU1DBEAqr0aevW3Awn0=
 github.com/go-acme/lego/v3 v3.1.0/go.mod h1:074uqt+JS6plx+c9Xaiz6+L+GBb+7itGtzfcDM2AhEE=
 github.com/go-acme/lego/v3 v3.2.0/go.mod h1:074uqt+JS6plx+c9Xaiz6+L+GBb+7itGtzfcDM2AhEE=
 github.com/go-cmd/cmd v1.0.5/go.mod h1:y8q8qlK5wQibcw63djSl/ntiHUHXHGdCkPk0j4QeW4s=
@@ -253,8 +238,6 @@ github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXP
 github.com/goji/httpauth v0.0.0-20160601135302-2da839ab0f4d/go.mod h1:nnjvkQ9ptGaCkuDUx6wNykzzlUixGxvkme+H/lnzb+A=
 github.com/golang-collections/collections v0.0.0-20130729185459-604e922904d3 h1:zN2lZNZRflqFyxVaTIU61KNKQ9C0055u9CAfpmqUvo4=
 github.com/golang-collections/collections v0.0.0-20130729185459-604e922904d3/go.mod h1:nPpo7qLxd6XL3hWJG/O60sR8ZKfMCiIoNap5GvD12KU=
-github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe h1:lXe2qZdvpiX5WZkZR4hgp4KJVfY3nMkvmwbVkpv1rVY=
-github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -371,8 +354,6 @@ github.com/jimstudt/http-authentication v0.0.0-20140401203705-3eca13d6893a/go.mo
 github.com/jmespath/go-jmespath v0.0.0-20180206201540-c2b33e8439af/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
 github.com/jmespath/go-jmespath v0.3.0 h1:OS12ieG61fsCg5+qLJ+SsW9NicxNkg3b25OyT2yCeUc=
 github.com/jmespath/go-jmespath v0.3.0/go.mod h1:9QtRXoHjLGCJ5IBSaohpXITPlowMeeYCZ7fLUTSywik=
-github.com/jmoiron/sqlx v1.2.0 h1:41Ip0zITnmWNR/vHV+S4m+VoUivnWY5E4OJfLZjCJMA=
-github.com/jmoiron/sqlx v1.2.0/go.mod h1:1FEQNm3xlJgrMD+FBdI9+xvCksHtbpVBBw5dYhBSsks=
 github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
 github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
 github.com/json-iterator/go v1.1.5/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
@@ -403,16 +384,11 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/kshvakov/clickhouse v1.3.11 h1:dtzTJY0fCA+MWkLyuKZaNPkmSwdX4gh8+Klic9NB1Lw=
-github.com/kshvakov/clickhouse v1.3.11/go.mod h1:/SVBAcqF3u7rxQ9sTWCZwf8jzzvxiZGeQvtmSF2BBEc=
 github.com/kylelemons/godebug v0.0.0-20170820004349-d65d576e9348/go.mod h1:B69LEHPfb2qLo0BaaOLcbitczOKLWTsrBG9LczfCD4k=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/labbsr0x/bindman-dns-webhook v1.0.2/go.mod h1:p6b+VCXIR8NYKpDr8/dg1HKfQoRHCdcsROXKvmoehKA=
 github.com/labbsr0x/goh v1.0.1/go.mod h1:8K2UhVoaWXcCU7Lxoa2omWnC8gyW8px7/lmO61c027w=
-github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
-github.com/lib/pq v1.2.0 h1:LXpIM/LZ5xGFhOpXAQUIMM1HdyqzVYM13zNdjCEEcA0=
-github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lightstep/lightstep-tracer-common/golang/gogo v0.0.0-20190605223551-bc2310a04743/go.mod h1:qklhhLq1aX+mtWk9cPHPzaBjWImj5ULL6C7HFJtXQMM=
 github.com/lightstep/lightstep-tracer-go v0.18.1/go.mod h1:jlF1pusYV4pidLvZ+XD0UBX0ZE6WURAspgAczcDHrL4=
 github.com/linode/linodego v0.10.0/go.mod h1:cziNP7pbvE3mXIPneHj0oRY8L1WtGEIKlZ8LANE4eXA=
@@ -437,9 +413,6 @@ github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzp
 github.com/mattn/go-runewidth v0.0.4/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
 github.com/mattn/go-runewidth v0.0.8 h1:3tS41NlGYSmhhe/8fhGRzc+z3AYCw1Fe1WAyLuujKs0=
 github.com/mattn/go-runewidth v0.0.8/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
-github.com/mattn/go-sqlite3 v1.9.0/go.mod h1:FPy6KqzDD04eiIsT53CuJW3U88zkxoIYsOqkbpncsNc=
-github.com/mattn/go-sqlite3 v1.11.0 h1:LDdKkqtYlom37fkvqs8rMPFKAMe8+SgjbwZ6ex1/A/Q=
-github.com/mattn/go-sqlite3 v1.11.0/go.mod h1:FPy6KqzDD04eiIsT53CuJW3U88zkxoIYsOqkbpncsNc=
 github.com/mattn/go-tty v0.0.0-20180219170247-931426f7535a/go.mod h1:XPvLUNfbS4fJH25nqRHfWLMa1ONC8Amw+mIA639KxkE=
 github.com/matttproud/golang_protobuf_extensions v1.0.1 h1:4hp9jkHxhMHkqkrB3Ix0jegS5sx/RkqARlsWZ6pIwiU=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
@@ -519,8 +492,6 @@ github.com/philhofer/fwd v1.0.0 h1:UbZqGr5Y38ApvM/V/jEljVxwocdweyH+vmYvRPBnbqQ=
 github.com/philhofer/fwd v1.0.0/go.mod h1:gk3iGcWd9+svBvR0sR+KPcfE+RNWozjowpeBVG3ZVNU=
 github.com/pierrec/lz4 v1.0.2-0.20190131084431-473cd7ce01a1/go.mod h1:3/3N9NVKO0jef7pBehbT1qWhCMrIgbYNnFAZCqQ5LRc=
 github.com/pierrec/lz4 v2.0.5+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
-github.com/pierrec/lz4 v2.5.2+incompatible h1:WCjObylUIOlKy/+7Abdn34TLIkXiA4UWUMhxq9m9ZXI=
-github.com/pierrec/lz4 v2.5.2+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
@@ -626,8 +597,6 @@ github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2
 github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
 github.com/xeipuuv/gojsonschema v1.1.0/go.mod h1:5yf86TLmAcydyeJq5YvxkGPE2fm/u4myDekKRoLuqhs=
 github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
-github.com/xo/dburl v0.0.0-20191005012637-293c3298d6c0 h1:6DtWz8hNS4qbq0OCRPhdBMG9E2qKTSDKlwnP3dmZvuA=
-github.com/xo/dburl v0.0.0-20191005012637-293c3298d6c0/go.mod h1:A47W3pdWONaZmXuLZgfKLAVgUY0qvfTRM5vVDKS40S4=
 github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
@@ -657,7 +626,6 @@ golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnf
 golang.org/x/crypto v0.0.0-20181029021203-45a5f77698d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190211182817-74369b46fc67/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190325154230-a5d413f7728c/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190418165655-df01cb2cc480/go.mod h1:WFFai1msRO1wXaEeE5yQxYXgSfI8pQAWXbQop6sCtWE=
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
@@ -815,8 +783,6 @@ golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200909081042-eff7692f9009 h1:W0lCpv29Hv0UaM1LXb9QlBHLNP8UFfcKjblhVCWftOM=
-golang.org/x/sys v0.0.0-20200909081042-eff7692f9009/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68 h1:nxC68pudNYkKU6jWhgrqdreuFiOQWj1Fs7T3VrH4Pjw=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4 h1:myAQVi0cGEoqQVR5POX+8RR2mrocKqNN1hmeMqhX27k=

h2mux/header.go

@@ -125,12 +125,12 @@ func IsWebsocketClientHeader(headerName string) bool {
 		headerName == "upgrade"
 }
 
-func H1ResponseToH2ResponseHeaders(h1 *http.Response) (h2 []Header) {
+func H1ResponseToH2ResponseHeaders(status int, h1 http.Header) (h2 []Header) {
 	h2 = []Header{
-		{Name: ":status", Value: strconv.Itoa(h1.StatusCode)},
+		{Name: ":status", Value: strconv.Itoa(status)},
 	}
-	userHeaders := make(http.Header, len(h1.Header))
-	for header, values := range h1.Header {
+	userHeaders := make(http.Header, len(h1))
+	for header, values := range h1 {
 		h2name := strings.ToLower(header)
 		if h2name == "content-length" {
 			// This header has meaning in HTTP/2 and will be used by the edge,

h2mux/header_test.go

@@ -579,7 +579,7 @@ func TestH1ResponseToH2ResponseHeaders(t *testing.T) {
 		Header:     mockHeaders,
 	}
 
-	headers := H1ResponseToH2ResponseHeaders(&mockResponse)
+	headers := H1ResponseToH2ResponseHeaders(mockResponse.StatusCode, mockResponse.Header)
 
 	serializedHeadersIndex := -1
 	for i, header := range headers {
@@ -622,7 +622,7 @@ func TestHeaderSize(t *testing.T) {
 		Header:     largeHeaders,
 	}
 
-	serializedHeaders := H1ResponseToH2ResponseHeaders(&mockResponse)
+	serializedHeaders := H1ResponseToH2ResponseHeaders(mockResponse.StatusCode, mockResponse.Header)
 	request, err := http.NewRequest(http.MethodGet, "https://example.com/", nil)
 	assert.NoError(t, err)
 	for _, header := range serializedHeaders {
@@ -669,6 +669,6 @@ func BenchmarkH1ResponseToH2ResponseHeaders(b *testing.B) {
 	b.ReportAllocs()
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
-		_ = H1ResponseToH2ResponseHeaders(h1resp)
+		_ = H1ResponseToH2ResponseHeaders(h1resp.StatusCode, h1resp.Header)
 	}
 }

ingress/ingress.go

@@ -24,6 +24,11 @@ var (
 	ErrURLIncompatibleWithIngress = errors.New("You can't set the --url flag (or $TUNNEL_URL) when using multiple-origin ingress rules")
 )
 
+const (
+	ServiceBastion     = "bastion"
+	ServiceWarpRouting = "warp-routing"
+)
+
 // FindMatchingRule returns the index of the Ingress Rule which matches the given
 // hostname and path. This function assumes the last rule matches everything,
 // which is the case if the rules were instantiated via the ingress#Validate method
@@ -38,6 +43,7 @@ func (ing Ingress) FindMatchingRule(hostname, path string) (*Rule, int) {
 			return &rule, i
 		}
 	}
+
 	i := len(ing.Rules) - 1
 	return &ing.Rules[i], i
 }
@@ -84,17 +90,35 @@ func NewSingleOrigin(c *cli.Context, allowURLFromArgs bool) (Ingress, error) {
 	return ing, err
 }
 
+// WarpRoutingService starts a tcp stream between the origin and requests from
+// warp clients.
+type WarpRoutingService struct {
+	Proxy StreamBasedOriginProxy
+}
+
+func NewWarpRoutingService() *WarpRoutingService {
+	return &WarpRoutingService{Proxy: &rawTCPService{name: ServiceWarpRouting}}
+}
+
 // Get a single origin service from the CLI/config.
-func parseSingleOriginService(c *cli.Context, allowURLFromArgs bool) (OriginService, error) {
+func parseSingleOriginService(c *cli.Context, allowURLFromArgs bool) (originService, error) {
 	if c.IsSet("hello-world") {
 		return new(helloWorld), nil
 	}
-	if c.IsSet("url") || c.IsSet(config.BastionFlag) {
+	if c.IsSet(config.BastionFlag) {
+		return newBastionService(), nil
+	}
+	if c.IsSet("url") {
 		originURL, err := config.ValidateUrl(c, allowURLFromArgs)
 		if err != nil {
 			return nil, errors.Wrap(err, "Error validating origin URL")
 		}
-		return &localService{URL: originURL, RootURL: originURL}, nil
+		if isHTTPService(originURL) {
+			return &httpService{
+				url: originURL,
+			}, nil
+		}
+		return newTCPOverWSService(originURL), nil
 	}
 	if c.IsSet("unix-socket") {
 		path, err := config.ValidateUnixSocket(c)
@@ -104,7 +128,7 @@ func parseSingleOriginService(c *cli.Context, allowURLFromArgs bool) (OriginServ
 		return &unixSocketPath{path: path}, nil
 	}
 	u, err := url.Parse("http://localhost:8080")
-	return &localService{URL: u, RootURL: u}, err
+	return &httpService{url: u}, err
 }
 
 // IsEmpty checks if there are any ingress rules.
@@ -136,7 +160,7 @@ func validate(ingress []config.UnvalidatedIngressRule, defaults OriginRequestCon
 	rules := make([]Rule, len(ingress))
 	for i, r := range ingress {
 		cfg := setConfig(defaults, r.OriginRequest)
-		var service OriginService
+		var service originService
 
 		if prefix := "unix:"; strings.HasPrefix(r.Service, prefix) {
 			// No validation necessary for unix socket filepath services
@@ -151,12 +175,12 @@ func validate(ingress []config.UnvalidatedIngressRule, defaults OriginRequestCon
 			service = &srv
 		} else if r.Service == "hello_world" || r.Service == "hello-world" || r.Service == "helloworld" {
 			service = new(helloWorld)
-		} else if r.Service == "bastion" || cfg.BastionMode {
+		} else if r.Service == ServiceBastion || cfg.BastionMode {
 			// Bastion mode will always start a Websocket proxy server, which will
 			// overwrite the localService.URL field when `start` is called. So,
 			// leave the URL field empty for now.
 			cfg.BastionMode = true
-			service = new(localService)
+			service = newBastionService()
 		} else {
 			// Validate URL services
 			u, err := url.Parse(r.Service)
@@ -171,8 +195,11 @@ func validate(ingress []config.UnvalidatedIngressRule, defaults OriginRequestCon
 			if u.Path != "" {
 				return Ingress{}, fmt.Errorf("%s is an invalid address, ingress rules don't support proxying to a different path on the origin service. The path will be the same as the eyeball request's path", r.Service)
 			}
-			serviceURL := localService{URL: u}
-			service = &serviceURL
+			if isHTTPService(u) {
+				service = &httpService{url: u}
+			} else {
+				service = newTCPOverWSService(u)
+			}
 		}
 
 		if err := validateHostname(r, i, len(ingress)); err != nil {
@@ -241,3 +268,7 @@ func ParseIngress(conf *config.Configuration) (Ingress, error) {
 	}
 	return validate(conf.Ingress, originRequestFromYAML(conf.OriginRequest))
 }
+
+func isHTTPService(url *url.URL) bool {
+	return url.Scheme == "http" || url.Scheme == "https" || url.Scheme == "ws" || url.Scheme == "wss"
+}

ingress/ingress_test.go

@@ -3,6 +3,7 @@ package ingress
 import (
 	"flag"
 	"fmt"
+	"net/http"
 	"net/url"
 	"regexp"
 	"testing"
@@ -61,12 +62,12 @@ ingress:
 			want: []Rule{
 				{
 					Hostname: "tunnel1.example.com",
-					Service:  &localService{URL: localhost8000},
+					Service:  &httpService{url: localhost8000},
 					Config:   defaultConfig,
 				},
 				{
 					Hostname: "*",
-					Service:  &localService{URL: localhost8001},
+					Service:  &httpService{url: localhost8001},
 					Config:   defaultConfig,
 				},
 			},
@@ -82,7 +83,22 @@ extraKey: extraValue
 			want: []Rule{
 				{
 					Hostname: "*",
-					Service:  &localService{URL: localhost8000},
+					Service:  &httpService{url: localhost8000},
+					Config:   defaultConfig,
+				},
+			},
+		},
+		{
+			name: "ws service",
+			args: args{rawYAML: `
+ingress:
+ - hostname: "*"
+   service: wss://localhost:8000
+`},
+			want: []Rule{
+				{
+					Hostname: "*",
+					Service:  &httpService{url: MustParseURL(t, "wss://localhost:8000")},
 					Config:   defaultConfig,
 				},
 			},
@@ -95,7 +111,7 @@ ingress:
 `},
 			want: []Rule{
 				{
-					Service: &localService{URL: localhost8000},
+					Service: &httpService{url: localhost8000},
 					Config:  defaultConfig,
 				},
 			},
@@ -209,6 +225,85 @@ ingress:
 				},
 			},
 		},
+		{
+			name: "TCP services",
+			args: args{rawYAML: `
+ingress:
+- hostname: tcp.foo.com
+  service: tcp://127.0.0.1
+- hostname: tcp2.foo.com
+  service: tcp://localhost:8000
+- service: http_status:404
+`},
+			want: []Rule{
+				{
+					Hostname: "tcp.foo.com",
+					Service:  newTCPOverWSService(MustParseURL(t, "tcp://127.0.0.1:7864")),
+					Config:   defaultConfig,
+				},
+				{
+					Hostname: "tcp2.foo.com",
+					Service:  newTCPOverWSService(MustParseURL(t, "tcp://localhost:8000")),
+					Config:   defaultConfig,
+				},
+				{
+					Service: &fourOhFour,
+					Config:  defaultConfig,
+				},
+			},
+		},
+		{
+			name: "SSH services",
+			args: args{rawYAML: `
+ingress:
+- service: ssh://127.0.0.1
+`},
+			want: []Rule{
+				{
+					Service: newTCPOverWSService(MustParseURL(t, "ssh://127.0.0.1:22")),
+					Config:  defaultConfig,
+				},
+			},
+		},
+		{
+			name: "RDP services",
+			args: args{rawYAML: `
+ingress:
+- service: rdp://127.0.0.1
+`},
+			want: []Rule{
+				{
+					Service: newTCPOverWSService(MustParseURL(t, "rdp://127.0.0.1:3389")),
+					Config:  defaultConfig,
+				},
+			},
+		},
+		{
+			name: "SMB services",
+			args: args{rawYAML: `
+ingress:
+- service: smb://127.0.0.1
+`},
+			want: []Rule{
+				{
+					Service: newTCPOverWSService(MustParseURL(t, "smb://127.0.0.1:445")),
+					Config:  defaultConfig,
+				},
+			},
+		},
+		{
+			name: "Other TCP services",
+			args: args{rawYAML: `
+ingress:
+- service: ftp://127.0.0.1
+`},
+			want: []Rule{
+				{
+					Service: newTCPOverWSService(MustParseURL(t, "ftp://127.0.0.1")),
+					Config:  defaultConfig,
+				},
+			},
+		},
 		{
 			name: "URL isn't necessary if using bastion",
 			args: args{rawYAML: `
@@ -221,7 +316,7 @@ ingress:
 			want: []Rule{
 				{
 					Hostname: "bastion.foo.com",
-					Service:  &localService{},
+					Service:  newBastionService(),
 					Config:   setConfig(originRequestFromYAML(config.OriginRequestConfig{}), config.OriginRequestConfig{BastionMode: &tr}),
 				},
 				{
@@ -241,7 +336,7 @@ ingress:
 			want: []Rule{
 				{
 					Hostname: "bastion.foo.com",
-					Service:  &localService{},
+					Service:  newBastionService(),
 					Config:   setConfig(originRequestFromYAML(config.OriginRequestConfig{}), config.OriginRequestConfig{BastionMode: &tr}),
 				},
 				{
@@ -369,6 +464,7 @@ func TestFindMatchingRule(t *testing.T) {
 	tests := []struct {
 		host          string
 		path          string
+		req           *http.Request
 		wantRuleIndex int
 	}{
 		{
@@ -403,9 +499,40 @@ func TestFindMatchingRule(t *testing.T) {
 		},
 	}
 
-	for i, test := range tests {
+	for _, test := range tests {
 		_, ruleIndex := ingress.FindMatchingRule(test.host, test.path)
-		assert.Equal(t, test.wantRuleIndex, ruleIndex, fmt.Sprintf("Expect host=%s, path=%s to match rule %d, got %d", test.host, test.path, test.wantRuleIndex, i))
+		assert.Equal(t, test.wantRuleIndex, ruleIndex, fmt.Sprintf("Expect host=%s, path=%s to match rule %d, got %d", test.host, test.path, test.wantRuleIndex, ruleIndex))
+	}
+}
+
+func TestIsHTTPService(t *testing.T) {
+	tests := []struct {
+		url    *url.URL
+		isHTTP bool
+	}{
+		{
+			url:    MustParseURL(t, "http://localhost"),
+			isHTTP: true,
+		},
+		{
+			url:    MustParseURL(t, "https://127.0.0.1:8000"),
+			isHTTP: true,
+		},
+		{
+			url:    MustParseURL(t, "ws://localhost"),
+			isHTTP: true,
+		},
+		{
+			url:    MustParseURL(t, "wss://localhost:8000"),
+			isHTTP: true,
+		},
+		{
+			url:    MustParseURL(t, "tcp://localhost:9000"),
+			isHTTP: false,
+		},
+	}
+	for _, test := range tests {
+		assert.Equal(t, test.isHTTP, isHTTPService(test.url))
 	}
 }
 
@@ -436,6 +563,7 @@ ingress:
 	if err != nil {
 		b.Error(err)
 	}
+
 	for n := 0; n < b.N; n++ {
 		ing.FindMatchingRule("tunnel1.example.com", "")
 		ing.FindMatchingRule("tunnel2.example.com", "")

ingress/origin_connection.go

@@ -0,0 +1,109 @@
+package ingress
+
+import (
+	"context"
+	"crypto/tls"
+	"io"
+	"net"
+	"net/http"
+
+	"github.com/cloudflare/cloudflared/websocket"
+	gws "github.com/gorilla/websocket"
+	"github.com/rs/zerolog"
+)
+
+// OriginConnection is a way to stream to a service running on the user's origin.
+// Different concrete implementations will stream different protocols as long as they are io.ReadWriters.
+type OriginConnection interface {
+	// Stream should generally be implemented as a bidirectional io.Copy.
+	Stream(ctx context.Context, tunnelConn io.ReadWriter, log *zerolog.Logger)
+	Close()
+}
+
+type streamHandlerFunc func(originConn io.ReadWriter, remoteConn net.Conn, log *zerolog.Logger)
+
+// Stream copies copy data to & from provided io.ReadWriters.
+func Stream(conn, backendConn io.ReadWriter, log *zerolog.Logger) {
+	proxyDone := make(chan struct{}, 2)
+
+	go func() {
+		_, err := io.Copy(conn, backendConn)
+		if err != nil {
+			log.Debug().Msgf("conn to backendConn copy: %v", err)
+		}
+		proxyDone <- struct{}{}
+	}()
+
+	go func() {
+		_, err := io.Copy(backendConn, conn)
+		if err != nil {
+			log.Debug().Msgf("backendConn to conn copy: %v", err)
+		}
+		proxyDone <- struct{}{}
+	}()
+
+	// If one side is done, we are done.
+	<-proxyDone
+}
+
+// DefaultStreamHandler is an implementation of streamHandlerFunc that
+// performs a two way io.Copy between originConn and remoteConn.
+func DefaultStreamHandler(originConn io.ReadWriter, remoteConn net.Conn, log *zerolog.Logger) {
+	Stream(originConn, remoteConn, log)
+}
+
+// tcpConnection is an OriginConnection that directly streams to raw TCP.
+type tcpConnection struct {
+	conn net.Conn
+}
+
+func (tc *tcpConnection) Stream(ctx context.Context, tunnelConn io.ReadWriter, log *zerolog.Logger) {
+	Stream(tunnelConn, tc.conn, log)
+}
+
+func (tc *tcpConnection) Close() {
+	tc.conn.Close()
+}
+
+// tcpOverWSConnection is an OriginConnection that streams to TCP over WS.
+type tcpOverWSConnection struct {
+	conn          net.Conn
+	streamHandler streamHandlerFunc
+}
+
+func (wc *tcpOverWSConnection) Stream(ctx context.Context, tunnelConn io.ReadWriter, log *zerolog.Logger) {
+	wc.streamHandler(websocket.NewConn(ctx, tunnelConn, log), wc.conn, log)
+}
+
+func (wc *tcpOverWSConnection) Close() {
+	wc.conn.Close()
+}
+
+// wsConnection is an OriginConnection that streams WS between eyeball and origin.
+type wsConnection struct {
+	wsConn *gws.Conn
+	resp   *http.Response
+}
+
+func (wsc *wsConnection) Stream(ctx context.Context, tunnelConn io.ReadWriter, log *zerolog.Logger) {
+	Stream(tunnelConn, wsc.wsConn.UnderlyingConn(), log)
+}
+
+func (wsc *wsConnection) Close() {
+	wsc.resp.Body.Close()
+	wsc.wsConn.Close()
+}
+
+func newWSConnection(clientTLSConfig *tls.Config, r *http.Request) (OriginConnection, *http.Response, error) {
+	d := &gws.Dialer{
+		TLSClientConfig: clientTLSConfig,
+	}
+	wsConn, resp, err := websocket.ClientConnect(r, d)
+	if err != nil {
+		return nil, nil, err
+	}
+	return &wsConnection{
+		wsConn,
+		resp,
+	}, resp, nil
+}

ingress/origin_connection_test.go

@@ -0,0 +1,294 @@
+package ingress
+
+import (
+	"bytes"
+	"context"
+	"crypto/tls"
+	"fmt"
+	"io/ioutil"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+	"time"
+
+	"github.com/cloudflare/cloudflared/logger"
+	"github.com/cloudflare/cloudflared/socks"
+	"github.com/gobwas/ws/wsutil"
+	gorillaWS "github.com/gorilla/websocket"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/net/proxy"
+	"golang.org/x/sync/errgroup"
+)
+
+const (
+	testStreamTimeout = time.Second * 3
+	echoHeaderName    = "Test-Cloudflared-Echo"
+)
+
+var (
+	testLogger   = logger.Create(nil)
+	testMessage  = []byte("TestStreamOriginConnection")
+	testResponse = []byte(fmt.Sprintf("echo-%s", testMessage))
+)
+
+func TestStreamTCPConnection(t *testing.T) {
+	cfdConn, originConn := net.Pipe()
+	tcpConn := tcpConnection{
+		conn: cfdConn,
+	}
+
+	eyeballConn, edgeConn := net.Pipe()
+
+	ctx, cancel := context.WithTimeout(context.Background(), testStreamTimeout)
+	defer cancel()
+
+	errGroup, ctx := errgroup.WithContext(ctx)
+	errGroup.Go(func() error {
+		_, err := eyeballConn.Write(testMessage)
+
+		readBuffer := make([]byte, len(testResponse))
+		_, err = eyeballConn.Read(readBuffer)
+		require.NoError(t, err)
+
+		require.Equal(t, testResponse, readBuffer)
+
+		return nil
+	})
+	errGroup.Go(func() error {
+		echoTCPOrigin(t, originConn)
+		originConn.Close()
+		return nil
+	})
+
+	tcpConn.Stream(ctx, edgeConn, testLogger)
+	require.NoError(t, errGroup.Wait())
+}
+
+func TestDefaultStreamWSOverTCPConnection(t *testing.T) {
+	cfdConn, originConn := net.Pipe()
+	tcpOverWSConn := tcpOverWSConnection{
+		conn:          cfdConn,
+		streamHandler: DefaultStreamHandler,
+	}
+
+	eyeballConn, edgeConn := net.Pipe()
+
+	ctx, cancel := context.WithTimeout(context.Background(), testStreamTimeout)
+	defer cancel()
+
+	errGroup, ctx := errgroup.WithContext(ctx)
+	errGroup.Go(func() error {
+		echoWSEyeball(t, eyeballConn)
+		return nil
+	})
+	errGroup.Go(func() error {
+		echoTCPOrigin(t, originConn)
+		originConn.Close()
+		return nil
+	})
+
+	tcpOverWSConn.Stream(ctx, edgeConn, testLogger)
+	require.NoError(t, errGroup.Wait())
+}
+
+// TestSocksStreamWSOverTCPConnection simulates proxying in socks mode.
+// Eyeball side runs cloudflared accesss tcp with --url flag to start a websocket forwarder which
+// wraps SOCKS5 traffic in websocket
+// Origin side runs a tcpOverWSConnection with socks.StreamHandler
+func TestSocksStreamWSOverTCPConnection(t *testing.T) {
+	var (
+		sendMessage             = t.Name()
+		echoHeaderIncomingValue = fmt.Sprintf("header-%s", sendMessage)
+		echoMessage             = fmt.Sprintf("echo-%s", sendMessage)
+		echoHeaderReturnValue   = fmt.Sprintf("echo-%s", echoHeaderIncomingValue)
+	)
+
+	statusCodes := []int{
+		http.StatusOK,
+		http.StatusTemporaryRedirect,
+		http.StatusBadRequest,
+		http.StatusInternalServerError,
+	}
+	for _, status := range statusCodes {
+		handler := func(w http.ResponseWriter, r *http.Request) {
+			body, err := ioutil.ReadAll(r.Body)
+			require.NoError(t, err)
+			require.Equal(t, []byte(sendMessage), body)
+
+			require.Equal(t, echoHeaderIncomingValue, r.Header.Get(echoHeaderName))
+			w.Header().Set(echoHeaderName, echoHeaderReturnValue)
+
+			w.WriteHeader(status)
+			w.Write([]byte(echoMessage))
+		}
+		origin := httptest.NewServer(http.HandlerFunc(handler))
+		defer origin.Close()
+
+		originURL, err := url.Parse(origin.URL)
+		require.NoError(t, err)
+
+		originConn, err := net.Dial("tcp", originURL.Host)
+		require.NoError(t, err)
+
+		tcpOverWSConn := tcpOverWSConnection{
+			conn:          originConn,
+			streamHandler: socks.StreamHandler,
+		}
+
+		wsForwarderOutConn, edgeConn := net.Pipe()
+		ctx, cancel := context.WithTimeout(context.Background(), testStreamTimeout)
+		defer cancel()
+
+		errGroup, ctx := errgroup.WithContext(ctx)
+		errGroup.Go(func() error {
+			tcpOverWSConn.Stream(ctx, edgeConn, testLogger)
+			return nil
+		})
+
+		wsForwarderListener, err := net.Listen("tcp", "127.0.0.1:0")
+		require.NoError(t, err)
+
+		errGroup.Go(func() error {
+			wsForwarderInConn, err := wsForwarderListener.Accept()
+			require.NoError(t, err)
+			defer wsForwarderInConn.Close()
+
+			Stream(wsForwarderInConn, &wsEyeball{wsForwarderOutConn}, testLogger)
+			return nil
+		})
+
+		eyeballDialer, err := proxy.SOCKS5("tcp", wsForwarderListener.Addr().String(), nil, proxy.Direct)
+		require.NoError(t, err)
+
+		transport := &http.Transport{
+			Dial: eyeballDialer.Dial,
+		}
+
+		// Request URL doesn't matter because the transport is using eyeballDialer to connectq
+		req, err := http.NewRequestWithContext(ctx, "GET", "http://test-socks-stream.com", bytes.NewBuffer([]byte(sendMessage)))
+		assert.NoError(t, err)
+		req.Header.Set(echoHeaderName, echoHeaderIncomingValue)
+
+		resp, err := transport.RoundTrip(req)
+		assert.NoError(t, err)
+		assert.Equal(t, status, resp.StatusCode)
+		require.Equal(t, echoHeaderReturnValue, resp.Header.Get(echoHeaderName))
+		body, err := ioutil.ReadAll(resp.Body)
+		require.NoError(t, err)
+		require.Equal(t, []byte(echoMessage), body)
+
+		wsForwarderOutConn.Close()
+		edgeConn.Close()
+		tcpOverWSConn.Close()
+
+		require.NoError(t, errGroup.Wait())
+	}
+}
+
+func TestStreamWSConnection(t *testing.T) {
+	eyeballConn, edgeConn := net.Pipe()
+
+	origin := echoWSOrigin(t)
+	defer origin.Close()
+
+	req, err := http.NewRequest(http.MethodGet, origin.URL, nil)
+	require.NoError(t, err)
+	req.Header.Set("Sec-Websocket-Key", "dGhlIHNhbXBsZSBub25jZQ==")
+
+	clientTLSConfig := &tls.Config{
+		InsecureSkipVerify: true,
+	}
+	wsConn, resp, err := newWSConnection(clientTLSConfig, req)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusSwitchingProtocols, resp.StatusCode)
+	require.Equal(t, "Upgrade", resp.Header.Get("Connection"))
+	require.Equal(t, "s3pPLMBiTxaQ9kYGzzhZRbK+xOo=", resp.Header.Get("Sec-Websocket-Accept"))
+	require.Equal(t, "websocket", resp.Header.Get("Upgrade"))
+
+	ctx, cancel := context.WithTimeout(context.Background(), testStreamTimeout)
+	defer cancel()
+
+	errGroup, ctx := errgroup.WithContext(ctx)
+	errGroup.Go(func() error {
+		echoWSEyeball(t, eyeballConn)
+		return nil
+	})
+
+	wsConn.Stream(ctx, edgeConn, testLogger)
+	require.NoError(t, errGroup.Wait())
+}
+
+type wsEyeball struct {
+	conn net.Conn
+}
+
+func (wse *wsEyeball) Read(p []byte) (int, error) {
+	data, err := wsutil.ReadServerBinary(wse.conn)
+	if err != nil {
+		return 0, err
+	}
+	return copy(p, data), nil
+}
+
+func (wse *wsEyeball) Write(p []byte) (int, error) {
+	err := wsutil.WriteClientBinary(wse.conn, p)
+	return len(p), err
+}
+
+func echoWSEyeball(t *testing.T, conn net.Conn) {
+	require.NoError(t, wsutil.WriteClientBinary(conn, testMessage))
+
+	readMsg, err := wsutil.ReadServerBinary(conn)
+	require.NoError(t, err)
+
+	require.Equal(t, testResponse, readMsg)
+
+	require.NoError(t, conn.Close())
+}
+
+func echoWSOrigin(t *testing.T) *httptest.Server {
+	var upgrader = gorillaWS.Upgrader{
+		ReadBufferSize:  10,
+		WriteBufferSize: 10,
+	}
+
+	ws := func(w http.ResponseWriter, r *http.Request) {
+		header := make(http.Header)
+		for k, vs := range r.Header {
+			if k == "Test-Cloudflared-Echo" {
+				header[k] = vs
+			}
+		}
+		conn, err := upgrader.Upgrade(w, r, header)
+		require.NoError(t, err)
+		defer conn.Close()
+
+		for {
+			messageType, p, err := conn.ReadMessage()
+			if err != nil {
+				return
+			}
+			require.Equal(t, testMessage, p)
+			if err := conn.WriteMessage(messageType, testResponse); err != nil {
+				return
+			}
+		}
+	}
+
+	// NewTLSServer starts the server in another thread
+	return httptest.NewTLSServer(http.HandlerFunc(ws))
+}
+
+func echoTCPOrigin(t *testing.T, conn net.Conn) {
+	readBuffer := make([]byte, len(testMessage))
+	_, err := conn.Read(readBuffer)
+	assert.NoError(t, err)
+
+	assert.Equal(t, testMessage, readBuffer)
+
+	_, err = conn.Write(testResponse)
+	assert.NoError(t, err)
+}

