Release 2021.8.0

RELEASE_NOTES

@@ -1,3 +1,11 @@
+2021.8.0
+- 2021-07-30 TUN-4847: Allow to list tunnels by prefix name or exclusion prefix name
+- 2021-07-30 TUN-4772: Release built executables with packages
+- 2021-07-30 TUN-4851: Component tests to sanity check that Proxy DNS and Tunnel are only run when expected
+- 2021-07-28 TUN-4811: Publish quick tunnels' hostname in /metrics under `userHostname` for backwards-compatibility
+- 2021-07-29 TUN-4832: Prevent tunnel from running accidentally when only proxy-dns should run
+- 2021-07-28 TUN-4819: Tolerate protocol TXT record lookup failing
+
 2021.7.4
 - 2021-07-28 TUN-4814: Revert "TUN-4699: Make quick tunnels the default in cloudflared"
 - 2021-07-28 TUN-4812: Disable CGO for cloudflared builds

build-packages.sh

@@ -1,3 +1,5 @@
+VERSION=$(git describe --tags --always --dirty="-dev" --match "[0-9][0-9][0-9][0-9].*.*")
+echo $VERSION
 export CGO_ENABLED=0
 # This controls the directory the built artifacts go into
 export ARTIFACT_DIR=built_artifacts/
@@ -7,9 +9,10 @@ export TARGET_OS=windows
 for arch in ${windowsArchs[@]}; do 
     export TARGET_ARCH=$arch
     make cloudflared-msi
+    mv ./cloudflared.exe $ARTIFACT_DIR/cloudflared-windows-$arch.exe
+    mv cloudflared-$VERSION-$arch.msi $ARTIFACT_DIR/cloudflared-windows-$arch.msi
 done
 
-mv *.msi $ARTIFACT_DIR
 
 export FIPS=true
 linuxArchs=("amd64" "386" "arm")
@@ -17,8 +20,18 @@ export TARGET_OS=linux
 for arch in ${linuxArchs[@]}; do 
     export TARGET_ARCH=$arch
     make cloudflared-deb
+    mv cloudflared\_$VERSION\_$arch.deb $ARTIFACT_DIR/cloudflared-linux-$arch.deb
+
+    # rpm packages invert the - and _ and use x86_64 instead of amd64. 
+    RPMVERSION=$(echo $VERSION|sed -r 's/-/_/g')
+    RPMARCH=$arch
+    if [ $arch == "amd64" ];then
+        RPMARCH="x86_64"
+    fi
     make cloudflared-rpm
+    mv cloudflared-$RPMVERSION-1.$RPMARCH.rpm $ARTIFACT_DIR/cloudflared-linux-$RPMARCH.rpm
+
+    # finally move the linux binary as well.
+    mv ./cloudflared $ARTIFACT_DIR/cloudflared-linux-$arch
 done
 