ingress/origin_proxy.go

@@ -0,0 +1,147 @@
+package ingress
+
+import (
+	"fmt"
+	"net"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"github.com/cloudflare/cloudflared/h2mux"
+	"github.com/cloudflare/cloudflared/websocket"
+	"github.com/pkg/errors"
+)
+
+var (
+	switchingProtocolText = fmt.Sprintf("%d %s", http.StatusSwitchingProtocols, http.StatusText(http.StatusSwitchingProtocols))
+)
+
+// HTTPOriginProxy can be implemented by origin services that want to proxy http requests.
+type HTTPOriginProxy interface {
+	// RoundTrip is how cloudflared proxies eyeball requests to the actual origin services
+	http.RoundTripper
+}
+
+// StreamBasedOriginProxy can be implemented by origin services that want to proxy ws/TCP.
+type StreamBasedOriginProxy interface {
+	EstablishConnection(r *http.Request) (OriginConnection, *http.Response, error)
+}
+
+func (o *unixSocketPath) RoundTrip(req *http.Request) (*http.Response, error) {
+	return o.transport.RoundTrip(req)
+}
+
+func (o *httpService) RoundTrip(req *http.Request) (*http.Response, error) {
+	// Rewrite the request URL so that it goes to the origin service.
+	req.URL.Host = o.url.Host
+	req.URL.Scheme = o.url.Scheme
+	if o.hostHeader != "" {
+		// For incoming requests, the Host header is promoted to the Request.Host field and removed from the Header map.
+		req.Host = o.hostHeader
+	}
+	return o.transport.RoundTrip(req)
+}
+
+func (o *httpService) EstablishConnection(req *http.Request) (OriginConnection, *http.Response, error) {
+	req.URL.Host = o.url.Host
+	req.URL.Scheme = websocket.ChangeRequestScheme(o.url)
+	if o.hostHeader != "" {
+		// For incoming requests, the Host header is promoted to the Request.Host field and removed from the Header map.
+		req.Host = o.hostHeader
+	}
+	return newWSConnection(o.transport.TLSClientConfig, req)
+}
+
+func (o *helloWorld) RoundTrip(req *http.Request) (*http.Response, error) {
+	// Rewrite the request URL so that it goes to the Hello World server.
+	req.URL.Host = o.server.Addr().String()
+	req.URL.Scheme = "https"
+	return o.transport.RoundTrip(req)
+}
+
+func (o *helloWorld) EstablishConnection(req *http.Request) (OriginConnection, *http.Response, error) {
+	req.URL.Host = o.server.Addr().String()
+	req.URL.Scheme = "wss"
+	return newWSConnection(o.transport.TLSClientConfig, req)
+}
+
+func (o *statusCode) RoundTrip(_ *http.Request) (*http.Response, error) {
+	return o.resp, nil
+}
+
+func (o *rawTCPService) EstablishConnection(r *http.Request) (OriginConnection, *http.Response, error) {
+	dest, err := getRequestHost(r)
+	if err != nil {
+		return nil, nil, err
+	}
+	conn, err := net.Dial("tcp", dest)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	originConn := &tcpConnection{
+		conn: conn,
+	}
+	resp := &http.Response{
+		Status:        switchingProtocolText,
+		StatusCode:    http.StatusSwitchingProtocols,
+		ContentLength: -1,
+	}
+	return originConn, resp, nil
+}
+
+// getRequestHost returns the host of the http.Request.
+func getRequestHost(r *http.Request) (string, error) {
+	if r.Host != "" {
+		return r.Host, nil
+	}
+	if r.URL != nil {
+		return r.URL.Host, nil
+	}
+	return "", errors.New("host not found")
+}
+
+func (o *tcpOverWSService) EstablishConnection(r *http.Request) (OriginConnection, *http.Response, error) {
+	var err error
+	dest := o.dest
+	if o.isBastion {
+		dest, err = o.bastionDest(r)
+		if err != nil {
+			return nil, nil, err
+		}
+	}
+
+	conn, err := net.Dial("tcp", dest)
+	if err != nil {
+		return nil, nil, err
+	}
+	originConn := &tcpOverWSConnection{
+		conn:          conn,
+		streamHandler: o.streamHandler,
+	}
+	resp := &http.Response{
+		Status:        switchingProtocolText,
+		StatusCode:    http.StatusSwitchingProtocols,
+		Header:        websocket.NewResponseHeader(r),
+		ContentLength: -1,
+	}
+	return originConn, resp, nil
+
+}
+
+func (o *tcpOverWSService) bastionDest(r *http.Request) (string, error) {
+	jumpDestination := r.Header.Get(h2mux.CFJumpDestinationHeader)
+	if jumpDestination == "" {
+		return "", fmt.Errorf("Did not receive final destination from client. The --destination flag is likely not set on the client side")
+	}
+	// Strip scheme and path set by client. Without a scheme
+	// Parsing a hostname and path without scheme might not return an error due to parsing ambiguities
+	if jumpURL, err := url.Parse(jumpDestination); err == nil && jumpURL.Host != "" {
+		return removePath(jumpURL.Host), nil
+	}
+	return removePath(jumpDestination), nil
+}
+
+func removePath(dest string) string {
+	return strings.SplitN(dest, "/", 2)[0]
+}

ingress/origin_proxy_test.go

@@ -0,0 +1,330 @@
+package ingress
+
+import (
+	"context"
+	"crypto/tls"
+	"fmt"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"sync"
+	"testing"
+
+	"github.com/cloudflare/cloudflared/h2mux"
+	"github.com/cloudflare/cloudflared/websocket"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestEstablishConnectionResponse ensures each implementation of StreamBasedOriginProxy returns
+// the expected response
+func assertEstablishConnectionResponse(t *testing.T,
+	originProxy StreamBasedOriginProxy,
+	req *http.Request,
+	expectHeader http.Header,
+) {
+	_, resp, err := originProxy.EstablishConnection(req)
+	assert.NoError(t, err)
+	assert.Equal(t, switchingProtocolText, resp.Status)
+	assert.Equal(t, http.StatusSwitchingProtocols, resp.StatusCode)
+	assert.Equal(t, expectHeader, resp.Header)
+}
+
+func TestHTTPServiceEstablishConnection(t *testing.T) {
+	origin := echoWSOrigin(t)
+	defer origin.Close()
+	originURL, err := url.Parse(origin.URL)
+	require.NoError(t, err)
+
+	httpService := &httpService{
+		url:        originURL,
+		hostHeader: origin.URL,
+		transport: &http.Transport{
+			TLSClientConfig: &tls.Config{
+				InsecureSkipVerify: true,
+			},
+		},
+	}
+	req, err := http.NewRequest(http.MethodGet, origin.URL, nil)
+	require.NoError(t, err)
+	req.Header.Set("Sec-Websocket-Key", "dGhlIHNhbXBsZSBub25jZQ==")
+	req.Header.Set("Test-Cloudflared-Echo", t.Name())
+
+	expectHeader := http.Header{
+		"Connection":            {"Upgrade"},
+		"Sec-Websocket-Accept":  {"s3pPLMBiTxaQ9kYGzzhZRbK+xOo="},
+		"Upgrade":               {"websocket"},
+		"Test-Cloudflared-Echo": {t.Name()},
+	}
+	assertEstablishConnectionResponse(t, httpService, req, expectHeader)
+}
+
+func TestHelloWorldEstablishConnection(t *testing.T) {
+	var wg sync.WaitGroup
+	shutdownC := make(chan struct{})
+	errC := make(chan error)
+	helloWorldSerivce := &helloWorld{}
+	helloWorldSerivce.start(&wg, testLogger, shutdownC, errC, OriginRequestConfig{})
+
+	// Scheme and Host of URL will be override by the Scheme and Host of the helloWorld service
+	req, err := http.NewRequest(http.MethodGet, "https://place-holder/ws", nil)
+	require.NoError(t, err)
+
+	expectHeader := http.Header{
+		"Connection": {"Upgrade"},
+		// Accept key when Sec-Websocket-Key is not specified
+		"Sec-Websocket-Accept": {"Kfh9QIsMVZcl6xEPYxPHzW8SZ8w="},
+		"Upgrade":              {"websocket"},
+	}
+	assertEstablishConnectionResponse(t, helloWorldSerivce, req, expectHeader)
+
+	close(shutdownC)
+}
+
+func TestRawTCPServiceEstablishConnection(t *testing.T) {
+	originListener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+
+	listenerClosed := make(chan struct{})
+	tcpListenRoutine(originListener, listenerClosed)
+
+	rawTCPService := &rawTCPService{name: ServiceWarpRouting}
+
+	req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("http://%s", originListener.Addr()), nil)
+	require.NoError(t, err)
+
+	assertEstablishConnectionResponse(t, rawTCPService, req, nil)
+
+	originListener.Close()
+	<-listenerClosed
+
+	req, err = http.NewRequest(http.MethodGet, fmt.Sprintf("http://%s", originListener.Addr()), nil)
+	require.NoError(t, err)
+
+	// Origin not listening for new connection, should return an error
+	_, resp, err := rawTCPService.EstablishConnection(req)
+	require.Error(t, err)
+	require.Nil(t, resp)
+}
+
+func TestTCPOverWSServiceEstablishConnection(t *testing.T) {
+	originListener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+
+	listenerClosed := make(chan struct{})
+	tcpListenRoutine(originListener, listenerClosed)
+
+	originURL := &url.URL{
+		Scheme: "tcp",
+		Host:   originListener.Addr().String(),
+	}
+
+	baseReq, err := http.NewRequest(http.MethodGet, "https://place-holder", nil)
+	require.NoError(t, err)
+	baseReq.Header.Set("Sec-Websocket-Key", "dGhlIHNhbXBsZSBub25jZQ==")
+
+	bastionReq := baseReq.Clone(context.Background())
+	bastionReq.Header.Set(h2mux.CFJumpDestinationHeader, originListener.Addr().String())
+
+	expectHeader := http.Header{
+		"Connection":           {"Upgrade"},
+		"Sec-Websocket-Accept": {"s3pPLMBiTxaQ9kYGzzhZRbK+xOo="},
+		"Upgrade":              {"websocket"},
+	}
+
+	tests := []struct {
+		service   *tcpOverWSService
+		req       *http.Request
+		expectErr bool
+	}{
+		{
+			service: newTCPOverWSService(originURL),
+			req:     baseReq,
+		},
+		{
+			service: newBastionService(),
+			req:     bastionReq,
+		},
+		{
+			service:   newBastionService(),
+			req:       baseReq,
+			expectErr: true,
+		},
+	}
+
+	for _, test := range tests {
+		if test.expectErr {
+			_, resp, err := test.service.EstablishConnection(test.req)
+			assert.Error(t, err)
+			assert.Nil(t, resp)
+		} else {
+			assertEstablishConnectionResponse(t, test.service, test.req, expectHeader)
+		}
+	}
+
+	originListener.Close()
+	<-listenerClosed
+
+	for _, service := range []*tcpOverWSService{newTCPOverWSService(originURL), newBastionService()} {
+		// Origin not listening for new connection, should return an error
+		_, resp, err := service.EstablishConnection(bastionReq)
+		assert.Error(t, err)
+		assert.Nil(t, resp)
+	}
+}
+
+func TestBastionDestination(t *testing.T) {
+	canonicalJumpDestHeader := http.CanonicalHeaderKey(h2mux.CFJumpDestinationHeader)
+	tests := []struct {
+		name         string
+		header       http.Header
+		expectedDest string
+		wantErr      bool
+	}{
+		{
+			name: "hostname destination",
+			header: http.Header{
+				canonicalJumpDestHeader: []string{"localhost"},
+			},
+			expectedDest: "localhost",
+		},
+		{
+			name: "hostname destination with port",
+			header: http.Header{
+				canonicalJumpDestHeader: []string{"localhost:9000"},
+			},
+			expectedDest: "localhost:9000",
+		},
+		{
+			name: "hostname destination with scheme and port",
+			header: http.Header{
+				canonicalJumpDestHeader: []string{"ssh://localhost:9000"},
+			},
+			expectedDest: "localhost:9000",
+		},
+		{
+			name: "full hostname url",
+			header: http.Header{
+				canonicalJumpDestHeader: []string{"ssh://localhost:9000/metrics"},
+			},
+			expectedDest: "localhost:9000",
+		},
+		{
+			name: "hostname destination with port and path",
+			header: http.Header{
+				canonicalJumpDestHeader: []string{"localhost:9000/metrics"},
+			},
+			expectedDest: "localhost:9000",
+		},
+		{
+			name: "ip destination",
+			header: http.Header{
+				canonicalJumpDestHeader: []string{"127.0.0.1"},
+			},
+			expectedDest: "127.0.0.1",
+		},
+		{
+			name: "ip destination with port",
+			header: http.Header{
+				canonicalJumpDestHeader: []string{"127.0.0.1:9000"},
+			},
+			expectedDest: "127.0.0.1:9000",
+		},
+		{
+			name: "ip destination with port and path",
+			header: http.Header{
+				canonicalJumpDestHeader: []string{"127.0.0.1:9000/metrics"},
+			},
+			expectedDest: "127.0.0.1:9000",
+		},
+		{
+			name: "ip destination with schem and port",
+			header: http.Header{
+				canonicalJumpDestHeader: []string{"tcp://127.0.0.1:9000"},
+			},
+			expectedDest: "127.0.0.1:9000",
+		},
+		{
+			name: "full ip url",
+			header: http.Header{
+				canonicalJumpDestHeader: []string{"ssh://127.0.0.1:9000/metrics"},
+			},
+			expectedDest: "127.0.0.1:9000",
+		},
+		{
+			name:    "no destination",
+			wantErr: true,
+		},
+	}
+	s := newBastionService()
+	for _, test := range tests {
+		r := &http.Request{
+			Header: test.header,
+		}
+		dest, err := s.bastionDest(r)
+		if test.wantErr {
+			assert.Error(t, err, "Test %s expects error", test.name)
+		} else {
+			assert.NoError(t, err, "Test %s expects no error, got error %v", test.name, err)
+			assert.Equal(t, test.expectedDest, dest, "Test %s expect dest %s, got %s", test.name, test.expectedDest, dest)
+		}
+	}
+}
+
+func TestHTTPServiceHostHeaderOverride(t *testing.T) {
+	cfg := OriginRequestConfig{
+		HTTPHostHeader: t.Name(),
+	}
+	handler := func(w http.ResponseWriter, r *http.Request) {
+		require.Equal(t, r.Host, t.Name())
+		if websocket.IsWebSocketUpgrade(r) {
+			respHeaders := websocket.NewResponseHeader(r)
+			for k, v := range respHeaders {
+				w.Header().Set(k, v[0])
+			}
+			w.WriteHeader(http.StatusSwitchingProtocols)
+			return
+		}
+		w.Write([]byte("ok"))
+	}
+	origin := httptest.NewServer(http.HandlerFunc(handler))
+	defer origin.Close()
+
+	originURL, err := url.Parse(origin.URL)
+	require.NoError(t, err)
+
+	httpService := &httpService{
+		url: originURL,
+	}
+	var wg sync.WaitGroup
+	shutdownC := make(chan struct{})
+	errC := make(chan error)
+	require.NoError(t, httpService.start(&wg, testLogger, shutdownC, errC, cfg))
+
+	req, err := http.NewRequest(http.MethodGet, originURL.String(), nil)
+	require.NoError(t, err)
+
+	resp, err := httpService.RoundTrip(req)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+
+	req = req.Clone(context.Background())
+	_, resp, err = httpService.EstablishConnection(req)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusSwitchingProtocols, resp.StatusCode)
+}
+
+func tcpListenRoutine(listener net.Listener, closeChan chan struct{}) {
+	go func() {
+		for {
+			conn, err := listener.Accept()
+			if err != nil {
+				close(closeChan)
+				return
+			}
+			// Close immediately, this test is not about testing read/write on connection
+			conn.Close()
+		}
+	}()
+}

ingress/origin_service.go

@@ -8,7 +8,6 @@ import (
 	"net"
 	"net/http"
 	"net/url"
-	"strconv"
 	"sync"
 	"time"
 
@@ -21,10 +20,8 @@ import (
 	"github.com/rs/zerolog"
 )
 
-// OriginService is something a tunnel can proxy traffic to.
-type OriginService interface {
-	// RoundTrip is how cloudflared proxies eyeball requests to the actual origin services
-	http.RoundTripper
+// originService is something a tunnel can proxy traffic to.
+type originService interface {
 	String() string
 	// Start the origin service if it's managed by cloudflared, e.g. proxy servers or Hello World.
 	// If it's not managed by cloudflared, this is a no-op because the user is responsible for
@@ -51,10 +48,6 @@ func (o *unixSocketPath) start(wg *sync.WaitGroup, log *zerolog.Logger, shutdown
 	return nil
 }
 
-func (o *unixSocketPath) RoundTrip(req *http.Request) (*http.Response, error) {
-	return o.transport.RoundTrip(req)
-}
-
 func (o *unixSocketPath) Dial(reqURL *url.URL, headers http.Header) (*gws.Conn, *http.Response, error) {
 	d := &gws.Dialer{
 		NetDial:         o.transport.Dial,
@@ -65,130 +58,90 @@ func (o *unixSocketPath) Dial(reqURL *url.URL, headers http.Header) (*gws.Conn,
 	return d.Dial(reqURL.String(), headers)
 }
 
-// localService is an OriginService listening on a TCP/IP address the user's origin can route to.
-type localService struct {
-	// The URL for the user's origin service
-	RootURL *url.URL
-	// The URL that cloudflared should send requests to.
-	// If this origin requires starting a proxy, this is the proxy's address,
-	// and that proxy points to RootURL. Otherwise, this is equal to RootURL.
-	URL       *url.URL
-	transport *http.Transport
+type httpService struct {
+	url        *url.URL
+	hostHeader string
+	transport  *http.Transport
 }
 
-func (o *localService) Dial(reqURL *url.URL, headers http.Header) (*gws.Conn, *http.Response, error) {
-	d := &gws.Dialer{TLSClientConfig: o.transport.TLSClientConfig}
-	// Rewrite the request URL so that it goes to the origin service.
-	reqURL.Host = o.URL.Host
-	reqURL.Scheme = websocket.ChangeRequestScheme(o.URL)
-	return d.Dial(reqURL.String(), headers)
-}
-
-func (o *localService) start(wg *sync.WaitGroup, log *zerolog.Logger, shutdownC <-chan struct{}, errC chan error, cfg OriginRequestConfig) error {
+func (o *httpService) start(wg *sync.WaitGroup, log *zerolog.Logger, shutdownC <-chan struct{}, errC chan error, cfg OriginRequestConfig) error {
 	transport, err := newHTTPTransport(o, cfg, log)
 	if err != nil {
 		return err
 	}
+	o.hostHeader = cfg.HTTPHostHeader
 	o.transport = transport
-
-	// Start a proxy if one is needed
-	if staticHost := o.staticHost(); originRequiresProxy(staticHost, cfg) {
-		if err := o.startProxy(staticHost, wg, log, shutdownC, errC, cfg); err != nil {
-			return err
-		}
-	}
-
 	return nil
 }
 
-func (o *localService) startProxy(staticHost string, wg *sync.WaitGroup, log *zerolog.Logger, shutdownC <-chan struct{}, errC chan error, cfg OriginRequestConfig) error {
+func (o *httpService) String() string {
+	return o.url.String()
+}
 
-	// Start a listener for the proxy
-	proxyAddress := net.JoinHostPort(cfg.ProxyAddress, strconv.Itoa(int(cfg.ProxyPort)))
-	listener, err := net.Listen("tcp", proxyAddress)
-	if err != nil {
-		log.Error().Msgf("Cannot start Websocket Proxy Server: %s", err)
-		return errors.Wrap(err, "Cannot start Websocket Proxy Server")
-	}
+// rawTCPService dials TCP to the destination specified by the client
+// It's used by warp routing
+type rawTCPService struct {
+	name string
+}
 
-	// Start the proxy itself
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		streamHandler := websocket.DefaultStreamHandler
-		// This origin's config specifies what type of proxy to start.
-		switch cfg.ProxyType {
-		case socksProxy:
-			log.Info().Msg("SOCKS5 server started")
-			streamHandler = func(wsConn *websocket.Conn, remoteConn net.Conn, _ http.Header) {
-				dialer := socks.NewConnDialer(remoteConn)
-				requestHandler := socks.NewRequestHandler(dialer)
-				socksServer := socks.NewConnectionHandler(requestHandler)
+func (o *rawTCPService) String() string {
+	return o.name
+}
 
-				_ = socksServer.Serve(wsConn)
-			}
-		case "":
-			log.Debug().Msg("Not starting any websocket proxy")
-		default:
-			log.Error().Msgf("%s isn't a valid proxy (valid options are {%s})", cfg.ProxyType, socksProxy)
-		}
-
-		errC <- websocket.StartProxyServer(log, listener, staticHost, shutdownC, streamHandler)
-	}()
-
-	// Modify this origin, so that it no longer points at the origin service directly.
-	// Instead, it points at the proxy to the origin service.
-	newURL, err := url.Parse("http://" + listener.Addr().String())
-	if err != nil {
-		return err
-	}
-	o.URL = newURL
+func (o *rawTCPService) start(wg *sync.WaitGroup, log *zerolog.Logger, shutdownC <-chan struct{}, errC chan error, cfg OriginRequestConfig) error {
 	return nil
 }
 
-func (o *localService) String() string {
-	if o.isBastion() {
-		return "Bastion"
-	}
-	return o.URL.String()
+// tcpOverWSService models TCP origins serving eyeballs connecting over websocket, such as
+// cloudflared access commands.
+type tcpOverWSService struct {
+	dest          string
+	isBastion     bool
+	streamHandler streamHandlerFunc
 }
 
-func (o *localService) isBastion() bool {
-	return o.URL == nil
-}
-
-func (o *localService) RoundTrip(req *http.Request) (*http.Response, error) {
-	// Rewrite the request URL so that it goes to the origin service.
-	req.URL.Host = o.URL.Host
-	req.URL.Scheme = o.URL.Scheme
-	return o.transport.RoundTrip(req)
-}
-
-func (o *localService) staticHost() string {
-
-	if o.URL == nil {
-		return ""
-	}
-
-	addPortIfMissing := func(uri *url.URL, port int) string {
-		if uri.Port() != "" {
-			return uri.Host
-		}
-		return fmt.Sprintf("%s:%d", uri.Hostname(), port)
-	}
-
-	switch o.URL.Scheme {
+func newTCPOverWSService(url *url.URL) *tcpOverWSService {
+	switch url.Scheme {
 	case "ssh":
-		return addPortIfMissing(o.URL, 22)
+		addPortIfMissing(url, 22)
 	case "rdp":
-		return addPortIfMissing(o.URL, 3389)
+		addPortIfMissing(url, 3389)
 	case "smb":
-		return addPortIfMissing(o.URL, 445)
+		addPortIfMissing(url, 445)
 	case "tcp":
-		return addPortIfMissing(o.URL, 7864) // just a random port since there isn't a default in this case
+		addPortIfMissing(url, 7864) // just a random port since there isn't a default in this case
 	}
-	return ""
+	return &tcpOverWSService{
+		dest: url.Host,
+	}
+}
 
+func newBastionService() *tcpOverWSService {
+	return &tcpOverWSService{
+		isBastion: true,
+	}
+}
+
+func addPortIfMissing(uri *url.URL, port int) {
+	if uri.Port() == "" {
+		uri.Host = fmt.Sprintf("%s:%d", uri.Hostname(), port)
+	}
+}
+
+func (o *tcpOverWSService) String() string {
+	if o.isBastion {
+		return ServiceBastion
+	}
+	return o.dest
+}
+
+func (o *tcpOverWSService) start(wg *sync.WaitGroup, log *zerolog.Logger, shutdownC <-chan struct{}, errC chan error, cfg OriginRequestConfig) error {
+	if cfg.ProxyType == socksProxy {
+		o.streamHandler = socks.StreamHandler
+	} else {
+		o.streamHandler = DefaultStreamHandler
+	}
+	return nil
 }
 
 // HelloWorld is an OriginService for the built-in Hello World server.
@@ -228,26 +181,6 @@ func (o *helloWorld) start(
 	return nil
 }
 
-func (o *helloWorld) RoundTrip(req *http.Request) (*http.Response, error) {
-	// Rewrite the request URL so that it goes to the Hello World server.
-	req.URL.Host = o.server.Addr().String()
-	req.URL.Scheme = "https"
-	return o.transport.RoundTrip(req)
-}
-
-func (o *helloWorld) Dial(reqURL *url.URL, headers http.Header) (*gws.Conn, *http.Response, error) {
-	d := &gws.Dialer{
-		TLSClientConfig: o.transport.TLSClientConfig,
-	}
-	reqURL.Host = o.server.Addr().String()
-	reqURL.Scheme = "wss"
-	return d.Dial(reqURL.String(), headers)
-}
-
-func originRequiresProxy(staticHost string, cfg OriginRequestConfig) bool {
-	return staticHost != "" || cfg.BastionMode
-}
-
 // statusCode is an OriginService that just responds with a given HTTP status.
 // Typical use-case is "user wants the catch-all rule to just respond 404".
 type statusCode struct {
@@ -277,10 +210,6 @@ func (o *statusCode) start(
 	return nil
 }
 
-func (o *statusCode) RoundTrip(_ *http.Request) (*http.Response, error) {
-	return o.resp, nil
-}
-
 type NopReadCloser struct{}
 
 // Read always returns EOF to signal end of input
@@ -292,7 +221,7 @@ func (nrc *NopReadCloser) Close() error {
 	return nil
 }
 
-func newHTTPTransport(service OriginService, cfg OriginRequestConfig, log *zerolog.Logger) (*http.Transport, error) {
+func newHTTPTransport(service originService, cfg OriginRequestConfig, log *zerolog.Logger) (*http.Transport, error) {
 	originCertPool, err := tlsconfig.LoadOriginCA(cfg.CAPool, log)
 	if err != nil {
 		return nil, errors.Wrap(err, "Error loading cert pool")
@@ -337,19 +266,19 @@ func newHTTPTransport(service OriginService, cfg OriginRequestConfig, log *zerol
 	return &httpTransport, nil
 }
 
-// MockOriginService should only be used by other packages to mock OriginService. Set Transport to configure desired RoundTripper behavior.
-type MockOriginService struct {
+// MockOriginHTTPService should only be used by other packages to mock OriginService. Set Transport to configure desired RoundTripper behavior.
+type MockOriginHTTPService struct {
 	Transport http.RoundTripper
 }
 
-func (mos MockOriginService) RoundTrip(req *http.Request) (*http.Response, error) {
+func (mos MockOriginHTTPService) RoundTrip(req *http.Request) (*http.Response, error) {
 	return mos.Transport.RoundTrip(req)
 }
 
-func (mos MockOriginService) String() string {
+func (mos MockOriginHTTPService) String() string {
 	return "MockOriginService"
 }
 
-func (mos MockOriginService) start(wg *sync.WaitGroup, log *zerolog.Logger, shutdownC <-chan struct{}, errC chan error, cfg OriginRequestConfig) error {
+func (mos MockOriginHTTPService) start(wg *sync.WaitGroup, log *zerolog.Logger, shutdownC <-chan struct{}, errC chan error, cfg OriginRequestConfig) error {
 	return nil
 }

ingress/rule.go

@@ -17,7 +17,7 @@ type Rule struct {
 	// A (probably local) address. Requests for a hostname which matches this
 	// rule's hostname pattern will be proxied to the service running on this
 	// address.
-	Service OriginService
+	Service originService
 
 	// Configure the request cloudflared sends to this specific origin.
 	Config OriginRequestConfig

ingress/rule_test.go

@@ -14,7 +14,7 @@ func Test_rule_matches(t *testing.T) {
 	type fields struct {
 		Hostname string
 		Path     *regexp.Regexp
-		Service  OriginService
+		Service  originService
 	}
 	type args struct {
 		requestURL *url.URL

origin/backoffhandler.go

@@ -2,6 +2,7 @@ package origin
 
 import (
 	"context"
+	"math/rand"
 	"time"
 )
 
@@ -30,7 +31,7 @@ type BackoffHandler struct {
 	resetDeadline time.Time
 }
 
-func (b BackoffHandler) GetBackoffDuration(ctx context.Context) (time.Duration, bool) {
+func (b BackoffHandler) GetMaxBackoffDuration(ctx context.Context) (time.Duration, bool) {
 	// Follows the same logic as Backoff, but without mutating the receiver.
 	// This select has to happen first to reflect the actual behaviour of the Backoff function.
 	select {
@@ -45,7 +46,8 @@ func (b BackoffHandler) GetBackoffDuration(ctx context.Context) (time.Duration,
 	if b.retries >= b.MaxRetries && !b.RetryForever {
 		return time.Duration(0), false
 	}
-	return time.Duration(b.GetBaseTime() * 1 << b.retries), true
+	maxTimeToWait := b.GetBaseTime() * 1 << (b.retries + 1)
+	return maxTimeToWait, true
 }
 
 // BackoffTimer returns a channel that sends the current time when the exponential backoff timeout expires.
@@ -62,7 +64,9 @@ func (b *BackoffHandler) BackoffTimer() <-chan time.Time {
 	} else {
 		b.retries++
 	}
-	return timeAfter(time.Duration(b.GetBaseTime() * 1 << (b.retries - 1)))
+	maxTimeToWait := time.Duration(b.GetBaseTime() * 1 << (b.retries))
+	timeToWait := time.Duration(rand.Int63n(maxTimeToWait.Nanoseconds()))
+	return timeAfter(timeToWait)
 }
 
 // Backoff is used to wait according to exponential backoff. Returns false if the
@@ -83,7 +87,9 @@ func (b *BackoffHandler) Backoff(ctx context.Context) bool {
 // Sets a grace period within which the the backoff timer is maintained. After the grace
 // period expires, the number of retries & backoff duration is reset.
 func (b *BackoffHandler) SetGracePeriod() {
-	b.resetDeadline = timeNow().Add(time.Duration(b.GetBaseTime() * 2 << b.retries))
+	maxTimeToWait := b.GetBaseTime() * 2 << (b.retries + 1)
+	timeToWait := time.Duration(rand.Int63n(maxTimeToWait.Nanoseconds()))
+	b.resetDeadline = timeNow().Add(timeToWait)
 }
 
 func (b BackoffHandler) GetBaseTime() time.Duration {

origin/backoffhandler_test.go

@@ -40,7 +40,7 @@ func TestBackoffCancel(t *testing.T) {
 	if backoff.Backoff(ctx) {
 		t.Fatalf("backoff allowed after cancel")
 	}
-	if _, ok := backoff.GetBackoffDuration(ctx); ok {
+	if _, ok := backoff.GetMaxBackoffDuration(ctx); ok {
 		t.Fatalf("backoff allowed after cancel")
 	}
 }
@@ -69,24 +69,24 @@ func TestBackoffGracePeriod(t *testing.T) {
 	}
 }
 
-func TestGetBackoffDurationRetries(t *testing.T) {
+func TestGetMaxBackoffDurationRetries(t *testing.T) {
 	// make backoff return immediately
 	timeAfter = immediateTimeAfter
 	ctx := context.Background()
 	backoff := BackoffHandler{MaxRetries: 3}
-	if _, ok := backoff.GetBackoffDuration(ctx); !ok {
+	if _, ok := backoff.GetMaxBackoffDuration(ctx); !ok {
 		t.Fatalf("backoff failed immediately")
 	}
 	backoff.Backoff(ctx) // noop
-	if _, ok := backoff.GetBackoffDuration(ctx); !ok {
+	if _, ok := backoff.GetMaxBackoffDuration(ctx); !ok {
 		t.Fatalf("backoff failed after 1 retry")
 	}
 	backoff.Backoff(ctx) // noop
-	if _, ok := backoff.GetBackoffDuration(ctx); !ok {
+	if _, ok := backoff.GetMaxBackoffDuration(ctx); !ok {
 		t.Fatalf("backoff failed after 2 retry")
 	}
 	backoff.Backoff(ctx) // noop
-	if _, ok := backoff.GetBackoffDuration(ctx); ok {
+	if _, ok := backoff.GetMaxBackoffDuration(ctx); ok {
 		t.Fatalf("backoff allowed after 3 (max) retries")
 	}
 	if backoff.Backoff(ctx) {
@@ -94,25 +94,25 @@ func TestGetBackoffDurationRetries(t *testing.T) {
 	}
 }
 