-mv *.deb $ARTIFACT_DIR
-mv *.rpm $ARTIFACT_DIR

cfsetup.yaml

@@ -108,20 +108,6 @@ stretch: &stretch
       - export GOARCH=amd64
       - export FIPS=true
       - make release
-  github-release-linux-amd64:
-    build_dir: *build_dir
-    builddeps:
-      - *pinned_go_fips
-      - build-essential
-      - python3-setuptools
-      - python3-pip
-    pre-cache: &install_pygithub
-      - pip3 install pygithub
-    post-cache:
-      - export GOOS=linux
-      - export GOARCH=amd64
-      - export FIPS=true
-      - make github-release
   release-linux-armv6:
     build_dir: *build_dir
     builddeps:
@@ -133,20 +119,6 @@ stretch: &stretch
       - export GOARCH=arm
       - export CC=arm-linux-gnueabihf-gcc
       - make release
-  github-release-linux-armv6:
-    build_dir: *build_dir
-    builddeps:
-      - *pinned_go
-      - crossbuild-essential-armhf
-      - gcc-arm-linux-gnueabihf
-      - python3-setuptools
-      - python3-pip
-    pre-cache: *install_pygithub
-    post-cache:
-      - export GOOS=linux
-      - export GOARCH=arm
-      - export CC=arm-linux-gnueabihf-gcc
-      - make github-release
   release-linux-386:
     build_dir: *build_dir
     builddeps:
@@ -156,18 +128,6 @@ stretch: &stretch
       - export GOOS=linux
       - export GOARCH=386
       - make release
-  github-release-linux-386:
-    build_dir: *build_dir
-    builddeps:
-      - *pinned_go
-      - gcc-multilib
-      - python3-setuptools
-      - python3-pip
-    pre-cache: *install_pygithub
-    post-cache:
-      - export GOOS=linux
-      - export GOARCH=386
-      - make github-release
   release-windows-amd64:
     build_dir: *build_dir
     builddeps:
@@ -178,19 +138,6 @@ stretch: &stretch
       - export GOARCH=amd64
       - export CC=x86_64-w64-mingw32-gcc
       - make release
-  github-release-windows-amd64:
-    build_dir: *build_dir
-    builddeps:
-      - *pinned_go
-      - gcc-mingw-w64
-      - python3-setuptools
-      - python3-pip
-    pre-cache: *install_pygithub
-    post-cache:
-      - export GOOS=windows
-      - export GOARCH=amd64
-      - export CC=x86_64-w64-mingw32-gcc
-      - make github-release
   release-windows-386:
     build_dir: *build_dir
     builddeps:
@@ -201,40 +148,14 @@ stretch: &stretch
       - export GOARCH=386
       - export CC=i686-w64-mingw32-gcc-win32
       - make release
-  github-release-windows-386:
-    build_dir: *build_dir
-    builddeps:
-      - *pinned_go
-      - gcc-mingw-w64
-      - python3-setuptools
-      - python3-pip
-    pre-cache: *install_pygithub
-    post-cache:
-      - export GOOS=windows
-      - export GOARCH=386
-      - export CC=i686-w64-mingw32-gcc-win32
-      - make github-release
-  github-release-linux-arm64:
-    build_dir: *build_dir
-    builddeps:
-      - *pinned_go
-      - crossbuild-essential-armhf
-      - g++-aarch64-linux-gnu
-      - python3-setuptools
-      - python3-pip
-    pre-cache: *install_pygithub
-    post-cache:
-      - export GOOS=linux
-      - export GOARCH=arm64
-      - export CC=aarch64-linux-gnu-gcc
-      - make github-release
   github-release-macos-amd64:
     build_dir: *build_dir
     builddeps:
       - *pinned_go
       - python3-setuptools
       - python3-pip
-    pre-cache: *install_pygithub
+    pre-cache: &install_pygithub
+      - pip3 install pygithub
     post-cache:
       - make github-mac-upload
   test:

cmd/cloudflared/tunnel/cmd.go

@@ -165,7 +165,7 @@ func TunnelCommand(c *cli.Context) error {
 
 	// Unauthenticated named tunnel on <random>.<quick-tunnels-service>.com
 	// For now, default to legacy setup unless quick-service is specified
-	if c.String("hostname") == "" && c.String("quick-service") != "" {
+	if !dnsProxyStandAlone(c, nil) && c.String("hostname") == "" && c.String("quick-service") != "" {
 		return RunQuickTunnel(sc)
 	}
 

cmd/cloudflared/tunnel/quick_tunnel.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"strings"
 	"time"
 
 	"github.com/google/uuid"
@@ -51,9 +52,14 @@ func RunQuickTunnel(sc *subcommandContext) error {
 		TunnelName:   data.Result.Name,
 	}
 
+	url := data.Result.Hostname
+	if !strings.HasPrefix(url, "https://") {
+		url = "https://" + url
+	}
+
 	for _, line := range connection.AsciiBox([]string{
 		"Your Quick Tunnel has been created! Visit it at:",
-		data.Result.Hostname,
+		url,
 	}, 2) {
 		sc.log.Info().Msg(line)
 	}

cmd/cloudflared/tunnel/subcommands.go

@@ -49,6 +49,16 @@ var (
 		Aliases: []string{"n"},
 		Usage:   "List tunnels with the given `NAME`",
 	}
+	listNamePrefixFlag = &cli.StringFlag{
+		Name:    "name-prefix",
+		Aliases: []string{"np"},
+		Usage:   "List tunnels that start with the give `NAME` prefix",
+	}
+	listExcludeNamePrefixFlag = &cli.StringFlag{
+		Name:    "exclude-name-prefix",
+		Aliases: []string{"enp"},
+		Usage:   "List tunnels whose `NAME` does not start with the given prefix",
+	}
 	listExistedAtFlag = &cli.TimestampFlag{
 		Name:        "when",
 		Aliases:     []string{"w"},
@@ -217,6 +227,8 @@ func buildListCommand() *cli.Command {
 			outputFormatFlag,
 			showDeletedFlag,
 			listNameFlag,
+			listNamePrefixFlag,
+			listExcludeNamePrefixFlag,
 			listExistedAtFlag,
 			listIDFlag,
 			showRecentlyDisconnected,
@@ -243,6 +255,12 @@ func listCommand(c *cli.Context) error {
 	if name := c.String("name"); name != "" {
 		filter.ByName(name)
 	}
+	if namePrefix := c.String("name-prefix"); namePrefix != "" {
+		filter.ByNamePrefix(namePrefix)
+	}
+	if excludePrefix := c.String("exclude-name-prefix"); excludePrefix != "" {
+		filter.ExcludeNameWithPrefix(excludePrefix)
+	}
 	if existedAt := c.Timestamp("time"); existedAt != nil {
 		filter.ByExistedAt(*existedAt)
 	}

component-tests/config.py

@@ -3,7 +3,7 @@ import copy
 
 from dataclasses import dataclass, InitVar
 
-from constants import METRICS_PORT
+from constants import METRICS_PORT, PROXY_DNS_PORT
 
 # frozen=True raises exception when assigning to fields. This emulates immutability
 
@@ -93,3 +93,12 @@ class ClassicTunnelConfig(ClassicTunnelBaseConfig):
 
     def get_url(self):
         return "https://" + self.hostname
+
+
+@dataclass(frozen=True)
+class ProxyDnsConfig(BaseConfig):
+    full_config = {
+        "port": PROXY_DNS_PORT,
+        "no-autoupdate": True,
+    }
+

component-tests/conftest.py

@@ -1,14 +1,21 @@
 import os
+from enum import Enum, auto
+from time import sleep
+
 import pytest
 import yaml
 
-from time import sleep
-
-from config import NamedTunnelConfig, ClassicTunnelConfig
-from constants import BACKOFF_SECS
+from config import NamedTunnelConfig, ClassicTunnelConfig, ProxyDnsConfig
+from constants import BACKOFF_SECS, PROXY_DNS_PORT
 from util import LOGGER
 
 
+class CfdModes(Enum):
+    NAMED = auto()
+    CLASSIC = auto()
+    PROXY_DNS = auto()
+
+
 @pytest.fixture(scope="session")
 def component_tests_config():
     config_file = os.getenv("COMPONENT_TESTS_CONFIG")
@@ -19,22 +26,30 @@ def component_tests_config():
         config = yaml.safe_load(stream)
         LOGGER.info(f"component tests base config {config}")
 
-        def _component_tests_config(additional_config={}, named_tunnel=True):
+        def _component_tests_config(additional_config={}, cfd_mode=CfdModes.NAMED, run_proxy_dns=True):
+            if run_proxy_dns:
+                # Regression test for TUN-4177, running with proxy-dns should not prevent tunnels from running.
+                # So we run all tests with it.
+                additional_config["proxy-dns"] = True
+                additional_config["proxy-dns-port"] = PROXY_DNS_PORT
+            else:
+                additional_config.pop("proxy-dns", None)
+                additional_config.pop("proxy-dns-port", None)
 