-func TestGetBackoffDuration(t *testing.T) {
+func TestGetMaxBackoffDuration(t *testing.T) {
 	// make backoff return immediately
 	timeAfter = immediateTimeAfter
 	ctx := context.Background()
 	backoff := BackoffHandler{MaxRetries: 3}
-	if duration, ok := backoff.GetBackoffDuration(ctx); !ok || duration != time.Second {
-		t.Fatalf("backoff didn't return 1 second on first retry")
+	if duration, ok := backoff.GetMaxBackoffDuration(ctx); !ok || duration > time.Second*2 {
+		t.Fatalf("backoff (%s) didn't return < 2 seconds on first retry", duration)
 	}
 	backoff.Backoff(ctx) // noop
-	if duration, ok := backoff.GetBackoffDuration(ctx); !ok || duration != time.Second*2 {
-		t.Fatalf("backoff didn't return 2 seconds on second retry")
+	if duration, ok := backoff.GetMaxBackoffDuration(ctx); !ok || duration > time.Second*4 {
+		t.Fatalf("backoff (%s) didn't return < 4 seconds on second retry", duration)
 	}
 	backoff.Backoff(ctx) // noop
-	if duration, ok := backoff.GetBackoffDuration(ctx); !ok || duration != time.Second*4 {
-		t.Fatalf("backoff didn't return 4 seconds on third retry")
+	if duration, ok := backoff.GetMaxBackoffDuration(ctx); !ok || duration > time.Second*8 {
+		t.Fatalf("backoff (%s) didn't return < 8 seconds on third retry", duration)
 	}
 	backoff.Backoff(ctx) // noop
-	if duration, ok := backoff.GetBackoffDuration(ctx); ok || duration != 0 {
-		t.Fatalf("backoff didn't return 0 seconds on fourth retry (exceeding limit)")
+	if duration, ok := backoff.GetMaxBackoffDuration(ctx); ok || duration != 0 {
+		t.Fatalf("backoff (%s) didn't return 0 seconds on fourth retry (exceeding limit)", duration)
 	}
 }
 
@@ -121,27 +121,27 @@ func TestBackoffRetryForever(t *testing.T) {
 	timeAfter = immediateTimeAfter
 	ctx := context.Background()
 	backoff := BackoffHandler{MaxRetries: 3, RetryForever: true}
-	if duration, ok := backoff.GetBackoffDuration(ctx); !ok || duration != time.Second {
-		t.Fatalf("backoff didn't return 1 second on first retry")
+	if duration, ok := backoff.GetMaxBackoffDuration(ctx); !ok || duration > time.Second*2 {
+		t.Fatalf("backoff (%s) didn't return < 2 seconds on first retry", duration)
 	}
 	backoff.Backoff(ctx) // noop
-	if duration, ok := backoff.GetBackoffDuration(ctx); !ok || duration != time.Second*2 {
-		t.Fatalf("backoff didn't return 2 seconds on second retry")
+	if duration, ok := backoff.GetMaxBackoffDuration(ctx); !ok || duration > time.Second*4 {
+		t.Fatalf("backoff (%s) didn't return < 4 seconds on second retry", duration)
 	}
 	backoff.Backoff(ctx) // noop
-	if duration, ok := backoff.GetBackoffDuration(ctx); !ok || duration != time.Second*4 {
-		t.Fatalf("backoff didn't return 4 seconds on third retry")
+	if duration, ok := backoff.GetMaxBackoffDuration(ctx); !ok || duration > time.Second*8 {
+		t.Fatalf("backoff (%s) didn't return < 8 seconds on third retry", duration)
 	}
 	if !backoff.Backoff(ctx) {
 		t.Fatalf("backoff refused on fourth retry despire RetryForever")
 	}
-	if duration, ok := backoff.GetBackoffDuration(ctx); !ok || duration != time.Second*8 {
+	if duration, ok := backoff.GetMaxBackoffDuration(ctx); !ok || duration > time.Second*16 {
 		t.Fatalf("backoff returned %v instead of 8 seconds on fourth retry", duration)
 	}
 	if !backoff.Backoff(ctx) {
 		t.Fatalf("backoff refused on fifth retry despire RetryForever")
 	}
-	if duration, ok := backoff.GetBackoffDuration(ctx); !ok || duration != time.Second*8 {
+	if duration, ok := backoff.GetMaxBackoffDuration(ctx); !ok || duration > time.Second*16 {
 		t.Fatalf("backoff returned %v instead of 8 seconds on fifth retry", duration)
 	}
 }

origin/proxy.go

@@ -5,7 +5,6 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"net"
 	"net/http"
 	"strconv"
 	"strings"
@@ -14,8 +13,6 @@ import (
 	"github.com/cloudflare/cloudflared/connection"
 	"github.com/cloudflare/cloudflared/ingress"
 	tunnelpogs "github.com/cloudflare/cloudflared/tunnelrpc/pogs"
-	"github.com/cloudflare/cloudflared/websocket"
-
 	"github.com/pkg/errors"
 	"github.com/rs/zerolog"
 )
@@ -24,52 +21,89 @@ const (
 	TagHeaderNamePrefix = "Cf-Warp-Tag-"
 )
 
-type client struct {
+type proxy struct {
 	ingressRules ingress.Ingress
+	warpRouting  *ingress.WarpRoutingService
 	tags         []tunnelpogs.Tag
 	log          *zerolog.Logger
 	bufferPool   *buffer.Pool
 }
 
-func NewClient(ingressRules ingress.Ingress, tags []tunnelpogs.Tag, log *zerolog.Logger) connection.OriginClient {
-	return &client{
+func NewOriginProxy(
+	ingressRules ingress.Ingress,
+	warpRouting *ingress.WarpRoutingService,
+	tags []tunnelpogs.Tag,
+	log *zerolog.Logger) connection.OriginProxy {
+
+	return &proxy{
 		ingressRules: ingressRules,
+		warpRouting:  warpRouting,
 		tags:         tags,
 		log:          log,
 		bufferPool:   buffer.NewPool(512 * 1024),
 	}
 }
 
-func (c *client) Proxy(w connection.ResponseWriter, req *http.Request, isWebsocket bool) error {
+// Caller is responsible for writing any error to ResponseWriter
+func (p *proxy) Proxy(w connection.ResponseWriter, req *http.Request, sourceConnectionType connection.Type) error {
 	incrementRequests()
 	defer decrementConcurrentRequests()
 
 	cfRay := findCfRayHeader(req)
 	lbProbe := isLBProbeRequest(req)
 
-	c.appendTagHeaders(req)
-	rule, ruleNum := c.ingressRules.FindMatchingRule(req.Host, req.URL.Path)
-	c.logRequest(req, cfRay, lbProbe, ruleNum)
+	serveCtx, cancel := context.WithCancel(req.Context())
+	defer cancel()
 
-	var (
-		resp *http.Response
-		err  error
-	)
-	if isWebsocket {
-		resp, err = c.proxyWebsocket(w, req, rule)
-	} else {
-		resp, err = c.proxyHTTP(w, req, rule)
+	p.appendTagHeaders(req)
+	if sourceConnectionType == connection.TypeTCP {
+		if p.warpRouting == nil {
+			err := errors.New(`cloudflared received a request from Warp client, but your configuration has disabled ingress from Warp clients. To enable this, set "warp-routing:\n\t enabled: true" in your config.yaml`)
+			p.log.Error().Msg(err.Error())
+			return err
+		}
+		logFields := logFields{
+			cfRay:   cfRay,
+			lbProbe: lbProbe,
+			rule:    ingress.ServiceWarpRouting,
+		}
+		if err := p.proxyStreamRequest(serveCtx, w, req, sourceConnectionType, p.warpRouting.Proxy, logFields); err != nil {
+			p.logRequestError(err, cfRay, ingress.ServiceWarpRouting)
+			return err
+		}
+		return nil
 	}
-	if err != nil {
-		c.logRequestError(err, cfRay, ruleNum)
-		w.WriteErrorResponse()
+
+	rule, ruleNum := p.ingressRules.FindMatchingRule(req.Host, req.URL.Path)
+	logFields := logFields{
+		cfRay:   cfRay,
+		lbProbe: lbProbe,
+		rule:    ruleNum,
+	}
+	p.logRequest(req, logFields)
+
+	if sourceConnectionType == connection.TypeHTTP {
+		if err := p.proxyHTTPRequest(w, req, rule, logFields); err != nil {
+			p.logRequestError(err, cfRay, ruleNum)
+			return err
+		}
+		return nil
+	}
+
+	connectionProxy, ok := rule.Service.(ingress.StreamBasedOriginProxy)
+	if !ok {
+		p.log.Error().Msgf("%s is not a connection-oriented service", rule.Service)
+		return fmt.Errorf("Not a connection-oriented service")
+	}
+
+	if err := p.proxyStreamRequest(serveCtx, w, req, sourceConnectionType, connectionProxy, logFields); err != nil {
+		p.logRequestError(err, cfRay, ruleNum)
 		return err
 	}
-	c.logOriginResponse(resp, cfRay, lbProbe, ruleNum)
 	return nil
 }
 
-func (c *client) proxyHTTP(w connection.ResponseWriter, req *http.Request, rule *ingress.Rule) (*http.Response, error) {
+func (p *proxy) proxyHTTPRequest(w connection.ResponseWriter, req *http.Request, rule *ingress.Rule, fields logFields) error {
 	// Support for WSGI Servers by switching transfer encoding from chunked to gzip/deflate
 	if rule.Config.DisableChunkedEncoding {
 		req.TransferEncoding = []string{"gzip", "deflate"}
@@ -82,78 +116,90 @@ func (c *client) proxyHTTP(w connection.ResponseWriter, req *http.Request, rule
 	// Request origin to keep connection alive to improve performance
 	req.Header.Set("Connection", "keep-alive")
 
-	if hostHeader := rule.Config.HTTPHostHeader; hostHeader != "" {
-		req.Header.Set("Host", hostHeader)
-		req.Host = hostHeader
+	httpService, ok := rule.Service.(ingress.HTTPOriginProxy)
+	if !ok {
+		p.log.Error().Msgf("%s is not a http service", rule.Service)
+		return fmt.Errorf("Not a http service")
 	}
 
-	resp, err := rule.Service.RoundTrip(req)
+	resp, err := httpService.RoundTrip(req)
 	if err != nil {
-		return nil, errors.Wrap(err, "Error proxying request to origin")
+		return errors.Wrap(err, "Error proxying request to origin")
 	}
 	defer resp.Body.Close()
 
-	err = w.WriteRespHeaders(resp)
+	err = w.WriteRespHeaders(resp.StatusCode, resp.Header)
 	if err != nil {
-		return nil, errors.Wrap(err, "Error writing response header")
+		return errors.Wrap(err, "Error writing response header")
 	}
 	if connection.IsServerSentEvent(resp.Header) {
-		c.log.Debug().Msg("Detected Server-Side Events from Origin")
-		c.writeEventStream(w, resp.Body)
+		p.log.Debug().Msg("Detected Server-Side Events from Origin")
+		p.writeEventStream(w, resp.Body)
 	} else {
 		// Use CopyBuffer, because Copy only allocates a 32KiB buffer, and cross-stream
 		// compression generates dictionary on first write
-		buf := c.bufferPool.Get()
-		defer c.bufferPool.Put(buf)
+		buf := p.bufferPool.Get()
+		defer p.bufferPool.Put(buf)
 		_, _ = io.CopyBuffer(w, resp.Body, buf)
 	}
-	return resp, nil
-}
-
-func (c *client) proxyWebsocket(w connection.ResponseWriter, req *http.Request, rule *ingress.Rule) (*http.Response, error) {
-	if hostHeader := rule.Config.HTTPHostHeader; hostHeader != "" {
-		req.Header.Set("Host", hostHeader)
-		req.Host = hostHeader
-	}
-
-	dialler, ok := rule.Service.(websocket.Dialler)
-	if !ok {
-		return nil, fmt.Errorf("Websockets aren't supported by the origin service '%s'", rule.Service)
-	}
-	conn, resp, err := websocket.ClientConnect(req, dialler)
-	if err != nil {
-		return nil, err
-	}
-
-	serveCtx, cancel := context.WithCancel(req.Context())
-	connClosedChan := make(chan struct{})
-	go func() {
-		// serveCtx is done if req is cancelled, or streamWebsocket returns
-		<-serveCtx.Done()
-		_ = conn.Close()
-		close(connClosedChan)
-	}()
-
-	// Copy to/from stream to the undelying connection. Use the underlying
-	// connection because cloudflared doesn't operate on the message themselves
-	err = c.streamWebsocket(w, conn.UnderlyingConn(), resp)
-	cancel()
-
-	// We need to make sure conn is closed before returning, otherwise we might write to conn after Proxy returns
-	<-connClosedChan
-	return resp, err
-}
-
-func (c *client) streamWebsocket(w connection.ResponseWriter, conn net.Conn, resp *http.Response) error {
-	err := w.WriteRespHeaders(resp)
-	if err != nil {
-		return errors.Wrap(err, "Error writing websocket response header")
-	}
-	websocket.Stream(conn, w)
+	p.logOriginResponse(resp, fields)
 	return nil
 }
 
-func (c *client) writeEventStream(w connection.ResponseWriter, respBody io.ReadCloser) {
+// proxyStreamRequest first establish a connection with origin, then it writes the status code and headers, and finally it streams data between
+// eyeball and origin.
+func (p *proxy) proxyStreamRequest(
+	serveCtx context.Context,
+	w connection.ResponseWriter,
+	req *http.Request,
+	sourceConnectionType connection.Type,
+	connectionProxy ingress.StreamBasedOriginProxy,
+	fields logFields,
+) error {
+	originConn, resp, err := connectionProxy.EstablishConnection(req)
+	if err != nil {
+		return err
+	}
+	if resp.Body != nil {
+		defer resp.Body.Close()
+	}
+
+	if err = w.WriteRespHeaders(resp.StatusCode, resp.Header); err != nil {
+		return err
+	}
+
+	streamCtx, cancel := context.WithCancel(serveCtx)
+	defer cancel()
+
+	go func() {
+		// streamCtx is done if req is cancelled or if Stream returns
+		<-streamCtx.Done()
+		originConn.Close()
+	}()
+
+	eyeballStream := &bidirectionalStream{
+		writer: w,
+		reader: req.Body,
+	}
+	originConn.Stream(serveCtx, eyeballStream, p.log)
+	p.logOriginResponse(resp, fields)
+	return nil
+}
+
+type bidirectionalStream struct {
+	reader io.Reader
+	writer io.Writer
+}
+
+func (wr *bidirectionalStream) Read(p []byte) (n int, err error) {
+	return wr.reader.Read(p)
+}
+
+func (wr *bidirectionalStream) Write(p []byte) (n int, err error) {
+	return wr.writer.Write(p)
+}
+
+func (p *proxy) writeEventStream(w connection.ResponseWriter, respBody io.ReadCloser) {
 	reader := bufio.NewReader(respBody)
 	for {
 		line, err := reader.ReadBytes('\n')
@@ -164,56 +210,61 @@ func (c *client) writeEventStream(w connection.ResponseWriter, respBody io.ReadC
 	}
 }
 
-func (c *client) appendTagHeaders(r *http.Request) {
-	for _, tag := range c.tags {
+func (p *proxy) appendTagHeaders(r *http.Request) {
+	for _, tag := range p.tags {
 		r.Header.Add(TagHeaderNamePrefix+tag.Name, tag.Value)
 	}
 }
 
-func (c *client) logRequest(r *http.Request, cfRay string, lbProbe bool, ruleNum int) {
-	if cfRay != "" {
-		c.log.Debug().Msgf("CF-RAY: %s %s %s %s", cfRay, r.Method, r.URL, r.Proto)
-	} else if lbProbe {
-		c.log.Debug().Msgf("CF-RAY: %s Load Balancer health check %s %s %s", cfRay, r.Method, r.URL, r.Proto)
+type logFields struct {
+	cfRay   string
+	lbProbe bool
+	rule    interface{}
+}
+
+func (p *proxy) logRequest(r *http.Request, fields logFields) {
+	if fields.cfRay != "" {
+		p.log.Debug().Msgf("CF-RAY: %s %s %s %s", fields.cfRay, r.Method, r.URL, r.Proto)
+	} else if fields.lbProbe {
+		p.log.Debug().Msgf("CF-RAY: %s Load Balancer health check %s %s %s", fields.cfRay, r.Method, r.URL, r.Proto)
 	} else {
-		c.log.Debug().Msgf("All requests should have a CF-RAY header. Please open a support ticket with Cloudflare. %s %s %s ", r.Method, r.URL, r.Proto)
+		p.log.Debug().Msgf("All requests should have a CF-RAY header. Please open a support ticket with Cloudflare. %s %s %s ", r.Method, r.URL, r.Proto)
 	}
-	c.log.Debug().Msgf("CF-RAY: %s Request Headers %+v", cfRay, r.Header)
-	c.log.Debug().Msgf("CF-RAY: %s Serving with ingress rule %d", cfRay, ruleNum)
+	p.log.Debug().Msgf("CF-RAY: %s Request Headers %+v", fields.cfRay, r.Header)
+	p.log.Debug().Msgf("CF-RAY: %s Serving with ingress rule %v", fields.cfRay, fields.rule)
 
 	if contentLen := r.ContentLength; contentLen == -1 {
-		c.log.Debug().Msgf("CF-RAY: %s Request Content length unknown", cfRay)
+		p.log.Debug().Msgf("CF-RAY: %s Request Content length unknown", fields.cfRay)
 	} else {
-		c.log.Debug().Msgf("CF-RAY: %s Request content length %d", cfRay, contentLen)
+		p.log.Debug().Msgf("CF-RAY: %s Request content length %d", fields.cfRay, contentLen)
 	}
 }
 
-func (c *client) logOriginResponse(r *http.Response, cfRay string, lbProbe bool, ruleNum int) {
-	responseByCode.WithLabelValues(strconv.Itoa(r.StatusCode)).Inc()
-	if cfRay != "" {
-		c.log.Debug().Msgf("CF-RAY: %s Status: %s served by ingress %d", cfRay, r.Status, ruleNum)
-	} else if lbProbe {
-		c.log.Debug().Msgf("Response to Load Balancer health check %s", r.Status)
+func (p *proxy) logOriginResponse(resp *http.Response, fields logFields) {
+	responseByCode.WithLabelValues(strconv.Itoa(resp.StatusCode)).Inc()
+	if fields.cfRay != "" {
+		p.log.Debug().Msgf("CF-RAY: %s Status: %s served by ingress %d", fields.cfRay, resp.Status, fields.rule)
+	} else if fields.lbProbe {
+		p.log.Debug().Msgf("Response to Load Balancer health check %s", resp.Status)
 	} else {
-		c.log.Debug().Msgf("Status: %s served by ingress %d", r.Status, ruleNum)
+		p.log.Debug().Msgf("Status: %s served by ingress %v", resp.Status, fields.rule)
 	}
-	c.log.Debug().Msgf("CF-RAY: %s Response Headers %+v", cfRay, r.Header)
+	p.log.Debug().Msgf("CF-RAY: %s Response Headers %+v", fields.cfRay, resp.Header)
 
-	if contentLen := r.ContentLength; contentLen == -1 {
-		c.log.Debug().Msgf("CF-RAY: %s Response content length unknown", cfRay)
+	if contentLen := resp.ContentLength; contentLen == -1 {
+		p.log.Debug().Msgf("CF-RAY: %s Response content length unknown", fields.cfRay)
 	} else {
-		c.log.Debug().Msgf("CF-RAY: %s Response content length %d", cfRay, contentLen)
+		p.log.Debug().Msgf("CF-RAY: %s Response content length %d", fields.cfRay, contentLen)
 	}
 }
 
-func (c *client) logRequestError(err error, cfRay string, ruleNum int) {
+func (p *proxy) logRequestError(err error, cfRay string, rule interface{}) {
 	requestErrors.Inc()
 	if cfRay != "" {
-		c.log.Error().Msgf("CF-RAY: %s Proxying to ingress %d error: %v", cfRay, ruleNum, err)
+		p.log.Error().Msgf("CF-RAY: %s Proxying to ingress %v error: %v", cfRay, rule, err)
 	} else {
-		c.log.Error().Msgf("Proxying to ingress %d error: %v", ruleNum, err)
+		p.log.Error().Msgf("Proxying to ingress %v error: %v", rule, err)
 	}
-
 }
 
 func findCfRayHeader(req *http.Request) string {

origin/proxy_test.go

@@ -6,17 +6,21 @@ import (
 	"flag"
 	"fmt"
 	"io"
+	"net"
 	"net/http"
 	"net/http/httptest"
 	"sync"
 	"testing"
 	"time"
 
+	"github.com/cloudflare/cloudflared/logger"
+
 	"github.com/cloudflare/cloudflared/cmd/cloudflared/config"
 	"github.com/cloudflare/cloudflared/connection"
 	"github.com/cloudflare/cloudflared/hello"
 	"github.com/cloudflare/cloudflared/ingress"
 	tunnelpogs "github.com/cloudflare/cloudflared/tunnelrpc/pogs"
+	gorillaWS "github.com/gorilla/websocket"
 	"github.com/urfave/cli/v2"
 
 	"github.com/gobwas/ws/wsutil"
@@ -26,7 +30,8 @@ import (
 )
 
 var (
-	testTags = []tunnelpogs.Tag(nil)
+	testTags                 = []tunnelpogs.Tag(nil)
+	unusedWarpRoutingService = (*ingress.WarpRoutingService)(nil)
 )
 
 type mockHTTPRespWriter struct {
@@ -39,19 +44,14 @@ func newMockHTTPRespWriter() *mockHTTPRespWriter {
 	}
 }
 
-func (w *mockHTTPRespWriter) WriteRespHeaders(resp *http.Response) error {
-	w.WriteHeader(resp.StatusCode)
-	for header, val := range resp.Header {
+func (w *mockHTTPRespWriter) WriteRespHeaders(status int, header http.Header) error {
+	w.WriteHeader(status)
+	for header, val := range header {
 		w.Header()[header] = val
 	}
 	return nil
 }
 
-func (w *mockHTTPRespWriter) WriteErrorResponse() {
-	w.WriteHeader(http.StatusBadGateway)
-	_, _ = w.Write([]byte("http response error"))
-}
-
 func (w *mockHTTPRespWriter) Read(data []byte) (int, error) {
 	return 0, fmt.Errorf("mockHTTPRespWriter doesn't implement io.Reader")
 }
@@ -125,59 +125,58 @@ func TestProxySingleOrigin(t *testing.T) {
 	errC := make(chan error)
 	require.NoError(t, ingressRule.StartOrigins(&wg, &log, ctx.Done(), errC))
 
-	client := NewClient(ingressRule, testTags, &log)
-	t.Run("testProxyHTTP", testProxyHTTP(t, client))
-	t.Run("testProxyWebsocket", testProxyWebsocket(t, client))
-	t.Run("testProxySSE", testProxySSE(t, client))
+	proxy := NewOriginProxy(ingressRule, unusedWarpRoutingService, testTags, &log)
+	t.Run("testProxyHTTP", testProxyHTTP(t, proxy))
+	t.Run("testProxyWebsocket", testProxyWebsocket(t, proxy))
+	t.Run("testProxySSE", testProxySSE(t, proxy))
 	cancel()
 	wg.Wait()
 }
 
-func testProxyHTTP(t *testing.T, client connection.OriginClient) func(t *testing.T) {
+func testProxyHTTP(t *testing.T, proxy connection.OriginProxy) func(t *testing.T) {
 	return func(t *testing.T) {
-		respWriter := newMockHTTPRespWriter()
+		responseWriter := newMockHTTPRespWriter()
 		req, err := http.NewRequest(http.MethodGet, "http://localhost:8080", nil)
 		require.NoError(t, err)
 
-		err = client.Proxy(respWriter, req, false)
+		err = proxy.Proxy(responseWriter, req, connection.TypeHTTP)
 		require.NoError(t, err)
 
-		assert.Equal(t, http.StatusOK, respWriter.Code)
+		assert.Equal(t, http.StatusOK, responseWriter.Code)
 	}
 }
 
-func testProxyWebsocket(t *testing.T, client connection.OriginClient) func(t *testing.T) {
+func testProxyWebsocket(t *testing.T, proxy connection.OriginProxy) func(t *testing.T) {
 	return func(t *testing.T) {
 		// WSRoute is a websocket echo handler
 		ctx, cancel := context.WithCancel(context.Background())
-		req, err := http.NewRequestWithContext(ctx, http.MethodGet, fmt.Sprintf("http://localhost:8080%s", hello.WSRoute), nil)
-
 		readPipe, writePipe := io.Pipe()
-		respWriter := newMockWSRespWriter(readPipe)
+		req, err := http.NewRequestWithContext(ctx, http.MethodGet, fmt.Sprintf("http://localhost:8080%s", hello.WSRoute), readPipe)
+		responseWriter := newMockWSRespWriter(readPipe)
 
 		var wg sync.WaitGroup
 		wg.Add(1)
 		go func() {
 			defer wg.Done()
-			err = client.Proxy(respWriter, req, true)
+			err = proxy.Proxy(responseWriter, req, connection.TypeWebsocket)
 			require.NoError(t, err)
 
-			require.Equal(t, http.StatusSwitchingProtocols, respWriter.Code)
+			require.Equal(t, http.StatusSwitchingProtocols, responseWriter.Code)
 		}()
 
 		msg := []byte("test websocket")
 		err = wsutil.WriteClientText(writePipe, msg)
 		require.NoError(t, err)
 
-		// ReadServerText reads next data message from rw, considering that caller represents client side.
-		returnedMsg, err := wsutil.ReadServerText(respWriter.respBody())
+		// ReadServerText reads next data message from rw, considering that caller represents proxy side.
+		returnedMsg, err := wsutil.ReadServerText(responseWriter.respBody())
 		require.NoError(t, err)
 		require.Equal(t, msg, returnedMsg)
 
 		err = wsutil.WriteClientBinary(writePipe, msg)
 		require.NoError(t, err)
 
-		returnedMsg, err = wsutil.ReadServerBinary(respWriter.respBody())
+		returnedMsg, err = wsutil.ReadServerBinary(responseWriter.respBody())
 		require.NoError(t, err)
 		require.Equal(t, msg, returnedMsg)
 
@@ -186,13 +185,13 @@ func testProxyWebsocket(t *testing.T, client connection.OriginClient) func(t *te
 	}
 }
 
-func testProxySSE(t *testing.T, client connection.OriginClient) func(t *testing.T) {
+func testProxySSE(t *testing.T, proxy connection.OriginProxy) func(t *testing.T) {
 	return func(t *testing.T) {
 		var (
 			pushCount = 50
 			pushFreq  = time.Millisecond * 10
 		)
-		respWriter := newMockSSERespWriter()
+		responseWriter := newMockSSERespWriter()
 		ctx, cancel := context.WithCancel(context.Background())
 		req, err := http.NewRequestWithContext(ctx, http.MethodGet, fmt.Sprintf("http://localhost:8080%s?freq=%s", hello.SSERoute, pushFreq), nil)
 		require.NoError(t, err)
@@ -201,18 +200,18 @@ func testProxySSE(t *testing.T, client connection.OriginClient) func(t *testing.
 		wg.Add(1)
 		go func() {
 			defer wg.Done()
-			err = client.Proxy(respWriter, req, false)
+			err = proxy.Proxy(responseWriter, req, connection.TypeHTTP)
 			require.NoError(t, err)
 
-			require.Equal(t, http.StatusOK, respWriter.Code)
+			require.Equal(t, http.StatusOK, responseWriter.Code)
 		}()
 
 		for i := 0; i < pushCount; i++ {
-			line := respWriter.ReadBytes()
+			line := responseWriter.ReadBytes()
 			expect := fmt.Sprintf("%d\n", i)
 			require.Equal(t, []byte(expect), line, fmt.Sprintf("Expect to read %v, got %v", expect, line))
 
-			line = respWriter.ReadBytes()
+			line = responseWriter.ReadBytes()
 			require.Equal(t, []byte("\n"), line, fmt.Sprintf("Expect to read '\n', got %v", line))
 		}
 
@@ -258,7 +257,7 @@ func TestProxyMultipleOrigins(t *testing.T) {
 	var wg sync.WaitGroup
 	require.NoError(t, ingress.StartOrigins(&wg, &log, ctx.Done(), errC))
 
-	client := NewClient(ingress, testTags, &log)
+	proxy := NewOriginProxy(ingress, unusedWarpRoutingService, testTags, &log)
 
 	tests := []struct {
 		url            string
@@ -290,18 +289,18 @@ func TestProxyMultipleOrigins(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		respWriter := newMockHTTPRespWriter()
+		responseWriter := newMockHTTPRespWriter()
 		req, err := http.NewRequest(http.MethodGet, test.url, nil)
 		require.NoError(t, err)
 
-		err = client.Proxy(respWriter, req, false)
+		err = proxy.Proxy(responseWriter, req, connection.TypeHTTP)
 		require.NoError(t, err)
 
-		assert.Equal(t, test.expectedStatus, respWriter.Code)
+		assert.Equal(t, test.expectedStatus, responseWriter.Code)
 		if test.expectedBody != nil {
-			assert.Equal(t, test.expectedBody, respWriter.Body.Bytes())
+			assert.Equal(t, test.expectedBody, responseWriter.Body.Bytes())
 		} else {
-			assert.Equal(t, 0, respWriter.Body.Len())
+			assert.Equal(t, 0, responseWriter.Body.Len())
 		}
 	}
 	cancel()
@@ -327,7 +326,7 @@ func TestProxyError(t *testing.T) {
 			{
 				Hostname: "*",
 				Path:     nil,
-				Service: ingress.MockOriginService{
+				Service: ingress.MockOriginHTTPService{
 					Transport: errorOriginTransport{},
 				},
 			},
@@ -336,14 +335,509 @@ func TestProxyError(t *testing.T) {
 
 	log := zerolog.Nop()
 
-	client := NewClient(ingress, testTags, &log)
+	proxy := NewOriginProxy(ingress, unusedWarpRoutingService, testTags, &log)
 
-	respWriter := newMockHTTPRespWriter()
+	responseWriter := newMockHTTPRespWriter()
 	req, err := http.NewRequest(http.MethodGet, "http://127.0.0.1", nil)
 	assert.NoError(t, err)
 
-	err = client.Proxy(respWriter, req, false)
-	assert.Error(t, err)
-	assert.Equal(t, http.StatusBadGateway, respWriter.Code)
-	assert.Equal(t, "http response error", respWriter.Body.String())
+	assert.Error(t, proxy.Proxy(responseWriter, req, connection.TypeHTTP))
+}
+
+type replayer struct {
+	sync.RWMutex
+	writeDone chan struct{}
+	rw        *bytes.Buffer
+}
+
+func newReplayer(buffer *bytes.Buffer) {
+
+}
+
+func (r *replayer) Read(p []byte) (int, error) {
+	r.RLock()
+	defer r.RUnlock()
+	return r.rw.Read(p)
+}
+
+func (r *replayer) Write(p []byte) (int, error) {
+	r.Lock()
+	defer r.Unlock()
+	n, err := r.rw.Write(p)
+	return n, err
+}
+
+func (r *replayer) String() string {
+	r.Lock()
+	defer r.Unlock()
+	return r.rw.String()
+}
+
+func (r *replayer) Bytes() []byte {
+	r.Lock()
+	defer r.Unlock()
+	return r.rw.Bytes()
+}
+
+// TestConnections tests every possible permutation of connection protocols
+// proxied by cloudflared.
+//
+// WS - WS : When a websocket based ingress is configured on the origin and
+// the eyeball is also a websocket client streaming data.
+// TCP - TCP : When teamnet is enabled and an http or tcp service is running
+// on the origin.
+// TCP - WS: When teamnet is enabled and a websocket based service is running
+// on the origin.
+// WS - TCP: When a tcp based ingress is configured on the origin and the
+// eyeball sends tcp packets wrapped in websockets. (E.g: cloudflared access).
+func TestConnections(t *testing.T) {
+	logger := logger.Create(nil)
+	replayer := &replayer{rw: &bytes.Buffer{}}
+	type args struct {
+		ingressServiceScheme  string
+		originService         func(*testing.T, net.Listener)
+		eyeballResponseWriter connection.ResponseWriter
+		eyeballRequestBody    io.ReadCloser
+
+		// Can be set to nil to show warp routing is not enabled.
+		warpRoutingService *ingress.WarpRoutingService
+
+		// eyeball connection type.
+		connectionType connection.Type
+
+		//requestheaders to be sent in the call to proxy.Proxy
+		requestHeaders http.Header
+	}
+
+	type want struct {
+		message []byte
+		headers http.Header
+		err     bool
+	}
+
+	var tests = []struct {
+		name string
+		args args
+		want want
+	}{
+		{
+			name: "ws-ws proxy",
+			args: args{
+				ingressServiceScheme:  "ws://",
+				originService:         runEchoWSService,
+				eyeballResponseWriter: newWSRespWriter(replayer),
+				eyeballRequestBody:    newWSRequestBody([]byte("test1")),
+				connectionType:        connection.TypeWebsocket,
+				requestHeaders: map[string][]string{
+					// Example key from https://tools.ietf.org/html/rfc6455#section-1.2
+					"Sec-Websocket-Key":     {"dGhlIHNhbXBsZSBub25jZQ=="},
+					"Test-Cloudflared-Echo": {"Echo"},
+				},
+			},
+			want: want{
+				message: []byte("echo-test1"),
+				headers: map[string][]string{
+					"Connection":            {"Upgrade"},
+					"Sec-Websocket-Accept":  {"s3pPLMBiTxaQ9kYGzzhZRbK+xOo="},
+					"Upgrade":               {"websocket"},
+					"Test-Cloudflared-Echo": {"Echo"},
+				},
+			},
+		},
+		{
+			name: "tcp-tcp proxy",
+			args: args{
+				ingressServiceScheme:  "tcp://",
+				originService:         runEchoTCPService,
+				eyeballResponseWriter: newTCPRespWriter(replayer),
+				eyeballRequestBody:    newTCPRequestBody([]byte("test2")),
+				warpRoutingService:    ingress.NewWarpRoutingService(),
+				connectionType:        connection.TypeTCP,
+				requestHeaders: map[string][]string{
+					"Cf-Cloudflared-Proxy-Src": {"non-blank-value"},
+				},
+			},
+			want: want{
+				message: []byte("echo-test2"),
+			},
+		},
+		{
+			name: "tcp-ws proxy",
+			args: args{
+				ingressServiceScheme: "ws://",
+				originService:        runEchoWSService,
+				//eyeballResponseWriter gets set after roundtrip dial.
+				eyeballRequestBody: newPipedWSRequestBody([]byte("test3")),
+				warpRoutingService: ingress.NewWarpRoutingService(),
+				requestHeaders: map[string][]string{
+					"Cf-Cloudflared-Proxy-Src": {"non-blank-value"},
+				},
+				connectionType: connection.TypeTCP,
+			},
+			want: want{
+				message: []byte("echo-test3"),
+				// We expect no headers here because they are sent back via
+				// the stream.
+			},
+		},
+		{
+			name: "ws-tcp proxy",
+			args: args{
+				ingressServiceScheme:  "tcp://",
+				originService:         runEchoTCPService,
+				eyeballResponseWriter: newWSRespWriter(replayer),
+				eyeballRequestBody:    newWSRequestBody([]byte("test4")),
+				connectionType:        connection.TypeWebsocket,
+				requestHeaders: map[string][]string{
+					// Example key from https://tools.ietf.org/html/rfc6455#section-1.2
+					"Sec-Websocket-Key": {"dGhlIHNhbXBsZSBub25jZQ=="},
+				},
+			},
+			want: want{
+				message: []byte("echo-test4"),
+				headers: map[string][]string{
+					"Connection":           {"Upgrade"},
+					"Sec-Websocket-Accept": {"s3pPLMBiTxaQ9kYGzzhZRbK+xOo="},
+					"Upgrade":              {"websocket"},
+				},
+			},
+		},
+		{
+			name: "tcp-tcp proxy without warpRoutingService enabled",
+			args: args{
+				ingressServiceScheme:  "tcp://",
+				originService:         runEchoTCPService,
+				eyeballResponseWriter: newTCPRespWriter(replayer),
+				eyeballRequestBody:    newTCPRequestBody([]byte("test2")),
+				connectionType:        connection.TypeTCP,
+				requestHeaders: map[string][]string{
+					"Cf-Cloudflared-Proxy-Src": {"non-blank-value"},
+				},
+			},
+			want: want{
+				message: []byte{},
+				err:     true,
+			},
+		},
+		{
+			name: "ws-ws proxy when origin is different",
+			args: args{
+				ingressServiceScheme:  "ws://",
+				originService:         runEchoWSService,
+				eyeballResponseWriter: newWSRespWriter(replayer),
+				eyeballRequestBody:    newWSRequestBody([]byte("test1")),
+				connectionType:        connection.TypeWebsocket,
+				requestHeaders: map[string][]string{
+					// Example key from https://tools.ietf.org/html/rfc6455#section-1.2
+					"Sec-Websocket-Key": {"dGhlIHNhbXBsZSBub25jZQ=="},
+					"Origin":            {"Different origin"},
+				},
+			},
+			want: want{
+				message: []byte{},
+				err:     true,
+			},
+		},
+		{
+			name: "tcp-* proxy when origin service has already closed the connection/ is no longer running",
+			args: args{
+				ingressServiceScheme: "tcp://",
+				originService: func(t *testing.T, ln net.Listener) {
+					// closing the listener created by the test.
+					ln.Close()
+				},
+				eyeballResponseWriter: newTCPRespWriter(replayer),
+				eyeballRequestBody:    newTCPRequestBody([]byte("test2")),
+				connectionType:        connection.TypeTCP,
+				requestHeaders: map[string][]string{
+					"Cf-Cloudflared-Proxy-Src": {"non-blank-value"},
+				},
+			},
+			want: want{
+				message: []byte{},
+				err:     true,
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			ctx, cancel := context.WithCancel(context.Background())
+			ln, err := net.Listen("tcp", "127.0.0.1:0")
+			require.NoError(t, err)
+			// Starts origin service
+			test.args.originService(t, ln)
+
+			ingressRule := createSingleIngressConfig(t, test.args.ingressServiceScheme+ln.Addr().String())
+			var wg sync.WaitGroup
+			errC := make(chan error)
+			ingressRule.StartOrigins(&wg, logger, ctx.Done(), errC)
+			proxy := NewOriginProxy(ingressRule, test.args.warpRoutingService, testTags, logger)
+
+			req, err := http.NewRequest(
+				http.MethodGet,
+				test.args.ingressServiceScheme+ln.Addr().String(),
+				test.args.eyeballRequestBody,
+			)
+			require.NoError(t, err)
+
+			req.Header = test.args.requestHeaders
+			respWriter := test.args.eyeballResponseWriter
+
+			if pipedReqBody, ok := test.args.eyeballRequestBody.(*pipedRequestBody); ok {
+				respWriter = newTCPRespWriter(pipedReqBody.pipedConn)
+				go func() {
+					resp := pipedReqBody.roundtrip(test.args.ingressServiceScheme + ln.Addr().String())
+					replayer.Write(resp)
+				}()
+			}
+
+			err = proxy.Proxy(respWriter, req, test.args.connectionType)
+
+			cancel()
+			assert.Equal(t, test.want.err, err != nil)
+			assert.Equal(t, test.want.message, replayer.Bytes())
+			respPrinter := respWriter.(responsePrinter)
+			assert.Equal(t, test.want.headers, respPrinter.headers())
+			replayer.rw.Reset()
+		})
+	}
+}
+
+type requestBody struct {
+	pw *io.PipeWriter
+	pr *io.PipeReader
+}
+
+func newWSRequestBody(data []byte) *requestBody {
+	pr, pw := io.Pipe()
+	go wsutil.WriteClientBinary(pw, data)
+	return &requestBody{
+		pr: pr,
+		pw: pw,
+	}
+}
+func newTCPRequestBody(data []byte) *requestBody {
+	pr, pw := io.Pipe()
+	go pw.Write(data)
+	return &requestBody{
+		pr: pr,
+		pw: pw,
+	}
+}
+
+func (r *requestBody) Read(p []byte) (n int, err error) {
+	return r.pr.Read(p)
+}
+
+func (r *requestBody) Close() error {
+	r.pw.Close()
+	r.pr.Close()
+	return nil
+}
+
+type pipedRequestBody struct {
+	dialer         gorillaWS.Dialer
+	pipedConn      net.Conn
+	wsConn         net.Conn
+	messageToWrite []byte
+}
+
+func newPipedWSRequestBody(data []byte) *pipedRequestBody {
+	conn1, conn2 := net.Pipe()
+	dialer := gorillaWS.Dialer{
+		NetDial: func(network, addr string) (net.Conn, error) {
+			return conn2, nil
+		},
+	}
+	return &pipedRequestBody{
+		dialer:         dialer,
+		pipedConn:      conn1,
+		wsConn:         conn2,
+		messageToWrite: data,
+	}
+}
+
+func (p *pipedRequestBody) roundtrip(addr string) []byte {
+	header := http.Header{}
+	conn, resp, err := p.dialer.Dial(addr, header)
+	if err != nil {
+		panic(err)
+	}
+	defer conn.Close()
+
+	if resp.StatusCode != http.StatusSwitchingProtocols {
+		panic(fmt.Errorf("resp returned status code: %d", resp.StatusCode))
+	}
+
+	err = conn.WriteMessage(gorillaWS.TextMessage, p.messageToWrite)
+	if err != nil {
+		panic(err)
+	}
+
+	_, data, err := conn.ReadMessage()
+	if err != nil {
+		panic(err)
+	}
+
+	return data
+}
+
+func (p *pipedRequestBody) Read(data []byte) (n int, err error) {
+	return p.pipedConn.Read(data)
+}
+
+func (p *pipedRequestBody) Close() error {
+	return nil
+}
+
+type responsePrinter interface {
+	headers() http.Header
+}
+
+type wsRespWriter struct {
+	w               io.Writer
+	responseHeaders http.Header
+	code            int
+}
+
+// newWSRespWriter uses wsutil.WriteClientText to generate websocket frames.
+// and wsutil.ReadClientText to translate frames from server to byte data.
+// In essence, this acts as a wsClient.
+func newWSRespWriter(w io.Writer) *wsRespWriter {
+	return &wsRespWriter{
+		w: w,
+	}
+}
+
+// Write is written to by ingress.Stream and serves as the output to the client.
+func (w *wsRespWriter) Write(p []byte) (int, error) {
+	returnedMsg, err := wsutil.ReadServerBinary(bytes.NewBuffer(p))
+	if err != nil {
+		// The data was not returned by a websocket connecton.
+		if err != io.ErrUnexpectedEOF {
+			return w.w.Write(p)
+		}
+	}
+	return w.w.Write(returnedMsg)
+}
+
+func (w *wsRespWriter) WriteRespHeaders(status int, header http.Header) error {
+	w.responseHeaders = header
+	w.code = status
+	return nil
+}
+
+// respHeaders is a test function to read respHeaders
+func (w *wsRespWriter) headers() http.Header {
+	return w.responseHeaders
+}
+
+type mockTCPRespWriter struct {
+	w               io.Writer
+	responseHeaders http.Header
+	code            int
+}
+
+func newTCPRespWriter(w io.Writer) *mockTCPRespWriter {
+	return &mockTCPRespWriter{
+		w: w,
+	}
+}
+
+func (m *mockTCPRespWriter) Write(p []byte) (n int, err error) {
+	return m.w.Write(p)
+}
+
+func (m *mockTCPRespWriter) WriteRespHeaders(status int, header http.Header) error {
+	m.responseHeaders = header
+	m.code = status
+	return nil
+}
+
+// respHeaders is a test function to read respHeaders
+func (m *mockTCPRespWriter) headers() http.Header {
+	return m.responseHeaders
+}
+
+func createSingleIngressConfig(t *testing.T, service string) ingress.Ingress {
+	ingressConfig := &config.Configuration{
+		Ingress: []config.UnvalidatedIngressRule{
+			{
+				Hostname: "*",
+				Service:  service,
+			},
+		},
+	}
+	ingressRule, err := ingress.ParseIngress(ingressConfig)
+	require.NoError(t, err)
+	return ingressRule
+}
+
+func runEchoTCPService(t *testing.T, l net.Listener) {
+	go func() {
+		for {
+			conn, err := l.Accept()
+			require.NoError(t, err)
+			defer conn.Close()
+
+			for {
+				buf := make([]byte, 1024)
+				size, err := conn.Read(buf)
+				if err == io.EOF {
+					return
+				}
+				data := []byte("echo-")
+				data = append(data, buf[:size]...)
+				_, err = conn.Write(data)
+				if err != nil {
+					t.Log(err)
+				}
+				return
+			}
+		}
+	}()
+}
+
+func runEchoWSService(t *testing.T, l net.Listener) {
+	var upgrader = gorillaWS.Upgrader{
+		ReadBufferSize:  10,
+		WriteBufferSize: 10,
+	}
+
+	var ws = func(w http.ResponseWriter, r *http.Request) {
+		header := make(http.Header)
+		for k, vs := range r.Header {
+			if k == "Test-Cloudflared-Echo" {
+				header[k] = vs
+			}
+		}
+		conn, err := upgrader.Upgrade(w, r, header)
+		if err != nil {
+			t.Log(err)
+			return
+		}
+		defer conn.Close()
+
+		for {
+			messageType, p, err := conn.ReadMessage()
+			if err != nil {
+				return
+			}
+			data := []byte("echo-")
+			data = append(data, p...)
+			if err := conn.WriteMessage(messageType, data); err != nil {
+				return
+			}
+		}
+	}
+
+	server := http.Server{
+		Handler: http.HandlerFunc(ws),
+	}
+
+	go func() {
+		err := server.Serve(l)
+		require.NoError(t, err)
+	}()
 }

origin/reconnect.go

@@ -108,7 +108,7 @@ func (cm *reconnectCredentialManager) RefreshAuth(
 	authOutcome, err := authenticate(ctx, backoff.Retries())
 	if err != nil {
 		cm.authFail.WithLabelValues(err.Error()).Inc()
-		if _, ok := backoff.GetBackoffDuration(ctx); ok {
+		if _, ok := backoff.GetMaxBackoffDuration(ctx); ok {
 			return backoff.BackoffTimer(), nil
 		}
 		return nil, err

origin/reconnect_test.go

@@ -8,6 +8,7 @@ import (
 	"time"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
 	tunnelpogs "github.com/cloudflare/cloudflared/tunnelrpc/pogs"
 )
@@ -28,13 +29,14 @@ func TestRefreshAuthBackoff(t *testing.T) {
 	// authentication failures should consume the backoff
 	for i := uint(0); i < backoff.MaxRetries; i++ {
 		retryChan, err := rcm.RefreshAuth(context.Background(), backoff, auth)
-		assert.NoError(t, err)
-		assert.NotNil(t, retryChan)
-		assert.Equal(t, (1<<i)*time.Second, wait)
+		require.NoError(t, err)
+		require.NotNil(t, retryChan)
+		require.Greater(t, wait.Seconds(), 0.0)
+		require.Less(t, wait.Seconds(), float64((1<<(i+1))*time.Second))
 	}
 	retryChan, err := rcm.RefreshAuth(context.Background(), backoff, auth)
-	assert.Error(t, err)
-	assert.Nil(t, retryChan)
+	require.Error(t, err)
+	require.Nil(t, retryChan)
 
 	// now we actually make contact with the remote server
 	_, _ = rcm.RefreshAuth(context.Background(), backoff, func(ctx context.Context, n int) (tunnelpogs.AuthOutcome, error) {
@@ -47,8 +49,8 @@ func TestRefreshAuthBackoff(t *testing.T) {
 		expectedGracePeriod := time.Duration(time.Second * 2 << backoff.MaxRetries)
 		return time.Now().Add(expectedGracePeriod * 2)
 	}
-	_, ok := backoff.GetBackoffDuration(context.Background())
-	assert.True(t, ok)
+	_, ok := backoff.GetMaxBackoffDuration(context.Background())
+	require.True(t, ok)
 }
 
 func TestRefreshAuthSuccess(t *testing.T) {

origin/tunnel.go

@@ -174,11 +174,11 @@ func ServeTunnelLoop(
 
 		config.Observer.SendReconnect(connIndex)
 
-		duration, ok := protocolFallback.GetBackoffDuration(ctx)
+		duration, ok := protocolFallback.GetMaxBackoffDuration(ctx)
 		if !ok {
 			return err
 		}
-		connLog.Info().Msgf("Retrying connection in %s seconds", duration)
+		connLog.Info().Msgf("Retrying connection in up to %s seconds", duration)
 
 		select {
 		case <-ctx.Done():
@@ -244,7 +244,7 @@ func selectNextProtocol(
 // on error returns a flag indicating if error can be retried
 func ServeTunnel(
 	ctx context.Context,
-	connLong *zerolog.Logger,
+	connLog *zerolog.Logger,
 	credentialManager *reconnectCredentialManager,
 	config *TunnelConfig,
 	addr *net.TCPAddr,
@@ -273,6 +273,7 @@ func ServeTunnel(
 
 	edgeConn, err := edgediscovery.DialEdge(ctx, dialTimeout, config.EdgeTLSConfigs[protocol], addr)
 	if err != nil {
+		connLog.Err(err).Msg("Unable to establish connection with Cloudflare edge")
 		return err, true
 	}
 	connectedFuse := &connectedFuse{
@@ -284,7 +285,7 @@ func ServeTunnel(
 		connOptions := config.ConnectionOptions(edgeConn.LocalAddr().String(), uint8(backoff.retries))
 		err = ServeHTTP2(
 			ctx,
-			connLong,
+			connLog,
 			config,
 			edgeConn,
 			connOptions,
@@ -296,7 +297,7 @@ func ServeTunnel(
 	} else {
 		err = ServeH2mux(
 			ctx,
-			connLong,
+			connLog,
 			credentialManager,
 			config,
 			edgeConn,
@@ -311,28 +312,29 @@ func ServeTunnel(
 	if err != nil {
 		switch err := err.(type) {
 		case connection.DupConnRegisterTunnelError:
+			connLog.Err(err).Msg("Unable to establish connection.")
 			// don't retry this connection anymore, let supervisor pick a new address
 			return err, false
 		case connection.ServerRegisterTunnelError:
-			connLong.Err(err).Msg("Register tunnel error from server side")
+			connLog.Err(err).Msg("Register tunnel error from server side")
 			// Don't send registration error return from server to Sentry. They are
 			// logged on server side
 			if incidents := config.IncidentLookup.ActiveIncidents(); len(incidents) > 0 {
-				connLong.Error().Msg(activeIncidentsMsg(incidents))
+				connLog.Error().Msg(activeIncidentsMsg(incidents))
 			}
 			return err.Cause, !err.Permanent
 		case ReconnectSignal:
-			connLong.Info().
+			connLog.Info().
 				Uint8(connection.LogFieldConnIndex, connIndex).
 				Msgf("Restarting connection due to reconnect signal in %s", err.Delay)
 			err.DelayBeforeReconnect()
 			return err, true
 		default:
 			if err == context.Canceled {
-				connLong.Debug().Err(err).Msgf("Serve tunnel error")
+				connLog.Debug().Err(err).Msgf("Serve tunnel error")
 				return err, false
 			}
-			connLong.Err(err).Msgf("Serve tunnel error")
+			connLog.Err(err).Msgf("Serve tunnel error")
 			_, permanent := err.(unrecoverableError)
 			return err, !permanent
 		}

origin/tunnel_test.go

@@ -40,8 +40,10 @@ func TestWaitForBackoffFallback(t *testing.T) {
 	mockFetcher := dynamicMockFetcher{
 		percentage: 0,
 	}
+	warpRoutingEnabled := false
 	protocolSelector, err := connection.NewProtocolSelector(
 		connection.HTTP2.String(),
+		warpRoutingEnabled,
 		namedTunnel,
 		mockFetcher.fetch(),
 		resolveTTL,

socks/request_handler.go

@@ -3,7 +3,10 @@ package socks
 import (
 	"fmt"
 	"io"
+	"net"
 	"strings"
+
+	"github.com/rs/zerolog"
 )
 
 // RequestHandler is the functions needed to handle a SOCKS5 command
@@ -104,3 +107,13 @@ func (h *StandardRequestHandler) handleAssociate(conn io.ReadWriter, req *Reques
 	}
 	return nil
 }
+
+func StreamHandler(tunnelConn io.ReadWriter, originConn net.Conn, log *zerolog.Logger) {
+	dialer := NewConnDialer(originConn)
+	requestHandler := NewRequestHandler(dialer)
+	socksServer := NewConnectionHandler(requestHandler)
+
+	if err := socksServer.Serve(tunnelConn); err != nil {
+		log.Debug().Err(err).Msg("Socks stream handler error")
+	}
+}

teamnet/api.go

@@ -16,9 +16,9 @@ import (
 // network, and says that eyeballs can reach that route using the corresponding
 // tunnel.
 type Route struct {
-	Network   CIDR
+	Network   CIDR      `json:"network"`
 	TunnelID  uuid.UUID `json:"tunnel_id"`
-	Comment   string
+	Comment   string    `json:"comment"`
 	CreatedAt time.Time `json:"created_at"`
 	DeletedAt time.Time `json:"deleted_at"`
 }
@@ -26,11 +26,20 @@ type Route struct {
 // CIDR is just a newtype wrapper around net.IPNet. It adds JSON unmarshalling.
 type CIDR net.IPNet
 
-func (c *CIDR) String() string {
-	n := net.IPNet(*c)
+func (c CIDR) String() string {
+	n := net.IPNet(c)
 	return n.String()
 }
 
+func (c CIDR) MarshalJSON() ([]byte, error) {
+	str := c.String()
+	json, err := json.Marshal(str)
+	if err != nil {
+		return nil, errors.Wrap(err, "error serializing CIDR into JSON")
+	}
+	return json, nil
+}
+
 // UnmarshalJSON parses a JSON string into net.IPNet
 func (c *CIDR) UnmarshalJSON(data []byte) error {
 	var s string
@@ -68,9 +77,9 @@ func (r NewRoute) MarshalJSON() ([]byte, error) {
 
 // DetailedRoute is just a Route with some extra fields, e.g. TunnelName.
 type DetailedRoute struct {
-	Network    CIDR
+	Network    CIDR      `json:"network"`
 	TunnelID   uuid.UUID `json:"tunnel_id"`
-	Comment    string
+	Comment    string    `json:"comment"`
 	CreatedAt  time.Time `json:"created_at"`
 	DeletedAt  time.Time `json:"deleted_at"`
 	TunnelName string    `json:"tunnel_name"`

teamnet/api_test.go

@@ -33,15 +33,15 @@ func TestUnmarshalRoute(t *testing.T) {
 	require.Equal(t, "test", r.Comment)
 }
 
-func TestUnmarshalDetailedRoute(t *testing.T) {
+func TestDetailedRouteJsonRoundtrip(t *testing.T) {
 	// Response from the teamnet route backend
 	data := `{
 		"network":"10.1.2.40/29",
 		"tunnel_id":"fba6ffea-807f-4e7a-a740-4184ee1b82c8",
-		"tunnel_name":"Mr. Tun",
 		"comment":"test",
 		"created_at":"2020-12-22T02:00:15.587008Z",
-		"deleted_at":null
+		"deleted_at":"2021-01-14T05:01:42.183002Z",
+		"tunnel_name":"Mr. Tun"
 	}`
 	var r DetailedRoute
 	err := json.Unmarshal([]byte(data), &r)
@@ -55,6 +55,13 @@ func TestUnmarshalDetailedRoute(t *testing.T) {
 	require.Equal(t, CIDR(*cidr), r.Network)
 	require.Equal(t, "test", r.Comment)
 	require.Equal(t, "Mr. Tun", r.TunnelName)
+
+	bytes, err := json.Marshal(r)
+	require.NoError(t, err)
+	obtainedJson := string(bytes)
+	data = strings.Replace(data, "\t", "", -1)
+	data = strings.Replace(data, "\n", "", -1)
+	require.Equal(t, data, obtainedJson)
 }
 
 func TestMarshalNewRoute(t *testing.T) {

tunneldns/https_upstream.go

@@ -30,12 +30,12 @@ type UpstreamHTTPS struct {
 }
 
 // NewUpstreamHTTPS creates a new DNS over HTTPS upstream from endpoint
-func NewUpstreamHTTPS(endpoint string, bootstraps []string, log *zerolog.Logger) (Upstream, error) {
+func NewUpstreamHTTPS(endpoint string, bootstraps []string, maxConnections int, log *zerolog.Logger) (Upstream, error) {
 	u, err := url.Parse(endpoint)
 	if err != nil {
 		return nil, err
 	}
-	return &UpstreamHTTPS{client: configureClient(u.Hostname()), endpoint: u, bootstraps: bootstraps, log: log}, nil
+	return &UpstreamHTTPS{client: configureClient(u.Hostname(), maxConnections), endpoint: u, bootstraps: bootstraps, log: log}, nil
 }
 
 // Exchange provides an implementation for the Upstream interface
@@ -122,17 +122,18 @@ func configureBootstrap(bootstrap string) (*url.URL, *http.Client, error) {
 		return nil, nil, fmt.Errorf("bootstrap address of %s must be an IP address", b.Hostname())
 	}
 
-	return b, configureClient(b.Hostname()), nil
+	return b, configureClient(b.Hostname(), MaxUpstreamConnsDefault), nil
 }
 
 // configureClient will configure a HTTPS client for upstream DoH requests
-func configureClient(hostname string) *http.Client {
+func configureClient(hostname string, maxUpstreamConnections int) *http.Client {
 	// Update TLS and HTTP client configuration
 	tlsConfig := &tls.Config{ServerName: hostname}
 	transport := &http.Transport{
 		TLSClientConfig:    tlsConfig,
 		DisableCompression: true,
 		MaxIdleConns:       1,
+		MaxConnsPerHost:    maxUpstreamConnections,
 		Proxy:              http.ProxyFromEnvironment,
 	}
 	_ = http2.ConfigureTransport(transport)

tunneldns/tunnel.go

@@ -21,8 +21,9 @@ import (
 )
 
 const (
-	LogFieldAddress = "address"
-	LogFieldURL     = "url"
+	LogFieldAddress         = "address"
+	LogFieldURL             = "url"
+	MaxUpstreamConnsDefault = 5
 )
 
 // Listener is an adapter between CoreDNS server and Warp runnable
@@ -69,6 +70,12 @@ func Command(hidden bool) *cli.Command {
 				Value:   cli.NewStringSlice("https://162.159.36.1/dns-query", "https://162.159.46.1/dns-query", "https://[2606:4700:4700::1111]/dns-query", "https://[2606:4700:4700::1001]/dns-query"),
 				EnvVars: []string{"TUNNEL_DNS_BOOTSTRAP"},
 			},
+			&cli.IntFlag{
+				Name:    "max-upstream-conns",
+				Usage:   "Maximum concurrent connections to upstream. Setting to 0 means unlimited.",
+				Value:   MaxUpstreamConnsDefault,
+				EnvVars: []string{"TUNNEL_DNS_MAX_UPSTREAM_CONNS"},
+			},
 		},
 		ArgsUsage: " ", // can't be the empty string or we get the default output
 		Hidden:    hidden,
@@ -92,8 +99,10 @@ func Run(c *cli.Context) error {
 		uint16(c.Int("port")),
 		c.StringSlice("upstream"),
 		c.StringSlice("bootstrap"),
+		c.Int("max-upstream-conns"),
 		log,
 	)
+
 	if err != nil {
 		log.Err(err).Msg("Failed to create the listeners")
 		return err
@@ -175,12 +184,12 @@ func (l *Listener) Stop() error {
 }
 
 // CreateListener configures the server and bound sockets
-func CreateListener(address string, port uint16, upstreams []string, bootstraps []string, log *zerolog.Logger) (*Listener, error) {
+func CreateListener(address string, port uint16, upstreams []string, bootstraps []string, maxUpstreamConnections int, log *zerolog.Logger) (*Listener, error) {
 	// Build the list of upstreams
 	upstreamList := make([]Upstream, 0)
 	for _, url := range upstreams {
 		log.Info().Str(LogFieldURL, url).Msg("Adding DNS upstream")
-		upstream, err := NewUpstreamHTTPS(url, bootstraps, log)
+		upstream, err := NewUpstreamHTTPS(url, bootstraps, maxUpstreamConnections, log)
 		if err != nil {
 			return nil, errors.Wrap(err, "failed to create HTTPS upstream")
 		}

vendor/github.com/DATA-DOG/go-sqlmock/.gitignore

@@ -1,3 +0,0 @@
-/examples/blog/blog
-/examples/orders/orders
-/examples/basic/basic

vendor/github.com/DATA-DOG/go-sqlmock/.travis.yml

@@ -1,25 +0,0 @@
-language: go
-
-go_import_path: github.com/DATA-DOG/go-sqlmock
-
-go:
-  - 1.2.x
-  - 1.3.x
-  - 1.4 # has no cover tool for latest releases
-  - 1.5.x
-  - 1.6.x
-  - 1.7.x
-  - 1.8.x
-  - 1.9.x
-  - 1.10.x
-  - 1.11.x
-
-sudo: false
-
-script:
-  - go vet
-  - test -z "$(go fmt ./...)" # fail if not formatted properly
-  - go test -race -coverprofile=coverage.txt -covermode=atomic
-
-after_success:
-  - bash <(curl -s https://codecov.io/bash)

vendor/github.com/DATA-DOG/go-sqlmock/LICENSE

@@ -1,28 +0,0 @@
-The three clause BSD license (http://en.wikipedia.org/wiki/BSD_licenses)
-
-Copyright (c) 2013-2019, DATA-DOG team
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
-
-* Redistributions of source code must retain the above copyright notice, this
-  list of conditions and the following disclaimer.
-
-* Redistributions in binary form must reproduce the above copyright notice,
-  this list of conditions and the following disclaimer in the documentation
-  and/or other materials provided with the distribution.
-
-* The name DataDog.lt may not be used to endorse or promote products
-  derived from this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL MICHAEL BOSTOCK BE LIABLE FOR ANY DIRECT,
-INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
-BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
-OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
-NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
-EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

vendor/github.com/DATA-DOG/go-sqlmock/README.md

@@ -1,259 +0,0 @@
-[![Build Status](https://travis-ci.org/DATA-DOG/go-sqlmock.svg)](https://travis-ci.org/DATA-DOG/go-sqlmock)
-[![GoDoc](https://godoc.org/github.com/DATA-DOG/go-sqlmock?status.svg)](https://godoc.org/github.com/DATA-DOG/go-sqlmock)
-[![Go Report Card](https://goreportcard.com/badge/github.com/DATA-DOG/go-sqlmock)](https://goreportcard.com/report/github.com/DATA-DOG/go-sqlmock)
-[![codecov.io](https://codecov.io/github/DATA-DOG/go-sqlmock/branch/master/graph/badge.svg)](https://codecov.io/github/DATA-DOG/go-sqlmock)
-
-# Sql driver mock for Golang
-
-**sqlmock** is a mock library implementing [sql/driver](https://godoc.org/database/sql/driver). Which has one and only
-purpose - to simulate any **sql** driver behavior in tests, without needing a real database connection. It helps to
-maintain correct **TDD** workflow.
-
-- this library is now complete and stable. (you may not find new changes for this reason)
-- supports concurrency and multiple connections.
-- supports **go1.8** Context related feature mocking and Named sql parameters.
-- does not require any modifications to your source code.
-- the driver allows to mock any sql driver method behavior.
-- has strict by default expectation order matching.
-- has no third party dependencies.
-
-**NOTE:** in **v1.2.0** **sqlmock.Rows** has changed to struct from interface, if you were using any type references to that
-interface, you will need to switch it to a pointer struct type. Also, **sqlmock.Rows** were used to implement **driver.Rows**
-interface, which was not required or useful for mocking and was removed. Hope it will not cause issues.
-
-## Install
-
-    go get github.com/DATA-DOG/go-sqlmock
-
-## Documentation and Examples
-
-Visit [godoc](http://godoc.org/github.com/DATA-DOG/go-sqlmock) for general examples and public api reference.
-See **.travis.yml** for supported **go** versions.
-Different use case, is to functionally test with a real database - [go-txdb](https://github.com/DATA-DOG/go-txdb)
-all database related actions are isolated within a single transaction so the database can remain in the same state.
-
-See implementation examples:
-
-- [blog API server](https://github.com/DATA-DOG/go-sqlmock/tree/master/examples/blog)
-- [the same orders example](https://github.com/DATA-DOG/go-sqlmock/tree/master/examples/orders)
-
-### Something you may want to test, assuming you use the [go-mysql-driver](https://github.com/go-sql-driver/mysql)
-
-``` go
-package main
-
-import (
-	"database/sql"
-
-	_ "github.com/go-sql-driver/mysql"
-)
-
-func recordStats(db *sql.DB, userID, productID int64) (err error) {
-	tx, err := db.Begin()
-	if err != nil {
-		return
-	}
-
-	defer func() {
-		switch err {
-		case nil:
-			err = tx.Commit()
-		default:
-			tx.Rollback()
-		}
-	}()
-
-	if _, err = tx.Exec("UPDATE products SET views = views + 1"); err != nil {
-		return
-	}
-	if _, err = tx.Exec("INSERT INTO product_viewers (user_id, product_id) VALUES (?, ?)", userID, productID); err != nil {
-		return
-	}
-	return
-}
-
-func main() {
-	// @NOTE: the real connection is not required for tests
-	db, err := sql.Open("mysql", "root@/blog")
-	if err != nil {
-		panic(err)
-	}
-	defer db.Close()
-
-	if err = recordStats(db, 1 /*some user id*/, 5 /*some product id*/); err != nil {
-		panic(err)
-	}
-}
-```
-
-### Tests with sqlmock
-
-``` go
-package main
-
-import (
-	"fmt"
-	"testing"
-
-	"github.com/DATA-DOG/go-sqlmock"
-)
-
-// a successful case
-func TestShouldUpdateStats(t *testing.T) {
-	db, mock, err := sqlmock.New()
-	if err != nil {
-		t.Fatalf("an error '%s' was not expected when opening a stub database connection", err)
-	}
-	defer db.Close()
-
-	mock.ExpectBegin()
-	mock.ExpectExec("UPDATE products").WillReturnResult(sqlmock.NewResult(1, 1))
-	mock.ExpectExec("INSERT INTO product_viewers").WithArgs(2, 3).WillReturnResult(sqlmock.NewResult(1, 1))
-	mock.ExpectCommit()
-
-	// now we execute our method
-	if err = recordStats(db, 2, 3); err != nil {
-		t.Errorf("error was not expected while updating stats: %s", err)
-	}
-
-	// we make sure that all expectations were met
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("there were unfulfilled expectations: %s", err)
-	}
-}
-
-// a failing test case
-func TestShouldRollbackStatUpdatesOnFailure(t *testing.T) {
-	db, mock, err := sqlmock.New()
-	if err != nil {
-		t.Fatalf("an error '%s' was not expected when opening a stub database connection", err)
-	}
-	defer db.Close()
-
-	mock.ExpectBegin()
-	mock.ExpectExec("UPDATE products").WillReturnResult(sqlmock.NewResult(1, 1))
-	mock.ExpectExec("INSERT INTO product_viewers").
-		WithArgs(2, 3).
-		WillReturnError(fmt.Errorf("some error"))
-	mock.ExpectRollback()
-
-	// now we execute our method
-	if err = recordStats(db, 2, 3); err == nil {
-		t.Errorf("was expecting an error, but there was none")
-	}
-
-	// we make sure that all expectations were met
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("there were unfulfilled expectations: %s", err)
-	}
-}
-```
-
-## Customize SQL query matching
-
-There were plenty of requests from users regarding SQL query string validation or different matching option.
-We have now implemented the `QueryMatcher` interface, which can be passed through an option when calling
-`sqlmock.New` or `sqlmock.NewWithDSN`.
-
-This now allows to include some library, which would allow for example to parse and validate `mysql` SQL AST.
-And create a custom QueryMatcher in order to validate SQL in sophisticated ways.
-
-By default, **sqlmock** is preserving backward compatibility and default query matcher is `sqlmock.QueryMatcherRegexp`
-which uses expected SQL string as a regular expression to match incoming query string. There is an equality matcher:
-`QueryMatcherEqual` which will do a full case sensitive match.
-
-In order to customize the QueryMatcher, use the following:
-
-``` go
-	db, mock, err := sqlmock.New(sqlmock.QueryMatcherOption(sqlmock.QueryMatcherEqual))
-```
-
-The query matcher can be fully customized based on user needs. **sqlmock** will not
-provide a standard sql parsing matchers, since various drivers may not follow the same SQL standard.
-
-## Matching arguments like time.Time
-
-There may be arguments which are of `struct` type and cannot be compared easily by value like `time.Time`. In this case
-**sqlmock** provides an [Argument](https://godoc.org/github.com/DATA-DOG/go-sqlmock#Argument) interface which
-can be used in more sophisticated matching. Here is a simple example of time argument matching:
-
-``` go
-type AnyTime struct{}
-
-// Match satisfies sqlmock.Argument interface
-func (a AnyTime) Match(v driver.Value) bool {
-	_, ok := v.(time.Time)
-	return ok
-}
-
-func TestAnyTimeArgument(t *testing.T) {
-	t.Parallel()
-	db, mock, err := New()
-	if err != nil {
-		t.Errorf("an error '%s' was not expected when opening a stub database connection", err)
-	}
-	defer db.Close()
-
-	mock.ExpectExec("INSERT INTO users").
-		WithArgs("john", AnyTime{}).
-		WillReturnResult(NewResult(1, 1))
-
-	_, err = db.Exec("INSERT INTO users(name, created_at) VALUES (?, ?)", "john", time.Now())
-	if err != nil {
-		t.Errorf("error '%s' was not expected, while inserting a row", err)
-	}
-
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("there were unfulfilled expectations: %s", err)
-	}
-}
-```
-
-It only asserts that argument is of `time.Time` type.
-
-## Run tests
-
-    go test -race
-
-## Change Log
-
-- **2019-02-13** - added `go.mod` removed the references and suggestions using `gopkg.in`.
-- **2018-12-11** - added expectation of Rows to be closed, while mocking expected query.
-- **2018-12-11** - introduced an option to provide **QueryMatcher** in order to customize SQL query matching.
-- **2017-09-01** - it is now possible to expect that prepared statement will be closed,
-  using **ExpectedPrepare.WillBeClosed**.
-- **2017-02-09** - implemented support for **go1.8** features. **Rows** interface was changed to struct
-  but contains all methods as before and should maintain backwards compatibility. **ExpectedQuery.WillReturnRows** may now
-  accept multiple row sets.
-- **2016-11-02** - `db.Prepare()` was not validating expected prepare SQL
-  query. It should still be validated even if Exec or Query is not
-  executed on that prepared statement.
-- **2016-02-23** - added **sqlmock.AnyArg()** function to provide any kind
-  of argument matcher.
-- **2016-02-23** - convert expected arguments to driver.Value as natural
-  driver does, the change may affect time.Time comparison and will be
-  stricter. See [issue](https://github.com/DATA-DOG/go-sqlmock/issues/31).
-- **2015-08-27** - **v1** api change, concurrency support, all known issues fixed.
-- **2014-08-16** instead of **panic** during reflect type mismatch when comparing query arguments - now return error
-- **2014-08-14** added **sqlmock.NewErrorResult** which gives an option to return driver.Result with errors for
-interface methods, see [issue](https://github.com/DATA-DOG/go-sqlmock/issues/5)
-- **2014-05-29** allow to match arguments in more sophisticated ways, by providing an **sqlmock.Argument** interface
-- **2014-04-21** introduce **sqlmock.New()** to open a mock database connection for tests. This method
-calls sql.DB.Ping to ensure that connection is open, see [issue](https://github.com/DATA-DOG/go-sqlmock/issues/4).
-This way on Close it will surely assert if all expectations are met, even if database was not triggered at all.
-The old way is still available, but it is advisable to call db.Ping manually before asserting with db.Close.
-- **2014-02-14** RowsFromCSVString is now a part of Rows interface named as FromCSVString.
-It has changed to allow more ways to construct rows and to easily extend this API in future.
-See [issue 1](https://github.com/DATA-DOG/go-sqlmock/issues/1)
-**RowsFromCSVString** is deprecated and will be removed in future
-
-## Contributions
-
-Feel free to open a pull request. Note, if you wish to contribute an extension to public (exported methods or types) -
-please open an issue before, to discuss whether these changes can be accepted. All backward incompatible changes are
-and will be treated cautiously
-
-## License
-
-The [three clause BSD license](http://en.wikipedia.org/wiki/BSD_licenses)
-