-            # Regression test for TUN-4177, running with proxy-dns should not prevent tunnels from running
-            additional_config["proxy-dns"] = True
-            additional_config["proxy-dns-port"] = 9053
-
-            if named_tunnel:
+            if cfd_mode is CfdModes.NAMED:
                 return NamedTunnelConfig(additional_config=additional_config,
                                          cloudflared_binary=config['cloudflared_binary'],
                                          tunnel=config['tunnel'],
                                          credentials_file=config['credentials_file'],
                                          ingress=config['ingress'])
-
-            return ClassicTunnelConfig(
-                additional_config=additional_config, cloudflared_binary=config['cloudflared_binary'],
-                hostname=config['classic_hostname'], origincert=config['origincert'])
+            elif cfd_mode is CfdModes.CLASSIC:
+                return ClassicTunnelConfig(
+                    additional_config=additional_config, cloudflared_binary=config['cloudflared_binary'],
+                    hostname=config['classic_hostname'], origincert=config['origincert'])
+            elif cfd_mode is CfdModes.PROXY_DNS:
+                return ProxyDnsConfig(cloudflared_binary=config['cloudflared_binary'])
+            else:
+                raise Exception(f"Unknown cloudflared mode {cfd_mode}")
 
         return _component_tests_config
 

component-tests/constants.py

@@ -1,3 +1,5 @@
 METRICS_PORT = 51000
 MAX_RETRIES = 5
 BACKOFF_SECS = 7
+
+PROXY_DNS_PORT = 9053

component-tests/test_proxy_dns.py

@@ -0,0 +1,72 @@
+#!/usr/bin/env python
+import socket
+from time import sleep
+
+import constants
+from conftest import CfdModes
+from util import start_cloudflared, wait_tunnel_ready, check_tunnel_not_connected
+
+
+# Sanity checks that test that we only run Proxy DNS and Tunnel when we really expect them to be there.
+class TestProxyDns:
+    def test_proxy_dns_with_named_tunnel(self, tmp_path, component_tests_config):
+        run_test_scenario(tmp_path, component_tests_config, CfdModes.NAMED, run_proxy_dns=True)
+
+    def test_proxy_dns_with_classic_tunnel(self, tmp_path, component_tests_config):
+        run_test_scenario(tmp_path, component_tests_config, CfdModes.CLASSIC, run_proxy_dns=True)
+
+    def test_proxy_dns_alone(self, tmp_path, component_tests_config):
+        run_test_scenario(tmp_path, component_tests_config, CfdModes.PROXY_DNS, run_proxy_dns=True)
+
+    def test_named_tunnel_alone(self, tmp_path, component_tests_config):
+        run_test_scenario(tmp_path, component_tests_config, CfdModes.NAMED, run_proxy_dns=False)
+
+    def test_classic_tunnel_alone(self, tmp_path, component_tests_config):
+        run_test_scenario(tmp_path, component_tests_config, CfdModes.CLASSIC, run_proxy_dns=False)
+
+
+def run_test_scenario(tmp_path, component_tests_config, cfd_mode, run_proxy_dns):
+    expect_proxy_dns = run_proxy_dns
+    expect_tunnel = False
+
+    if cfd_mode == CfdModes.NAMED:
+        expect_tunnel = True
+        pre_args = ["tunnel"]
+        args = ["run"]
+    elif cfd_mode == CfdModes.CLASSIC:
+        expect_tunnel = True
+        pre_args = []
+        args = []
+    elif cfd_mode == CfdModes.PROXY_DNS:
+        expect_proxy_dns = True
+        pre_args = []
+        args = ["proxy-dns", "--port", str(constants.PROXY_DNS_PORT)]
+    else:
+        assert False, f"Unknown cfd_mode {cfd_mode}"
+
+    config = component_tests_config(cfd_mode=cfd_mode, run_proxy_dns=run_proxy_dns)
+    with start_cloudflared(tmp_path, config, cfd_pre_args=pre_args, cfd_args=args, new_process=True, capture_output=False):
+        if expect_tunnel:
+            wait_tunnel_ready()
+        else:
+            check_tunnel_not_connected()
+        verify_proxy_dns(expect_proxy_dns)
+
+
+def verify_proxy_dns(should_be_running):
+    # Wait for the Proxy DNS listener to come up.
+    sleep(constants.BACKOFF_SECS)
+    had_failure = False
+    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    try:
+        sock.connect(('localhost', constants.PROXY_DNS_PORT))
+        sock.send(b"anything")
+    except:
+        if should_be_running:
+            assert False, "Expected Proxy DNS to be running, but it was not."
+        had_failure = True
+    finally:
+        sock.close()
+
+    if not should_be_running and not had_failure:
+        assert False, "Proxy DNS should not have been running, but it was."