vendor/github.com/DATA-DOG/go-sqlmock/argument.go

@@ -1,24 +0,0 @@
-package sqlmock
-
-import "database/sql/driver"
-
-// Argument interface allows to match
-// any argument in specific way when used with
-// ExpectedQuery and ExpectedExec expectations.
-type Argument interface {
-	Match(driver.Value) bool
-}
-
-// AnyArg will return an Argument which can
-// match any kind of arguments.
-//
-// Useful for time.Time or similar kinds of arguments.
-func AnyArg() Argument {
-	return anyArgument{}
-}
-
-type anyArgument struct{}
-
-func (a anyArgument) Match(_ driver.Value) bool {
-	return true
-}

vendor/github.com/DATA-DOG/go-sqlmock/driver.go

@@ -1,81 +0,0 @@
-package sqlmock
-
-import (
-	"database/sql"
-	"database/sql/driver"
-	"fmt"
-	"sync"
-)
-
-var pool *mockDriver
-
-func init() {
-	pool = &mockDriver{
-		conns: make(map[string]*sqlmock),
-	}
-	sql.Register("sqlmock", pool)
-}
-
-type mockDriver struct {
-	sync.Mutex
-	counter int
-	conns   map[string]*sqlmock
-}
-
-func (d *mockDriver) Open(dsn string) (driver.Conn, error) {
-	d.Lock()
-	defer d.Unlock()
-
-	c, ok := d.conns[dsn]
-	if !ok {
-		return c, fmt.Errorf("expected a connection to be available, but it is not")
-	}
-
-	c.opened++
-	return c, nil
-}
-
-// New creates sqlmock database connection and a mock to manage expectations.
-// Accepts options, like ValueConverterOption, to use a ValueConverter from
-// a specific driver.
-// Pings db so that all expectations could be
-// asserted.
-func New(options ...func(*sqlmock) error) (*sql.DB, Sqlmock, error) {
-	pool.Lock()
-	dsn := fmt.Sprintf("sqlmock_db_%d", pool.counter)
-	pool.counter++
-
-	smock := &sqlmock{dsn: dsn, drv: pool, ordered: true}
-	pool.conns[dsn] = smock
-	pool.Unlock()
-
-	return smock.open(options)
-}
-
-// NewWithDSN creates sqlmock database connection with a specific DSN
-// and a mock to manage expectations.
-// Accepts options, like ValueConverterOption, to use a ValueConverter from
-// a specific driver.
-// Pings db so that all expectations could be asserted.
-//
-// This method is introduced because of sql abstraction
-// libraries, which do not provide a way to initialize
-// with sql.DB instance. For example GORM library.
-//
-// Note, it will error if attempted to create with an
-// already used dsn
-//
-// It is not recommended to use this method, unless you
-// really need it and there is no other way around.
-func NewWithDSN(dsn string, options ...func(*sqlmock) error) (*sql.DB, Sqlmock, error) {
-	pool.Lock()
-	if _, ok := pool.conns[dsn]; ok {
-		pool.Unlock()
-		return nil, nil, fmt.Errorf("cannot create a new mock database with the same dsn: %s", dsn)
-	}
-	smock := &sqlmock{dsn: dsn, drv: pool, ordered: true}
-	pool.conns[dsn] = smock
-	pool.Unlock()
-
-	return smock.open(options)
-}

vendor/github.com/DATA-DOG/go-sqlmock/expectations.go

@@ -1,355 +0,0 @@
-package sqlmock
-
-import (
-	"database/sql/driver"
-	"fmt"
-	"strings"
-	"sync"
-	"time"
-)
-
-// an expectation interface
-type expectation interface {
-	fulfilled() bool
-	Lock()
-	Unlock()
-	String() string
-}
-
-// common expectation struct
-// satisfies the expectation interface
-type commonExpectation struct {
-	sync.Mutex
-	triggered bool
-	err       error
-}
-
-func (e *commonExpectation) fulfilled() bool {
-	return e.triggered
-}
-
-// ExpectedClose is used to manage *sql.DB.Close expectation
-// returned by *Sqlmock.ExpectClose.
-type ExpectedClose struct {
-	commonExpectation
-}
-
-// WillReturnError allows to set an error for *sql.DB.Close action
-func (e *ExpectedClose) WillReturnError(err error) *ExpectedClose {
-	e.err = err
-	return e
-}
-
-// String returns string representation
-func (e *ExpectedClose) String() string {
-	msg := "ExpectedClose => expecting database Close"
-	if e.err != nil {
-		msg += fmt.Sprintf(", which should return error: %s", e.err)
-	}
-	return msg
-}
-
-// ExpectedBegin is used to manage *sql.DB.Begin expectation
-// returned by *Sqlmock.ExpectBegin.
-type ExpectedBegin struct {
-	commonExpectation
-	delay time.Duration
-}
-
-// WillReturnError allows to set an error for *sql.DB.Begin action
-func (e *ExpectedBegin) WillReturnError(err error) *ExpectedBegin {
-	e.err = err
-	return e
-}
-
-// String returns string representation
-func (e *ExpectedBegin) String() string {
-	msg := "ExpectedBegin => expecting database transaction Begin"
-	if e.err != nil {
-		msg += fmt.Sprintf(", which should return error: %s", e.err)
-	}
-	return msg
-}
-
-// WillDelayFor allows to specify duration for which it will delay
-// result. May be used together with Context
-func (e *ExpectedBegin) WillDelayFor(duration time.Duration) *ExpectedBegin {
-	e.delay = duration
-	return e
-}
-
-// ExpectedCommit is used to manage *sql.Tx.Commit expectation
-// returned by *Sqlmock.ExpectCommit.
-type ExpectedCommit struct {
-	commonExpectation
-}
-
-// WillReturnError allows to set an error for *sql.Tx.Close action
-func (e *ExpectedCommit) WillReturnError(err error) *ExpectedCommit {
-	e.err = err
-	return e
-}
-
-// String returns string representation
-func (e *ExpectedCommit) String() string {
-	msg := "ExpectedCommit => expecting transaction Commit"
-	if e.err != nil {
-		msg += fmt.Sprintf(", which should return error: %s", e.err)
-	}
-	return msg
-}
-
-// ExpectedRollback is used to manage *sql.Tx.Rollback expectation
-// returned by *Sqlmock.ExpectRollback.
-type ExpectedRollback struct {
-	commonExpectation
-}
-
-// WillReturnError allows to set an error for *sql.Tx.Rollback action
-func (e *ExpectedRollback) WillReturnError(err error) *ExpectedRollback {
-	e.err = err
-	return e
-}
-
-// String returns string representation
-func (e *ExpectedRollback) String() string {
-	msg := "ExpectedRollback => expecting transaction Rollback"
-	if e.err != nil {
-		msg += fmt.Sprintf(", which should return error: %s", e.err)
-	}
-	return msg
-}
-
-// ExpectedQuery is used to manage *sql.DB.Query, *dql.DB.QueryRow, *sql.Tx.Query,
-// *sql.Tx.QueryRow, *sql.Stmt.Query or *sql.Stmt.QueryRow expectations.
-// Returned by *Sqlmock.ExpectQuery.
-type ExpectedQuery struct {
-	queryBasedExpectation
-	rows             driver.Rows
-	delay            time.Duration
-	rowsMustBeClosed bool
-	rowsWereClosed   bool
-}
-
-// WithArgs will match given expected args to actual database query arguments.
-// if at least one argument does not match, it will return an error. For specific
-// arguments an sqlmock.Argument interface can be used to match an argument.
-func (e *ExpectedQuery) WithArgs(args ...driver.Value) *ExpectedQuery {
-	e.args = args
-	return e
-}
-
-// RowsWillBeClosed expects this query rows to be closed.
-func (e *ExpectedQuery) RowsWillBeClosed() *ExpectedQuery {
-	e.rowsMustBeClosed = true
-	return e
-}
-
-// WillReturnError allows to set an error for expected database query
-func (e *ExpectedQuery) WillReturnError(err error) *ExpectedQuery {
-	e.err = err
-	return e
-}
-
-// WillDelayFor allows to specify duration for which it will delay
-// result. May be used together with Context
-func (e *ExpectedQuery) WillDelayFor(duration time.Duration) *ExpectedQuery {
-	e.delay = duration
-	return e
-}
-
-// String returns string representation
-func (e *ExpectedQuery) String() string {
-	msg := "ExpectedQuery => expecting Query, QueryContext or QueryRow which:"
-	msg += "\n  - matches sql: '" + e.expectSQL + "'"
-
-	if len(e.args) == 0 {
-		msg += "\n  - is without arguments"
-	} else {
-		msg += "\n  - is with arguments:\n"
-		for i, arg := range e.args {
-			msg += fmt.Sprintf("    %d - %+v\n", i, arg)
-		}
-		msg = strings.TrimSpace(msg)
-	}
-
-	if e.rows != nil {
-		msg += fmt.Sprintf("\n  - %s", e.rows)
-	}
-
-	if e.err != nil {
-		msg += fmt.Sprintf("\n  - should return error: %s", e.err)
-	}
-
-	return msg
-}
-
-// ExpectedExec is used to manage *sql.DB.Exec, *sql.Tx.Exec or *sql.Stmt.Exec expectations.
-// Returned by *Sqlmock.ExpectExec.
-type ExpectedExec struct {
-	queryBasedExpectation
-	result driver.Result
-	delay  time.Duration
-}
-
-// WithArgs will match given expected args to actual database exec operation arguments.
-// if at least one argument does not match, it will return an error. For specific
-// arguments an sqlmock.Argument interface can be used to match an argument.
-func (e *ExpectedExec) WithArgs(args ...driver.Value) *ExpectedExec {
-	e.args = args
-	return e
-}
-
-// WillReturnError allows to set an error for expected database exec action
-func (e *ExpectedExec) WillReturnError(err error) *ExpectedExec {
-	e.err = err
-	return e
-}
-
-// WillDelayFor allows to specify duration for which it will delay
-// result. May be used together with Context
-func (e *ExpectedExec) WillDelayFor(duration time.Duration) *ExpectedExec {
-	e.delay = duration
-	return e
-}
-
-// String returns string representation
-func (e *ExpectedExec) String() string {
-	msg := "ExpectedExec => expecting Exec or ExecContext which:"
-	msg += "\n  - matches sql: '" + e.expectSQL + "'"
-
-	if len(e.args) == 0 {
-		msg += "\n  - is without arguments"
-	} else {
-		msg += "\n  - is with arguments:\n"
-		var margs []string
-		for i, arg := range e.args {
-			margs = append(margs, fmt.Sprintf("    %d - %+v", i, arg))
-		}
-		msg += strings.Join(margs, "\n")
-	}
-
-	if e.result != nil {
-		res, _ := e.result.(*result)
-		msg += "\n  - should return Result having:"
-		msg += fmt.Sprintf("\n      LastInsertId: %d", res.insertID)
-		msg += fmt.Sprintf("\n      RowsAffected: %d", res.rowsAffected)
-		if res.err != nil {
-			msg += fmt.Sprintf("\n      Error: %s", res.err)
-		}
-	}
-
-	if e.err != nil {
-		msg += fmt.Sprintf("\n  - should return error: %s", e.err)
-	}
-
-	return msg
-}
-
-// WillReturnResult arranges for an expected Exec() to return a particular
-// result, there is sqlmock.NewResult(lastInsertID int64, affectedRows int64) method
-// to build a corresponding result. Or if actions needs to be tested against errors
-// sqlmock.NewErrorResult(err error) to return a given error.
-func (e *ExpectedExec) WillReturnResult(result driver.Result) *ExpectedExec {
-	e.result = result
-	return e
-}
-
-// ExpectedPrepare is used to manage *sql.DB.Prepare or *sql.Tx.Prepare expectations.
-// Returned by *Sqlmock.ExpectPrepare.
-type ExpectedPrepare struct {
-	commonExpectation
-	mock         *sqlmock
-	expectSQL    string
-	statement    driver.Stmt
-	closeErr     error
-	mustBeClosed bool
-	wasClosed    bool
-	delay        time.Duration
-}
-
-// WillReturnError allows to set an error for the expected *sql.DB.Prepare or *sql.Tx.Prepare action.
-func (e *ExpectedPrepare) WillReturnError(err error) *ExpectedPrepare {
-	e.err = err
-	return e
-}
-
-// WillReturnCloseError allows to set an error for this prepared statement Close action
-func (e *ExpectedPrepare) WillReturnCloseError(err error) *ExpectedPrepare {
-	e.closeErr = err
-	return e
-}
-
-// WillDelayFor allows to specify duration for which it will delay
-// result. May be used together with Context
-func (e *ExpectedPrepare) WillDelayFor(duration time.Duration) *ExpectedPrepare {
-	e.delay = duration
-	return e
-}
-
-// WillBeClosed expects this prepared statement to
-// be closed.
-func (e *ExpectedPrepare) WillBeClosed() *ExpectedPrepare {
-	e.mustBeClosed = true
-	return e
-}
-
-// ExpectQuery allows to expect Query() or QueryRow() on this prepared statement.
-// This method is convenient in order to prevent duplicating sql query string matching.
-func (e *ExpectedPrepare) ExpectQuery() *ExpectedQuery {
-	eq := &ExpectedQuery{}
-	eq.expectSQL = e.expectSQL
-	eq.converter = e.mock.converter
-	e.mock.expected = append(e.mock.expected, eq)
-	return eq
-}
-
-// ExpectExec allows to expect Exec() on this prepared statement.
-// This method is convenient in order to prevent duplicating sql query string matching.
-func (e *ExpectedPrepare) ExpectExec() *ExpectedExec {
-	eq := &ExpectedExec{}
-	eq.expectSQL = e.expectSQL
-	eq.converter = e.mock.converter
-	e.mock.expected = append(e.mock.expected, eq)
-	return eq
-}
-
-// String returns string representation
-func (e *ExpectedPrepare) String() string {
-	msg := "ExpectedPrepare => expecting Prepare statement which:"
-	msg += "\n  - matches sql: '" + e.expectSQL + "'"
-
-	if e.err != nil {
-		msg += fmt.Sprintf("\n  - should return error: %s", e.err)
-	}
-
-	if e.closeErr != nil {
-		msg += fmt.Sprintf("\n  - should return error on Close: %s", e.closeErr)
-	}
-
-	return msg
-}
-
-// query based expectation
-// adds a query matching logic
-type queryBasedExpectation struct {
-	commonExpectation
-	expectSQL string
-	converter driver.ValueConverter
-	args      []driver.Value
-}
-
-func (e *queryBasedExpectation) attemptArgMatch(args []namedValue) (err error) {
-	// catch panic
-	defer func() {
-		if e := recover(); e != nil {
-			_, ok := e.(error)
-			if !ok {
-				err = fmt.Errorf(e.(string))
-			}
-		}
-	}()
-
-	err = e.argsMatches(args)
-	return
-}

vendor/github.com/DATA-DOG/go-sqlmock/expectations_before_go18.go

@@ -1,52 +0,0 @@
-// +build !go1.8
-
-package sqlmock
-
-import (
-	"database/sql/driver"
-	"fmt"
-	"reflect"
-)
-
-// WillReturnRows specifies the set of resulting rows that will be returned
-// by the triggered query
-func (e *ExpectedQuery) WillReturnRows(rows *Rows) *ExpectedQuery {
-	e.rows = &rowSets{sets: []*Rows{rows}, ex: e}
-	return e
-}
-
-func (e *queryBasedExpectation) argsMatches(args []namedValue) error {
-	if nil == e.args {
-		return nil
-	}
-	if len(args) != len(e.args) {
-		return fmt.Errorf("expected %d, but got %d arguments", len(e.args), len(args))
-	}
-	for k, v := range args {
-		// custom argument matcher
-		matcher, ok := e.args[k].(Argument)
-		if ok {
-			// @TODO: does it make sense to pass value instead of named value?
-			if !matcher.Match(v.Value) {
-				return fmt.Errorf("matcher %T could not match %d argument %T - %+v", matcher, k, args[k], args[k])
-			}
-			continue
-		}
-
-		dval := e.args[k]
-		// convert to driver converter
-		darg, err := e.converter.ConvertValue(dval)
-		if err != nil {
-			return fmt.Errorf("could not convert %d argument %T - %+v to driver value: %s", k, e.args[k], e.args[k], err)
-		}
-
-		if !driver.IsValue(darg) {
-			return fmt.Errorf("argument %d: non-subset type %T returned from Value", k, darg)
-		}
-
-		if !reflect.DeepEqual(darg, v.Value) {
-			return fmt.Errorf("argument %d expected [%T - %+v] does not match actual [%T - %+v]", k, darg, darg, v.Value, v.Value)
-		}
-	}
-	return nil
-}

vendor/github.com/DATA-DOG/go-sqlmock/expectations_go18.go

@@ -1,66 +0,0 @@
-// +build go1.8
-
-package sqlmock
-
-import (
-	"database/sql"
-	"database/sql/driver"
-	"fmt"
-	"reflect"
-)
-
-// WillReturnRows specifies the set of resulting rows that will be returned
-// by the triggered query
-func (e *ExpectedQuery) WillReturnRows(rows ...*Rows) *ExpectedQuery {
-	sets := make([]*Rows, len(rows))
-	for i, r := range rows {
-		sets[i] = r
-	}
-	e.rows = &rowSets{sets: sets, ex: e}
-	return e
-}
-
-func (e *queryBasedExpectation) argsMatches(args []namedValue) error {
-	if nil == e.args {
-		return nil
-	}
-	if len(args) != len(e.args) {
-		return fmt.Errorf("expected %d, but got %d arguments", len(e.args), len(args))
-	}
-	// @TODO should we assert either all args are named or ordinal?
-	for k, v := range args {
-		// custom argument matcher
-		matcher, ok := e.args[k].(Argument)
-		if ok {
-			if !matcher.Match(v.Value) {
-				return fmt.Errorf("matcher %T could not match %d argument %T - %+v", matcher, k, args[k], args[k])
-			}
-			continue
-		}
-
-		dval := e.args[k]
-		if named, isNamed := dval.(sql.NamedArg); isNamed {
-			dval = named.Value
-			if v.Name != named.Name {
-				return fmt.Errorf("named argument %d: name: \"%s\" does not match expected: \"%s\"", k, v.Name, named.Name)
-			}
-		} else if k+1 != v.Ordinal {
-			return fmt.Errorf("argument %d: ordinal position: %d does not match expected: %d", k, k+1, v.Ordinal)
-		}
-
-		// convert to driver converter
-		darg, err := e.converter.ConvertValue(dval)
-		if err != nil {
-			return fmt.Errorf("could not convert %d argument %T - %+v to driver value: %s", k, e.args[k], e.args[k], err)
-		}
-
-		if !driver.IsValue(darg) {
-			return fmt.Errorf("argument %d: non-subset type %T returned from Value", k, darg)
-		}
-
-		if !reflect.DeepEqual(darg, v.Value) {
-			return fmt.Errorf("argument %d expected [%T - %+v] does not match actual [%T - %+v]", k, darg, darg, v.Value, v.Value)
-		}
-	}
-	return nil
-}

vendor/github.com/DATA-DOG/go-sqlmock/go.mod

@@ -1 +0,0 @@
-module github.com/DATA-DOG/go-sqlmock

vendor/github.com/DATA-DOG/go-sqlmock/options.go

@@ -1,22 +0,0 @@
-package sqlmock
-
-import "database/sql/driver"
-
-// ValueConverterOption allows to create a sqlmock connection
-// with a custom ValueConverter to support drivers with special data types.
-func ValueConverterOption(converter driver.ValueConverter) func(*sqlmock) error {
-	return func(s *sqlmock) error {
-		s.converter = converter
-		return nil
-	}
-}
-
-// QueryMatcherOption allows to customize SQL query matcher
-// and match SQL query strings in more sophisticated ways.
-// The default QueryMatcher is QueryMatcherRegexp.
-func QueryMatcherOption(queryMatcher QueryMatcher) func(*sqlmock) error {
-	return func(s *sqlmock) error {
-		s.queryMatcher = queryMatcher
-		return nil
-	}
-}

vendor/github.com/DATA-DOG/go-sqlmock/query.go

@@ -1,68 +0,0 @@
-package sqlmock
-
-import (
-	"fmt"
-	"regexp"
-	"strings"
-)
-
-var re = regexp.MustCompile("\\s+")
-
-// strip out new lines and trim spaces
-func stripQuery(q string) (s string) {
-	return strings.TrimSpace(re.ReplaceAllString(q, " "))
-}
-
-// QueryMatcher is an SQL query string matcher interface,
-// which can be used to customize validation of SQL query strings.
-// As an example, external library could be used to build
-// and validate SQL ast, columns selected.
-//
-// sqlmock can be customized to implement a different QueryMatcher
-// configured through an option when sqlmock.New or sqlmock.NewWithDSN
-// is called, default QueryMatcher is QueryMatcherRegexp.
-type QueryMatcher interface {
-
-	// Match expected SQL query string without whitespace to
-	// actual SQL.
-	Match(expectedSQL, actualSQL string) error
-}
-
-// QueryMatcherFunc type is an adapter to allow the use of
-// ordinary functions as QueryMatcher. If f is a function
-// with the appropriate signature, QueryMatcherFunc(f) is a
-// QueryMatcher that calls f.
-type QueryMatcherFunc func(expectedSQL, actualSQL string) error
-
-// Match implements the QueryMatcher
-func (f QueryMatcherFunc) Match(expectedSQL, actualSQL string) error {
-	return f(expectedSQL, actualSQL)
-}
-
-// QueryMatcherRegexp is the default SQL query matcher
-// used by sqlmock. It parses expectedSQL to a regular
-// expression and attempts to match actualSQL.
-var QueryMatcherRegexp QueryMatcher = QueryMatcherFunc(func(expectedSQL, actualSQL string) error {
-	expect := stripQuery(expectedSQL)
-	actual := stripQuery(actualSQL)
-	re, err := regexp.Compile(expect)
-	if err != nil {
-		return err
-	}
-	if !re.MatchString(actual) {
-		return fmt.Errorf(`could not match actual sql: "%s" with expected regexp "%s"`, actual, re.String())
-	}
-	return nil
-})
-
-// QueryMatcherEqual is the SQL query matcher
-// which simply tries a case sensitive match of
-// expected and actual SQL strings without whitespace.
-var QueryMatcherEqual QueryMatcher = QueryMatcherFunc(func(expectedSQL, actualSQL string) error {
-	expect := stripQuery(expectedSQL)
-	actual := stripQuery(actualSQL)
-	if actual != expect {
-		return fmt.Errorf(`actual sql: "%s" does not equal to expected "%s"`, actual, expect)
-	}
-	return nil
-})

vendor/github.com/DATA-DOG/go-sqlmock/result.go

@@ -1,39 +0,0 @@
-package sqlmock
-
-import (
-	"database/sql/driver"
-)
-
-// Result satisfies sql driver Result, which
-// holds last insert id and rows affected
-// by Exec queries
-type result struct {
-	insertID     int64
-	rowsAffected int64
-	err          error
-}
-
-// NewResult creates a new sql driver Result
-// for Exec based query mocks.
-func NewResult(lastInsertID int64, rowsAffected int64) driver.Result {
-	return &result{
-		insertID:     lastInsertID,
-		rowsAffected: rowsAffected,
-	}
-}
-
-// NewErrorResult creates a new sql driver Result
-// which returns an error given for both interface methods
-func NewErrorResult(err error) driver.Result {
-	return &result{
-		err: err,
-	}
-}
-
-func (r *result) LastInsertId() (int64, error) {
-	return r.insertID, r.err
-}
-
-func (r *result) RowsAffected() (int64, error) {
-	return r.rowsAffected, r.err
-}

vendor/github.com/DATA-DOG/go-sqlmock/rows.go

@@ -1,176 +0,0 @@
-package sqlmock
-
-import (
-	"database/sql/driver"
-	"encoding/csv"
-	"fmt"
-	"io"
-	"strings"
-)
-
-// CSVColumnParser is a function which converts trimmed csv
-// column string to a []byte representation. Currently
-// transforms NULL to nil
-var CSVColumnParser = func(s string) []byte {
-	switch {
-	case strings.ToLower(s) == "null":
-		return nil
-	}
-	return []byte(s)
-}
-
-type rowSets struct {
-	sets []*Rows
-	pos  int
-	ex   *ExpectedQuery
-}
-
-func (rs *rowSets) Columns() []string {
-	return rs.sets[rs.pos].cols
-}
-
-func (rs *rowSets) Close() error {
-	rs.ex.rowsWereClosed = true
-	return rs.sets[rs.pos].closeErr
-}
-
-// advances to next row
-func (rs *rowSets) Next(dest []driver.Value) error {
-	r := rs.sets[rs.pos]
-	r.pos++
-	if r.pos > len(r.rows) {
-		return io.EOF // per interface spec
-	}
-
-	for i, col := range r.rows[r.pos-1] {
-		dest[i] = col
-	}
-
-	return r.nextErr[r.pos-1]
-}
-
-// transforms to debuggable printable string
-func (rs *rowSets) String() string {
-	if rs.empty() {
-		return "with empty rows"
-	}
-
-	msg := "should return rows:\n"
-	if len(rs.sets) == 1 {
-		for n, row := range rs.sets[0].rows {
-			msg += fmt.Sprintf("    row %d - %+v\n", n, row)
-		}
-		return strings.TrimSpace(msg)
-	}
-	for i, set := range rs.sets {
-		msg += fmt.Sprintf("    result set: %d\n", i)
-		for n, row := range set.rows {
-			msg += fmt.Sprintf("      row %d - %+v\n", n, row)
-		}
-	}
-	return strings.TrimSpace(msg)
-}
-
-func (rs *rowSets) empty() bool {
-	for _, set := range rs.sets {
-		if len(set.rows) > 0 {
-			return false
-		}
-	}
-	return true
-}
-
-// Rows is a mocked collection of rows to
-// return for Query result
-type Rows struct {
-	converter driver.ValueConverter
-	cols      []string
-	rows      [][]driver.Value
-	pos       int
-	nextErr   map[int]error
-	closeErr  error
-}
-
-// NewRows allows Rows to be created from a
-// sql driver.Value slice or from the CSV string and
-// to be used as sql driver.Rows.
-// Use Sqlmock.NewRows instead if using a custom converter
-func NewRows(columns []string) *Rows {
-	return &Rows{
-		cols:      columns,
-		nextErr:   make(map[int]error),
-		converter: driver.DefaultParameterConverter,
-	}
-}
-
-// CloseError allows to set an error
-// which will be returned by rows.Close
-// function.
-//
-// The close error will be triggered only in cases
-// when rows.Next() EOF was not yet reached, that is
-// a default sql library behavior
-func (r *Rows) CloseError(err error) *Rows {
-	r.closeErr = err
-	return r
-}
-
-// RowError allows to set an error
-// which will be returned when a given
-// row number is read
-func (r *Rows) RowError(row int, err error) *Rows {
-	r.nextErr[row] = err
-	return r
-}
-
-// AddRow composed from database driver.Value slice
-// return the same instance to perform subsequent actions.
-// Note that the number of values must match the number
-// of columns
-func (r *Rows) AddRow(values ...driver.Value) *Rows {
-	if len(values) != len(r.cols) {
-		panic("Expected number of values to match number of columns")
-	}
-
-	row := make([]driver.Value, len(r.cols))
-	for i, v := range values {
-		// Convert user-friendly values (such as int or driver.Valuer)
-		// to database/sql native value (driver.Value such as int64)
-		var err error
-		v, err = r.converter.ConvertValue(v)
-		if err != nil {
-			panic(fmt.Errorf(
-				"row #%d, column #%d (%q) type %T: %s",
-				len(r.rows)+1, i, r.cols[i], values[i], err,
-			))
-		}
-
-		row[i] = v
-	}
-
-	r.rows = append(r.rows, row)
-	return r
-}
-
-// FromCSVString build rows from csv string.
-// return the same instance to perform subsequent actions.
-// Note that the number of values must match the number
-// of columns
-func (r *Rows) FromCSVString(s string) *Rows {
-	res := strings.NewReader(strings.TrimSpace(s))
-	csvReader := csv.NewReader(res)
-
-	for {
-		res, err := csvReader.Read()
-		if err != nil || res == nil {
-			break
-		}
-
-		row := make([]driver.Value, len(r.cols))
-		for i, v := range res {
-			row[i] = CSVColumnParser(strings.TrimSpace(v))
-		}
-		r.rows = append(r.rows, row)
-	}
-	return r
-}

vendor/github.com/DATA-DOG/go-sqlmock/rows_go18.go

@@ -1,20 +0,0 @@
-// +build go1.8
-
-package sqlmock
-
-import "io"
-
-// Implement the "RowsNextResultSet" interface
-func (rs *rowSets) HasNextResultSet() bool {
-	return rs.pos+1 < len(rs.sets)
-}
-
-// Implement the "RowsNextResultSet" interface
-func (rs *rowSets) NextResultSet() error {
-	if !rs.HasNextResultSet() {
-		return io.EOF
-	}
-
-	rs.pos++
-	return nil
-}

vendor/github.com/DATA-DOG/go-sqlmock/sqlmock.go

@@ -1,589 +0,0 @@
-/*
-Package sqlmock is a mock library implementing sql driver. Which has one and only
-purpose - to simulate any sql driver behavior in tests, without needing a real
-database connection. It helps to maintain correct **TDD** workflow.
-
-It does not require any modifications to your source code in order to test
-and mock database operations. Supports concurrency and multiple database mocking.
-
-The driver allows to mock any sql driver method behavior.
-*/
-package sqlmock
-
-import (
-	"database/sql"
-	"database/sql/driver"
-	"fmt"
-	"time"
-)
-
-// Sqlmock interface serves to create expectations
-// for any kind of database action in order to mock
-// and test real database behavior.
-type Sqlmock interface {
-
-	// ExpectClose queues an expectation for this database
-	// action to be triggered. the *ExpectedClose allows
-	// to mock database response
-	ExpectClose() *ExpectedClose
-
-	// ExpectationsWereMet checks whether all queued expectations
-	// were met in order. If any of them was not met - an error is returned.
-	ExpectationsWereMet() error
-
-	// ExpectPrepare expects Prepare() to be called with expectedSQL query.
-	// the *ExpectedPrepare allows to mock database response.
-	// Note that you may expect Query() or Exec() on the *ExpectedPrepare
-	// statement to prevent repeating expectedSQL
-	ExpectPrepare(expectedSQL string) *ExpectedPrepare
-
-	// ExpectQuery expects Query() or QueryRow() to be called with expectedSQL query.
-	// the *ExpectedQuery allows to mock database response.
-	ExpectQuery(expectedSQL string) *ExpectedQuery
-
-	// ExpectExec expects Exec() to be called with expectedSQL query.
-	// the *ExpectedExec allows to mock database response
-	ExpectExec(expectedSQL string) *ExpectedExec
-
-	// ExpectBegin expects *sql.DB.Begin to be called.
-	// the *ExpectedBegin allows to mock database response
-	ExpectBegin() *ExpectedBegin
-
-	// ExpectCommit expects *sql.Tx.Commit to be called.
-	// the *ExpectedCommit allows to mock database response
-	ExpectCommit() *ExpectedCommit
-
-	// ExpectRollback expects *sql.Tx.Rollback to be called.
-	// the *ExpectedRollback allows to mock database response
-	ExpectRollback() *ExpectedRollback
-
-	// MatchExpectationsInOrder gives an option whether to match all
-	// expectations in the order they were set or not.
-	//
-	// By default it is set to - true. But if you use goroutines
-	// to parallelize your query executation, that option may
-	// be handy.
-	//
-	// This option may be turned on anytime during tests. As soon
-	// as it is switched to false, expectations will be matched
-	// in any order. Or otherwise if switched to true, any unmatched
-	// expectations will be expected in order
-	MatchExpectationsInOrder(bool)
-
-	// NewRows allows Rows to be created from a
-	// sql driver.Value slice or from the CSV string and
-	// to be used as sql driver.Rows.
-	NewRows(columns []string) *Rows
-}
-
-type sqlmock struct {
-	ordered      bool
-	dsn          string
-	opened       int
-	drv          *mockDriver
-	converter    driver.ValueConverter
-	queryMatcher QueryMatcher
-
-	expected []expectation
-}
-
-func (c *sqlmock) open(options []func(*sqlmock) error) (*sql.DB, Sqlmock, error) {
-	db, err := sql.Open("sqlmock", c.dsn)
-	if err != nil {
-		return db, c, err
-	}
-	for _, option := range options {
-		err := option(c)
-		if err != nil {
-			return db, c, err
-		}
-	}
-	if c.converter == nil {
-		c.converter = driver.DefaultParameterConverter
-	}
-	if c.queryMatcher == nil {
-		c.queryMatcher = QueryMatcherRegexp
-	}
-	return db, c, db.Ping()
-}
-
-func (c *sqlmock) ExpectClose() *ExpectedClose {
-	e := &ExpectedClose{}
-	c.expected = append(c.expected, e)
-	return e
-}
-
-func (c *sqlmock) MatchExpectationsInOrder(b bool) {
-	c.ordered = b
-}
-
-// Close a mock database driver connection. It may or may not
-// be called depending on the circumstances, but if it is called
-// there must be an *ExpectedClose expectation satisfied.
-// meets http://golang.org/pkg/database/sql/driver/#Conn interface
-func (c *sqlmock) Close() error {
-	c.drv.Lock()
-	defer c.drv.Unlock()
-
-	c.opened--
-	if c.opened == 0 {
-		delete(c.drv.conns, c.dsn)
-	}
-
-	var expected *ExpectedClose
-	var fulfilled int
-	var ok bool
-	for _, next := range c.expected {
-		next.Lock()
-		if next.fulfilled() {
-			next.Unlock()
-			fulfilled++
-			continue
-		}
-
-		if expected, ok = next.(*ExpectedClose); ok {
-			break
-		}
-
-		next.Unlock()
-		if c.ordered {
-			return fmt.Errorf("call to database Close, was not expected, next expectation is: %s", next)
-		}
-	}
-
-	if expected == nil {
-		msg := "call to database Close was not expected"
-		if fulfilled == len(c.expected) {
-			msg = "all expectations were already fulfilled, " + msg
-		}
-		return fmt.Errorf(msg)
-	}
-
-	expected.triggered = true
-	expected.Unlock()
-	return expected.err
-}
-
-func (c *sqlmock) ExpectationsWereMet() error {
-	for _, e := range c.expected {
-		e.Lock()
-		fulfilled := e.fulfilled()
-		e.Unlock()
-
-		if !fulfilled {
-			return fmt.Errorf("there is a remaining expectation which was not matched: %s", e)
-		}
-
-		// for expected prepared statement check whether it was closed if expected
-		if prep, ok := e.(*ExpectedPrepare); ok {
-			if prep.mustBeClosed && !prep.wasClosed {
-				return fmt.Errorf("expected prepared statement to be closed, but it was not: %s", prep)
-			}
-		}
-
-		// must check whether all expected queried rows are closed
-		if query, ok := e.(*ExpectedQuery); ok {
-			if query.rowsMustBeClosed && !query.rowsWereClosed {
-				return fmt.Errorf("expected query rows to be closed, but it was not: %s", query)
-			}
-		}
-	}
-	return nil
-}
-
-// Begin meets http://golang.org/pkg/database/sql/driver/#Conn interface
-func (c *sqlmock) Begin() (driver.Tx, error) {
-	ex, err := c.begin()
-	if ex != nil {
-		time.Sleep(ex.delay)
-	}
-	if err != nil {
-		return nil, err
-	}
-
-	return c, nil
-}
-
-func (c *sqlmock) begin() (*ExpectedBegin, error) {
-	var expected *ExpectedBegin
-	var ok bool
-	var fulfilled int
-	for _, next := range c.expected {
-		next.Lock()
-		if next.fulfilled() {
-			next.Unlock()
-			fulfilled++
-			continue
-		}
-
-		if expected, ok = next.(*ExpectedBegin); ok {
-			break
-		}
-
-		next.Unlock()
-		if c.ordered {
-			return nil, fmt.Errorf("call to database transaction Begin, was not expected, next expectation is: %s", next)
-		}
-	}
-	if expected == nil {
-		msg := "call to database transaction Begin was not expected"
-		if fulfilled == len(c.expected) {
-			msg = "all expectations were already fulfilled, " + msg
-		}
-		return nil, fmt.Errorf(msg)
-	}
-
-	expected.triggered = true
-	expected.Unlock()
-
-	return expected, expected.err
-}
-
-func (c *sqlmock) ExpectBegin() *ExpectedBegin {
-	e := &ExpectedBegin{}
-	c.expected = append(c.expected, e)
-	return e
-}
-
-// Exec meets http://golang.org/pkg/database/sql/driver/#Execer
-func (c *sqlmock) Exec(query string, args []driver.Value) (driver.Result, error) {
-	namedArgs := make([]namedValue, len(args))
-	for i, v := range args {
-		namedArgs[i] = namedValue{
-			Ordinal: i + 1,
-			Value:   v,
-		}
-	}
-
-	ex, err := c.exec(query, namedArgs)
-	if ex != nil {
-		time.Sleep(ex.delay)
-	}
-	if err != nil {
-		return nil, err
-	}
-
-	return ex.result, nil
-}
-
-func (c *sqlmock) exec(query string, args []namedValue) (*ExpectedExec, error) {
-	var expected *ExpectedExec
-	var fulfilled int
-	var ok bool
-	for _, next := range c.expected {
-		next.Lock()
-		if next.fulfilled() {
-			next.Unlock()
-			fulfilled++
-			continue
-		}
-
-		if c.ordered {
-			if expected, ok = next.(*ExpectedExec); ok {
-				break
-			}
-			next.Unlock()
-			return nil, fmt.Errorf("call to ExecQuery '%s' with args %+v, was not expected, next expectation is: %s", query, args, next)
-		}
-		if exec, ok := next.(*ExpectedExec); ok {
-			if err := c.queryMatcher.Match(exec.expectSQL, query); err != nil {
-				next.Unlock()
-				continue
-			}
-
-			if err := exec.attemptArgMatch(args); err == nil {
-				expected = exec
-				break
-			}
-		}
-		next.Unlock()
-	}
-	if expected == nil {
-		msg := "call to ExecQuery '%s' with args %+v was not expected"
-		if fulfilled == len(c.expected) {
-			msg = "all expectations were already fulfilled, " + msg
-		}
-		return nil, fmt.Errorf(msg, query, args)
-	}
-	defer expected.Unlock()
-
-	if err := c.queryMatcher.Match(expected.expectSQL, query); err != nil {
-		return nil, fmt.Errorf("ExecQuery: %v", err)
-	}
-
-	if err := expected.argsMatches(args); err != nil {
-		return nil, fmt.Errorf("ExecQuery '%s', arguments do not match: %s", query, err)
-	}
-
-	expected.triggered = true
-	if expected.err != nil {
-		return expected, expected.err // mocked to return error
-	}
-
-	if expected.result == nil {
-		return nil, fmt.Errorf("ExecQuery '%s' with args %+v, must return a database/sql/driver.Result, but it was not set for expectation %T as %+v", query, args, expected, expected)
-	}
-
-	return expected, nil
-}
-
-func (c *sqlmock) ExpectExec(expectedSQL string) *ExpectedExec {
-	e := &ExpectedExec{}
-	e.expectSQL = expectedSQL
-	e.converter = c.converter
-	c.expected = append(c.expected, e)
-	return e
-}
-
-// Prepare meets http://golang.org/pkg/database/sql/driver/#Conn interface
-func (c *sqlmock) Prepare(query string) (driver.Stmt, error) {
-	ex, err := c.prepare(query)
-	if ex != nil {
-		time.Sleep(ex.delay)
-	}
-	if err != nil {
-		return nil, err
-	}
-
-	return &statement{c, ex, query}, nil
-}
-
-func (c *sqlmock) prepare(query string) (*ExpectedPrepare, error) {
-	var expected *ExpectedPrepare
-	var fulfilled int
-	var ok bool
-
-	for _, next := range c.expected {
-		next.Lock()
-		if next.fulfilled() {
-			next.Unlock()
-			fulfilled++
-			continue
-		}
-
-		if c.ordered {
-			if expected, ok = next.(*ExpectedPrepare); ok {
-				break
-			}
-
-			next.Unlock()
-			return nil, fmt.Errorf("call to Prepare statement with query '%s', was not expected, next expectation is: %s", query, next)
-		}
-
-		if pr, ok := next.(*ExpectedPrepare); ok {
-			if err := c.queryMatcher.Match(pr.expectSQL, query); err == nil {
-				expected = pr
-				break
-			}
-		}
-		next.Unlock()
-	}
-
-	if expected == nil {
-		msg := "call to Prepare '%s' query was not expected"
-		if fulfilled == len(c.expected) {
-			msg = "all expectations were already fulfilled, " + msg
-		}
-		return nil, fmt.Errorf(msg, query)
-	}
-	defer expected.Unlock()
-	if err := c.queryMatcher.Match(expected.expectSQL, query); err != nil {
-		return nil, fmt.Errorf("Prepare: %v", err)
-	}
-
-	expected.triggered = true
-	return expected, expected.err
-}
-
-func (c *sqlmock) ExpectPrepare(expectedSQL string) *ExpectedPrepare {
-	e := &ExpectedPrepare{expectSQL: expectedSQL, mock: c}
-	c.expected = append(c.expected, e)
-	return e
-}
-
-type namedValue struct {
-	Name    string
-	Ordinal int
-	Value   driver.Value
-}
-
-// Query meets http://golang.org/pkg/database/sql/driver/#Queryer
-func (c *sqlmock) Query(query string, args []driver.Value) (driver.Rows, error) {
-	namedArgs := make([]namedValue, len(args))
-	for i, v := range args {
-		namedArgs[i] = namedValue{
-			Ordinal: i + 1,
-			Value:   v,
-		}
-	}
-
-	ex, err := c.query(query, namedArgs)
-	if ex != nil {
-		time.Sleep(ex.delay)
-	}
-	if err != nil {
-		return nil, err
-	}
-
-	return ex.rows, nil
-}
-
-func (c *sqlmock) query(query string, args []namedValue) (*ExpectedQuery, error) {
-	var expected *ExpectedQuery
-	var fulfilled int
-	var ok bool
-	for _, next := range c.expected {
-		next.Lock()
-		if next.fulfilled() {
-			next.Unlock()
-			fulfilled++
-			continue
-		}
-
-		if c.ordered {
-			if expected, ok = next.(*ExpectedQuery); ok {
-				break
-			}
-			next.Unlock()
-			return nil, fmt.Errorf("call to Query '%s' with args %+v, was not expected, next expectation is: %s", query, args, next)
-		}
-		if qr, ok := next.(*ExpectedQuery); ok {
-			if err := c.queryMatcher.Match(qr.expectSQL, query); err != nil {
-				next.Unlock()
-				continue
-			}
-			if err := qr.attemptArgMatch(args); err == nil {
-				expected = qr
-				break
-			}
-		}
-		next.Unlock()
-	}
-
-	if expected == nil {
-		msg := "call to Query '%s' with args %+v was not expected"
-		if fulfilled == len(c.expected) {
-			msg = "all expectations were already fulfilled, " + msg
-		}
-		return nil, fmt.Errorf(msg, query, args)
-	}
-
-	defer expected.Unlock()
-
-	if err := c.queryMatcher.Match(expected.expectSQL, query); err != nil {
-		return nil, fmt.Errorf("Query: %v", err)
-	}
-
-	if err := expected.argsMatches(args); err != nil {
-		return nil, fmt.Errorf("Query '%s', arguments do not match: %s", query, err)
-	}
-
-	expected.triggered = true
-	if expected.err != nil {
-		return expected, expected.err // mocked to return error
-	}
-
-	if expected.rows == nil {
-		return nil, fmt.Errorf("Query '%s' with args %+v, must return a database/sql/driver.Rows, but it was not set for expectation %T as %+v", query, args, expected, expected)
-	}
-	return expected, nil
-}
-
-func (c *sqlmock) ExpectQuery(expectedSQL string) *ExpectedQuery {
-	e := &ExpectedQuery{}
-	e.expectSQL = expectedSQL
-	e.converter = c.converter
-	c.expected = append(c.expected, e)
-	return e
-}
-
-func (c *sqlmock) ExpectCommit() *ExpectedCommit {
-	e := &ExpectedCommit{}
-	c.expected = append(c.expected, e)
-	return e
-}
-
-func (c *sqlmock) ExpectRollback() *ExpectedRollback {
-	e := &ExpectedRollback{}
-	c.expected = append(c.expected, e)
-	return e
-}
-
-// Commit meets http://golang.org/pkg/database/sql/driver/#Tx
-func (c *sqlmock) Commit() error {
-	var expected *ExpectedCommit
-	var fulfilled int
-	var ok bool
-	for _, next := range c.expected {
-		next.Lock()
-		if next.fulfilled() {
-			next.Unlock()
-			fulfilled++
-			continue
-		}
-
-		if expected, ok = next.(*ExpectedCommit); ok {
-			break
-		}
-
-		next.Unlock()
-		if c.ordered {
-			return fmt.Errorf("call to Commit transaction, was not expected, next expectation is: %s", next)
-		}
-	}
-	if expected == nil {
-		msg := "call to Commit transaction was not expected"
-		if fulfilled == len(c.expected) {
-			msg = "all expectations were already fulfilled, " + msg
-		}
-		return fmt.Errorf(msg)
-	}
-
-	expected.triggered = true
-	expected.Unlock()
-	return expected.err
-}
-
-// Rollback meets http://golang.org/pkg/database/sql/driver/#Tx
-func (c *sqlmock) Rollback() error {
-	var expected *ExpectedRollback
-	var fulfilled int
-	var ok bool
-	for _, next := range c.expected {
-		next.Lock()
-		if next.fulfilled() {
-			next.Unlock()
-			fulfilled++
-			continue
-		}
-
-		if expected, ok = next.(*ExpectedRollback); ok {
-			break
-		}
-
-		next.Unlock()
-		if c.ordered {
-			return fmt.Errorf("call to Rollback transaction, was not expected, next expectation is: %s", next)
-		}
-	}
-	if expected == nil {
-		msg := "call to Rollback transaction was not expected"
-		if fulfilled == len(c.expected) {
-			msg = "all expectations were already fulfilled, " + msg
-		}
-		return fmt.Errorf(msg)
-	}
-
-	expected.triggered = true
-	expected.Unlock()
-	return expected.err
-}
-
-// NewRows allows Rows to be created from a
-// sql driver.Value slice or from the CSV string and
-// to be used as sql driver.Rows.
-func (c *sqlmock) NewRows(columns []string) *Rows {
-	r := NewRows(columns)
-	r.converter = c.converter
-	return r
-}

vendor/github.com/DATA-DOG/go-sqlmock/sqlmock_go18.go

@@ -1,121 +0,0 @@
-// +build go1.8
-
-package sqlmock
-
-import (
-	"context"
-	"database/sql/driver"
-	"errors"
-	"time"
-)
-
-// ErrCancelled defines an error value, which can be expected in case of
-// such cancellation error.
-var ErrCancelled = errors.New("canceling query due to user request")
-
-// Implement the "QueryerContext" interface
-func (c *sqlmock) QueryContext(ctx context.Context, query string, args []driver.NamedValue) (driver.Rows, error) {
-	namedArgs := make([]namedValue, len(args))
-	for i, nv := range args {
-		namedArgs[i] = namedValue(nv)
-	}
-
-	ex, err := c.query(query, namedArgs)
-	if ex != nil {
-		select {
-		case <-time.After(ex.delay):
-			if err != nil {
-				return nil, err
-			}
-			return ex.rows, nil
-		case <-ctx.Done():
-			return nil, ErrCancelled
-		}
-	}
-
-	return nil, err
-}
-
-// Implement the "ExecerContext" interface
-func (c *sqlmock) ExecContext(ctx context.Context, query string, args []driver.NamedValue) (driver.Result, error) {
-	namedArgs := make([]namedValue, len(args))
-	for i, nv := range args {
-		namedArgs[i] = namedValue(nv)
-	}
-
-	ex, err := c.exec(query, namedArgs)
-	if ex != nil {
-		select {
-		case <-time.After(ex.delay):
-			if err != nil {
-				return nil, err
-			}
-			return ex.result, nil
-		case <-ctx.Done():
-			return nil, ErrCancelled
-		}
-	}
-
-	return nil, err
-}
-
-// Implement the "ConnBeginTx" interface
-func (c *sqlmock) BeginTx(ctx context.Context, opts driver.TxOptions) (driver.Tx, error) {
-	ex, err := c.begin()
-	if ex != nil {
-		select {
-		case <-time.After(ex.delay):
-			if err != nil {
-				return nil, err
-			}
-			return c, nil
-		case <-ctx.Done():
-			return nil, ErrCancelled
-		}
-	}
-
-	return nil, err
-}
-
-// Implement the "ConnPrepareContext" interface
-func (c *sqlmock) PrepareContext(ctx context.Context, query string) (driver.Stmt, error) {
-	ex, err := c.prepare(query)
-	if ex != nil {
-		select {
-		case <-time.After(ex.delay):
-			if err != nil {
-				return nil, err
-			}
-			return &statement{c, ex, query}, nil
-		case <-ctx.Done():
-			return nil, ErrCancelled
-		}
-	}
-
-	return nil, err
-}
-
-// Implement the "Pinger" interface
-// for now we do not have a Ping expectation
-// may be something for the future
-func (c *sqlmock) Ping(ctx context.Context) error {
-	return nil
-}
-
-// Implement the "StmtExecContext" interface
-func (stmt *statement) ExecContext(ctx context.Context, args []driver.NamedValue) (driver.Result, error) {
-	return stmt.conn.ExecContext(ctx, stmt.query, args)
-}
-
-// Implement the "StmtQueryContext" interface
-func (stmt *statement) QueryContext(ctx context.Context, args []driver.NamedValue) (driver.Rows, error) {
-	return stmt.conn.QueryContext(ctx, stmt.query, args)
-}
-
-// @TODO maybe add ExpectedBegin.WithOptions(driver.TxOptions)
-
-// CheckNamedValue meets https://golang.org/pkg/database/sql/driver/#NamedValueChecker
-func (c *sqlmock) CheckNamedValue(nv *driver.NamedValue) (err error) {
-	nv.Value, err = c.converter.ConvertValue(nv.Value)
-	return err
-}

vendor/github.com/DATA-DOG/go-sqlmock/statement.go

@@ -1,28 +0,0 @@
-package sqlmock
-
-import (
-	"database/sql/driver"
-)
-
-type statement struct {
-	conn  *sqlmock
-	ex    *ExpectedPrepare
-	query string
-}
-
-func (stmt *statement) Close() error {
-	stmt.ex.wasClosed = true
-	return stmt.ex.closeErr
-}
-
-func (stmt *statement) NumInput() int {
-	return -1
-}
-
-func (stmt *statement) Exec(args []driver.Value) (driver.Result, error) {
-	return stmt.conn.Exec(stmt.query, args)
-}
-
-func (stmt *statement) Query(args []driver.Value) (driver.Rows, error) {
-	return stmt.conn.Query(stmt.query, args)
-}

vendor/github.com/cloudflare/golz4/.gitignore

@@ -1,22 +0,0 @@
-# Compiled Object files, Static and Dynamic libs (Shared Objects)
-*.o
-*.a
-*.so
-
-# Folders
-_obj
-_test
-
-# Architecture specific extensions/prefixes
-*.[568vq]
-[568vq].out
-
-*.cgo1.go
-*.cgo2.c
-_cgo_defun.c
-_cgo_gotypes.go
-_cgo_export.*
-
-_testmain.go
-
-*.exe

vendor/github.com/cloudflare/golz4/LICENSE

@@ -1,27 +0,0 @@
-Copyright (c) 2013 CloudFlare, Inc.
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without modification,
-are permitted provided that the following conditions are met:
-
-* Redistributions of source code must retain the above copyright notice, this
-  list of conditions and the following disclaimer.
-
-* Redistributions in binary form must reproduce the above copyright notice, this
-  list of conditions and the following disclaimer in the documentation and/or
-  other materials provided with the distribution.
-
-* Neither the name of the CloudFlare, Inc. nor the names of its
-  contributors may be used to endorse or promote products derived from
-  this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
-ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
-(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
-ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

vendor/github.com/cloudflare/golz4/Makefile

@@ -1,14 +0,0 @@
-GCFLAGS := 
-LDFLAGS :=
-
-.PHONY: install
-install:
-	@go install -v .
-
-.PHONY: test
-test:
-	@go test -gcflags='$(GCFLAGS)' -ldflags='$(LDFLAGS)' .
-
-.PHONY: bench
-bench:
-	@go test -gcflags='$(GCFLAGS)' -ldflags='$(LDFLAGS)' -bench .

vendor/github.com/cloudflare/golz4/README.md

@@ -1,4 +0,0 @@
-golz4
-=====
-
-Golang interface to LZ4 compression

vendor/github.com/cloudflare/golz4/doc.go

@@ -1,4 +0,0 @@
-// Package lz4 implements compression using lz4.c and lz4hc.c
-//
-// Copyright (c) 2013 CloudFlare, Inc.
-package lz4

vendor/github.com/cloudflare/golz4/lz4.go

@@ -1,55 +0,0 @@
-package lz4
-
-// #cgo CFLAGS: -O3
-// #include "src/lz4.h"
-// #include "src/lz4.c"
-import "C"
-
-import (
-	"errors"
-	"fmt"
-	"unsafe"
-)
-
-// p gets a char pointer to the first byte of a []byte slice
-func p(in []byte) *C.char {
-	if len(in) == 0 {
-		return (*C.char)(unsafe.Pointer(nil))
-	}
-	return (*C.char)(unsafe.Pointer(&in[0]))
-}
-
-// clen gets the length of a []byte slice as a char *
-func clen(s []byte) C.int {
-	return C.int(len(s))
-}
-
-// Uncompress with a known output size. len(out) should be equal to
-// the length of the uncompressed out.
-func Uncompress(in, out []byte) (error) {
-	if int(C.LZ4_decompress_safe(p(in), p(out), clen(in), clen(out))) < 0 {
-		return errors.New("Malformed compression stream")
-	}
-
-	return nil
-}
-
-// CompressBound calculates the size of the output buffer needed by
-// Compress. This is based on the following macro:
-//
-// #define LZ4_COMPRESSBOUND(isize)
-//      ((unsigned int)(isize) > (unsigned int)LZ4_MAX_INPUT_SIZE ? 0 : (isize) + ((isize)/255) + 16)
-func CompressBound(in []byte) int {
-	return len(in) + ((len(in) / 255) + 16)
-}
-
-// Compress compresses in and puts the content in out. len(out)
-// should have enough space for the compressed data (use CompressBound
-// to calculate). Returns the number of bytes in the out slice.
-func Compress(in, out []byte) (outSize int, err error) {
-	outSize = int(C.LZ4_compress_limitedOutput(p(in), p(out), clen(in), clen(out)))
-	if outSize == 0 {
-		err = fmt.Errorf("insufficient space for compression")
-	}
-	return
-}

vendor/github.com/cloudflare/golz4/lz4_hc.go

@@ -1,38 +0,0 @@
-package lz4
-
-// #cgo CFLAGS: -O3
-// #include "src/lz4hc.h"
-// #include "src/lz4hc.c"
-import "C"
-
-import (
-	"fmt"
-)
-
-// CompressHC compresses in and puts the content in out. len(out)
-// should have enough space for the compressed data (use CompressBound
-// to calculate). Returns the number of bytes in the out slice. Determines
-// the compression level automatically.
-func CompressHC(in, out []byte) (int, error) {
-	// 0 automatically sets the compression level.
-	return CompressHCLevel(in, out, 0)
-}
-
-// CompressHCLevel compresses in at the given compression level and puts the
-// content in out. len(out) should have enough space for the compressed data
-// (use CompressBound to calculate). Returns the number of bytes in the out
-// slice. To automatically choose the compression level, use 0. Otherwise, use
-// any value in the inclusive range 1 (worst) through 16 (best). Most
-// applications will prefer CompressHC.
-func CompressHCLevel(in, out []byte, level int) (outSize int, err error) {
-	// LZ4HC does not handle empty buffers. Pass through to Compress.
-	if len(in) == 0 || len(out) == 0 {
-		return Compress(in, out)
-	}
-
-	outSize = int(C.LZ4_compressHC2_limitedOutput(p(in), p(out), clen(in), clen(out), C.int(level)))
-	if outSize == 0 {
-		err = fmt.Errorf("insufficient space for compression")
-	}
-	return
-}

vendor/github.com/cloudflare/golz4/sample.txt

@@ -1,143 +0,0 @@
-CANTO I
-
-
-IN the midway of this our mortal life,
-I found me in a gloomy wood, astray
-Gone from the path direct: and e'en to tell
-It were no easy task, how savage wild
-That forest, how robust and rough its growth,
-Which to remember only, my dismay
-Renews, in bitterness not far from death.
-Yet to discourse of what there good befell,
-All else will I relate discover'd there.
-How first I enter'd it I scarce can say,
-Such sleepy dullness in that instant weigh'd
-My senses down, when the true path I left,
-But when a mountain's foot I reach'd, where clos'd
-The valley, that had pierc'd my heart with dread,
-I look'd aloft, and saw his shoulders broad
-Already vested with that planet's beam,
-Who leads all wanderers safe through every way.
-
-Then was a little respite to the fear,
-That in my heart's recesses deep had lain,
-All of that night, so pitifully pass'd:
-And as a man, with difficult short breath,
-Forespent with toiling, 'scap'd from sea to shore,
-Turns to the perilous wide waste, and stands
-At gaze; e'en so my spirit, that yet fail'd
-Struggling with terror, turn'd to view the straits,
-That none hath pass'd and liv'd.  My weary frame
-After short pause recomforted, again
-I journey'd on over that lonely steep,
-
-The hinder foot still firmer.  Scarce the ascent
-Began, when, lo! a panther, nimble, light,
-And cover'd with a speckled skin, appear'd,
-Nor, when it saw me, vanish'd, rather strove
-To check my onward going; that ofttimes
-With purpose to retrace my steps I turn'd.
-
-The hour was morning's prime, and on his way
-Aloft the sun ascended with those stars,
-That with him rose, when Love divine first mov'd
-Those its fair works: so that with joyous hope
-All things conspir'd to fill me, the gay skin
-Of that swift animal, the matin dawn
-And the sweet season.  Soon that joy was chas'd,
-And by new dread succeeded, when in view
-A lion came, 'gainst me, as it appear'd,
-
-With his head held aloft and hunger-mad,
-That e'en the air was fear-struck.  A she-wolf
-Was at his heels, who in her leanness seem'd
-Full of all wants, and many a land hath made
-Disconsolate ere now.  She with such fear
-O'erwhelmed me, at the sight of her appall'd,
-That of the height all hope I lost.  As one,
-Who with his gain elated, sees the time
-When all unwares is gone, he inwardly
-Mourns with heart-griping anguish; such was I,
-Haunted by that fell beast, never at peace,
-Who coming o'er against me, by degrees
-Impell'd me where the sun in silence rests.
-
-While to the lower space with backward step
-I fell, my ken discern'd the form one of one,
-Whose voice seem'd faint through long disuse of speech.
-When him in that great desert I espied,
-"Have mercy on me!" cried I out aloud,
-"Spirit! or living man! what e'er thou be!"
-
-He answer'd: "Now not man, man once I was,
-And born of Lombard parents, Mantuana both
-By country, when the power of Julius yet
-Was scarcely firm.  At Rome my life was past
-Beneath the mild Augustus, in the time
-Of fabled deities and false.  A bard
-Was I, and made Anchises' upright son
-The subject of my song, who came from Troy,
-When the flames prey'd on Ilium's haughty towers.
-But thou, say wherefore to such perils past
-Return'st thou?  wherefore not this pleasant mount
-Ascendest, cause and source of all delight?"
-"And art thou then that Virgil, that well-spring,
-From which such copious floods of eloquence
-Have issued?"  I with front abash'd replied.
-"Glory and light of all the tuneful train!
-May it avail me that I long with zeal
-Have sought thy volume, and with love immense
-Have conn'd it o'er.  My master thou and guide!
-Thou he from whom alone I have deriv'd
-That style, which for its beauty into fame
-Exalts me.  See the beast, from whom I fled.
-O save me from her, thou illustrious sage!"
-
-"For every vein and pulse throughout my frame
-She hath made tremble."  He, soon as he saw
-That I was weeping, answer'd, "Thou must needs
-Another way pursue, if thou wouldst 'scape
-From out that savage wilderness.  This beast,
-At whom thou criest, her way will suffer none
-To pass, and no less hindrance makes than death:
-So bad and so accursed in her kind,
-That never sated is her ravenous will,
-Still after food more craving than before.
-To many an animal in wedlock vile
-She fastens, and shall yet to many more,
-Until that greyhound come, who shall destroy
-Her with sharp pain.  He will not life support
-By earth nor its base metals, but by love,
-Wisdom, and virtue, and his land shall be
-The land 'twixt either Feltro.  In his might
-Shall safety to Italia's plains arise,
-For whose fair realm, Camilla, virgin pure,
-Nisus, Euryalus, and Turnus fell.
-He with incessant chase through every town
-Shall worry, until he to hell at length
-Restore her, thence by envy first let loose.
-I for thy profit pond'ring now devise,
-That thou mayst follow me, and I thy guide
-Will lead thee hence through an eternal space,
-Where thou shalt hear despairing shrieks, and see
-Spirits of old tormented, who invoke
-A second death; and those next view, who dwell
-Content in fire, for that they hope to come,
-Whene'er the time may be, among the blest,
-Into whose regions if thou then desire
-T' ascend, a spirit worthier then I
-Must lead thee, in whose charge, when I depart,
-Thou shalt be left: for that Almighty King,
-Who reigns above, a rebel to his law,
-Adjudges me, and therefore hath decreed,
-That to his city none through me should come.
-He in all parts hath sway; there rules, there holds
-His citadel and throne.  O happy those,
-Whom there he chooses!"  I to him in few:
-"Bard! by that God, whom thou didst not adore,
-I do beseech thee (that this ill and worse
-I may escape) to lead me, where thou saidst,
-That I Saint Peter's gate may view, and those
-Who as thou tell'st, are in such dismal plight."
-
-Onward he mov'd, I close his steps pursu'd.