component-tests/test_reconnect.py

@@ -6,6 +6,7 @@ from time import sleep
 import pytest
 from flaky import flaky
 
+from conftest import CfdModes
 from util import start_cloudflared, wait_tunnel_ready, check_tunnel_not_connected
 
 
@@ -27,8 +28,7 @@ class TestReconnect:
     def test_classic_reconnect(self, tmp_path, component_tests_config):
         extra_config = copy.copy(self.extra_config)
         extra_config["hello-world"] = True
-        config = component_tests_config(
-            additional_config=extra_config, named_tunnel=False)
+        config = component_tests_config(additional_config=extra_config, cfd_mode=CfdModes.CLASSIC)
         with start_cloudflared(tmp_path, config, cfd_args=[], new_process=True, allow_input=True, capture_output=False) as cloudflared:
             self.assert_reconnect(config, cloudflared, 1)
 

component-tests/test_service.py

@@ -8,6 +8,7 @@ from pathlib import Path
 import pytest
 
 import test_logging
+from conftest import CfdModes
 from util import start_cloudflared, wait_tunnel_ready
 
 
@@ -34,7 +35,7 @@ class TestServiceMode:
             "hello-world": True,
             "logfile": str(log_file),
         }
-        config = component_tests_config(additional_config=additional_config, named_tunnel=False)
+        config = component_tests_config(additional_config=additional_config, cfd_mode=CfdModes.CLASSIC)
 
         def assert_log_file():
             test_logging.assert_log_in_file(log_file)
@@ -52,7 +53,7 @@ class TestServiceMode:
             "loglevel": "debug",
             "log-directory": str(log_dir),
         }
-        config = component_tests_config(additional_config=additional_config, named_tunnel=False)
+        config = component_tests_config(additional_config=additional_config, cfd_mode=CfdModes.CLASSIC)
 
         def assert_rotating_log():
             test_logging.assert_log_to_dir(config, log_dir)

connection/observer.go

@@ -111,6 +111,13 @@ func (o *Observer) sendConnectedEvent(connIndex uint8, location string) {
 
 func (o *Observer) sendURL(url string) {
 	o.sendEvent(Event{EventType: SetURL, URL: url})
+
+	if !strings.HasPrefix(url, "https://") {
+		// We add https:// in the prefix for backwards compatibility as we used to do that with the old free tunnels
+		// and some tools (like `wrangler tail`) are regexp-ing for that specifically.
+		url = "https://" + url
+	}
+	o.metrics.userHostnamesCounts.WithLabelValues(url).Inc()
 }
 
 func (o *Observer) SendReconnect(connIndex uint8) {

connection/observer_test.go

@@ -6,9 +6,28 @@ import (
 	"testing"
 	"time"
 
+	"github.com/prometheus/client_golang/prometheus"
+	dto "github.com/prometheus/client_model/go"
 	"github.com/stretchr/testify/assert"
 )
 