vendor/github.com/denisenkom/go-mssqldb/LICENSE.txt

@@ -1,27 +0,0 @@
-Copyright (c) 2012 The Go Authors. All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are
-met:
-
-   * Redistributions of source code must retain the above copyright
-notice, this list of conditions and the following disclaimer.
-   * Redistributions in binary form must reproduce the above
-copyright notice, this list of conditions and the following disclaimer
-in the documentation and/or other materials provided with the
-distribution.
-   * Neither the name of Google Inc. nor the names of its
-contributors may be used to endorse or promote products derived from
-this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

vendor/github.com/denisenkom/go-mssqldb/README.md

@@ -1,289 +0,0 @@
-# A pure Go MSSQL driver for Go's database/sql package
-
-[![GoDoc](https://godoc.org/github.com/denisenkom/go-mssqldb?status.svg)](http://godoc.org/github.com/denisenkom/go-mssqldb)
-[![Build status](https://ci.appveyor.com/api/projects/status/jrln8cs62wj9i0a2?svg=true)](https://ci.appveyor.com/project/denisenkom/go-mssqldb)
-[![codecov](https://codecov.io/gh/denisenkom/go-mssqldb/branch/master/graph/badge.svg)](https://codecov.io/gh/denisenkom/go-mssqldb)
-
-## Install
-
-Requires Go 1.8 or above.
-
-Install with `go get github.com/denisenkom/go-mssqldb` .
-
-## Connection Parameters and DSN
-
-The recommended connection string uses a URL format:
-`sqlserver://username:password@host/instance?param1=value&param2=value`
-Other supported formats are listed below.
-
-### Common parameters:
-
-* `user id` - enter the SQL Server Authentication user id or the Windows Authentication user id in the DOMAIN\User format. On Windows, if user id is empty or missing Single-Sign-On is used.
-* `password`
-* `database`
-* `connection timeout` - in seconds (default is 0 for no timeout), set to 0 for no timeout. Recommended to set to 0 and use context to manage query and connection timeouts.
-* `dial timeout` - in seconds (default is 15), set to 0 for no timeout
-* `encrypt`
-  * `disable` - Data send between client and server is not encrypted.
-  * `false` - Data sent between client and server is not encrypted beyond the login packet. (Default)
-  * `true` - Data sent between client and server is encrypted.
-* `app name` - The application name (default is go-mssqldb)
-
-### Connection parameters for ODBC and ADO style connection strings:
-
-* `server` - host or host\instance (default localhost)
-* `port` - used only when there is no instance in server (default 1433)
-
-### Less common parameters:
-
-* `keepAlive` - in seconds; 0 to disable (default is 30)
-* `failoverpartner` - host or host\instance (default is no partner). 
-* `failoverport` - used only when there is no instance in failoverpartner (default 1433)
-* `packet size` - in bytes; 512 to 32767 (default is 4096)
-  * Encrypted connections have a maximum packet size of 16383 bytes
-  * Further information on usage: https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/configure-the-network-packet-size-server-configuration-option
-* `log` - logging flags (default 0/no logging, 63 for full logging)
-  *  1 log errors
-  *  2 log messages
-  *  4 log rows affected
-  *  8 trace sql statements
-  * 16 log statement parameters
-  * 32 log transaction begin/end
-* `TrustServerCertificate`
-  * false - Server certificate is checked. Default is false if encypt is specified.
-  * true - Server certificate is not checked. Default is true if encrypt is not specified. If trust server certificate is true, driver accepts any certificate presented by the server and any host name in that certificate. In this mode, TLS is susceptible to man-in-the-middle attacks. This should be used only for testing.
-* `certificate` - The file that contains the public key certificate of the CA that signed the SQL Server certificate. The specified certificate overrides the go platform specific CA certificates.
-* `hostNameInCertificate` - Specifies the Common Name (CN) in the server certificate. Default value is the server host.
-* `ServerSPN` - The kerberos SPN (Service Principal Name) for the server. Default is MSSQLSvc/host:port.
-* `Workstation ID` - The workstation name (default is the host name)
-* `ApplicationIntent` - Can be given the value `ReadOnly` to initiate a read-only connection to an Availability Group listener. The `database` must be specified when connecting with `Application Intent` set to `ReadOnly`. 
-
-### The connection string can be specified in one of three formats:
-
-
-1. URL: with `sqlserver` scheme. username and password appears before the host. Any instance appears as
-    the first segment in the path. All other options are query parameters. Examples:
-
-  * `sqlserver://username:password@host/instance?param1=value&param2=value`
-  * `sqlserver://username:password@host:port?param1=value&param2=value`
-  * `sqlserver://sa@localhost/SQLExpress?database=master&connection+timeout=30` // `SQLExpress instance.
-  * `sqlserver://sa:mypass@localhost?database=master&connection+timeout=30`     // username=sa, password=mypass.
-  * `sqlserver://sa:mypass@localhost:1234?database=master&connection+timeout=30` // port 1234 on localhost.
-  * `sqlserver://sa:my%7Bpass@somehost?connection+timeout=30` // password is "my{pass"
-
-  A string of this format can be constructed using the `URL` type in the `net/url` package.
-
-```go
-  query := url.Values{}
-  query.Add("app name", "MyAppName")
-
-  u := &url.URL{
-      Scheme:   "sqlserver",
-      User:     url.UserPassword(username, password),
-      Host:     fmt.Sprintf("%s:%d", hostname, port),
-      // Path:  instance, // if connecting to an instance instead of a port
-      RawQuery: query.Encode(),
-  }
-  db, err := sql.Open("sqlserver", u.String())
-```
-
-2. ADO: `key=value` pairs separated by `;`. Values may not contain `;`, leading and trailing whitespace is ignored.
-     Examples:
-	
-  * `server=localhost\\SQLExpress;user id=sa;database=master;app name=MyAppName`
-  * `server=localhost;user id=sa;database=master;app name=MyAppName`
-
-3. ODBC: Prefix with `odbc`, `key=value` pairs separated by `;`. Allow `;` by wrapping
-    values in `{}`. Examples:
-	
-  * `odbc:server=localhost\\SQLExpress;user id=sa;database=master;app name=MyAppName`
-  * `odbc:server=localhost;user id=sa;database=master;app name=MyAppName`
-  * `odbc:server=localhost;user id=sa;password={foo;bar}` // Value marked with `{}`, password is "foo;bar"
-  * `odbc:server=localhost;user id=sa;password={foo{bar}` // Value marked with `{}`, password is "foo{bar"
-  * `odbc:server=localhost;user id=sa;password={foobar }` // Value marked with `{}`, password is "foobar "
-  * `odbc:server=localhost;user id=sa;password=foo{bar`   // Literal `{`, password is "foo{bar"
-  * `odbc:server=localhost;user id=sa;password=foo}bar`   // Literal `}`, password is "foo}bar"
-  * `odbc:server=localhost;user id=sa;password={foo{bar}` // Literal `{`, password is "foo{bar"
-  * `odbc:server=localhost;user id=sa;password={foo}}bar}` // Escaped `} with `}}`, password is "foo}bar"
-
-## Executing Stored Procedures
-
-To run a stored procedure, set the query text to the procedure name:
-```go
-var account = "abc"
-_, err := db.ExecContext(ctx, "sp_RunMe",
-	sql.Named("ID", 123),
-	sql.Named("Account", sql.Out{Dest: &account}),
-)
-```
-
-## Reading Output Parameters from a Stored Procedure with Resultset
-
-To read output parameters from a stored procedure with resultset, make sure you read all the rows before reading the output parameters:
-```go
-sqltextcreate := `
-CREATE PROCEDURE spwithoutputandrows
-	@bitparam BIT OUTPUT
-AS BEGIN
-	SET @bitparam = 1
-	SELECT 'Row 1'
-END
-`
-var bitout int64
-rows, err := db.QueryContext(ctx, "spwithoutputandrows", sql.Named("bitparam", sql.Out{Dest: &bitout}))
-var strrow string
-for rows.Next() {
-	err = rows.Scan(&strrow)
-}
-fmt.Printf("bitparam is %d", bitout)
-```
-
-## Caveat for local temporary tables
-
-Due to protocol limitations, temporary tables will only be allocated on the connection
-as a result of executing a query with zero parameters. The following query
-will, due to the use of a parameter, execute in its own session,
-and `#mytemp` will be de-allocated right away:
-
-```go
-conn, err := pool.Conn(ctx)
-defer conn.Close()
-_, err := conn.ExecContext(ctx, "select @p1 as x into #mytemp", 1)
-// at this point #mytemp is already dropped again as the session of the ExecContext is over
-```
-
-To work around this, always explicitly create the local temporary
-table in a query without any parameters. As a special case, the driver
-will then be able to execute the query directly on the
-connection-scoped session. The following example works:
-
-```go
-conn, err := pool.Conn(ctx)
-
-// Set us up so that temp table is always cleaned up, since conn.Close()
-// merely returns conn to pool, rather than actually closing the connection.
-defer func() {
-	_, _ = conn.ExecContext(ctx, "drop table #mytemp")  // always clean up
-	conn.Close() // merely returns conn to pool
-}()
-
-
-// Since we not pass any parameters below, the query will execute on the scope of
-// the connection and succeed in creating the table.
-_, err := conn.ExecContext(ctx, "create table #mytemp ( x int )")
-
-// #mytemp is now available even if you pass parameters
-_, err := conn.ExecContext(ctx, "insert into #mytemp (x) values (@p1)", 1)
-
-```
-
-## Return Status
-
-To get the procedure return status, pass into the parameters a
-`*mssql.ReturnStatus`. For example:
-```
-var rs mssql.ReturnStatus
-_, err := db.ExecContext(ctx, "theproc", &rs)
-log.Printf("status=%d", rs)
-```
-
-or
-
-```
-var rs mssql.ReturnStatus
-_, err := db.QueryContext(ctx, "theproc", &rs)
-for rows.Next() {
-	err = rows.Scan(&val)
-}
-log.Printf("status=%d", rs)
-```
-
-Limitation: ReturnStatus cannot be retrieved using `QueryRow`.
-
-## Parameters
-
-The `sqlserver` driver uses normal MS SQL Server syntax and expects parameters in
-the sql query to be in the form of either `@Name` or `@p1` to `@pN` (ordinal position).
-
-```go
-db.QueryContext(ctx, `select * from t where ID = @ID and Name = @p2;`, sql.Named("ID", 6), "Bob")
-```
-
-### Parameter Types
-
-To pass specific types to the query parameters, say `varchar` or `date` types,
-you must convert the types to the type before passing in. The following types
-are supported:
-
- * string -> nvarchar
- * mssql.VarChar -> varchar
- * time.Time -> datetimeoffset or datetime (TDS version dependent)
- * mssql.DateTime1 -> datetime
- * mssql.DateTimeOffset -> datetimeoffset
- * "github.com/golang-sql/civil".Date -> date
- * "github.com/golang-sql/civil".DateTime -> datetime2
- * "github.com/golang-sql/civil".Time -> time
- * mssql.TVP -> Table Value Parameter (TDS version dependent)
-
-## Important Notes
-
- * [LastInsertId](https://golang.org/pkg/database/sql/#Result.LastInsertId) should
-    not be used with this driver (or SQL Server) due to how the TDS protocol
-	works. Please use the [OUTPUT Clause](https://docs.microsoft.com/en-us/sql/t-sql/queries/output-clause-transact-sql)
-	or add a `select ID = convert(bigint, SCOPE_IDENTITY());` to the end of your
-	query (ref [SCOPE_IDENTITY](https://docs.microsoft.com/en-us/sql/t-sql/functions/scope-identity-transact-sql)).
-	This will ensure you are getting the correct ID and will prevent a network round trip.
- * [NewConnector](https://godoc.org/github.com/denisenkom/go-mssqldb#NewConnector)
-    may be used with [OpenDB](https://golang.org/pkg/database/sql/#OpenDB).
- * [Connector.SessionInitSQL](https://godoc.org/github.com/denisenkom/go-mssqldb#Connector.SessionInitSQL)
-	may be set to set any driver specific session settings after the session
-	has been reset. If empty the session will still be reset but use the database
-	defaults in Go1.10+.
-
-## Features
-
-* Can be used with SQL Server 2005 or newer
-* Can be used with Microsoft Azure SQL Database
-* Can be used on all go supported platforms (e.g. Linux, Mac OS X and Windows)
-* Supports new date/time types: date, time, datetime2, datetimeoffset
-* Supports string parameters longer than 8000 characters
-* Supports encryption using SSL/TLS
-* Supports SQL Server and Windows Authentication
-* Supports Single-Sign-On on Windows
-* Supports connections to AlwaysOn Availability Group listeners, including re-direction to read-only replicas.
-* Supports query notifications
-
-## Tests
-
-`go test` is used for testing. A running instance of MSSQL server is required.
-Environment variables are used to pass login information.
-
-Example:
-
-    env SQLSERVER_DSN=sqlserver://user:pass@hostname/instance?database=test1 go test
-
-## Deprecated
-
-These features still exist in the driver, but they are are deprecated.
-
-### Query Parameter Token Replace (driver "mssql")
-
-If you use the driver name "mssql" (rather then "sqlserver") the SQL text
-will be loosly parsed and an attempt to extract identifiers using one of
-
-* ?
-* ?nnn
-* :nnn
-* $nnn
-
-will be used. This is not recommended with SQL Server. 
-There is at least one existing `won't fix` issue with the query parsing.
-
-Use the native "@Name" parameters instead with the "sqlserver" driver name.
-
-## Known Issues
-
-* SQL Server 2008 and 2008 R2 engine cannot handle login records when SSL encryption is not disabled.
-To fix SQL Server 2008 R2 issue, install SQL Server 2008 R2 Service Pack 2.
-To fix SQL Server 2008 issue, install Microsoft SQL Server 2008 Service Pack 3 and Cumulative update package 3 for SQL Server 2008 SP3.
-More information: http://support.microsoft.com/kb/2653857

vendor/github.com/denisenkom/go-mssqldb/appveyor.yml

@@ -1,50 +0,0 @@
-version: 1.0.{build}
-
-os: Windows Server 2012 R2
-
-clone_folder: c:\gopath\src\github.com\denisenkom\go-mssqldb
-
-environment:
-  GOPATH: c:\gopath
-  HOST: localhost
-  SQLUSER: sa
-  SQLPASSWORD: Password12!
-  DATABASE: test  
-  GOVERSION: 111
-  matrix:
-    - GOVERSION: 18
-      SQLINSTANCE: SQL2016
-    - GOVERSION: 19
-      SQLINSTANCE: SQL2016
-    - GOVERSION: 110
-      SQLINSTANCE: SQL2016
-    - GOVERSION: 111
-      SQLINSTANCE: SQL2016
-    - SQLINSTANCE: SQL2014
-    - SQLINSTANCE: SQL2012SP1
-    - SQLINSTANCE: SQL2008R2SP2
- 
-install:
-  - set GOROOT=c:\go%GOVERSION%
-  - set PATH=%GOPATH%\bin;%GOROOT%\bin;%PATH%
-  - go version
-  - go env
-  - go get -u github.com/golang-sql/civil
-
-build_script:
-  - go build
-
-before_test:
-  # setup SQL Server 
-  - ps: | 
-      $instanceName = $env:SQLINSTANCE
-      Start-Service "MSSQL`$$instanceName"
-      Start-Service "SQLBrowser"
-  - sqlcmd -S "(local)\%SQLINSTANCE%" -Q "Use [master]; CREATE DATABASE test;"
-  - sqlcmd -S "(local)\%SQLINSTANCE%" -h -1 -Q "set nocount on; Select @@version"
-  - pip install codecov
- 
-
-test_script:
-  - go test -race -cpu 4 -coverprofile=coverage.txt -covermode=atomic
-  - codecov -f coverage.txt

vendor/github.com/denisenkom/go-mssqldb/buf.go

@@ -1,262 +0,0 @@
-package mssql
-
-import (
-	"encoding/binary"
-	"errors"
-	"io"
-)
-
-type packetType uint8
-
-type header struct {
-	PacketType packetType
-	Status     uint8
-	Size       uint16
-	Spid       uint16
-	PacketNo   uint8
-	Pad        uint8
-}
-
-// tdsBuffer reads and writes TDS packets of data to the transport.
-// The write and read buffers are separate to make sending attn signals
-// possible without locks. Currently attn signals are only sent during
-// reads, not writes.
-type tdsBuffer struct {
-	transport io.ReadWriteCloser
-
-	packetSize int
-
-	// Write fields.
-	wbuf        []byte
-	wpos        int
-	wPacketSeq  byte
-	wPacketType packetType
-
-	// Read fields.
-	rbuf        []byte
-	rpos        int
-	rsize       int
-	final       bool
-	rPacketType packetType
-
-	// afterFirst is assigned to right after tdsBuffer is created and
-	// before the first use. It is executed after the first packet is
-	// written and then removed.
-	afterFirst func()
-}
-
-func newTdsBuffer(bufsize uint16, transport io.ReadWriteCloser) *tdsBuffer {
-	return &tdsBuffer{
-		packetSize: int(bufsize),
-		wbuf:       make([]byte, 1<<16),
-		rbuf:       make([]byte, 1<<16),
-		rpos:       8,
-		transport:  transport,
-	}
-}
-
-func (rw *tdsBuffer) ResizeBuffer(packetSize int) {
-	rw.packetSize = packetSize
-}
-
-func (w *tdsBuffer) PackageSize() int {
-	return w.packetSize
-}
-
-func (w *tdsBuffer) flush() (err error) {
-	// Write packet size.
-	w.wbuf[0] = byte(w.wPacketType)
-	binary.BigEndian.PutUint16(w.wbuf[2:], uint16(w.wpos))
-	w.wbuf[6] = w.wPacketSeq
-
-	// Write packet into underlying transport.
-	if _, err = w.transport.Write(w.wbuf[:w.wpos]); err != nil {
-		return err
-	}
-	// It is possible to create a whole new buffer after a flush.
-	// Useful for debugging. Normally reuse the buffer.
-	// w.wbuf = make([]byte, 1<<16)
-
-	// Execute afterFirst hook if it is set.
-	if w.afterFirst != nil {
-		w.afterFirst()
-		w.afterFirst = nil
-	}
-
-	w.wpos = 8
-	w.wPacketSeq++
-	return nil
-}
-
-func (w *tdsBuffer) Write(p []byte) (total int, err error) {
-	for {
-		copied := copy(w.wbuf[w.wpos:w.packetSize], p)
-		w.wpos += copied
-		total += copied
-		if copied == len(p) {
-			return
-		}
-		if err = w.flush(); err != nil {
-			return
-		}
-		p = p[copied:]
-	}
-}
-
-func (w *tdsBuffer) WriteByte(b byte) error {
-	if int(w.wpos) == len(w.wbuf) || w.wpos == w.packetSize {
-		if err := w.flush(); err != nil {
-			return err
-		}
-	}
-	w.wbuf[w.wpos] = b
-	w.wpos += 1
-	return nil
-}
-
-func (w *tdsBuffer) BeginPacket(packetType packetType, resetSession bool) {
-	status := byte(0)
-	if resetSession {
-		switch packetType {
-		// Reset session can only be set on the following packet types.
-		case packSQLBatch, packRPCRequest, packTransMgrReq:
-			status = 0x8
-		}
-	}
-	w.wbuf[1] = status // Packet is incomplete. This byte is set again in FinishPacket.
-	w.wpos = 8
-	w.wPacketSeq = 1
-	w.wPacketType = packetType
-}
-
-func (w *tdsBuffer) FinishPacket() error {
-	w.wbuf[1] |= 1 // Mark this as the last packet in the message.
-	return w.flush()
-}
-
-var headerSize = binary.Size(header{})
-
-func (r *tdsBuffer) readNextPacket() error {
-	h := header{}
-	var err error
-	err = binary.Read(r.transport, binary.BigEndian, &h)
-	if err != nil {
-		return err
-	}
-	if int(h.Size) > r.packetSize {
-		return errors.New("Invalid packet size, it is longer than buffer size")
-	}
-	if headerSize > int(h.Size) {
-		return errors.New("Invalid packet size, it is shorter than header size")
-	}
-	_, err = io.ReadFull(r.transport, r.rbuf[headerSize:h.Size])
-	if err != nil {
-		return err
-	}
-	r.rpos = headerSize
-	r.rsize = int(h.Size)
-	r.final = h.Status != 0
-	r.rPacketType = h.PacketType
-	return nil
-}
-
-func (r *tdsBuffer) BeginRead() (packetType, error) {
-	err := r.readNextPacket()
-	if err != nil {
-		return 0, err
-	}
-	return r.rPacketType, nil
-}
-
-func (r *tdsBuffer) ReadByte() (res byte, err error) {
-	if r.rpos == r.rsize {
-		if r.final {
-			return 0, io.EOF
-		}
-		err = r.readNextPacket()
-		if err != nil {
-			return 0, err
-		}
-	}
-	res = r.rbuf[r.rpos]
-	r.rpos++
-	return res, nil
-}
-
-func (r *tdsBuffer) byte() byte {
-	b, err := r.ReadByte()
-	if err != nil {
-		badStreamPanic(err)
-	}
-	return b
-}
-
-func (r *tdsBuffer) ReadFull(buf []byte) {
-	_, err := io.ReadFull(r, buf[:])
-	if err != nil {
-		badStreamPanic(err)
-	}
-}
-
-func (r *tdsBuffer) uint64() uint64 {
-	var buf [8]byte
-	r.ReadFull(buf[:])
-	return binary.LittleEndian.Uint64(buf[:])
-}
-
-func (r *tdsBuffer) int32() int32 {
-	return int32(r.uint32())
-}
-
-func (r *tdsBuffer) uint32() uint32 {
-	var buf [4]byte
-	r.ReadFull(buf[:])
-	return binary.LittleEndian.Uint32(buf[:])
-}
-
-func (r *tdsBuffer) uint16() uint16 {
-	var buf [2]byte
-	r.ReadFull(buf[:])
-	return binary.LittleEndian.Uint16(buf[:])
-}
-
-func (r *tdsBuffer) BVarChar() string {
-	return readBVarCharOrPanic(r)
-}
-
-func readBVarCharOrPanic(r io.Reader) string {
-	s, err := readBVarChar(r)
-	if err != nil {
-		badStreamPanic(err)
-	}
-	return s
-}
-
-func readUsVarCharOrPanic(r io.Reader) string {
-	s, err := readUsVarChar(r)
-	if err != nil {
-		badStreamPanic(err)
-	}
-	return s
-}
-
-func (r *tdsBuffer) UsVarChar() string {
-	return readUsVarCharOrPanic(r)
-}
-
-func (r *tdsBuffer) Read(buf []byte) (copied int, err error) {
-	copied = 0
-	err = nil
-	if r.rpos == r.rsize {
-		if r.final {
-			return 0, io.EOF
-		}
-		err = r.readNextPacket()
-		if err != nil {
-			return
-		}
-	}
-	copied = copy(buf, r.rbuf[r.rpos:r.rsize])
-	r.rpos += copied
-	return
-}

vendor/github.com/denisenkom/go-mssqldb/bulkcopy.go

@@ -1,583 +0,0 @@
-package mssql
-
-import (
-	"bytes"
-	"context"
-	"encoding/binary"
-	"fmt"
-	"math"
-	"reflect"
-	"strings"
-	"time"
-
-	"github.com/denisenkom/go-mssqldb/internal/decimal"
-)
-
-type Bulk struct {
-	// ctx is used only for AddRow and Done methods.
-	// This could be removed if AddRow and Done accepted
-	// a ctx field as well, which is available with the
-	// database/sql call.
-	ctx context.Context
-
-	cn          *Conn
-	metadata    []columnStruct
-	bulkColumns []columnStruct
-	columnsName []string
-	tablename   string
-	numRows     int
-
-	headerSent bool
-	Options    BulkOptions
-	Debug      bool
-}
-type BulkOptions struct {
-	CheckConstraints  bool
-	FireTriggers      bool
-	KeepNulls         bool
-	KilobytesPerBatch int
-	RowsPerBatch      int
-	Order             []string
-	Tablock           bool
-}
-
-type DataValue interface{}
-
-const (
-	sqlDateFormat = "2006-01-02"
-	sqlTimeFormat = "2006-01-02 15:04:05.999999999Z07:00"
-)
-
-func (cn *Conn) CreateBulk(table string, columns []string) (_ *Bulk) {
-	b := Bulk{ctx: context.Background(), cn: cn, tablename: table, headerSent: false, columnsName: columns}
-	b.Debug = false
-	return &b
-}
-
-func (cn *Conn) CreateBulkContext(ctx context.Context, table string, columns []string) (_ *Bulk) {
-	b := Bulk{ctx: ctx, cn: cn, tablename: table, headerSent: false, columnsName: columns}
-	b.Debug = false
-	return &b
-}
-
-func (b *Bulk) sendBulkCommand(ctx context.Context) (err error) {
-	//get table columns info
-	err = b.getMetadata(ctx)
-	if err != nil {
-		return err
-	}
-
-	//match the columns
-	for _, colname := range b.columnsName {
-		var bulkCol *columnStruct
-
-		for _, m := range b.metadata {
-			if m.ColName == colname {
-				bulkCol = &m
-				break
-			}
-		}
-		if bulkCol != nil {
-
-			if bulkCol.ti.TypeId == typeUdt {
-				//send udt as binary
-				bulkCol.ti.TypeId = typeBigVarBin
-			}
-			b.bulkColumns = append(b.bulkColumns, *bulkCol)
-			b.dlogf("Adding column %s %s %#x", colname, bulkCol.ColName, bulkCol.ti.TypeId)
-		} else {
-			return fmt.Errorf("Column %s does not exist in destination table %s", colname, b.tablename)
-		}
-	}
-
-	//create the bulk command
-
-	//columns definitions
-	var col_defs bytes.Buffer
-	for i, col := range b.bulkColumns {
-		if i != 0 {
-			col_defs.WriteString(", ")
-		}
-		col_defs.WriteString("[" + col.ColName + "] " + makeDecl(col.ti))
-	}
-
-	//options
-	var with_opts []string
-
-	if b.Options.CheckConstraints {
-		with_opts = append(with_opts, "CHECK_CONSTRAINTS")
-	}
-	if b.Options.FireTriggers {
-		with_opts = append(with_opts, "FIRE_TRIGGERS")
-	}
-	if b.Options.KeepNulls {
-		with_opts = append(with_opts, "KEEP_NULLS")
-	}
-	if b.Options.KilobytesPerBatch > 0 {
-		with_opts = append(with_opts, fmt.Sprintf("KILOBYTES_PER_BATCH = %d", b.Options.KilobytesPerBatch))
-	}
-	if b.Options.RowsPerBatch > 0 {
-		with_opts = append(with_opts, fmt.Sprintf("ROWS_PER_BATCH = %d", b.Options.RowsPerBatch))
-	}
-	if len(b.Options.Order) > 0 {
-		with_opts = append(with_opts, fmt.Sprintf("ORDER(%s)", strings.Join(b.Options.Order, ",")))
-	}
-	if b.Options.Tablock {
-		with_opts = append(with_opts, "TABLOCK")
-	}
-	var with_part string
-	if len(with_opts) > 0 {
-		with_part = fmt.Sprintf("WITH (%s)", strings.Join(with_opts, ","))
-	}
-
-	query := fmt.Sprintf("INSERT BULK %s (%s) %s", b.tablename, col_defs.String(), with_part)
-
-	stmt, err := b.cn.PrepareContext(ctx, query)
-	if err != nil {
-		return fmt.Errorf("Prepare failed: %s", err.Error())
-	}
-	b.dlogf(query)
-
-	_, err = stmt.(*Stmt).ExecContext(ctx, nil)
-	if err != nil {
-		return err
-	}
-
-	b.headerSent = true
-
-	var buf = b.cn.sess.buf
-	buf.BeginPacket(packBulkLoadBCP, false)
-
-	// Send the columns metadata.
-	columnMetadata := b.createColMetadata()
-	_, err = buf.Write(columnMetadata)
-
-	return
-}
-
-// AddRow immediately writes the row to the destination table.
-// The arguments are the row values in the order they were specified.
-func (b *Bulk) AddRow(row []interface{}) (err error) {
-	if !b.headerSent {
-		err = b.sendBulkCommand(b.ctx)
-		if err != nil {
-			return
-		}
-	}
-
-	if len(row) != len(b.bulkColumns) {
-		return fmt.Errorf("Row does not have the same number of columns than the destination table %d %d",
-			len(row), len(b.bulkColumns))
-	}
-
-	bytes, err := b.makeRowData(row)
-	if err != nil {
-		return
-	}
-
-	_, err = b.cn.sess.buf.Write(bytes)
-	if err != nil {
-		return
-	}
-
-	b.numRows = b.numRows + 1
-	return
-}
-
-func (b *Bulk) makeRowData(row []interface{}) ([]byte, error) {
-	buf := new(bytes.Buffer)
-	buf.WriteByte(byte(tokenRow))
-
-	var logcol bytes.Buffer
-	for i, col := range b.bulkColumns {
-
-		if b.Debug {
-			logcol.WriteString(fmt.Sprintf(" col[%d]='%v' ", i, row[i]))
-		}
-		param, err := b.makeParam(row[i], col)
-		if err != nil {
-			return nil, fmt.Errorf("bulkcopy: %s", err.Error())
-		}
-
-		if col.ti.Writer == nil {
-			return nil, fmt.Errorf("no writer for column: %s, TypeId: %#x",
-				col.ColName, col.ti.TypeId)
-		}
-		err = col.ti.Writer(buf, param.ti, param.buffer)
-		if err != nil {
-			return nil, fmt.Errorf("bulkcopy: %s", err.Error())
-		}
-	}
-
-	b.dlogf("row[%d] %s\n", b.numRows, logcol.String())
-
-	return buf.Bytes(), nil
-}
-
-func (b *Bulk) Done() (rowcount int64, err error) {
-	if b.headerSent == false {
-		//no rows had been sent
-		return 0, nil
-	}
-	var buf = b.cn.sess.buf
-	buf.WriteByte(byte(tokenDone))
-
-	binary.Write(buf, binary.LittleEndian, uint16(doneFinal))
-	binary.Write(buf, binary.LittleEndian, uint16(0)) //     curcmd
-
-	if b.cn.sess.loginAck.TDSVersion >= verTDS72 {
-		binary.Write(buf, binary.LittleEndian, uint64(0)) //rowcount 0
-	} else {
-		binary.Write(buf, binary.LittleEndian, uint32(0)) //rowcount 0
-	}
-
-	buf.FinishPacket()
-
-	tokchan := make(chan tokenStruct, 5)
-	go processResponse(b.ctx, b.cn.sess, tokchan, nil)
-
-	var rowCount int64
-	for token := range tokchan {
-		switch token := token.(type) {
-		case doneStruct:
-			if token.Status&doneCount != 0 {
-				rowCount = int64(token.RowCount)
-			}
-			if token.isError() {
-				return 0, token.getError()
-			}
-		case error:
-			return 0, b.cn.checkBadConn(token)
-		}
-	}
-	return rowCount, nil
-}
-
-func (b *Bulk) createColMetadata() []byte {
-	buf := new(bytes.Buffer)
-	buf.WriteByte(byte(tokenColMetadata))                              // token
-	binary.Write(buf, binary.LittleEndian, uint16(len(b.bulkColumns))) // column count
-
-	for i, col := range b.bulkColumns {
-
-		if b.cn.sess.loginAck.TDSVersion >= verTDS72 {
-			binary.Write(buf, binary.LittleEndian, uint32(col.UserType)) //  usertype, always 0?
-		} else {
-			binary.Write(buf, binary.LittleEndian, uint16(col.UserType))
-		}
-		binary.Write(buf, binary.LittleEndian, uint16(col.Flags))
-
-		writeTypeInfo(buf, &b.bulkColumns[i].ti)
-
-		if col.ti.TypeId == typeNText ||
-			col.ti.TypeId == typeText ||
-			col.ti.TypeId == typeImage {
-
-			tablename_ucs2 := str2ucs2(b.tablename)
-			binary.Write(buf, binary.LittleEndian, uint16(len(tablename_ucs2)/2))
-			buf.Write(tablename_ucs2)
-		}
-		colname_ucs2 := str2ucs2(col.ColName)
-		buf.WriteByte(uint8(len(colname_ucs2) / 2))
-		buf.Write(colname_ucs2)
-	}
-
-	return buf.Bytes()
-}
-
-func (b *Bulk) getMetadata(ctx context.Context) (err error) {
-	stmt, err := b.cn.prepareContext(ctx, "SET FMTONLY ON")
-	if err != nil {
-		return
-	}
-
-	_, err = stmt.ExecContext(ctx, nil)
-	if err != nil {
-		return
-	}
-
-	// Get columns info.
-	stmt, err = b.cn.prepareContext(ctx, fmt.Sprintf("select * from %s SET FMTONLY OFF", b.tablename))
-	if err != nil {
-		return
-	}
-	rows, err := stmt.QueryContext(ctx, nil)
-	if err != nil {
-		return fmt.Errorf("get columns info failed: %v", err)
-	}
-	b.metadata = rows.(*Rows).cols
-
-	if b.Debug {
-		for _, col := range b.metadata {
-			b.dlogf("col: %s typeId: %#x size: %d scale: %d prec: %d flags: %d lcid: %#x\n",
-				col.ColName, col.ti.TypeId, col.ti.Size, col.ti.Scale, col.ti.Prec,
-				col.Flags, col.ti.Collation.LcidAndFlags)
-		}
-	}
-
-	return rows.Close()
-}
-
-func (b *Bulk) makeParam(val DataValue, col columnStruct) (res param, err error) {
-	res.ti.Size = col.ti.Size
-	res.ti.TypeId = col.ti.TypeId
-
-	if val == nil {
-		res.ti.Size = 0
-		return
-	}
-
-	switch col.ti.TypeId {
-
-	case typeInt1, typeInt2, typeInt4, typeInt8, typeIntN:
-		var intvalue int64
-
-		switch val := val.(type) {
-		case int:
-			intvalue = int64(val)
-		case int32:
-			intvalue = int64(val)
-		case int64:
-			intvalue = val
-		default:
-			err = fmt.Errorf("mssql: invalid type for int column: %T", val)
-			return
-		}
-
-		res.buffer = make([]byte, res.ti.Size)
-		if col.ti.Size == 1 {
-			res.buffer[0] = byte(intvalue)
-		} else if col.ti.Size == 2 {
-			binary.LittleEndian.PutUint16(res.buffer, uint16(intvalue))
-		} else if col.ti.Size == 4 {
-			binary.LittleEndian.PutUint32(res.buffer, uint32(intvalue))
-		} else if col.ti.Size == 8 {
-			binary.LittleEndian.PutUint64(res.buffer, uint64(intvalue))
-		}
-	case typeFlt4, typeFlt8, typeFltN:
-		var floatvalue float64
-
-		switch val := val.(type) {
-		case float32:
-			floatvalue = float64(val)
-		case float64:
-			floatvalue = val
-		case int:
-			floatvalue = float64(val)
-		case int64:
-			floatvalue = float64(val)
-		default:
-			err = fmt.Errorf("mssql: invalid type for float column: %T %s", val, val)
-			return
-		}
-
-		if col.ti.Size == 4 {
-			res.buffer = make([]byte, 4)
-			binary.LittleEndian.PutUint32(res.buffer, math.Float32bits(float32(floatvalue)))
-		} else if col.ti.Size == 8 {
-			res.buffer = make([]byte, 8)
-			binary.LittleEndian.PutUint64(res.buffer, math.Float64bits(floatvalue))
-		}
-	case typeNVarChar, typeNText, typeNChar:
-
-		switch val := val.(type) {
-		case string:
-			res.buffer = str2ucs2(val)
-		case []byte:
-			res.buffer = val
-		default:
-			err = fmt.Errorf("mssql: invalid type for nvarchar column: %T %s", val, val)
-			return
-		}
-		res.ti.Size = len(res.buffer)
-
-	case typeVarChar, typeBigVarChar, typeText, typeChar, typeBigChar:
-		switch val := val.(type) {
-		case string:
-			res.buffer = []byte(val)
-		case []byte:
-			res.buffer = val
-		default:
-			err = fmt.Errorf("mssql: invalid type for varchar column: %T %s", val, val)
-			return
-		}
-		res.ti.Size = len(res.buffer)
-
-	case typeBit, typeBitN:
-		if reflect.TypeOf(val).Kind() != reflect.Bool {
-			err = fmt.Errorf("mssql: invalid type for bit column: %T %s", val, val)
-			return
-		}
-		res.ti.TypeId = typeBitN
-		res.ti.Size = 1
-		res.buffer = make([]byte, 1)
-		if val.(bool) {
-			res.buffer[0] = 1
-		}
-	case typeDateTime2N:
-		switch val := val.(type) {
-		case time.Time:
-			res.buffer = encodeDateTime2(val, int(col.ti.Scale))
-			res.ti.Size = len(res.buffer)
-		case string:
-			var t time.Time
-			if t, err = time.Parse(sqlTimeFormat, val); err != nil {
-				return res, fmt.Errorf("bulk: unable to convert string to date: %v", err)
-			}
-			res.buffer = encodeDateTime2(t, int(col.ti.Scale))
-			res.ti.Size = len(res.buffer)
-		default:
-			err = fmt.Errorf("mssql: invalid type for datetime2 column: %T %s", val, val)
-			return
-		}
-	case typeDateTimeOffsetN:
-		switch val := val.(type) {
-		case time.Time:
-			res.buffer = encodeDateTimeOffset(val, int(col.ti.Scale))
-			res.ti.Size = len(res.buffer)
-		case string:
-			var t time.Time
-			if t, err = time.Parse(sqlTimeFormat, val); err != nil {
-				return res, fmt.Errorf("bulk: unable to convert string to date: %v", err)
-			}
-			res.buffer = encodeDateTimeOffset(t, int(col.ti.Scale))
-			res.ti.Size = len(res.buffer)
-		default:
-			err = fmt.Errorf("mssql: invalid type for datetimeoffset column: %T %s", val, val)
-			return
-		}
-	case typeDateN:
-		switch val := val.(type) {
-		case time.Time:
-			res.buffer = encodeDate(val)
-			res.ti.Size = len(res.buffer)
-		case string:
-			var t time.Time
-			if t, err = time.ParseInLocation(sqlDateFormat, val, time.UTC); err != nil {
-				return res, fmt.Errorf("bulk: unable to convert string to date: %v", err)
-			}
-			res.buffer = encodeDate(t)
-			res.ti.Size = len(res.buffer)
-		default:
-			err = fmt.Errorf("mssql: invalid type for date column: %T %s", val, val)
-			return
-		}
-	case typeDateTime, typeDateTimeN, typeDateTim4:
-		var t time.Time
-		switch val := val.(type) {
-		case time.Time:
-			t = val
-		case string:
-			if t, err = time.Parse(sqlTimeFormat, val); err != nil {
-				return res, fmt.Errorf("bulk: unable to convert string to date: %v", err)
-			}
-		default:
-			err = fmt.Errorf("mssql: invalid type for datetime column: %T %s", val, val)
-			return
-		}
-
-		if col.ti.Size == 4 {
-			res.buffer = encodeDateTim4(t)
-			res.ti.Size = len(res.buffer)
-		} else if col.ti.Size == 8 {
-			res.buffer = encodeDateTime(t)
-			res.ti.Size = len(res.buffer)
-		} else {
-			err = fmt.Errorf("mssql: invalid size of column %d", col.ti.Size)
-		}
-
-	// case typeMoney, typeMoney4, typeMoneyN:
-	case typeDecimal, typeDecimalN, typeNumeric, typeNumericN:
-		prec := col.ti.Prec
-		scale := col.ti.Scale
-		var dec decimal.Decimal
-		switch v := val.(type) {
-		case int:
-			dec = decimal.Int64ToDecimalScale(int64(v), 0)
-		case int8:
-			dec = decimal.Int64ToDecimalScale(int64(v), 0)
-		case int16:
-			dec = decimal.Int64ToDecimalScale(int64(v), 0)
-		case int32:
-			dec = decimal.Int64ToDecimalScale(int64(v), 0)
-		case int64:
-			dec = decimal.Int64ToDecimalScale(int64(v), 0)
-		case float32:
-			dec, err = decimal.Float64ToDecimalScale(float64(v), scale)
-		case float64:
-			dec, err = decimal.Float64ToDecimalScale(float64(v), scale)
-		case string:
-			dec, err = decimal.StringToDecimalScale(v, scale)
-		default:
-			return res, fmt.Errorf("unknown value for decimal: %T %#v", v, v)
-		}
-
-		if err != nil {
-			return res, err
-		}
-		dec.SetPrec(prec)
-
-		var length byte
-		switch {
-		case prec <= 9:
-			length = 4
-		case prec <= 19:
-			length = 8
-		case prec <= 28:
-			length = 12
-		default:
-			length = 16
-		}
-
-		buf := make([]byte, length+1)
-		// first byte length written by typeInfo.writer
-		res.ti.Size = int(length) + 1
-		// second byte sign
-		if !dec.IsPositive() {
-			buf[0] = 0
-		} else {
-			buf[0] = 1
-		}
-
-		ub := dec.UnscaledBytes()
-		l := len(ub)
-		if l > int(length) {
-			err = fmt.Errorf("decimal out of range: %s", dec)
-			return res, err
-		}
-		// reverse the bytes
-		for i, j := 1, l-1; j >= 0; i, j = i+1, j-1 {
-			buf[i] = ub[j]
-		}
-		res.buffer = buf
-	case typeBigVarBin, typeBigBinary:
-		switch val := val.(type) {
-		case []byte:
-			res.ti.Size = len(val)
-			res.buffer = val
-		default:
-			err = fmt.Errorf("mssql: invalid type for Binary column: %T %s", val, val)
-			return
-		}
-	case typeGuid:
-		switch val := val.(type) {
-		case []byte:
-			res.ti.Size = len(val)
-			res.buffer = val
-		default:
-			err = fmt.Errorf("mssql: invalid type for Guid column: %T %s", val, val)
-			return
-		}
-
-	default:
-		err = fmt.Errorf("mssql: type %x not implemented", col.ti.TypeId)
-	}
-	return
-
-}
-
-func (b *Bulk) dlogf(format string, v ...interface{}) {
-	if b.Debug {
-		b.cn.sess.log.Printf(format, v...)
-	}
-}