+func TestSendUrl(t *testing.T) {
+	observer := NewObserver(&log, &log, false)
+
+	observer.sendURL("my-url.com")
+	assert.Equal(t, 1.0, getCounterValue(t, observer.metrics.userHostnamesCounts, "https://my-url.com"))
+
+	observer.sendURL("https://another-long-one.com")
+	assert.Equal(t, 1.0, getCounterValue(t, observer.metrics.userHostnamesCounts, "https://another-long-one.com"))
+}
+
+func getCounterValue(t *testing.T, metric *prometheus.CounterVec, val string) float64 {
+	var m = &dto.Metric{}
+	err := metric.WithLabelValues(val).Write(m)
+	assert.NoError(t, err)
+	return m.Counter.GetValue()
+}
+
 func TestRegisterServerLocation(t *testing.T) {
 	m := newTunnelMetrics()
 	tunnels := 20

connection/protocol.go

@@ -172,7 +172,10 @@ func NewProtocolSelector(
 
 	http2Percentage, err := fetchFunc()
 	if err != nil {
-		return nil, err
+		log.Err(err).Msg("Unable to lookup protocol. Defaulting to `http2`. If this fails, you can set `--protocol h2mux` in your cloudflared command.")
+		return &staticProtocolSelector{
+			current: HTTP2,
+		}, nil
 	}
 	if protocolFlag == HTTP2.String() {
 		if http2Percentage < 0 {

connection/protocol_test.go

@@ -158,7 +158,8 @@ func TestNewProtocolSelector(t *testing.T) {
 			protocol:          "unknown",
 			fetchFunc:         mockFetcherWithError(),
 			namedTunnelConfig: testNamedTunnelConfig,
-			wantErr:           true,
+			expectedProtocol:  HTTP2,
+			wantErr:           false,
 		},
 	}
 

github_release.py

@@ -197,25 +197,6 @@ def upload_asset(release, filepath, filename, release_version, kv_account_id, na
     except shutil.SameFileError:
         pass # the macOS release copy fails with being the same file (already in the artifacts directory)
 
-def compile_regex() :
-    # The capture groups are:
-    # 1: the text cloudflared
-    # 2: compiled architecture
-    # 3: possible extensions
-    capture_string = r'(cloudflared).+(amd64|x86_64|386|arm)(\.msi|\.deb|\.rpm|\.exe)?'
-    return re.compile(capture_string)
-
-def extract_filename(regex, filename):
-    match_groups = regex.match(filename)
-    os = "linux"
-    name = match_groups.group(1)
-    arch = match_groups.group(2)
-    ext = match_groups.group(3)
-    if ext in ['.msi', '.exe']:
-        os = "windows"
-    return "{}-{}-{}{}".format(name, os, arch, ext if ext is not None else "")
-
-
 def main():
     """ Attempts to upload Asset to Github Release. Creates Release if it doesnt exist """
     try:
@@ -229,11 +210,9 @@ def main():
             return
 
         if os.path.isdir(args.path):
-            regexp = compile_regex()
             onlyfiles = [f for f in listdir(args.path) if isfile(join(args.path, f))]
             for filename in onlyfiles:
                 binary_path = os.path.join(args.path, filename)
-                filename = extract_filename(regexp, filename)
                 upload_asset(release, binary_path, filename, args.release_version, args.kv_account_id, args.namespace_id,
                 args.kv_api_token)
         else:

tunnelstore/filter.go

@@ -25,6 +25,14 @@ func (f *Filter) ByName(name string) {
 	f.queryParams.Set("name", name)
 }
 
+func (f *Filter) ByNamePrefix(namePrefix string) {
+	f.queryParams.Set("name_prefix", namePrefix)
+}
+
+func (f *Filter) ExcludeNameWithPrefix(excludePrefix string) {
+	f.queryParams.Set("exclude_prefix", excludePrefix)
+}
+
 func (f *Filter) NoDeleted() {
 	f.queryParams.Set("is_deleted", "false")
 }