vendor/github.com/denisenkom/go-mssqldb/bulkcopy_sql.go

@@ -1,93 +0,0 @@
-package mssql
-
-import (
-	"context"
-	"database/sql/driver"
-	"encoding/json"
-	"errors"
-)
-
-type copyin struct {
-	cn       *Conn
-	bulkcopy *Bulk
-	closed   bool
-}
-
-type serializableBulkConfig struct {
-	TableName   string
-	ColumnsName []string
-	Options     BulkOptions
-}
-
-func (d *Driver) OpenConnection(dsn string) (*Conn, error) {
-	return d.open(context.Background(), dsn)
-}
-
-func (c *Conn) prepareCopyIn(ctx context.Context, query string) (_ driver.Stmt, err error) {
-	config_json := query[11:]
-
-	bulkconfig := serializableBulkConfig{}
-	err = json.Unmarshal([]byte(config_json), &bulkconfig)
-	if err != nil {
-		return
-	}
-
-	bulkcopy := c.CreateBulkContext(ctx, bulkconfig.TableName, bulkconfig.ColumnsName)
-	bulkcopy.Options = bulkconfig.Options
-
-	ci := &copyin{
-		cn:       c,
-		bulkcopy: bulkcopy,
-	}
-
-	return ci, nil
-}
-
-func CopyIn(table string, options BulkOptions, columns ...string) string {
-	bulkconfig := &serializableBulkConfig{TableName: table, Options: options, ColumnsName: columns}
-
-	config_json, err := json.Marshal(bulkconfig)
-	if err != nil {
-		panic(err)
-	}
-
-	stmt := "INSERTBULK " + string(config_json)
-
-	return stmt
-}
-
-func (ci *copyin) NumInput() int {
-	return -1
-}
-
-func (ci *copyin) Query(v []driver.Value) (r driver.Rows, err error) {
-	panic("should never be called")
-}
-
-func (ci *copyin) Exec(v []driver.Value) (r driver.Result, err error) {
-	if ci.closed {
-		return nil, errors.New("copyin query is closed")
-	}
-
-	if len(v) == 0 {
-		rowCount, err := ci.bulkcopy.Done()
-		ci.closed = true
-		return driver.RowsAffected(rowCount), err
-	}
-
-	t := make([]interface{}, len(v))
-	for i, val := range v {
-		t[i] = val
-	}
-
-	err = ci.bulkcopy.AddRow(t)
-	if err != nil {
-		return
-	}
-
-	return driver.RowsAffected(0), nil
-}
-
-func (ci *copyin) Close() (err error) {
-	return nil
-}

vendor/github.com/denisenkom/go-mssqldb/conn_str.go

@@ -1,456 +0,0 @@
-package mssql
-
-import (
-	"fmt"
-	"net"
-	"net/url"
-	"os"
-	"strconv"
-	"strings"
-	"time"
-	"unicode"
-)
-
-type connectParams struct {
-	logFlags                  uint64
-	port                      uint64
-	host                      string
-	instance                  string
-	database                  string
-	user                      string
-	password                  string
-	dial_timeout              time.Duration
-	conn_timeout              time.Duration
-	keepAlive                 time.Duration
-	encrypt                   bool
-	disableEncryption         bool
-	trustServerCertificate    bool
-	certificate               string
-	hostInCertificate         string
-	hostInCertificateProvided bool
-	serverSPN                 string
-	workstation               string
-	appname                   string
-	typeFlags                 uint8
-	failOverPartner           string
-	failOverPort              uint64
-	packetSize                uint16
-}
-
-func parseConnectParams(dsn string) (connectParams, error) {
-	var p connectParams
-
-	var params map[string]string
-	if strings.HasPrefix(dsn, "odbc:") {
-		parameters, err := splitConnectionStringOdbc(dsn[len("odbc:"):])
-		if err != nil {
-			return p, err
-		}
-		params = parameters
-	} else if strings.HasPrefix(dsn, "sqlserver://") {
-		parameters, err := splitConnectionStringURL(dsn)
-		if err != nil {
-			return p, err
-		}
-		params = parameters
-	} else {
-		params = splitConnectionString(dsn)
-	}
-
-	strlog, ok := params["log"]
-	if ok {
-		var err error
-		p.logFlags, err = strconv.ParseUint(strlog, 10, 64)
-		if err != nil {
-			return p, fmt.Errorf("Invalid log parameter '%s': %s", strlog, err.Error())
-		}
-	}
-	server := params["server"]
-	parts := strings.SplitN(server, `\`, 2)
-	p.host = parts[0]
-	if p.host == "." || strings.ToUpper(p.host) == "(LOCAL)" || p.host == "" {
-		p.host = "localhost"
-	}
-	if len(parts) > 1 {
-		p.instance = parts[1]
-	}
-	p.database = params["database"]
-	p.user = params["user id"]
-	p.password = params["password"]
-
-	p.port = 1433
-	strport, ok := params["port"]
-	if ok {
-		var err error
-		p.port, err = strconv.ParseUint(strport, 10, 16)
-		if err != nil {
-			f := "Invalid tcp port '%v': %v"
-			return p, fmt.Errorf(f, strport, err.Error())
-		}
-	}
-
-	// https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/configure-the-network-packet-size-server-configuration-option
-	// Default packet size remains at 4096 bytes
-	p.packetSize = 4096
-	strpsize, ok := params["packet size"]
-	if ok {
-		var err error
-		psize, err := strconv.ParseUint(strpsize, 0, 16)
-		if err != nil {
-			f := "Invalid packet size '%v': %v"
-			return p, fmt.Errorf(f, strpsize, err.Error())
-		}
-
-		// Ensure packet size falls within the TDS protocol range of 512 to 32767 bytes
-		// NOTE: Encrypted connections have a maximum size of 16383 bytes.  If you request
-		// a higher packet size, the server will respond with an ENVCHANGE request to
-		// alter the packet size to 16383 bytes.
-		p.packetSize = uint16(psize)
-		if p.packetSize < 512 {
-			p.packetSize = 512
-		} else if p.packetSize > 32767 {
-			p.packetSize = 32767
-		}
-	}
-
-	// https://msdn.microsoft.com/en-us/library/dd341108.aspx
-	//
-	// Do not set a connection timeout. Use Context to manage such things.
-	// Default to zero, but still allow it to be set.
-	if strconntimeout, ok := params["connection timeout"]; ok {
-		timeout, err := strconv.ParseUint(strconntimeout, 10, 64)
-		if err != nil {
-			f := "Invalid connection timeout '%v': %v"
-			return p, fmt.Errorf(f, strconntimeout, err.Error())
-		}
-		p.conn_timeout = time.Duration(timeout) * time.Second
-	}
-	p.dial_timeout = 15 * time.Second
-	if strdialtimeout, ok := params["dial timeout"]; ok {
-		timeout, err := strconv.ParseUint(strdialtimeout, 10, 64)
-		if err != nil {
-			f := "Invalid dial timeout '%v': %v"
-			return p, fmt.Errorf(f, strdialtimeout, err.Error())
-		}
-		p.dial_timeout = time.Duration(timeout) * time.Second
-	}
-
-	// default keep alive should be 30 seconds according to spec:
-	// https://msdn.microsoft.com/en-us/library/dd341108.aspx
-	p.keepAlive = 30 * time.Second
-	if keepAlive, ok := params["keepalive"]; ok {
-		timeout, err := strconv.ParseUint(keepAlive, 10, 64)
-		if err != nil {
-			f := "Invalid keepAlive value '%s': %s"
-			return p, fmt.Errorf(f, keepAlive, err.Error())
-		}
-		p.keepAlive = time.Duration(timeout) * time.Second
-	}
-	encrypt, ok := params["encrypt"]
-	if ok {
-		if strings.EqualFold(encrypt, "DISABLE") {
-			p.disableEncryption = true
-		} else {
-			var err error
-			p.encrypt, err = strconv.ParseBool(encrypt)
-			if err != nil {
-				f := "Invalid encrypt '%s': %s"
-				return p, fmt.Errorf(f, encrypt, err.Error())
-			}
-		}
-	} else {
-		p.trustServerCertificate = true
-	}
-	trust, ok := params["trustservercertificate"]
-	if ok {
-		var err error
-		p.trustServerCertificate, err = strconv.ParseBool(trust)
-		if err != nil {
-			f := "Invalid trust server certificate '%s': %s"
-			return p, fmt.Errorf(f, trust, err.Error())
-		}
-	}
-	p.certificate = params["certificate"]
-	p.hostInCertificate, ok = params["hostnameincertificate"]
-	if ok {
-		p.hostInCertificateProvided = true
-	} else {
-		p.hostInCertificate = p.host
-		p.hostInCertificateProvided = false
-	}
-
-	serverSPN, ok := params["serverspn"]
-	if ok {
-		p.serverSPN = serverSPN
-	} else {
-		p.serverSPN = fmt.Sprintf("MSSQLSvc/%s:%d", p.host, p.port)
-	}
-
-	workstation, ok := params["workstation id"]
-	if ok {
-		p.workstation = workstation
-	} else {
-		workstation, err := os.Hostname()
-		if err == nil {
-			p.workstation = workstation
-		}
-	}
-
-	appname, ok := params["app name"]
-	if !ok {
-		appname = "go-mssqldb"
-	}
-	p.appname = appname
-
-	appintent, ok := params["applicationintent"]
-	if ok {
-		if appintent == "ReadOnly" {
-			if p.database == "" {
-				return p, fmt.Errorf("Database must be specified when ApplicationIntent is ReadOnly")
-			}
-			p.typeFlags |= fReadOnlyIntent
-		}
-	}
-
-	failOverPartner, ok := params["failoverpartner"]
-	if ok {
-		p.failOverPartner = failOverPartner
-	}
-
-	failOverPort, ok := params["failoverport"]
-	if ok {
-		var err error
-		p.failOverPort, err = strconv.ParseUint(failOverPort, 0, 16)
-		if err != nil {
-			f := "Invalid tcp port '%v': %v"
-			return p, fmt.Errorf(f, failOverPort, err.Error())
-		}
-	}
-
-	return p, nil
-}
-
-func splitConnectionString(dsn string) (res map[string]string) {
-	res = map[string]string{}
-	parts := strings.Split(dsn, ";")
-	for _, part := range parts {
-		if len(part) == 0 {
-			continue
-		}
-		lst := strings.SplitN(part, "=", 2)
-		name := strings.TrimSpace(strings.ToLower(lst[0]))
-		if len(name) == 0 {
-			continue
-		}
-		var value string = ""
-		if len(lst) > 1 {
-			value = strings.TrimSpace(lst[1])
-		}
-		res[name] = value
-	}
-	return res
-}
-
-// Splits a URL of the form sqlserver://username:password@host/instance?param1=value&param2=value
-func splitConnectionStringURL(dsn string) (map[string]string, error) {
-	res := map[string]string{}
-
-	u, err := url.Parse(dsn)
-	if err != nil {
-		return res, err
-	}
-
-	if u.Scheme != "sqlserver" {
-		return res, fmt.Errorf("scheme %s is not recognized", u.Scheme)
-	}
-
-	if u.User != nil {
-		res["user id"] = u.User.Username()
-		p, exists := u.User.Password()
-		if exists {
-			res["password"] = p
-		}
-	}
-
-	host, port, err := net.SplitHostPort(u.Host)
-	if err != nil {
-		host = u.Host
-	}
-
-	if len(u.Path) > 0 {
-		res["server"] = host + "\\" + u.Path[1:]
-	} else {
-		res["server"] = host
-	}
-
-	if len(port) > 0 {
-		res["port"] = port
-	}
-
-	query := u.Query()
-	for k, v := range query {
-		if len(v) > 1 {
-			return res, fmt.Errorf("key %s provided more than once", k)
-		}
-		res[strings.ToLower(k)] = v[0]
-	}
-
-	return res, nil
-}
-
-// Splits a URL in the ODBC format
-func splitConnectionStringOdbc(dsn string) (map[string]string, error) {
-	res := map[string]string{}
-
-	type parserState int
-	const (
-		// Before the start of a key
-		parserStateBeforeKey parserState = iota
-
-		// Inside a key
-		parserStateKey
-
-		// Beginning of a value. May be bare or braced
-		parserStateBeginValue
-
-		// Inside a bare value
-		parserStateBareValue
-
-		// Inside a braced value
-		parserStateBracedValue
-
-		// A closing brace inside a braced value.
-		// May be the end of the value or an escaped closing brace, depending on the next character
-		parserStateBracedValueClosingBrace
-
-		// After a value. Next character should be a semicolon or whitespace.
-		parserStateEndValue
-	)
-
-	var state = parserStateBeforeKey
-
-	var key string
-	var value string
-
-	for i, c := range dsn {
-		switch state {
-		case parserStateBeforeKey:
-			switch {
-			case c == '=':
-				return res, fmt.Errorf("Unexpected character = at index %d. Expected start of key or semi-colon or whitespace.", i)
-			case !unicode.IsSpace(c) && c != ';':
-				state = parserStateKey
-				key += string(c)
-			}
-
-		case parserStateKey:
-			switch c {
-			case '=':
-				key = normalizeOdbcKey(key)
-				state = parserStateBeginValue
-
-			case ';':
-				// Key without value
-				key = normalizeOdbcKey(key)
-				res[key] = value
-				key = ""
-				value = ""
-				state = parserStateBeforeKey
-
-			default:
-				key += string(c)
-			}
-
-		case parserStateBeginValue:
-			switch {
-			case c == '{':
-				state = parserStateBracedValue
-			case c == ';':
-				// Empty value
-				res[key] = value
-				key = ""
-				state = parserStateBeforeKey
-			case unicode.IsSpace(c):
-				// Ignore whitespace
-			default:
-				state = parserStateBareValue
-				value += string(c)
-			}
-
-		case parserStateBareValue:
-			if c == ';' {
-				res[key] = strings.TrimRightFunc(value, unicode.IsSpace)
-				key = ""
-				value = ""
-				state = parserStateBeforeKey
-			} else {
-				value += string(c)
-			}
-
-		case parserStateBracedValue:
-			if c == '}' {
-				state = parserStateBracedValueClosingBrace
-			} else {
-				value += string(c)
-			}
-
-		case parserStateBracedValueClosingBrace:
-			if c == '}' {
-				// Escaped closing brace
-				value += string(c)
-				state = parserStateBracedValue
-				continue
-			}
-
-			// End of braced value
-			res[key] = value
-			key = ""
-			value = ""
-
-			// This character is the first character past the end,
-			// so it needs to be parsed like the parserStateEndValue state.
-			state = parserStateEndValue
-			switch {
-			case c == ';':
-				state = parserStateBeforeKey
-			case unicode.IsSpace(c):
-				// Ignore whitespace
-			default:
-				return res, fmt.Errorf("Unexpected character %c at index %d. Expected semi-colon or whitespace.", c, i)
-			}
-
-		case parserStateEndValue:
-			switch {
-			case c == ';':
-				state = parserStateBeforeKey
-			case unicode.IsSpace(c):
-				// Ignore whitespace
-			default:
-				return res, fmt.Errorf("Unexpected character %c at index %d. Expected semi-colon or whitespace.", c, i)
-			}
-		}
-	}
-
-	switch state {
-	case parserStateBeforeKey: // Okay
-	case parserStateKey: // Unfinished key. Treat as key without value.
-		key = normalizeOdbcKey(key)
-		res[key] = value
-	case parserStateBeginValue: // Empty value
-		res[key] = value
-	case parserStateBareValue:
-		res[key] = strings.TrimRightFunc(value, unicode.IsSpace)
-	case parserStateBracedValue:
-		return res, fmt.Errorf("Unexpected end of braced value at index %d.", len(dsn))
-	case parserStateBracedValueClosingBrace: // End of braced value
-		res[key] = value
-	case parserStateEndValue: // Okay
-	}
-
-	return res, nil
-}
-
-// Normalizes the given string as an ODBC-format key
-func normalizeOdbcKey(s string) string {
-	return strings.ToLower(strings.TrimRightFunc(s, unicode.IsSpace))
-}

vendor/github.com/denisenkom/go-mssqldb/convert.go

@@ -1,306 +0,0 @@
-package mssql
-
-import "errors"
-
-// Copyright 2011 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// Type conversions for Scan.
-
-// This file was imported from database.sql.convert for go 1.10.3 with minor modifications to get
-// convertAssign function
-// This function is used internally by sql to convert values during call to Scan, we need same
-// logic to return values for OUTPUT parameters.
-// TODO: sql library should instead expose function defaultCheckNamedValue to be callable by drivers
-
-import (
-	"database/sql"
-	"database/sql/driver"
-	"fmt"
-	"reflect"
-	"strconv"
-	"time"
-)
-
-var errNilPtr = errors.New("destination pointer is nil") // embedded in descriptive error
-
-// convertAssign copies to dest the value in src, converting it if possible.
-// An error is returned if the copy would result in loss of information.
-// dest should be a pointer type.
-func convertAssign(dest, src interface{}) error {
-	// Common cases, without reflect.
-	switch s := src.(type) {
-	case string:
-		switch d := dest.(type) {
-		case *string:
-			if d == nil {
-				return errNilPtr
-			}
-			*d = s
-			return nil
-		case *[]byte:
-			if d == nil {
-				return errNilPtr
-			}
-			*d = []byte(s)
-			return nil
-		case *sql.RawBytes:
-			if d == nil {
-				return errNilPtr
-			}
-			*d = append((*d)[:0], s...)
-			return nil
-		}
-	case []byte:
-		switch d := dest.(type) {
-		case *string:
-			if d == nil {
-				return errNilPtr
-			}
-			*d = string(s)
-			return nil
-		case *interface{}:
-			if d == nil {
-				return errNilPtr
-			}
-			*d = cloneBytes(s)
-			return nil
-		case *[]byte:
-			if d == nil {
-				return errNilPtr
-			}
-			*d = cloneBytes(s)
-			return nil
-		case *sql.RawBytes:
-			if d == nil {
-				return errNilPtr
-			}
-			*d = s
-			return nil
-		}
-	case time.Time:
-		switch d := dest.(type) {
-		case *time.Time:
-			*d = s
-			return nil
-		case *string:
-			*d = s.Format(time.RFC3339Nano)
-			return nil
-		case *[]byte:
-			if d == nil {
-				return errNilPtr
-			}
-			*d = []byte(s.Format(time.RFC3339Nano))
-			return nil
-		case *sql.RawBytes:
-			if d == nil {
-				return errNilPtr
-			}
-			*d = s.AppendFormat((*d)[:0], time.RFC3339Nano)
-			return nil
-		}
-	case nil:
-		switch d := dest.(type) {
-		case *interface{}:
-			if d == nil {
-				return errNilPtr
-			}
-			*d = nil
-			return nil
-		case *[]byte:
-			if d == nil {
-				return errNilPtr
-			}
-			*d = nil
-			return nil
-		case *sql.RawBytes:
-			if d == nil {
-				return errNilPtr
-			}
-			*d = nil
-			return nil
-		}
-	}
-
-	var sv reflect.Value
-
-	switch d := dest.(type) {
-	case *string:
-		sv = reflect.ValueOf(src)
-		switch sv.Kind() {
-		case reflect.Bool,
-			reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64,
-			reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64,
-			reflect.Float32, reflect.Float64:
-			*d = asString(src)
-			return nil
-		}
-	case *[]byte:
-		sv = reflect.ValueOf(src)
-		if b, ok := asBytes(nil, sv); ok {
-			*d = b
-			return nil
-		}
-	case *sql.RawBytes:
-		sv = reflect.ValueOf(src)
-		if b, ok := asBytes([]byte(*d)[:0], sv); ok {
-			*d = sql.RawBytes(b)
-			return nil
-		}
-	case *bool:
-		bv, err := driver.Bool.ConvertValue(src)
-		if err == nil {
-			*d = bv.(bool)
-		}
-		return err
-	case *interface{}:
-		*d = src
-		return nil
-	}
-
-	if scanner, ok := dest.(sql.Scanner); ok {
-		return scanner.Scan(src)
-	}
-
-	dpv := reflect.ValueOf(dest)
-	if dpv.Kind() != reflect.Ptr {
-		return errors.New("destination not a pointer")
-	}
-	if dpv.IsNil() {
-		return errNilPtr
-	}
-
-	if !sv.IsValid() {
-		sv = reflect.ValueOf(src)
-	}
-
-	dv := reflect.Indirect(dpv)
-	if sv.IsValid() && sv.Type().AssignableTo(dv.Type()) {
-		switch b := src.(type) {
-		case []byte:
-			dv.Set(reflect.ValueOf(cloneBytes(b)))
-		default:
-			dv.Set(sv)
-		}
-		return nil
-	}
-
-	if dv.Kind() == sv.Kind() && sv.Type().ConvertibleTo(dv.Type()) {
-		dv.Set(sv.Convert(dv.Type()))
-		return nil
-	}
-
-	// The following conversions use a string value as an intermediate representation
-	// to convert between various numeric types.
-	//
-	// This also allows scanning into user defined types such as "type Int int64".
-	// For symmetry, also check for string destination types.
-	switch dv.Kind() {
-	case reflect.Ptr:
-		if src == nil {
-			dv.Set(reflect.Zero(dv.Type()))
-			return nil
-		} else {
-			dv.Set(reflect.New(dv.Type().Elem()))
-			return convertAssign(dv.Interface(), src)
-		}
-	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
-		s := asString(src)
-		i64, err := strconv.ParseInt(s, 10, dv.Type().Bits())
-		if err != nil {
-			err = strconvErr(err)
-			return fmt.Errorf("converting driver.Value type %T (%q) to a %s: %v", src, s, dv.Kind(), err)
-		}
-		dv.SetInt(i64)
-		return nil
-	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
-		s := asString(src)
-		u64, err := strconv.ParseUint(s, 10, dv.Type().Bits())
-		if err != nil {
-			err = strconvErr(err)
-			return fmt.Errorf("converting driver.Value type %T (%q) to a %s: %v", src, s, dv.Kind(), err)
-		}
-		dv.SetUint(u64)
-		return nil
-	case reflect.Float32, reflect.Float64:
-		s := asString(src)
-		f64, err := strconv.ParseFloat(s, dv.Type().Bits())
-		if err != nil {
-			err = strconvErr(err)
-			return fmt.Errorf("converting driver.Value type %T (%q) to a %s: %v", src, s, dv.Kind(), err)
-		}
-		dv.SetFloat(f64)
-		return nil
-	case reflect.String:
-		switch v := src.(type) {
-		case string:
-			dv.SetString(v)
-			return nil
-		case []byte:
-			dv.SetString(string(v))
-			return nil
-		}
-	}
-
-	return fmt.Errorf("unsupported Scan, storing driver.Value type %T into type %T", src, dest)
-}
-
-func strconvErr(err error) error {
-	if ne, ok := err.(*strconv.NumError); ok {
-		return ne.Err
-	}
-	return err
-}
-
-func cloneBytes(b []byte) []byte {
-	if b == nil {
-		return nil
-	} else {
-		c := make([]byte, len(b))
-		copy(c, b)
-		return c
-	}
-}
-
-func asString(src interface{}) string {
-	switch v := src.(type) {
-	case string:
-		return v
-	case []byte:
-		return string(v)
-	}
-	rv := reflect.ValueOf(src)
-	switch rv.Kind() {
-	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
-		return strconv.FormatInt(rv.Int(), 10)
-	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
-		return strconv.FormatUint(rv.Uint(), 10)
-	case reflect.Float64:
-		return strconv.FormatFloat(rv.Float(), 'g', -1, 64)
-	case reflect.Float32:
-		return strconv.FormatFloat(rv.Float(), 'g', -1, 32)
-	case reflect.Bool:
-		return strconv.FormatBool(rv.Bool())
-	}
-	return fmt.Sprintf("%v", src)
-}
-
-func asBytes(buf []byte, rv reflect.Value) (b []byte, ok bool) {
-	switch rv.Kind() {
-	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
-		return strconv.AppendInt(buf, rv.Int(), 10), true
-	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
-		return strconv.AppendUint(buf, rv.Uint(), 10), true
-	case reflect.Float32:
-		return strconv.AppendFloat(buf, rv.Float(), 'g', -1, 32), true
-	case reflect.Float64:
-		return strconv.AppendFloat(buf, rv.Float(), 'g', -1, 64), true
-	case reflect.Bool:
-		return strconv.AppendBool(buf, rv.Bool()), true
-	case reflect.String:
-		s := rv.String()
-		return append(buf, s...), true
-	}
-	return
-}

vendor/github.com/denisenkom/go-mssqldb/doc.go

@@ -1,14 +0,0 @@
-// package mssql implements the TDS protocol used to connect to MS SQL Server (sqlserver)
-// database servers.
-//
-// This package registers the driver:
-//    sqlserver: uses native "@" parameter placeholder names and does no pre-processing.
-//
-// If the ordinal position is used for query parameters, identifiers will be named
-// "@p1", "@p2", ... "@pN".
-//
-// Please refer to the README for the format of the DSN. There are multiple DSN
-// formats accepted: ADO style, ODBC style, and URL style. The following is an
-// example of a URL style DSN:
-//    sqlserver://sa:mypass@localhost:1234?database=master&connection+timeout=30
-package mssql

vendor/github.com/denisenkom/go-mssqldb/error.go

@@ -1,73 +0,0 @@
-package mssql
-
-import (
-	"fmt"
-)
-
-// Error represents an SQL Server error. This
-// type includes methods for reading the contents
-// of the struct, which allows calling programs
-// to check for specific error conditions without
-// having to import this package directly.
-type Error struct {
-	Number     int32
-	State      uint8
-	Class      uint8
-	Message    string
-	ServerName string
-	ProcName   string
-	LineNo     int32
-}
-
-func (e Error) Error() string {
-	return "mssql: " + e.Message
-}
-
-// SQLErrorNumber returns the SQL Server error number.
-func (e Error) SQLErrorNumber() int32 {
-	return e.Number
-}
-
-func (e Error) SQLErrorState() uint8 {
-	return e.State
-}
-
-func (e Error) SQLErrorClass() uint8 {
-	return e.Class
-}
-
-func (e Error) SQLErrorMessage() string {
-	return e.Message
-}
-
-func (e Error) SQLErrorServerName() string {
-	return e.ServerName
-}
-
-func (e Error) SQLErrorProcName() string {
-	return e.ProcName
-}
-
-func (e Error) SQLErrorLineNo() int32 {
-	return e.LineNo
-}
-
-type StreamError struct {
-	Message string
-}
-
-func (e StreamError) Error() string {
-	return e.Message
-}
-
-func streamErrorf(format string, v ...interface{}) StreamError {
-	return StreamError{"Invalid TDS stream: " + fmt.Sprintf(format, v...)}
-}
-
-func badStreamPanic(err error) {
-	panic(err)
-}
-
-func badStreamPanicf(format string, v ...interface{}) {
-	panic(streamErrorf(format, v...))
-}

vendor/github.com/denisenkom/go-mssqldb/go.mod

@@ -1,8 +0,0 @@
-module github.com/denisenkom/go-mssqldb
-
-go 1.11
-
-require (
-	github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe
-	golang.org/x/crypto v0.0.0-20190325154230-a5d413f7728c
-)